Finding Hidden Startup Programs in Windows: Ultimate Guide

Sponsored: The first 100 people to go to blinkist.com/ThioJoe get unlimited access for 1 week to try it out! You’ll also get 25% off if you want the full membership.
Windows Sysinternals: docs.microsoft.com/en-us/sysi...
The Sysinternals live shortcut: \\live.sysinternals.com@SSL\DavWWWRoot
▼ Time Stamps: ▼
0:00 - Intro
0:45 - Task Manager
2:26 - Startup Folders
3:48 - Truly Outstanding Message
5:03 - Registry Entries
5:52 - Services
7:35 - Task Scheduler
8:09 - Autoruns: What is it? + WARNING
9:19 - How to Get Autoruns
10:36 - Autoruns: Basics, Logon, Scheduled Tasks
12:44 - Autoruns: Services
15:16 - Autoruns: Drivers, Codecs, Office, IE, Explorer
16:18 - Autoruns: More Features & Usage
17:26 - Autoruns: Scanning with VirusTotal
19:19 - Autoruns: Verified Publishers

[@ThioJoe]

Sponsored: The first 100 people to go to blinkist.com/ThioJoe get unlimited access for 1 week to try it out! You’ll also get 25% off if you want the full membership.

[@bork7430]

Early again

[@cycrothelargeplanet]

@@bork7430 cool

[@harvey7820]

3rd reply

[@i_am_the_one4587]

The steam thing which you say takes 4 minutes is 4 sec since it is 258 ms

[@BARAAGAMER_YT]

You're creative keep going✨✨✨✨✨.. Sender:your brother (Baraa) from Palestine 🇵🇸🇺🇲

[@actibase498]

I love how he just randomly started giving actual helpful information and didnt tell anybody

[@goblinsmoker]

When did he stop doing the joke videos haha. I just remember when he used to do that

[@azmc4940]

He did make an announcement video about it tho

[@DeputyFish]

he did announce it a while ago

[@jrandesi56]

Like 3 years ago

[@johnsmith8981]

He's been a legit tech channel for a while. This channel is basically "learn tech stuff with Thio Joe."

[@v1nc325]

I swear ThioJoe made a 180 in his youtube career. I still remember a couple years back when he only made scammy content and was despised by a lot of people. It's genuinly great to see him making ACTUALLY useful content, and in a straight to the point fashion. Props to him!

[@ThioJoe]

Also i don't know why it says 2100 seconds bios time, it definitely doesn't take that long

[@creepybeat]

Steam really takes a while to start, Epic Games launcher is faster !

[@pythondrink]

No likes? Here's one for u haha

[@creepybeat]

@@pythondrink second is mine xD

[@darwisyaiman1865]

Installing update i guess🤔

[@Gamer-ct6hb]

14th likeeeee btw why is he a member of his own channel?

[@YouVidTuber]

The "CPU at Startup" time in the task manager is just talking about CPU time, it doesn't necessarily mean how long it took for the program to start up, but rather how long the CPU was working on that task, which usually goes outside of the computer's actual startup time

[@ColRealPro]

last bios time: 2000 seconds, whoa you got some slow startup

[@ThioJoe]

Yea idk why it said that. I just looked again and this time it says 45 seconds

[@pyreouss]

@@ThioJoe that’s still pretty slow

[@nextdaydelivery7989]

@@ThioJoe yeh mines like 9.7 secs. You on a hard drive?

[@wohao_gaster7434]

@@pyreouss Mine was 5 minutes, after updating it's less but it's still long and every time I log in it automatically opens the OOBE(PC login)

[@pyreouss]

@@wohao_gaster7434 mine is like 3 seconds on a hard drive, because i only have my undervolting software (ThrottleStop) and Intelligent Standby List Cleaner open on startup

[@ricogoins]

Yay I love thiojoe videos, especially long ones. I cant wait to watch it

[@mine_craftpro]

same

[@SamuelViagus]

And when he uploads yesterday and today

[@TheGraphicsgriffin]

Me too!

[@benzykaram]

Yes, really love the in-depth long form he's been uploading.

[@koduflower2000]

same thing for me

[@t-ree]

You know its a wholesome day when Thio uploads

[@Passionate747]

I want to extend my heartfelt gratitude for your invaluable assistance in navigating the intricacies of Windows 11. Your expertise in disabling startup programs has significantly streamlined my system's performance, saving both time and frustration. Your patience and clear instructions made the process seamless, empowering me with newfound knowledge. Your dedication to ensuring my technological experience is smooth and efficient is truly commendable. I'm immensely grateful for your support and guidance. Your professionalism and skill have made a world of difference. Thank you for your outstanding service.❤

[@rzerobzero]

50 yr old IT guy here and I never had a program slip a "start on boot" program into Task Scheduler......until today. Thank you for helping me find that and for all the other useful info in this video.

[@_SJ]

Another quality and well-detailed content. You deserve more subscribers 🙂

[@nawarelsabaa]

This was a very useful video. I really like the direction you are taking the channel, Thio. Keep it up!

[@prowler1567]

A truck load of information of which I will have to come back to for how to do reference. Very helpful for checking system when for some reason it has slowed in performance. Thanks Joe.

[@mar8925]

Thank you ThioJoe for making great sources into understanding the complexities of the windows operating system.

[@sudipnath514]

That "stock photo searched" is really awesome. Keep it up!

[@flabbinpappy1820]

You are the man!! This is invaluable when a computer is slow. Thanks for the content, keep it up!

[@grayfool]

Thanks man, this answers a lot of questions. Really helpful.

[@kahuna1247]

This was very helpful. It helped me remove a shortcut in the start-up folder added by an app update with no option to remove it in the app settings.

[@DerMaikNichJa]

That’s helpful. Using windows for ages I was not aware about the details available in the task manager

[@Gersonzao]

For the VirusTotal scan feature, it doesn't mean much, typically malicious services/startup programs use other files to run its malicious behaviour. I would recommend to also manually analyze the files in the folder the service/startup program is in and also in its parent and child folders (mainly .dll and .exe files)

[@krisch7]

"Truly Outstaning Message" in the chapters section is legit helpful! XD

[@davidmg1925]

"......on the "innernet........"" (??) Yes, I'm not sure where D's and T's go.....

[@flicka25]

You make a lot of sensible videos....things we really can us. TY

[@samrat9075]

this channel is the best tech channel in terms of knowledge thiojoe provides

[@BBWahoo]

This is really good for removing any potential viruses hidden in your computer!! Thank you

[@oneandxero]

ahh thankyou so much brother. i only use the task manager and task scheduler for managing startup apps but now I'll check all of them..

[@michaelbrown7148]

Thanks! Very informative.

[@donjon7554]

You are an awesome person. So humble and so helpful!

[@LostInThe0zone]

This is great stuff. I particularly liked the pointer to the sysinternals live update folder. Have you ever done a presentation on sysinternals?

[@maiamaya6083]

Very useful video, thanks mate

[@b.tulsirao7724]

tons of thanks...very useful video.. Cheers

[@donjon7554]

I don't know how You do it but Your videos are always helpful and somehow you know when I have a problem you will come with a solution to that very same problem like you were a mind reader. You're awesome!

[@thomaspedersen6442]

This is a very informative video! Thank you.

[@jacquesdelmelle8118]

You are a genius ThioJoe. Thanks a lot!

[@alonzosmith6189]

Wow, have not used Sysinternal sense my desktop support days. Thanks for sharing

[@johnsavard7583]

Perhaps the most useful video ever posted to KZbin!!!!

[@davinp]

When you install some programs/applications, they will add themselves to the startup folder. Also, some but not all have an option in the program settings to stop it from opening at Windows start up

[@devnol]

2:05 those aren't thousand delimiters, they are commas. It says it takes 258ms of cpu time on startup plus change. That's not real world time that's how many clock cycles it uses divided the clock speed. Cpu times is measured in microseconds and thus task manager shows decimal ms

[@triparadox.c]

It is thousand delimiter. Lol at the 2.4 MB on the left side.

[@BluesChoker01]

First, remember that numeric magnitude calculations are *completely* independent of any units of measure that we humans decide to attribute to them. While we don't want to convert units of time to units of distance, we can surely convert milliseconds to minutes or hours. 😃The column with ThioJoe's long startup rascal is labeled with the ISO designation for milliseconds and there's no reason to doubt that. So, we have 258,842 milliseconds of CPU elapsed time as recorded by the startup logger. Note that the magnitude is simply a number: (2x10^5) + (5x10^4) + (8 x 10^3) + (8 x 10^2) + (4 x 10^1) + (2 x 10^0) (200,000 + 50,000 + 8,000 + 800 + 40 + 2) 258,842 Looks good, so now we can attach our units to this number: 258,842 ms. Sure, we could do the conversions in our heads, but it doesn't look too bad written out with the standard keyboard and not Wolfram symbols: (258,858 ms) x (1 sec / 1000 ms) = (259 sec) x (1 min / 60 sec) = (4.4 min) x (1 hr / 60 min) = 0.073 hr OK, that's how you do this part. For these CPU measurements, we just wanted the relative CPU elapsed times for all the processes in order to compare the values with other values in our startup task survey. But if you want to examine how we measure CPU timings, these are dependent upon a fast natural oscillator, such as a crystal excited by a small amount of electric current. Atomic clocks aboard fleets of GPS satellites use the incredibly accurate and stable cesium atomic clocks whose oscillation frequencies are produced when cesium atoms are excited using photon beams at certain frequencies. It seems clear that the next major breakthrough in CPU and bus architecture will switch from using electric current from electrons, which have mass, to massless photons that move across some kind of glass fiber bus architecture. We're approaching the limits of how small we can make transistors that require copper and electrons--they're fast, but not as close to light speed as massless photons over fiber optics. Regardless, that's a completely separate issue from how we measure the usage of CPU instructions by code. I've actually built synthetic benchmark programs for the US EPA's National Computer Center headquarters in Research Triangle Park, NC. A little context for those unfamiliar with this area. The RTP is located equidistant from Duke University, UNC Chapel Hill and North Carolina State University. These benchmarks were later modified and used in the EPA's 10 regional office Computing Centers around the US, of which Washington DC was considered Regional Computing Center One. The point was to develop models that reflected the kinds of workloads the different EPA Program Offices used (e.g., Air and Radiation, Water and Aquifers, Permit Compliance, and the rescue heroes in the HazMat suits from Superfund). Anyway, we had other modeling software from vendors as well but the objective was to connect increases in work that the Offices understood to hardware and software that we understood, to budgets which everyone understood. After a few years of refining the process, the Congressional Committees responsible for Agency budget approval saw that we didn't guestimate but nailed our requirements without the silly games assuming padding by us and chopping by them. That really made everyone's job easier and a lot more fun. One unexpected result was the referrals to other organizations who needed help getting up to speed in this area. Man did we get loaned out to a bunch of places with three acronyms. Didn't get paid much extra for this but damn the work was fun. This kind of modeling requires understanding the instruction distribution profiles of the specific programs driving the majority of the overall system workload growth (not to mention memory usage patterns, I/O usage, interrupts to the operating system kernel, etc.). There's no point in buying an awd, hybrid 850 HP Porsche that can whip an 1100 HP RWD engine-only MacLaren in lap times around Laguna Seca Raceway if what you need is a truck with 1000 lb-ft of low RPM torque that can pull a house off its foundation. 😃 But the problem with these deep CPU measurements is that they require custom hardware probes to record these events occurring at incredible speeds--often concurrently on different processors, especially without affecting the performance of what you're trying to measure. It's not much different than trying to catch quantum events at the atomic level; the light wavelengths short enough to reflect off an atomic nucleus proton or neutron, much less a much smaller electron, have frequencies in the X-Ray or even Gamma Ray range--and they will definitely affect their targets, even when using stream of individual photons. So, it's not an easy or inexpensive task to accomplish. That said, it's often a good strategy to use simpler software monitors to record process CPU active or elapsed wall clock time. Real world time. 😃 Sometimes you just don't need the kind of detail folks think you might, but rather the general relationships and idiosyncrasies of a particular system. Also don't forget that the advertised performance specs of the CPUs that the major vendors use is a bit like the automobile industry's advertised brake horsepower and torque numbers. It's not that they are bad or useless numbers. But all auto makers measure the power output of their engines or motors on an idealized test dyno when the powerplant isn't even in a car. Well, imagine testing it after the cars are assembled. So, I understand why they test samples this way or they'd never move as much product. If purchase a car and then modify it, of course there is no need to remove stuff to test it. So, you rent some time on a different measurement device that records the power where the rubber hits the dyno. That's really all you need to learn--did my changes make it to the drive wheels. Now, what the CPU manufacturers measure is the two sides of the same coin: oscillations per second in Hertz, and the reciprocal number, which is called the cycle time per unit of time. The second measurement is often thought of as the shortest theoretical period of time in which a CPU can execute an instruction that takes only one CPU cycle to complete. LOL, the Planck CPU time. 😃 Thus, if we measure the most number of stable CPU cycles per second in Hertz units to be 5.0 Gigahertz, this is equivalent to 5.0 billion CPU cycles per second. That could be considered the greatest number of instructions possible in one second. However, most instructions take more than one instruction cycle, some as many as 10 to 20 CPU cycles. Branch prediction cache logic, data caches, multiple pipelines, super pipelines and all sorts of nifty things can increase throughput. Still the number is useful. Knowing that our CPU can execute at 5 Gigahertz or 5.0 billion cycles/second, we use the reciprocal value to determine the CPU has a cycle time of 0.2 nanoseconds per cycle. 5.0 gigahertz 5,000,000,000 cycles/sec CPU cycle time = 1 sec / 5,000,000,000 cycles = 0.0000000002 sec/cycle = 0.2 ns/cycle That's how you do this part. Cheers

[@chhavimanichoubey9437]

i know engagement in your channel is dropped when you started giving priority to quality educational content instead of clickbait garbage videos, but we educated audience is with you all the time.

[@rockastley8083]

U just helped me so much thank u joe

[@BsktImp]

Thanks ThioJoe. Can you do a video on getting rid of all the temporary and installation files, cabs and folders etc that take up so much space but hide in hidden folders and/or folders/files with long alphanumeric names (even after clearing cache, disk cleanup, browser history deletion)? Oh and another one on properly configuring firewalls (open ports etc)?

[@kowhaifan1249]

Dude just get a program to do that for you.

[@ruukes4770]

Yes solve first issue: ccleaner solve second issue: adgaurd

[@mignexus]

Amazing video! Congratulations!

[@coolguy-hu4ou]

this video is actually very helpful, thanks

[@rajaram69]

I really needed this one.

[@thomasjarvis7984]

Brilliant, Thanks Joe

[@ThePowerRanger]

Thank you so much for this!!

[@doomelements4679]

A very detailed video which is actually useful.

[@janjurcik1746]

Amazing video this one! Thank you.

[@nadir4333]

You are the best ThioJoe now my laptop is not slow anymore , although I have 8 gb ram !

[@knowledgeispower5122]

Awesome info thanks

[@privacyadvisor]

This is QUALITY CONTENT! 🔥

[@batarasiagian9635]

Strongly agree. The type of information that makes the internet worthwhile.

[@ruukes4770]

Second comment woot woot

[@FrederikWoellert]

Your Videos are amazing keep it up.

[@Bob-The-Guy]

Thanks for the tip on on Autoruns! It helped me find a driver that was loading that I could not see otherwise and remove it! Tricky Asus install of Asus System Control Interface that I wanted gone but could not figure out how to uninstall it permanently until Autoruns showed this hidden driver.

[@tixds]

Helpful!

[@DragonKastle]

Great video!

[@avvn9331]

Very useful information

[@StackoTra]

damn, this method actually lowered my laptop BIOS time from 13.8s to 8.2s. thank you!

[@semprocarnage]

Thanks for this video thio, this was the reason that while my pc used only 2gb ram after boot, my lap used 4gb ram. Dell background apps were eating memory which I was unable to find even in services.msc menu

[@konso1]

:O THE COMMAND LINE SECTION IN TASK MANAGER! THANK YOU!

[@stevenrowe5047]

well TJ i am sure that there are people out there that know what you are saying. i have no idea what you are talking about. but i will keep watching and maybe learn something. keep it up.

[@sudhanvagr]

Stunning 👍

[@jackkraken3888]

Autoruns (along with some other excellent tools) was made by Mark Mark Russinovich when he was working in I believe Winternals then Microsoft bought WInternals and therefore become the owners of Autoruns and the entire sysinternals toolkit. Also Microsoft has a weird ability to mess up good things they are involved in.

[@kowhaifan1249]

At Least they ran minecraft well

[@Zempest]

@@kowhaifan1249 some what well

[@russianyoutube]

@@kowhaifan1249 yes and no

[@cycrothelargeplanet]

Great video 👍

[@cycrothelargeplanet]

Thx for the heart (edits remove the heart)

[@karbis]

This is so coool thiojoe good video

[@kenb4849]

Do you know of any tools or profiles that can reset my Windows Services settings to a common default as I have run a few 'optimizers' that may have done a few too many opt-ings. I know that I can do your 'In-Place' Windows restore, which may be my best solution, but wanted to know if there was such a 'Services-Resetting' tool that might be available. Thanks for all of your great content, Ken.

[@3r-plusllc549]

It looks like Thio is changing from been a little kid posting pranks and finally he giving some useful information..!!

[@Fllyzwtf]

Yay a new upload!

[@ankitmohapatra689]

THANK YOU!

[@xDB8x]

7:18 ye, for example TeamViewer service starts up automatically for some reason, even though the program itself is not allowed to startup automatically. And I have to keep changing that to manual on each update

[@devu4240]

Informative

[@blueheron99]

Thx thio

[@CaiDoZHD]

Quality content. Not enough views.

[@fazed343]

Literally just looked this up to help disable Origin Web Helper Service and thats the example you use LOL Talk about providence!

[@daleryanaldover6545]

This is just what I need, the pc at the office has been plagued by csrss.exe and a bunch of rat viruses. I knew some of the startup locations like Task scheduler, and registry but the damn virus keeps on going back. It might be hiding on another user's registry for all I know. Thanks Thio, definitely gonna check Mark's video about malware hunting.

[@ronaldoliver1700]

Thank you

[@pyp2205]

Well that explains why Discord on my Cisco computer kept on opening, when the computer was starting up. I just went into the Discord settings to disable start on startup.

[@videosmarcotitulos4841]

*Very Good*

[@alnoorratansi9364]

Hi Great video, can you talk about the yellow highlighted entries, can they be deleted ? It says program not found

[@Ceno-wn3wf]

thx bro

[@merbudd]

0:51 last bios time 2143 seconds wtf? I know the comment Thio himself made about it but that is literally 35 minutes holy sh**!

[@jamespiercehd720p8]

Biggest fan of you

[@FallenStarFeatures]

An important thing to know about Startup apps: The Startup Settings page Windows 11 shows you defaults to running apps located in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup. While this works, it runs the original .EXE file without any command line arguments. If you want Windows 11 to start up a Shortcut with its own command line options, you need to put that Shortcut in your User Account's AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup folder.

[@royalkumar795]

1:01 wtf why is last BIOS time showing 2143.8 Sec where most of computer is 4-8 sec , Is something wrong on your computer ?

[@fragalot]

Holey mother of gawd, this is amazing.

[@OrloxPhoenix]

17:05 threatening Airdrop 3 with the delete option to assert dominance 😂👍🏼

[@whereami2884]

Can i ever say: "Now i know everything about Windows!" ?

[@kritharthgoel8893]

Thio can you make a video on does windows 11 makes your pc slower in all (Boot time, app opening time etc.) (On a device which meets the minimum requirements for windows 11)

[@fikerfiker7922]

Thankyou

[@kelvin4782]

Thio joe knows aloat about windows....he's like a windows developer

[@whatzause]

Question: Windows 10 Pro: on every bootup, even after my desktop icons fill the screen, the boot is still not obviously complete because there is a tiny blue circle rotating near or at the mouse pointer. That little circle comes and goes intermittently until it finally stops for good. At that point (for example) your “connect” to online will STAY, and other operations will work better. I would like it if a pop up would appear, say in mid screen, saying “bootup is complete.” This has to be a 3rd party job I think, but it’d still be nice. On my XP machines, clicking “status” under the network (or connectivity “antenna” icon) shows a “disable” option even though at bootup on my system it is already disabled. A little white square appears on the taskbar near that icon, and DISAPPEARS, when the computer is fully booted. Clicking status then says “ENABLE” like it should have in the first place, and I know there will be no more waiting for the boot actions to finish. (That’s just to give you an example in XP, of a way to determine what I am looking for in WIN10.)

[@arovilpradhan668]

Hi thiojoe, your contents are cool and I love it but the most important thing here is how did you customise your windows start menu icon can you please share it as I saw in very rare tech videos who have done like and when searched in google unrelevant articles appear. A hint is also appreciated so that I can search it myself

[@andypaunov8109]

That taskmgr context menu... Big shoutout. I just love these context menus popping out of nowhere... Right-click on the Run dialog to see what I'm talking about. And if you want to go to shell:::{437ff9c0-a07f-4fa0-af80-84b6c6440a16} ("Command folder"), you can Invoke icon size commands if you wish to. Not that it does something...

[@crazynuts5414]

I love that windows tool

[@puneetmaheshwari]

thankyou

[@DavidGarcia-nz3sw]

Where I work as desktop support, our computers are issued with a number of startup programs that slow down boot times and general performance. We use to disable them through task manager, and this required using elevated credentials. Recently we’ve been seeing computers that will only show startup programs in Task Manager when logged in with a standard user account, but when running Task Manager with elevated permissions the list of startup programs disappears. Someone told me it was because these applications were common programs meant for all users, and as such were probably launching from the “common startup” folder, but when I navigate to the common startup folder it’s empty. Where could I disable these programs to prevent them from starting up? Thanks for any tips. P.S. It just occurred to me that I’ve never tried to navigate to the common startup folder when logged in with elevated permissions. I’ve only tried seeing the common startup folder under a users standard account. Maybe that’s been the problem.

[@JordanIdk]

Arr, I see that Sonarr/NZBGet.

[@ThioJoe]

Don't forget Radarr

[@aubymori1333]

thanks

[@lovell8983]

Can anyone help me out? I installed UltraViewer from it website, nothing special. But I don't want it to startup with windows10 so I uncheck the box in UltraViewer settings and also in task manager. But it still autostarts every time I turn on my computer

[@tvuser1]

You can reverse autoruns with a bootable usb drive for most entries, a decent boot usb diag disk, or backup registry first.

[@fbi47agent76]

thx man i cant find some startup softwares on startup list of msconfig

[@deltaindiabravo]

oh my goodness 😎 just stumbled over this video and noticed that somehow his Speaking-CPU runs like rocket-fast. 😂😂 as a non native english person, I had a hard time keeping track. Besides this .. he makes good and usefull content. 👍