Microsoft cloaks AutoRuns in a little bit of mystery

Microsoft’s Sysinternals monitoring suite has just been updated, with a new version of AutoRuns that every Windows user needs. There’s something of a mystery surrounding the update, but it would behoove you to download it now.

Sysinternals, as you probably know, was the brainchild of Windows internals legend (and action adventure novelist) Mark Russinovich and Winternals Software co-founder Bryce Cogswell. Microsoft bought the company and hired Russinovich in 1996, and has distributed free updates to Sysinternals ever since. The Sysinternals package includes several monitoring tools — including Process Monitor, which watches access to the Registry and files — but AutoRuns has always been the most popular.

AutoRuns scans a PC and lists every single program that’s rigged to start automatically. On most computers, the list’s lengthy — and sobering. Of course AutoRuns detects programs that start on boot up and logon — looking at all the obvious and not-at-all-obvious Registry keys and folder locations — but it also tells you about automatically starting drivers, Internet Explorer add-ons and browser helper objects, Explorer shell extensions … and many things you probably never imagined.

AutoRuns not only lists the auto-running programs, it lets you turn individual programs off. There are many minor features, including the ability to filter out Microsoft-signed programs, a quick way to jump to folders holding auto-starting programs, and a command-line version that lets you display file hashes.

AutoRuns doesn’t require installation. It’s a program that runs and collects its information, displays it (with a rather rudimentary user interface), lets you wrangle with your system, then fades away.

Here’s the mystery.

Every time Microsoft updates AutoRuns, it omits a little piece of important information: It doesn’t say what’s been added to the auto-detection scan. This time, we’re informed that AutoRuns 11.1 “adds several new autostart locations” to its scanning regimen, but there isn’t a breath about what locations those might be.

I’m convinced that Russinovich and Microsoft intentionally refrain from disclosing where they’re poking to find auto-running applications because they don’t want to make it easier for system crackers to squirrel away their unwanted programs.

Undaunted, I put AutoRuns 11.0 next to AutoRuns 11.1 and checked. They both run side-by-side, no problem. On my production systems, and a couple of lesser machines — even one PC running Windows 8 Developer Preview — I found exactly no difference in the reported autorunning programs. So I’ll have to take Microsoft’s word for it that there are newly discovered nasty apps out there that haven’t yet invaded my PCs.