Windows Sysinternals: Autoruns and Process Explorer

Autoruns and Process Explorer. These are two very strong programs that have been around, hiding for quite some time. While they can serve many useful purposes, I have been using them for a year or two to manually remove malware/spyware infections on Windows machines.



Autoruns:
Autoruns is essentially a very advanced version of msconfig which many users use to change their startup settings. It lists all startup programs, as well as explorer extensions, toolbars, Winlogon notifications, services, broser helper objects and much more. Next to everything listed is its location in the Windows registry, which can be double clicked to open regedit to that location.
It also provides very useful features such as verifying and hiding signed Microsoft entries, leaving you with only a list of possibly unwanted objects. This is a fantastic way to pinpoint any malware or spyware that may be hiding from you.

Process Explorer:
While Autoruns is comparable to an over-achieving msconfig, Process Explorer is basically an overflowing keg of your typical task manager. This program will show you all your running executable files, like taskmanager does, and includes every DLL and subprogram each is using. It allows you to pause running processes which is another very useful tool for stopping malicious software. Hunt down the specific DLLs that you've found are running from Autoruns, pause the EXE that is running them, and delete all traces of that software. When you delete the DLL there will no longer be a trail of hiding copymachines spewing out malware after malware. Of course there are many other uses for this program, as it also shows memory addresses and possible faults, and a very detailed system monitor.

These programs are more than just unitasking tools. They are great for just learning how Windows run programs, and I suggest downloading them and playing with them a bit to see what all is possible.

You can find out more information and download them here: Autoruns | Process Explorer