WinPatrol: Startup Programs

WinPatrol's top feature is how it monitors and allows you to review the programs that automatically launch when you start Windows. Any type of program determined to infect your system will most likely appear on Startup Programs list. This list is essential to detecting nasty software such as trojans, worms, spyware, adware or other programs that may insert themselves into your PC's auto-startup locations. 

The first time you run WinPatrol Scotty the Watch Dog will review a list of these special Startup Programs. The startup commands for these programs can be found in the Windows Registry, the WIN.INI file, your Windows Startup Folder, within some system files and other internal system areas. 

Many of the programs you see in the Startup Programs list may have come pre-installed by your computer manufacturer. Others may have been installed at a later point by spyware, adware, or some other malicious program. Whenever a new program is added to the Startup Programs list, Scotty will warn you of the change. You will then see the name of the new program and can decide if this program is ok, or if it is suspicious.

Configuring Startup Programs

In addition to the main list of Startup Programs, WinPatrol includes several buttons to help you get more information about the programs that start with Windows and configure them as you see fit.

"Monitor"
This button allows you to configure how frequently Scotty checks the Startup Programs list for changes. You can set this frequency in minutes, and even set it to 0 minutes to disable checking of the Startup Programs list entirely.

PLUS users also have the option to monitor Startup programs in real-time using the monitor image button.

"Info..."
WinPatrol provides additional information on Startup Programs, including the company that created the program file as well as the program version. Most legitimate files will usually include copyright and company information that can be displayed by WinPatrol, but not always. When it does exist, this information will help you decide if the program is a valid program or not and whether you want to Remove or Disable it (see below).

As it is often difficult to tell just from a file name or company name whether a program is legitimate, you can click the Free Info... button to review a list of common, well-known malicious programs on the WinPatrol web site. PLUS members can click the PLUS Info... button to search the online WinPatrol database for more information on the specific program itself.

"Reset"
You may notice some new Startup programs which aren't listed by most Startup programs. These are undocumented registry locations which Spyware has been known to use to infect your system.
Scotty will monitor these locations and in some cases will allow you to Reset your computer back to their original settings and remove the Spyware additions.

"Remove"
This button will not delete any programs from your hard drive. Instead it will remove only the entry for that program in the Startup Programs list, preventing the program from restarting every time your system does. If the program is currently running, the Remove button will also allow you to shut down it down.

"Disable"
When you disable a program in WinPatrol it will automatically be removed. It will also be removed whenever it is detected in the future. 

This feature can be handy because some programs have a bad habit of returning after they have been removed from the Startup Programs list. For example, we discovered many programs like QuickTime, RealPlayer, and MSN Messenger who think they're so important they put themselves in the Startup Programs list every time they run.

Just leave these programs as disabled and Scotty will remove them for you every time they reappear. If you want to Enable them in the future, click to select the program and the "Disable" button will automatically change to "Enable."

"Add"
This button allows you to Add a new program to the list of programs that will always start when you reboot or logon to your computer. When you click Add you'll see the standard Windows Open dialog which will allow you to navigate to the folder where your program is located.


"Close"
 To close or Exit the WinPatrol tab interface click the X in the upper right hand corner or the Close button. WinPatrol will continue monitor changes but the main interface will be removed from memory.

Dealing with Stubborn Programs

If you notice a Startup Programs entry keeps coming back after you disable or remove it, you should take a peek at the Active Tasks currently running. Sometimes malicious programs will come in pairs or groups that protect each other to prevent you from removing them. In such cases, you will want to find all the suspicious tasks on the Active Tasks list and use the Kill Task feature to shut down each one before removing the suspicious entry from the Startup Programs list.

  • First, close down all the applications that you know about.
  • Click the Active Tasks tab to check what programs are still listed.
  • You may see multiple suspicious programs. Some may have what look to be randomly created filenames.
  • Hold down the CTRL key to select several tasks at once and click on each suspicious task.
  • Click on the Kill Task button.

Once the programs are no longer active you should be able to remove them from the Startup Programs list and reboot.

"Delete File on Reboot"
If after trying to remove a suspicious or dangerous program you find it still will not go away, right-click on the title of the program and select "Delete File on Reboot." This action will not take place until the next time you boot, but the file will be deleted before Windows starts and any other programs that may attempt to prevent its deletion.

There is no way to recover the file once it is deleted, so use this feature only when you are absolutely sure you want to remove the file.


More WinPatrol Features