*** What to uncheck and what not. ***

Hi, myqn.

There is no such thing as the one and only golden rule of what you may disable and what you may not.

There is only one golden rule if you do not wish to render your system unbootable and useless:

If you do not know whether
+ an autorun programme
+ a service
+ a driver
is needed or not, leave it as it is.

In case you tend not to stick to this only golden rule which exists, please, prior to scrambling your system, read this:
Lost GUI
My big mistake with Autoruns!
Help ???
Feel free to use the forum search button in order to read more stories of the same kind.

If you would like to get some useful information on services and autorun programmes you may like to pay a visit to this site "www.BlackViper.com: Windows XP Home and Professional Service Pack 2 Service Configurations".

Hope this helps.
Karl


Edited by Karlchen - 26 June 2007 at 3:01am

Hi, myqn.

I know well that my previous answer must read pretty discouraging. Actually, the message which I was trying to get across was simply this:

+ You may use Autoruns to view everything. No problem.
+ Do not change anything unless you know what the effect will be.

As the question you asked has been asked several times before, here is an attempt of writing
some kind of inofficial guideline for Autoruns newbies on how to use Autoruns carefully.

Basic advice on enabling/disabling items using Autoruns in advance:

• If you change an item, write down the item that you change. This is particularly useful if you are changing more than one item at a time.


• If you disable an item, just untick (=disable) it. Do not delete it. If you just disable it and you need to re-enable it you simply need to tick it again. If you deleted it, it's gone for good.

I will suppose that you are using Autoruns v8.5 and go through the different tabs that Autoruns shows.

• Tab "Everything":
  will be skipped, because it is the summary of all the other tabs.


• Tab "Logon":
  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit: Never ever touch it, unless you are told to do so by an expert and unless you have to set it back to its default value, because some rogue software maliciously modified it. Never untick it or delete it. You will not be able to logon ever again.
  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell: Never touch, unless you are told to do so by an expert and unless you have to set it back to its default value, because some rogue software maliciously modified it. Never untick it or delete it. You will not see your desktop if you do..
  In general, be careful with entries starting with HKLM\...., because changing them will affect all users.
  Unticking items under
  + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run,
  + HKCU\Software\Microsoft\Windows\CurrentVersion\Run,
  + C:\Documents and Settings\All Users\Start Menu\Programs\Startup,
  + C:\Documents and Settings\<yourloginname>\Start Menu\Programs\Startup
  may or may not negatively affect some of your applications, but it will not render your system unbootable and it can be undone easily.


• Tab "Explorer":
  Simply leave the items as they are, unless you are told by an expert to untick a particular entry.


• Tab "Internet Explorer":
  You may try to disable some Browser Helper Objects by unticking them in case you suspect the have been put in by some kind og malware.
  If your I.E. does not function properly after such changes, simply tick the disabled items again and relaunch I.e.


• Tab "Scheduled Tasks":
  I would rather use Control Panel => Scheduled Tasks to administer my tasks than Autoruns. Unticking tasks should not do permanent damage to your system.


• Tab "Services":
  Basically, do not untick any service, if you are not absolutely sure your system does not need it.
  Never simply delete a service from the list, unless told to do so by an expert.
  Inside Autoruns you can only enable (ticking) or disable (unticking) a service.
  If you need to reconfigure the way a service is launched (automatically, manually, never) user services.msc instead of Autoruns.
  With a lot of services your will only learn during the next reboot if disabling it was a good idea or not.
  Some services are more vital than others.


• Tab "Drivers":
  Never ever simply untick any driver!
  Drivers have to be maintained (installed, updated, deactivated, removed) using devmgmt.msc.


• Tab "Boot Execute":
  simply do not touch, unless told to do so by an expert.


• Tab "Image Hijack":
  simply do not touch, unless told to do so by an expert.


• Tab "LSA Providers":
  simply do not touch, unless told to do so by an expert.


• Tab "Print monitors":
  simply do not touch. Printer configuration should be done using Control Panel => Printers.


• Tab "Winsock Providers":
  simply do not touch, unless told to do so by an expert.


• Tab "Winlogon":
  simply do not touch, unless told to do so by an expert.


• Tab "KnownDLLs":
  simply do not touch, unless told to do so by an expert.


• Tab "AppInit":
  simply do not touch, unless told to do so by an expert.

Hope this helps a little bit.

Kind regards,
Karl


Edited by Karlchen - 10 April 2006 at 5:33am