Check what really starts with Windows

What “startup programs” actually includes

Beyond the familiar Startup folder, Windows will run software at boot or logon from registry Run keys, services and drivers, ServiceDll registrations, scheduled tasks, Winlogon and AppInit hooks, IFEO/SilentProcessExit debuggers, WMI event subscriptions, LSA packages, print monitors and providers, credential providers, browser helper objects, COM hijacks and even screensavers. Malware favours the obscure ones precisely because most startup managers never look there.

Exactly what WinSight inspects

• All 22 autostart families listed above, enumerated read-only: the scan changes nothing.
• Every referenced image is Authenticode-checked with catalog fallback, using a six-state verdict model that never fabricates an “Unsigned” result from an inconclusive check. A missing file reports FileMissing (“signature not checked”), which usually means an orphaned registration, not an infection.
• Optional VirusTotal enrichment, off by default, using your own API key, sending only a SHA-256 hash.
• Guardian, the companion monitor, raises a live tray alert the moment a new startup item appears and reconciles changes made while WinSight was not running. When elevated, write attribution names the program that created the entry.

Inspection, not removal

WinSight deliberately reports and explains rather than deleting. A notable result is a signal to investigate, not proof of malware, and deleting a service registration blindly can break recovery paths. Each finding offers safe next steps: inspect details, reveal the validated file location, or open Windows’ own Startup apps settings to disable an entry through the supported path.

Deciding what is safe

A signed entry from a vendor you recognize is usually fine. Investigate when you see an unsigned image in a user-writable path, a scheduled task or WMI subscription you cannot explain, or a name imitating a system component (svch0st.exe). When in doubt, disable rather than delete, reboot, and confirm nothing broke.