Check what really starts with Windows

What “startup programs” actually includes

Beyond the familiar Startup folder, Windows will run software at boot or logon from registry Run keys, services and drivers, ServiceDll registrations, scheduled tasks, Winlogon and AppInit hooks, IFEO/SilentProcessExit debuggers, WMI event subscriptions, LSA packages, print monitors and providers, credential providers, browser helper objects, COM hijacks and even screensavers. Malware favours the obscure ones precisely because most startup managers never look there.

Exactly what WinSight inspects

• All 27 autostart families, the ones above among them, enumerated read-only: the scan changes nothing.
• Every referenced image is Authenticode-checked with catalog fallback, using a six-state verdict model that never fabricates an “Unsigned” result from an inconclusive check. A missing file reports FileMissing (“signature not checked”), which usually means an orphaned registration, not an infection.
• The command line is read too, not just the file: a signed Windows interpreter such as rundll32, mshta, regsvr32 or powershell handed a remote, per-user or encoded payload is flagged even though the executable verifies perfectly, and scheduled tasks report their arguments.
• Optional VirusTotal enrichment, off by default, using your own API key, sending only a SHA-256 hash.
• Guardian, the companion monitor, opens a decision window (Allow, Block or decide later) the moment a new startup item appears and reconciles changes made while WinSight was not running. When elevated, write attribution names the program that created the entry.

Inspection, not removal

WinSight deliberately reports and explains rather than deleting. A notable result is a signal to investigate, not proof of malware, and deleting a service registration blindly can break recovery paths. Each finding offers safe next steps: inspect details, reveal the validated file location, or open Windows’ own Startup apps settings to disable an entry through the supported path. The one exception is yours to choose: when Guardian reports a new item in your own Run keys or Startup folder, Block moves it into a quarantine you can restore with winsight restore.

Deciding what is safe

A signed entry from a vendor you recognize is usually fine. Investigate when you see an unsigned image in a user-writable path, a scheduled task or WMI subscription you cannot explain, or a name imitating a system component (svch0st.exe). When in doubt, disable rather than delete, reboot, and confirm nothing broke.