How to Find and Remove Suspicious Startup Entries in Windows

What Causes This?

Suspicious startup entries usually appear when a program adds itself to Windows so it launches every time your PC starts. This can happen with legitimate apps, but it’s also a common trick used by adware, junkware, crypto miners, and other malware to stay active in the background. Some entries are hidden in the Startup folder, while others are stored in the Registry, scheduled tasks, or Windows services.

Common Symptoms

• Your PC feels slow immediately after signing in
• Unknown apps or command windows open at startup
• Browser pop-ups, redirects, or unwanted toolbars keep coming back
• High CPU, disk, or memory usage with no obvious cause
• You see strange app names, blank publishers, or random file paths in startup lists

How to Fix It Manually

1. Check startup apps in Task Manager

   • Press Ctrl + Shift + Esc to open Task Manager.
   • If needed, click More details.
   • Open the Startup apps tab on Windows 11, or Startup on Windows 10.
   • Look for entries with:
     • Unknown or blank publisher
     • Strange names made of random letters
     • High startup impact
     • File locations pointing to Temp, AppData, or unusual folders
   • Right-click any suspicious item and choose Disable.

2. Open the file location of suspicious entries

   • In Task Manager, right-click the startup item and select Open file location if available.
   • If the file is in a suspicious folder, do not run it.
   • Right-click the file, choose Properties, and check:
     • Publisher
     • Digital Signatures tab
     • File path and creation date
   • If it looks malicious or unrelated to software you installed, note the path for removal.

3. Check the Startup folders

   • Press Win + R, type shell:startup, and press Enter.
   • Remove shortcuts for apps you don’t recognize.
   • Then press Win + R, type shell:common startup, and press Enter.
   • Review that folder too. Delete only shortcuts or entries you are confident are unwanted.

4. Review startup entries in Windows Settings

   • Open Settings > Apps > Startup.
   • Sort by Status or review the app list manually.
   • Turn off anything suspicious, especially entries with no clear app name or publisher.

5. Check common Registry startup locations

   • Press Win + R, type regedit, and press Enter.
   • Go to these keys:
     • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
     • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
   • Look for values that launch unknown .exe, .bat, .vbs, or PowerShell commands.
   • Before deleting anything, use File > Export to back up the key.
   • Delete only entries you are sure are suspicious.

6. Scan for malware and remove leftovers

   • Open Windows Security from the Start menu.
   • Go to Virus & threat protection > Scan options.
   • Run a Full scan.
   • If Windows Security finds threats, remove them and restart your PC.
   • After restarting, check Task Manager again to confirm the startup entry did not return.

Fix It Automatically with Kudu

Kudu makes this easier by scanning startup locations, flagging risky or unnecessary entries, and helping you disable or remove them safely. It can save time if you don’t want to dig through Task Manager, Registry keys, and startup folders by hand.

Download Kudu Free →