Windows – How to find out how a program started on Windows

automatic updateboottask-managerwindowswindows 10

From what I have understood after researching on Google, there are two ways of how a program can start on Windows:

  1. Manual (The user doubled clicked on the executable or shortcut file of the program)
  2. Automatic:
  3. Started by another program

Automatic startup can be due to 4 reasons:

  • A service, that should be installed
  • the windows registry
    (HKCU\Software\Microsoft\Windows\CurrentVersion\Run)
  • a shortcut to it to the startup folder of start menu
  • task scheduler

However, I found an invisible window called: UNCServer.exe running on my computer.

I want to stop it but I couldn't find the reason why it is running. I checked everywhere on all the bullets points mentioned above but there is no luck.

Assuming that the task is running right now on my computer, is there a way to know how a program has started on Windows?

Best Answer

If you would use ProcessExplorer, you can find how program started:
From menu: go to View->Select column then switch to tab:Process Image
and check box Autostart location.

This way you can reveal what mechanism program used to autostart.
Make sure to run ProcessExplorer as administrator.

Related Question