The tab taxonomy (most-used in practice)
- Logon: HKCU+HKLM Run/RunOnce + shell startup — your everyday audit zone;
- Scheduled Tasks: vendor resurrection engines live here; look for “update” tasks with regrowth behavior after an uninstall;
- Services / Drivers: read-only review for per-user workouts; writes here imply the admin-scope assessment starts, not continues;
- Explorer / Office / Codecs: add-in surfaces; shell sluggishness answers are frequently in the Explorer tab.
The five safety verbs
- Hide verified publisher (option): collapses Windows and stock-Microsoft entries; you're left with exactly the terrain worth inspecting;
- Uncheck, don't delete: entries disable-in-place, revertable via the same checkbox — machine-scope entries will require admin elevation for the toggle;
- VirusTotal column (option): zero-network claim note — this is the moment where your “mix external signals carefully” consent decision belongs;
- Compare: File → Compare on same-box exports around an incident window gives you the diff you came for;
- Never “leave disabled and forget”: notes on what you toggled win the second debugging session, in months, on no memory.
Autoruns is the confidence machine for the questions “is anything left from that app” — bringing discipline to its breadth is the skill it gives back.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.