Startup Ledger

The following is AI-generated (aka vibe-coded) software. The software is specific to my needs and my system and may not work for you or your system. Support is limited, but if you report a bug I'll certainly look into it. All code is provided in a zip file for you to review should you choose.

Startup Ledger keeps a record of what starts with Windows, what VirusTotal says about it, and what you decided. It checks the file hashes in an Autoruns export against VirusTotal, remembers every answer, and on each run tells you what is new, what changed and what needs a look.

• Only file hashes are sent to VirusTotal. Nothing is uploaded.
• Lookups are throttled, retried and cached after every answer, so a run can stop at any point (a request limit, the daily quota, Ctrl+C) and the same command picks up where it left off.
• An allowlist trusts your own files until their hash or their VirusTotal result changes.
• Each run is compared with the last one: new, changed and removed entries, and verdicts that got worse or better.
• It works in a window or on the command line, and needs only Python’s standard library (the window needs Tkinter, which the python.org installers include).

Contents

• Getting started
• Exporting in the background
• The window
• Keyboard shortcuts
• Command line
• Reading the results
• The allowlist
• Files it keeps
• Testing
• Troubleshooting
• Limitations
• How the code is organized

Getting started

1. Get a VirusTotal API key. A free one is on your VirusTotal profile, under API key. Put it in the VT_API_KEY environment variable, which keeps it out of your shell history and the process list:

   setx VT_API_KEY YOUR_KEY                 (Command Prompt, for new windows)
   $env:VT_API_KEY = "YOUR_KEY"             (PowerShell, this window)

   You can also type it in the window’s Settings, or pass --virus-total-api-key. The window never saves it.

2. Get autorunsc (the command-line Autoruns, in the Autoruns download) and put it on the PATH, or give its place in Settings (--autorunsc-file-or-folder-path).

3. Export and check. Double-click startup-ledger.py (or run python startup-ledger.py) for the window, press Export from Autoruns, then Check with VirusTotal. On the command line, this exports to autoruns-export.csv and checks it:

   python startup-ledger.py --export-autoruns TRUE --autorunsc-file-or-folder-path "C:\Tools\autorunsc64.exe"

   The export asks for Administrator rights (a UAC prompt) if the app doesn’t have them: without them, autorunsc silently misses services and other users’ entries. An export you made yourself works too (--autoruns-export-file-path, or Browse in the window): run autorunsc64.exe -accepteula -nobanner -a * -c -h -s -o autoruns-export.csv.
   The -s matters: without it the Signer column never says “(Verified)”, so --skip-trusted-signers TRUE and --prioritize TRUE can’t tell trusted files from the rest.

   The free API allows 4 requests a minute and 500 a day. A typical PC has a few hundred distinct files, so the first run can take an hour or more and may need a second day; later runs only look up what’s new or due for a recheck. --skip-trusted-signers TRUE skips files with a verified Microsoft signature, which is most of them.

Exporting in the background

The export can run on a schedule, so a fresh one is waiting whenever you open the window, which imports the same file:

• autorunsc writes to a temporary file beside the export (autoruns-export-partial-<number>.csv), and that file replaces the export only once it is complete and has entries. The window never reads half an export, and a failed run leaves the last good export in place.
• Run in the background (no console, as from Task Scheduler), it never shows a UAC prompt, which nobody could answer. Give the task Administrator rights instead: in Task Scheduler, tick Run with highest privileges. Without them it warns, and the export misses entries.
• --check-with-virus-total FALSE only exports; leave it out to check the new export too (with VT_API_KEY set for the task, and --quiet TRUE for a shorter log).
• --add-timestamp TRUE keeps every export (autoruns-export-2026-10-08-192400.csv); the check reads the new one.

A Task Scheduler action for it: program C:\Path\To\pythonw.exe (or python.exe), arguments "C:\Tools\startup-ledger\startup-ledger.py" --export-autoruns TRUE --check-with-virus-total FALSE --autorunsc-file-or-folder-path "C:\Tools\autorunsc64.exe" --autoruns-export-file-path "C:\Tools\startup-ledger\autoruns-export.csv".
Give the window the same export file (it remembers it), and it shows the newest export when it opens.

The export exits with 1 when it wasn’t written (autorunsc missing or failing, or an empty export), and the check then doesn’t run.

The window

Run startup-ledger.py with no --autoruns-export-file-path (double-click it) and it opens a window:

• Toolbar: the Autoruns export, Export from Autoruns (run autorunsc to make it, asking for Administrator rights, then import it), Import (read it again, sending nothing to VirusTotal), Check with VirusTotal and Settings. While an import runs, the status bar says what it is doing (reading the export, hashing a file Autoruns couldn’t read, by name) and for how long. Export writes the file in the export field (blank: autoruns-export.csv in the working folder), with the autorunsc in Settings, and shows autorunsc’s output beside the details. Import drops rows identical in every column, and shows each entry with its cached result, its allowlist state and what changed since the last results. Check runs the command line with the settings, shows its output as it goes (Stop ends it; every lookup is already cached), then shows the new results.
• Settings (a window of its own): every command-line option as an input with its label to the left and its help as a tooltip, remembered between sessions, except the API key (blank uses VT_API_KEY). --allow and --disallow have none: Allow and Remove do the same for the selected rows.
• Table: one row per autostart entry: entry, file, hash, what VirusTotal says, the flag, what changed since the last run, when it was first seen, your decision (the allowlist), signer, category and when it was checked. Flagged files and allowlist alerts are red, files to review a milder red, allowlisted ones gray; the text says the same. The columns fit the entries on each import until you resize one (drag a heading’s edge, or double-click it to fit that column to its widest cell); from then on your widths are kept, also in the next session. Click a heading to sort (again to reverse). Right-click a heading to filter by its values, with All, Inverse and, for signers, Verified and Unverified; Clear filters drops them all.
  Show narrows the table to entries needing attention, flagged, unknown, allowlisted, or new or changed; Search keeps the rows that have every word typed.
• Bottom: everything known about the selected entry, with Allow and Remove (several rows at once), Check first and Hash file (see below), VirusTotal page and Copy hash; beside it, the output of the check or the export.

Check first marks the selected files to be looked up first in the next check, before every other file and even if VirusTotal was asked recently (or the vendor is trusted and skipped). The VirusTotal column says “check first”, and the details say since when. A file stays marked until a check has looked it up, so a check that stops early at the request limit or the quota gets to it next time; a lookup that fails keeps it marked too. Pressed again (it then reads Don’t check first), it unmarks them. Marks are kept in virus-total-priority.json.

Hash file works out the hash of the selected entries’ files now, reading each from this computer (in the background: a large file can take a moment). For an entry Autoruns left without a hash, because it couldn’t read the file or local hashing is off, it fills the hash in, so the row can be checked, allowlisted or marked to check first. For an entry that has one, the details say whether the file is unchanged since the export (or since the import hashed it) or has changed, with its new hash: export again to check the new file. A file that isn’t there is marked missing, as an import with local hashing marks it; one that is there but can’t be read is reported in red. The button is off for an entry that names no file (a command line). It changes only what the window shows; the next import or check reads the export again.

Only one window opens per working folder: launching it again brings that window to the front, with any options given filled in (and --export-autoruns TRUE exports in it). Checks on the command line still run while it’s open.

The window keeps its settings in startup-ledger.ini in its working folder (--working-folder-path; default: the folder holding startup-ledger.py), and relative file paths in the settings point there, so virus-total-results.csv, virus-total-cache.json, virus-total-allowlist.json and virus-total-first-seen.json sit beside the app. Settings from the app’s old name (check-autoruns-virustotal.ini) are taken over the first time.

Keyboard shortcuts

Command line

python startup-ledger.py --autoruns-export-file-path EXPORT [options]
python startup-ledger.py --export-autoruns TRUE [--autoruns-export-file-path EXPORT] [options]
python startup-ledger.py --help

Every option takes a value, --name VALUE or --name=VALUE, in any order; yes/no options take TRUE or FALSE (or 1/0, YES/NO, ON/OFF, in any case). An option given twice, a bare --quiet or a value out of range is a mistake. Every option besides the export has a default.
Relative paths on the command line point to the current folder.

Examples:

# Resume an interrupted run: run the same command again.
python startup-ledger.py --autoruns-export-file-path autoruns-export.csv

# Weekly: look again at the files VirusTotal didn't know and those with detections, cheaply.
python startup-ledger.py --autoruns-export-file-path autoruns-export.csv --recheck-not-found-days 7 --recheck-flagged-days 7

# Trust your own apps until they change, and stop trusting one.
python startup-ledger.py --autoruns-export-file-path autoruns-export.csv --allow "MyApp.exe,C:\Tools\backup-helper.exe"
python startup-ledger.py --autoruns-export-file-path autoruns-export.csv --disallow "backup-helper.exe"

# Export and check in one step, e.g. from Task Scheduler with "Run with highest privileges".
python startup-ledger.py --export-autoruns TRUE --autorunsc-file-or-folder-path "C:\Tools" --quiet TRUE

# A big machine: skip verified Microsoft files, riskiest first, only new or interesting lines.
python startup-ledger.py --autoruns-export-file-path autoruns-export.csv --skip-trusted-signers TRUE --prioritize TRUE --quiet TRUE

Exit status: 0 the export or check finished; 1 it couldn’t be done (no API key, no export, a failed export, a data file that can’t be used, results that couldn’t be written); 2 a command-line mistake (“Error: …” and “Use –help for usage.”), or a check that stopped early (a request limit, the quota, a rejected key, Ctrl+C). After a stop, run the same command again to continue.

Options that changed

Scripts and scheduled tasks written for the earlier command line need these changes; each old switch is now an option with a value:

The window’s settings saved by an earlier version are kept, “Don’t compare” and “don’t hash files here” included.

Reading the results

• Flagged YES: at least --min-detections engines say malicious. REVIEW: fewer, or only suspicious ones; often a false positive, but worth a look.
• Unknown and unsigned: files VirusTotal has never seen that aren’t verified-signed. Often more interesting than a single detection.
• Missing files (VT_Status = file_not_found): entries pointing to a file that doesn’t exist, usually leftovers of uninstalled software, sometimes malware remnants. No hash (no_hash): Autoruns couldn’t read the file; the app then hashes it itself (HashComputed = YES), the same hash VirusTotal uses. A file it looks for and doesn’t find is marked file_not_found too, whatever Autoruns said; one that is there but can’t be read (another program holds it), or in a folder this account can’t open, stays no_hash. A Known DLL that Autoruns lists by name only (wow64win.dll) is looked for in System32, so the ARM64 helpers (wowarmhw.dll, xtajit.dll) are missing on x64 Windows. That’s only right on the computer the export came from: --local-hashing FALSE turns it off.
• Since the last run: new, changed (same entry, another file) and removed entries, with what Autoruns knows about each, and verdicts that got worse, got better, or that VirusTotal now knows.
  An entry that had no hash last time and has one now is “now hashed”, not changed.
• First seen: the date each entry was first reported with its hash. A new hash (an update, or a replaced file) gets a new date.
• The run ends with a SUMMARY: what was looked up, counts per result (each split into new and reported before), the allowlist, and what changed since the last run.
• Progress lines for new files, unknown files and files at or over --min-detections say what the file is: its name, description, company, signature and the entries that start it. A file VirusTotal first saw in the last 30 days is pointed out.

virus-total-results.csv has a row per entry, in UTF-8 with a byte-order mark so Excel shows accented characters. Any cell starting with =, +, - or @ gets a leading ', so Excel can’t run it as a formula: entry names and paths come from the machine being checked, which may be the compromised one.

The allowlist

For files you trust that VirusTotal will never know, such as your own apps:

• --allow (or Allow in the window) records the file’s current hash and VirusTotal result in virus-total-allowlist.json. The entry stays out of the flagged, review and unknown lists while the file at that path still has that hash and VirusTotal says no worse than it did.
• If either changes, it’s an ALLOWLIST ALERT at the top of every run until you allow it again (after rebuilding your app, say) or remove it.
• An entry pointing to a missing file (Windows’ leftover “Adobe Type Manager” pointing to atmfd.dll) can be acknowledged the same way, by the file’s name, its path or the entry’s name. An acknowledgement is for that entry and that path: Autoruns lists some Known DLLs twice under one name, for System32 and for SysWOW64, and each is acknowledged on its own. It’s alerted if a file appears at that path; an entry pointed at another missing file is a new missing file, not acknowledged until you allow it.
• Allowlisted files are looked up again once their result is older than --recheck-allowlisted-days (7 by default), so a change on VirusTotal is noticed. Each item has a note you can fill in by hand.

Files it keeps

Every file is written through a temporary file that replaces it in one step, so a crash never leaves half a file. A JSON file that isn’t valid is kept as <name>.damaged-<date and time>.json and the run starts without it. A file that can’t be opened (a sync client or antivirus holding it), or that holds JSON of another shape, stops the run before anything is looked up, and is left as it is: carrying on without it would replace your cache, allowlist or dates with the next save.

Testing

The tests use pytest, with VirusTotal and autorunsc faked, and every export built in the test:

python -m pytest                 # everything (the window tests start Xvfb when there's no display)
python -m pytest -m "not gui"    # without opening windows

The 75 tests take about 12 seconds, and pass at 100% and at 150% display scaling (Xvfb :98 -screen 0 3000x1800x24 -dpi 144, then DISPLAY=:98 python -m pytest).

The refactor that split the app into a package was checked against the single-file version it replaced: eleven runs in a row on one export with a fake VirusTotal (a first run stopped by --max-requests, a resume with --allow, --quiet and rechecks, worse verdicts, flaky network, --disallow, a rejected key, the quota, a log file and mistakes) gave the same console output, results CSV, cache, allowlist and first-seen file, timestamps aside.

Measured under Xvfb on the cloud test machine: a search keystroke with 3,000 entries refreshes the table in 65 ms (159 ms before the refactor; 24 ms instead of 78 with 1,000), since the rows are put in the table once per import and filtering only chooses which are shown.
--help takes 102 ms instead of 182, since the command line no longer loads Tk.

Troubleshooting

• “No VirusTotal API key”: set VT_API_KEY, or pass --virus-total-api-key. In the window, type it in Settings. A window opened before you ran setx doesn’t see the new variable.

• “No verified signatures found in this export”: the export was made without -s. Export again with Export from Autoruns or --export-autoruns TRUE.

• The run stops with “most likely the daily or monthly quota”: the free key’s 500 requests a day are used up. Run the same command tomorrow; every lookup so far is cached.

• “Cannot open … virus-total-cache.json” (or the allowlist): another program has the file open. Close it (or pause the sync client) and run again.

• “Could not write the results”: virus-total-results.csv is probably open in Excel. Close it and run again; nothing is looked up twice.

• The window says it’s already open: one window per working folder; the open one comes to the front. If it didn’t answer, a window may be stuck: close it, or end its Python process.

• The export has far fewer entries than Autoruns shows: the export ran without Administrator rights. Run it from an elevated prompt, or with “Run with highest privileges” in Task Scheduler.

• “Could not find autorunsc64.exe or autorunsc.exe on the PATH”: give its file or folder in Settings (autorunsc64.exe) or with --autorunsc-file-or-folder-path.

• Import takes a long time: the status bar names the step. “Hashing the files Autoruns couldn’t read” reads each of those files on this computer, which takes a while for large ones or many; the window remembers them, so the next import is quick. An export made with Administrator rights leaves few to hash.
  --local-hashing FALSE (in Settings) turns it off.

• “Something went wrong” in the status bar: a mistake in the app; the details are in the output panel. Please report them.

• “Error: –quiet needs a value” (or another yes/no option): the option takes TRUE or FALSE now; see Options that changed.

Limitations

• The window and the export are made for Windows; the tests run them under Linux, so the Windows-only parts (UAC elevation, Sysnative paths, the taskbar ID, display scaling on Windows) aren’t covered by them.
• An export run with Administrator rights from a window or console that hasn’t got them runs autorunsc on its own, so its few lines of output aren’t shown; what it wrote is still checked.
• Only hashes are looked up: a file VirusTotal has never seen gets no verdict until someone uploads it, which this app never does.
• The window’s output panel is a plain pipe, not a terminal.

How the code is organized

startup-ledger.py is a small launcher holding the command line (make_parser, main); the app is the startup_ledger package beside it. Everything but the window runs without Tk.

The icon, startup-ledger.ico beside the launcher (a magnifying glass over a power symbol), is drawn by tools/make_icon.py at each size Windows uses, 16 to 256 pixels; sizes of 32 and under get a larger glass and heavier strokes so they stay clear on the taskbar. Run python tools/make_icon.py after changing the drawing (it needs Pillow; --png-folder-path writes each size as a PNG to look at). On Windows the window uses the .ico as it is; elsewhere it needs Pillow with ImageTk to show it.