No, it is normal for legitimate applications to appear as "not verified" in autoruns.exe. In my experience, this is normal behaviour and I have seen other legit applications that didn't appear as digitally signed. I wouldn't worry too much about what autoruns tells me if I were you.
This is why malware analysis makes use of various tools, either for static or dynamic analysis. There needs to be a much more detailed "inspection" of the characteristics and behaviour of the application to reach a verdict.
Here is a screenshot from my machine, to put your mind at ease:
What you CAN do, is to create some sort of 'saved state', to compare your system with at a later time, and possibly detect how a malware gains persistence. Remember, if you eliminate a malware's persistence, then you've 'theoretically' eliminated the malware:
- Run autoruns.exe on a "clean" system and let it finish. (If you suspect your system is already infected with malware, then this process won't help you).
- Click on File -> Save, and then save the .arn file.
- When at some point you suspect that you have been infected by some malware, then run autoruns.exe again and when it finishes, go to File -> Compare and load the .arn file from step 2. If you notice some dodgy Registry entry that you can be certain it is not legitimate, then you can safely delete it.
However, this doesn't mean that you'll always be able to see the auto-start registry entry (e.g. see persistence through RunOnceKey, rootkit driver infection, etc). Nevertheless, it might help sometimes.