Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I open MSConfig and look at all the applications set to run on startup there is a suspicious file set to run at startup. I have disabled the .exe to not run at startup but I want to delete the .exe aswell.

From MSConfig I can see that the .exe sits in %APPDATA% folder but I am unable to see the .exe when I navigate to the folder in windows explorer. Is it possible the .exe has already been deleted(it may have been a legitimate app that I uninstalled at some point)? Can a .exe that does not exist be shown in MSConfig?

How can I delete the .exe?

Note: I know C++ WinAPI and I have attempted to find the file using FindFirstFileEx();(I'm a Admin User) and also tried open it with CreateFile(); but both say "Cannot find path specified". That could mean that the file doesn't exist but could that also mean that the file permissions are set to FILE_ATTRIBUTE_HIDDEN? I've also tried SetFileAttributes to FILE_ATTRIBUTE_NORMAL but it gives the same error? Any ideas on what I should do to confirm whether the file exists?

share|improve this question
1  
I'm guessing you've already set Explorer to show hidden files and show "protected operating system files"? –  Iszi Jul 7 '12 at 15:43
1  
What IS the .exe? MSconfig should still say. –  ekaj Jul 7 '12 at 22:23
add comment

1 Answer

I would just run Sysinternal's autoruns, and find the exe file in the list it provides you with. Make sure you run it as an administrator. If the file is marked red it does no longer exist.

You should however note the name of the file and do some research about it. If you have a bad feeling about the file I would also run a virus and malware scanner.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.