Suspicious .exe set to run at startup: Determine if file exists still

Question

When I open MSConfig and look at all the applications set to run on startup there is a suspicious file set to run at startup. I have disabled the .exe to not run at startup but I want to delete the .exe aswell.

From MSConfig I can see that the .exe sits in %APPDATA% folder but I am unable to see the .exe when I navigate to the folder in windows explorer. Is it possible the .exe has already been deleted(it may have been a legitimate app that I uninstalled at some point)? Can a .exe that does not exist be shown in MSConfig?

How can I delete the .exe?

Note: I know C++ WinAPI and I have attempted to find the file using FindFirstFileEx();(I'm a Admin User) and also tried open it with CreateFile(); but both say "Cannot find path specified". That could mean that the file doesn't exist but could that also mean that the file permissions are set to FILE_ATTRIBUTE_HIDDEN? I've also tried SetFileAttributes to FILE_ATTRIBUTE_NORMAL but it gives the same error? Any ideas on what I should do to confirm whether the file exists?

Answer 1

I would just run Sysinternal's autoruns, and find the exe file in the list it provides you with. Make sure you run it as an administrator. If the file is marked red it does no longer exist.

You should however note the name of the file and do some research about it. If you have a bad feeling about the file I would also run a virus and malware scanner.