Ok so I think I found the file (Called (Default)) by following the filepath, but when I try to delete it this error pops up (see attached picture). I also restarted my computer and turned off the internet for some reason but the same error still popped up when I tried to delete it.
EDIT: On further inspection I see that all folders contain this "(Default)" file, so this probably isn't the file that I'm looking for haha
I do not believe that is the right location. The path that you previously mentioned is "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run". StikyNot.exe would not be located there, and I expect that the proper location has more than one key in it. And you are correct, the Default key is native to all of the key locations, and shouldn't be deleted.
A handy program to use for searching for all keys that might be related to a program that is installed, is call Registrar Lite. You might try searching all names that you have found that relate to program in question, like BulletStorm, etc. Its faster and easier than plodding through the registry with Regedit.
Registrar Lite - Free software downloads and software reviews - CNET Download.com
'''
No, I'm 100% positive that the path is correct as stikynot.exe in msconfig also has the same path as what I'm looking for. I think stikynote.exe is there because I use sticky note and when you restart your computer all of the sticky notes are saved instead of going away after every shut down.
Then I would have expected to see other keys in the screenshot that you posted above...such as BulletStorm. Since it is not there, I doubt that it is anywhere in the registry, but a general search with Registrar Lite would be a good idea.
Those People Can Fly games which write themselves into Startup are an infection. I got rid of one last week by deleting it's Registry key, which can be found linked in msconfig>Startup or CCleaner>Tools>Startup. This was causing major infection which Malwarebytes struggled to delete until I killed the key but now seems clean.
Use the Old Timer temp files cleanup tool Lee posted, uncheck everything in msconfig>Startup except AV and gadgets, then after restarts check msconfig>Services, tick Hide all MS services, see what's running without your knowledge and uncheck it - keep checking back in both places to see if anything writes itself back in. You now have a clean boot.
I'd also uninstall AVG which no one here recommends since it bloated up years ago and never recovered. Use MS Security Essentials or Avast 6 which most recommend here for freeware.
Alright, I'm doing what you recommended, but since the original malawarebytes scan said I was virus free, does that mean I'm virus free since your similar virus showed up in malawarebytes? Also I did another scan with malawarebytes and everything turned out normal.
EDIT: Also, can you explain the part in red a little bit further.
Also, in a worse case scenario, what could this thing possibly do to my computer? I don't understand viruses at all.
Last edited by pan; 21 Aug 2011 at 19:56.
Look under "Location" column in msconfig>Startup for reg key or file location of that program, then delete it.
If it's a file make sure it's uninstalled in Control Panel first, then delete any files by taking ownership if necessary: Take Ownership Shortcut
Did Old Timer's cleaner get rid of the .tmp file popup at startup? If not, unhide Hidden files in Control Panel>Folder Options>View then browse to each User's Appdata folders to find the Temp folders and delete them, taking ownership if necessary.
The .tmp popup no longer occurs. When going to the location path specified in msconfig>Startup by using regedit, the program is not there, but it still says that it is there. Also notice how in the pictures i previously posted on page 2 (post #17), the name of the file in msconfig changed from bullletstorm from people can fly to some numbers by unknown. Does this mean that it is gone permantly, just msconfig is saving the location?
Quote