Unkown startup app - no clear name, no file location

Hi Thulan Amarasinghe,

I am Dave, I will help you with this.

Click the link below to download a small free utility that does not require installation.

https://download.sysinternals.com/files/Autorun...

When the file downloads, unzip it.

Run Autoruns64 as Administrator

Select the Logon tab at the top of Autoruns, please provide a screenshot of all entries on the Logon tab.

Hi,

It seems like there might be a suspicious or unwanted application starting up with your computer. To identify and remove this application, follow these steps:

1. Use Autoruns: Autoruns is a utility developed by Sysinternals (now part of Microsoft) that provides a comprehensive view of all the applications, services, and drivers set to run at startup. To use Autoruns, follow these steps: a. Download Autoruns from the official Microsoft website: https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns b. Extract the downloaded ZIP file and run the Autoruns64.exe file (for 64-bit systems) or Autoruns.exe file (for 32-bit systems). c. Look for the suspicious application in the list by matching the name you found in the Task Manager's Startup Apps section. d. When you find the entry, right-click on it and choose "Jump to Entry" or "Jump to Image" to locate the associated registry entry or file location. e. You can disable the application by unchecking the box next to it in Autoruns. To delete the associated files or registry entries, make sure you first back up your data and create a system restore point in case something goes wrong.
2. Use Process Explorer: Process Explorer is another Sysinternals tool that provides detailed information about running processes, including the file locations and startup registry entries. To use Process Explorer, follow these steps: a. Download Process Explorer from the official Microsoft website: https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer b. Extract the downloaded ZIP file and run the procexp64.exe file (for 64-bit systems) or procexp.exe file (for 32-bit systems). c. Locate the suspicious application in the process list and click on it to see the details in the lower pane. d. Check the "Path" and "Command line" sections to find the file location and startup registry entry. e. To delete the associated files or registry entries, make sure you first back up your data and create a system restore point in case something goes wrong.

Please note that editing the registry and deleting system files can be risky, and you should only do so if you are confident in your ability to handle potential issues that may arise.

If you are unable to locate the suspicious application using Autoruns or Process Explorer, or if you are concerned about potential malware, consider running a full system scan using Windows Defender or a reputable third-party antivirus program to detect and remove any threats.