potentially questionable startup processes

There are a bunch of places that may have windows\\load

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\\load
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows NT\CurrentVersion\Windows\\load
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Windows\\load
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Windows\\load
HKEY_USERS\S-1-5-21-3804909484-125725482-3536007706-1005\Software\Microsoft\Windows NT\CurrentVersion\Windows\\load

You could have other similar S-1-xxxxx (whatever) locations.

 

You know regedit has problems that many of us geeks know about. It does not always show things that are in the registry. Much like Windows Task Manager does not show all running processes.

I use the below. It is a million time better and faster than regedit:

Registrar Lite

You could also look with it to see if anything is found.

 

That's the same as what I gave you. Registry keys just use \\ instead of : to indicate the subkeys.

 

Ok! If your malware problems are finished (seems like it), you should also check out the below:

How to Protect yourself from malware!

 

You're welcome. Surf safely!