Unknown renamer autostart

Memba · Post by **Memba** » 2013-11-05 06:17:09

Everytime I boot my PC the Ant Renamer window flashes up for a split of a second and disappears afterwards. Until now I couldn't identify that it's Ant Renamer but for whatever reason just a single time the window stayed open. So something automatically starts Ant renamer.

This is weird because
- I didn't set up any Autostart, also Sysinternal's autorun doesn't reveal anything that's related to Ant Renamer
- I couldn't find some kind of service that's installed by Ant Renamer
- The tasklist doesn't show the renamer.exe

Where does this autostart window come from?
I even renamed the installation directory just to find that this doesn't help. Which means that this renamer-window starts from another location outside of the installation directory (huh?).

To make this clear: I don't believe that Ant Renamer is kind of a trojan, I probably screwed up my system by myself. But still this is weird and I'd like to stop this. So does anyone have an idea where this autostart could come from and how I can avoid it?

Post by **antp** » 2013-11-05 12:50:14

that's very weird

I suppose you check that it wasn't accidentally put in the "startup" group of the start menu?
Or maybe a file whose type would be associated to Ant Renamer by mistake, and then tries to open with it?

Ant Renamer's installer doesn't do anything more than copying the files, creating the icon shortcut and uninstall information.
Hence why it also works as a standalone program (it does not actually need to be installed).

You could try to search in the registry (regedit.exe) for occurences of the executable file name, see if it appears at other places than in the uninstall information.

Memba · Post by **Memba** » 2013-11-05 16:39:25

Hi Antoine,

thanks for your hints.

Or maybe a file whose type would be associated to Ant Renamer by mistake, and then tries to open with it?

Jackpot! There was an entry in autostart with the .arb extension which launched the renamer. I remember slightly having played with Archives long ago so that probably should have been and .arc
Sorry for the alert, everything's ok now