I ran in to a few of these things before and somtimes the thing can be well hidden. One thing to try is use regedit and see if you can spot anything thats loading that shouldnt be or does not need to be under hkey local machine/software/microsoft/windows/current version/run and anything else with run ie..runonce...runservicesonce here you might find what is loading. I would also run sysedit and take a look at the autoexec.bat and config.sys files then look at the load= line in the win.ini
I would be surprised if the was a link in the startup folder but its worth a look.

another route is to use a prog to give you a list of all proccesses running you could try sysinternals.com there is a prog there called process explorer also I run a windowed netstat prog to monitor connections using tcpview.exe from the same site. with these two you should be able to track down the "pirate bastard file"

Hope this adds to the information you asked for!