I see BilP Studios provide  WinPatrol FREE  http://www.winpatrol.com/
do you have it installed.?

No, I've never installed any of their products.

OK , can only suggest you Delete it to the "Recycle Bin" & if needed can use "Recycle Bin" , "Restore" by right click on file.

It is unlikely that any software would install itself and run from a \temp folder. Sometimes it will use the tempfolder to temporarily extract files to during install, and does not always clean up properly after install. The copy there may be a leftover from an install and the running one may be somewhere else. When you searched for cleanup.exe, did you a) in Windows Explorer, tools, folder options, view tab, set show hidden files and folders and b) in search, more advanced options, check the first three boxes?

A google search for cleanup.exe shows up several freebies (clean up temp internet files, etc.) did you download anything like that? have a look in add/remove, see if there is an entry there.

The program was definitely running from the temp file.  I renamed it "dontcleanup.exe" and rebooted and it was no longer running.  The thing that puzzles me is that I cannot find it in the start up items or in the registry.  I have no idea what was making this thing load at startup.  My search for the file was the C: drive with all the advanced options checked.  The only place it was found was in the temp folder.

I also did a google search for the file and I have not installed any of the programs that I found there.

Update: I did another registry search and found a string value reference to cleanup.exe in HKEY_USERS\************\Software\Microsoft\Search Assistant\ACMru\6503.

I still have no idea what it is or what it does and why it needs 50% of my CPU while it's running.

The values at that key (\Search Assistant\ACMru\6503) are just a record of the things you searched for by typing in the 'all or part of a file name box' in search; they are the suggestions  that pop up (or rather under) the box in search when you start typing in something; quite safe to delete those numbered values in the right panel (not the one called default). Or if you like (just like at Google search bar) you can delete them by highlighting and press delete, as/when they show in the search panel.

It is indeed odd that cleanup.exe loads on startup  yet does not appear in any run key in the registry or startup folder, unless the entry is disguised (something else starts and calls cleanup.exe); also that you got no message that it could not load when you renamed it; I would have expected that whatever is causing it to start should have reacted to that. I suggest you check the run keys at

 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and

 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

for anything suspicious or not identifiable with your expected startups.

Do you have anything from Sony Vaio?. Reason I ask is because cleanup.exe is mentioned in pacs portal startup list as possibly related to that.

As you don't know what it is or does, if not running it does not affect any application, I would delete it anyway.

JRosenfeld,  during my investigation of this file I had already checked the registry under all the run folders and found nothing.  Also, I don't have any Sony Vaio products installed.

I guess for now I'll just leave the file renamed so it won't load at startup.  Maybe sometime in the future I'll figure out what it is and where it came from.

Thanks for your help.

I guess I stumped all the forum experts on this one.

Try downloading HijackThis, running it, and submitting a log of its output to one of the forums where experts can analyze the log output. See the first link listed below for how to proceed.

Jim