Where are the various places that processes can be started on desktop login on Ubuntu?

Specifically: My laptop has an encrypted Truecrypt partition, and a Dropbox share on it. On login Dropbox tries to start and can't access its directory because at that point I haven't mounted the TC volume.

Dropbox is listed in the Startup Applications GUI, which as far as I can tell just lists whatever is in ~/.config/autostart. However, if I remove it from there (either from the GUI or by deleting dropbox.desktop, and with Dropbox stopped when I do it), if I log out and back in again it puts itself back and starts again. Where is that coming from?

Furthermore: if I replace dropbox.desktop with an empty read only file, it doesn't get replaced but Dropbox still starts. How?

Further furthemore: I have my own bash script which prompts me for the TC volume password, mounts it, then starts dropbox. I have added that to ~/.config/autostart (via the GUI), but my script doesn't seem to start. What might I be doing wrong?

Over the years I have spent ages removing viruses on Windows and got used to the idea that there are dozens of places that you can configure applications to start automatically but I thought Linux would be a bit cleaner than that! This has prompted me to learn more about the startup process.