Unwanted "Start> All Programs" Enties

[SophieSpirit]

Hello, I have an Inspiron B130 Laptop running XP Home. Last week I went to open >Start> All Programs and found several dozens entries; all read similar to "ScanHKCR1192130831-56" next one "ScanHKCR1192130832-58 and so on. When I click on one of them, I get a message asking "Are you sure you want this information added to the registry?" At present I have just under 100 sitting in my All Programs area. This is a tough one; does anyone know a way to stop this?" Thank you.

[kbm292]

What do you use for virus protection and spyware protection?

[Brontos]

Well each of those is a registry entry (.reg file)

Right click on one of them and click "Edit" and paste it here. This should help us understand weather these are "kind" or "unkind"

Brontos

EDIT: For the record, a virus does not need your permission to edit the registry, so I'm curious to the reason of this problem.

EDIT 2: Just thought of something - HKCR probably stands for "HKEY_CLASSES_ROOT"

[SuperDave]

Did you do anything unusual before this problem happened? Installed something new, downloaded anything?

[SophieSpirit]

To KBM292:I use Avast virus and Ashampoo firewall along with 3 spyware programs.

To Brontos: ScanHKCR1192130832-58 is one such listing. I went online and used Trend-Micro's free scan and other than a few basic threats, nothing else was detected on my coputer.

[Broni]

Right click on one of them and click "Edit" and paste it here. This should help us understand weather these are "kind" or "unkind"

[SophieSpirit]

I have not downloaded anything recently and down anything unusual.

[SophieSpirit]

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\]
"DriverCachePath"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,44,72,69,76,65,\
  72,20,43,61,63,68,65,00
"BootDir"="C:\\"
"PrivateHash"=hex:7e,00,38,2a,43,65,57,6c,cf,94,85,2b,26,d8,31,37
"ServicePackCachePath"="c:\\windows\\ServicePackFiles\\ServicePackCache"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\BaseWinOptions]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\ExceptionComponents]
"ComponentList"=hex(7):7b,etc

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\ExceptionComponents\{077ACEC7-979C-40AB-9835-435BA1511E0D}]
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{077ACEC7-979C-40AB-9835-435BA1511E0D}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=hex(2):43,etc

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\ExceptionComponents\{30C7234B-6482-4A55-A11D-ECD9030313F2}]
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{30C7234B-6482-4A55-A11D-ECD9030313F2}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=hex(2):43,etc

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\ExceptionComponents\{3FDF25EE-E592-4495-8391-6E9C504DAC2B}]
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{3FDF25EE-E592-4495-8391-6E9C504DAC2B}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=hex(2):43,etc
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\ExceptionComponents\{60204BB3-7078-4F70-8F69-68297621941C}]
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{60204BB3-7078-4F70-8F69-68297621941C}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=hex(2):43,etc

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\ExceptionComponents\{981FB688-E76B-4246-987B-92083185B90A}]
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{981FB688-E76B-4246-987B-92083185B90A}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=hex(2):43,etc
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\ExceptionComponents\{A47B3654-48EE-48A5-B629-97D70175E58F}]
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{A47B3654-48EE-48A5-B629-97D70175E58F}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=hex(2):43,etc
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\ExceptionComponents\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}]
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=hex(2):43,etc
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\ExceptionComponents\{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}]
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{C5B8FBE9-645E-4484-A7AA-E8DA9A70DD77}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\ExceptionComponents\{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}]
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{CFB4B314-0328-45E1-94AF-45A3F5F48E0B}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=hex(2):43,etc
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\ExceptionComponents\{DD90D410-1823-43EB-9A16-A2331BF08799}]
"FriendlyName"="Windows Media Files"
"ComponentGUID"="{DD90D410-1823-43EB-9A16-A2331BF08799}"
"Version"=dword:000a0000
"Sub-Version"=dword:00000e3e
"ExceptionInfName"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,67,69,73,74,\
  65,72,65,64,50,61,63,6b,61,67,65,73,5c,7b,44,44,39,30,44,34,31,30,2d,31,38,\
  32,33,2d,34,33,45,42,2d,39,41,31,36,2d,41,32,33,33,31,42,46,30,38,37,39,39,\
  7d,5c,57,4d,50,31,30,2e,69,6e,66,00
"ExceptionCatalogName"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,67,69,73,\
  74,65,72,65,64,50,61,63,6b,61,67,65,73,5c,7b,44,44,39,30,44,34,31,30,2d,31,\
  38,32,33,2d,34,33,45,42,2d,39,41,31,36,2d,41,32,33,33,31,42,46,30,38,37,39,\
  39,7d,5c,77,6d,70,31,30,2e,63,61,74,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\Migration DLLs]
"Microsoft Office Family"="C:\\PROGRA~1\\MICROS~2\\Office10\\MIGRAT~1\\MIGRATE.DLL"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\Oc Manager]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\Oc Manager\MasterInfs]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\Oc Manager\Subcomponents]
"beacon"=dword:00000001
"fax"=dword:00000000
"wmpocm"=dword:00000001
"msmsgs"=dword:00000000
"rootautoupdate"=dword:00000001
"msnexplr"=dword:00000000
"starter"=dword:00000000
"ieaccess"=dword:00000001
"iis_common"=dword:00000000
"iis_inetmgr"=dword:00000000
"iis_pwmgr"=dword:00000000
"iis_www"=dword:00000000
"iis_doc"=dword:00000000
"iis_ftp"=dword:00000000
"iis_smtp"=dword:00000000
"fp_extensions"=dword:00000000
"oeaccess"=dword:00000001
"mswordpad"=dword:00000001
"calc"=dword:00000001
"charmap"=dword:00000001
"clipbook"=dword:00000001
"deskpaper"=dword:00000001
"mousepoint"=dword:00000001
"paint"=dword:00000001
"templates"=dword:00000001
"chat"=dword:00000001
"dialer"=dword:00000001
"hypertrm"=dword:00000001
"mplay"=dword:00000001
"rec"=dword:00000001
"vol"=dword:00000001
"accessopt"=dword:00000001
"pinball"=dword:00000001
"freecell"=dword:00000001
"hearts"=dword:00000001
"minesweeper"=dword:00000001
"solitaire"=dword:00000001
"spider"=dword:00000001
"zonegames"=dword:00000001
"wmaccess"=dword:00000000
"indexsrv_system"=dword:00000000
"wbem"=dword:00000001
"terminalserver"=dword:00000000
"snmp"=dword:00000000
"wbemsnmp"=dword:00000000
"simptcp"=dword:00000001
"upnp"=dword:00000001
"iprip"=dword:00000001
"p2p"=dword:00000001
"lpdsvc"=dword:00000001
"dtc"=dword:00000001
"com"=dword:00000001
"display"=dword:00000001
"ntcomponents"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\OOBE]
"RunWelcomeProcess"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\OOBE\CKPT]
"0"=dword:00000009
"TopOfStack"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\OOBE\Status]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\OOBE\Status\{C37D92A5-CA34-11d2-B71C-00C04F794977}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\OptionalComponents]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\OptionalComponents\Messenger]
"Installed"="0"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\OptionalComponents\Moviemk]
"Installed"="1"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\OptionalComponents\SwDir]
"Installed"="1"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\OptionalComponents\SwFlash]
"Installed"="0"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\\WindowsFeatures]
"Windows Media Player"=dword:00000001

[Broni]

I looked at your post, and it looks like some registry patch. I didn't notice anything suspicious, but it beats me, why would they be listed under Program Files, unless someone saved them there.

Couple of questions, then...
- Are you the only user of that computer?
- Open Windows Explorer, navigate to Program Files folder. Can you see any of those files in right pane?