Weird Registry Entry

[gfincher]

In the last several weeks, I have somehow got several instances of the following entry in my registry:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFT繗ARE]

[HKEY_CURRENT_USER\SOFT繗ARE\Microsoft]

[HKEY_CURRENT_USER\SOFT繗ARE\Microsoft\Protected Storage System Provide繲偑邐*Default縪偑*Local Machine縪偑Data]

Viewed in Notepad - the erroneous characters are displayed as [] (blocks)

As you may can see, there are some otherwise unprintable characters in the keys. The result is that you cannot remove the keys with anything (that I have discovered so far)!

Registry Mechanic just whizzes right past them, Regedit won't touch them, etc.

Ideas?? Short of format & reload?!

XPAddict

[aresgodofwar]

so software was replaced by that entry, or software is still there in addition to these new entries? my first instinct would be to run spyware and antivirus scans.

[gfincher]

I have run:

AdAware SE 1.05 w/latest def

Spybot w/latest def

MS AntiSpyware w/latest def

I am now (since entries showed up) running PrevX Home

I use CA EZ-Armor Firewall/AntiVirus combination.

In Regedit, my local admin account is the owner of the data (viewed in Security dialog), and has Full Control access to entries(there are three identical entries). All of the entries also have a further section, which resolves in a key with my user SID as a keyname. So the entire registry segment reads like:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFT繗ARE\Microsoft\Protected Storage System Provide繲偑邐*Default縪偑*Local Machine縪偑Data\S-1-5-21-3292650235-516276246-1282138258-1008]

I have booted into BartPE & attempted to remove the offending sections by importing the NTUSER.DAT - I have also done so while logged on locally as an Admin & Loading the NTUSER.DAT hive.

Next step is probably going to be trashing my current user profile (deleting user & profile) & recreating a same named user. Since the errant information is contained in the HKCU hive, that should get rid of it, but... you know how it is when you would rather know HOW to fix something instead of brute forcing it (hesitation to wipe & reload!)

I may try Files & Settings Xfer wizard to dump important installed software reg info and then do the delete user/profile.

XPAddict