unauthorised registry changes on boot up (Win XP -

[richardjoss]

I have Ad-Watch monitoring installed which alerts me to any attempt to change registry settings. It has suddenly started alerting me to attempts to make changes on boot up. I recently installed Win XP SP2 and also Omnipage 14 so the requests may be left over from temp files that have not been cleaned up, a corrupted install or something. Here is a typical example:

Key: Software/Microsoft/Windows/CurrentVersion/RunOnce
Value: OE-WMPWMP7_Install_0
Data: CWindowsNFunregmp2.exeMigrateLibrary

Another Data setting that also comes up is:
Data: CWindowsSystem32msnnet??(can't read my writing!).dllsystem32"blackbox.dll"

Any ideas on how I can a) gett rid of these requests and [img]/forums/images/smilies/cool.gif[/img] is it anything more sinister than a corrupted install or whatever?

TIA

Richard

[Leif]

They both look like they are connected to Windows Media Player.
What version do you currently have installed, and have you done a recent upgrade?

[JohnGray]

The RunOnce key is used for programs that [tada!] should run once after a reboot, usually for software that needs to "do something" before much of the operating system starts. Successful running should cause that key to be deleted (so that it only runs once)... Most of the time it's generated by a Microsoft installer.

John

[richardjoss]

The two files - unregmp2.exe, and "blackbox.dll" - show up on the hard disk in the C:windows$NTServicePackUninstall directory. The first is also in C;windowsinf and the second in C;windowssystem32. Are these leftovers from my recent install of WinXP SP2? I do have win media player V 9.0 if that is any help (and it may have been upgraded through Windows Auto Update).

Cheers

Richard