Please look at this incorrect information in the Startup Manager. BTW, I running with a User Account that has full administrative privileges; however, it is not the hidden administrator account...if that makes any difference.
In the picture below, the Startup Manager says that THGuard.exe is in HKLM\Software\Microsoft\Windows\CurrentVersion\Run. However it is NOT located there. It is located at HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run as shown below.
Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
Class Name: <NO CLASS>
Last Write Time: 1/17/2009 - 7 AM
Value 0
Name: AsioThk32Reg
Type: REG_SZ
Data: REGSVR32.EXE /S CTASIO.DLL
Value 1
Name: avgnt
Type: REG_SZ
Data: "C:\Program Files (x86)\Avira\Avira Premium Security Suite\avgnt.exe" /min /nosplash
Value 2
Name: THGuard
Type: REG_SZ
Data: "C:\Program Files (x86)\TrojanHunter 5.0\THGuard.exe"
Value 3
Name: UltraMon
Type: REG_SZ
Data: "C:\Program Files\UltraMon\UltraMon.exe"
BELOW is what is located at HKLM\Software\Microsoft\Windows\CurrentVersion\Run:
Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Class Name: <NO CLASS>
Last Write Time: 1/23/2009 - 1 AM
Value 0
Name: PowerChute
Type: REG_SZ
Data: "C:\Program Files (x86)\APC\APC PowerChute Personal Edition\Display.exe"
Value 1
Name: IAAnotif
Type: REG_SZ
Data: "C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe"
Value 2
Name: NvCplDaemon
Type: REG_SZ
Data: RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
Value 3
Name: NvMediaCenter
Type: REG_SZ
Data: RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
