What would be changing my Explorer Shell Settings?

[jsteph]

Trend Micro antispyware keeps popping up messages that say a change has been made in my Explorer Shell Folder settings.

The reg key appears to be:

hklm\users\[local service]\software\microsoft\windows\currentversion\explorer\shell folders

It's adding the key (which looks very similar to what was already out there)

AppData    C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data

This is similar to what was already out there:

Local AppData    C:\Documents and Settings\LocalService.NT AUTHORITY\Local Settings\Application Data

Notice the added on was in the "Application Data" folder that was higher in the folder tree--the one out there had the appdata folder under "Local Settings".

It also added a similar one for Favorites.
This *seems* benign, but I've never seen this pop up before, and I haven't installed any software recently. It happened while I was adding a sql-server ODBC DSN in the odbc dialog, but I'm not sure if that had anything to do with this.
Any ideas on this?
Thanks,
--Jim

 

[cupid11213]

i have several times seen a virus that when shutting off your pc says "your computer is being shutdown /NT AUTHORITY.EXE OR SOMETHING LIKE IT

PLEASE CHECK TO SEE IF IT COULD BE A VIRUS.

Some people make things happen, some people watch things happen, while others wonder what happened.

 

[erikhertzel]

I would do an online virus scan from Trend Micro:

housecall.trendmicro.com

Hope that helps,

Erik

 

[jsteph]

Thanks all, I'll try the scan and see what happens...
--Jim