Help with Strange Registry Entries in HKEY CURRENT USER

It ends up it is from Movavi Video Editor. I'm going to put a Process Monitor on the computer and find out which Movavi file is creating these entries. Thanks to everyone who helped.

It seems they return after a day or so.

Normally nothing is set in the values for HKEY_CURRENT_USER.

When they are deleted they don't seem to effect the computer.

Those entries on their own can't be malicious. A process shouldn't be writing to that key. Is there anything showing in the data for those values if you widen the registry window?

To find out which process is creating them, a Process Monitor capture would work, but it would add a lot of drag to the operating system waiting for the values to be written.

If the entries were written at boot or shortly thereafter, it would be quite straightforward.

Another method would be with a clean boot, though long and tedious. If the entries weren't created with a clean boot, you'd selectively re-enable items until the culprit could be pinpointed.

Hello, I am Mite, an independent advisor and a user like you, and I am here to offer help.

It's not normal for the registry to have these entries. You can delete those entries and see whether the system or other software behaves abnormally. Before you delete the entries, I strongly recommend to backup your registry. Then, you can perform a clean boot to identify the problem. A "clean boot" starts Windows with a minimal set of drivers and startup programs, so that you can determine which problem creates these entries. To perform a clean boot, you can follow this tutorial:

https://support.microsoft.com/en-us/topic/how-t...

You can keep tracking the new entries while using the clean boot to identify the problem.

It seems they return after a day or so. When they are deleted they don't seem to effect the computer.

They're definitely not normal. How long after you delete them are they recreated?

We may be able to get a Process Monitor capture to see what process is creating them.