I recently started having a problem with my system startup where a folder kept opening on it's own. After some investigation it turned out to be related to the NUA.exe program. In the registry there is a key:
HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\NortonUpdateAgent
of type:
REG_SZ
with the value:
C:\Documents and Settings\All Users\Application Data\Norton\NUA.exe
without double quotes. By coincidence I have a folder named Documents on the C: drive (C:\Documents) which happens to correspond to the first part of the registry key entry so what happens is that the C:\Documents folder opens up and NUA.exe doesn't run at startup. I edited the registry entry and put double quotes around the key value:
"C:\Documents and Settings\All Users\Application Data\Norton\NUA.exe"
and all was well until the second time the computer was rebooted. It appears the NUA.exe or some other program in the Symantec product suite resets that registry key entry. If I edit the registry key entry right before I shut down then everything works fine for the next reboot; the C:\Documents folder doesn't open and the NUA.exe program runs at startup. I removed that registry key entry and it just came back reinforcing my belief that something else is restoring it.
Bottom line is that the registry key entry *SHOULD* have double quotes around it and which ever program is restoring the registry key should be aware of that as well. I also noticed there was another registry key entry for NUA.exe in:
HKEY_USERS\S-1-5-21-2940244638-3619938898-1758026546-1005\Software\Microsoft\Windows\CurrentVersion\Run
which I put double quotes around as well thinking this is where the path is being restored from but that didn't make any difference. Is there a way for me to alter the path for NUA.exe so when the registry key gets restored it has double quotes?