If anyone else is plagued by this (?possibly dodgy?) activity which sits in the sys tray and cannot be easily removed, the only way I have found is via 'Hijackthis' in the 04 block. Probably a shockwave update file, but known also sometimes to be an 'infection cover' depending on file size and name. Mine sat in the Macromedia folder, but did not show in the reg in 'Run' or 'Run Once', nor in start-up and just would NOT go away!
Tarq57
6th Sep 2008, 12:08
Appears to be created courtesy of Adobe, to do with the Macromedia Shockwave 10 updater. Try killing the process using taskmanager, then locating it (should be in C:\WINDOWS\system32\Macromed\Shock* wave 10\Postupdater.exe) and either renaming it, making it "read only", or deleting it completely.
Open Regedit, navigate to this key: O4 - HKCU\..\RunOnce: [SWHelper] "C:\WINDOWS\system32\Macromed\Shockwave 10\PostUpdate.exe" 1014020 (if it is present.) It can probably be deleted, or you may want to try a restart, and see if it deletes itself.
Having done this, if it recreates itself, or if the file wasn't in the indicated place, that would be a bit sinister, but I think you should be good to go.
There are a lot of hits around the web for this one.
[edit, "wibble" should be read as "slash-colon".Or rather, colon slash.]
Thanks Targ - as I said, HJT got rid of the key very simply! The problem with it appears to be in the way the file name is capitalised as to whether it is a virus or not.