Nadya,
The registry key you refer to should not be deleted rather the data in it. FWIW mine has "%1 %" refering to using the comand (the %1) and 1 parameter.
I have had to write many scripts at work to cleanup virus remnants from registries. They are tricky at best, we usually gather the offending information by reading the virus itself and doing its opposite(open with like ultra edit 32 instead of open). We use the mcafee and ca sites to get specific info to remove from the registries as well. These worm virii are particularily pervasive into the system, and whacked my little fox pro career hard they attack the sct files. I can tell the author is a vbs'er or a js'er because they probably don't know we use the *.sct before there was a windows script.
If you know the virus name I can go get the info and even devise a reverse for your registry(including backup), as a courtesy, as you have helped me here many times (with source of course).
The .vxd file you look for normally is not in the windows directory unless win2k has changed that. They are normally buried under systems, and if you get a directory of that area by *.vxd and see many the same SIZE and time it is suspect. The same applies to .exe, .wsh, .jpg, .mpg, .js, etc.. those executable file names.

Tom