Could you try Microsoft Sysinternals Regmon to monitor CCleaner registry activity.
Just use HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders as Include filter in Regmon and run CCleaner, then save the Regmon log and attach it here.
I used it myself and I can confirm that CCleaner can set those paths, but the question is why your CCleaner set wrong paths.
Thanks. The NetworkService profile apparently is a "special" secure profile for some of the Windows XP services. For some reason in your system CCleaner get wrong environment paths what points to that profile.
Could you try Process Explorer to check some things. In Process Explorer select properties from the CCleaner process and look in the environment tab and check if any of those paths there poit to the NetworkService profile (especially USERPROFILE path).
Using Process Explorer made me realize that it was a program called USB Drive Letter Manager that was causing this problem.
This is a windows service that automatically changes USB device drive letters to a preferred letter, Ex: change from G to Z, and it enables USB auto-running.
So when I plug in my pendrive it starts my program launcher (RK Launcher), I then start CCleaner via RK Launcher.
All this sounds like there shouldn't be a problem but, since USBDLM is started as a windows service it starts before I am logged in, so it uses the NetworkService profile for its ENV variables. When it launches RKL it passes the ENV Variables to it, and then when RKL launches CCLeaner it passes it the wrong variables!
I guess I'm going to have to find a different USB Auto-Running program, Thanks for your help.
Great. That makes sense! CCleaner adopts it's environment from the service, but probably still runs under your own user account (CCleaner process shows as blue in Process Explorer). That's why it saves the Shell Folders in your HKCU and not in the NetworkService profile HKCU.