There were 4 sub keys, 1.4, 1.4.0, 1.6, 1.6.0. The first 2 referred to a non-existant directory, C:\Program Files\Java\jre1.5.0_02, on my system. The latter 2 referred to C:\Program Files\Java\jre6 which does exist. I deleted the first two keys and reran the vulnerability scan. That seems to have fixed the problem. ...