registry key creation at bootup

I have 4 keys that are created everytime I bootup XP.
They are Cydoor, Cydoor Service, Briliant Digital, and
TrinityAYB. Spybot detects them and deletes them but
they come right back. I can manually delete them with
regedit but they come back on the next re-boot.

How can I tell what program is creating these keys when I
bootup XP?

http://sarc.com/avcenter/venc/data/adware.cydoor.html

The above link will give Symantec's information on Adware.Cydoor and its removal.

http://www.google.com and search for Cydoor and any other AV company (McAfee for example) will give you links to other removal information.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"sdreon" <anonymous@discussions.microsoft.com> wrote in message news:2fbb701c46da8$413c7130$a401280a@phx.gbl...
>I have 4 keys that are created everytime I bootup XP.
> They are Cydoor, Cydoor Service, Briliant Digital, and
> TrinityAYB. Spybot detects them and deletes them but
> they come right back. I can manually delete them with
> regedit but they come back on the next re-boot.
>
> How can I tell what program is creating these keys when I
> bootup XP?

Didn't work. Somehow, Kazaa is installing these keys at
bootup and I can't figure it out. I can't find Kazaa on
my computer anywhere and I have already run Kazaabegone.
So, if I could trace the registry during bootup I could
figure it out.

I tried Windows XP audit but it doesn't work during
bootup.

Kazaa is one way of getting this Adware scum on your system, but it is not the cause. Once its there, removing Kazaa won't help. You need to remove Cydoor.

You may want to try a search at www.google.com for "Cydoor" and see if there may be a different variant that is infesting your system.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"sdreon" <anonymous@discussions.microsoft.com> wrote in message news:077301c46e56$701f5180$a601280a@phx.gbl...
> Didn't work. Somehow, Kazaa is installing these keys at
> bootup and I can't figure it out. I can't find Kazaa on
> my computer anywhere and I have already run Kazaabegone.
> So, if I could trace the registry during bootup I could
> figure it out.
>
> I tried Windows XP audit but it doesn't work during
> bootup.

Try Ad-aware from lavasoft. download the latest engine and dat files.
before scanning open taskmanager and stop any task's that resemble the
problem files. If you have to run msconfig at the run prompt and uncheck any
item that also refers to cydoor. Then start the ad-aware scan. Ad-aware
may tell you that it could not delete items that were in use and let ad-aware
scan on reboot. Say yes to the prompt and reboot. Continue running the scans
until your system reports NO items.


"Doug Knox MS-MVP" wrote:

> Kazaa is one way of getting this Adware scum on your system, but it is not the cause. Once its there, removing Kazaa won't help. You need to remove Cydoor.
>
> You may want to try a search at www.google.com for "Cydoor" and see if there may be a different variant that is infesting your system.
>
> --
> Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display
> Win 95/98/Me/XP Tweaks and Fixes
> http://www.dougknox.com
> --------------------------------
> Per user Group Policy Restrictions for XP Home and XP Pro
> http://www.dougknox.com/xp/utils/xp_securityconsole.htm
> --------------------------------
> Please reply only to the newsgroup so all may benefit.
> Unsolicited e-mail is not answered.
>
> "sdreon" <anonymous@discussions.microsoft.com> wrote in message news:077301c46e56$701f5180$a601280a@phx.gbl...
> > Didn't work. Somehow, Kazaa is installing these keys at
> > bootup and I can't figure it out. I can't find Kazaa on
> > my computer anywhere and I have already run Kazaabegone.
> > So, if I could trace the registry during bootup I could
> > figure it out.
> >
> > I tried Windows XP audit but it doesn't work during
> > bootup.
>