W32.Spybot.Worm - deletion of offending registry entries is being monitored by virus
OS: Windows XP Home Edition SP2 and all critical updates applied as of 5-29-2007.
Ran full scan using Symantec antivirus. Symantec antivirus detected W32.Spybot.Worm; specifically it removed c:\windows\system32\avp.exe.
From Symantec's website they outline the procedure for removal of the worm. After the full scan and deletion of the file, Symantec then details the procedure for cleaning the registry by removing the references to the deleted file (in my case, avp.exe) from the following locations:
The problem is that after removing the "avp.exe" entry from the above keys, a quick reivew shows that they have been added back almost immediately. It's as though some service is monitoring my editing of the registry and replaces them after I've completed editing.