Freeware tool offered by Sysinternals , provides the ability to monitor registry-related read and write activity in real-time.
It could be used to monitor creation of the registry keys by some malicious code.
It works on all versions of WinNT/2K, Windows 9x/Me and Windows 64-bit.