[CCT]

I have a registry entry under
HKey_Local_Machine\Software\Microsoft\Windows\Current_User\RunOnce that I
can't find any info about and every time I delete it it comes back.
The entry is PIP_Clean and it's looking for a file named travlocl.exe which
it can't find.

I have been unable to find a reference to either of these names.

The weird part (at least to me) is that if I delete the entry it comes right
back as soon as I move off the key.

Any ideas what this is?

[Doug Knox MS-MVP]

This sounds like spyware/malware of some variety. Its actually monitoring this key to ensure that its "run command" is always there.

http://www.lavasoftusa.com for AdAware
http://www.safer-networking.org for SpyBot Search and Destroy

For both of the above programs, ensure you check for updates, as the original download may not include the latest definitions files.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"CCT" <CCT@discussions.microsoft.com> wrote in message news:10D20FF4-CF79-4F62-9E55-A982FB459AE6@microsoft.com...
>I have a registry entry under
> HKey_Local_Machine\Software\Microsoft\Windows\Current_User\RunOnce that I
> can't find any info about and every time I delete it it comes back.
> The entry is PIP_Clean and it's looking for a file named travlocl.exe which
> it can't find.
>
> I have been unable to find a reference to either of these names.
>
> The weird part (at least to me) is that if I delete the entry it comes right
> back as soon as I move off the key.
>
> Any ideas what this is?