Leave Process Monitor running in the background somewhere, filtering to the relevant registry keys, and when they change, go inspect the log to see what did it.
_________________________
Bitt Faulk