Is it possible for spyware to some how weave it's way into the registry, when i have a firewall and virus scan
Yes it is very possible for spyware to make it's way into the windows registry even with a firewall. Anti-Virus is made to detect viruses, worms, it's not made to detect spyware/adware thats what spybot seek-and-destroy are used for.

How can or does it get passed a firewall. I have a WinXP SP 1.
Even if a firewall is enabled, you set the firewall to allow traffic on port 80 (www, http) allowing you to have access to webpages that may contain malicious html scripts, javascripts, active x allowing access for spyware/adware to be installed on your system. Like other members say set Internet explorer to prompt for javascript, disable active x, .vbs, .wsh, etc...

I also highly recommend going to www.privacy.net and do a scan on your computer.
Privacy Analysis of your Internet Connection Some Information that is collected about you when visiting a web site
This will show you what you have enabled for example, .vbs, javascript, shockwave, your current location a little bit of other useful information. Help you to secure your browser and surfing habits. Recommend checking this out aswell it allows you to download software that willprevent spyware from being installed on your PC in the first place http://www.antionline.com/showthread...778#post743778

Hope this helps, Computernerd22