键：Application
20.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cmd
键：Application
21.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.com
键：ProgId
32.HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
键：Run
33.HKLM\software\Microsoft\Windows\CurrentVersion\Policies\Explorer\
键：Run
键：Application
22.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hta
键：Application
23.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pif
36.HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
键：Userinit
37.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
键：Userinit
38.HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
57.HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
键：StubPath
58.HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components
键：StubPath
59.HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components
48.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
49.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
50.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
7.HKLM\SOFTWARE\Microsoft\Command Processor
键：AutoRun
8.HKCU\SOFTWARE\Microsoft\Command Processor
键：AutoRun
9.HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
键：StubPath
60.HKCU\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components
键：StubPath
61.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
51.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
52.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
53.HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
键：CLSID
54.HKCU\SOFTWARE\Classes\PROTOCOLS\Filter
键：CLSID
55.HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
键：CLSID
56.HKCU\SOFTWARE\Classes\PROTOCOLS\Handler
键：CLSID
键：run
15.HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows
键：load
16.HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
键：run
17.HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
键：ProgId
26.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bat
键：ProgId
27.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cmd
键：taskman
10.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
键：taskman
11.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
键：shell
45.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
46.HKCU\Software\Microsoft\Windows\CurrentVersion\Run
47.HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
键：Application
24.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.scr
键：Application
25.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.scr
键：ProgId
28.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.com
键：ProgId
29.HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe
3.HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
4.HKCU\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run
启动项：
1.HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\Run
2.HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\RunOnce
5.HKCU\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\RunOnce
6.HKCU\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\TerminalServer\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
键：Debugger
42.HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd
键：StartupPrograms
43.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
44.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
34.HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
键：AppInit_DLLs
35.HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders
键：SecurityProviders
66.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
67.HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
键：ProgId