01、DOS虚拟机程序*SYSTEMCurrentControlSetControlWOW*02、Explorer防毒键值*SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2*03、Ini重定向加载项*MicrosoftWindows NTCurrentVersionIniFileMapping*04、LSA本地安全策略*SYSTEMCurrentControlSetControlLsa*SYSTEMCurrentControlSetControlSecurityProviders*05、Rpc网络远程调用协议*SOFTWAREMicrosoftRpc*06、ShellExecuteHooks隐性启动*SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks*07、Windows安全中心*SOFTWAREMicrosoftsecurity center*08、Windows的文件校验*SOFTWAREPoliciesMicrosoftSystemCertificatesTrustedPublisherSafer*键值 AuthenticodeFlags09、WinSock网络协议*SYSTEM*controlset*ServicesWinSock*10、安全模式*SYSTEM*CurrentControlSet*ControlSafeBoot*11、磁盘显示与隐藏*EnumPCI*键值ChannelOptions12、打印服务*SYSTEMCurrentControlSetControlPrint*13、计划任务*SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler*14、浏览器侧边栏*SOFTWAREMicrosoftInternet ExplorerExplorer Bars*15、浏览器插件*SOFTWAREClassesCLSID*键值 InprocServer32*SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects*SOFTWAREMicrosoftWindowsCurrentVersionExtStats*16、浏览器工具栏按钮*SoftwareMicrosoftInternet ExplorerExtensions*17、浏览器工具条*SOFTWAREMicrosoftInternet ExplorerToolbar*18、浏览器默认搜索引擎劫持*SoftwareMicrosoftInternet ExplorerURLSearchHooks*19、浏览器启动页面*SOFTWAREClassesCLSID*shellOpenHomePageCommand*20、浏览器设置键值*Internet ExplorerControl Panel*Internet ExplorerMain*Internet ExplorerMain*SYSTEMCurrentControlSetControlTerminal ServerWdsrdpwd*21、浏览器通信协议*SOFTWAREClassesPROTOCOLSHandler*22、浏览器协议前缀*SOFTWAREMicrosoftWindowsCurrentVersionURL*23、浏览器右键菜单*SoftwareMicrosoftInternet ExplorerMenuExt*24、命令行劫持*SOFTWAREMicrosoftCommand Processor*25、默认屏幕保护程序*Control PanelDesktop*26、启动项相关键值*SoftwareMicrosoftWindowsCurrentVersionRun*SoftwareMicrosoftWindowsCurrentVersionRun*SoftwareMicrosoftWindowsCurrentVersionRunOnce*SoftwareMicrosoftWindowsCurrentVersionRunOnce*27、输入法加载项*SYSTEMCurrentControlSetControlKeyboard Layouts*28、网络协议组件*SoftwareClassesProtocolsFilter*SoftwareClassesProtocolsHandler*29、文件关联及打开方式*键值 Drive*fileshell*opencommand*ShowExt*CommCntrMaintenancePatch.CommCntrMaintenancePatch1*foldershell*ddeexec*http*shellopencommand*InProcServer32*SOFTWAREClasses.*30、文件夹选项菜单*SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer键值 NoFolderOptions31、系统保护文件设置*SYSTEMCurrentControlSetControlSession Manager键值AllowProtectedRenames32、系统登录脚本*SOFTWAREPoliciesMicrosoftWindowsSystemScripts*33、系统动态组件*SoftwareMicrosoftActive SetupInstalled Components*34、系统环境变量*SYSTEMCurrentControlSetControlSession Manager*35、服务*Services*36、系统解码插件*SOFTWAREClassesCLSID083863F1-70DE-11D0-BD40-00A0C911CE86*37、系统界面核心用户环境*SoftwareMicrosoftWindows NTCurrentVersionWindows*SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon*38、系统配置策略*SoftwareMicrosoftWindowsCurrentVersionPolicies*39、系统启动配置*SYSTEMCurrentControlSetControlBootVerificationProgram*40、系统图标资源*Icon*Control PanelDesktopWindowMetrics41、系统自动播放*SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerNoDriveTypeAutoRun*SystemCurrentControlSetServicesCdromAutorun42、显示或隐藏文件*SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced*43、映像劫持*AeDebug*Image File Execution Options*44、用户登陆框*SOFTWAREMicrosoftWindows NTCurrentVersionGinaDLL*45、用户账户列表*SAM*46、终端服务*SOFTWAREMicrosoftWindows NTCurrentVersionDrivers32Terminal Server*SYSTEMCurrentControlSetControlTerminal Server*47、终止程序设置*Control PanelDesktopArtoEndTasks*Control PanelDesktopHungAppTimeOut*Control PanelDesktopWaitToKillAppTimeout*SYSTEM*ControlSet*ControlWaitToKillServiceTimeout*48、桌面项目设置*SoftwareMicrosoftWindowsCurrentVersionExplorer*键值 HideDesktopIcons49、组策略设置键值*SOFTWAREPoliciesMicrosoftWindowsSafer*