随系统启动加载的方式（收集中）

1、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/ShellServiceObjectDelayLoad 

随系统延迟加载

2、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Windows

AppInit_DLLs＝""

作为系统dll加载到所有进程，开机启动，无进程

3、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run

4、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/RunOnce

5、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/RunOnceEx

6、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File Execution Options/

替换默认系统功能程序，比如taskman ，按下Ctrl＋Alt＋Del触发

7、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon/Userinit   

8、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon/Shell   

9、HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services   

服务

10、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Policies/Explorer/Run

随IE启动的

11、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Browser Helper Objects/

12、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Internet Explorer/Extensions/

13、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Internet Explorer/Toolbar/

14、HKEY_LOCAL_MACHINE/Software/Microsoft/Internet Explorer/URLSearchHooks/

 

 推荐查杀工具：恶意软件清理助手，360safe