1、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/ShellServiceObjectDelayLoad
随系统延迟加载
2、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Windows
AppInit_DLLs=""
作为系统dll加载到所有进程,开机启动,无进程
3、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run
4、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/RunOnce
5、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/RunOnceEx
6、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File Execution Options/
替换默认系统功能程序,比如taskman ,按下Ctrl+Alt+Del触发
7、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon/Userinit
8、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon/Shell
9、HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services
服务
10、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Policies/Explorer/Run
随IE启动的
11、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/Browser Helper Objects/
12、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Internet Explorer/Extensions/
13、HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Internet Explorer/Toolbar/
14、HKEY_LOCAL_MACHINE/Software/Microsoft/Internet Explorer/URLSearchHooks/
推荐查杀工具:恶意软件清理助手,360safe