：转载时请以超链接形式标明文章原始出处和作者信息及

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinlogonHKLM\SYSTEM\ControlSet001\Control\Session Manager\BootExecute HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\User\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper ObjectsHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnceHKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesHKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce\SetupHKU\.Default\Software\Microsoft\Windows\CurrentVersion\RunHKU\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnceHKLM\System\CurrentControlSet\Services\VxDHKCU\Control Panel\Desktop HKLM\System\CurrentControlSet\ServicesHKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\run HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoadHKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\runHKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\runHKLM\SOFTWARE\Classes\Protocols\Filter HKLM\SOFTWARE\Classes\Protocols\Handler HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved HKLM\Software\Classes\Folder\Shellex\ColumnHandlers HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks HKLM\Software\Microsoft\Internet Explorer\Toolbar HKLM\Software\Microsoft\Internet Explorer\Extensions HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors HKLM\SYSTEM\CurrentControlSet\Control\MPRServices HKCU\ftp\shell\open\command HKCR\ftp\shell\open\command HKCU\Software\Microsoft\ole HKCU\Software\Microsoft\Command Processor HKLM\SOFTWARE\Classes\mailto\shell\open\command HKCR\PROTOCOLS HKCU\Control Panel\Desktop HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units HKLM\SYSTEM\CurrentControlSet\Services\WinSock2 HKLM\SYSTEM\CurrentControlSet\Services\WinSock HKLM\SYSTEM\CurrentControlSet\Control\Lsa HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell folders\Startup HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\runServices HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options HKLM\System\CurrentControlSet\Control\Session Manager\KnownDlls HKLM\SOFTWARE\Classes\Protocols\Handler HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell HKLM\Software\Microsoft\Command Processor HKLM\SOFTWARE\Microsoft\Ras HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Network HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform HKCU\Software\Microsoft\Security Center HKLM\Software\Microsoft\Security Center HKLM\SOFTWARE\Microsoft\Netcache HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt HKCU\Software\Microsoft\Internet explorer\Main\\*page HKCU\Software\Microsoft\Internet explorer\Main\\Enable Browser Extensions HKCU\Software\Microsoft\Internet explorer\Main\Featurecontrol HKCU\Software\Microsoft\Internet explorer\Menuext HKCU\Software\Microsoft\Internet explorer\Styles HKLM\Software\Clients\Startmenuinternet HKLM\Software\Microsoft\Code store database\Distribution units HKCU\Software\Microsoft\Internet explorer\Abouturls HKLM\Software\Microsoft\Internet explorer\Activex compatibility HKCU\Software\Microsoft\Internet Explorer\Explorer Bars HKLM\Software\Microsoft\Internet explorer\Main\\*page HKLM\Software\Microsoft\Internet explorer\Styles HKLM\Software\Microsoft\Internet explorer\Menuext HKLM\Software\Microsoft\Internet explorer\Plugins HKLM\Software\Microsoft\Windows\Currentversion\Explorer\Browser helpr objects HKLM\Software\Microsoft\Windows\Currentversion\Internet settings\*zones HKLM\Software\Microsoft\Windows\Currentversion\Internet settings\Safesites HKLM\Software\Microsoft\Windows\Currentversion\Internet settings\Url HKLM\Software\Microsoft\Windows\Currentversion\Internet settings\Zonemap\Protocoldefaults HKLM\Software\Microsoft\Windows\Currentversion\Internet settings\Zonemap\Domains HKLM\Software\Microsoft\Windows\Currentversion\Internet settings\Zonemap\Ranges