1、01、DOS 虚拟机程序 *SYSTEMCurrentControlSetControlWOW* 02、 Explorer 防毒键值*SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2*03、Ini 重定向加载项*MicrosoftWindows NTCurrentVersionIniFileMapping*04、LSA 本地安全策略*SYSTEMCurrentControlSetControlLsa* *SYSTEMCurrentControlSetControlSecurityProviders* 05、Rpc 网络远程调用
2、协议*SOFTWAREMicrosoftRpc* 06、ShellExecuteHooks 隐性启动 *SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks* 07、 Windows 安全中心*SOFTWAREMicrosoftsecurity center*08、 Windows 的文件校验*SOFTWAREPoliciesMicrosoftSystemCertificatesTrustedPublisherSafer* 键 值 AuthenticodeFlags09、WinSock 网络协议 *SYSTEM*cont
3、rolset*ServicesWinSock*10、安全模式 *SYSTEM*CurrentControlSet*ControlSafeBoot*11、磁盘显示与隐藏*EnumPCI* 键值 ChannelOptions12、打印服务 *SYSTEMCurrentControlSetControlPrint*13、计划任务 *SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler*14、浏览器侧边栏*SOFTWAREMicrosoftInternet ExplorerExplorer Bars*15、浏览器插件 *SO
4、FTWAREClassesCLSID* 键值 InprocServer32 *SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects* *SOFTWAREMicrosoftWindowsCurrentVersionExtStats*16、浏览器工具栏按钮 *SoftwareMicrosoftInternet ExplorerExtensions*17、浏览器工具条*SOFTWAREMicrosoftInternet ExplorerToolbar*18、浏览器默认搜索引擎劫持*SoftwareMicrosoftI
5、nternet ExplorerURLSearchHooks*19、浏览器启动页面*SOFTWAREClassesCLSID*shellOpenHomePageCommand*20、浏览器设置键值*Internet ExplorerControl Panel*Internet ExplorerMain*Internet ExplorerMain*SYSTEMCurrentControlSetControlTerminal ServerWdsrdpwd*21、浏览器通信协议*SOFTWAREClassesPROTOCOLSHandler*22、浏览器协议前缀*SOFTWAREMicrosoftW
6、indowsCurrentVersionURL*23、浏览器右键菜单*SoftwareMicrosoftInternet ExplorerMenuExt*24、命令行劫持*SOFTWAREMicrosoftCommand Processor*25、默认屏幕保护程序*Control PanelDesktop*26、启动项相关键值*SoftwareMicrosoftWindowsCurrentVersionRun *SoftwareMicrosoftWindowsCurrentVersionRun* *SoftwareMicrosoftWindowsCurrentVersionRunOnce *S
7、oftwareMicrosoftWindowsCurrentVersionRunOnce*27、输入法加载项*SYSTEMCurrentControlSetControlKeyboard Layouts*28、网络协议组件*SoftwareClassesProtocolsFilter*SoftwareClassesProtocolsHandler*29、文件关联及打开方式* 键值 Drive*fileshell*opencommand*ShowExt*CommCntrMaintenancePatch.CommCntrMaintenancePatch1*foldershell*ddeexec*h
8、ttp*shellopencommand*InProcServer32*SOFTWAREClasses.*30、文件夹选项菜单*SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer 键 值 NoFolderOptions31、系统保护文件设置*SYSTEMCurrentControlSetControlSession Manager 键值 AllowProtectedRenames32、系统登录脚本*SOFTWAREPoliciesMicrosoftWindowsSystemScripts*33、系统动态组件*SoftwareMicros
9、oftActive SetupInstalled Components*34、系统环境变量*SYSTEMCurrentControlSetControlSession Manager*35、服务*Services*36、系统解码插件 *SOFTWAREClassesCLSID083863F1-70DE-11D0-BD40-00A0C911CE86*37、系统界面核心 用户环境*SoftwareMicrosoftWindows NTCurrentVersionWindows* *SOFTWAREMicrosoftWindows NTCurrentVersionWinlogon*38、系统配置策略
10、SoftwareMicrosoftWindowsCurrentVersionPolicies*39、系统启动配置 *SYSTEMCurrentControlSetControlBootVerificationProgram*40、系统图标资源*Icon*Control PanelDesktopWindowMetrics41、系统自动播放 *SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerNoDriveTypeAuto Run*SystemCurrentControlSetServicesCdromAutorun42、显示或隐藏文件*
11、SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced*43、映像劫持*AeDebug*Image File Execution Options*44、用户登陆框*SOFTWAREMicrosoftWindows NTCurrentVersionGinaDLL*45、用户账户列表*SAM*46、终端服务*SOFTWAREMicrosoftWindows NTCurrentVersionDrivers32Terminal Server* *SYSTEMCurrentControlSetControlTerminal Server*47、终止程序设置*Control PanelDesktopArtoEndTasks*Control PanelDesktopHungAppTimeOut*Control PanelDesktopWaitToKillAppTimeout* *SYSTEM*ControlSet*ControlWaitToKillServiceTimeout*48、桌面项目设置*SoftwareMicrosoftWindowsCurrentVersionExplorer* 键值 HideDesktopIcons49、组策略设置键值*SOFTWAREPoliciesMicrosoftWindowsSafer*
