资源管理器加载模块
    + HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
      text/xml
        [A ] 128. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll



    + HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers
      {0561EC90-CE54-4f0c-9C55-E226110A740C}
        [AM] 129. c:\program files\media player classic\codecs\mmfinfo.dll



    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
      HyperTerminal Icon Ext
        [A ] 130. c:\windows\system32\hticons.dll


      WinRAR shell extension
        [AM] 131. c:\program files\winrar\rarext.dll


      Portable Media Devices
        [A ] 132. c:\windows\system32\audiodev.dll


      Portable Media Devices Menu
        [A ] 132. c:\windows\system32\audiodev.dll


      Microsoft Office HTML Icon Handler
        [A ] 133. c:\program files\microsoft office\office11\msohev.dll


      Web Folders
        [A ] 134. c:\program files\common files\microsoft shared\web folders\msonsext.dll


      Haali Column Provider
        [AM] 129. c:\program files\media player classic\codecs\mmfinfo.dll


      PicaView
        [A ] 135. c:\program files\acdsee\picaview.dll


      Shell Extensions for RealOne Player
        [A ] 136. c:\program files\real\realplayer\rpshell.dll


      RISING
        [AM] 137. c:\windows\system32\ravext.dll



    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
      {32CD708B-60A7-4C00-9377-D73EAA495F0F}
        [AM] 137. c:\windows\system32\ravext.dll


      {E3F426F6-8634-42A5-A29E-BC694A88FB7D}
        [AM] 138. c:\windows\system32\kvmxema0.dll


      {334345F1-DACF-3452-CB7D-4620F34A1533}
        [AM] 139. c:\windows\system32\rsztcpm.dll


      {5B681598-AD5F-BC8C-77DC-748FAC8D3FB5}
        [AM] 140. c:\windows\system32\kafyezy.dll


      {4E32FA58-3453-FA2D-BC49-F340348ACCE4}
        [AM] 141. c:\windows\system32\rsmydpm.dll


      {2598FF45-DA60-F48A-BC43-10AC47853D52}
        [AM] 142. c:\windows\system32\rarjbpi.dll


      {4859245F-345D-BC13-AC4F-145D47DA34F4}
        [AM] 143. c:\windows\system32\avzxdmn.dll


      {67D81718-1314-5200-2597-587901018076}
        [AM] 144. c:\windows\system32\kaqhfzy.dll


      {2A321487-4977-D98A-C8D5-6488257545A2}
        [AM] 145. c:\windows\system32\kapjbzy.dll


      {66650011-3344-6688-4899-345FABCD1566}
        [AM] 146. c:\windows\system32\ratbfpi.dll


      {2960356A-458E-DE24-BD50-268F589A56A2}
        [AM] 147. c:\windows\system32\avwlbmn.dll


      {28907901-1416-3389-9981-372178569982}
        [AM] 148. c:\windows\system32\kawdbzy.dll


      {3C87A354-ABC3-DEDE-FF33-3213FD7447C3}
        [AM] 149. c:\windows\system32\kvdxcma.dll




  + 用户登陆自运行项目
    + HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      ravdh3mon
        [A ] 150. c:\program files\netmeeting\ravdh3mon.exe


      Intel Chipset Monitor
        [A ] 151. c:\documents and settings\administrator\local settings\temp\raqjbpi.exe


      logogo
        [AM] 152. c:\windows\system\logogo.exe




  + 程序初始化和已知动态连接库
    + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
      AppInit_DLLs
        [AM] 140. c:\windows\system32\kafyezy.dll





+ 其他自启动项目
  + c:\autorun.inf
    OPEN
      [A ] 153. c:\setup.exe


    shellexecute
      [A ] 153. c:\setup.exe


    shell\打开(&O)\command
      [A ] 153. c:\setup.exe



  + d:\autorun.inf
    OPEN
      [A ] 154. d:\setup.exe


    shellexecute
      [A ] 154. d:\setup.exe


    shell\打开(&O)\command
      [A ] 154. d:\setup.exe



  + e:\autorun.inf
    OPEN
      [A ] 155. e:\setup.exe


    shellexecute
      [A ] 155. e:\setup.exe


    shell\打开(&O)\command
      [A ] 155. e:\setup.exe