%SystemDrive%\Documents and Settings\All Users\Start Menu\Programs\Startup
%SystemDrive%\Documents and Settings\<username>\Start Menu\Programs\Startup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, Common Startup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, Common AltStartup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, Common Startup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, Common AltStartup
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, Startup
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, AltStartup
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, Startup
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, AltStartup
--
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
--
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows, load
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows, run
--
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer, run
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, shell
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, shell
--
HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Startup
HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown
HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logon
HKCU\Software\Policies\Microsoft\Windows\System\Scripts\Logoff
--
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd, StartupPrograms
--
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Runonce
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunonceEx
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
--
%WinDir%\system.ini
%WinDir%\win.ini
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
--
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions
--
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, AppSetup
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, GinaDLL
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, System
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Taskman
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, UIHost
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, VmApplet
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Userinit
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, shell
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon, shell
--
HKCU\Control Panel\Desktop, SCRNSAVE.EXE
--
HKLM\SYSTEM\CurrentControlSet\Control\BootVerificationProgram, ImageName
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, Appinit_Dlls
HKLM\SOFTWARE\Classes\Protocols\Filter
HKLM\SOFTWARE\Classes\Protocols\Handler
--
HKCU\Software\Microsoft\Internet Explorer\Desktop\Components
--
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
HKCU\Software\Microsoft\Active Setup\Installed Components
--
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
--
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
--
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKCU\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
--
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
--
HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers
HKCU\Software\Classes\Folder\shellex\ColumnHandlers
--
HKLM\SOFTWARE\Microsoft\Ctf\LangBarAddin
HKCU\Software\Microsoft\Ctf\LangBarAddin
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
--
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks
--
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
--
HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars
HKCU\Software\Microsoft\Internet Explorer\Explorer Bars
--
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
HKCU\Software\Microsoft\Internet Explorer\Extensions
--
HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt
--
HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins
--
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units
%WinDir%\Downloaded Program Files
--
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefix
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
HKLM\SYSTEM\CurrentControlSet\Services
HKLM\SYSTEM\ControlSet001\Services
HKLM\SYSTEM\ControlSet002\Services
HKLM\SYSTEM\ControlSet003\Services
HKLM\SYSTEM\CurrentControlSet\Services
HKLM\SYSTEM\ControlSet001\Services
HKLM\SYSTEM\ControlSet002\Services
HKLM\SYSTEM\ControlSet003\Services
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager, BootExecute +
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager, Execute
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager, SetupExecute
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDlls
HKLM\SYSTEM\CurrentControlSet\Control\Lsa, Authentication Packages
HKLM\SYSTEM\CurrentControlSet\Control\Lsa, Notification Packages
HKLM\SYSTEM\CurrentControlSet\Control\Lsa, Security Packages
--
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders, SecurityProviders
HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKLM\SOFTWARE\Microsoft\Command Processor, AutoRun
HKCU\Software\Microsoft\Command Processor, AutoRun
HKLM\SOFTWARE\Classes\*\shell\open\command
HKCU\Software\Classes\*\shell\open\command
%WinDir%\system32
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
HKCU\Control Panel\IOProcs, MVB
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\Utility Manager
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\BackupPath
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\Cleanuppath
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\DefragPath
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug, Debugger
HKLM\SOFTWARE\Microsoft\Windows Script Host
--
Task Scheduler: %WinDir%\Tasks
HKCU\Software\Mirabilis\ICQ\Agent\Apps
Автор: Saule
2007