If you are just looking for some common registry keys used by viruses and worms, you can start with:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce HKCU\Software\Microsoft\Windows\CurrentVersion\Run HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce Those are by far the most popular registry keys used by malicious software to allow the malware to run when windows starts. /john --------------------------------------------------------------------------- ---------------------------------------------------------------------------
