HKCU\SOFTWARE\Microsoft\Internet Explorer\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Webcheck\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\* [*] HKCU\SOFTWARE\Microsoft\Search Assistant\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\Internet Explorer\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\Windows\History\* [*] %CSIDL_APPDATA%\Microsoft\Windows\Cookies\* [*] %CSIDL_APPDATA%\Microsoft\Internet Explorer\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Default Behaviors\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Media\\MimeTypes\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Plugins\MIME\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Security\AntiPhishing\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\* [*] %CSIDL_QUICKLAUNCH%\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter [EnabledV8] HKCU\SOFTWARE\Microsoft\Internet Explorer\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Webcheck\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\* [*] HKCU\SOFTWARE\Microsoft\Search Assistant\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\Internet Explorer\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\Windows\History\* [*] %CSIDL_APPDATA%\Microsoft\Windows\Cookies\* [*] %CSIDL_APPDATA%\Microsoft\Internet Explorer\* [*] MigXmlHelper.IsUpgrade() HKCU\Software\Microsoft\Internet Explorer\Styles [Use My Stylesheet] HKCU\Software\Microsoft\Internet Explorer\Styles [User Stylesheet] HKCU\Software\Microsoft\Internet Explorer\Desktop\General [*] HKCU\Software\Microsoft\Internet Explorer\Default HTML Editor\* [*] HKCU\Software\Microsoft\Internet Explorer\Default MHTML Editor\* [*] HKCU\Software\Microsoft\Internet Explorer\Main [Save Directory] %CSIDL_LOCAL_APPDATA%\Microsoft\Internet Explorer [MSIMGSIZ.dat] HKLM\SOFTWARE\Microsoft\Internet Explorer\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\* [*] HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c} [IsInstalled] HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo [IconsVisible] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\* [*] %WINDIR%\System32 [rsaci.rat] HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Unattend\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer [Build] HKLM\SOFTWARE\Microsoft\Internet Explorer [Version] HKLM\SOFTWARE\Microsoft\Internet Explorer [W2kVersion] HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Default Behaviors\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\International\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\MenuExt\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Media\\MimeTypes\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\MIME\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings [MinorVersion] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SO\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\TemplatePolicies\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Capabilities\UrlAssociations [gopher] HKLM\SOFTWARE\Microsoft\Internet Explorer\Version Vector\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter [EnabledV8] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0002df01-0000-0000-c000-000000000046} [Policy] HKLM\SOFTWARE\Microsoft\Internet Explorer\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\* [*] HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c} [IsInstalled] HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo [IconsVisible] %WINDIR%\System32 [rsaci.rat] %CSIDL_PROGRAM_FILES%\Internet Explorer\CUSTOM\* [*] %CSIDL_PROGRAM_FILES%\Internet Explorer\SIGNUP\* [*] %windir%\system32\ie4uinit.exe -apply MigXmlHelper.IsUpgrade() HKLM\SOFTWARE\Microsoft\Internet Explorer\View Source Editor [Editor Name] HKLM\SOFTWARE\Microsoft\Internet Explorer [BrandGUID] MigXmlHelper.IsUpgrade() MigXmlHelper.DoesObjectExist("Registry", "HKLM\SOFTWARE\Microsoft\Internet Explorer [BrandGUID]") MigXmlHelper.DoesObjectExist("Registry", "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\%InternetExplorer.BrandGUID%") HKLM\SOFTWARE\Microsoft\Internet Explorer [BrandGUID] HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\%InternetExplorer.BrandGUID%\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Default Behaviors\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Media\\MimeTypes\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Plugins\MIME\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Security\AntiPhishing\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\* [*] %CSIDL_QUICKLAUNCH%\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter [EnabledV8] HKCU\SOFTWARE\Microsoft\Internet Explorer\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Webcheck\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\* [*] HKCU\SOFTWARE\Microsoft\Search Assistant\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\Internet Explorer\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\Windows\History\* [*] %CSIDL_APPDATA%\Microsoft\Windows\Cookies\* [*] %CSIDL_APPDATA%\Microsoft\Internet Explorer\* [*] MigXmlHelper.IsUpgrade() HKCU\Software\Microsoft\Internet Explorer\Styles [Use My Stylesheet] HKCU\Software\Microsoft\Internet Explorer\Styles [User Stylesheet] HKCU\Software\Microsoft\Internet Explorer\Desktop\General [*] HKCU\Software\Microsoft\Internet Explorer\Default HTML Editor\* [*] HKCU\Software\Microsoft\Internet Explorer\Default MHTML Editor\* [*] HKCU\Software\Microsoft\Internet Explorer\Main [Save Directory] %CSIDL_LOCAL_APPDATA%\Microsoft\Internet Explorer [MSIMGSIZ.dat] HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Unattend\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer [Build] HKLM\SOFTWARE\Microsoft\Internet Explorer [Version] HKLM\SOFTWARE\Microsoft\Internet Explorer [W2kVersion] HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Default Behaviors\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\International\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\MenuExt\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Media\\MimeTypes\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Plugins\MIME\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings [MinorVersion] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SO\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Capabilities\UrlAssociations [gopher] HKLM\SOFTWARE\Microsoft\Internet Explorer\Version Vector\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter [EnabledV8] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0002df01-0000-0000-c000-000000000046} [Policy] HKLM\SOFTWARE\Microsoft\Internet Explorer\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\* [*] HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c} [IsInstalled] HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo [IconsVisible] %WINDIR%\System32 [rsaci.rat] %CSIDL_PROGRAM_FILES%\Internet Explorer\CUSTOM\* [*] %CSIDL_PROGRAM_FILES%\Internet Explorer\SIGNUP\* [*] HKLM\SOFTWARE\Microsoft\Internet Explorer\Capabilities\UrlAssociations [gopher] %windir%\system32\ie4uinit.exe -apply MigXmlHelper.IsUpgrade() HKLM\SOFTWARE\Microsoft\Internet Explorer\View Source Editor [Editor Name] HKCU\SOFTWARE\Microsoft\Internet Explorer\Default Behaviors\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\MenuExt\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Media\\MimeTypes\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Plugins\MIME\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\Security\AntiPhishing\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\* [*] %CSIDL_QUICKLAUNCH%\* [*] HKCU\SOFTWARE\Microsoft\Internet Explorer\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Webcheck\* [*] HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\* [*] HKCU\SOFTWARE\Microsoft\Search Assistant\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\Internet Explorer\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\Windows\History\* [*] %CSIDL_APPDATA%\Microsoft\Windows\Cookies\* [*] %CSIDL_APPDATA%\Microsoft\Internet Explorer\* [*] MigXmlHelper.IsUpgrade() HKCU\Software\Microsoft\Internet Explorer\Styles [Use My Stylesheet] HKCU\Software\Microsoft\Internet Explorer\Styles [User Stylesheet] HKCU\Software\Microsoft\Internet Explorer\Desktop\General [*] HKCU\Software\Microsoft\Internet Explorer\Default HTML Editor\* [*] HKCU\Software\Microsoft\Internet Explorer\Default MHTML Editor\* [*] HKCU\Software\Microsoft\Internet Explorer\Main [Save Directory] %CSIDL_LOCAL_APPDATA%\Microsoft\Internet Explorer [MSIMGSIZ.dat] HKLM\SOFTWARE\Microsoft\Internet Explorer\* [*] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\* [*] HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c} [IsInstalled] %WINDIR%\System32 [rsaci.rat] %CSIDL_PROGRAM_FILES%\Internet Explorer\CUSTOM\* [*] %CSIDL_PROGRAM_FILES%\Internet Explorer\SIGNUP\* [*] %windir%\system32\ie4uinit.exe -apply MigXmlHelper.IsUpgrade() HKLM\SOFTWARE\Microsoft\Internet Explorer\View Source Editor [Editor Name] Network_and_Internet\Internet_Options