Delete Key dan Value
- HKCR\*\shellex\ContextMenuHandlers\Open With\
- HKCR\inffile\shell\Install\command\
- HKCR\inffile\shell\Install\
- HKCR\regfile\shell\open\command\
- HKCR\regfile\shell\open\
- HKCR\VBEFile\Shell\Open2\command\
- HKCR\VBEFile\Shell\Open2\
- HKCR\VBEFile\Shell\Edit\command\
- HKCR\VBEFile\Shell\Edit\
Add Key dan Value
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr
- HKCU\Software\Policies\Microsoft\Windows\System\DisableCMD,2,REG_DWORD
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner,ALICE
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOrganization
- HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableSR
- HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableConfig
- HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
C:\WINDOWS\system32\userinit.exe, C:\WINDOWS\system32\wscript.exe //e:vbscript.encode C:\WINDOWS\system32\drivers\alice.sys