Those four-letter abbreviations are included here because either one can be referenced in definitions. Most of the time you will use the longer versions but either way works. You'll see them in both forms in other places, too, so don't be too shocked.

Each hive includes a number of registry "keys" inside of it. The most important hives are going to be HKCU and HKLM. This is where the majority of system information is kept, and the majority of malware changes are made.

A registry key can have registry keys inside of itself as well. Think of keys as folders or directories, and registry "values" as files. A value stores a tidbit of information on the system. It is usually used to hold only one setting, and it can be a string, a number, or binary code.

Every registry key must contain a default value, which can be totally empty, or which might hold information. We'll look at these a little later.

So how to registry definitions work?

Registry definitions are basically stored in a giant ".reg" file called reg-list.reg. This file is automatically merged with the Windows registry whenever QVR runs a scan. There are a few things registry definitions can do:

1. Adding or changing registry value(s)

The registry definitions can or change registry values like this:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion]
"WallpaperDir"="%SystemRoot%\Web\Wallpaper"

The first line sets the key that is going to be used, and the second one sets the value "WallpaperDir" to the desired contents. If you want to change more than one value in a single key, you only need to use the first line once, and then list each value change after:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion]
"WallpaperDir"="%SystemRoot%\Web\Wallpaper"
"ProgramFilesPath"="%ProgramFiles%"

If the key(s) don't already exist, they are created for you.

If you need to set a numeric value, you have to do it like this:


To indicate that you want to change a default value, use the "@" character in place of the value name:

2. Deleting registry value(s)

To delete a specific registry value, the code for the registry definitions looks like this:


I know, "=-" looks weird, but that's how it works. If the value doesn't exist, nothing happens here.

3. Deleting registry key(s)

To delete an entire registry keys and all keys and values within it, you use code that looks like this:


See that little minus thing? Yep, that's what you have to remember. If the registry key doesn't exist, nothing happens.

Alright, where do I find this stuff?

As always, ThreatExpert has the answer. There is a little section near the bottom of the report for any malware that creates registry entries that looks like this: