Hey Hey,

That list is by no means comprehensive... It's a tutorial giving examples of each code... not the complete listing... For Example:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

Are all scanned by HJT yet don't appear on that page.

I did test the HKCR\Exefiles\Shell\Open\Command and it is definately not detected... However the number of places that you could possibly hijack in the registry are quite numerous... With each version more and more places are being added... but if the program grows too large it'll lose it's purpose and become a registry scanning/cleaning tool more than anything else... I'd suggest you send an email in and request that that Key be added to the list of locations that HJT checks...

There are obviously places that it doesn't look and places that people won't know to look... but that's why they pay us the big bucks... and that's why there are programs to look for specific pieces of malware...

Peace,
HT