Figure 1: Sample values in the Run registry key PCTVOICE=pctspk.exe SynTPLpr=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe SynTPEnh=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe WinVNC="C:\Program Files\UltraVNC\WINVNC.EXE" -servicehelper ShStatEXE="C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE McAfeeUpdaterUI="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey