KB Article:

Outpost Anti-spyware scans for malware the following registry keys on startup:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RemoteComputer\NameSpace
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\shellex\ContextMenuHandlers
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
• HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar
• HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
• HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce.
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx.
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices.
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions, DllName
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify, DllName
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt
• HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\MenuExt
• HKEY_CLASSES_ROOT\txtfile\shell\open\command
• HKEY_CLASSES_ROOT\txtfile\shell\runas\command
• HKEY_CLASSES_ROOT\exefile\shell\open\command
• HKEY_CLASSES_ROOT\exefile\shell\runas\command
• HKEY_CLASSES_ROOT\comfile\shell\open\command
• HKEY_CLASSES_ROOT\comfile\shell\runas\command
• HKEY_CLASSES_ROOT\piffile\shell\open\command
• HKEY_CLASSES_ROOT\piffile\shell\runas\command
• HKEY_CLASSES_ROOT\batfile\shell\open\command
• HKEY_CLASSES_ROOT\batfile\shell\runas\command
• HKEY_CLASSES_ROOT\cmdfile\shell\open\command
• HKEY_CLASSES_ROOT\cmdfile\shell\runas\command
• HKEY_CLASSES_ROOT\scrfile\shell\open\command
• HKEY_CLASSES_ROOT\scrfile\shell\runas\command
• HKEY_CLASSES_ROOT\regfile\shell\open\command
• HKEY_CLASSES_ROOT\regfile\shell\runas\command
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems, Windows

The following command files are scanned for malware:

• autoexec.bat
• config.sys
• Windows\winstart.bat
• Windows\dosstart.bat
• Windows\system32\autoexec.nt
• Windows\system32\config.nt

The following ini files are scanned for malware:

• Windows\system.ini
• Windows\win.ini

Besides the above mentioned files Outpost also scans autorun.inf in the root of the disk and HOSTS file in Windows\system32\drivers\etc folder.