Maybe msconfig.exe ? I've heard that some trojans disable msconfig to prevent users from easily disabling hklm run keys. Maybe VMM32.VXD ? to...
Separate names with a comma.