That's more a malware-specific question than a registry one. Start
with Google and locate industry write-ups detailing the behavior and
modifications made by individual nasties.
Use tools designed to do this (after fully backing up the registry)
such as Ad-Aware and Spybot Search & Destroy for example.
Generically use a startup manager to examine known startup locations on
disk and in the registry.
Do not modify the registry without knowing exactly what you are doing
and having backed it up (not an "Export") in advance.