AppInit_DLLs is a mechanism that allows an arbitrary list of DLLs to be loaded into each user mode process on the system. Microsoft is modifying the AppInit DLLs facility in Windows 7 and Windows Server 2008 R2 to add a new code-signing requirement. This will help improve the system reliability and performance, as well as improve visibility into the origin of software.
简单的说就是：AppInit_DLLs用来全局注入dll模块，凡是导入了user32.dll的程序都会 主动加载这个键值下的模块。
相比XP，Win7下多了两个值：
LoadAppInit_DLLs 为1开启，为0关闭，（Win7默认为0）
RequireSignedAppInit_DLLs 值为1表明模块需要签名才能加载，反之。
AppInit_DLLs键值介绍（Win7系统）
http://msdn.microsoft.com/en-us/library/dd744762(v=vs.85).aspx
64位系统：
AppInit_Dlls(64位程序读取)
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows [AppInit_DLLs]
AppInit_Dlls(32位程序读取)
HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftWindows NTCurrentVersionWindows [AppInit_DLLs]
32位系统：
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindows [AppInit_DLLs]
如何调试：
下USER32!LoadAppInitDlls断点，后面NtOpenKey 和NtQueryValueKey 读取AppInit_Dlls键值，得到模块名，接着LoadLibrary该模块。
jpg改rar 