Troj/Conhook-AM creates the following registry entries:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\<Random Letters>
DLLName
<Random FileName>.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\<Random Letters>
Impersonate
0
Troj/Conhook-AM is registered as a new service named "<Random Letters>". Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\<Random Letters>