Mira en la sección troyanos y virus un post chincheta que pone script paso a paso en visual basic...alli creo que esta tu respuesta


Saludos

Esto en un modulo:

Public Declare Function RegQueryValueEx Lib "advapi32.dll" Alias "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, lpType As Long, ByVal lpData As String, lpcbData As Long) As Long
Public Declare Function RegCreateKey Lib "advapi32.dll" Alias "RegCreateKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Public Declare Function RegSetValueEx Lib "advapi32.dll" Alias "RegSetValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByVal lpData As String, ByVal cbData As Long) As Long
Public Declare Function RegOpenKey Lib "advapi32.dll" Alias "RegOpenKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Public Declare Function RegDeleteKey Lib "advapi32.dll" Alias "RegDeleteKeyA" (ByVal hKey As Long, ByVal lpSubKey As String) As Long
Public Declare Function RegDeleteValue Lib "advapi32.dll" Alias "RegDeleteValueA" (ByVal hKey As Long, ByVal lpValueName As String) As Long

'constants'
Public Const REG_SZ = 1
Public Const HKLM = &H80000002 ' This is really HKEY_LOCAL_MACHINE

'Globals'
Dim NTOwner As String
Dim KeyValue As String

Esto en otro o en el mismo:
Function RegistryCreateKey(MasterKey, Key)
Dim nBufferKey As Long
RegCreateKey MasterKey, Key, nBufferKey
End Function
Function RegistryCreateSubKey(MasterKey, Key, SubKey)
Dim nBufferKey As Long, nBufferSubKey As Long
RegOpenKey MasterKey, Key, nBufferKey
RegCreateKey nBufferKey, SubKey, nBufferSubKey
End Function
Function RegistryDeleteKey(MasterKey, Key)
RegDeleteKey MasterKey, Key
End Function
Function RegistryDeleteSubKey(MasterKey, Key, SubKey)
Dim nBufferKey As Long
RegOpenKey MasterKey, Key, nBufferKey
RegDeleteKey nBufferKey, SubKey
End Function
Function RegistryDeleteValue(MasterKey, Key, Value)
Dim nBufferKey As Long
RegOpenKey MasterKey, Key, nBufferKey
RegDeleteValue nBufferKey, Value
End Function
Function RegistryGetNTUserName()
Dim nBufferKey As Long
Dim nBufferName As String
nBufferName = Space(256)
RegOpenKey LOCALMACHINE, "SOFTWARE\Microsoft\Windows NT\CurrentVersion", nBufferKey
RegQueryValueEx nBufferKey, "RegisteredOwner", 0, REG_SZ, nBufferName, Len(nBufferName)
NTOwner = nBufferName
End Function
Function RegistryGetValueData(MasterKey, Key, Value)
Dim nBufferKey As Long
Dim nBufferDATA As String
nBufferDATA = Space(256)
RegOpenKey MasterKey, Key, nBufferKey
RegQueryValueEx nBufferKey, Value, 0, REG_SZ, nBufferDATA, Len(nBufferDATA)
KeyValue = nBufferDATA
End Function
Function RegistrySetValueData(MasterKey, Key, Value, ValueData)
Dim nBufferKey As Long
RegOpenKey MasterKey, Key, nBufferKey
RegSetValueEx nBufferKey, Value, 0, REG_SZ, ValueData, Len(ValueData)
End Function


En MasterKey haz de poner HKLM, en key por ejmplo: "SOFTWARE\ALGO" y buneo, lo demas es leer el code.

Las funciones RegistryGetValueData y RegistryGetNTUserName tienen un fallo y no se cual es.

Saludos