Appinit DLLs

Loads given list of DLLs in all user mode procs
HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\ : "Appinit_Dlls"
HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\ : "Appinit_Dlls"

Forces appinit_dlls to be signed. Disabled by default on Win7 for backwards compatibility. Plans to enforce signing in future Win versions (need to test 10).
According to random internet guy, this gets modified by Avast. Probably others too.
user32.dll!ClientThreadSetup -> Kernel32.dll!LoadAppInitDlls -> checks LoadAppInit_DLLs reg key -> call Kernel32.dll!BaseLoadAppInitDLLs -> for each DLL in AppInit_DLLs reg key call Kernel32.dll!LoadLibraryEx (LOAD_LIBRARY_REQUIRE_SIGNED_TARGET == RequireSignedAppINit_DLLs reg key)