Provided Registry Keys
These are just the registry keys, to add analysis these further you really need the names of the values too. The first key is relating to Intel video driver. The second is a network related to LAN Manager. The third is related to the Windows Firewall/Internet Connection Sharing. The forth is indeed a Windows Genuine Advantage hook.
None of these registry keys indicate an intrusion by themselves. However I would investigate if a user has changed these areas or if the changes correlate with Group Policy or Microsoft updates being deployed.
I would suggest that changes to your environment (such as patches, software and group policy) should be tested on a control PC so you can quickly weed out false positives. This will help you to understand the Windows registry more in depth.
Typically high risk registry keys are:
- HKEY_LOCAL_MACHINE \SYSTEM\CurrentControlSet\Control\Session Manager\* particularly PendingFileRenameOperations
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
The suggestions made by Mark are good. Sans.org has plenty of great resources. Personally I would just use a search engine like Google or Bing to search for the registry key/value. Most standard Microsoft registry keys are fairly well documented with explanations.
I would also watch malware reports from all the major vendors. There are generally common patterns on where malware drop registry keys e.g. http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Torpig-A.aspx
Hope this helps.