无忧启动论坛
标题:
以下输入法注册表文件，没有用的可能是哪一部分？
[打印本页]
作者:
tt911
时间:
2018-9-28 19:16
标题:
以下输入法注册表文件，没有用的可能是哪一部分？
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.swnpf]
@="WanNengWBImeSkinFile"
Windows Registry Editor Version 5.00
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\Microsoft\CTF\Assemblies\0x00000804\{34745C63-B2F0-4784-8B67-5E12C8701A31}]
"Default"="{00000000-0000-0000-0000-000000000000}"
"Profile"="{00000000-0000-0000-0000-000000000000}"
"KeyboardLayout"=dword:08040804
Windows Registry Editor Version 5.00
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\Microsoft\CTF\DirectSwitchHotkeys\00001000]
"CLSID"="{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}"
"LangId"="00000804"
"Modifiers"="0000c002"
"PreservedKeyId"="{3B09F8DC-6114-43A5-98F3-C5CA414C4633}"
"Profile"="{1E552381-07D8-4DB8-B086-65EF69BC9965}"
"VirtualKey"="000000bc"
Windows Registry Editor Version 5.00
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\Microsoft\CTF\HiddenDummyLayouts]
"00000804"="00000804"
Windows Registry Editor Version 5.00
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\Microsoft\CTF\SortOrder\AssemblyItem\0x00000804\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000]
"CLSID"="{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}"
"Profile"="{1E552381-07D8-4DB8-B086-65EF69BC9965}"
"KeyboardLayout"=dword:00000000
Windows Registry Editor Version 5.00
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\WanNengWB]
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\WanNengWB\AppInfo]
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\WanNengWB\DownLoadFile]
"d177fc39befb1fbf4e27b269cc9d1dfd"="C:\\Users\\Administrator\\AppData\\LocalLow\\WanNengWBIME\\Config\\wp.gif"
"70814aa68e1bdf77c195dfc384a2f764"="C:\\Users\\Administrator\\AppData\\LocalLow\\WanNengWBIME\\Config\\ug.gif"
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\WanNengWB\PreInstall]
"InstallParentName"="RevoAppBar.exe"
"InstallParentSign"="VS Revo Group"
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\WanNengWB\Setting]
"SoftMD5"="5681b1f90af6017a19a3a06b377f1e7f"
"InstallType"="1"
"UnstallShow"="1"
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\WanNengWB\user]
"7aknr5330"="373500"
"isv_i3735p0"="373500"
"ixt_e3e57m30"="-0812791-005337"
"liFpv3g57a30"="373500"
@=""
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wncl]
@="WanNengWBPYImeDictFile"
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wnpf]
@="WanNengWBImeSkinFile"
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}]
@="万能五笔输入法"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}\InProcServer32]
@="C:\\Windows\\system32\\wnTSF.ime"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WanNengWBImeSkinFile]
@="WanNengWBImeSkinFile"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WanNengWBImeSkinFile\DefaultIcon]
@="C:\\Program Files (x86)\\WanNengWBInput\\9.9.3.10908\\WnSkinInst.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WanNengWBImeSkinFile\shell]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WanNengWBImeSkinFile\shell\open]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WanNengWBImeSkinFile\shell\open\command]
@="\"C:\\Program Files (x86)\\WanNengWBInput\\9.9.3.10908\\WnSkinInst.exe\" -install %1"
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WanNengWBPYImeDictFile]
@="WanNengWBPYImeDictFile"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WanNengWBPYImeDictFile\DefaultIcon]
@="C:\\Program Files (x86)\\WanNengWBInput\\9.9.3.10908\\WnDictInst.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WanNengWBPYImeDictFile\shell]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WanNengWBPYImeDictFile\shell\open]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WanNengWBPYImeDictFile\shell\open\command]
@="\"C:\\Program Files (x86)\\WanNengWBInput\\9.9.3.10908\\WnDictInst.exe\" -install %1"
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}]
@="万能五笔输入法"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}\InProcServer32]
@="C:\\Windows\\SysWow64\\wnTSF.ime"
"ThreadingModel"="Apartment"
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}\LanguageProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}\LanguageProfile\0x00000804]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{1CB3BC1A-2FD4-4668-B5C5-646329DD489F}\LanguageProfile\0x00000804\{1E552381-07D8-4DB8-B086-65EF69BC9965}]
"IconFile"="C:\\Windows\\System32\\wnTSF.ime"
"IconIndex"=dword:ffffff9b
"Enable"=dword:00000001
"HiddenInSettingUI"=dword:00000000
"SubItemInSettingUI"=dword:00000000
"Description"="万能五笔输入法"
Windows Registry Editor Version 5.00
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\Keyboard Layout]
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\Keyboard Layout\Preload]
"1"="00000804"
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\Keyboard Layout\Substitutes]
"00000804"="00000409"
"d0010804"="00000804"
[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\Keyboard Layout\Toggle]
作者:
vaf
时间:
2018-9-28 22:31
本帖最后由 vaf 于 2018-9-28 22:33 编辑
凡带 S-1-5-21 .........
及其子键值
都可删掉
作者:
flyingdancex
时间:
2018-9-28 22:36
呵呵，万能五笔
作者:
nttwqz
时间:
2018-9-28 22:42
Windows Registry Editor Version 5.00
嗯哼哼哼。。。
作者:
maomihuacha
时间:
2018-9-29 09:30
使用 Total Uninstall 6 反复多次监控提取
带 S-1-5-21 也是需要的 这是个性定制的核心 导入可以转换到.DEFAULT键值下
作者:
vaf
时间:
2018-9-29 12:25
监控不到就是没有变化，硬要提取再注入其实是重复注入，没有作用。
这是在一个基础上追加变化的情况。
若要全新应用，则须导出其全部主键和子键，这有时需跟踪安装、调试的全过程，比较麻烦。
作者:
vaf
时间:
2018-9-29 14:27
我怀疑注册表跟踪软件有死角，有些事件跟不到。
作者:
9zhmke
时间:
2018-10-2 16:14
1、HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\可以直接替换成HKEY_CURRENT_USER\SOFTWARE....
2、HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\Microsoft\CTF应该不相关
3、[HKEY_USERS\S-1-5-21-2158447405-545287247-157017643-500\SOFTWARE\WanNengWB\PreInstall] 这个看上去象流氓软件
4、凡是扩展名的关联都可以不要，比如[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wnpf]
5、[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WanNengWBImeSkinFile]肯定是不需要的，但如果输入法要检测完整性那又是另一回事了
......
欢迎光临 无忧启动论坛 (http://bbs.wuyou.net/)
Powered by Discuz! X3.3