没事做的windows xp全自动安装光盘

满天飞

不是冲击波的,而是XP系统的自动关机的窗口。
在运行里打上"shutdown -s -f -t 3600"就会在一个小时内电脑自动关机。
只要再打上"shutdown -a"就会取消关机命令。

sklss

学彪大侠：
    你好！我是无忧论坛里的一条潜水鱼，之前本人也曾看到过XP安装过程中背景图像可以改为有自己个性的图像，当初没有把握机会学习，今天又看到大侠您发的帖子，正是我所需要的，现在想请教一下

       那些安装背景和XP启动画面是怎样修改的？
还有：建立自动应答文件后产生的两个文件是“UNATTEND.TXT;UNATTEND.cmd”据说若使用CD安装的时候必须将“Unattend.txt”文件改名为“Winnt.sif”文件，是这样的吗？假若是这样的话请问“Unattend.cmd”这个文件要保持不变呢还要也要改名呢？
    还有：本人想想用Cd引导进行无人执守安装的话，得把自动应答文件放在哪个位置？比如说是光盘根目录还是I386目录？
     
          望大侠能相应的指点一下，还有：顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶顶！

        ：）
              2004.07.16

solomonyang

已回了电子邮件

aesop

师父！！！！！！！！！！我也学学如何修改winxp安装背景和启动画面，及自动批量修改winxp的部分配置，还有安装完xp后自动批量安装一些常用工具（并自动注册这些软件和配置软件）。希望您能教教我！谢谢！谢谢！！谢谢！！！！！！！！！！

smcpu

能教教吗？发我邮箱吧

solomonyang

修改winxp安装背景和启动画面
1.复制完winXP pro的安装文件到硬盘上后，点击“i386”目录查找“winntbbu.dl_”；复制到一个地方 ，然后用winRAR打开winntbbu.dl_ ，拖出一个系统文件winntbbu.dll;使用EXESCOPR修改资源,通过makecab命令：“makecab winntbbu.dll winntbbu.dl_”重新生成一个winntbbu.dl_文件
2.同１，修改Ntoskrnl.ex_

solomonyang

系统还原和自动更新是通过修改注册表实现,我可是花了好几个星期才成功的

solomonyang

关于自动批量安装一些常用工具你最好能够学一点批处理文件的编写
批处理文件是一种文本文件。简单的说，它的作用就是自动的连续执行多条命令，批处理文件的内容就是一条一条的命令。

solomonyang

shutdown命令的详细解释:
用法: shutdown [-i | -l | -s | -r | -a] [-f] [-m \\computername] [-t xx] [-cmment"] [-d up:xx:yy]
        -i                      显示 GUI 界面，必须是第一个选项
        -l                      注销(不能与选项 -m 一起使用)
        -s                      关闭此计算机
        -r                      关闭并重启动此计算机
        -a                      放弃系统关机
        -m \\computername       远程计算机关机/重启动/放弃
        -t xx                   设置关闭的超时为 xx 秒
        -c "comment"            关闭注释(最大 127 个字符)
        -f                      强制运行的应用程序关闭而没有警告
        -d [p]:xx:yy         关闭原因代码
                                u 是用户代码
                                p 是一个计划的关闭代码
                                xx 是一个主要原因代码(小于 256 的正整数)
                                yy 是一个次要原因代码(小于 65536 的正整数)

solomonyang

[这个贴子最后由solomonyang在 2004/07/23 04:55pm 第 1 次编辑]

关闭自动更新微软原文:
Important This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
SUMMARY
If you are logged on as a Computer Administrator or a member of the Administrators group, you may be prompted from the notification area of the taskbar to configure the Automatic Updates feature in Windows.
For additional information about the availability of the Automatic Updates feature and how to configure and use it, click the following article numbers to view the articles in the Microsoft Knowledge Base:
306525 How to configure and use Automatic Updates in Windows XP
327850 How to configure and use Automatic Updates in Windows 2000
Advanced users and IT Professionals can also configure Automatic Updates by using Group Policy, using Windows NT 4.0 System Policy, or by modifying registry settings. This article describes how to configure the Automatic Updates features by using Group Policy or registry settings.
For additional information about configuring Automatic Updates on your network, see the Software Update Services Deployment white paper. To view this white paper, visit the following Microsoft Web site:
http://go.microsoft.com/fwlink/?linkid=6928
MORE INFORMATION
Configuring Automatic Updates by using local Group Policy
Click Start, and then click Run.
Type gpedit.msc, and then click OK.
In the Group Policy snap-in, expand Computer Configuration.
Right-click Administrative Templates, and then click Add/Remove Templates.
Click Add, click Wuau.adm in the Windows\Inf folder, and then click Open.
Click Close.
Under Computer Configuration, expand Administrative Templates, expand Windows Components, and then expand Windows Update.
The Configure Automatic Updates policy appears. This policy specifies whether the computer receives security updates and other important downloads through the Windows automatic updating service. The settings for this policy let you specify if automatic updates are enabled on the computer. If the service is enabled, you must select one of the three configuration options.
To view the policy settings, double-click the Configure Automatic Updates policy.
To turn on Automatic Updates, click Enabled in the list of options that appear at the top of the Setting tab.
If you click Enabled, you must select one of the three configuration options.
Select one of the following three options:
2 - Notify for download and notify for install
When Windows finds updates that apply to this computer, an icon appears in the notification area and a message appears that states the updates are ready to be downloaded. If you click either the icon or the message, the option that you use to select the updates you want to download appears. Windows downloads the selected updates in the background. When the download is complete, the icon appears in the notification area again and a message appears that states that the updates are ready to be installed. If you click either the icon or the message, the option that you use to select the updates you want to install appears.
3 - Auto download and notify for install
NOTE: This setting is the default setting.
Windows finds updates that apply to your computer and downloads these updates in the background (the user is not notified or interrupted during this process). When the download is complete, the icon appears in the notification area and a message that states that the updates are ready to be installed appears. If you click either the icon or the message, the option that you use to select the updates you want to install appears.
4 - Auto download and schedule the install
To specify the schedule, select the appropriate options in the Group Policy Settings dialog box. If you do not specify a schedule, the default schedule for all installations is used. This schedule is every day at 3:00 A.M. If any of the updates require you to restart the computer to complete the installation, Windows restarts the computer automatically. (If a user is logged on to the computer when Windows is ready to restart it, the user is notified that Windows will restart. The user can chose to delay the restart operation.)
If you select option 4, you can set a recurring schedule. If you do not set a schedule, all updates are downloaded and installed every day at 3:00 A.M.
Other Options
Additionally, you can select either the Disabled option or the Not Configured option. If you select Disabled, an administrator must download and install any available updates manually from the Microsoft Windows Update Web site.
If you select Not Configured, the status of Automatic Updates (enabled or not enabled) is not specified at the Group Policy level. However, an administrator can still configure Automatic Updates by using Control Panel. Control Panel includes the same settings that are available in Group Policy.
Note An updated Administrative Template (.adm file) is now available for use with the Automatic Updates feature in Windows Server 2003 and the Software Update Services (SUS) Service Pack 1 (SP1) client. This updated policy file adds two new policies:
Reschedule Automatic Updates scheduled installations
Specifies the time for Automatic Updates to wait, following system startup, before proceeding with a scheduled installation that was missed previously
No auto-restart for scheduled Automatic Updates installations
Specifies that to complete a scheduled installation, Automatic Updates will wait for the computer to be restarted by any user who is logged on, instead of causing the computer to restart automatically
The updated client and policy file is included in Windows Server 2003. To download the SUS SP1 client for Windows 2000- and Windows XP-based computers, visit the following Microsoft Web site:
http://www.microsoft.com/windows2000/downloads/recommended/susclient/default.asp
To download the updated Administrative Template for Windows 2000- and Windows XP-based computers, visit the following Microsoft Web site:
http://microsoft.com/downloads/details.aspx?FamilyId=D26A0AEA-D274-42E6-8025-8C667B4C94E9&displaylang=en
Loading policy settings by using Group Policy in Active Directory
You must use the Wuau.adm file that describes the new policy settings for the Automatic Updates client. Wuau.adm is automatically installed to the Windows\Inf folder when you install the new Automatic Updates feature.
You can load Windows\Inf\Wuau.adm as an administrative template in Group Policy Object Editor.
To load policy settings by using Group Policy in Active Directory:
On an Active Directory domain controller, click Start, and then click Run.
Type dsa.msc to load the Active Directory Users and Computers snap-in.
Right-click the organizational unit or domain in which you want to create the policy, and then click Properties.
Click the Group Policy tab, and then click New.
Type a name for the policy, and then click Edit.
Under either Computer Settings, right-click Administrative Templates.
Click Add/Remove Templates, and then click Add.
Type the name of the Automatic Updates .adm file, for example, windows_folder\inf\wuau.adm.
Click Open.
Configuring Automatic Updates by editing the registry
Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
In a non-Active Directory environment, you can edit registry settings to configure Automatic Updates.
NOTE: You must manually create these registry keys.
You can use either of the following methods to set these registry keys:
Manually edit the registry by using Regedit.exe.
Centrally deploy these registry keys by using the Windows NT 4.0-style System Policy functionality.
To use Registry Editor, follow these steps:
Click Start, click Run, and then type regedit in the Open box.
Locate and then click the following key in the registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
Add any of the following settings:
Value name: NoAutoUpdate
Value data: 0 or 1
0: Automatic Updates is enabled (default).
1: Automatic Updates is disabled.
Registry Value Type: Reg_DWORD
Value name: AUOptions
Value data: 1 to 4
1: Keep my computer up to date has been disabled in Automatic Updates.
2: Notify of download and installation.
3: Automatically download and notify of installation.
4: Automatically download and scheduled installation.
Registry Value Type: Reg_DWORD
Value name: ScheduledInstallDay
Value data: 0 to 7
0: Every day.
1 through 7: The days of the week from Sunday (1) to Saturday (7).
Registry Value Type: Reg_DWORD
Value name: ScheduledInstallTime
Value data: n, where n equals the time of day in a 24-hour format (0-23).
Registry Value Type: Reg_DWORD
Value name: UseWUServer
Value data: Set this value to 1 to configure Automatic Updates to use a server that is running Software Update Services instead of Windows Update.
Registry Value Type: Reg_DWORD
Value name: RescheduleWaitTime
Value data: m, where m equals the amount of time (in minutes, 1-60, representing 1 minute to 60 minutes) to wait between the time Automatic Updates starts and the time it begins installations whose scheduled time has passed.
Registry Value Type: Reg_DWORD
Note This setting only affects client behavior after the clients have updated to the SUS SP1 client version or later.
Value name: NoAutoRebootWithLoggedOnUsers
Value data: Reg_DWORD: 0 (false) or 1 (true). If set to 1, Automatic Updates does not automatically restart a computer while users are logged on.
Registry Value Type: Reg_DWORD
Note This setting affects client behavior after the clients have updated to the SUS SP1 client version or later.
To use Automatic Updates with a server that is running Software Update Services, see the Software Update Services Deployment white paper. To view this white paper, visit the following Microsoft Web site:
http://go.microsoft.com/fwlink/?linkid=6928
Note When you configure Automatic Updates directly by using the policy registry keys, the policy overrides the preferences that are set by the local administrative user to configure the client. If an administrator removes the registry keys at a later date, the preferences that were set by the local administrative user are used again.
Note To determine the server that is running Software Update Services your client computers and servers go to for their updates, put the following two settings in the registry at this location:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\
WUServer sets the SUS server by HTTP name (for example, http://IntranetSUS). Registry Value Type: Reg_SZ
WUStatusServer sets the SUS statistics server by HTTP name (for example, http://IntranetSUS). Registry Value Type: Reg_SZ

solomonyang

我学习批处理文件的第一篇文章:
DOS批处理文件
后缀是bat(cmd)的文件就是批处理文件，是一种文本文件。简单的说，它的作用就是自动的连续执行多条命令，批处理文件的内容就是一条一条的命令。那它有什么用呢？
　　比如，在启动wps软件时，每次都必须执行
　　C:\>cd wps
　　C:\WPS>spdos
　　C:\WPS>py
　　C:\WPS>wbx
　　C:\WPS>wps
　　如果每次用WPS之前都这样执行一次，您是不是觉得很麻烦呢？
　　如果有一个方法，只需编写一个批处理文件，就会自动执行刚才的所有命令，您想不想学呢？
　　当您看完此节，自己编写的第一个批处理文件顺利执行时，您一定会大吃一惊的。
　　此外电脑每次启动时都会寻找autoexec.bat这条批处理文件，从而可执行一些每次开机都要执行的命令，如设置路径path、加载鼠标驱动mouse、磁盘加速smartdrv等，可以使您的电脑真正自动化。

　　echo、@、call、pause、rem　是批处理文件最常用的几个命令，我们就从他们开始学起。 echo 表示显示此命令后的字符
echo off 表示在此语句后所有运行的命令都不显示命令行本身
@ 与echo off相象，但它是加在其它命令行的最前面，表示运行时不显示命令行本身。
call 调用另一条批处理文件（如果直接调用别的批处理文件 ，执行完那条文件后将无法执行当前文件后续命令）
pause 运行此句会暂停，显示Press any key to continue... 等待用户按任意键后继续
rem 表示此命令后的字符为解释行，不执行，只是给自己今后查找用的
　　例：用edit编辑a.bat文件，输入下列内容后存盘为c:\a.bat，执行该批处理文件后可实现：将根目录中所有文件写入 a.txt中，启动UCDOS，进入WPS等功能。
　　批处理文件的内容为: 　　　　　　　　文件表示：
　　　　echo off　　　　　　　　　　　　不显示命令行
　　　　dir c:\*.* >a.txt　　　　　　　将c盘文件列表写入a.txt
　　　　call c:\ucdos\ucdos.bat　　　　调用ucdos
　　　　echo 你好 　　　　　　　　　　　显示"你好"
　　　　pause 　　　　　　　　　　　　　暂停,等待按键继续
　　　　rem 使用wps 　　　　　　　　　　注释将使用wps
　　　　cd ucdos　　　　　　　　　　　　进入ucdos目录
　　　　wps 　　　　　　　　　　　　　　使用wps　　
　　批处理文件中还可以像C语言一样使用参数，这只需用到一个参数表示符%。
　　 %表示参数，参数是指在运行批处理文件时在文件名后加的字符串。变量可以从 %0到%9，%0表示文件名本身，字符串用%1到%9顺序表示。
　　例如，C：根目录下一批处理文件名为f.bat，内容为 format %1
　　则如果执行C:\>f a: 　　　则实际执行的是format a:
　　又如C：根目录下一批处理文件的名为t.bat，内容为 type %1 type %2
　　那么运行C:\>t a.txt b.txt 将顺序地显示a.txt和b.txt文件的内容

　　if goto choice for　是批处理文件中比较高级的命令，如果这几个你用得很熟练，你就是批处理文件的专家啦。
if 表示将判断是否符合规定的条件，从而决定执行不同的命令。 有三种格式:
1、if "参数" == "字符串" 　待执行的命令
参数如果等于指定的字符串，则条件成立，运行命令，否则运行下一句。(注意是两个等号）
如if "%1"=="a" format a:
2、if exist 文件名　 待执行的命令
如果有指定的文件，则条件成立，运行命令，否则运行下一句。如if exist config.sys edit config.sys
3、if errorlevel 数字　 待执行的命令
如果返回码等于指定的数字，则条件成立，运行命令，否则运行下一句。如if errorlevel 2 goto x2 　DOS程序运行时都会返回一个数字给DOS，称为错误码errorlevel或称返回码
goto 批处理文件运行到这里将跳到goto 所指定的标号处， 一般与if配合使用。 如:
goto end
:end
echo this is the end
标号用 :字符串 表示，标号所在行不被执行
choice 使用此命令可以让用户输入一个字符，从而运行不同的命令。使用时应该加/c:参数，c:后应写提示可输入的字符，之间无空格。它的返回码为1234……
如: choice /c:dme defrag,mem,end
将显示
defrag,mem,end[D,M,E]?
例如，test.bat的内容如下:
@echo off
choice /c:dme defrag,mem,end
if errorlevel 3 goto defrag 应先判断数值最高的错误码
if errorlevel 2 goto mem
if errotlevel 1 goto end
:defrag
c:\dos\defrag
goto end
:mem
mem
goto end
:end
echo good bye
此文件运行后，将显示 defrag,mem,end[D,M,E]? 用户可选择d m e ，然后if语句将作出判断，d表示执行标号为defrag的程序段，m表示执行标号为mem的程序段，e表示执行标号为end的程序段，每个程序段最后都以goto end将程序跳到end标号处，然后程序将显示good bye，文件结束。
for 循环命令，只要条件符合，它将多次执行同一命令。
格式FOR [%%f] in (集合) DO [命令]
只要参数f在指定的集合内，则条件成立，执行命令
如果一条批处理文件中有一行:
for %%c in (*.bat *.txt) do type %%c
含义是如果是以bat或txt结尾的文件，则显示文件的内容。

　　 DOS在启动会自动运行autoexec.bat这条文件，一般我们在里面装载每次必用的程序，如: path(设置路径)、smartdrv(磁盘加速)、 mouse(鼠标启动)、mscdex(光驱连接)、 doskey(键盘管理)、set(设置环境变量)等。
　　如果启动盘根目录中没有这个文件，电脑会让用户输入日期和时间。
　　例如，一个典型的autoexec.bat内容如下:
@echo off　　　　　　　　　　　　　　　　　　　　　不显示命令行
prompt $p$g　　　　　　　　　　　　　　　　　　　　设置提示符前有目录提示
path c:\dos;c:\;c:\windows;c:\ucdos;c:\tools　　　 设置路径
lh c:\dos\doskey.com 　　　　　　　　　　　　　　　加载键盘管理
lh c:\mouse\mouse.com　　　　　　　　　　　　　　　加载鼠标管理
lh c:\dos\smartdrv.exe 　　　　　　　　　　　　　　加载磁盘加速管理
lh c:\dos\mscdex /S /D:MSCD000 /M:12 /V　　　　　　加载CD-ROM驱动
set temp=c:\temp 　　　　　　　　　　　　　　　　　设置临时目录

superstone

"系统还原和自动更新是通过修改注册表实现,我可是花了好几个星期才成功的"
大多数设置都是通过修改注册表实现的
大家可以自己去实践
用注册表对比的软件
很方便的就可以找到哪个键修改了
不要一味的只问、问、问。。。
自己动手去吧

Quist

不喜欢太多个人的oem讯息

史奴比

下面引用由superstone在 2004/07/23 05:35pm 发表的内容：
"系统还原和自动更新是通过修改注册表实现,我可是花了好几个星期才成功的"
大多数设置都是通过修改注册表实现的
大家可以自己去实践
用注册表对比的软件
...

老大说的有道理，只是我试了好多次，就是找不到，要不介绍个好用点的对比软件？

superstone

摘要信息:
已删除键: 1
已修改键: 12
新建键 : 3

已删除键
HKEY_USERS\S-1-5-21-1715567821-823518204-725345543-1003\Software\Vitas\RegSnap\estimReg\@
   键值: <值未设置>
--------------
位置总数: 1
已修改键
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG\Seed
   Old value: 类型: REG_BINARY 长度: 80 字节      AA 97 15 0B EF 45 90 74 77 50 25 D1 F8 95 8C 21  |  .....E.twP%....!      7E DE 4A AD ED C4 D5 83 0C C0 72 79 34 19 0F F1  |  ~.J.......ry4...      1F 8B 0E 1D CD 6E 51 0E 56 D7 E7 D9 69 8E 7F 15  |  .....nQ.V...i..      72 36 8E 46 13 7B EF C4 DB CD 35 80 91 2E 79 E1  |  r6.F.{....5...y.      B1 4A 9A 6A E3 C1 32 F3 FD BA DE 15 D3 A0 4F 06  |  .J.j..2.......O.   New value: 类型: REG_BINARY 长度: 80 字节      B4 09 E8 91 B1 E3 D8 A1 80 6F 0F 7E B2 AD 6A F5  |  .........o.~..j.      CB BD CB 92 19 78 21 50 74 13 3B 2D 50 35 CD ED  |  .....x!Pt.;-P5..      13 D0 9A CA 31 E3 80 4F 8C A0 29 08 8B CC A8 46  |  ....1..O..)....F      8A 5B 7D 35 0B C9 B7 F4 53 7A F3 6D F7 A6 08 51  |  .[}5....Sz.m...Q      39 1F 16 8D 7F 89 98 D1 97 97 E8 FD 5A C5 9E 6A  |  9..........Z..j
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR
   Old value: DWORD: 1 (0x1)   New value: DWORD: 0 (0)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sr\ImagePath
   旧值: 类型: REG_EXPAND_SZ 长度: 36 字节      5C 53 79 73 74 65 6D 52 6F 6F 74 5C 53 79 73 74  |  \SystemRoot\Syst      65 6D 33 32 5C 44 52 49 56 45 52 53 5C 73 72 2E  |  em32\DRIVERS\sr.      73 79 73 00                                      |  sys.               新值: 类型: REG_EXPAND_SZ 长度: 24 字节      53 79 73 74 65 6D 33 32 5C 44 52 49 56 45 52 53  |  System32\DRIVERS      5C 73 72 2E 73 79 73 00                          |  \sr.sys.        
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sr\Parameters\FirstRun
   旧值: DWORD: 1 (0x1)   新值: DWORD: 0 (0)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sr\Start
   旧值: DWORD: 4 (0x4)   新值: DWORD: 0 (0)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\ImagePath
   旧值: 类型: REG_EXPAND_SZ 长度: 36 字节      5C 53 79 73 74 65 6D 52 6F 6F 74 5C 53 79 73 74  |  \SystemRoot\Syst      65 6D 33 32 5C 44 52 49 56 45 52 53 5C 73 72 2E  |  em32\DRIVERS\sr.      73 79 73 00                                      |  sys.               新值: 类型: REG_EXPAND_SZ 长度: 24 字节      53 79 73 74 65 6D 33 32 5C 44 52 49 56 45 52 53  |  System32\DRIVERS      5C 73 72 2E 73 79 73 00                          |  \sr.sys.        
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Parameters\FirstRun
   旧值: DWORD: 1 (0x1)   新值: DWORD: 0 (0)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Start
   旧值: DWORD: 4 (0x4)   新值: DWORD: 0 (0)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
   旧值: 字串: "D:\Documents and Settings\LocalService\Application Data"   新值: 字串: "D:\WINDOWS\system32\config\systemprofile\Application Data"
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData
   旧值: 字串: "D:\Documents and Settings\LocalService\Application Data"   新值: 字串: "D:\WINDOWS\system32\config\systemprofile\Application Data"
HKEY_USERS\S-1-5-21-1715567821-823518204-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHAPCY
   旧值: 类型: REG_BINARY 长度: 16 字节      16 00 00 00 52 00 00 00 60 5B 8A 23 24 70 C4 01  |  ....R...`[.#$p..   新值: 类型: REG_BINARY 长度: 16 字节      17 00 00 00 53 00 00 00 20 C6 5B 07 D0 70 C4 01  |  ....S... .[..p..
HKEY_USERS\S-1-5-21-1715567821-823518204-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHAPCY:FLFQZ.PCY
   旧值: 类型: REG_BINARY 长度: 16 字节      16 00 00 00 1E 00 00 00 20 AA F5 4C 1C 70 C4 01  |  ........ ..L.p..   新值: 类型: REG_BINARY 长度: 16 字节      17 00 00 00 1F 00 00 00 20 C6 5B 07 D0 70 C4 01  |  ........ .[..p..
--------------
位置总数: 12
新建键
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SR\0000\Control\ActiveService
   键值: 字串: "sr"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SR\0000\Control\ActiveService
   键值: 字串: "sr"
HKEY_USERS\S-1-5-21-1715567821-823518204-725345543-1003\Software\Vitas\RegSnap\estimReg\f_superstone3
   键值: DWORD: 138865 (0x21e71)
--------------
位置总数: 3


偶用regsnap做的对比
很容易的就得到是这个键在控制
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\DisableSR
   Old value: DWORD: 1 (0x1)   New value: DWORD: 0 (0)
改了几次试了试,就是这个键,但偶没有刻盘重装系统测试,如有出入,还请指出...
另外，regshot也不错，大家都可以试试。。。

scaven

还不错，就是太花哨了。