本帖最后由 yjqd 于 2019-5-12 21:37 编辑
笨办法修复的,注册表花的时间太多
SYSTEM中的ControlSet001\services中的SDRSVC、SYSTEM中的ControlSet002\services中的SDRSVC (Windows Backup 提供 Windows 备份和还原功能)
可以不要,它是用于备份和还原系统,对应的是控制面板里的备份和还原
系统还原:创建还原点,还原时只是还原更改的部分。
备份还原:备份整个系统(系统盘)
Win7 SP1旗舰版精简版
32位版本,名称:23403_GRMCULFRER_ZH-CN_MICRO_v2.iso
---------------------------------------------------------------------------------------------------------------------------
如果没有SOFTWARE\Classes\Interface\{B653F1E0-17D7-4AC6-9B18-F84B61DBC1A2},系统还原可以设置还原点,但进行到"将计算机还原到所选事件之前的状态"时,点击下一步报错:灾难性错误
如果没有SYSTEM\ControlSet001\services\swprv和SYSTEM\ControlSet002\services\swprv,点击系统保护,界面中一直在搜索分区
rstrui.exe在SOFTWARE\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}中
sxproxy.dll在SOFTWARE\Classes\CLSID\{23CF860E-9D2C-451A-8E83-C79C848D85A6}中
srcore.dll在SOFTWARE\Classes\CLSID\{883FF1FC-09E1-48e5-8E54-E2469ACB0CFD}中
{23CF860E-9D2C-451A-8E83-C79C848D85A6}在SOFTWARE\Classes\Interface\{ADCF3F49-521F-48A6-BABA-8E20D5D3E861}和SOFTWARE\Classes\Interface\{B653F1E0-17D7-4AC6-9B18-F84B61DBC1A2}中
=============================================================================================
所需文件 从安装镜像中提取
Windows\System32
Windows\System32\rstrui.exe
Windows\System32\sdrsvc.dll
Windows\System32\srclient.dll
Windows\System32\srcore.dll
Windows\System32\srrstr.dll
Windows\System32\sxproxy.dll
Windows\System32\zh-CN
Windows\System32\zh-CN\rstrui.exe.mui
Windows\System32\zh-CN\sdrsvc.dll.mui
Windows\System32\zh-CN\srcore.dll.mui
Windows\System32\zh-CN\srrstr.dll.mui
Windows\System32\zh-CN\sxproxy.dll.mui
=============================================================================================
所需注册表 从安装镜像中提取
SOFTWARE和SYSTEM
SOFTWARE中的Classes\CLSID和Classes\Interface
SYSTEM中的ControlSet001\services中的SDRSVC(Windows Backup 提供 Windows 备份和还原功能)和SWPRV(Microsoft Software Shadow Copy Provider)服务项
SYSTEM中的ControlSet002\services中的SDRSVC(Windows Backup 提供 Windows 备份和还原功能)和SWPRV(Microsoft Software Shadow Copy Provider)服务项
---------------------------------------------------------------------------------------------------------------------------
SOFTWARE中的Classes\CLSID和Classes\Interface
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\CLSID]
@="{0000031A-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000031A-0000-0000-C000-000000000046}]
@="ClassMoniker"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000031A-0000-0000-C000-000000000046}\InprocServer32]
@="ole32.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000031A-0000-0000-C000-000000000046}\ProgID]
@="clsid"
上面4项没被精简掉
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23CF860E-9D2C-451A-8E83-C79C848D85A6}]
@="PSFactoryBuffer"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23CF860E-9D2C-451A-8E83-C79C848D85A6}\InProcServer32]
@=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,78,00,\
70,00,72,00,6f,00,78,00,79,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Both"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}]
@="System Restore"
"LocalizedString"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,\
6f,00,6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\
00,5c,00,61,00,70,00,70,00,77,00,69,00,7a,00,2e,00,63,00,70,00,6c,00,2c,00,\
2d,00,31,00,39,00,30,00,00,00
"InfoTip"=hex(2):40,00,25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,\
6f,00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,\
00,61,00,70,00,70,00,77,00,69,00,7a,00,2e,00,63,00,70,00,6c,00,2c,00,2d,00,\
31,00,39,00,31,00,00,00
"System.ControlPanel.EnableInSafeMode"=dword:00000003
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\DefaultIcon]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,73,00,\
74,00,72,00,75,00,69,00,2e,00,65,00,78,00,65,00,2c,00,30,00,00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\Shell\Open\Command]
@=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,00,25,\
00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,73,00,\
74,00,72,00,75,00,69,00,2e,00,65,00,78,00,65,00,00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3f6bc534-dfa1-4ab4-ae54-ef25a74e0107}\ShellFolder]
"Attributes"=dword:20000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B966436-6781-4906-8035-9AF94B32C3F7}]
@="SPP Class"
"AppID"="{f32d97df-e3e5-4cb9-9e3e-0eb5b4e49801}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B966436-6781-4906-8035-9AF94B32C3F7}\InprocServer32]
@=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,70,00,\
70,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Both"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B966436-6781-4906-8035-9AF94B32C3F7}\ProgID]
@="Spp.Spp.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B966436-6781-4906-8035-9AF94B32C3F7}\VersionIndependentProgID]
@="Spp.Spp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{883FF1FC-09E1-48e5-8E54-E2469ACB0CFD}]
@="SrControl Class"
"AppID"="{f32d97df-e3e5-4cb9-9e3e-0eb5b4e49801}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{883FF1FC-09E1-48e5-8E54-E2469ACB0CFD}\InprocServer32]
@=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,74,00,25,\
00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,00,72,00,\
63,00,6f,00,72,00,65,00,2e,00,64,00,6c,00,6c,00,00,00
"ThreadingModel"="Both"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{883FF1FC-09E1-48e5-8E54-E2469ACB0CFD}\ProgID]
@="SrControl.SrControl.1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{883FF1FC-09E1-48e5-8E54-E2469ACB0CFD}\VersionIndependentProgID]
@="SrControl.SrControl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ADCF3F49-521F-48A6-BABA-8E20D5D3E861}]
@="ISharedProtectionPoints"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ADCF3F49-521F-48A6-BABA-8E20D5D3E861}\NumMethods]
@="16"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ADCF3F49-521F-48A6-BABA-8E20D5D3E861}\ProxyStubClsid32]
@="{23CF860E-9D2C-451A-8E83-C79C848D85A6}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B653F1E0-17D7-4AC6-9B18-F84B61DBC1A2}]
@="ISrControl"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B653F1E0-17D7-4AC6-9B18-F84B61DBC1A2}\NumMethods]
@="8"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B653F1E0-17D7-4AC6-9B18-F84B61DBC1A2}\ProxyStubClsid32]
@="{23CF860E-9D2C-451A-8E83-C79C848D85A6}"
---------------------------------------------------------------------------------------------------------------------------
SYSTEM
SYSTEM中的ControlSet001\services中的SDRSVC(Windows Backup 提供 Windows 备份和还原功能)和SWPRV(Microsoft Software Shadow Copy Provider)服务项
SYSTEM中的ControlSet002\services中的SDRSVC(Windows Backup 提供 Windows 备份和还原功能)和SWPRV(Microsoft Software Shadow Copy Provider)服务项
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SWPRV]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\SWPRV]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SDRSVC]
"DisplayName"="@%SystemRoot%\\system32\\sdrsvc.dll,-107"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,53,00,44,00,52,00,53,00,56,00,43,00,00,00
"Start"=dword:00000003
"Type"=dword:00000010
"Description"="@%SystemRoot%\\system32\\sdrsvc.dll,-102"
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
"ObjectName"="localSystem"
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,\
65,00,73,00,74,00,6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,53,00,65,00,63,00,75,00,72,00,69,00,74,00,\
79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\
00,54,00,61,00,6b,00,65,00,4f,00,77,00,6e,00,65,00,72,00,73,00,68,00,69,00,\
70,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\
00,43,00,72,00,65,00,61,00,74,00,65,00,53,00,79,00,6d,00,62,00,6f,00,6c,00,\
69,00,63,00,4c,00,69,00,6e,00,6b,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,41,00,73,00,73,00,69,00,67,00,6e,00,50,00,\
72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,6e,00,\
63,00,72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,54,00,63,00,\
62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\
00,53,00,79,00,73,00,74,00,65,00,6d,00,45,00,6e,00,76,00,69,00,72,00,6f,00,\
6e,00,6d,00,65,00,6e,00,74,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,\
00,65,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SDRSVC\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
53,00,44,00,52,00,53,00,56,00,43,00,2e,00,64,00,6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\swprv]
"DisplayName"="@%SystemRoot%\\System32\\swprv.dll,-103"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,73,00,77,00,70,00,72,00,76,00,00,00
"Description"="@%SystemRoot%\\System32\\swprv.dll,-102"
"ObjectName"="LocalSystem"
"ErrorControl"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000010
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,\
68,00,61,00,6e,00,67,00,65,00,4e,00,6f,00,74,00,69,00,66,00,79,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,\
65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,\
61,00,74,00,65,00,50,00,65,00,72,00,6d,00,61,00,6e,00,65,00,6e,00,74,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,\
6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,00,74,00,65,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4d,00,61,00,6e,00,\
61,00,67,00,65,00,56,00,6f,00,6c,00,75,00,6d,00,65,00,50,00,72,00,69,00,76,\
00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,\
6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\
00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,42,00,61,00,\
73,00,65,00,50,00,72,00,69,00,6f,00,72,00,69,00,74,00,79,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4d,00,61,00,6e,00,\
61,00,67,00,65,00,56,00,6f,00,6c,00,75,00,6d,00,65,00,50,00,72,00,69,00,76,\
00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,\
6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\
00,53,00,65,00,54,00,63,00,62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,\
67,00,65,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\swprv\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
73,00,77,00,70,00,72,00,76,00,2e,00,64,00,6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\SWPRV]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\SafeBoot\Network\SWPRV]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SDRSVC]
"DisplayName"="@%SystemRoot%\\system32\\sdrsvc.dll,-107"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,53,00,44,00,52,00,53,00,56,00,43,00,00,00
"Start"=dword:00000003
"Type"=dword:00000010
"Description"="@%SystemRoot%\\system32\\sdrsvc.dll,-102"
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
"ObjectName"="localSystem"
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,\
65,00,73,00,74,00,6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,53,00,65,00,63,00,75,00,72,00,69,00,74,00,\
79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\
00,54,00,61,00,6b,00,65,00,4f,00,77,00,6e,00,65,00,72,00,73,00,68,00,69,00,\
70,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\
00,43,00,72,00,65,00,61,00,74,00,65,00,53,00,79,00,6d,00,62,00,6f,00,6c,00,\
69,00,63,00,4c,00,69,00,6e,00,6b,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,\
00,67,00,65,00,00,00,53,00,65,00,41,00,73,00,73,00,69,00,67,00,6e,00,50,00,\
72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,6e,00,\
63,00,72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,54,00,63,00,\
62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,\
00,53,00,79,00,73,00,74,00,65,00,6d,00,45,00,6e,00,76,00,69,00,72,00,6f,00,\
6e,00,6d,00,65,00,6e,00,74,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,\
00,65,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\SDRSVC\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
53,00,44,00,52,00,53,00,56,00,43,00,2e,00,64,00,6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\swprv]
"DisplayName"="@%SystemRoot%\\System32\\swprv.dll,-103"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,73,00,77,00,70,00,72,00,76,00,00,00
"Description"="@%SystemRoot%\\System32\\swprv.dll,-102"
"ObjectName"="LocalSystem"
"ErrorControl"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000010
"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,\
68,00,61,00,6e,00,67,00,65,00,4e,00,6f,00,74,00,69,00,66,00,79,00,50,00,72,\
00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,\
65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,00,6c,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,72,00,65,00,\
61,00,74,00,65,00,50,00,65,00,72,00,6d,00,61,00,6e,00,65,00,6e,00,74,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,\
6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,00,74,00,65,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4d,00,61,00,6e,00,\
61,00,67,00,65,00,56,00,6f,00,6c,00,75,00,6d,00,65,00,50,00,72,00,69,00,76,\
00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,\
6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\
00,53,00,65,00,49,00,6e,00,63,00,72,00,65,00,61,00,73,00,65,00,42,00,61,00,\
73,00,65,00,50,00,72,00,69,00,6f,00,72,00,69,00,74,00,79,00,50,00,72,00,69,\
00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,4d,00,61,00,6e,00,\
61,00,67,00,65,00,56,00,6f,00,6c,00,75,00,6d,00,65,00,50,00,72,00,69,00,76,\
00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,74,00,\
6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,\
00,53,00,65,00,54,00,63,00,62,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,\
67,00,65,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\swprv\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
73,00,77,00,70,00,72,00,76,00,2e,00,64,00,6c,00,6c,00,00,00 |