Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\*\shell\runas]
@="管理员取得所有权"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\*\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"

[HKEY_CLASSES_ROOT\exefile\shell\runas2]
@="管理员取得所有权"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\exefile\shell\runas2\command]
@="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" && icacls \"%1\" /grant administrators:F"

[HKEY_CLASSES_ROOT\Directory\shell\runas]
@="管理员取得所有权"
"NoWorkingDirectory"=""

[HKEY_CLASSES_ROOT\Directory\shell\runas\command]
@="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"
"IsolatedCommand"="cmd.exe /c takeown /f \"%1\" /r /d y && icacls \"%1\" /grant administrators:F /t"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{115178a7-a915-4fcd-8947-7e0368caa950}]
"LastModified"=hex(b):4e,b6,49,c1,ee,25,cb,01
"Description"="禁止幽灵网吧辅助工具V3.1"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,a8,05,00,00,00,00,00
"ItemData"=hex:40,f9,59,a5,52,7c,e6,26,6f,00,63,61,b8,fc,88,e7
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{1258d267-fae9-4e26-b5a5-1af5ad24b589}]
"LastModified"=hex(b):b4,7e,f0,85,2f,37,cb,01
"Description"="禁止：组策略恢复"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,be,0b,00,00,00,00,00
"ItemData"=hex:eb,f5,cf,55,62,ee,23,75,b4,d6,07,5e,ac,69,a0,e8
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{193492ef-3e47-4aec-9422-a8b89bf7e341}]
"LastModified"=hex(b):10,0c,e9,4d,0e,14,cf,01
"Description"=""
"FriendlyName"=" (1.68.21.0)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,94,06,00,00,00,00,00
"ItemData"=hex:bd,bd,83,b2,4b,08,8e,1d,4f,36,54,3a,33,f6,60,21
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{1ce2c1ff-33a5-4bef-b8fb-c4d8588ae8ee}]
"LastModified"=hex(b):f0,f5,7e,dc,e1,06,cf,01
"Description"=""
"FriendlyName"="SnipeSword(5.0.1.9)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,84,07,00,00,00,00,00
"ItemData"=hex:37,fd,78,3a,f8,7b,03,05,00,00,73,93,ca,13,8d,34
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{26db5eb5-9efb-4649-bc0a-dabe71bb54f9}]
"LastModified"=hex(b):c0,c5,d3,12,0e,14,cf,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,ae,0c,00,00,00,00,00
"ItemData"=hex:4b,bb,56,e7,63,60,b5,9e,c8,94,c9,2d,bf,2c,84,2a
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{296a3c7e-6281-4f47-a81f-25be8347e7b0}]
"LastModified"=hex(b):a8,3f,fe,63,34,37,cb,01
"Description"="禁：组策略恢复补丁"
"FriendlyName"="组策略恢复补丁"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):05,98,0b,00,00,00,00,00
"ItemData"=hex:54,39,79,7d,40,56,25,fc,e4,d4,59,bd,b9,34,20,52
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{2cf78c60-5450-444d-9e4f-93ffa73ddd51}]
"LastModified"=hex(b):46,fd,67,0a,3c,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,d8,05,00,00,00,00,00
"ItemData"=hex:a6,0e,59,a7,0d,e4,c1,76,8d,6d,f8,dc,78,91,f8,e9
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{332ef7c7-4b1e-48b3-869b-2b95ebed582f}]
"LastModified"=hex(b):0a,ef,f8,87,ed,25,cb,01
"Description"="禁止幽灵网吧辅助工具 v4.0"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,14,01,00,00,00,00,00
"ItemData"=hex:3a,c7,3c,1a,c6,3e,0a,f2,86,bd,7d,16,c2,d4,ec,c7
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{332f9275-5d1d-4c9a-87cf-84b44747b3f8}]
"LastModified"=hex(b):f0,e8,7f,dd,ef,25,cb,01
"Description"="禁止傀儡僵尸攻击器"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,5e,25,00,00,00,00,00
"ItemData"=hex:40,eb,fb,97,ef,cd,73,b1,b3,1e,63,dd,e0,12,bd,a1
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{3445f41e-50d5-4016-8b05-a033d2a8fbee}]
"LastModified"=hex(b):4e,e7,2d,27,30,37,cb,01
"Description"="禁掉：防网吧关掉指定字符工具"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,30,01,00,00,00,00,00
"ItemData"=hex:5f,dd,71,d2,34,15,a0,3d,c7,ac,0a,3d,aa,e8,7f,eb
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}]
"Description"="Stop the download of this file"
"FriendlyName"="Mdac11.cab"
"SaferFlags"=dword:00000000
"HashAlg"=dword:00008003
"ItemData"=hex:5e,ab,30,4f,95,7a,49,89,6a,00,6c,1c,31,15,40,15
"LastModified"=hex(b):85,c4,34,dc,19,a2,c2,01
"ItemSize"=hex(b):0b,03,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{37a97423-2802-4f4f-9f96-ce2d9612a135}]
"LastModified"=hex(b):12,25,3f,34,1a,3d,cf,01
"Description"=""
"FriendlyName"="不能运行时点我.bat110 字节2011-3-10  20:02:04"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):6e,00,00,00,00,00,00,00
"ItemData"=hex:14,37,80,b6,c6,25,ea,f0,18,a0,e7,6f,90,c3,76,95
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{382b7584-6b91-442a-aabe-947b3d50f64e}]
"LastModified"=hex(b):44,b9,51,48,2d,37,cb,01
"Description"="禁止GP_killer(组策略恢复补丁)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,54,05,00,00,00,00,00
"ItemData"=hex:c7,bc,11,96,6a,ec,de,21,f2,83,aa,5a,bc,00,c4,2e
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{38d4f224-f845-4065-bf66-6fb2d5a16d7b}]
"LastModified"=hex(b):fe,b3,13,2d,36,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,a8,05,00,00,00,00,00
"ItemData"=hex:40,f9,59,a5,52,7c,e6,26,6f,00,63,61,b8,fc,88,e7
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{3a6d6872-adc6-400b-af41-a833d33f5c36}]
"LastModified"=hex(b):24,ce,0b,e4,32,37,cb,01
"Description"="禁：网吧死机攻击器"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):a4,bb,11,00,00,00,00,00
"ItemData"=hex:1a,60,de,30,64,9e,c4,96,95,83,2c,cc,4c,11,37,f2
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{3bbdaadf-7ece-41a7-8c32-06a34e270a2d}]
"LastModified"=hex(b):6c,9c,0f,2f,ee,25,cb,01
"Description"="禁止幽灵网吧辅助工具V3.5B版"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,62,07,00,00,00,00,00
"ItemData"=hex:5b,c9,df,c9,5b,e5,b1,d0,d1,68,4b,f5,79,98,c9,b7
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{3dbf5e69-ebf5-49ac-a14d-9681e71ce15e}]
"LastModified"=hex(b):d4,44,23,85,0e,14,cf,01
"Description"=""
"FriendlyName"=" (1.0.4.5)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,38,21,00,00,00,00,00
"ItemData"=hex:f0,68,09,bb,a2,62,ea,44,b0,4f,3a,57,fa,b3,fe,a8
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{3f92e643-5e38-49d0-8556-345a3a575940}]
"LastModified"=hex(b):74,2d,e0,72,34,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,ac,08,00,00,00,00,00
"ItemData"=hex:93,de,e4,9f,b3,9b,32,53,16,bb,95,ce,50,70,03,ba
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{455e6942-1a39-4471-be80-71e2738fff38}]
"LastModified"=hex(b):32,f1,ae,85,fd,2c,c7,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,ae,0c,00,00,00,00,00
"ItemData"=hex:98,9f,d6,01,50,1d,96,32,9b,0a,24,1b,b7,21,f6,59
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{48f5167d-7c8e-4e27-99a4-41baa671df0a}]
"LastModified"=hex(b):6c,71,1b,bb,5d,89,d5,01
"Description"=""
"FriendlyName"="taskkill.exe (6.1.7600.16385)taskkill.exeTerminates ProcessesMicrosoft® Windows® Operating SystemMicrosoft Corporation"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,b8,01,00,00,00,00,00
"ItemData"=hex:37,22,fa,50,1d,cb,50,ae,42,81,8f,90,34,90,68,91
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{48f5167d-7c8e-4e27-99a4-41baa671df0a}\SHA256]
"ItemData"=hex:74,b3,15,2a,28,d4,f1,a4,ff,f4,6b,27,9a,bf,0e,ef,66,6d,f0,f8,24,\
  5e,fa,e1,e7,1e,6e,37,58,89,ff,70
"HashAlg"=dword:0000800c

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{4cc1b5bd-2d30-4291-9e0a-23a80041dc18}]
"LastModified"=hex(b):58,2f,7b,1e,35,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,06,01,00,00,00,00,00
"ItemData"=hex:61,06,c3,dd,26,cd,c3,a0,93,47,4f,e7,ff,b8,db,ed
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{51d6b999-4b5f-4d11-a3ff-14fe617991ac}]
"LastModified"=hex(b):ee,ff,3f,2a,0e,14,cf,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,aa,02,00,00,00,00,00
"ItemData"=hex:df,5b,7e,b9,01,c6,99,40,57,c2,dc,33,3e,bd,f1,a6
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{5b074bd0-f4e7-43c8-ba74-8f6441d347cf}]
"LastModified"=hex(b):76,47,a0,29,3d,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,d2,05,00,00,00,00,00
"ItemData"=hex:27,e1,7f,74,4a,d7,90,96,7c,c5,ea,c0,8d,b5,f7,da
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{5c6751b7-cf41-418a-bd93-0ee1bcd24a50}]
"LastModified"=hex(b):76,41,d1,8b,1e,3d,cf,01
"Description"=""
"FriendlyName"=" (1.2.0.0)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,e6,0a,00,00,00,00,00
"ItemData"=hex:bc,a2,a0,26,da,54,6f,18,c1,ce,28,8c,28,73,f1,b9
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{5eb0a6b4-8c8c-4966-b400-c2b8bd0fa1ba}]
"LastModified"=hex(b):48,c4,6b,83,2d,37,cb,01
"Description"="禁止幽灵网吧V4.1"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,06,01,00,00,00,00,00
"ItemData"=hex:dd,4f,ce,1f,e9,8f,f9,45,27,e6,aa,3c,eb,db,c7,87
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{65a1add1-ec91-4959-921f-cb8e9011117f}]
"LastModified"=hex(b):b2,b7,5e,35,0e,14,cf,01
"Description"=""
"FriendlyName"=" (1.68.18.0)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,94,06,00,00,00,00,00
"ItemData"=hex:b2,53,9e,78,60,f9,46,08,74,b9,88,9a,cf,90,9c,49
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{68c29963-f1ad-429c-ad51-93bfbd680a7f}]
"LastModified"=hex(b):08,5f,73,f2,1a,3d,cf,01
"Description"="ylwb4.2"
"FriendlyName"="Ghost Netbar Tool幽灵网吧辅助工具 v4.2泆寒 (4.2.0.0)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,90,01,00,00,00,00,00
"ItemData"=hex:dd,01,29,3a,8a,bd,e1,f4,4a,9a,34,1d,00,9f,d4,51
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{6b5f503b-fe5f-4876-9939-dcb7eba99d1c}]
"LastModified"=hex(b):f4,82,82,e9,ed,25,cb,01
"Description"="幽灵网吧辅助工具 v4.2B版"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,22,00,00,00,00,00,00
"ItemData"=hex:43,a6,2c,a5,f4,23,a0,aa,61,3c,93,21,1f,ae,c9,38
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{70f8f873-f9b1-464c-90a8-d2d9cf5cca17}]
"LastModified"=hex(b):00,fe,85,78,36,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,14,01,00,00,00,00,00
"ItemData"=hex:fb,4b,bc,b7,c4,e7,61,05,b8,83,6a,4f,03,fb,fe,79
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{761ff8e4-074e-4892-9c72-499fa0865000}]
"LastModified"=hex(b):12,34,18,00,1b,3d,cf,01
"Description"=""
"FriendlyName"="run.bat109 字节2010-6-1  20:14:10"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):6d,00,00,00,00,00,00,00
"ItemData"=hex:21,a8,0d,92,d7,e2,e5,dd,d7,65,70,0c,10,50,70,a6
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{7683098c-ea28-4fae-b56f-12abbae6a534}]
"LastModified"=hex(b):2a,31,9c,92,fd,2c,c7,01
"Description"=""
"FriendlyName"="process-x"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,fe,33,00,00,00,00,00
"ItemData"=hex:15,37,c1,dd,69,03,b9,5d,b6,d2,d5,26,b9,16,f1,ba
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{7761f87c-6a8c-4781-9bbf-6cf08d871a15}]
"LastModified"=hex(b):84,e0,08,94,36,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,06,01,00,00,00,00,00
"ItemData"=hex:91,4d,fb,59,11,54,2a,d3,21,63,3a,1d,c9,af,76,70
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{77bb9078-3fe8-4155-b3fa-9c0bbe84284c}]
"LastModified"=hex(b):7f,ca,e5,b0,5d,89,d5,01
"Description"=""
"FriendlyName"="NTSD.Exe (5.1.2600.0)NTSD.ExeSymbolic Debugger for Windows 2000Microsoft® Windows® Operating SystemMicrosoft Corporation"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,7c,00,00,00,00,00,00
"ItemData"=hex:fd,d5,61,79,84,b2,4d,21,99,1f,80,bc,94,71,42,18
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{77bb9078-3fe8-4155-b3fa-9c0bbe84284c}\SHA256]
"ItemData"=hex:52,ad,59,97,56,b2,9d,dc,f5,1d,e0,3d,5c,7b,62,31,8d,57,9d,ce,f6,\
  08,6f,7a,47,ba,a2,47,2f,30,5c,e9
"HashAlg"=dword:0000800c

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{78ac65e5-8eee-4b9f-be0a-714f9bb6dc5a}]
"LastModified"=hex(b):84,01,a0,73,fd,2c,c7,01
"Description"=""
"FriendlyName"="wsyscheck"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,94,06,00,00,00,00,00
"ItemData"=hex:8e,5d,ba,9e,8d,73,08,0b,3a,10,10,ac,11,5d,db,d5
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{78b608d1-236b-43e7-9f03-72bd185a576d}]
"LastModified"=hex(b):44,cf,65,73,19,3d,cf,01
"Description"=""
"FriendlyName"="4.2.30.exe8  KB2011-3-19  23:58:24"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,1e,00,00,00,00,00,00
"ItemData"=hex:1f,f9,5d,d6,46,d9,de,dc,d2,dc,c0,ce,a6,ad,f3,dc
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{7ee4eeeb-c3d2-4fb8-a825-21a6c3b70ba6}]
"LastModified"=hex(b):be,f0,85,61,33,37,cb,01
"Description"="禁：网吧幽灵万象2009"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,b0,0d,00,00,00,00,00
"ItemData"=hex:0d,52,25,fd,93,2d,af,ad,68,bc,a3,ac,97,45,40,f8
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}]
"Description"="Stop the download of this file"
"FriendlyName"="mdac20.cab"
"SaferFlags"=dword:00000000
"HashAlg"=dword:00008003
"ItemData"=hex:67,b0,d4,8b,34,3a,3f,d3,bc,e9,dc,64,67,04,f3,94
"LastModified"=hex(b):03,8a,39,dc,19,a2,c2,01
"ItemSize"=hex(b):05,02,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{80623833-9940-4bff-a2d9-bb1ab8901de9}]
"LastModified"=hex(b):74,bc,fc,57,0e,14,cf,01
"Description"=""
"FriendlyName"=" (1.0.2.6)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,3e,16,00,00,00,00,00
"ItemData"=hex:5f,d5,b4,eb,59,47,80,60,67,f5,f5,ae,d2,df,59,c6
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}]
"Description"="Stop the download of this file"
"FriendlyName"="mdac20_a.cab"
"SaferFlags"=dword:00000000
"HashAlg"=dword:00008003
"ItemData"=hex:32,78,02,dc,fe,f8,c8,93,dc,8a,b0,06,dd,84,7d,1d
"LastModified"=hex(b):be,77,45,dc,19,a2,c2,01
"ItemSize"=hex(b):96,03,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{8592b45b-b48a-424a-adf7-c678f71c2742}]
"LastModified"=hex(b):86,9a,09,a6,fd,2c,c7,01
"Description"=""
"FriendlyName"="xuetr"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,64,1d,00,00,00,00,00
"ItemData"=hex:a5,f6,ba,4d,e4,59,cc,e6,b0,0e,8a,60,36,a9,f6,0e
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{85d88f70-cd88-4789-9257-4cbaf60abf87}]
"LastModified"=hex(b):80,ea,d7,72,2d,37,cb,01
"Description"="禁止幽灵网吧v3.0"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):49,24,0f,00,00,00,00,00
"ItemData"=hex:43,0a,fa,3f,b7,0f,7a,08,36,cd,23,d8,b4,01,f8,a4
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{870bb4e2-011c-4e7d-b1e6-b25866779e22}]
"LastModified"=hex(b):c3,8b,7f,cf,55,89,d5,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,b8,01,00,00,00,00,00
"ItemData"=hex:37,22,fa,50,1d,cb,50,ae,42,81,8f,90,34,90,68,91
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{870bb4e2-011c-4e7d-b1e6-b25866779e22}\SHA256]
"ItemData"=hex:74,b3,15,2a,28,d4,f1,a4,ff,f4,6b,27,9a,bf,0e,ef,66,6d,f0,f8,24,\
  5e,fa,e1,e7,1e,6e,37,58,89,ff,70
"HashAlg"=dword:0000800c

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{889a08fc-5b6f-4cb6-a475-3fbe0621a4c2}]
"LastModified"=hex(b):5a,a3,70,a6,3c,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,06,01,00,00,00,00,00
"ItemData"=hex:ef,68,ad,ac,5e,8f,ae,8e,e0,22,3b,eb,5c,7b,cc,43
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{8f8df11d-f084-4b55-aa15-0ecebf722ced}]
"LastModified"=hex(b):02,8d,36,54,37,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,d2,05,00,00,00,00,00
"ItemData"=hex:e6,27,3e,20,85,37,bd,90,a4,d3,c1,e3,48,3b,a9,0a
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{912cbcc3-98da-4fc7-bc73-457ea8bb322f}]
"LastModified"=hex(b):7a,11,dc,5d,36,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,22,00,00,00,00,00,00
"ItemData"=hex:fe,af,42,08,99,52,e0,6a,69,fe,cb,64,fc,cd,6b,7e
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}]
"Description"="Stop the download of this file"
"FriendlyName"="_msadc10.cab"
"SaferFlags"=dword:00000000
"HashAlg"=dword:00008003
"ItemData"=hex:bd,9a,2a,db,42,eb,d8,56,0e,25,0e,4d,f8,16,2f,67
"LastModified"=hex(b):81,4f,3e,dc,19,a2,c2,01
"ItemSize"=hex(b):e5,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{97f0c56f-8e08-4684-9c5f-26fbb42013ff}]
"LastModified"=hex(b):8a,48,55,03,35,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,22,00,00,00,00,00,00
"ItemData"=hex:43,a6,2c,a5,f4,23,a0,aa,61,3c,93,21,1f,ae,c9,38
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{996c4334-66a7-43c0-9d0e-dd3af2ad8ce8}]
"LastModified"=hex(b):2e,2e,43,e9,e0,06,cf,01
"Description"=""
"FriendlyName"=" xuetr(1.0.4.5)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,48,22,00,00,00,00,00
"ItemData"=hex:02,05,62,0f,b2,59,f6,5c,4a,c6,c4,a3,05,a7,fe,88
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{9ab1cf0b-dde6-4643-b51e-8741d310f221}]
"LastModified"=hex(b):62,73,00,03,37,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,62,07,00,00,00,00,00
"ItemData"=hex:5b,c9,df,c9,5b,e5,b1,d0,d1,68,4b,f5,79,98,c9,b7
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{9ed6f968-b3d1-46df-8466-b725ecfd16dc}]
"LastModified"=hex(b):d8,76,c9,5c,ed,25,cb,01
"Description"="禁幽灵网吧工具4.2"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,22,00,00,00,00,00,00
"ItemData"=hex:fe,af,42,08,99,52,e0,6a,69,fe,cb,64,fc,cd,6b,7e
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{a59515f1-0656-43d5-b343-48855f234ec2}]
"LastModified"=hex(b):24,4a,3b,53,ed,25,cb,01
"Description"="禁止幽灵网吧辅助工具V3.4"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,fc,01,00,00,00,00,00
"ItemData"=hex:94,ac,75,c7,27,23,03,fc,94,ca,2b,4a,25,5c,b6,d2
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{a9340f79-ea4a-428b-acb6-001d5113037d}]
"LastModified"=hex(b):aa,b1,5a,c9,24,bd,c9,01
"Description"="万像幽灵2008"
"FriendlyName"="万像幽灵2008.exe6625  KB2008-7-13  13:47:41"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):e7,83,67,00,00,00,00,00
"ItemData"=hex:38,94,fc,33,05,08,c1,4d,40,ea,7a,2b,95,c5,1f,e6
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{ab043d98-360e-455c-b4ee-b295f8344664}]
"LastModified"=hex(b):de,49,10,eb,7b,2b,cf,01
"Description"=""
"FriendlyName"="icesword 1.22"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,60,0b,00,00,00,00,00
"ItemData"=hex:e6,55,ba,28,d3,b4,6f,b9,17,fb,e6,e4,f1,27,26,48
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{ab602d1e-0309-40f6-b174-27e410ad40cb}]
"LastModified"=hex(b):10,ba,5b,c9,34,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,14,01,00,00,00,00,00
"ItemData"=hex:f4,c9,78,95,f6,ec,c9,2d,ba,3b,a9,8b,b5,b2,5e,35
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{aba0e66c-3651-4769-bcef-5e59438fa363}]
"LastModified"=hex(b):e8,9a,82,75,0e,14,cf,01
"Description"=""
"FriendlyName"=" (1.0.0.0)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,b4,21,00,00,00,00,00
"ItemData"=hex:dd,c6,5f,9d,e8,34,c5,8d,81,7f,37,a8,4f,18,df,10
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{abd5c7d4-69f2-46df-aa5d-7e0541b2ec40}]
"LastModified"=hex(b):a0,8b,b5,75,ed,25,cb,01
"Description"="禁止幽灵网吧辅助工具V3.5"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,64,07,00,00,00,00,00
"ItemData"=hex:05,11,fc,df,0e,3c,75,22,7a,75,88,72,d4,4b,bc,a0
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{af56d02d-610e-490e-8277-90fbf90793f0}]
"LastModified"=hex(b):fc,c9,ab,88,1a,3d,cf,01
"Description"="ylwb3.4"
"FriendlyName"=" (1.0.0.1)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):5f,e3,0d,00,00,00,00,00
"ItemData"=hex:95,6c,60,81,ef,4d,9d,16,87,4f,98,41,2c,9d,c1,c8
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{b3405034-0a54-4e11-bbca-209b6fbd67d4}]
"LastModified"=hex(b):04,48,1a,31,3c,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,06,01,00,00,00,00,00
"ItemData"=hex:55,3c,ed,24,15,8e,27,13,97,3f,54,01,ed,f9,7a,86
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{baf5bb6e-5408-4731-a70c-bbd7639ac329}]
"LastModified"=hex(b):0a,a4,3b,99,32,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,90,06,00,00,00,00,00
"ItemData"=hex:0f,c4,4a,2f,06,8a,45,14,b3,77,06,d7,cc,6e,f2,5f
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{d03cc634-6d9a-4e51-bf34-726a370f58a3}]
"LastModified"=hex(b):92,b0,9e,9a,7d,2b,cf,01
"Description"=""
"FriendlyName"=" wsyscheck (1.68.17.0)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,92,06,00,00,00,00,00
"ItemData"=hex:a8,a2,e1,ff,43,17,46,09,41,f4,2d,b0,64,e3,e1,9a
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{d06a9efc-946a-425d-bfc1-48800a306928}]
"LastModified"=hex(b):a0,3f,46,c2,31,37,cb,01
"Description"="禁：网吧神话破坏幽灵3.2"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,c4,06,00,00,00,00,00
"ItemData"=hex:b7,56,fe,4c,38,e4,3b,68,50,e0,15,ac,eb,60,24,a4
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}]
"Description"="Stop the download of this file"
"FriendlyName"="msadc11.cab"
"SaferFlags"=dword:00000000
"HashAlg"=dword:00008003
"ItemData"=hex:38,6b,08,5f,84,ec,f6,69,d3,6b,95,6a,22,c0,1e,80
"LastModified"=hex(b):40,b2,40,dc,19,a2,c2,01
"ItemSize"=hex(b):72,01,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{e2253831-360c-42ab-be94-8b5adafe102f}]
"LastModified"=hex(b):56,e8,f1,ef,35,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,64,07,00,00,00,00,00
"ItemData"=hex:05,11,fc,df,0e,3c,75,22,7a,75,88,72,d4,4b,bc,a0
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{e9a1f4d9-ce10-4ee8-8d82-49bf71bac2e9}]
"LastModified"=hex(b):d4,6b,3d,55,3d,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,14,01,00,00,00,00,00
"ItemData"=hex:49,07,f1,08,d4,12,2a,fd,45,49,db,d4,22,0f,c3,0c
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{ebede712-d909-4681-87fe-752f73b55b3d}]
"LastModified"=hex(b):68,21,3d,c7,36,37,cb,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,fc,01,00,00,00,00,00
"ItemData"=hex:94,ac,75,c7,27,23,03,fc,94,ca,2b,4a,25,5c,b6,d2
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{fce541eb-3b21-40bf-9555-c5b5dfb0e664}]
"LastModified"=hex(b):a2,a4,b5,40,ee,25,cb,01
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,d2,05,00,00,00,00,00
"ItemData"=hex:27,e1,7f,74,4a,d7,90,96,7c,c5,ea,c0,8d,b5,f7,da
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{fd1ab25e-e739-45f3-994c-4c33306ca5ad}]
"LastModified"=hex(b):0c,5e,05,28,2d,37,cb,01
"Description"="禁绿化的批处理"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,6e,00,00,00,00,00,00
"ItemData"=hex:00,b5,85,65,20,15,e8,62,30,a7,42,44,84,00,7f,c1
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{de85544a-ef2c-474e-99ec-8a732ec6dcce}]
"LastModified"=hex(b):a0,d9,c2,26,5f,89,d5,01
"Description"=""
"FriendlyName"="Kill ProcessMicrosoft(R) Windows(R) Operating SystemMicrosoft CorporationTaskKill.exe (5.1.2600.0)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,3e,01,00,00,00,00,00
"ItemData"=hex:c9,34,46,72,e6,de,7f,a5,3b,44,3b,32,a0,28,58,56
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{77009f3f-f7e9-4403-a3d1-7a2f780365e5}]
"LastModified"=hex(b):7a,dd,c8,42,5f,89,d5,01
"Description"=""
"FriendlyName"=" (5.1.2600.0)"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,7c,00,00,00,00,00,00
"ItemData"=hex:fd,d5,61,79,84,b2,4d,21,99,1f,80,bc,94,71,42,18
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{5340f140-ffea-4f1d-9b00-a0b43d7c0004}]
"LastModified"=hex(b):2c,d4,25,83,e8,8a,d5,01
"Description"=""
"FriendlyName"="taskkill.exe (10.0.17763.1)

taskkill.exe

Terminates Processes

Microsoft® Windows® Operating System

Microsoft Corporation"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):00,76,01,00,00,00,00,00
"ItemData"=hex:ab,a3,aa,d5,62,0e,89,d2,2d,51,02,8e,ed,ad,3f,d6
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Hashes\{5340f140-ffea-4f1d-9b00-a0b43d7c0004}\SHA256]
"ItemData"=hex:94,72,f2,da,48,16,3a,7b,f3,6a,f3,d5,a9,23,95,77,88,72,1d,ce,35,\
  a3,da,54,3c,c5,e7,a1,f5,ca,54,75
"HashAlg"=dword:0000800c

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}]
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"=hex(2):25,00,48,00,4b,00,45,00,59,00,5f,00,43,00,55,00,52,00,52,00,\
  45,00,4e,00,54,00,5f,00,55,00,53,00,45,00,52,00,5c,00,53,00,6f,00,66,00,74,\
  00,77,00,61,00,72,00,65,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,\
  66,00,74,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,00,43,00,75,\
  00,72,00,72,00,65,00,6e,00,74,00,56,00,65,00,72,00,73,00,69,00,6f,00,6e,00,\
  5c,00,45,00,78,00,70,00,6c,00,6f,00,72,00,65,00,72,00,5c,00,53,00,68,00,65,\
  00,6c,00,6c,00,20,00,46,00,6f,00,6c,00,64,00,65,00,72,00,73,00,5c,00,43,00,\
  61,00,63,00,68,00,65,00,25,00,4f,00,4c,00,4b,00,2a,00,00,00
"LastModified"=hex(b):34,11,ac,e3,f4,d4,c8,01

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000001
"DisableChangePassword"=dword:00000001
"NoConfigPage"=dword:00000000
"NoDevMgrPage"=dword:00000000
"DisableSwitchUserOption"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"AllowMultipleTSSessions"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"HideFastUserSwitching"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer]
"DesktopProcess"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.2345navig.com"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="www.2345navig.com"
"Start Page"="http://www.2345navig.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN]
"Start Page"="http://www.2345navig.com"
"First Home Page"="http://www.2345navig.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="www.2345navig.com"
"Default_Page_URL"="www.2345navig.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Baidu\BaiduProtect\LockIEStartPage]
"Start Page"="www.2345navig.com"

[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.2345navig.com"
"First Home Page"="http://www.2345navig.com"

[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.2345navig.com"
"First Home Page"="http://www.2345navig.com"

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Software\Microsoft\Internet Explorer\Main]
"Start Page"="www.2345navig.com"
"Default_Page_URL"="www.2345navig.com"
