[main]
Title=File Sharing
Description=Request Windows Vista as source
Selected=False
Level=3
Locked=false
Author=Steelbone, NightMan
Version=12
Contact=vistape@vistape.net
Date=09.03.2008
Credits=
Updates=
Download_Level=1

[process]
Echo,"Processing File Sharing script..."
#ReadENV
IniRead,%VistaInfo%,"VistaInfo","SourceType","%SourceType%"
If,"%SourceType%",NotEqual,"VistaCD",Exit,"Request Windows Vista DVD..."
IniRead,%VistaInfo%,"VistaInfo","Language","%DistLang%"
FileCopy,"%InstallSRC%\Windows\System32\browser.dll","%TargetDir%\Windows\System32"
FileCopy,"%InstallSRC%\Windows\System32\lanman.drv","%TargetDir%\Windows\System32"
FileCopy,"%InstallSRC%\Windows\System32\netman.dll","%TargetDir%\Windows\System32"
FileCopy,"%InstallSRC%\Windows\System32\netprof.dll","%TargetDir%\Windows\System32"
FileCopy,"%InstallSRC%\Windows\System32\nlasvc.dll","%TargetDir%\Windows\System32"
FileCopy,"%InstallSRC%\Windows\System32\samsrv.dll","%TargetDir%\Windows\System32"
FileCopy,"%InstallSRC%\Windows\System32\sens.dll","%TargetDir%\Windows\System32"
FileCopy,"%InstallSRC%\Windows\System32\shrpubw.exe","%TargetDir%\Windows\System32"
FileCopy,"%InstallSRC%\Windows\System32\srvsvc.dll","%TargetDir%\Windows\System32"
FileCopy,"%InstallSRC%\Windows\System32\sscore.dll","%TargetDir%\Windows\System32"
FileCopy,"%InstallSRC%\Windows\System32\Drivers\srv2.sys","%TargetDir%\Windows\System32\Drivers"
FileCopy,"%InstallSRC%\Windows\System32\Drivers\srv.sys","%TargetDir%\Windows\System32\Drivers"
FileCopy,"%InstallSRC%\Windows\System32\Drivers\srvnet.sys","%TargetDir%\Windows\System32\Drivers"
FileCopy,"%InstallSRC%\Windows\System32\%DistLang%\shrpubw.exe.mui","%TargetDir%\Windows\System32\%DistLang%"
FileCopy,"%InstallSRC%\Windows\System32\%DistLang%\browser.dll.mui","%TargetDir%\Windows\System32\%DistLang%"
FileCopy,"%InstallSRC%\Windows\System32\%DistLang%\netman.dll.mui","%TargetDir%\Windows\System32\%DistLang%"
FileCopy,"%InstallSRC%\Windows\System32\%DistLang%\netprof.dll.mui","%TargetDir%\Windows\System32\%DistLang%"
FileCopy,"%InstallSRC%\Windows\System32\%DistLang%\nlasvc.dll.mui","%TargetDir%\Windows\System32\%DistLang%"
FileCopy,"%InstallSRC%\Windows\System32\%DistLang%\sens.dll.mui","%TargetDir%\Windows\System32\%DistLang%"
FileCopy,"%InstallSRC%\Windows\System32\%DistLang%\shrpubw.exe.mui","%TargetDir%\Windows\System32\%DistLang%"
FileCopy,"%InstallSRC%\Windows\System32\%DistLang%\sscore.dll.mui","%TargetDir%\Windows\System32\%DistLang%"
#
FileCopy,"%InstallSRC%\Windows\System32\ntshrui.dll","%TargetDir%\Windows\System32"
FileCopy,"%InstallSRC%\Windows\System32\%DistLang%\ntshrui.dll.mui","%TargetDir%\Windows\System32\%DistLang%"
#
RegHiveLoad,"WB-System","%RegSystem%"
RegHiveLoad,"WB-Software","%RegSoftware%"
RegHiveLoad,"WB-Default","%RegUser%"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\Browser","DisplayName","@%systemroot%\system32\browser.dll,-100"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\Browser","Group","NetworkProvider"
RegWrite,"HKLM","0x2","WB-System\ControlSet001\Services\Browser","ImagePath","%SystemRoot%\System32\svchost.exe -k netsvcs"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\Browser","Description","@%systemroot%\system32\browser.dll,-101"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\Browser","ObjectName","LocalSystem"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\Browser","ErrorControl","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\Browser","Start","2"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\Browser","Type","32"
RegWrite,"HKLM","0x7","WB-System\ControlSet001\Services\Browser","DependOnService","LanmanWorkstation","LanmanServer"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\Browser","FailureActions","84","03","00","00","00","00","00","00","00","00","00","00","03","00","00","00","14","00","00","00","01","00","00","00","c0","d4","01","00","01","00","00","00","e0","93","04","00","00","00","00","00","00","00","00","00"
RegWrite,"HKLM","0x2","WB-System\ControlSet001\Services\Browser\Parameters","ServiceDll","%SystemRoot%\System32\browser.dll"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\Browser\Parameters","ServiceDllUnloadOnStop","1"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\Browser\Parameters","MaintainServerList","Auto"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\Browser\Enum","0","Root\LEGACY_BROWSER\0000"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\Browser\Enum","Count","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\Browser\Enum","NextInstance","1"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\LanmanServer","DisplayName","@%systemroot%\system32\srvsvc.dll,-100"
RegWrite,"HKLM","0x2","WB-System\ControlSet001\Services\LanmanServer","ImagePath","%SystemRoot%\system32\svchost.exe -k netsvcs"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\LanmanServer","Description","@%systemroot%\system32\srvsvc.dll,-101"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\LanmanServer","ObjectName","LocalSystem"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer","ErrorControl","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer","Start","2"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer","Type","32"
RegWrite,"HKLM","0x7","WB-System\ControlSet001\Services\LanmanServer","DependOnService","SamSS","Srv"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer","ServiceSidType","1"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer","FailureActions","80","51","01","00","00","00","00","00","00","00","00","00","03","00","00","00","14","00","00","00","01","00","00","00","60","ea","00","00","01","00","00","00","c0","d4","01","00","00","00","00","00","00","00","00","00"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SrvsvcConfigInfo","01","00","04","80","a0","00","00","00","ac","00","00","00","00","00","00","00","14","00","00","00","02","00","8c","00","06","00","00","00","00","00","18","00","17","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","17","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","00","00","14","00","17","00","0f","00","01","01","00","00","00","00","00","05","12","00","00","00","00","00","18","00","03","00","00","00","01","02","00","00","00","00","00","05","20","00","00","00","23","02","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","01","00","00","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","05","07","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SrvsvcTransportEnum","01","00","04","80","8c","00","00","00","98","00","00","00","00","00","00","00","14","00","00","00","02","00","78","00","05","00","00","00","00","00","18","00","17","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","17","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","00","00","14","00","17","00","0f","00","01","01","00","00","00","00","00","05","12","00","00","00","00","00","18","00","03","00","00","00","01","02","00","00","00","00","00","05","20","00","00","00","23","02","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","05","0b","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SrvsvcConnection","01","00","04","80","7c","00","00","00","88","00","00","00","00","00","00","00","14","00","00","00","02","00","68","00","04","00","00","00","00","00","18","00","01","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","01","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","00","00","18","00","01","00","00","00","01","02","00","00","00","00","00","05","20","00","00","00","26","02","00","00","00","00","18","00","01","00","00","00","01","02","00","00","00","00","00","05","20","00","00","00","23","02","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SrvsvcServerDiskEnum","01","00","04","80","4c","00","00","00","58","00","00","00","00","00","00","00","14","00","00","00","02","00","38","00","02","00","00","00","00","00","18","00","01","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","01","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SrvsvcFile","01","00","04","80","64","00","00","00","70","00","00","00","00","00","00","00","14","00","00","00","02","00","50","00","03","00","00","00","00","00","18","00","11","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","11","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","00","00","18","00","11","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","23","02","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SrvsvcSessionInfo","01","00","04","80","78","00","00","00","84","00","00","00","00","00","00","00","14","00","00","00","02","00","64","00","04","00","00","00","00","00","18","00","13","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","13","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","00","00","18","00","13","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","23","02","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","05","0b","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SrvsvcShareFileInfo","01","00","04","80","a0","00","00","00","ac","00","00","00","00","00","00","00","14","00","00","00","02","00","8c","00","06","00","00","00","00","00","18","00","13","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","13","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","00","00","18","00","13","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","23","02","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","01","00","00","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","05","07","00","00","00","00","00","14","00","02","00","00","00","01","01","00","00","00","00","00","05","04","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SrvsvcSharePrintInfo","01","00","04","80","b8","00","00","00","c4","00","00","00","00","00","00","00","14","00","00","00","02","00","a4","00","07","00","00","00","00","00","18","00","13","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","13","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","00","00","18","00","13","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","26","02","00","00","00","00","18","00","13","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","23","02","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","01","00","00","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","05","07","00","00","00","00","00","14","00","02","00","00","00","01","01","00","00","00","00","00","05","04","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SrvsvcShareAdminInfo","01","00","04","80","8c","00","00","00","98","00","00","00","00","00","00","00","14","00","00","00","02","00","78","00","05","00","00","00","00","00","18","00","13","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","02","00","00","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","00","00","18","00","02","00","00","00","01","02","00","00","00","00","00","05","20","00","00","00","23","02","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","01","00","00","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","05","07","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SrvsvcShareConnect","01","00","04","80","8c","00","00","00","98","00","00","00","00","00","00","00","14","00","00","00","02","00","78","00","05","00","00","00","00","00","18","00","03","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","03","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","00","00","18","00","03","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","27","02","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","01","00","00","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","05","07","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SrvsvcShareAdminConnect","01","00","04","80","78","00","00","00","84","00","00","00","00","00","00","00","14","00","00","00","02","00","64","00","04","00","00","00","00","00","18","00","03","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","03","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","00","00","18","00","03","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","27","02","00","00","00","00","14","00","03","00","0f","00","01","01","00","00","00","00","00","05","04","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SrvsvcStatisticsInfo","01","00","04","80","60","00","00","00","6c","00","00","00","00","00","00","00","14","00","00","00","02","00","4c","00","03","00","00","00","00","00","18","00","01","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","01","00","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","00","00","14","00","01","00","00","00","01","01","00","00","00","00","00","02","00","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","AnonymousDescriptorsUpgraded","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","PreviousAnonymousRestriction","0"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","SessionSecurityDescriptorRegenerated","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\DefaultSecurity","InteractiveDescriptorsRegenerated","0"
RegWrite,"HKLM","0x7","WB-System\ControlSet001\Services\LanmanServer\Linkage","Bind","\Device\Smb_Tcpip_{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}","\Device\Smb_Tcpip6_{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}","\Device\NetbiosSmb","\Device\Tcpip6_{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}","\Device\Tcpip_{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}","\Device\NetBT_Tcpip_{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}","\Device\NetBT_Tcpip6_{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}"
RegWrite,"HKLM","0x7","WB-System\ControlSet001\Services\LanmanServer\Linkage","Route",""Smb" "Tcpip" "{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}"",""Smb" "Tcpip6" "{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}"",""NetbiosSmb"",""Tcpip6" "{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}"",""Tcpip" "{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}"",""NetBT" "Tcpip" "{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}"",""NetBT" "Tcpip6" "{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}""
RegWrite,"HKLM","0x7","WB-System\ControlSet001\Services\LanmanServer\Linkage","Export","\Device\LanmanServer_Smb_Tcpip_{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}","\Device\LanmanServer_Smb_Tcpip6_{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}","\Device\LanmanServer_NetbiosSmb","\Device\LanmanServer_Tcpip6_{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}","\Device\LanmanServer_Tcpip_{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}","\Device\LanmanServer_NetBT_Tcpip_{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}","\Device\LanmanServer_NetBT_Tcpip6_{AE63B719-1F97-46A5-8448-3E7EC85FA2BC}"
RegWrite,"HKLM","0x2","WB-System\ControlSet001\Services\LanmanServer\Parameters","ServiceDll","%SystemRoot%\system32\srvsvc.dll"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\Parameters","ServiceDllUnloadOnStop","1"
RegWrite,"HKLM","0x7","WB-System\ControlSet001\Services\LanmanServer\Parameters","NullSessionPipes","netlogon","lsarpc","samr","browser"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\Parameters","autodisconnect","15"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\Parameters","enableforcedlogoff","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\Parameters","enablesecuritysignature","0"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\Parameters","requiresecuritysignature","0"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\Parameters","restrictnullsessaccess","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\Parameters","Lmannounce","0"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\Parameters","Size","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\Parameters","AdjustedNullSessionPipes","2"
RegWrite,"HKLM","0x3","WB-System\ControlSet001\Services\LanmanServer\Parameters","Guid","e0","3c","5e","a9","b7","88","ab","44","b2","df","b9","6f","5d","44","87","7c"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\LanmanServer\Enum","0","Root\LEGACY_LANMANSERVER\0000"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\Enum","Count","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\LanmanServer\Enum","NextInstance","1"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\SamSs","Description","@%SystemRoot%\system32\samsrv.dll,-2"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\SamSs","DisplayName","@%SystemRoot%\system32\samsrv.dll,-1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\SamSs","ErrorControl","1"
RegWrite,"HKLM","0x2","wb-system\ControlSet001\Services\SamSs","ImagePath","%SystemRoot%\system32\lsass.exe"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\SamSs","ObjectName","LocalSystem"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\SamSs","Start","2"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\SamSs","Type","32"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\SamSs","Group","MS_WindowsLocalValidation"
RegWrite,"HKLM","0x7","wb-system\ControlSet001\Services\SamSs","DependOnService","RPCSS"
RegWrite,"HKLM","0x3","wb-system\ControlSet001\Services\SamSs\Security","Security","01","00","14","80","90","00","00","00","9c","00","00","00","14","00","00","00","30","00","00","00","02","00","1c","00","01","00","00","00","02","80","14","00","ff","01","0f","00","01","01","00","00","00","00","00","01","00","00","00","00","02","00","60","00","04","00","00","00","00","00","14","00","8d","00","02","00","01","01","00","00","00","00","00","05","0b","00","00","00","00","00","18","00","ff","01","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","14","00","8d","00","00","00","01","01","00","00","00","00","00","05","04","00","00","00","00","00","18","00","8d","00","00","00","01","02","00","00","00","00","00","05","20","00","00","00","21","02","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\srv2","DisplayName","srv2"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\srv2","Group","Network"
RegWrite,"HKLM","0x2","WB-System\ControlSet001\Services\srv2","ImagePath","System32\DRIVERS\srv2.sys"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\srv2","Description","Default SDDL for Windows Resource Protected file"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srv2","ErrorControl","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srv2","Start","3"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srv2","Type","2"
RegWrite,"HKLM","0x7","WB-System\ControlSet001\Services\srv2","DependOnService","srvnet"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\srv2\Enum","0","Root\LEGACY_SRV2\0000"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srv2\Enum","Count","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srv2\Enum","NextInstance","1"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\srv","Group","Network"
RegWrite,"HKLM","0x2","WB-System\ControlSet001\Services\srv","ImagePath","System32\DRIVERS\srv.sys"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srv","ErrorControl","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srv","Start","3"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srv","Type","2"
RegWrite,"HKLM","0x7","WB-System\ControlSet001\Services\srv","DependOnService","srv2"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\srv\Enum","0","Root\LEGACY_SRV\0000"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srv\Enum","Count","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srv\Enum","NextInstance","1"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\srvnet","Group","Network"
RegWrite,"HKLM","0x2","WB-System\ControlSet001\Services\srvnet","ImagePath","System32\DRIVERS\srvnet.sys"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srvnet","ErrorControl","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srvnet","Start","3"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srvnet","Type","2"
RegWrite,"HKLM","0x1","WB-System\ControlSet001\Services\srvnet\Enum","0","Root\LEGACY_SRVNET\0000"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srvnet\Enum","Count","1"
RegWrite,"HKLM","0x4","WB-System\ControlSet001\Services\srvnet\Enum","NextInstance","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_BROWSER","NextInstance","1"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_BROWSER\0000","Service","Browser"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_BROWSER\0000","Legacy","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_BROWSER\0000","ConfigFlags","0"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_BROWSER\0000","Class","LegacyDriver"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_BROWSER\0000","ClassGUID","{8ECC055D-047F-11D1-A537-0000F8753ED1}"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_BROWSER\0000","DeviceDesc","@%systemroot%\system32\browser.dll,-100"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_BROWSER\0000\Control","*NewlyCreated*","0"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_LANMANSERVER","NextInstance","1"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_LANMANSERVER\0000","Service","LanmanServer"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_LANMANSERVER\0000","Legacy","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_LANMANSERVER\0000","ConfigFlags","0"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_LANMANSERVER\0000","Class","LegacyDriver"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_LANMANSERVER\0000","ClassGUID","{8ECC055D-047F-11D1-A537-0000F8753ED1}"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_LANMANSERVER\0000","DeviceDesc","@%systemroot%\system32\srvsvc.dll,-100"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_LANMANSERVER\0000\Control","*NewlyCreated*","0"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_SRV","NextInstance","1"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRV\0000","Service","srv"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_SRV\0000","Legacy","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_SRV\0000","ConfigFlags","32"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRV\0000","Class","LegacyDriver"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRV\0000","ClassGUID","{8ECC055D-047F-11D1-A537-0000F8753ED1}"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRV\0000","DeviceDesc","srv"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRV\0000\Control","ActiveService","srv"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_SRV2","NextInstance","1"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRV2\0000","Service","srv2"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_SRV2\0000","Legacy","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_SRV2\0000","ConfigFlags","32"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRV2\0000","Class","LegacyDriver"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRV2\0000","ClassGUID","{8ECC055D-047F-11D1-A537-0000F8753ED1}"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRV2\0000","DeviceDesc","srv2"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRV2\0000\Control","ActiveService","srv2"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_SRVNET","NextInstance","1"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRVNET\0000","Service","srvnet"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_SRVNET\0000","Legacy","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_SRVNET\0000","ConfigFlags","32"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRVNET\0000","Class","LegacyDriver"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRVNET\0000","ClassGUID","{8ECC055D-047F-11D1-A537-0000F8753ED1}"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRVNET\0000","DeviceDesc","srvnet"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_SRVNET\0000\Control","ActiveService","srvnet"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\Netman","DisplayName","@%SystemRoot%\system32\netman.dll,-109"
RegWrite,"HKLM","0x2","wb-system\ControlSet001\Services\Netman","ImagePath","%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\Netman","Description","@%SystemRoot%\system32\netman.dll,-110"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\Netman","ObjectName","LocalSystem"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\Netman","ErrorControl","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\Netman","Start","3"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\Netman","Type","32"
RegWrite,"HKLM","0x7","wb-system\ControlSet001\Services\Netman","DependOnService","RpcSs","nsi"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\Netman","ServiceSidType","1"
RegWrite,"HKLM","0x7","wb-system\ControlSet001\Services\Netman","RequiredPrivileges","SeImpersonatePrivilege","SeChangeNotifyPrivilege"
RegWrite,"HKLM","0x3","wb-system\ControlSet001\Services\Netman","FailureActions","80","51","01","00","00","00","00","00","00","00","00","00","03","00","00","00","14","00","00","00","01","00","00","00","64","00","00","00","01","00","00","00","64","00","00","00","00","00","00","00","00","00","00","00"
RegWrite,"HKLM","0x2","wb-system\ControlSet001\Services\Netman\Parameters","ServiceDll","%SystemRoot%\System32\netman.dll"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\Netman\Enum","0","Root\LEGACY_NETMAN\0000"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\Netman\Enum","Count","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\Netman\Enum","NextInstance","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_NETMAN","NextInstance","1"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_NETMAN\0000","Service","Netman"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_NETMAN\0000","Legacy","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_NETMAN\0000","ConfigFlags","0"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_NETMAN\0000","Class","LegacyDriver"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_NETMAN\0000","ClassGUID","{8ECC055D-047F-11D1-A537-0000F8753ED1}"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_NETMAN\0000","DeviceDesc","@%SystemRoot%\system32\netman.dll,-109"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_NETMAN\0000\Control","*NewlyCreated*","0"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\SENS","DisplayName","@%SystemRoot%\system32\Sens.dll,-200"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\SENS","Group","ProfSvc_Group"
RegWrite,"HKLM","0x2","wb-system\ControlSet001\Services\SENS","ImagePath","%SystemRoot%\system32\svchost.exe -k netsvcs"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\SENS","Description","@%SystemRoot%\system32\Sens.dll,-201"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\SENS","ObjectName","LocalSystem"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\SENS","ErrorControl","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\SENS","Start","2"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\SENS","Type","32"
RegWrite,"HKLM","0x7","wb-system\ControlSet001\Services\SENS","DependOnService","EventSystem"
RegWrite,"HKLM","0x7","wb-system\ControlSet001\Services\SENS","RequiredPrivileges","SeAuditPrivilege","SeChangeNotifyPrivilege","SeCreateGlobalPrivilege","SeImpersonatePrivilege","SeTcbPrivilege"
RegWrite,"HKLM","0x3","wb-system\ControlSet001\Services\SENS","FailureActions","80","51","01","00","00","00","00","00","00","00","00","00","03","00","00","00","14","00","00","00","01","00","00","00","c0","d4","01","00","01","00","00","00","e0","93","04","00","00","00","00","00","00","00","00","00"
RegWrite,"HKLM","0x2","wb-system\ControlSet001\Services\SENS\Parameters","ServiceDll","%SystemRoot%\System32\sens.dll"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\SENS\Parameters","ServiceMain","ServiceMain"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\SENS\Parameters","ServiceDllUnloadOnStop","1"
RegWrite,"HKLM","0x3","wb-system\ControlSet001\Services\SENS\Security","Security","01","00","14","80","90","00","00","00","9c","00","00","00","14","00","00","00","30","00","00","00","02","00","1c","00","01","00","00","00","02","80","14","00","ff","01","0f","00","01","01","00","00","00","00","00","01","00","00","00","00","02","00","60","00","04","00","00","00","00","00","14","00","8d","01","02","00","01","01","00","00","00","00","00","05","0b","00","00","00","00","00","18","00","ff","01","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","00","18","00","ff","01","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","25","02","00","00","00","00","14","00","fd","01","02","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","LocalService","nsi","lltdsvc","SSDPSRV","upnphost","SCardSvr","w32time","EventSystem","RemoteRegistry","WinHttpAutoProxySvc","lanmanworkstation","TBS","SLUINotify","THREADORDER","fdrespub","netprofm","fdphost","wcncsvc","QWAVE","Mcx2Svc","WebClient"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","LocalSystemNetworkRestricted","hidserv","UxSms","WdiSystemHost","Netman","trkwks","AudioEndpointBuilder","WUDFSvc","irmon","sysmain","IPBusEnum","dot3svc","PcaSvc","CscService","wlansvc","UmRdpService","EMDMgmt","WPDBusEnum","TabletInputService"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","NetworkServiceNetworkRestricted","PolicyAgent"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","LocalServiceNoNetwork","PLA","DPS","BFE","mpssvc","ehstart"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","NetworkService","CryptSvc","DHCP","TermService","KtmRm","DNSCache","NapAgent","nlasvc","WinRM","WECSVC","Tapisrv"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","termsvcs","TermService"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","WerSvcGroup","wersvc"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","netsvcs","AeLookupSvc","wercplsupport","Themes","CertPropSvc","SCPolicySvc","lanmanserver","gpsvc","IKEEXT","AudioSrv","FastUserSwitchingCompatibility","Ias","Irmon","Nla","Ntmssvc","NWCWorkstation","Nwsapagent","Rasauto","Rasman","Remoteaccess","SENS","Sharedaccess","SRService","Tapisrv","Wmi","WmdmPmSp","TermService","wuauserv","BITS","ShellHWDetection","LogonHours","PCAudit","helpsvc","uploadmgr","iphlpsvc","seclogon","AppInfo","msiscsi","MMCSS","ProfSvc","EapHost","winmgmt","schedule","SessionEnv","browser","hkmsvc","AppMgmt"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","swprv","swprv"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","LocalServiceNetworkRestricted","DHCP","eventlog","AudioSrv","LmHosts","wscsvc","p2pimsvc","PNRPSvc","p2psvc","WPCSvc","PnrpAutoReg"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","rpcss","RpcSs"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","regsvc","RemoteRegistry"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","wcssvc","WcsPlugInService"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","DcomLaunch","PlugPlay","DcomLaunch"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","wdisvc","WdiServiceHost"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","sdrsvc","sdrsvc"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","imgsvc","StiSvc"
RegWrite,"HKLM","0x7","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost","secsvcs","WinDefend"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\LocalService","AuthenticationCapabilities","8192"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\LocalService","CoInitializeSecurityParam","1"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\LocalSystemNetworkRestricted","CoInitializeSecurityParam","1"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs","AuthenticationCapabilities","12320"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs","CoInitializeSecurityParam","1"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\NetworkService","CoInitializeSecurityParam","1"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\NetworkService","DefaultRpcStackSize","28"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\SDRSVC","CoInitializeSecurityParam","0"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\swprv","CoInitializeSecurityParam","0"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\termsvcs","CoInitializeSecurityParam","1"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\wcssvc","CoInitializeSecurityParam","1"
RegWrite,"HKLM","0x1","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\wcssvc","CoInitializeSecurityAppID","{CD11FAB6-1C0E-45e1-BA31-5C6008EF2607}"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\wercplsupport","AuthenticationCapabilities","12320"
RegWrite,"HKLM","0x4","WB-Software\Microsoft\Windows NT\CurrentVersion\Svchost\wercplsupport","CoInitializeSecurityParam","1"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\netprofm","DisplayName","@%SystemRoot%\system32\netprof.dll,-246"
RegWrite,"HKLM","0x2","wb-system\ControlSet001\Services\netprofm","ImagePath","%SystemRoot%\System32\svchost.exe -k LocalService"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\netprofm","Description","@%SystemRoot%\system32\netprof.dll,-247"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\netprofm","ObjectName","NT AUTHORITY\LocalService"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\netprofm","ErrorControl","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\netprofm","Start","2"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\netprofm","Type","32"
RegWrite,"HKLM","0x7","wb-system\ControlSet001\Services\netprofm","DependOnService","RpcSs","nlasvc"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\netprofm","ServiceSidType","1"
RegWrite,"HKLM","0x7","wb-system\ControlSet001\Services\netprofm","RequiredPrivileges","SeImpersonatePrivilege","SeChangeNotifyPrivilege"
RegWrite,"HKLM","0x3","wb-system\ControlSet001\Services\netprofm","FailureActions","80","51","01","00","00","00","00","00","00","00","00","00","03","00","00","00","14","00","00","00","01","00","00","00","64","00","00","00","01","00","00","00","64","00","00","00","00","00","00","00","64","00","00","00"
RegWrite,"HKLM","0x2","wb-system\ControlSet001\Services\netprofm\Parameters","ServiceDll","%SystemRoot%\System32\netprofm.dll"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\netprofm\Parameters","ServiceDllUnloadOnStop","1"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\netprofm\Enum","0","Root\LEGACY_NETPROFM\0000"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\netprofm\Enum","Count","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\netprofm\Enum","NextInstance","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_NETPROFM","NextInstance","1"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_NETPROFM\0000","Service","netprofm"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_NETPROFM\0000","Legacy","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_NETPROFM\0000","ConfigFlags","0"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_NETPROFM\0000","Class","LegacyDriver"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_NETPROFM\0000","ClassGUID","{8ECC055D-047F-11D1-A537-0000F8753ED1}"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Enum\Root\LEGACY_NETPROFM\0000","DeviceDesc","@%SystemRoot%\system32\netprof.dll,-246"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Enum\Root\LEGACY_NETPROFM\0000\Control","*NewlyCreated*","0"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\NlaSvc","DisplayName","@%SystemRoot%\System32\nlasvc.dll,-1"
RegWrite,"HKLM","0x2","wb-system\ControlSet001\Services\NlaSvc","ImagePath","%SystemRoot%\System32\svchost.exe -k NetworkService"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\NlaSvc","Description","@%SystemRoot%\System32\nlasvc.dll,-2"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\NlaSvc","ObjectName","NT AUTHORITY\NetworkService"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\NlaSvc","ErrorControl","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\NlaSvc","Start","2"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\NlaSvc","Type","32"
RegWrite,"HKLM","0x7","wb-system\ControlSet001\Services\NlaSvc","DependOnService","NSI","RpcSs","TcpIp"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\NlaSvc","ServiceSidType","1"
RegWrite,"HKLM","0x7","wb-system\ControlSet001\Services\NlaSvc","RequiredPrivileges","SeCreateGlobalPrivilege","SeImpersonatePrivilege","SeAuditPrivilege"
RegWrite,"HKLM","0x3","wb-system\ControlSet001\Services\NlaSvc","FailureActions","80","51","01","00","00","00","00","00","00","00","00","00","03","00","00","00","14","00","00","00","01","00","00","00","64","00","00","00","01","00","00","00","64","00","00","00","00","00","00","00","00","00","00","00"
RegWrite,"HKLM","0x2","wb-system\ControlSet001\Services\NlaSvc\Parameters","ServiceDll","%SystemRoot%\System32\nlasvc.dll"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\NlaSvc\Parameters","ServiceDllUnloadOnStop","1"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\NlaSvc\Parameters\Fuser","Tlag","500"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\NlaSvc\Parameters\Internet","PassivePollPeriod","5"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\NlaSvc\Parameters\Internet","StaleThreshold","30"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\NlaSvc\Parameters\Internet","WebTimeout","10"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\NlaSvc\Parameters\Internet","EnableActiveProbing","1"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\NlaSvc\Parameters\Internet","ActiveWebProbeHost","www.msftncsi.com"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\NlaSvc\Parameters\Internet","ActiveWebProbePath","ncsi.txt"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\NlaSvc\Parameters\Internet","ActiveWebProbeContent","Microsoft NCSI"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\NlaSvc\Parameters\Internet","ActiveDnsProbeHost","dns.msftncsi.com"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\NlaSvc\Parameters\Internet","ActiveDnsProbeContent","131.107.255.255"
RegWrite,"HKLM","0x1","wb-system\ControlSet001\Services\NlaSvc\Parameters\Internet","KnownProxylessGateways","00-0e-d7-15-c6-21 148549"
RegWrite,"HKLM","0x4","wb-system\ControlSet001\Services\NlaSvc\Parameters\PMux","Tresolve","2000"
RegWrite,"HKLM","0x3","wb-system\ControlSet001\Services\NlaSvc\Security","Security","01","00","14","98","b4","00","00","00","c0","00","00","00","14","00","00","00","30","00","00","00","02","00","1c","00","01","00","00","00","02","80","14","00","ff","01","0f","00","01","01","00","00","00","00","00","01","00","00","00","00","02","00","84","00","05","00","00","00","00","02","18","00","ff","01","0f","00","01","02","00","00","00","00","00","05","20","00","00","00","20","02","00","00","00","02","14","00","ff","01","0f","00","01","01","00","00","00","00","00","05","12","00","00","00","00","00","14","00","9d","00","02","00","01","01","00","00","00","00","00","05","04","00","00","00","00","00","14","00","8d","01","02","00","01","01","00","00","00","00","00","05","06","00","00","00","00","00","28","00","1d","00","02","00","01","06","00","00","00","00","00","05","50","00","00","00","44","3e","41","bb","45","ba","a8","7a","6c","bd","92","68","f4","ad","64","8f","d5","e6","70","e9","01","01","00","00","00","00","00","05","12","00","00","00","01","01","00","00","00","00","00","05","12","00","00","00"
RegWrite,"HKLM","0x1","WB-Software\Classes\CLSID\{40dd6e20-7c17-11ce-a804-00aa003ca9f6}",,"Shell extensions for sharing"
RegWrite,"HKLM","0x1","WB-Software\Classes\CLSID\{40dd6e20-7c17-11ce-a804-00aa003ca9f6}\InProcServer32",,"ntshrui.dll"
RegWrite,"HKLM","0x1","WB-Software\Classes\CLSID\{40dd6e20-7c17-11ce-a804-00aa003ca9f6}\InProcServer32","ThreadingModel","Apartment"
RegWrite,"HKLM","0x1","WB-Software\Classes\*\shellex\ContextMenuHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
RegWrite,"HKLM","0x1","WB-Software\Classes\Directory\shellex\PropertySheetHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
RegWrite,"HKLM","0x1","WB-Software\Classes\Directory\shellex\ContextMenuHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
RegWrite,"HKLM","0x1","WB-Software\Classes\Drive\shellex\ContextMenuHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
RegWrite,"HKLM","0x1","WB-Software\Classes\Drive\shellex\PropertySheetHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
#09.03.2008
RegWrite,"HKLM","0x1","WB-Software\Classes\CLSID\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}",,"Shell extensions for sharing"
RegWrite,"HKLM","0x1","WB-Software\Classes\CLSID\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}\InProcServer32",,"ntshrui.dll"
RegWrite,"HKLM","0x1","WB-Software\Classes\CLSID\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}\InProcServer32","ThreadingModel","Apartment"
RegWrite,"HKLM","0x1","WB-Software\Classes\Directory\shellex\ContextMenuHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
RegWrite,"HKLM","0x1","WB-Software\Classes\Directory\shellex\PropertySheetHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
RegWrite,"HKLM","0x1","WB-Software\Classes\Drive\shellex\ContextMenuHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
RegWrite,"HKLM","0x1","WB-Software\Classes\Drive\shellex\PropertySheetHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
RegWrite,"HKLM","0x1","WB-Software\Classes\CLSID\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}",,"Shell extensions for sharing"
RegWrite,"HKLM","0x1","WB-Software\Classes\CLSID\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}\InProcServer32",,"ntshrui.dll"
RegWrite,"HKLM","0x1","WB-Software\Classes\CLSID\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}\InProcServer32","ThreadingModel","Apartment"
RegWrite,"HKLM","0x1","WB-Software\Classes\Directory\shellex\ContextMenuHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
RegWrite,"HKLM","0x1","WB-Software\Classes\Directory\shellex\PropertySheetHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
RegWrite,"HKLM","0x1","WB-Software\Classes\Drive\shellex\ContextMenuHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
RegWrite,"HKLM","0x1","WB-Software\Classes\Drive\shellex\PropertySheetHandlers\Sharing",,"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"
RegWrite,"HKLM","0x1","WB-Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved","{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}","Shell extensions for sharing"
RegWrite,"HKLM","0x3","WB-Default\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached","{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6} {000214E8-0000-0000-C000-000000000046} 0x401","01","00","00","00","31","00","34","00","f4","a9","8c","b7","56","a3","c7","01"
RegHiveUnLoad,"WB-Software"
RegHiveUnLoad,"WB-System"
RegHiveUnLoad,"WB-Default"

