[Version] Signature="$Chicago$" Provider=Nobody [DefaultInstall] AddReg=UnhookRegKey DelReg=del [UnhookRegKey] HKLM, Software\CLASSES\batfile\shell\open\command,,,"""%1"" %*" HKLM, Software\CLASSES\comfile\shell\open\command,,,"""%1"" %*" HKLM, Software\CLASSES\exefile\shell\open\command,,,"""%1"" %*" HKLM, Software\CLASSES\piffile\shell\open\command,,,"""%1"" %*" HKLM, Software\CLASSES\regfile\shell\open\command,,,"regedit.exe "%1"" HKLM, Software\CLASSES\scrfile\shell\open\command,,,"""%1"" %*" HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, "Explorer.exe" HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, "cmd.exe" HKLM, SYSTEM\ControlSet002\Control\SafeBoot, AlternateShell,0, "cmd.exe" HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, "cmd.exe" HKLM, SOFTWARE\Classes\exefile,,,application HKCU, Software\Microsoft\Internet Explorer\Main, start page,0, "about:blank" HKCU, Software\Microsoft\Internet Explorer\Main, Search Page,0, "about:blank" HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt, UncheckedValue,0x00010001,0 HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, UncheckedValue,0x00010001,1 HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion, RegisteredOrganization,0, "Organization" HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion, RegisteredOwner,0, "Owner" HKLM, SOFTWARE\Classes\txtfile, FriendlyTypeName,0, "@C:\Windows\system32\notepad.exe,-469" HKLM, SOFTWARE\Classes\Word.Document.8,,,"Microsoft Word Document" HKLM, SOFTWARE\Classes\Word.Document.8\DefaultIcon,,,"C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-01500 48383C9}\wordicon.exe,1" HKLM, SOFTWARE\Classes\PowerPoint.Show.8,,, "Microsoft PowerPoint Presentation" HKLM, SOFTWARE\Classes\PowerPoint.Show.8\DefaultIcon,,,"C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-015 0048383C9}\pptico.exe,1" HKLM, SOFTWARE\Classes\Excel.Sheet.8,,,"Microsoft Excel Worksheet" HKLM, SOFTWARE\Classes\Excel.Sheet.8\DefaultIcon,,,"C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-01500483 83C9}\xlicons.exe,1" HKLM, SOFTWARE\Classes\Access.Application.11,,,"Microsoft Office Access Application" HKLM, SOFTWARE\Classes\Access.Application.11\DefaultIcon,,,"C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-01 50048383C9}\accicons.exe,1" HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, Hidden, 0x00010001,1 HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, HideFileExt, 0x00010001,0 HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, ShowSuperHidden, 0x00010001,1 HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden,WarningIfNotDefault,0,"@ shell32.dll,-28964" [del] HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoFolderOptions HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableRegistryTools HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableTaskMgr HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System,DIsablecmd HKCU, Software\Microsoft\Internet Explorer\Main, Window Title HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer,NoFolderOptions HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System,DisableRegistryTools HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System,DisableTaskMgr HKLM, SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore HKCU, Software\Microsoft\Windows\CurrentVersion\Run, System HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop HKCU, Software\Microsoft\Windows NT\CurrentVersion\Winlogon, shell HKCU, Software\Policies\Microsoft\Windows\System, DisableCMD HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt, WarningIfNotDefault HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Run, cintaku HKLM, SOFTWARE\Classes\exefile, FriendlyTypeName