Windows Registry Editor Version 5.00
www.Tarfandestan.com
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"netsvcs"=hex(7):41,00,70,00,70,00,4d,00,67,00,6d,00,74,00,00,00,41,00,75,00,\
64,00,69,00,6f,00,53,00,72,00,76,00,00,00,42,00,72,00,6f,00,77,00,73,00,65,\
00,72,00,00,00,43,00,72,00,79,00,70,00,74,00,53,00,76,00,63,00,00,00,44,00,\
4d,00,53,00,65,00,72,00,76,00,65,00,72,00,00,00,45,00,76,00,65,00,6e,00,74,\
00,53,00,79,00,73,00,74,00,65,00,6d,00,00,00,48,00,69,00,64,00,53,00,65,00,\
72,00,76,00,00,00,49,00,61,00,73,00,00,00,49,00,70,00,72,00,69,00,70,00,00,\
00,49,00,72,00,6d,00,6f,00,6e,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,00,\
53,00,65,00,72,00,76,00,65,00,72,00,00,00,4c,00,61,00,6e,00,6d,00,61,00,6e,\
00,57,00,6f,00,72,00,6b,00,73,00,74,00,61,00,74,00,69,00,6f,00,6e,00,00,00,\
4d,00,65,00,73,00,73,00,65,00,6e,00,67,00,65,00,72,00,00,00,4e,00,65,00,74,\
00,6d,00,61,00,6e,00,00,00,4e,00,6c,00,61,00,00,00,4e,00,74,00,6d,00,73,00,\
73,00,76,00,63,00,00,00,4e,00,57,00,43,00,57,00,6f,00,72,00,6b,00,73,00,74,\
00,61,00,74,00,69,00,6f,00,6e,00,00,00,4e,00,77,00,73,00,61,00,70,00,61,00,\
67,00,65,00,6e,00,74,00,00,00,52,00,61,00,73,00,61,00,75,00,74,00,6f,00,00,\
00,52,00,61,00,73,00,6d,00,61,00,6e,00,00,00,52,00,65,00,6d,00,6f,00,74,00,\
65,00,61,00,63,00,63,00,65,00,73,00,73,00,00,00,53,00,61,00,63,00,73,00,76,\
00,72,00,00,00,53,00,63,00,68,00,65,00,64,00,75,00,6c,00,65,00,00,00,53,00,\
65,00,63,00,6c,00,6f,00,67,00,6f,00,6e,00,00,00,53,00,45,00,4e,00,53,00,00,\
00,53,00,68,00,61,00,72,00,65,00,64,00,61,00,63,00,63,00,65,00,73,00,73,00,\
00,00,54,00,68,00,65,00,6d,00,65,00,73,00,00,00,54,00,72,00,6b,00,57,00,6b,\
00,73,00,00,00,54,00,72,00,6b,00,53,00,76,00,72,00,00,00,57,00,33,00,32,00,\
54,00,69,00,6d,00,65,00,00,00,57,00,5a,00,43,00,53,00,56,00,43,00,00,00,57,\
00,6d,00,69,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,00,53,00,70,00,00,00,\
77,00,69,00,6e,00,6d,00,67,00,6d,00,74,00,00,00,77,00,75,00,61,00,75,00,73,\
00,65,00,72,00,76,00,00,00,42,00,49,00,54,00,53,00,00,00,53,00,68,00,65,00,\
6c,00,6c,00,48,00,57,00,44,00,65,00,74,00,65,00,63,00,74,00,69,00,6f,00,6e,\
00,00,00,68,00,65,00,6c,00,70,00,73,00,76,00,63,00,00,00,75,00,70,00,6c,00,\
6f,00,61,00,64,00,6d,00,67,00,72,00,00,00,57,00,6d,00,64,00,6d,00,50,00,6d,\
00,53,00,4e,00,00,00,53,00,52,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,\
00,00,00,00

[version]
Signature="$CHICAGO$"
SetupClass=BASE
LayoutFile=layout.inf

[DefaultInstall]
CopyFiles=SRFlt_files,SRSvc_files,SR_files
AddReg=SRFlt_addreg,SRSvc_addreg,SR_addreg
ProfileItems=SRProfile
RegisterDlls=SR_register
DelReg=SRSvc_delreg

[DefaultInstall.Services]
AddService=sr,,SRFlt_service,SRFlt_event
AddService=srservice,,SRSvc_service,SRSvc_event

[Uninstall]
DelFiles=SRFlt_files,SRSvc_files,SR_files,SRWmi_files
DelReg=SRFlt_delreg,SRSvc_delreg,SR_delreg
UnregisterDlls=SR_register

[Uninstall.Services]
DelService=sr
DelService=srservice

[DestinationDirs]
SRFlt_files=12
SRSvc_files=11
SR_files=11,Restore

[SRFlt_files]
sr.sys,,,0x10000

[SRSvc_files]
srclient.dll,,,0x10000
srsvc.dll,,,0x10000
srrstr.dll,,,0x10000

[SRSvc_files.Security]
"D:P(A;;GRGX;;;BU)(A;;GA;;;BA)(A;;GA;;;SY)(A;;GRGX;;;WD)"

[SR_files]
filelist.xml,,,0x10000
rstrui.exe,,,0x10000
srframe.mmf,,,0x10000
srdiag.exe,,,0x10000

[SR_files.Security]
"D:P(A;;GRGX;;;BU)(A;;GA;;;BA)(A;;GA;;;SY)(A;;GRGX;;;WD)"

[SRProfile]
Name=%SR_UI_Link_Name%
CmdLine=11,restore,rstrui.exe
SubDir=%SR_UI_Link_SubDir%
InfoTip="@%systemroot%\system32\restore\rstrui.exe,-2078"
DisplayResource="%systemroot%\system32\restore\rstrui.exe",2048


[SRFlt_service]
DisplayName    = %SR_Filter_Name%
ServiceType    = 2    
StartType      = 0    
ErrorControl   = 1    
ServiceBinary  = %12%\sr.sys
LoadOrderGroup = "FSFilter System Recovery"

[SRSvc_service]
DisplayName    = %SR_Service_Name%
Description    = %SR_Service_Desc%
ServiceType    = 0x20  
StartType      = 2    
ErrorControl   = 1    
ServiceBinary  = %11%\svchost.exe -k netsvcs
Dependencies   = "RpcSs"

[SRSvc_event]
AddReg=SRSvc_event_addreg
DelReg=SRSvc_event_delreg

[SRFlt_event]
AddReg=SRFlt_event_addreg
DelReg=SRFlt_event_delreg

[SRFlt_addreg]
HKLM,"system\currentcontrolset\services\SR\Parameters","FirstRun",0x10001,1
HKLM,"system\currentcontrolset\services\SR\Parameters","DontBackup",0x10001,0



HKLM,"SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys","",0x00000000,"FSFilter System Recovery"
HKLM,"SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sr.sys","",0x00000000,"FSFilter System Recovery"

[SRSvc_addreg]
HKLM,"SYSTEM\CurrentControlSet\Services\SRService\Parameters","ServiceDll",0x00020000,"%11%\srsvc.dll"



HKLM,"SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SRService","",0x00000000,"Service"
HKLM,"SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SRService","",0x00000000,"Service"

[SR_addreg]
HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SystemRestore","DisableSR",0x10001,0
HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SystemRestore","CreateFirstRunRp",0x10001,0
HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SystemRestore\Cfg","DiskPercent",0x10001,12
HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SystemRestore\SnapshotCallbacks"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Run","SRFirstRun",,"rundll32 srclient.dll,CreateFirstRunRp"

[SRSvc_event_addreg]
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System\SRService","EventMessageFile",0x00020000,"%11%\srsvc.dll"
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System\SRService","TypesSupported",0x00010001,7

[SRFlt_event_addreg]
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System\SR","EventMessageFile",0x00020000,"%11%\IoLogMsg.dll;%12%\sr.sys"
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System\SR","TypesSupported",0x00010001,7

[SRFlt_delreg]
HKLM,"system\currentcontrolset\services\SR\Parameters","MachineGuid"
HKLM,"system\currentcontrolset\services\SR\Parameters","Disabled"
HKLM,"SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys"
HKLM,"SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sr.sys"

[SRSvc_delreg]
HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SvcHost","SRGroup"




HKLM,"SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SRService"
HKLM,"SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SRService"
HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\FilesToSnapshot"

[SR_delreg]
HKLM,"Software\Microsoft\Windows NT\CurrentVersion\SystemRestore"

[SRSvc_event_delreg]
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\Application\SRService"
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System\SRService","EventMessageFile"
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System\SRService","TypesSupported"

[SRFlt_event_delreg]
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System\SR","EventMessageFile"
HKLM,"SYSTEM\CurrentControlSet\Services\EventLog\System\SR","TypesSupported"

[SR_register]
11,,srclient.dll,1

[Strings]
SR_Filter_Name  = "System Restore Filter Driver"

SR_Service_Name = "System Restore Service"
SR_Service_Desc = "Performs system restore functions. To stop service, turn off System Restore from the System Restore tab in My Computer->Properties"

SR_UI_Link_Name    = "System Restore"
SR_UI_Link_SubDir  = "Accessories\System Tools"