biansant的专栏

 作者：曹卫忠禁止学生玩游戏一直是计算机教师头疼的事。禁止游戏的程序有很多，但隐蔽性多不太好，学生只要杀进程或断开网络连接就行了。这里介绍一种利用Winlogon通知包和进程注入的方法来禁止全屏游戏，配合硬盘还原系统，在实践中取得较好的效果。Winlogon事件通知包(Winlogon Notification Package)”就是处理winlogon在切换状态时发出的事件的DLL。

 IntroductionThe Winlogon Notification Package is a DLL which exports functionsthat handle Winlogon.exe events. These event messages includes lock,unlock, logoff, logon, startup, shutdown, sta

 HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Active Setup/Installed ComponentsMonitoring of the Active Setup Registry KeyWhat is the Active Setup?Why monitor this key? Microsoft uses this ke