reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{f874310e-b6b7-47dc-bc84-b9e6b38f5903}" /freg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e88865ea-0e1c-4e20-9aa6-edcd0212c87c}" /f
[color=rgb(34, 101, 169) !important]复制代码
准备用UltraISO打开某个文件，讨厌的“主文件夹”和“图库”又出现了
有时候在某些界面，这兄弟俩跟幽灵一样跳出来，再次打开又消失了……
执行检索：
$guidList = @( "{f874310e-b6b7-47dc-bc84-b9e6b38f5903}", #主文件夹 "{e88865ea-0e1c-4e20-9aa6-edcd0212c87c}" #图库)$outputFile = "$env:USERPROFILE\Desktop\RegSearch.txt""" | Out-File $outputFilefunction Search-RegKey { param($BasePath, $targetGuid) Get-ChildItem -Path $BasePath -Recurse -ErrorAction SilentlyContinue | ForEach-Object { $key = $_ if ($key.PSChildName -match [regex]::Escape($targetGuid)) { "【$targetGuid 键名匹配】$($key.PSPath)" | Out-File $outputFile -Append } foreach($valName in $key.GetValueNames()){ $valData = $key.GetValue($valName) if($valData -is [string] -and $valData -match [regex]::Escape($targetGuid)){ "【$targetGuid 数值匹配】$($key.PSPath) 值:$valName" | Out-File $outputFile -Append } } }}foreach($g in $guidList){ Write-Host "扫描 $g ｜HKCU" Search-RegKey "HKCU:" $g Write-Host "扫描 $g ｜HKLM" Search-RegKey "HKLM:" $g}Write-Host "GUID检索完毕，桌面查看 RegSearch.txt"
[color=rgb(34, 101, 169) !important]复制代码
RegSearch.txt里记录的就是这哥俩残留的项，执行清理：
@echo offchcp 936 >nul 2>&1fltmc filters >nul 2>&1 || (echo 需要管理员权限运行 & pause & exit)setlocal enabledelayedexpansionset "HOME_GUID={f874310e-b6b7-47dc-bc84-b9e6b38f5903}"set "GALLERY_GUID={e88865ea-0e1c-4e20-9aa6-edcd0212c87c}"call :DelRegKey "HKLM\SOFTWARE\Classes\CLSID\%HOME_GUID%"call :DelRegKey "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\%HOME_GUID%"call :DelRegKey "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\%HOME_GUID%"call :DelRegKey "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\%HOME_GUID%"reg add "HKLM\SOFTWARE\Classes\Folder\shell\pintohome" /v AppliesTo /t REG_SZ /d "System.ParsingName:"::{679f85cb-0220-4080-b29b-5540cc05aab6}" AND System.IsFolder:=System.StructuredQueryType.Boolean#True" /f >nulcall :DelRegKey "HKLM\SOFTWARE\Classes\CLSID\%GALLERY_GUID%"call :DelRegKey "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\%GALLERY_GUID%"call :DelRegKey "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\%GALLERY_GUID%"call :DelRegKey "HKLM\SOFTWARE\WOW6432Node\Classes\CLSID\%GALLERY_GUID%"powershell -Command "taskkill /f /im explorer.exe; start explorer.exe"pausegoto :EOF:DelRegKeyset "RegPath=%~1"echo 处理: %RegPath%takeown /f "%RegPath%" >nul 2>&1icacls "%RegPath%" /grant administrators:F >nul 2>&1reg delete "%RegPath%" /f >nul 2>&1goto :eof
[color=rgb(34, 101, 169) !important]复制代码
再次执行检索，还有几项残留，但是项减少就是成功，到此也算完成了。
[color=]强迫症可以继续看下去：
1. 在PE里打开注册表编辑器→HKLM→文件 →加载配置单元C:\Windows\System32\config\SOFTWARE，命名为OFF（随便起名）
2.手动删除第二次检索的内容（批处理容易出问题，有需要的我单独再发）
[color=]切记！切记！
退出前一定要
[color=]选中HKLM\OFF →文件 →卸载配置单元
特别提醒！！！
[color=]不能删除 pintohome 整个项，会导致
[color=]固定到快速访问
[color=]功能损坏。
修改
[color=]pintohome
[color=]数值即可：
HKLM\WIN_SOFT\Classes\Folder\shell\pintohome
AppliesTo 的字符串值{f874310e-b6b7-47dc-bc84-b9e6b38f5903}
修改内容为：System.ParsingName:"::{679f85cb-0220-4080-b29b-5540cc05aab6}" AND System.IsFolder:=System.StructuredQueryType.Boolean#True
