海运的博客

此方法相当于OEM授权，可完美永久激活Windows7/Windows 2008R2，下载90个品牌的slic2.1密钥和证书。
1.使用应工具将BIN文件写入主板BIOS。
2.将XRM-MS导入系统：

slmgr /ilc cert.XRM-MS

3.根据系统版本导入任一品牌相应OEM KEY即可永久激活：

slmgr /ipk 76MTG-QMQJQ-46DQR-CHRBB-7K3HD

4.查询激活状态：

slmgr /xpr

安装准备，下载Windows7原版镜像，Windows PE启动盘。

1.将下载的windows7光盘解压至硬盘非系统盘
1.使用PE启动系统，格式化系统盘
2.复制解压的Windows7镜像内bootmgr文件和boot、efi、sources(只需拷贝boot.wim)文件夹拷到C盘根目录
3.打开CMD窗口执行：c:\boot\bootsect.exe /nt60 c:
如果PE为32位安装64位Windows7，或PE为64位安装32位系统，替换c:\boot\bootsect.exe和c:\boot\zh-cn\bootsect.exe.gui即可。

重新启动以硬盘引导，进入修复命令行，执行安装进程，

D:\windows\sources\setup.exe
#注意为sources目录下setup.exe，执行boot下setup.exe会提示无相关驱动。

WinDbg官方下载：
http://msdl.microsoft.com/download/symbols/debuggers/dbg_x86_6.11.1.404.msi
http://msdl.microsoft.com/download/symbols/debuggers/dbg_amd64_6.11.1.404.msi
打开WinDbg设置Symbol File Path为：

SRV*http://msdl.microsoft.com/download/symbols

然后将dump文件拖入WinDbg窗口等待片刻即有分析结果，dump文件在C:\Windows\Minidump目录。

输入!analyze -v查看详细分析结果：

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff8811f7ffa80, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
    bit 0 : value 0 = read operation, 1 = write operation
    bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800042d2040, address which referenced memory

Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800044ff100
 fffff8811f7ffa80 

CURRENT_IRQL:  2

FAULTING_IP: 
nt!RtlCopyMemoryNonTemporal+40
fffff800`042d2040 4c8b0c11        mov     r9,qword ptr [rcx+rdx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xA

PROCESS_NAME:  ThunderPlatfor

TRAP_FRAME:  fffff88008a5e5c0 -- (.trap 0xfffff88008a5e5c0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.

STACK_COMMAND:  kb

FOLLOWUP_IP: 
L1C62x64+5534
fffff880`05e6f534 ??              ???

SYMBOL_STACK_INDEX:  c

SYMBOL_NAME:  L1C62x64+5534

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: L1C62x64

IMAGE_NAME:  L1C62x64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  49d2f6fd

FAILURE_BUCKET_ID:  X64_0xA_L1C62x64+5534

BUCKET_ID:  X64_0xA_L1C62x64+5534

Followup: MachineOwner
---------

1: kd> lmvm L1C62x64
start             end                 module name
fffff880`05e6a000 fffff880`05e7c000   L1C62x64 T (no symbols)           
    Loaded symbol image file: L1C62x64.sys
    Image path: \SystemRoot\system32\DRIVERS\L1C62x64.sys
    Image name: L1C62x64.sys
    Timestamp:        Wed Apr 01 13:09:17 2009 (49D2F6FD)
    CheckSum:         0001660A
    ImageSize:        00012000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

可见是L1C62x64.sys的问题，查看了下是Atheros千M网卡的驱动文件，是进程ThunderPlatfor引起的系统蓝屏，先升级下网卡驱动试试，再不行就升级迅雷，郁闷ING。。。

Windows 2008R2语言包官方下载：http://www.microsoft.com/zh-cn/download/details.aspx?id=2634

黑客入侵windows服务器经常会用到新建用户、提权，用mcafee限制可严防此类事情的发生。
打开mcafee控制台——访问保护——属性——用户自定义规则——添加：
7.1更新，注册表限制/SAM/SAM/Domains/Account/Groups/**

防止修改或替换SAM文件：

新建用户测试：