netsvcs
drivers32
/md5start
winlogon.exe
explorer.exe
svchost.exe
csrss.exe
wininit.exe
msgina.dll
/md5stop 
msconfig
safebootminimal
safebootnetwork
activex
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav 
c:\system volume information|_REGISTRY_MACHINE_SYSTEM;true;true;true /FP
c:\system volume information|_REGISTRY_MACHINE_SOFTWARE;true;true;true /FP