Hey, Billy!
I use ERUNT for registry backups, and I was really glad to have found that tool (I found it here). The program I'm writing makes no attempt to remove malware entries or backup and restore the entire registry, it just backs up certain areas of the registry, modifies/adds some keys and values, and then re-adjusts things back to the way the user had it originally. The backups it makes and restores might include some entries subsequently removed by malware tools, etc. but more authoring could probably be done to ensure that they're removed again.
Why do you want to stop and restart explorer?
Explorer is stopped and restarted because its the easiest way I know to implement changes to the UI without rebooting.
I don't want to break forum rules by posting code here - and I was going to attach the file but I don't see an attach option so I'd imagine it's not allowed in this forum, but I'll PM you the .zip so you can try it out. It must be "run as administrator".
For everyone else who's curious, here's a better description of what the program does and the text of some of the .reg files.
Step 1: Backup
Back up these keys to separate registry files
HKCU_CP_desktop-backup.reg
HKCU_explorer_advanced-backup.reg
HKCU_explorer_cabinetstate-backup.reg
HKLM_policies_system-backup.reg
HKLM_services_themes-backup.reg
Step 2: Adminify
Apply the values in adminify_tweaked_values.reg
Stop the Themes service
Stop and Start Explorer to implement most changes immediately
Warn to reboot to disable UAC
Step 3: De-Adminify (Return things to the way they were before we started)
Import default values using adminify_default_values.reg
Import backed-up user values from these files:
HKCU_CP_desktop-backup.reg
HKCU_explorer_advanced-backup.reg
HKCU_explorer_cabinetstate-backup.reg
HKLM_policies_system-backup.reg
HKLM_services_themes-backup.reg
Start the Themes service
Stop and Start Explorer to implement most changes immediately
Warn to reboot to return UAC to desired level
adminify_tweaked_values.reg contains this:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"AlwaysShowMenus"=dword:00000001 ;Show menu in Windows Explorer (1=Do, 0=Don't)
"Hidden"=dword:00000001 ;Show hidden files and folders (1=Do, 2=Don't)
"HideFileExt"=dword:00000000 ;Hide file extensions (1=Enabled, 0=Disabled)
"DontPrettyPath"=dword:00000001 ;Files/directories in all caps displayed as mixed-case (1=False, 0=True)
"ShowSuperHidden"=dword:00000001 ;I'm not really sure (1=Enabled, 0=Disabled)
"IntelliMenus"=dword:00000000 ;Menus (such as the start menu) are personalized (1=True, 0=False)
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState]
"FullPath"=dword:00000001 ;Display the Full Path in the Title Bar (1=Enabled, 0=Disabled)
"FullPathAddress"=dword:00000001 ;Display the Full Path in the Address Bar (1=Enabled, 0=Disabled)
[HKEY_CURRENT_USER\Control Panel\Desktop]
"MenuShowDelay"="100" ;Shorten menu delay (Default value "400")
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA"=dword:00000000 ;Enable UAC (1=Enabled, 0=Disabled)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes]
"Start"=dword:00000004 ;Themes Service (2=Automatic[Default], 3=Manual, 4=Disabled)
adminify_default_values.reg contains this:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"AlwaysShowMenus"=dword:00000001 ;Show menu in Windows Explorer (1=Do, 0=Don't)
"Hidden"=dword:00000002 ;Show hidden files and folders (1=Do, 2=Don't)
"HideFileExt"=dword:00000001 ;Hide file extensions (1=Enabled, 0=Disabled)
"DontPrettyPath"=dword:00000000 ;Files/directories in all caps displayed as mixed-case (1=False, 0=True)
"ShowSuperHidden"=dword:00000000 ;I'm not really sure (1=Enabled, 0=Disabled)
"IntelliMenus"=dword:00000001 ;Menus (such as the start menu) are personalized (1=True, 0=False)
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CabinetState]
"FullPath"=dword:00000000 ;Display the Full Path in the Title Bar (1=Enabled, 0=Disabled)
"FullPathAddress"=dword:00000000 ;Display the Full Path in the Address Bar (1=Enabled, 0=Disabled)
[HKEY_CURRENT_USER\Control Panel\Desktop]
"MenuShowDelay"="400" ;Shorten menu delay (Default value "400")
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA"=dword:00000001 ;Enable UAC (1=Enabled, 0=Disabled)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes]
"Start"=dword:00000002 ;Themes Service (2=Automatic[Default], 3=Manual, 4=Disabled)