WINDOWs XP
GO TO in Windows Regedit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents
Edit OOBETimer
This is what you're supposed to go to. FF D5 71 D6 8B 6A 8D 6F D5 33 93 FD
After editing, Deny permision on Folder to System account.