Home » Spyware & Browser Hijacker Support Forum » von google auf falsche seiten umgeleitet+ultralangsames spybot » Themenansicht

von google auf falsche seiten umgeleitet+ultralangsames spybot
#0
14.05.2006, 14:26
kaihawai
Member

Themenstarter

Beiträge: 16
#16 hallo sabina, ich bin untröstlich, aber ich glaube, ich habe wieder was gefangen. habe mit spybot; adaware und ewido schon einiges entfernt. zuletzt fand spybot im abgesicherten modus wieder PipasA..
der silent runner hat die datei "dmsso.exe" gefunden, die ich schließlich gelöscht habe.
jetzt habe ich folgendes ergebnis:

"Silent Runners.vbs", revision 45, http://www.silentrunners.org/
Operating System: Windows 2000
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"internat.exe" = "internat.exe" [MS]
"SpybotSD TeaTimer" = "C:\Programme\Spybot - Search & Destroy\TeaTimer.exe" ["Safer Networking Limited"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Synchronization Manager" = "mobsync.exe /logon" [MS]
"NeroFilterCheck" = "C:\WINNT\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"Omnipage" = "C:\Programme\ScanSoft\OmniPageSE\opware32.exe" ["ScanSoft, Inc"]
"RemoteControl" = "C:\Programme\PowerDVD\PDVDServ.exe" ["Cyberlink Corp."]
"Tweak UI" = "RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp" [MS]
"eBayToolbar" = "C:\Programme\eBay\eBay Toolbar2\eBayTBDaemon.exe" ["eBay"]
"Easy-PrintToolBox" = "C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon" ["CANON INC."]
"QuickTime Task" = ""C:\Programme\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"AVGCtrl" = ""C:\Programme\AVPersonal\AVGNT.EXE" /min" ["H+BEDV Datentechnik GmbH"]
"avgnt" = ""C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min" ["Avira GmbH"]
"Zone Labs Client" = "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" ["Zone Labs, LLC"]
"SpySweeper" = ""C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe" /startintray" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "C:\Programme\Acrobat Writer\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{22D8E815-4A5E-4DFB-845E-AAB64207F5BD}\(Default) = (no title provided)
-> {HKLM...CLSID} = "eBay Toolbar Helper"
\InProcServer32\(Default) = "C:\Programme\eBay\eBay Toolbar2\eBayTB.dll" [null data]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\Spybot - Search & Destroy\SDHelper.dll" ["Safer Networking Limited"]
{AE7CD045-E861-484f-8273-0445EE161910}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEToolbarHelper Class"
\InProcServer32\(Default) = "C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung"
-> {HKLM...CLSID} = "Systemsteuerungserweiterung für die Anzeigeverschiebung"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINNT\system32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRar\rarext.dll" [null data]
"{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}" = "Adobe.Acrobat.ContextMenu"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Programme\Acrobat Writer\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
"{92085AD4-F48A-450D-BD93-B28CC7DF67CE}" = "eBay Toolbar"
-> {HKLM...CLSID} = "eBay Toolbar"
\InProcServer32\(Default) = "C:\Programme\eBay\eBay Toolbar2\eBayTB.dll" [null data]
"{45AC2688-0253-4ED8-97DE-B5370FA7D48A}" = "Shell Extension for Malware scanning"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{54D9498B-CF93-414F-8984-8CE7FDE0D391}" = "ewido shell guard"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "C:\Programme\ewido anti-malware\shellhook.dll" ["TODO: <Firmenname>"]

HKLM\System\CurrentControlSet\Control\Session Manager\
INFECTION WARNING! "BootExecute" = "autocheck autochk * SsiEfr.e" [file not found], [MS], [file not found], [file not found]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
INFECTION WARNING! WRNotifier\DLLName = "WRLogonNTF.dll" [file not found]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Adobe.Acrobat.ContextMenu\(Default) = "{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802}"
-> {HKLM...CLSID} = "Acrobat Elements Context Menu"
\InProcServer32\(Default) = "C:\Programme\Acrobat Writer\Acrobat Elements\ContextMenu.dll" ["Adobe Systems Inc."]
AntiVir/Win\(Default) = "{a7cda720-84ee-11d0-b5c0-00001b3ca278}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\AVPersonal\AVShlExt.DLL" ["H+BEDV Datentechnik GmbH"]
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {HKLM...CLSID} = "Ctest Object"
\InProcServer32\(Default) = "C:\Programme\ewido anti-malware\context.dll" ["ewido networks"]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRar\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
ewido\(Default) = "{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}"
-> {HKLM...CLSID} = "Ctest Object"
\InProcServer32\(Default) = "C:\Programme\ewido anti-malware\context.dll" ["ewido networks"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRar\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
AntiVir/Win\(Default) = "{a7cda720-84ee-11d0-b5c0-00001b3ca278}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Programme\AVPersonal\AVShlExt.DLL" ["H+BEDV Datentechnik GmbH"]
Shell Extension for Malware scanning\(Default) = "{45AC2688-0253-4ED8-97DE-B5370FA7D48A}"
-> {HKLM...CLSID} = "Shell Extension for Malware scanning"
\InProcServer32\(Default) = "C:\Programme\AntiVir PersonalEdition Classic\shlext.dll" ["H+BEDV Datentechnik GmbH"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Programme\WinRar\rarext.dll" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is enabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINNT\ABomb.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\

HKCU\Software\Microsoft\Internet Explorer\Desktop\Components\0\
"SCRNSAVE.EXE" = "C:\WINNT\system32\ACDSee.scr" ["ACD Systems"]


Startup items in "C. Hampl" & "All Users" startup folders:
----------------------------------------------------------

C:\Dokumente und Einstellungen\C. Hampl\Startmenü\Programme\Autostart
"Acrobat Assistant" -> shortcut to: "C:\Programme\Acrobat Writer\Distillr\acrotray.exe" ["Adobe Systems Inc."]
"Microsoft Office" -> shortcut to: "C:\Programme\Microsoft Office\Office\OSA9.EXE -b -l" [MS]

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
"Acrobat Assistant" -> shortcut to: "C:\Programme\Acrobat Writer\Distillr\acrotray.exe" ["Adobe Systems Inc."]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\rnr20.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\nwprovau.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\msafd.dll [MS], 01 - 03, 06 - 36
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll" [null data]

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll" [null data]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}" = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll" [null data]
"{92085AD4-F48A-450D-BD93-B28CC7DF67CE}" = (no title provided)
-> {HKLM...CLSID} = "eBay Toolbar"
\InProcServer32\(Default) = "C:\Programme\eBay\eBay Toolbar2\eBayTB.dll" [null data]
"{327C2873-E90D-4C37-AA9D-10AC9BABA46C}" = "Easy-WebPrint"
-> {HKLM...CLSID} = "Easy-WebPrint"
\InProcServer32\(Default) = "C:\Programme\Canon\Easy-WebPrint\Toolband.dll" [null data]

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{182EC0BE-5110-49C8-A062-BEB1D02A220B}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Adobe PDF"
\InProcServer32\(Default) = "C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll" [null data]
{9455301C-CF6B-11D3-A266-00C04F689C50}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Encarta &Recherche-Assistent"
\InProcServer32\(Default) = "C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Researcher\EROPROJ.DLL" [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{9455301C-CF6B-11D3-A266-00C04F689C50}\
"ButtonText" = "Recherche-Assistent"

{B205A35E-1FC4-4CE3-818B-899DBBB3388C}\


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

AntiVir Scheduler, AntiVirScheduler, "C:\Programme\AntiVir PersonalEdition Classic\sched.exe" ["Avira GmbH"]
AntiVir Update, AVWUpSrv, ""C:\Programme\AVPersonal\AVWUPSRV.EXE"" ["H+BEDV Datentechnik GmbH, Germany"]
Ati HotKey Poller, Ati HotKey Poller, "C:\WINNT\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
COM+-Ereignissystem, EventSystem, "C:\WINNT\system32\svchost.exe -k netsvcs" {"C:\WINNT\system32\es.dll" [null data]}
ewido security suite control, ewido security suite control, "C:\Programme\ewido anti-malware\ewidoctrl.exe" ["ewido networks"]
ewido security suite guard, ewido security suite guard, "C:\Programme\ewido anti-malware\ewidoguard.exe" ["ewido networks"]
TrueVector Internet Monitor, vsmon, "C:\WINNT\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Canon BJ Language Monitor PIXMA iP4000\Driver = "CNMLM64.DLL" ["CANON INC."]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 56 seconds, including 17 seconds for message boxes)


f-secure meldet keine hidden items;
ergebnisse von ewido:

---------------------------------------------------------
ewido anti-malware - Scan Report
---------------------------------------------------------

+ Erstellt am: 14:38:01, 14.05.2006
+ Report-Checksumme: C7D56D63

+ Scanergebnis:

:mozilla.7:C:\Dokumente und Einstellungen\C. Hampl\Anwendungsdaten\Mozilla\Firefox\Profiles\5mupkpqo.default\cookies.txt -> TrackingCookie.Ivwbox : Gesäubert mit Backup
:mozilla.21:C:\Dokumente und Einstellungen\C. Hampl\Anwendungsdaten\Mozilla\Firefox\Profiles\5mupkpqo.default\cookies.txt -> TrackingCookie.Falkag : Gesäubert mit Backup
:mozilla.22:C:\Dokumente und Einstellungen\C. Hampl\Anwendungsdaten\Mozilla\Firefox\Profiles\5mupkpqo.default\cookies.txt -> TrackingCookie.Falkag : Gesäubert mit Backup
:mozilla.23:C:\Dokumente und Einstellungen\C. Hampl\Anwendungsdaten\Mozilla\Firefox\Profiles\5mupkpqo.default\cookies.txt -> TrackingCookie.Falkag : Gesäubert mit Backup
:mozilla.24:C:\Dokumente und Einstellungen\C. Hampl\Anwendungsdaten\Mozilla\Firefox\Profiles\5mupkpqo.default\cookies.txt -> TrackingCookie.Falkag : Gesäubert mit Backup
:mozilla.25:C:\Dokumente und Einstellungen\C. Hampl\Anwendungsdaten\Mozilla\Firefox\Profiles\5mupkpqo.default\cookies.txt -> TrackingCookie.Falkag : Gesäubert mit Backup
:mozilla.26:C:\Dokumente und Einstellungen\C. Hampl\Anwendungsdaten\Mozilla\Firefox\Profiles\5mupkpqo.default\cookies.txt -> TrackingCookie.Falkag : Gesäubert mit Backup


::Report Ende

ergebnisse von hijackthis:
Logfile of HijackThis v1.99.0
Scan saved at 14:38:42, on 14.05.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINNT\system32\svchost.exe
C:\Programme\ewido anti-malware\ewidoctrl.exe
C:\Programme\ewido anti-malware\ewidoguard.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Programme\ScanSoft\OmniPageSE\opware32.exe
C:\Programme\PowerDVD\PDVDServ.exe
C:\Programme\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\internat.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Acrobat Writer\Distillr\acrotray.exe
C:\Programme\Acrobat Writer\Distillr\acrotray.exe
C:\Programme\Microsoft Encarta\Encarta Enzyklopädie Professional 2005\EDICT.EXE
C:\Programme\HijackThis.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\ewido anti-malware\securitysuite.exe
C:\Programme\Microsoft Office\Office\WINWORD.EXE
C:\WINNT\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Acrobat Writer\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [eBayToolbar] C:\Programme\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Acrobat Assistant.lnk = C:\Programme\Acrobat Writer\Distillr\acrotray.exe
O4 - Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Acrobat Writer\Distillr\acrotray.exe
O8 - Extra context menu item: &eBay Search - res://C:\Programme\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Download with GetRight - C:\Programme\GetRight\GRdownload.htm
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Open with GetRight Browser - C:\Programme\GetRight\GRbrowse.htm
O9 - Extra button: Recherche-Assistent - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}: NameServer = 85.255.116.158 85.255.112.181
O23 - Service: AntiVir Scheduler - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programme\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programme\ewido anti-malware\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

ist mein rechner noch infiziert? was ist mit dem immer wiederkehrenden 017 eintrag? wenn mein rechner sauber ist, wie mach ich ihn sicherer (habe mir firefox runtergeladen und werde künftig nur noch damit surfen)?

entschuldige für die erneute mühen! und schon vielen dank im voraus!!!
grüße kai
Seitenanfang Seitenende
14.05.2006, 16:42
Sabina
Ehrenmitglied
Avatar Sabina

Beiträge: 29434
#17 kaihawai

017 - die Internetverbindung geht in die Ukraine..................

1.
Download f-secure-Beta Trial
http://www.f-secure.com/blacklight/
doppelklick: blbeta.exe
nach dem Check klicke -- next -> poste das Log

2.
stelle den CleanUp genauso ein, wie hier angegeben:
http://virus-protect.org/cleanup.html

3.
Kopiere diese 4 Textdateien ab . (rechtsklick mit der Maus -> den Text markieren -> kopieren -> einfügen) Sie sind nach Datum geordnet. (kopiere nur die letzten 3 Monate ab)
http://virus-protect.org/datfindbat.html
__________
MfG Sabina

rund um die PC-Sicherheit
Seitenanfang Seitenende
14.05.2006, 17:14
kaihawai
Member

Themenstarter

Beiträge: 16
#18 hallo sabina, danke für die hilfe!!!
log von f-secure:
05/14/06 17:21:04 [Info]: BlackLight Engine 1.0.36 initialized
05/14/06 17:21:04 [Info]: OS: 5.0 build 2195 (Service Pack 4)
05/14/06 17:21:04 [Note]: 7019 4
05/14/06 17:21:04 [Note]: 7005 0
05/14/06 17:21:07 [Note]: 7006 0
05/14/06 17:21:07 [Note]: 7011 528
05/14/06 17:21:07 [Note]: 7026 0
05/14/06 17:21:07 [Note]: 7026 0
05/14/06 17:21:12 [Note]: FSRAW library version 1.7.1015
05/14/06 17:23:45 [Note]: 2000 1006
05/14/06 17:24:02 [Note]: 7007 0

bei datfindbat:

Datentr„ger in Laufwerk C: ist WINDOWS 2000
Datentr„gernummer: 60EC-2B1F

Verzeichnis von C:\WINNT\system32

14.05.2006 16:25 41.118 vsconfig.xml
13.05.2006 14:20 602.632 filesafer23.exe
13.05.2006 14:14 3.107 howiper.exe
22.04.2006 01:16 2.335 qtplugin.log
02.04.2006 14:12 4.212 zllictbl.dat
16.03.2006 11:34 71.448 zlcommdb.dll
16.03.2006 11:34 79.640 zlcomm.dll
16.03.2006 11:33 100.120 vsxml.dll
16.03.2006 11:33 382.744 vsutil.dll
16.03.2006 11:33 71.448 vsregexp.dll
16.03.2006 11:33 227.096 vspubapi.dll
16.03.2006 11:33 104.216 vsmonapi.dll
16.03.2006 11:33 141.080 vsinit.dll
16.03.2006 11:33 372.824 vsdatant.sys
16.03.2006 11:32 83.736 vsdata.dll
16.03.2006 11:16 54.960 vsutil_loc0407.dll
07.03.2006 21:50 369.124 perfh009.dat
07.03.2006 21:50 50.808 perfc009.dat
07.03.2006 21:50 363.562 perfh007.dat
07.03.2006 21:50 61.656 perfc007.dat
07.03.2006 21:50 828.948 PerfStringBackup.INI
26.01.2006 21:20 135.664 FNTCACHE.DAT
18.01.2006 13:05 57.344 avsda.dll
10.12.2005 08:15 3.350 KGyGaAvL.sys
10.12.2005 03:00 8.464 sporder.dll
13.10.2005 15:28 16.384 Perflib_Perfdata_2d0.dat
29.09.2005 20:15 16.384 Perflib_Perfdata_280.dat
24.09.2005 22:51 16.384 Perflib_Perfdata_320.dat
04.05.2005 14:45 884.736 msimsg.dll
04.05.2005 14:45 78.848 msiexec.exe
04.05.2005 14:45 271.360 msihnd.dll
04.05.2005 14:45 15.360 msisip.dll
04.05.2005 14:45 2.890.240 msi.dll
29.04.2005 09:16 1.122.576 webvw.dll
04.04.2005 11:52 589.824 CDDBControl.dll
04.04.2005 11:52 765.952 CDDBUI.dll
12.03.2005 09:54 245.008 WINSRV.DLL
12.03.2005 09:54 381.200 USER32.DLL
12.03.2005 09:44 1.634.288 WIN32K.SYS
12.03.2005 02:46 15.072 spmsg.dll
10.03.2005 14:06 102.400 CddbLangTH.dll
10.03.2005 14:06 110.592 CddbLangNL.dll
10.03.2005 14:06 86.016 CddbLangJA.dll
10.03.2005 14:06 81.920 CddbLangKO.dll
10.03.2005 14:06 110.592 CddbLangFR.dll
10.03.2005 14:06 110.592 CddbLangES.dll
10.03.2005 14:06 110.592 CddbLangDE.dll
10.03.2005 14:06 106.496 CddbLangSV.dll
10.03.2005 14:06 110.592 CddbLangIT.dll
10.03.2005 14:06 110.592 CddbLangPT_BR.dll
10.03.2005 14:06 77.824 CddbLangZT.dll
10.03.2005 14:06 77.824 CddbLangZH.dll
04.03.2005 08:56 2.383.632 SHELL32.DLL
02.03.2005 15:00 1.692.736 NTOSKRNL.EXE
02.03.2005 15:00 1.715.520 NTKRNLPA.EXE
24.02.2005 14:02 132.096 MSRATING.DLL
24.02.2005 14:02 2.811.904 MSHTML.DLL
18.02.2005 17:35 597.504 WININET.DLL
18.02.2005 17:35 1.337.344 SHDOCVW.DLL
18.02.2005 17:35 1.017.856 BROWSEUI.DLL
18.02.2005 17:35 236.032 IEPEERS.DLL
07.02.2005 07:32 287.232 sp3res.dll
04.02.2005 07:34 55.568 authz.dll

Datentr„ger in Laufwerk C: ist WINDOWS 2000
Datentr„gernummer: 60EC-2B1F

Verzeichnis von C:\DOKUME~1\CA917~1.HAM\LOKALE~1\Temp

13.05.2006 14:50 16.384 ~DFBCAE.tmp
12.05.2006 20:01 2.048.000 Acr34.tmp
12.05.2006 19:48 3.363 Acr1C.tmp
12.05.2006 19:48 3.631 Acr1D.tmp
09.05.2006 07:06 163.648 N670UA.shd
09.05.2006 07:06 300 TWAIN.LOG
09.05.2006 07:06 4 Twain001.Mtx
09.05.2006 07:06 156 Twunk001.MTX
06.05.2006 19:28 147.456 ~WRF3115.tmp
06.05.2006 19:28 512 ~DF682B.tmp
06.05.2006 19:28 512 ~DF5F7A.tmp
06.05.2006 13:02 16.384 ~DFFEDE.tmp
05.05.2006 17:42 16.384 ~DF3B87.tmp
04.05.2006 23:37 4.014.409 pf2447047485.tmp
04.05.2006 23:10 4.986.121 pf940909004.tmp
04.05.2006 22:36 32 pf4916984.tmp
04.05.2006 22:36 0 audio4916968.tmp
04.05.2006 21:42 5.829 pf604811975.tmp
04.05.2006 21:42 5.829 pf604811974.tmp
04.05.2006 21:41 53 pf3393640789.tmp
04.05.2006 18:15 16.384 ~DFC785.tmp
04.05.2006 17:54 16.384 ~DF94C.tmp
04.05.2006 17:50 16.384 ~DFB821.tmp
03.05.2006 16:15 37.376 ~WRS1532.tmp
03.05.2006 16:11 147.456 ~WRF3165.tmp
03.05.2006 14:49 165.376 GLC39.tmp
03.05.2006 14:13 16.384 ~DFDE2.tmp
02.05.2006 13:14 16.384 ~DF3D0E.tmp
02.05.2006 12:15 16.384 ~DF7564.tmp
02.05.2006 12:06 125.850 netfxupdate.log
02.05.2006 09:18 16.384 ~DF7C7.tmp
02.05.2006 09:12 16.384 ~DFD842.tmp
28.04.2006 13:53 14.091 avp.klb
22.04.2006 02:13 16.384 ~DF4FD2.tmp
20.04.2006 19:59 1.929 avp.set
19.04.2006 13:55 0 ~DF2E.tmp
15.04.2006 16:57 49.993 base001.avc
10.04.2006 19:54 58.534 about.bmp
10.04.2006 18:09 49.438 base004.avc
10.04.2006 18:09 49.974 base005.avc
10.04.2006 18:09 49.532 base002.avc
10.04.2006 18:09 49.286 base003.avc
10.04.2006 13:00 65.536 ~DF6626.tmp
02.04.2006 12:47 16.384 ~DF5EF9.tmp
20.03.2006 12:57 10.134 dat10.tmp
17.03.2006 14:21 16.384 ~DFDDC8.tmp
17.03.2006 14:19 16.384 ~DF9E98.tmp
09.03.2006 23:25 42.929 h2r2E.tmp
07.03.2006 21:53 71.168 220ae.mst
07.03.2006 21:51 32.238 netfxsl.log
07.03.2006 21:50 6.590 ASPNETSetup.log
07.03.2006 00:03 0 mso105.tmp
24.02.2006 05:57 65.536 ~DF2A33.tmp
21.02.2006 08:30 0 mso4.tmp
09.02.2006 15:20 245.760 ~WRF3482.tmp
01.02.2006 06:43 10.272 ~WRS0005.tmp
01.02.2006 06:32 78.336 ~WRC3149.tmp
01.02.2006 06:29 147.456 ~WRF0004.tmp

Datentr„ger in Laufwerk C: ist WINDOWS 2000
Datentr„gernummer: 60EC-2B1F

Verzeichnis von C:\WINNT

14.05.2006 17:28 5.402 ModemLog_MicroLink 56k Fun USB EU.txt
14.05.2006 16:53 54.156 QTFont.qfn
14.05.2006 16:22 32.628 SchedLgU.Txt
14.05.2006 16:21 1.286.138 ShellIconCache
14.05.2006 13:38 0 nsreg.dat
14.05.2006 13:37 2.266 mozver.dat
13.05.2006 23:20 131.572 ntbtlog.txt
13.05.2006 16:15 1.409 QTFont.for
10.05.2006 17:12 116 NeroDigital.ini
04.05.2006 23:48 155 winamp.ini
04.05.2006 21:38 288 cdplayer.ini
04.05.2006 18:28 423.068 setupapi.log
20.04.2006 18:26 25.601 CSTBox.INI
20.03.2006 12:54 255 oleco.ini
07.03.2006 21:51 1.562 COM+.log
07.03.2006 21:47 133.516 Windows Update.log
18.02.2006 19:08 1.442.106 ACD Wallpaper.bmp
15.12.2005 19:12 0 PROTOCOL.INI
11.12.2005 21:55 581 win.ini
10.12.2005 03:05 98 acc1.txt
16.11.2005 15:48 478.720 WRUninstall.dll
13.06.2005 20:41 157.283 comsetup.log
13.06.2005 20:41 341.285 iis5.log
13.06.2005 20:41 1.429 imsins.log
13.06.2005 20:41 20.079 KB890859.log
13.06.2005 20:41 131.364 ocgen.log
13.06.2005 20:41 9.959 ockodak.log
13.06.2005 20:41 8.041 updspapi.log
13.06.2005 20:30 1.429 imsins.BAK
13.06.2005 20:30 18.882 KB894320.log
19.05.2005 12:26 14.655 KB893086.log
19.05.2005 12:23 12.849 KB893066.log
19.05.2005 12:15 7.829 KB842773.log
19.05.2005 12:15 105.876 setupact.log
19.05.2005 12:15 7.618 KB893803v2.log
19.05.2005 12:13 6.539 KB890923-IE6SP1-20050225.103456.log
18.05.2005 17:29 0 OpPrintServer.INI
27.04.2005 14:00 83 mspsp.ini
02.03.2005 12:35 0 iPlayer.INI
20.02.2005 16:55 20.010 Q828026.log
20.02.2005 16:55 14.975 KB885835.log
20.02.2005 16:53 12.025 KB885836.log
20.02.2005 16:52 11.835 KB871250.log
20.02.2005 16:52 13.026 KB873339.log
20.02.2005 16:52 13.817 KB891711.log
20.02.2005 16:51 10.046 KB890175.log
20.02.2005 16:51 10.398 KB873333.log
20.02.2005 16:51 8.358 KB890047.log
20.02.2005 16:50 6.453 KB888113.log
20.02.2005 16:50 8.293 KB885250.log
20.02.2005 16:50 6.517 KB891781.log
20.02.2005 16:50 7.028 KB867282-IE6SP1-20050127.163319.log
11.02.2005 20:41 208 asym.ini

Datentr„ger in Laufwerk C: ist WINDOWS 2000
Datentr„gernummer: 60EC-2B1F

Verzeichnis von C:\

14.05.2006 17:28 0 sys.txt
14.05.2006 17:28 8.743 system.txt
14.05.2006 17:28 10.465 systemtemp.txt
14.05.2006 17:27 90.130 system32.txt
14.05.2006 16:22 402.653.184 pagefile.sys
10.12.2005 18:05 21.566 ResponseXML.log
10.12.2005 18:05 21.575 ResponseText.log
10.12.2005 18:05 14.827 Request.log
10.12.2005 08:09 0 BHO.log
10.12.2005 08:09 48 Errors.log
29.10.2004 11:51 828.340 dvdshrink317setup.zip
24.10.2004 17:23 0 AUTOEXEC.BAT
24.10.2004 17:23 0 IO.SYS
24.10.2004 17:23 0 MSDOS.SYS
24.10.2004 17:23 0 CONFIG.SYS
24.10.2004 17:20 192 boot.ini
19.06.2003 12:05 150.528 arcldr.exe
19.06.2003 12:05 163.840 arcsetup.exe
19.06.2003 12:05 216.096 ntldr
19.06.2003 12:05 34.724 NTDETECT.COM
20 Datei(en) 404.214.258 Bytes
0 Verzeichnis(se), 317.440.000 Bytes frei


bei cleanup habe ich das problem, dass ich ein häkchen nicht machen kann
"delete prefetch files"
was kann ich tun?? liebe grüße kaihawai
Seitenanfang Seitenende
14.05.2006, 19:20
Sabina
Ehrenmitglied
Avatar Sabina

Beiträge: 29434
#19 kaihawai

1.
KILLBOX - Pocket KillBox
http://virus-protect.org/killbox.html

Options: Delete on Reboot --> anhaken
und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "---- klicke auf "no",und kopiere das nächste rein, erst beim letzten auf "yes"
reinkopieren: .....

C:\WINNT\system32\filesafer23.exe
C:\WINNT\system32\howiper.exe

PC neustarten

2.
Killbox:
(Tools -- Delete Temp Files)



3.
Fixe mit dem HijacktHis:

Zitat

O17 - HKLM\System\CCS\Services\Tcpip\..\{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}: NameServer = 85.255.116.158 85.255.112.181
PC neustarten, neue Internetverbindung erstellen.

4.
Download FixWareout
http://downloads.subratam.org/Fixwareout.exe
Fixwareout.exe --> next --> Install --> Run fixit --> Finish / der PC wird neustarten --> C:\fixwareout\report.txt

da auch die Cookies geloescht werden, musst du dich hier im Forum wieder neu anmelden..mit deinem Passwort
__________
MfG Sabina

rund um die PC-Sicherheit
Seitenanfang Seitenende
14.05.2006, 22:24
kaihawai
Member

Themenstarter

Beiträge: 16
#20 hi sabina, konnte
Killbox:
Tools -- Delete Temp Files nicht starten. Fehlermeldung: Run-time error `9`subscript out of range
hier der fixwareout report:

Fixwareout ver 1.003
Last edited 04/26/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocne
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\mgcppp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\tesvaf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\32refaselif
...

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is lagitamate

»»»»» Search by size and names...

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal

hijackthis
Logfile of HijackThis v1.99.0
Scan saved at 22:39:59, on 14.05.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINNT\system32\svchost.exe
C:\Programme\ewido anti-malware\ewidoctrl.exe
C:\Programme\ewido anti-malware\ewidoguard.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\NOTEPAD.EXE
C:\Programme\ScanSoft\OmniPageSE\opware32.exe
C:\Programme\PowerDVD\PDVDServ.exe
C:\Programme\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\internat.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Acrobat Writer\Distillr\acrotray.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Acrobat Writer\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [eBayToolbar] C:\Programme\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Acrobat Assistant.lnk = C:\Programme\Acrobat Writer\Distillr\acrotray.exe
O4 - Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Acrobat Writer\Distillr\acrotray.exe
O8 - Extra context menu item: &eBay Search - res://C:\Programme\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Download with GetRight - C:\Programme\GetRight\GRdownload.htm
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Open with GetRight Browser - C:\Programme\GetRight\GRbrowse.htm
O9 - Extra button: Recherche-Assistent - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}: NameServer = 85.255.116.158 85.255.112.181
O23 - Service: AntiVir Scheduler - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programme\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programme\ewido anti-malware\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

was kann ich tun? auf jeden fall einen schönen abend und eine erholsame nach
wünscht kaihawai
Seitenanfang Seitenende
14.05.2006, 23:11
Sabina
Ehrenmitglied
Avatar Sabina

Beiträge: 29434
#21 1.
wende Cleanup an + starte den PC neu
http://virus-protect.org/cleanup.html

2.
öffne das HijackThis -- Button "scan" -- vor Malware-Eintrage Häkchen setzen -- Button "Fix checked" -- PC neustarten

O17 - HKLM\System\CCS\Services\Tcpip\..\{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}: NameServer = 85.255.116.158 85.255.112.181

PC neustarten

3.
poste das Log vom Winpfind
http://virus-protect.org/winpfind.html
__________
MfG Sabina

rund um die PC-Sicherheit
Seitenanfang Seitenende
15.05.2006, 00:19
kaihawai
Member

Themenstarter

Beiträge: 16
#22 hallo sabina, wie gesagt ist es mir leider nicht möglich, das häkchen vor delete prefetch files zu machen. habe den vorgang trotzdem gestartet. bei hijackthis war dann kein 017 eintrag mehr.

winpfind log:
WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows 2000 Current Build: Service Pack 4 Current Build Number: 2195
Internet Explorer Version: 6.0.2800.1106

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...

Checking %ProgramFilesDir% folder...
qoologic 02.05.2006 18:40:26 532480 C:\Programme\cwshredder.exe
urllogic 02.05.2006 18:40:26 532480 C:\Programme\cwshredder.exe
UPX! 03.05.2006 15:20:20 177476 C:\Programme\escancheck110.sfx.exe
UPX! 14.05.2006 13:17:14 5125248 C:\Programme\Firefox_Setup_1.5.0.3dt.exe
UPX! 15.12.2004 11:40:42 203264 C:\Programme\HijackThis.exe
UPX! 29.10.2004 15:16:26 7092297 C:\Programme\mwn-vpnclient-win-4[1].0.5C.exe

Checking %WinDir% folder...
UPX! 22.08.2004 17:04:56 69120 C:\WINNT\daemon.dll

Checking %System% folder...
PEC2 03.09.2004 20:03:48 716800 C:\WINNT\SYSTEM32\DivX.dll
PECompact2 03.09.2004 20:03:48 716800 C:\WINNT\SYSTEM32\DivX.dll
Umonitor 19.06.2003 12:05:04 549648 C:\WINNT\SYSTEM32\rasdlg.dll
winsync 10.12.1999 14:00:00 1309184 C:\WINNT\SYSTEM32\wbdbase.deu

Checking %System%\Drivers folder and sub-folders...

Items found in C:\WINNT\SYSTEM32\drivers\etc\hosts


Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
15.05.2006 00:04:06 H 54156 C:\WINNT\QTFont.qfn
15.05.2006 00:00:30 H 1198572 C:\WINNT\ShellIconCache
15.05.2006 00:02:02 S 64 C:\WINNT\CSC\00000001
07.05.2006 10:43:02 S 64 C:\WINNT\CSC\00000002
02.05.2006 09:20:50 S 64 C:\WINNT\CSC\csc1.tmp
02.04.2006 14:12:46 H 4212 C:\WINNT\system32\zllictbl.dat
15.05.2006 00:06:54 H 1024 C:\WINNT\system32\config\default.LOG
15.05.2006 00:03:44 H 1024 C:\WINNT\system32\config\SAM.LOG
15.05.2006 00:12:08 H 1024 C:\WINNT\system32\config\SECURITY.LOG
15.05.2006 00:19:24 H 12288 C:\WINNT\system32\config\software.LOG
20.03.2006 12:46:14 HS 336 C:\WINNT\system32\Microsoft\Protect\S-1-5-18\908cf4e6-1ea4-49d7-8cae-099deb202f5c
20.03.2006 12:46:14 HS 24 C:\WINNT\system32\Microsoft\Protect\S-1-5-18\Preferred
15.05.2006 00:01:58 H 6 C:\WINNT\Tasks\SA.DAT

Checking for CPL files...
Microsoft Corporation 10.12.1999 14:00:00 68880 C:\WINNT\SYSTEM32\access.cpl
Microsoft Corporation 19.06.2003 12:05:04 304912 C:\WINNT\SYSTEM32\appwiz.cpl
Microsoft Corporation 19.06.2003 12:05:04 242448 C:\WINNT\SYSTEM32\desk.cpl
Microsoft Corporation 13.11.2000 01:50:00 90112 C:\WINNT\SYSTEM32\directx.cpl
Microsoft Corporation 10.12.1999 14:00:00 32016 C:\WINNT\SYSTEM32\fax.cpl
Microsoft Corporation 10.12.1999 14:00:00 130832 C:\WINNT\SYSTEM32\hdwwiz.cpl
Microsoft Corporation 29.08.2002 09:32:28 293376 C:\WINNT\SYSTEM32\inetcpl.cpl
Microsoft Corporation 10.12.1999 14:00:00 121616 C:\WINNT\SYSTEM32\intl.cpl
Microsoft Corporation 10.12.1999 14:00:00 36624 C:\WINNT\SYSTEM32\irprops.cpl
Microsoft Corporation 30.10.2001 09:10:00 326144 C:\WINNT\SYSTEM32\joy.cpl
Microsoft Corporation 10.12.1999 14:00:00 122640 C:\WINNT\SYSTEM32\main.cpl
Microsoft Corporation 10.12.1999 14:00:00 307472 C:\WINNT\SYSTEM32\mmsys.cpl
Microsoft Corporation 10.12.1999 14:00:00 17168 C:\WINNT\SYSTEM32\ncpa.cpl
Microsoft Corporation 10.12.1999 14:00:00 42256 C:\WINNT\SYSTEM32\nwc.cpl
Microsoft Corporation 19.06.2003 12:05:04 41232 C:\WINNT\SYSTEM32\odbccp32.cpl
Microsoft Corporation 19.06.2003 12:05:04 92432 C:\WINNT\SYSTEM32\powercfg.cpl
Apple Computer, Inc. 03.08.2002 01:31:00 297984 C:\WINNT\SYSTEM32\QuickTime.cpl
SiSoftware 29.09.2003 18:42:58 53248 C:\WINNT\SYSTEM32\SanCpl.cpl
Microsoft Corporation 19.06.2003 12:05:04 83728 C:\WINNT\SYSTEM32\sticpl.cpl
Microsoft Corporation 19.06.2003 12:05:04 129296 C:\WINNT\SYSTEM32\sysdm.cpl
Microsoft Corporation 10.12.1999 14:00:00 5904 C:\WINNT\SYSTEM32\telephon.cpl
Microsoft Corporation 10.12.1999 14:00:00 61200 C:\WINNT\SYSTEM32\timedate.cpl
Microsoft Corporation 18.06.2000 15:03:10 106544 C:\WINNT\SYSTEM32\TWEAKUI.CPL
Microsoft Corporation 19.06.2003 12:05:04 54784 C:\WINNT\SYSTEM32\wuaucpl.cpl
Microsoft Corporation 29.08.2002 09:32:28 293376 C:\WINNT\SYSTEM32\dllcache\inetcpl.cpl
IBM Corporation 07.10.1999 01:12:54 94720 C:\WINNT\SYSTEM32\dllcache\mwcpa32.cpl
Microsoft Corporation 10.12.1999 14:00:00 42256 C:\WINNT\SYSTEM32\dllcache\nwc.cpl
Microsoft Corporation 19.06.2003 12:05:04 41232 C:\WINNT\SYSTEM32\dllcache\odbccp32.cpl
Microsoft Corporation 19.06.2003 12:05:04 54784 C:\WINNT\SYSTEM32\dllcache\wuaucpl.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
10.12.2005 17:37:16 1594 C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Acrobat Assistant.lnk

Checking files in %ALLUSERSPROFILE%\Application Data folder...
17.02.2006 20:54:42 305 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html

Checking files in %USERPROFILE%\Startup folder...
27.10.2004 20:48:40 1594 C:\Dokumente und Einstellungen\C. Hampl\Startmenü\Programme\Autostart\Acrobat Assistant.lnk
27.03.2003 00:57:36 1568 C:\Dokumente und Einstellungen\C. Hampl\Startmenü\Programme\Autostart\Microsoft Office.lnk

Checking files in %USERPROFILE%\Application Data folder...

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Adobe.Acrobat.ContextMenu
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} = C:\Programme\Acrobat Writer\Acrobat Elements\ContextMenu.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\AntiVir/Win
{a7cda720-84ee-11d0-b5c0-00001b3ca278} = C:\Programme\AVPersonal\AVShlExt.DLL
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Programme\ewido anti-malware\context.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\shell32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\shell32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Shell Extension for Malware scanning
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} = C:\Programme\AntiVir PersonalEdition Classic\shlext.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR
{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programme\WinRar\rarext.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\AntiVir/Win
{a7cda720-84ee-11d0-b5c0-00001b3ca278} = C:\Programme\AVPersonal\AVShlExt.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Shell Extension for Malware scanning
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} = C:\Programme\AntiVir PersonalEdition Classic\shlext.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR
{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programme\WinRar\rarext.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ewido
{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E} = C:\Programme\ewido anti-malware\context.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\shell32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR
{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Programme\WinRar\rarext.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\shell32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\shell32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\shell32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= C:\WINNT\system32\docprop2.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{7f9609be-af9a-11d1-83e0-00c04fb6e984}
= %SystemRoot%\system32\faxshell.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{884EA37B-37C0-11d2-BE3F-00A0C9A83DA1}
= C:\WINNT\system32\docprop2.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
AcroIEHlprObj Class = C:\Programme\Acrobat Writer\Acrobat\ActiveX\AcroIEHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22D8E815-4A5E-4DFB-845E-AAB64207F5BD}
eBay Toolbar Helper = C:\Programme\eBay\eBay Toolbar2\eBayTB.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}
= C:\Programme\Spybot - Search & Destroy\SDHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}
AcroIEToolbarHelper Class = C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{182EC0BE-5110-49C8-A062-BEB1D02A220B}
Adobe PDF = C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Tipps und Tricks = %SystemRoot%\system32\shdocvw.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{9455301C-CF6B-11D3-A266-00C04F689C50}
Encarta &Recherche-Assistent = C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Researcher\EROPROJ.DLL

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{8E718888-423F-11D2-876E-00A0C9082467} = @msdxmLC.dll,-1@1031,&Radio : C:\WINNT\system32\msdxm.ocx
{47833539-D0C5-4125-9FA8-0819E2EAAC93} = Adobe PDF : C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll
{92085AD4-F48A-450D-BD93-B28CC7DF67CE} = eBay Toolbar : C:\Programme\eBay\eBay Toolbar2\eBayTB.dll
{327C2873-E90D-4c37-AA9D-10AC9BABA46C} = Easy-WebPrint : C:\Programme\Canon\Easy-WebPrint\Toolband.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9455301C-CF6B-11D3-A266-00C04F689C50}
ButtonText = Recherche-Assistent :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{B205A35E-1FC4-4CE3-818B-899DBBB3388C}
MenuText = :

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{30D02401-6A81-11D0-8274-00C04FD5AE38}
Search Band = %SystemRoot%\system32\browseui.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
Media Band = %SystemRoot%\system32\browseui.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}
File and Folders Search ActiveX Control = C:\WINNT\system32\shell32.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}
Favorites Band = %SystemRoot%\system32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}
History Band = %SystemRoot%\system32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E64-B078-11D0-89E4-00C04FC9E26E}
Explorer-Band = %SystemRoot%\system32\shdocvw.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Adresse : %SystemRoot%\system32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\browseui.dll
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} = :
{47833539-D0C5-4125-9FA8-0819E2EAAC93} = Adobe PDF : C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Adresse : %SystemRoot%\system32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\browseui.dll
{47833539-D0C5-4125-9FA8-0819E2EAAC93} = Adobe PDF : C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Synchronization Manager mobsync.exe /logon
NeroFilterCheck C:\WINNT\system32\NeroCheck.exe
Omnipage C:\Programme\ScanSoft\OmniPageSE\opware32.exe
RemoteControl C:\Programme\PowerDVD\PDVDServ.exe
Tweak UI RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
eBayToolbar C:\Programme\eBay\eBay Toolbar2\eBayTBDaemon.exe
Easy-PrintToolBox C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
QuickTime Task "C:\Programme\QuickTime\qttask.exe" -atboottime
AVGCtrl "C:\Programme\AVPersonal\AVGNT.EXE" /min
avgnt "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
Zone Labs Client C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
SpySweeper "C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe" /startintray

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
internat.exe internat.exe
SpybotSD TeaTimer C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\AdminComponent

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
dontdisplaylastusername 0
legalnoticecaption
legalnoticetext
shutdownwithoutlogon 1


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\comdlg32
NoBackButton 0
NoFileMru 0

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
NoDriveTypeAutoRun 149
NoRecentDocsHistory 
ClearRecentDocsOnExit 
NoRecentDocsMenu 
NoSMMyDocs 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
Network.ConnectionTray {7007ACCF-3202-11D1-AAD2-00805FC1270E} = C:\WINNT\system32\NETSHELL.dll
WebCheck {E6FB5E20-DE35-11CF-9C87-00AA005127ED} = %SystemRoot%\system32\webcheck.dll
SysTray {35CEC8A3-2BE6-11D2-8773-92E220524153} = stobject.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,
Shell = Explorer.exe
System =

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent
= Ati2evxx.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain
= crypt32.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet
= cryptnet.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll
= cscdll.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy
= sclgntfy.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn
= WlNotify.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier
= WRLogonNTF.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wzcnotif
= wzcdlg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path
Debugger = ntsd -d

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
AppInit_DLLs


»»»»»»»»»»»»»»»»»»»»»»»» Scan Complete »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
WinPFind v1.4.1 - Log file written to "WinPFind.Txt" in the WinPFind folder.
Scan completed on 15.05.2006 00:19:30

liebe grüße kaihawai
Seitenanfang Seitenende
15.05.2006, 11:29
Sabina
Ehrenmitglied
Avatar Sabina

Beiträge: 29434
#23 kaihawai

Zitat

bei hijackthis war dann kein 017 eintrag mehr.
wenn du im HijackThis den Eintrag
O17 - HKLM\System\CCS\Services\Tcpip\..\{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}: NameServer = 85.255.116.158 85.255.112.181

nicht mehr siehst, ist alles wieder in Ordnung.

dennoch mache einen Onlinescan mit kaspersky und berichte
http://virus-protect.org/onlinescan.html
__________
MfG Sabina

rund um die PC-Sicherheit
Seitenanfang Seitenende
15.05.2006, 12:57
kaihawai
Member

Themenstarter

Beiträge: 16
#24 hi sabina, es ist zum aus der haut fahren
Onlinescan mit kaspersky: Report is empty - no malware has been detected

Aber: 017 bei hijackthisscan
Logfile of HijackThis v1.99.0
Scan saved at 13:11:38, on 15.05.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINNT\system32\svchost.exe
C:\Programme\ewido anti-malware\ewidoctrl.exe
C:\Programme\ewido anti-malware\ewidoguard.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Programme\ScanSoft\OmniPageSE\opware32.exe
C:\Programme\PowerDVD\PDVDServ.exe
C:\Programme\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\internat.exe
C:\Programme\Acrobat Writer\Distillr\acrotray.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Acrobat Writer\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [eBayToolbar] C:\Programme\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Acrobat Assistant.lnk = C:\Programme\Acrobat Writer\Distillr\acrotray.exe
O4 - Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Acrobat Writer\Distillr\acrotray.exe
O8 - Extra context menu item: &eBay Search - res://C:\Programme\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Download with GetRight - C:\Programme\GetRight\GRdownload.htm
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Open with GetRight Browser - C:\Programme\GetRight\GRbrowse.htm
O9 - Extra button: Recherche-Assistent - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}: NameServer = 85.255.116.158 85.255.112.181
O23 - Service: AntiVir Scheduler - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programme\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programme\ewido anti-malware\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

was macht diese nummer in die ukraine eigentlich? für deine hilfe sehr dankbar!!!!
kaihawai
Seitenanfang Seitenende
15.05.2006, 13:23
Sabina
Ehrenmitglied
Avatar Sabina

Beiträge: 29434
#25 Download Registry Search by Bobbi Flekman
http://virus-protect.org/artikel/tools/regsearch.html
und doppelklicken, um zu starten. in: "Enter search strings" (reinschreiben oder reinkopieren)

{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}

in edit und klicke "Ok".
Notepad wird sich oeffnen -- kopiere den Text ab und poste ihn.
__________
MfG Sabina

rund um die PC-Sicherheit
Seitenanfang Seitenende
15.05.2006, 13:57
kaihawai
Member

Themenstarter

Beiträge: 16
#26 Hallo sabina, hier der Text
REGEDIT4

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0

; Results at 15.05.2006 14:08:09 for strings:
; '{2446f51c-e63b-4059-aaab-cec3f56c1b96}'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dhcp\Parameters]
; Contents of value:
;  +nhd+ +nhd, +nhd +nhd
"{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}"=hex:0f,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,2b,6e,68,44,2b,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
2b,6e,68,44,2c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2b,6e,68,44,06,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,2b,6e,68,44

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\Linkage]
; Contents of value:
; \Device\NwlnkNb
; \Device\NwlnkIpx \Device\Nbf_{751
; \Device\Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\Nbf_NdisWanNbfOut{F0C3022
; \Device\Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNb
; \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbf
; \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \
; \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\N
; \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpi
; \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,\
63,65,5c,4e,77,6c,6e,6b,49,70,78,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,7b,\
37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,\
32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,33,30,32,32,35,2d,33,35,\
30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,31,34,30,45,37,31,45,41,\
7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,\
6e,7b,38,36,46,45,38,42,43,32,2d,39,33,43,32,2d,34,44,42,31,2d,41,33,32,43,\
2d,34,39,35,30,30,33,45,36,44,39,36,38,7d,00,5c,44,65,76,69,63,65,5c,4e,62,\
66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,42,38,38,33,45,30,2d,31,\
39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,32,31,41,42,34,42,41,31,\
45,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,\
49,6e,7b,46,35,46,36,43,34,32,42,2d,44,46,43,45,2d,34,37,35,33,2d,41,36,36,\
32,2d,42,37,39,36,36,30,30,41,31,31,37,32,7d,00,5c,44,65,76,69,63,65,5c,4e,\
62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,45,46,46,35,42,34,38,38,\
2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,37,36,33,44,35,38,41,38,\
34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,\
62,66,4f,75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,33,33,2d,34,46,36,33,2d,\
38,33,31,31,2d,37,44,41,36,38,41,34,46,33,39,46,43,7d,00,5c,44,65,76,69,63,\
65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,\
41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,32,30,34,45,37,41,\
31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,39,32,41,41,37,42,\
44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,\
2d,33,35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,\
34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,\
44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,\
35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,\
36,43,31,42,39,36,7d,00,00
; Contents of value:
; \Device\LanmanServer_NwlnkNb
; \Device\LanmanServer_NwlnkIpx \Device\LanmanServer_Nbf_{751
; \Device\LanmanServer_Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-9
; \Device\LanmanServer_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\LanmanServer_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanServer_Nbf_NdisWanNbfIn{1EB883E0-
; \Device\LanmanServer_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanServer_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanServer_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-
; \Device\LanmanServer_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanServer_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\Lanman
; \Device\LanmanServer_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_N
; \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpi
; \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\
4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,\
76,65,72,5f,4e,77,6c,6e,6b,49,70,78,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,\
61,6e,53,65,72,76,65,72,5f,4e,62,66,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,\
34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,\
7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,62,\
66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,33,30,32,32,35,2d,\
33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,31,34,30,45,37,31,\
45,41,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\
4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,\
2d,39,33,43,32,2d,34,44,42,31,2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,\
39,36,38,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,\
5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,42,38,38,33,45,\
30,2d,31,39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,32,31,41,42,34,\
42,41,31,45,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,\
72,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,\
32,42,2d,44,46,43,45,2d,34,37,35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,\
41,31,31,37,32,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,\
65,72,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,45,46,46,35,\
42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,37,36,33,44,\
35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,\
72,76,65,72,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,44,37,\
35,39,45,35,36,39,2d,37,46,33,33,2d,34,46,36,33,2d,38,33,31,31,2d,37,44,41,\
36,38,41,34,46,33,39,46,43,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,\
53,65,72,76,65,72,5f,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,\
5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,\
2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4c,61,\
6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,\
32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,\
39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,\
6e,53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,31,36,39,\
45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,33,35,39,35,36,\
36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,\
72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,33,39,35,\
37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,42,\
35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,\
72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,\
36,33,42,2d,34,30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,\
36,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation\Linkage]
; Contents of value:
; \Device\NwlnkNb
; \Device\Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\Nbf_Ndis
; \Device\Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Dev
; \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Devi
; \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \De
; \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA
; \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \
; \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,\
63,65,5c,4e,62,66,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,\
39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,\
69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,\
33,30,32,32,35,2d,33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,\
31,34,30,45,37,31,45,41,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,\
73,57,61,6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,2d,39,33,43,32,2d,34,\
44,42,31,2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,39,36,38,7d,00,5c,44,\
65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,\
42,38,38,33,45,30,2d,31,39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,\
32,31,41,42,34,42,41,31,45,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,\
69,73,57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,32,42,2d,44,46,43,45,2d,\
34,37,35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,41,31,31,37,32,7d,00,5c,\
44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,\
45,46,46,35,42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,\
37,36,33,44,35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,\
33,33,2d,34,46,36,33,2d,38,33,31,31,2d,37,44,41,36,38,41,34,46,33,39,46,43,\
7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,\
69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,37,35,31,46,36,46,45,36,\
2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,\
45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,\
7b,32,32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,\
32,38,39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,\
42,54,5f,54,63,70,69,70,5f,7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,\
36,38,41,2d,38,37,39,37,2d,33,35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,\
65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,33,39,\
35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,\
42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\
70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,41,41,41,\
42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00
; Contents of value:
; \Device\LanmanWorkstation_NwlnkNb
; \Device\LanmanWorkstation_Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_Nbf_Ndis
; \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanWorkstat
; \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanWorkstati
; \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorksta
; \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA
; \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \
; \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,\
74,69,6f,6e,5f,4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,\
61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,62,66,5f,7b,37,35,31,46,36,46,\
45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,\
41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,\
73,74,61,74,69,6f,6e,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,\
7b,46,30,43,33,30,32,32,35,2d,33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,\
30,31,46,44,31,34,30,45,37,31,45,41,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,\
6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,62,66,5f,4e,64,69,73,57,61,\
6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,2d,39,33,43,32,2d,34,44,42,31,\
2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,39,36,38,7d,00,5c,44,65,76,69,\
63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,42,38,38,33,45,30,2d,31,39,45,\
45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,32,31,41,42,34,42,41,31,45,7d,\
00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,\
6e,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,\
32,42,2d,44,46,43,45,2d,34,37,35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,\
41,31,31,37,32,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,\
73,74,61,74,69,6f,6e,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,\
7b,45,46,46,35,42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,\
35,37,36,33,44,35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,\
6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,62,66,5f,4e,64,69,73,57,61,\
6e,4e,62,66,4f,75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,33,33,2d,34,46,36,\
33,2d,38,33,31,31,2d,37,44,41,36,38,41,34,46,33,39,46,43,7d,00,5c,44,65,76,\
69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,\
62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,\
6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,37,35,31,\
46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,\
41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,\
6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,\
32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,\
39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,\
6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,\
7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,\
33,35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,\
6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,70,69,\
70,5f,7b,45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,\
44,2d,42,34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4c,\
61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,\
70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,41,\
41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBIOS\Linkage]
; Contents of value:
; \Device\NwlnkNb
; \Device\Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\Nbf_Ndis
; \Device\Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Dev
; \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Devi
; \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \De
; \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\Net
; \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_
; \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,\
63,65,5c,4e,62,66,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,\
39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,\
69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,\
33,30,32,32,35,2d,33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,\
31,34,30,45,37,31,45,41,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,\
73,57,61,6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,2d,39,33,43,32,2d,34,\
44,42,31,2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,39,36,38,7d,00,5c,44,\
65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,\
42,38,38,33,45,30,2d,31,39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,\
32,31,41,42,34,42,41,31,45,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,\
69,73,57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,32,42,2d,44,46,43,45,2d,\
34,37,35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,41,31,31,37,32,7d,00,5c,\
44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,\
45,46,46,35,42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,\
37,36,33,44,35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,\
33,33,2d,34,46,36,33,2d,38,33,31,31,2d,37,44,41,36,38,41,34,46,33,39,46,43,\
7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,37,35,\
31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,\
32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,\
54,63,70,69,70,5f,7b,32,32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,\
2d,41,33,33,46,2d,32,38,39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,\
63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,31,36,39,45,30,46,44,2d,\
38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,33,35,39,35,36,36,37,33,30,45,\
38,35,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,\
34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,30,\
35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00
; Contents of value:
; \Device\NetBIOS_NwlnkNb
; \Device\NetBIOS_Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBIOS_Nbf_Ndis
; \Device\NetBIOS_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\NetBIOS_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\NetB
; \Device\NetBIOS_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\NetBIOS_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\NetBIOS_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\NetBI
; \Device\NetBIOS_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\NetBIOS_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\NetBIOS_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\NetBIOS_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\Net
; \Device\NetBIOS_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\NetBIOS_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\NetBIOS_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetBIOS_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBIOS_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBIOS_Net
; \Device\NetBIOS_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\NetBIOS_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetBIOS_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBIOS_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBIOS_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBIOS_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBIOS_NetBT_Tcpip_
; \Device\NetBIOS_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetBIOS_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBIOS_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBIOS_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBIOS_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBIOS_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBIOS_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBIOS_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBIOS_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBIOS_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBIOS_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBIOS_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBIOS_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBIOS_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBIOS_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBIOS_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBIOS_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBIOS_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBIOS_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBIOS_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBIOS_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,77,6c,6e,6b,\
4e,62,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,62,66,5f,7b,37,\
35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,\
41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,\
4f,53,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,33,\
30,32,32,35,2d,33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,31,\
34,30,45,37,31,45,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,\
4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,\
2d,39,33,43,32,2d,34,44,42,31,2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,\
39,36,38,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,42,38,38,33,45,30,2d,31,39,45,\
45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,32,31,41,42,34,42,41,31,45,7d,\
00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,62,66,5f,4e,64,69,73,\
57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,32,42,2d,44,46,43,45,2d,34,37,\
35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,41,31,31,37,32,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,\
62,66,4f,75,74,7b,45,46,46,35,42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,\
38,34,38,39,2d,35,37,36,33,44,35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,\
65,5c,4e,65,74,42,49,4f,53,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,\
75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,33,33,2d,34,46,36,33,2d,38,33,31,\
31,2d,37,44,41,36,38,41,34,46,33,39,46,43,7d,00,5c,44,65,76,69,63,65,5c,4e,\
65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,37,35,31,46,36,\
46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,\
30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,\
65,74,42,54,5f,54,63,70,69,70,5f,7b,32,32,30,34,45,37,41,31,2d,36,37,31,38,\
2d,34,41,41,45,2d,41,33,33,46,2d,32,38,39,32,41,41,37,42,44,35,46,31,7d,00,\
5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,\
69,70,5f,7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,\
39,37,2d,33,35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,\
4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,\
33,39,35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,\
44,36,42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,\
4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,\
42,2d,34,30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,\
00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Linkage]
; Contents of value:
; \Device\Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C}
; \Device\Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\Tcpip_{E169E0FD-8B49-468A-8797-359566730E85}
; \Device\Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,37,35,31,46,36,46,\
45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,\
41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,32,32,30,\
34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,39,32,\
41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\
45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,33,\
35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\
70,5f,7b,45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,\
44,2d,42,34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,54,\
63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,\
41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00
; Contents of value:
; \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C}
; \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85}
; \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,\
32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,32,32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,\
41,45,2d,41,33,33,46,2d,32,38,39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,31,36,39,45,30,46,\
44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,33,35,39,35,36,36,37,33,\
30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,\
2d,42,34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,\
34,30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage]
; Contents of value:
; \Device\Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C}
; \Device\Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\Tcpip_{E169E0FD-8B49-468A-8797-359566730E85}
; \Device\Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,37,35,31,46,36,46,\
45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,\
41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,32,32,30,\
34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,39,32,\
41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\
45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,33,\
35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\
70,5f,7b,45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,\
44,2d,42,34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,54,\
63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,\
41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Adapters\NdisWanIp]
; Contents of value:
; Tcpip\Parameters\Interfaces\{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1}
; Tcpip\Parameters\Interfaces\{E169E0FD-8B49-468A-8797-359566730E85} Tcpip\Parameters\Interfaces\{EB673957-1B1E-4411-B19D-B45BAD6B528B}
; Tcpip\Parameters\Interfaces\{EB673957-1B1E-4411-B19D-B45BAD6B528B} Tcpip\Parameters\Interfaces\{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; Tcpip\Parameters\Interfaces\{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"IpConfig"=hex(7):54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,\
65,72,66,61,63,65,73,5c,7b,32,32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,\
41,45,2d,41,33,33,46,2d,32,38,39,32,41,41,37,42,44,35,46,31,7d,00,54,63,70,\
69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,\
7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,\
33,35,39,35,36,36,37,33,30,45,38,35,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,\
65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,7b,45,42,36,37,33,39,35,\
37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,42,\
35,32,38,42,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,\
74,65,72,66,61,63,65,73,5c,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,\
30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Dhcp\Parameters]
; Contents of value:
;  Ýjhd+ Ýjhd, Ýjhd Ýjhd
"{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}"=hex:0f,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,dd,4a,68,44,2b,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
dd,4a,68,44,2c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,dd,4a,68,44,06,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,dd,4a,68,44

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\lanmanserver\Linkage]
; Contents of value:
; \Device\NwlnkNb
; \Device\NwlnkIpx \Device\Nbf_{751
; \Device\Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\Nbf_NdisWanNbfOut{F0C3022
; \Device\Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNb
; \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbf
; \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \
; \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\N
; \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpi
; \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,\
63,65,5c,4e,77,6c,6e,6b,49,70,78,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,7b,\
37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,\
32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,33,30,32,32,35,2d,33,35,\
30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,31,34,30,45,37,31,45,41,\
7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,\
6e,7b,38,36,46,45,38,42,43,32,2d,39,33,43,32,2d,34,44,42,31,2d,41,33,32,43,\
2d,34,39,35,30,30,33,45,36,44,39,36,38,7d,00,5c,44,65,76,69,63,65,5c,4e,62,\
66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,42,38,38,33,45,30,2d,31,\
39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,32,31,41,42,34,42,41,31,\
45,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,\
49,6e,7b,46,35,46,36,43,34,32,42,2d,44,46,43,45,2d,34,37,35,33,2d,41,36,36,\
32,2d,42,37,39,36,36,30,30,41,31,31,37,32,7d,00,5c,44,65,76,69,63,65,5c,4e,\
62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,45,46,46,35,42,34,38,38,\
2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,37,36,33,44,35,38,41,38,\
34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,\
62,66,4f,75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,33,33,2d,34,46,36,33,2d,\
38,33,31,31,2d,37,44,41,36,38,41,34,46,33,39,46,43,7d,00,5c,44,65,76,69,63,\
65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,\
41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,32,30,34,45,37,41,\
31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,39,32,41,41,37,42,\
44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,\
2d,33,35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,\
34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,\
44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,\
35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,\
36,43,31,42,39,36,7d,00,00
; Contents of value:
; \Device\LanmanServer_NwlnkNb
; \Device\LanmanServer_NwlnkIpx \Device\LanmanServer_Nbf_{751
; \Device\LanmanServer_Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-9
; \Device\LanmanServer_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\LanmanServer_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanServer_Nbf_NdisWanNbfIn{1EB883E0-
; \Device\LanmanServer_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanServer_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanServer_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-
; \Device\LanmanServer_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanServer_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\Lanman
; \Device\LanmanServer_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_N
; \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpi
; \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\
4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,\
76,65,72,5f,4e,77,6c,6e,6b,49,70,78,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,\
61,6e,53,65,72,76,65,72,5f,4e,62,66,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,\
34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,\
7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,62,\
66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,33,30,32,32,35,2d,\
33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,31,34,30,45,37,31,\
45,41,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\
4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,\
2d,39,33,43,32,2d,34,44,42,31,2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,\
39,36,38,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,\
5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,42,38,38,33,45,\
30,2d,31,39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,32,31,41,42,34,\
42,41,31,45,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,\
72,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,\
32,42,2d,44,46,43,45,2d,34,37,35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,\
41,31,31,37,32,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,\
65,72,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,45,46,46,35,\
42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,37,36,33,44,\
35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,\
72,76,65,72,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,44,37,\
35,39,45,35,36,39,2d,37,46,33,33,2d,34,46,36,33,2d,38,33,31,31,2d,37,44,41,\
36,38,41,34,46,33,39,46,43,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,\
53,65,72,76,65,72,5f,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,\
5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,\
2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4c,61,\
6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,\
32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,\
39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,\
6e,53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,31,36,39,\
45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,33,35,39,35,36,\
36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,\
72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,33,39,35,\
37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,42,\
35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,\
72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,\
36,33,42,2d,34,30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,\
36,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\lanmanworkstation\Linkage]
; Contents of value:
; \Device\NwlnkNb
; \Device\Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\Nbf_Ndis
; \Device\Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Dev
; \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Devi
; \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \De
; \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA
; \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \
; \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,\
63,65,5c,4e,62,66,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,\
39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,\
69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,\
33,30,32,32,35,2d,33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,\
31,34,30,45,37,31,45,41,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,\
73,57,61,6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,2d,39,33,43,32,2d,34,\
44,42,31,2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,39,36,38,7d,00,5c,44,\
65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,\
42,38,38,33,45,30,2d,31,39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,\
32,31,41,42,34,42,41,31,45,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,\
69,73,57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,32,42,2d,44,46,43,45,2d,\
34,37,35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,41,31,31,37,32,7d,00,5c,\
44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,\
45,46,46,35,42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,\
37,36,33,44,35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,\
33,33,2d,34,46,36,33,2d,38,33,31,31,2d,37,44,41,36,38,41,34,46,33,39,46,43,\
7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,\
69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,37,35,31,46,36,46,45,36,\
2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,\
45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,\
7b,32,32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,\
32,38,39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,\
42,54,5f,54,63,70,69,70,5f,7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,\
36,38,41,2d,38,37,39,37,2d,33,35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,\
65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,33,39,\
35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,\
42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\
70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,41,41,41,\
42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00
; Contents of value:
; \Device\LanmanWorkstation_NwlnkNb
; \Device\LanmanWorkstation_Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_Nbf_Ndis
; \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanWorkstat
; \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanWorkstati
; \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorksta
; \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA
; \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \
; \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_T
Seitenanfang Seitenende
15.05.2006, 14:08
Sabina
Ehrenmitglied
Avatar Sabina

Beiträge: 29434
#27 1.
Um die Diensteverwaltung explizit aufzurufen, geben Sie ein unter
Start - Ausführen: services.msc
Nun werden alle laufenden Dienste angezeigt.

TCP/IP-NetBIOS-Hilfsprogramm-> deaktiviert
Ermöglicht die Unterstützung vom NetBIOS-über-TCP/IP-Dienst (NetBT) und die NetBIOS-Namensauflösung.

---------------------------------------------------------------------------
2.
Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als fixme.reg mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden.

Zitat

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Dhcp\Parameters]
"{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}"=-
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dhcp\Parameters]
"{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}=-
Computer in den abgesicherten Modus neustarten (F8 beim Starten drücken). Die Datei "fixme.reg" auf dem Desktop doppelklicken und der Registry mit "ja" oder "yes" beifügen

boote wieder in den normalmodus, erstelle eine neue Internetverbindung und berichte
__________
MfG Sabina

rund um die PC-Sicherheit
Seitenanfang Seitenende
15.05.2006, 14:44
kaihawai
Member

Themenstarter

Beiträge: 16
#28 ich hirsch hab tcp/ip zunächst nur beendet und nicht deakt6iviert, so dass ich das ganze 2x machen musste. bei der einwahl ins netz kam dann zuerst fehlermeldung: netzwerkprotokollverbindung werden überprüft TCP/IP CP gemeldeter Fehler... hat sich dann automatisch wiedereingewählt. habe hijackthis laufen lassen und der 017 ist immer noch da:
Logfile of HijackThis v1.99.0
Scan saved at 14:56:40, on 15.05.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AVPersonal\AVWUPSRV.EXE
C:\WINNT\system32\svchost.exe
C:\Programme\ewido anti-malware\ewidoctrl.exe
C:\Programme\ewido anti-malware\ewidoguard.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Programme\ScanSoft\OmniPageSE\opware32.exe
C:\Programme\PowerDVD\PDVDServ.exe
C:\Programme\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\AVPersonal\AVGNT.EXE
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\internat.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Acrobat Writer\Distillr\acrotray.exe
C:\Programme\Acrobat Writer\Distillr\acrotray.exe
C:\Programme\Microsoft Encarta\Encarta Enzyklopädie Professional 2005\EDICT.EXE
C:\Programme\AntiVir PersonalEdition Classic\update.exe
C:\Programme\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Acrobat Writer\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Acrobat Writer\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Programme\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Omnipage] C:\Programme\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [eBayToolbar] C:\Programme\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVGCtrl] "C:\Programme\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Acrobat Assistant.lnk = C:\Programme\Acrobat Writer\Distillr\acrotray.exe
O4 - Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programme\Acrobat Writer\Distillr\acrotray.exe
O8 - Extra context menu item: &eBay Search - res://C:\Programme\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: Download with GetRight - C:\Programme\GetRight\GRdownload.htm
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Open with GetRight Browser - C:\Programme\GetRight\GRbrowse.htm
O9 - Extra button: Recherche-Assistent - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{EB673957-1B1E-4411-B19D-B45BAD6B528B}: NameServer = 85.255.116.158 85.255.112.181
O23 - Service: AntiVir Scheduler - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programme\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programme\ewido anti-malware\ewidoguard.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

hab ich hirsch jetzt alles kaputt gemacht?
grüße Kaihawai
Seitenanfang Seitenende
15.05.2006, 14:58
Sabina
Ehrenmitglied
Avatar Sabina

Beiträge: 29434
#29 {EB673957-1B1E-4411-B19D-B45BAD6B528B}
muesste alles aus der Registry geloescht werden, aber vielleicht gibt es noch eine Datei, welche die korrumpierte Verbindung immer wieder neu erstellt.

das beste wird doch formatieren sein... wenn du es nicht gebacken bekommt, deine korrekten Providerdaten beim neuerstellen einer Internetverbindung einzugeben...
was ist denn dein Provider?

Download Registry Search by Bobbi Flekman
http://virus-protect.org/artikel/tools/regsearch.html
und doppelklicken, um zu starten. in: "Enter search strings" (reinschreiben oder reinkopieren)

{EB673957-1B1E-4411-B19D-B45BAD6B528B}

in edit und klicke "Ok".
Notepad wird sich oeffnen -- kopiere den Text ab und poste ihn.
__________
MfG Sabina

rund um die PC-Sicherheit
Seitenanfang Seitenende
15.05.2006, 15:20
kaihawai
Member

Themenstarter

Beiträge: 16
#30 hallo sabina, ich geh über freenet ins netz; was verbricht den die nummer in die ukraine?
REGEDIT4

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0

; Results at 15.05.2006 15:32:08 for strings:
; '{eb673957-1b1e-4411-b19d-b45bad6b528b}'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dhcp\Parameters]
; Contents of value:
;  jzhd+ jzhd, jzhd jzhd
"{EB673957-1B1E-4411-B19D-B45BAD6B528B}"=hex:0f,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,6a,7a,68,44,2b,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
6a,7a,68,44,2c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,6a,7a,68,44,06,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,6a,7a,68,44

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\Linkage]
; Contents of value:
; \Device\NwlnkNb
; \Device\NwlnkIpx \Device\Nbf_{751
; \Device\Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\Nbf_NdisWanNbfOut{F0C3022
; \Device\Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNb
; \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbf
; \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \
; \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\N
; \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpi
; \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,\
63,65,5c,4e,77,6c,6e,6b,49,70,78,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,7b,\
37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,\
32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,33,30,32,32,35,2d,33,35,\
30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,31,34,30,45,37,31,45,41,\
7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,\
6e,7b,38,36,46,45,38,42,43,32,2d,39,33,43,32,2d,34,44,42,31,2d,41,33,32,43,\
2d,34,39,35,30,30,33,45,36,44,39,36,38,7d,00,5c,44,65,76,69,63,65,5c,4e,62,\
66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,42,38,38,33,45,30,2d,31,\
39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,32,31,41,42,34,42,41,31,\
45,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,\
49,6e,7b,46,35,46,36,43,34,32,42,2d,44,46,43,45,2d,34,37,35,33,2d,41,36,36,\
32,2d,42,37,39,36,36,30,30,41,31,31,37,32,7d,00,5c,44,65,76,69,63,65,5c,4e,\
62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,45,46,46,35,42,34,38,38,\
2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,37,36,33,44,35,38,41,38,\
34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,\
62,66,4f,75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,33,33,2d,34,46,36,33,2d,\
38,33,31,31,2d,37,44,41,36,38,41,34,46,33,39,46,43,7d,00,5c,44,65,76,69,63,\
65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,\
41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,32,30,34,45,37,41,\
31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,39,32,41,41,37,42,\
44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,\
2d,33,35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,\
34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,\
44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,\
35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,\
36,43,31,42,39,36,7d,00,00
; Contents of value:
; \Device\LanmanServer_NwlnkNb
; \Device\LanmanServer_NwlnkIpx \Device\LanmanServer_Nbf_{751
; \Device\LanmanServer_Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-9
; \Device\LanmanServer_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\LanmanServer_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanServer_Nbf_NdisWanNbfIn{1EB883E0-
; \Device\LanmanServer_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanServer_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanServer_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-
; \Device\LanmanServer_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanServer_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\Lanman
; \Device\LanmanServer_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_N
; \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpi
; \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\
4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,\
76,65,72,5f,4e,77,6c,6e,6b,49,70,78,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,\
61,6e,53,65,72,76,65,72,5f,4e,62,66,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,\
34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,\
7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,62,\
66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,33,30,32,32,35,2d,\
33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,31,34,30,45,37,31,\
45,41,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\
4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,\
2d,39,33,43,32,2d,34,44,42,31,2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,\
39,36,38,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,\
5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,42,38,38,33,45,\
30,2d,31,39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,32,31,41,42,34,\
42,41,31,45,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,\
72,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,\
32,42,2d,44,46,43,45,2d,34,37,35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,\
41,31,31,37,32,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,\
65,72,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,45,46,46,35,\
42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,37,36,33,44,\
35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,\
72,76,65,72,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,44,37,\
35,39,45,35,36,39,2d,37,46,33,33,2d,34,46,36,33,2d,38,33,31,31,2d,37,44,41,\
36,38,41,34,46,33,39,46,43,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,\
53,65,72,76,65,72,5f,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,\
5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,\
2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4c,61,\
6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,\
32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,\
39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,\
6e,53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,31,36,39,\
45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,33,35,39,35,36,\
36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,\
72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,33,39,35,\
37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,42,\
35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,\
72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,\
36,33,42,2d,34,30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,\
36,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation\Linkage]
; Contents of value:
; \Device\NwlnkNb
; \Device\Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\Nbf_Ndis
; \Device\Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Dev
; \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Devi
; \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \De
; \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA
; \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \
; \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,\
63,65,5c,4e,62,66,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,\
39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,\
69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,\
33,30,32,32,35,2d,33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,\
31,34,30,45,37,31,45,41,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,\
73,57,61,6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,2d,39,33,43,32,2d,34,\
44,42,31,2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,39,36,38,7d,00,5c,44,\
65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,\
42,38,38,33,45,30,2d,31,39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,\
32,31,41,42,34,42,41,31,45,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,\
69,73,57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,32,42,2d,44,46,43,45,2d,\
34,37,35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,41,31,31,37,32,7d,00,5c,\
44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,\
45,46,46,35,42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,\
37,36,33,44,35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,\
33,33,2d,34,46,36,33,2d,38,33,31,31,2d,37,44,41,36,38,41,34,46,33,39,46,43,\
7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,\
69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,37,35,31,46,36,46,45,36,\
2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,\
45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,\
7b,32,32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,\
32,38,39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,\
42,54,5f,54,63,70,69,70,5f,7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,\
36,38,41,2d,38,37,39,37,2d,33,35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,\
65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,33,39,\
35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,\
42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\
70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,41,41,41,\
42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00
; Contents of value:
; \Device\LanmanWorkstation_NwlnkNb
; \Device\LanmanWorkstation_Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_Nbf_Ndis
; \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanWorkstat
; \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanWorkstati
; \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorksta
; \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA
; \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \
; \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,\
74,69,6f,6e,5f,4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,\
61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,62,66,5f,7b,37,35,31,46,36,46,\
45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,\
41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,\
73,74,61,74,69,6f,6e,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,\
7b,46,30,43,33,30,32,32,35,2d,33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,\
30,31,46,44,31,34,30,45,37,31,45,41,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,\
6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,62,66,5f,4e,64,69,73,57,61,\
6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,2d,39,33,43,32,2d,34,44,42,31,\
2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,39,36,38,7d,00,5c,44,65,76,69,\
63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,42,38,38,33,45,30,2d,31,39,45,\
45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,32,31,41,42,34,42,41,31,45,7d,\
00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,\
6e,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,\
32,42,2d,44,46,43,45,2d,34,37,35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,\
41,31,31,37,32,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,\
73,74,61,74,69,6f,6e,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,\
7b,45,46,46,35,42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,\
35,37,36,33,44,35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,\
6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,62,66,5f,4e,64,69,73,57,61,\
6e,4e,62,66,4f,75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,33,33,2d,34,46,36,\
33,2d,38,33,31,31,2d,37,44,41,36,38,41,34,46,33,39,46,43,7d,00,5c,44,65,76,\
69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,\
62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,\
6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,37,35,31,\
46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,\
41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,\
6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,\
32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,\
39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,\
6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,\
7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,\
33,35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,\
6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,70,69,\
70,5f,7b,45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,\
44,2d,42,34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4c,\
61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,\
70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,41,\
41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBIOS\Linkage]
; Contents of value:
; \Device\NwlnkNb
; \Device\Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\Nbf_Ndis
; \Device\Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Dev
; \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Devi
; \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \De
; \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\Net
; \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_
; \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,\
63,65,5c,4e,62,66,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,\
39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,\
69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,\
33,30,32,32,35,2d,33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,\
31,34,30,45,37,31,45,41,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,\
73,57,61,6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,2d,39,33,43,32,2d,34,\
44,42,31,2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,39,36,38,7d,00,5c,44,\
65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,\
42,38,38,33,45,30,2d,31,39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,\
32,31,41,42,34,42,41,31,45,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,\
69,73,57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,32,42,2d,44,46,43,45,2d,\
34,37,35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,41,31,31,37,32,7d,00,5c,\
44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,\
45,46,46,35,42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,\
37,36,33,44,35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,\
33,33,2d,34,46,36,33,2d,38,33,31,31,2d,37,44,41,36,38,41,34,46,33,39,46,43,\
7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,37,35,\
31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,\
32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,\
54,63,70,69,70,5f,7b,32,32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,\
2d,41,33,33,46,2d,32,38,39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,\
63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,31,36,39,45,30,46,44,2d,\
38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,33,35,39,35,36,36,37,33,30,45,\
38,35,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,\
34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,30,\
35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00
; Contents of value:
; \Device\NetBIOS_NwlnkNb
; \Device\NetBIOS_Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBIOS_Nbf_Ndis
; \Device\NetBIOS_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\NetBIOS_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\NetB
; \Device\NetBIOS_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\NetBIOS_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\NetBIOS_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\NetBI
; \Device\NetBIOS_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\NetBIOS_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\NetBIOS_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\NetBIOS_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\Net
; \Device\NetBIOS_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\NetBIOS_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\NetBIOS_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetBIOS_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBIOS_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBIOS_Net
; \Device\NetBIOS_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\NetBIOS_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetBIOS_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBIOS_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBIOS_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBIOS_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBIOS_NetBT_Tcpip_
; \Device\NetBIOS_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetBIOS_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBIOS_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBIOS_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBIOS_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBIOS_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBIOS_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBIOS_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBIOS_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBIOS_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBIOS_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBIOS_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBIOS_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBIOS_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBIOS_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBIOS_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBIOS_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBIOS_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBIOS_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBIOS_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBIOS_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,77,6c,6e,6b,\
4e,62,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,62,66,5f,7b,37,\
35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,\
41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,\
4f,53,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,33,\
30,32,32,35,2d,33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,31,\
34,30,45,37,31,45,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,\
4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,\
2d,39,33,43,32,2d,34,44,42,31,2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,\
39,36,38,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,42,38,38,33,45,30,2d,31,39,45,\
45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,32,31,41,42,34,42,41,31,45,7d,\
00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,62,66,5f,4e,64,69,73,\
57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,32,42,2d,44,46,43,45,2d,34,37,\
35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,41,31,31,37,32,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,\
62,66,4f,75,74,7b,45,46,46,35,42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,\
38,34,38,39,2d,35,37,36,33,44,35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,\
65,5c,4e,65,74,42,49,4f,53,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,\
75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,33,33,2d,34,46,36,33,2d,38,33,31,\
31,2d,37,44,41,36,38,41,34,46,33,39,46,43,7d,00,5c,44,65,76,69,63,65,5c,4e,\
65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,37,35,31,46,36,\
46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,\
30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,\
65,74,42,54,5f,54,63,70,69,70,5f,7b,32,32,30,34,45,37,41,31,2d,36,37,31,38,\
2d,34,41,41,45,2d,41,33,33,46,2d,32,38,39,32,41,41,37,42,44,35,46,31,7d,00,\
5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,\
69,70,5f,7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,\
39,37,2d,33,35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,\
4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,\
33,39,35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,\
44,36,42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,\
4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,\
42,2d,34,30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,\
00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Linkage]
; Contents of value:
; \Device\Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C}
; \Device\Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\Tcpip_{E169E0FD-8B49-468A-8797-359566730E85}
; \Device\Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,37,35,31,46,36,46,\
45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,\
41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,32,32,30,\
34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,39,32,\
41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\
45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,33,\
35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\
70,5f,7b,45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,\
44,2d,42,34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,54,\
63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,\
41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00
; Contents of value:
; \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C}
; \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85}
; \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,\
32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,32,32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,\
41,45,2d,41,33,33,46,2d,32,38,39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,31,36,39,45,30,46,\
44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,33,35,39,35,36,36,37,33,\
30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,\
2d,42,34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,\
34,30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces\Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage]
; Contents of value:
; \Device\Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C}
; \Device\Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\Tcpip_{E169E0FD-8B49-468A-8797-359566730E85}
; \Device\Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,37,35,31,46,36,46,\
45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,\
41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,32,32,30,\
34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,39,32,\
41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\
45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,33,\
35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\
70,5f,7b,45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,\
44,2d,42,34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,54,\
63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,\
41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Adapters\NdisWanIp]
; Contents of value:
; Tcpip\Parameters\Interfaces\{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1}
; Tcpip\Parameters\Interfaces\{E169E0FD-8B49-468A-8797-359566730E85} Tcpip\Parameters\Interfaces\{EB673957-1B1E-4411-B19D-B45BAD6B528B}
; Tcpip\Parameters\Interfaces\{EB673957-1B1E-4411-B19D-B45BAD6B528B} Tcpip\Parameters\Interfaces\{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; Tcpip\Parameters\Interfaces\{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"IpConfig"=hex(7):54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,\
65,72,66,61,63,65,73,5c,7b,32,32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,\
41,45,2d,41,33,33,46,2d,32,38,39,32,41,41,37,42,44,35,46,31,7d,00,54,63,70,\
69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,\
7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,\
33,35,39,35,36,36,37,33,30,45,38,35,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,\
65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,7b,45,42,36,37,33,39,35,\
37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,42,\
35,32,38,42,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,\
74,65,72,66,61,63,65,73,5c,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,\
30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{EB673957-1B1E-4411-B19D-B45BAD6B528B}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\lanmanserver\Linkage]
; Contents of value:
; \Device\NwlnkNb
; \Device\NwlnkIpx \Device\Nbf_{751
; \Device\Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\Nbf_NdisWanNbfOut{F0C3022
; \Device\Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNb
; \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbf
; \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \
; \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\N
; \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpi
; \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,\
63,65,5c,4e,77,6c,6e,6b,49,70,78,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,7b,\
37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,\
32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,33,30,32,32,35,2d,33,35,\
30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,31,34,30,45,37,31,45,41,\
7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,\
6e,7b,38,36,46,45,38,42,43,32,2d,39,33,43,32,2d,34,44,42,31,2d,41,33,32,43,\
2d,34,39,35,30,30,33,45,36,44,39,36,38,7d,00,5c,44,65,76,69,63,65,5c,4e,62,\
66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,42,38,38,33,45,30,2d,31,\
39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,32,31,41,42,34,42,41,31,\
45,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,\
49,6e,7b,46,35,46,36,43,34,32,42,2d,44,46,43,45,2d,34,37,35,33,2d,41,36,36,\
32,2d,42,37,39,36,36,30,30,41,31,31,37,32,7d,00,5c,44,65,76,69,63,65,5c,4e,\
62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,45,46,46,35,42,34,38,38,\
2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,37,36,33,44,35,38,41,38,\
34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,\
62,66,4f,75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,33,33,2d,34,46,36,33,2d,\
38,33,31,31,2d,37,44,41,36,38,41,34,46,33,39,46,43,7d,00,5c,44,65,76,69,63,\
65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,\
41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,32,30,34,45,37,41,\
31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,39,32,41,41,37,42,\
44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,\
2d,33,35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,33,39,35,37,2d,31,42,31,45,2d,\
34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,42,35,32,38,42,7d,00,5c,\
44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,\
35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,\
36,43,31,42,39,36,7d,00,00
; Contents of value:
; \Device\LanmanServer_NwlnkNb
; \Device\LanmanServer_NwlnkIpx \Device\LanmanServer_Nbf_{751
; \Device\LanmanServer_Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-9
; \Device\LanmanServer_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\LanmanServer_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanServer_Nbf_NdisWanNbfIn{1EB883E0-
; \Device\LanmanServer_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanServer_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanServer_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-
; \Device\LanmanServer_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanServer_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\Lanman
; \Device\LanmanServer_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_N
; \Device\LanmanServer_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpi
; \Device\LanmanServer_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetbiosSmb \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanServer_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\
4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,\
76,65,72,5f,4e,77,6c,6e,6b,49,70,78,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,\
61,6e,53,65,72,76,65,72,5f,4e,62,66,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,\
34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,\
7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,62,\
66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,33,30,32,32,35,2d,\
33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,31,34,30,45,37,31,\
45,41,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\
4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,\
2d,39,33,43,32,2d,34,44,42,31,2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,\
39,36,38,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,\
5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,42,38,38,33,45,\
30,2d,31,39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,32,31,41,42,34,\
42,41,31,45,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,\
72,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,\
32,42,2d,44,46,43,45,2d,34,37,35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,\
41,31,31,37,32,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,\
65,72,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,45,46,46,35,\
42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,37,36,33,44,\
35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,\
72,76,65,72,5f,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,44,37,\
35,39,45,35,36,39,2d,37,46,33,33,2d,34,46,36,33,2d,38,33,31,31,2d,37,44,41,\
36,38,41,34,46,33,39,46,43,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,\
53,65,72,76,65,72,5f,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,\
5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,\
2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4c,61,\
6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,\
32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,32,38,\
39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,\
6e,53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,31,36,39,\
45,30,46,44,2d,38,42,34,39,2d,34,36,38,41,2d,38,37,39,37,2d,33,35,39,35,36,\
36,37,33,30,45,38,35,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,\
72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,33,39,35,\
37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,42,\
35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,\
72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,32,34,34,36,46,35,31,43,2d,45,\
36,33,42,2d,34,30,35,39,2d,41,41,41,42,2d,43,45,43,33,46,35,36,43,31,42,39,\
36,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\lanmanworkstation\Linkage]
; Contents of value:
; \Device\NwlnkNb
; \Device\Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\Nbf_Ndis
; \Device\Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Dev
; \Device\Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Devi
; \Device\Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \De
; \Device\Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA
; \Device\Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \
; \Device\Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetbiosSmb \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,77,6c,6e,6b,4e,62,00,5c,44,65,76,69,\
63,65,5c,4e,62,66,5f,7b,37,35,31,46,36,46,45,36,2d,34,36,34,35,2d,34,45,41,\
39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,45,38,43,7d,00,5c,44,65,76,\
69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,46,30,43,\
33,30,32,32,35,2d,33,35,30,32,2d,34,45,36,32,2d,39,37,41,37,2d,30,31,46,44,\
31,34,30,45,37,31,45,41,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,\
73,57,61,6e,4e,62,66,49,6e,7b,38,36,46,45,38,42,43,32,2d,39,33,43,32,2d,34,\
44,42,31,2d,41,33,32,43,2d,34,39,35,30,30,33,45,36,44,39,36,38,7d,00,5c,44,\
65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,49,6e,7b,31,45,\
42,38,38,33,45,30,2d,31,39,45,45,2d,34,33,34,30,2d,41,46,32,45,2d,35,45,33,\
32,31,41,42,34,42,41,31,45,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,\
69,73,57,61,6e,4e,62,66,49,6e,7b,46,35,46,36,43,34,32,42,2d,44,46,43,45,2d,\
34,37,35,33,2d,41,36,36,32,2d,42,37,39,36,36,30,30,41,31,31,37,32,7d,00,5c,\
44,65,76,69,63,65,5c,4e,62,66,5f,4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,\
45,46,46,35,42,34,38,38,2d,44,37,39,30,2d,34,45,31,31,2d,38,34,38,39,2d,35,\
37,36,33,44,35,38,41,38,34,41,30,7d,00,5c,44,65,76,69,63,65,5c,4e,62,66,5f,\
4e,64,69,73,57,61,6e,4e,62,66,4f,75,74,7b,44,37,35,39,45,35,36,39,2d,37,46,\
33,33,2d,34,46,36,33,2d,38,33,31,31,2d,37,44,41,36,38,41,34,46,33,39,46,43,\
7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,\
69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,37,35,31,46,36,46,45,36,\
2d,34,36,34,35,2d,34,45,41,39,2d,42,36,44,38,2d,32,32,41,32,41,30,30,41,36,\
45,38,43,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,\
7b,32,32,30,34,45,37,41,31,2d,36,37,31,38,2d,34,41,41,45,2d,41,33,33,46,2d,\
32,38,39,32,41,41,37,42,44,35,46,31,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,\
42,54,5f,54,63,70,69,70,5f,7b,45,31,36,39,45,30,46,44,2d,38,42,34,39,2d,34,\
36,38,41,2d,38,37,39,37,2d,33,35,39,35,36,36,37,33,30,45,38,35,7d,00,5c,44,\
65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,42,36,37,33,39,\
35,37,2d,31,42,31,45,2d,34,34,31,31,2d,42,31,39,44,2d,42,34,35,42,41,44,36,\
42,35,32,38,42,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\
70,5f,7b,32,34,34,36,46,35,31,43,2d,45,36,33,42,2d,34,30,35,39,2d,41,41,41,\
42,2d,43,45,43,33,46,35,36,43,31,42,39,36,7d,00,00
; Contents of value:
; \Device\LanmanWorkstation_NwlnkNb
; \Device\LanmanWorkstation_Nbf_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_Nbf_Ndis
; \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{F0C30225-3502-4E62-97A7-01FD140E71EA} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanWorkstat
; \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{86FE8BC2-93C2-4DB1-A32C-495003E6D968} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanWorkstati
; \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{1EB883E0-19EE-4340-AF2E-5E321AB4BA1E} \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorksta
; \Device\LanmanWorkstation_Nbf_NdisWanNbfIn{F5F6C42B-DFCE-4753-A662-B796600A1172} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA
; \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{EFF5B488-D790-4E11-8489-5763D58A84A0} \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \
; \Device\LanmanWorkstation_Nbf_NdisWanNbfOut{D759E569-7F33-4F63-8311-7DA68A4F39FC} \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetbiosSmb \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{751F6FE6-4645-4EA9-B6D8-22A2A00A6E8C} \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E63B-4059-AAAB-CEC3F56C1B96}
; \Device\LanmanWorkstation_NetBT_Tcpip_{2204E7A1-6718-4AAE-A33F-2892AA7BD5F1} \Device\LanmanWorkstation_NetBT_Tcpip_{E169E0FD-8B49-468A-8797-359566730E85} \Device\LanmanWorkstation_NetBT_Tcpip_{EB673957-1B1E-4411-B19D-B45BAD6B528B} \Device\LanmanWorkstation_NetBT_Tcpip_{2446F51C-E6
Seitenanfang Seitenende
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!

Folgende Themen könnten Dich auch interessieren:
Seite(n): 123