Was für ein Virus und wie krieg ich Ihn weg?

#16 Pocket KillBox
http://virus-protect.org/killbox.html

Options: "Delete on Reboot" und "Single File"--> anhaken
und klicke auf das rote Kreuz, wenn gefragt wird, ob "Do you want to reboot? "---- klicke auf auf "yes"
reinkopieren: ............

C:\Avenger\bhrax1.dll

PC neustarten

dann gehe in C:\!KillBox\ und loesche die Datei, die drin ist.
__________
MfG Sabina

rund um die PC-Sicherheit

#17 Irgendwie hab ich immer noch das Gefühl, das irgendwas nicht stimmt, aber wenn Du sagst, das es das war, dann will ich Dir das wohl glauben, obwohl ich den Avenger ordner immer noch nicht löschen kann, denn dann krieg ich zur Antwort, das der Ordner nicht gelöscht werden kann, da der Ordner nicht leer ist!????
Wenn ich Ihn dann öffne, ist aber nix drin?!!!

#18 der ordner ist nicht leer, aber diese dll ist ein Rootkit, also nur mit speziellen Programmen sichtbar, du solltest versuchen, ihn mit der killbox zu loeschen.
oder:
Am besten, du loeschst den Avenger komplett.
__________
MfG Sabina

rund um die PC-Sicherheit

#19 Also, mit Killbox hab ich es wohl gelöscht.Denn wenn ich den Pfad eingebe, dann sagt er "File does not seem exist" oder so.
Ich hab da eine andere Problematik und zwar kann ich die Datei C:\Avenger nicht löschen, weder normal noch im abgesicherten Modus noch sonst wie.
Da krieg ich dann immer die schon oben genannte Fehlermeldung.
Woran kann das liegen?

#20 vielleicht ist die Datei schreibgeschuetzt.
Klicke mal (rechtsklick) und schau, ob du den Schreibschutz aufheben kannst , es wird wahrscheinlich nur im abges.Modus als Administrator klappen.
Ansonsten ist es kein Grund zu Sorge, denn der Virus ist im Avenger "eingeschlossen" und hat keine Verbindung mehr nach "aussen"
__________
MfG Sabina

rund um die PC-Sicherheit

#21 Gut, dann möchte ich mich wieder einmal ganz recht herzlich für die Hilfe bedanken und weiss es wirklich zu schätzen, das Du Dir für ein Problem soviel Zeit nimmst.

Ich werde es nicht leid Euch auch weiter zu empfehlen, da ich begeistert bin, wie selbstlos Ihr anderen Usern helft.

MfG

Jean-Luc

#22 falls der 017-Eintrag im HijackThis wieder auftauchten sollte, (kann passieren), dann melde dich .
__________
MfG Sabina

rund um die PC-Sicherheit

#23 Kaum haste es ausgesprochen, schon ist er wieder da.Gibt´s gar nicht.
Hier mein Log von HiJackthis:

Logfile of HijackThis v1.99.1
Scan saved at 17:18:21, on 09.07.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\Softwin\BitDefender8\bdoesrv.exe
C:\Programme\Softwin\BitDefender8\bdswitch.exe
C:\Programme\Desktop Messenger\8876480\Program\backWeb-8876480.exe
E:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe
C:\Programme\ewido anti-spyware 4.0\ewido.exe
E:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\GEMEIN~1\Nokia\MPAPI\MPAPI3s.exe
C:\Programme\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
C:\Programme\Softwin\BitDefender8\vsserv.exe
C:\Programme\Softwin\BitDefender8\bdmcon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
E:\Programme\Crazy Browser\Crazy Browser\Crazy Browser.exe
E:\Exedateien\hijackthis\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {FF99367F-97CB-E438-B0AA-2818ECD2BB70} - (no file)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [BDMCon] c:\PROGRA~1\softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] C:\Programme\Softwin\BitDefender8\\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] c:\programme\softwin\bitdefender8\bdnagent.exe
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Programme\Softwin\BitDefender8\\bdswitch.exe
O4 - HKLM\..\Run: [LDM] C:\Programme\Desktop Messenger\8876480\Program\backWeb-8876480.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [!ewido] "C:\Programme\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [LDM] C:\Programme\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [PcSync] E:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Hattrick Organizer Extension support - E:\Programme\HO\lineups\support.htm
O8 - Extra context menu item: Hattrick Organizer Lineups - E:\Programme\HO\lineups\hoe.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Hattrick Organizer - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - E:\Programme\HO\lineups\hoe.exe
O9 - Extra 'Tools' menuitem: Hattrick Organizer - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - E:\Programme\HO\lineups\hoe.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.de/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B305CE29-8C9C-407F-92AF-5623C559D3EB}: NameServer = 85.255.113.107 85.255.112.121
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programme\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Programme\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

#24 1.
F-Secure Online Scanner Next Generation Beta
http://support.f-secure.com/enu/home/ols3.shtml

1. Klicke den Link: "F-Secure Online Scanner Next Generation Beta".
2. Du wirst aufgefordert werden, ein ActiveX-Control zu installieren
3. Installiere diese ActiveX-Komponente
4. Lies die Anleitung und klicke: "Accept"
5. Klicke "Full System Scan"
6. klicke "Show report" - kopiere den Scanreport

2.
Download Registry Search by Bobbi Flekman
http://virus-protect.org/artikel/tools/regsearch.html
und doppelklicken, um zu starten. in: "Enter search strings" (reinschreiben oder reinkopieren)

{B305CE29-8C9C-407F-92AF-5623C559D3EB}

in edit und klicke "Ok".
Notepad wird sich oeffnen -- kopiere den Text ab und poste ihn.
__________
MfG Sabina

rund um die PC-Sicherheit

#25 Was mich wundert, ist, das ich immer noch die Meldung nach einer gewissen Zeit bekomme,Virtueller Speicher ist voll und wird erweitert.
Dazu erscheint unten rechts ein gelbes Dreieck in der Taskleiste.

Hier aber erstmal die Reports.

F-Secure:

Scanning Report
Sunday, July 09, 2006 20:38:51 - 21:42:54
Computer name: NCC-D186F6099B5
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\ D:\ E:\ F:\


--------------------------------------------------------------------------------

Result: 6 malware found
Crac*hier nicht!* (spyware)
System (Disinfected)
Malware.TopAntiSpyware (spyware)
System (Disinfected)
Stealth_file (hidden item)
C:\AVENGER\BHRAX1.DLL (Submitted)
C:\WINDOWS\BHRAX1.DLL
Tracking Cookie (spyware)
System (Disinfected)
W32/Malware (virus)
C:\CASINO\CASINO-CLUB DEUTSCH\UPDATE.EXE

--------------------------------------------------------------------------------

Statistics
Scanned:
Files: 86735
System: 3641
Not scanned: 9
Actions:
Disinfected: 3
Renamed: 0
Deleted: 0
None: 3
Submitted: 1
Files not scanned:
C:\HIBERFIL.SYS
C:\PAGEFILE.SYS
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
C:\WINDOWS\SYSTEM32\CONFIG\SAM
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
C:\PROGRAMME\GEMEINSAME DATEIEN\SYSTEM\KNK.EXE
C:\PROGRAMME\GEMEINSAME DATEIEN\SYSTEM\WFD.EXE

--------------------------------------------------------------------------------

Options
Scanning engines:
F-Secure AVP: 6.0.171, 2006-07-07
F-Secure Libra: 2.4.1, 2006-07-04
F-Secure Orion: 1.2.37, 2006-07-06
F-Secure Blacklight: 1.0.31, 0000-00-00
F-Secure Pegasus: 1.19.0, 2006-06-05
F-Secure Draco: 1.0.35, 0259-24-212
Scanning options:
Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX
Use Advanced heuristics


RegSearch Report:

REGEDIT4

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0

; Results at 09.07.2006 21:45:14 for strings:
; '{b305ce29-8c9c-407f-92af-5623c559d3eb}'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dhcp\Parameters]
; Contents of value:
;  ôk±dù ôk±d
ôk±d+ ôk±d, ôk±d ôk±d
"{B305CE29-8C9C-407F-92AF-5623C559D3EB}"=hex:0f,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,f4,4b,b1,44,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
f4,4b,b1,44,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f4,4b,b1,44,2b,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f4,4b,b1,44,2c,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,f4,4b,b1,44,06,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,f4,4b,b1,44

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\Linkage]
; Contents of value:
; \Device\NetbiosSmb
; \Device\NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3} \Device\NetBT_Tcpip
; \Device\NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip
; \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,\
65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,34,43,39,46,42,37,\
34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,\
33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\
70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,\
43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,4e,\
65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,2d,45,36,41,46,\
2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,43,45,34,7d,00,\
5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,43,46,30,\
43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,\
37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,\
70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,39,\
32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00
; Contents of value:
; \Device\LanmanServer_NetbiosSmb
; \Device\LanmanServer_NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3} \Device\LanmanServer_NetBT_Tcpip
; \Device\LanmanServer_NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\LanmanServer_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\LanmanServer_NetBT_Tcpip
; \Device\LanmanServer_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\LanmanServer_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\LanmanServer_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\LanmanServer_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\LanmanServer_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\LanmanServer_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\
4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,\
53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,34,43,39,46,42,\
37,34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,\
45,33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,\
76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,46,42,42,33,32,36,42,46,\
2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,\
44,37,30,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,\
5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,2d,45,36,\
41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,43,45,34,\
7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,\
34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,\
44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,\
5f,54,63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,\
46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanworkstation\Linkage]
; Contents of value:
; \Device\NetbiosSmb
; \Device\NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3} \Device\NetBT_Tcpip
; \Device\NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip
; \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,\
65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,34,43,39,46,42,37,\
34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,\
33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\
70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,\
43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,4e,\
65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,2d,45,36,41,46,\
2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,43,45,34,7d,00,\
5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,43,46,30,\
43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,\
37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,\
70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,39,\
32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00
; Contents of value:
; \Device\LanmanWorkstation_NetbiosSmb
; \Device\LanmanWorkstation_NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3} \Device\LanmanWorkstation_NetBT_Tcpip
; \Device\LanmanWorkstation_NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\LanmanWorkstation_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\LanmanWorkstation_NetBT_Tcpip
; \Device\LanmanWorkstation_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\LanmanWorkstation_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\LanmanWorkstation_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\LanmanWorkstation_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\LanmanWorkstation_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\LanmanWorkstation_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,\
74,69,6f,6e,5f,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,\
61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,\
70,69,70,5f,7b,34,43,39,46,42,37,34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,\
45,42,35,2d,39,33,36,36,43,34,45,33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,\
5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,\
54,63,70,69,70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,\
2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,\
63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,2d,45,36,41,46,2d,34,44,\
35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,43,45,34,7d,00,5c,44,65,\
76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,\
34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,\
44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,\
4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,\
43,2d,34,30,37,46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,\
00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBIOS\Linkage]
; Contents of value:
; \Device\NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
34,43,39,46,42,37,34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,\
33,36,36,43,34,45,33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,\
44,45,2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,\
44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,\
30,43,45,34,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,\
2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,\
34,30,37,46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00
; Contents of value:
; \Device\NetBIOS_NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\NetBIOS_NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBIOS_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\NetBIOS_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBIOS_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBIOS_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBIOS_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBIOS_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBIOS_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,\
5f,54,63,70,69,70,5f,7b,34,43,39,46,42,37,34,33,2d,31,44,31,37,2d,34,42,35,\
45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,33,38,41,43,33,7d,00,5c,44,65,76,\
69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,43,2d,42,\
30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,\
2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,\
43,45,34,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,\
37,44,2d,39,39,38,32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,\
7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,39,32,41,46,2d,\
35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Linkage]
; Contents of value:
; \Device\Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,34,43,39,46,42,37,\
34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,\
33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,46,42,42,\
33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,43,2d,42,30,33,33,\
35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\
43,34,31,44,46,43,39,44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,\
37,42,38,35,36,34,42,30,43,45,34,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\
70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,\
32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,54,\
63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,\
39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00
; Contents of value:
; \Device\NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
34,43,39,46,42,37,34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,\
33,36,36,43,34,45,33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,\
44,45,2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,\
44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,\
30,43,45,34,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,\
2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,\
34,30,37,46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NetBT\Parameters\Interfaces\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage]
; Contents of value:
; \Device\Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,34,43,39,46,42,37,\
34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,\
33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,46,42,42,\
33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,43,2d,42,30,33,33,\
35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\
43,34,31,44,46,43,39,44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,\
37,42,38,35,36,34,42,30,43,45,34,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\
70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,\
32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,54,\
63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,\
39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Adapters\NdisWanIp]
; Contents of value:
; Tcpip\Parameters\Interfaces\{FBB326BF-D033-4EDE-B49C-B03352FCCD70}
; Tcpip\Parameters\Interfaces\{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} Tcpip\Parameters\Interfaces\{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A}
; Tcpip\Parameters\Interfaces\{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} Tcpip\Parameters\Interfaces\{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; Tcpip\Parameters\Interfaces\{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"IpConfig"=hex(7):54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,\
65,72,66,61,63,65,73,5c,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,\
44,45,2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,54,63,70,\
69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,\
7b,43,34,31,44,46,43,39,44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,\
39,37,42,38,35,36,34,42,30,43,45,34,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,\
65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,7b,45,43,46,30,43,46,36,\
43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,37,45,46,\
37,42,30,41,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,\
74,65,72,66,61,63,65,73,5c,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,\
30,37,46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{B305CE29-8C9C-407F-92AF-5623C559D3EB}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Dhcp\Parameters]
; Contents of value:
; 
k±dù
k±d

k±d+
k±d,
k±d
k±d
"{B305CE29-8C9C-407F-92AF-5623C559D3EB}"=hex:0f,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,01,4b,b1,44,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
01,4b,b1,44,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,01,4b,b1,44,2b,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,01,4b,b1,44,2c,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,01,4b,b1,44,06,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,01,4b,b1,44

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\lanmanserver\Linkage]
; Contents of value:
; \Device\NetbiosSmb
; \Device\NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3} \Device\NetBT_Tcpip
; \Device\NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip
; \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,\
65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,34,43,39,46,42,37,\
34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,\
33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\
70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,\
43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,4e,\
65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,2d,45,36,41,46,\
2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,43,45,34,7d,00,\
5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,43,46,30,\
43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,\
37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,\
70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,39,\
32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00
; Contents of value:
; \Device\LanmanServer_NetbiosSmb
; \Device\LanmanServer_NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3} \Device\LanmanServer_NetBT_Tcpip
; \Device\LanmanServer_NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\LanmanServer_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\LanmanServer_NetBT_Tcpip
; \Device\LanmanServer_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\LanmanServer_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\LanmanServer_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\LanmanServer_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\LanmanServer_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\LanmanServer_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\
4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,\
53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,34,43,39,46,42,\
37,34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,\
45,33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,\
76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,46,42,42,33,32,36,42,46,\
2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,\
44,37,30,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,\
5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,2d,45,36,\
41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,43,45,34,\
7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,\
34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,\
44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,\
5f,54,63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,\
46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\lanmanworkstation\Linkage]
; Contents of value:
; \Device\NetbiosSmb
; \Device\NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3} \Device\NetBT_Tcpip
; \Device\NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip
; \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,\
65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,34,43,39,46,42,37,\
34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,\
33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\
70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,\
43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,4e,\
65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,2d,45,36,41,46,\
2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,43,45,34,7d,00,\
5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,43,46,30,\
43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,\
37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,\
70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,39,\
32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00
; Contents of value:
; \Device\LanmanWorkstation_NetbiosSmb
; \Device\LanmanWorkstation_NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3} \Device\LanmanWorkstation_NetBT_Tcpip
; \Device\LanmanWorkstation_NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\LanmanWorkstation_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\LanmanWorkstation_NetBT_Tcpip
; \Device\LanmanWorkstation_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\LanmanWorkstation_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\LanmanWorkstation_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\LanmanWorkstation_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\LanmanWorkstation_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\LanmanWorkstation_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,\
74,69,6f,6e,5f,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,\
61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,\
70,69,70,5f,7b,34,43,39,46,42,37,34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,\
45,42,35,2d,39,33,36,36,43,34,45,33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,\
5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,\
54,63,70,69,70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,\
2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,\
63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,2d,45,36,41,46,2d,34,44,\
35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,43,45,34,7d,00,5c,44,65,\
76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,\
34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,\
44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,\
4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,\
43,2d,34,30,37,46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,\
00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\NetBIOS\Linkage]
; Contents of value:
; \Device\NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
34,43,39,46,42,37,34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,\
33,36,36,43,34,45,33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,\
44,45,2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,\
44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,\
30,43,45,34,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,\
2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,\
34,30,37,46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00
; Contents of value:
; \Device\NetBIOS_NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\NetBIOS_NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBIOS_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\NetBIOS_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBIOS_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBIOS_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBIOS_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBIOS_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBIOS_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,\
5f,54,63,70,69,70,5f,7b,34,43,39,46,42,37,34,33,2d,31,44,31,37,2d,34,42,35,\
45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,33,38,41,43,33,7d,00,5c,44,65,76,\
69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,43,2d,42,\
30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,\
2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,\
43,45,34,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,\
37,44,2d,39,39,38,32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,\
7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,39,32,41,46,2d,\
35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\NetBT\Linkage]
; Contents of value:
; \Device\Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,34,43,39,46,42,37,\
34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,\
33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,46,42,42,\
33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,43,2d,42,30,33,33,\
35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\
43,34,31,44,46,43,39,44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,\
37,42,38,35,36,34,42,30,43,45,34,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\
70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,\
32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,54,\
63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,\
39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00
; Contents of value:
; \Device\NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
34,43,39,46,42,37,34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,\
33,36,36,43,34,45,33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,\
44,45,2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,\
44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,\
30,43,45,34,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,\
2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,\
34,30,37,46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\NetBT\Parameters\Interfaces\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Linkage]
; Contents of value:
; \Device\Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,34,43,39,46,42,37,\
34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,\
33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,46,42,42,\
33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,43,2d,42,30,33,33,\
35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\
43,34,31,44,46,43,39,44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,\
37,42,38,35,36,34,42,30,43,45,34,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\
70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,\
32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,54,\
63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,\
39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Adapters\NdisWanIp]
; Contents of value:
; Tcpip\Parameters\Interfaces\{FBB326BF-D033-4EDE-B49C-B03352FCCD70}
; Tcpip\Parameters\Interfaces\{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} Tcpip\Parameters\Interfaces\{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A}
; Tcpip\Parameters\Interfaces\{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} Tcpip\Parameters\Interfaces\{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; Tcpip\Parameters\Interfaces\{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"IpConfig"=hex(7):54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,\
65,72,66,61,63,65,73,5c,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,\
44,45,2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,54,63,70,\
69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,\
7b,43,34,31,44,46,43,39,44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,\
39,37,42,38,35,36,34,42,30,43,45,34,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,\
65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,7b,45,43,46,30,43,46,36,\
43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,37,45,46,\
37,42,30,41,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,\
74,65,72,66,61,63,65,73,5c,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,\
30,37,46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{B305CE29-8C9C-407F-92AF-5623C559D3EB}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp\Parameters]
; Contents of value:
;  ôk±dù ôk±d
ôk±d+ ôk±d, ôk±d ôk±d
"{B305CE29-8C9C-407F-92AF-5623C559D3EB}"=hex:0f,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,f4,4b,b1,44,f9,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
f4,4b,b1,44,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f4,4b,b1,44,2b,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,f4,4b,b1,44,2c,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,f4,4b,b1,44,06,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,f4,4b,b1,44

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\Linkage]
; Contents of value:
; \Device\NetbiosSmb
; \Device\NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3} \Device\NetBT_Tcpip
; \Device\NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip
; \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,\
65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,34,43,39,46,42,37,\
34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,\
33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\
70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,\
43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,4e,\
65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,2d,45,36,41,46,\
2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,43,45,34,7d,00,\
5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,43,46,30,\
43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,\
37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,\
70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,39,\
32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00
; Contents of value:
; \Device\LanmanServer_NetbiosSmb
; \Device\LanmanServer_NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3} \Device\LanmanServer_NetBT_Tcpip
; \Device\LanmanServer_NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\LanmanServer_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\LanmanServer_NetBT_Tcpip
; \Device\LanmanServer_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\LanmanServer_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\LanmanServer_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\LanmanServer_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\LanmanServer_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\LanmanServer_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,\
4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,\
53,65,72,76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,34,43,39,46,42,\
37,34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,\
45,33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,\
76,65,72,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,46,42,42,33,32,36,42,46,\
2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,\
44,37,30,7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,\
5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,2d,45,36,\
41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,43,45,34,\
7d,00,5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,\
34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,\
44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,53,65,72,76,65,72,5f,4e,65,74,42,54,\
5f,54,63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,\
46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\Linkage]
; Contents of value:
; \Device\NetbiosSmb
; \Device\NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3} \Device\NetBT_Tcpip
; \Device\NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip
; \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,\
65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,34,43,39,46,42,37,\
34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,\
33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,\
70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,\
43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,4e,\
65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,2d,45,36,41,46,\
2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,43,45,34,7d,00,\
5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,45,43,46,30,\
43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,\
37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,\
70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,39,\
32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00
; Contents of value:
; \Device\LanmanWorkstation_NetbiosSmb
; \Device\LanmanWorkstation_NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3} \Device\LanmanWorkstation_NetBT_Tcpip
; \Device\LanmanWorkstation_NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\LanmanWorkstation_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\LanmanWorkstation_NetBT_Tcpip
; \Device\LanmanWorkstation_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\LanmanWorkstation_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\LanmanWorkstation_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\LanmanWorkstation_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\LanmanWorkstation_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\LanmanWorkstation_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,\
74,69,6f,6e,5f,4e,65,74,62,69,6f,73,53,6d,62,00,5c,44,65,76,69,63,65,5c,4c,\
61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,54,63,\
70,69,70,5f,7b,34,43,39,46,42,37,34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,\
45,42,35,2d,39,33,36,36,43,34,45,33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,\
5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,54,5f,\
54,63,70,69,70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,\
2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,\
63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,2d,45,36,41,46,2d,34,44,\
35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,43,45,34,7d,00,5c,44,65,\
76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,\
34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,\
44,65,76,69,63,65,5c,4c,61,6e,6d,61,6e,57,6f,72,6b,73,74,61,74,69,6f,6e,5f,\
4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,\
43,2d,34,30,37,46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,\
00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBIOS\Linkage]
; Contents of value:
; \Device\NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
34,43,39,46,42,37,34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,\
33,36,36,43,34,45,33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,\
44,45,2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,\
44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,\
30,43,45,34,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,\
2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,\
34,30,37,46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00
; Contents of value:
; \Device\NetBIOS_NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\NetBIOS_NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBIOS_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\NetBIOS_NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBIOS_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBIOS_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBIOS_NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBIOS_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBIOS_NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,\
5f,54,63,70,69,70,5f,7b,34,43,39,46,42,37,34,33,2d,31,44,31,37,2d,34,42,35,\
45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,33,38,41,43,33,7d,00,5c,44,65,76,\
69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,43,2d,42,\
30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,44,\
2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,30,\
43,45,34,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,\
37,44,2d,39,39,38,32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,49,4f,53,5f,4e,65,74,42,54,5f,54,63,70,69,70,5f,\
7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,39,32,41,46,2d,\
35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Linkage]
; Contents of value:
; \Device\Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Bind"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,34,43,39,46,42,37,\
34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,\
33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,46,42,42,\
33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,43,2d,42,30,33,33,\
35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\
43,34,31,44,46,43,39,44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,\
37,42,38,35,36,34,42,30,43,45,34,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\
70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,\
32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,54,\
63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,\
39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00
; Contents of value:
; \Device\NetBT_Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\NetBT_Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\NetBT_Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\NetBT_Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,\
34,43,39,46,42,37,34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,\
33,36,36,43,34,45,33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,\
54,5f,54,63,70,69,70,5f,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,\
44,45,2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,5c,44,65,\
76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,5f,7b,43,34,31,44,46,43,39,\
44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,37,42,38,35,36,34,42,\
30,43,45,34,7d,00,5c,44,65,76,69,63,65,5c,4e,65,74,42,54,5f,54,63,70,69,70,\
5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,\
2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,4e,65,\
74,42,54,5f,54,63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,\
34,30,37,46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage]
; Contents of value:
; \Device\Tcpip_{4C9FB743-1D17-4B5E-8EB5-9366C4E38AC3}
; \Device\Tcpip_{FBB326BF-D033-4EDE-B49C-B03352FCCD70} \Device\Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4}
; \Device\Tcpip_{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} \Device\Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\Tcpip_{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; \Device\Tcpip_{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"Export"=hex(7):5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,34,43,39,46,42,37,\
34,33,2d,31,44,31,37,2d,34,42,35,45,2d,38,45,42,35,2d,39,33,36,36,43,34,45,\
33,38,41,43,33,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,46,42,42,\
33,32,36,42,46,2d,44,30,33,33,2d,34,45,44,45,2d,42,34,39,43,2d,42,30,33,33,\
35,32,46,43,43,44,37,30,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,70,5f,7b,\
43,34,31,44,46,43,39,44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,39,\
37,42,38,35,36,34,42,30,43,45,34,7d,00,5c,44,65,76,69,63,65,5c,54,63,70,69,\
70,5f,7b,45,43,46,30,43,46,36,43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,\
32,2d,44,32,32,34,38,37,45,46,37,42,30,41,7d,00,5c,44,65,76,69,63,65,5c,54,\
63,70,69,70,5f,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,30,37,46,2d,\
39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\NdisWanIp]
; Contents of value:
; Tcpip\Parameters\Interfaces\{FBB326BF-D033-4EDE-B49C-B03352FCCD70}
; Tcpip\Parameters\Interfaces\{C41DFC9D-E6AF-4D56-8F91-97B8564B0CE4} Tcpip\Parameters\Interfaces\{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A}
; Tcpip\Parameters\Interfaces\{ECF0CF6C-4D85-4C7D-9982-D22487EF7B0A} Tcpip\Parameters\Interfaces\{B305CE29-8C9C-407F-92AF-5623C559D3EB}
; Tcpip\Parameters\Interfaces\{B305CE29-8C9C-407F-92AF-5623C559D3EB}
;
"IpConfig"=hex(7):54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,\
65,72,66,61,63,65,73,5c,7b,46,42,42,33,32,36,42,46,2d,44,30,33,33,2d,34,45,\
44,45,2d,42,34,39,43,2d,42,30,33,33,35,32,46,43,43,44,37,30,7d,00,54,63,70,\
69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,\
7b,43,34,31,44,46,43,39,44,2d,45,36,41,46,2d,34,44,35,36,2d,38,46,39,31,2d,\
39,37,42,38,35,36,34,42,30,43,45,34,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,\
65,74,65,72,73,5c,49,6e,74,65,72,66,61,63,65,73,5c,7b,45,43,46,30,43,46,36,\
43,2d,34,44,38,35,2d,34,43,37,44,2d,39,39,38,32,2d,44,32,32,34,38,37,45,46,\
37,42,30,41,7d,00,54,63,70,69,70,5c,50,61,72,61,6d,65,74,65,72,73,5c,49,6e,\
74,65,72,66,61,63,65,73,5c,7b,42,33,30,35,43,45,32,39,2d,38,43,39,43,2d,34,\
30,37,46,2d,39,32,41,46,2d,35,36,32,33,43,35,35,39,44,33,45,42,7d,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{B305CE29-8C9C-407F-92AF-5623C559D3EB}]

; End Of The Log...

#26 0.
Start - Einstellungen - Systemsteuerung - Verwaltung - Computerverwaltung - und dann den Eintrag Dienste auswählen

TCP/IP-NetBIOS-Hilfsprogramm
Ermöglicht die Unterstützung vom NetBIOS-über-TCP/IP-Dienst (NetBT) und die NetBIOS-Namensauflösung.

Hinweis: Für die meisten Netzwerkverbindungen nicht erforderlich, und zugleich ein potentielles Sicherheitsproblem. Sollten nach dieser Einstellung Netzwerkprobleme auftauchen, Einstellung zurücksetzen

Zitat

C:\AVENGER\BHRAX1.DLL (Submitted)
C:\WINDOWS\BHRAX1.DLL

es scheint, dass die dll untilgbar ist... nicht mal der virenscanner hat sie beachtet, wie es scheint, sondern nur registriert.....
versuche es mal so:

***

Schritt 1
Erstelle eine neue Datei C:\bad

Schritt 2 :
Start - Ausführen - cmd (reinschreiben)

kopiere in das DOS-Fenster:
-- und klicke -- [enter]

move C:\WINDOWS\BHRAX1.DLL C:\bad

Schritt 3 :
C:\bad loeschen

----------------------------------------------
**
Gehe in die Registry
Start - Ausfuehren - regedit
bearbeiten - suchen - {B305CE29-8C9C-407F-92AF-5623C559D3EB}

loesche alle, die du findest

**
fixe mit dem HijackThis:

Zitat

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {FF99367F-97CB-E438-B0AA-2818ECD2BB70} - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{B305CE29-8C9C-407F-92AF-5623C559D3EB}: NameServer = 85.255.113.107 85.255.112.121

PC neustarten

**
bevor du online gehst:
In der Netzwerkverbindung auf Netzwerk => die TC/IP-Verbindung => Einstellungen => Erweitert => DNS => dort war dann folgende IP-Adressen verwenden aktiviert und der böse Server steht drin => abändern auf IP-Adresse automatisch beziehen. Zusätzlich dann noch ueberpruefen, ob NETbios für TCP/IP deaktiviert ist

**
poste das neue Log vom HijackThis
__________
MfG Sabina

rund um die PC-Sicherheit

#27 Mit c:\bad hat es nicht geklappt, denn als ich eingegeben hab, move C:\WINDOWS\BHRAX1.DLL C:\bad
sagt er mir das er das angegebene Verzeichnis nicht finden kann.

{B305CE29-8C9C-407F-92AF-5623C559D3EB} hab ich gelöscht und da standen noch 2 andere drin, aber die hab ich nicht glöscht, sollte ich?Hatten eine ganz andere Bezeichnung.

Also, der böse Server stand nicht drin, bei TCP/IP stand schon drin IP-Adresse automatisch beziehen.

Logfile of HijackThis v1.99.1
Scan saved at 08:37:05, on 10.07.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\Softwin\BitDefender8\bdoesrv.exe
C:\Programme\Softwin\BitDefender8\bdswitch.exe
C:\Programme\Desktop Messenger\8876480\Program\backWeb-8876480.exe
E:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe
C:\Programme\ewido anti-spyware 4.0\ewido.exe
E:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\GEMEIN~1\Nokia\MPAPI\MPAPI3s.exe
C:\Programme\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe
C:\Programme\Softwin\BitDefender8\vsserv.exe
C:\Programme\Softwin\BitDefender8\bdmcon.exe
C:\WINDOWS\system32\wscntfy.exe
E:\Programme\Crazy Browser\Crazy Browser\Crazy Browser.exe
E:\Exedateien\hijackthis\HijackThis.exe

O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [BDMCon] c:\PROGRA~1\softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [BDOESRV] C:\Programme\Softwin\BitDefender8\\bdoesrv.exe
O4 - HKLM\..\Run: [BDNewsAgent] c:\programme\softwin\bitdefender8\bdnagent.exe
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Programme\Softwin\BitDefender8\\bdswitch.exe
O4 - HKLM\..\Run: [LDM] C:\Programme\Desktop Messenger\8876480\Program\backWeb-8876480.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] E:\Programme\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Programme\Gemeinsame Dateien\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [!ewido] "C:\Programme\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [LDM] C:\Programme\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [PcSync] E:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML
O8 - Extra context menu item: Hattrick Organizer Extension support - E:\Programme\HO\lineups\support.htm
O8 - Extra context menu item: Hattrick Organizer Lineups - E:\Programme\HO\lineups\hoe.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Hattrick Organizer - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - E:\Programme\HO\lineups\hoe.exe
O9 - Extra 'Tools' menuitem: Hattrick Organizer - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - E:\Programme\HO\lineups\hoe.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.de/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols3/fscax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B305CE29-8C9C-407F-92AF-5623C559D3EB}: NameServer = 85.255.113.107 85.255.112.121
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programme\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Programme\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programme\Gemeinsame Dateien\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

#28 Noch eine Frage, kann ich mein Onlinebanking bedenkenlos machen oder muss ich Angst haben, das da jemand in meinen daten rumschnüffelt?

#29 wie es ausschaut, wirst du nicht ums Formatieren drumrumkommen..............

Den folgenden Text in den Editor (Start - Zubehör - Editor) kopieren und als listen.bat mit 'Speichern unter' auf dem Desktop. Gebe bei Dateityp 'Alle Dateien' an. Du solltest jetzt auf dem Desktop diese Datei finden. --> die listen.bat doppelt klicken--> kopiere den Text, der erscheint

Zitat

cd\
dir "C:\WINDOWS\Downloaded Program Files" >>files.txt
dir "C:\Dokumente und Einstellungen\%UserName%\Eigene Dateien" >>files.txt
dir "C:\Program Files\SpySheriff" >>files.txt
dir "C:\Dokumente und Einstellungen\%UserName%\Lokale Einstellungen\Temp" >>files.txt
dir "C:\WINDOWS\Temp" >>files.txt
dir "C:\Temp" >>files.txt
dir "C:\Programme" >>files.txt
dir "C:\Dokumente und Einstellungen\%UserName%\Anwendungsdaten" >>files.txt
dir "C:\Programme\Gemeinsame Dateien" >>files.txt
dir "C:\Windows\System32" >>files.txt
notepad files.txt

__________
MfG Sabina

rund um die PC-Sicherheit

#30 Mach keinen Mist.Will net formatieren.

Irgendwie muss diese ver******wi***beschi***** Datei zu löschen sein.

Hier nochmal der kopierte Text aus der listen.bat:

Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: F001-1833

Verzeichnis von C:\WINDOWS\Downloaded Program Files

11.04.2006 17:10 135.168 asinst.dll
03.04.2006 11:00 537 asinst.inf
07.10.2004 22:16 815 bitdefender.inf
07.10.2004 23:05 327.680 bitdefender.ocx
25.06.2003 19:00 541 ca.pub
17.01.2006 17:11 580.663 daas_s.dll
03.02.2006 11:20 188.416 fsauc.dll
16.06.2006 15:31 181.856 fscax.dll
15.06.2006 10:19 483 fscax.inf
12.07.2000 03:02 36.864 fxfileop.dll
04.03.2005 04:52 752 jinstall-1_5_0_02.inf
09.10.2003 10:32 144 QTPlugin.inf
29.06.2005 16:12 <DIR> rave
18.04.2003 20:11 6.638 ravllio.vxd
04.09.2003 14:33 167.936 ravscan.dll
04.09.2003 14:34 290.816 ravupdt.dll
05.03.2003 20:27 381 ravupdt.ini
02.12.2005 12:55 5.101 swflash.inf
31.10.2001 11:37 118 uninst.bat
29.06.2005 16:12 11.023 update.log
19 Datei(en) 1.935.932 Bytes
1 Verzeichnis(se), 4.473.438.208 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: F001-1833

Verzeichnis von C:\Dokumente und Einstellungen\Stromi\Eigene Dateien

04.07.2006 16:18 <DIR> .
04.07.2006 16:18 <DIR> ..
26.10.2004 22:28 <DIR> Alle Handb�cher + Kurzanleitungen
08.01.2006 21:13 <DIR> Command & Conquer Gener„le Stunde Null Data
09.06.2005 17:51 <DIR> Command and Conquer Generals Data
28.10.2005 10:58 <DIR> Eigene Bilder
09.07.2006 12:15 <DIR> Eigene Musik
26.04.2006 08:34 <DIR> Eigene Wiedergabelisten
03.04.2006 20:15 <DIR> ICQ Lite
01.08.2005 21:50 <DIR> Meine empfangenen Dateien
14.01.2006 14:43 <DIR> My Skype Content
04.04.2006 10:53 <DIR> My Skype Pictures
19.06.2005 15:01 <DIR> My Skype Received Files
26.10.2004 23:09 <DIR> Nero Screensaver
26.10.2004 23:22 <DIR> Nero Wallpaper
27.06.2005 00:30 <DIR> NeroVision
17.07.2005 11:39 <DIR> The Incredibles
0 Datei(en) 0 Bytes
17 Verzeichnis(se), 4.473.438.208 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: F001-1833

Verzeichnis von C:\Dokumente und Einstellungen\Stromi\Lokale Einstellungen\Temp

10.07.2006 14:01 <DIR> .
10.07.2006 14:01 <DIR> ..
09.07.2006 19:54 16.384 4.tmp
09.07.2006 12:13 0 CacheInfo.dnl
09.07.2006 20:38 <DIR> F-Secure
10.07.2006 09:29 <DIR> hsperfdata_Stromi
27.02.2006 19:06 24.576 IadHide3.dll
10.07.2006 08:53 <DIR> IncrediMail
10.07.2006 10:54 2.678 jusched.log
09.07.2006 14:00 155 kb.log
10.07.2006 08:52 917.504 MFPL7014.DLL
09.07.2006 19:54 549.376 mso27B7C.xls
09.07.2006 21:42 <DIR> OnlineScanner
08.07.2006 18:02 <DIR> VBE
7 Datei(en) 1.510.673 Bytes
7 Verzeichnis(se), 4.473.438.208 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: F001-1833

Verzeichnis von C:\WINDOWS\Temp

10.07.2006 13:59 <DIR> .
10.07.2006 13:59 <DIR> ..
09.07.2006 22:22 <DIR> tmp000001da
09.07.2006 17:13 <DIR> tmp0000155a
09.07.2006 11:46 <DIR> tmp00001aae
09.07.2006 12:02 <DIR> tmp00002731
09.07.2006 20:32 <DIR> tmp00002d98
09.07.2006 23:27 <DIR> tmp0000333e
10.07.2006 10:45 <DIR> tmp00003a71
10.07.2006 08:06 <DIR> tmp00004075
08.07.2006 20:10 <DIR> tmp00004e1d
10.07.2006 13:58 <DIR> tmp00004e57
08.07.2006 17:25 <DIR> tmp00005084
10.07.2006 08:29 <DIR> tmp0000525e
08.07.2006 17:34 <DIR> tmp000056df
08.07.2006 17:45 <DIR> tmp00005f2c
08.07.2006 15:06 <DIR> tmp0000660b
09.07.2006 13:27 <DIR> tmp0000687e
09.07.2006 13:30 <DIR> tmp00006aac
08.07.2006 15:22 <DIR> tmp000071a9
08.07.2006 23:51 <DIR> tmp000077d9
0 Datei(en) 0 Bytes
21 Verzeichnis(se), 4.473.434.112 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: F001-1833

Verzeichnis von C:\Temp

25.06.2006 12:45 <DIR> .
25.06.2006 12:45 <DIR> ..
0 Datei(en) 0 Bytes
2 Verzeichnis(se), 4.473.434.112 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: F001-1833

Verzeichnis von C:\Programme

08.07.2006 15:10 <DIR> .
08.07.2006 15:10 <DIR> ..
28.05.2005 16:51 <DIR> Adobe
13.10.2005 05:04 <DIR> Canon
08.07.2006 15:10 <DIR> CCleaner
07.07.2006 09:30 <DIR> CleanUp!
28.05.2005 16:32 <DIR> ComPlus Applications
27.02.2006 19:06 <DIR> Desktop Messenger
16.04.2006 16:56 <DIR> directx
02.07.2005 17:41 <DIR> ewido
06.07.2006 10:07 <DIR> ewido anti-spyware 4.0
26.04.2006 08:22 <DIR> Gemeinsame Dateien
08.03.2006 00:10 <DIR> Google
03.04.2006 20:15 <DIR> ICQLite
09.07.2006 14:17 <DIR> ICQToolbar
28.10.2005 14:08 <DIR> IncrediMail
28.05.2005 17:36 <DIR> Internet Explorer
14.03.2006 16:14 <DIR> iPod
14.03.2006 16:14 <DIR> iTunes
01.04.2006 09:07 <DIR> Java
27.02.2006 19:06 <DIR> Logitech
30.06.2005 10:48 <DIR> Messenger
28.05.2005 16:36 <DIR> microsoft frontpage
28.05.2005 16:33 <DIR> Movie Maker
13.04.2006 21:06 <DIR> Mozilla Firefox
28.05.2005 16:31 <DIR> MSN
28.05.2005 16:32 <DIR> MSN Gaming Zone
28.05.2005 16:33 <DIR> NetMeeting
28.05.2005 16:32 <DIR> Online Services
28.05.2005 16:34 <DIR> Online-Dienste
28.05.2005 16:33 <DIR> Outlook Express
14.03.2006 16:16 <DIR> QuickTime
28.05.2005 21:11 <DIR> SiS7012
28.05.2005 16:57 <DIR> Softwin
19.10.2005 12:33 <DIR> ThriXXX
10.04.2006 18:42 <DIR> Ubi Soft
30.10.2005 18:49 <DIR> VideoLAN
28.05.2005 16:36 <DIR> Windows Media Player
28.05.2005 16:31 <DIR> Windows NT
28.05.2005 16:36 <DIR> xerox
0 Datei(en) 0 Bytes
40 Verzeichnis(se), 4.473.434.112 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: F001-1833

Verzeichnis von C:\Dokumente und Einstellungen\Stromi\Anwendungsdaten

07.10.2005 18:55 <DIR> Adobe
10.08.2005 19:36 <DIR> AdobeUM
20.10.2005 04:40 <DIR> Ahead
10.06.2006 14:02 <DIR> Apple Computer
26.04.2006 08:26 <DIR> DataLayer
08.09.2005 16:49 <DIR> Google
13.10.2005 05:05 <DIR> Help
03.04.2006 20:12 <DIR> ICQLite
28.05.2005 16:45 <DIR> Identities
27.04.2006 16:02 5 kc.tmp
02.08.2005 14:33 <DIR> Lavasoft
28.05.2005 17:46 <DIR> Macromedia
11.03.2006 23:31 <DIR> Mozilla
26.04.2006 08:37 <DIR> Nokia
26.04.2006 08:30 <DIR> Nokia Multimedia Player
26.04.2006 08:24 <DIR> PC Suite
16.06.2006 18:36 <DIR> Skype
28.05.2005 20:33 <DIR> Sun
11.03.2006 23:58 <DIR> Talkback
02.08.2005 01:17 <DIR> TuneUp Software
30.10.2005 18:50 <DIR> vlc
1 Datei(en) 5 Bytes
20 Verzeichnis(se), 4.473.430.016 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: F001-1833

Verzeichnis von C:\Programme\Gemeinsame Dateien

26.04.2006 08:22 <DIR> .
26.04.2006 08:22 <DIR> ..
29.05.2005 13:59 <DIR> Adobe
28.05.2005 22:08 <DIR> Ahead
28.05.2005 17:10 <DIR> Designer
28.05.2005 16:33 <DIR> Dienste
27.02.2006 18:54 <DIR> InstallShield
28.05.2005 20:31 <DIR> Java
15.04.2006 10:59 <DIR> Logitech
29.05.2005 22:37 <DIR> Microsoft Shared
28.05.2005 16:33 <DIR> MSSoap
26.04.2006 08:22 <DIR> Nokia
28.05.2005 17:24 <DIR> ODBC
26.04.2006 08:22 <DIR> PCSuite
28.10.2005 12:49 <DIR> Softwin
28.05.2005 17:24 <DIR> SpeechEngines
12.04.2006 22:16 <DIR> SWF Studio
10.07.2006 13:59 <DIR> System
0 Datei(en) 0 Bytes
18 Verzeichnis(se), 4.473.430.016 Bytes frei
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: F001-1833

Verzeichnis von C:\Windows\System32

08.07.2006 16:25 <DIR> .
08.07.2006 16:25 <DIR> ..
30.06.2005 10:55 611 $winnt$.inf
28.05.2005 18:19 <DIR> 1025
28.05.2005 18:19 <DIR> 1028
30.06.2005 12:40 <DIR> 1031
30.06.2005 12:37 <DIR> 1033
28.05.2005 18:19 <DIR> 1037
28.05.2005 18:19 <DIR> 1041
28.05.2005 18:19 <DIR> 1042
28.05.2005 18:19 <DIR> 1054
06.07.2006 21:57 <DIR> ActiveScan
03.04.2006 10:59 128 asinst.cfg
30.06.2005 10:43 <DIR> CatRoot
09.07.2006 20:34 <DIR> CatRoot2
14.02.2006 05:38 154 files.inf
01.04.2006 09:07 7.006 jupdate-1.5.0_06-b05.log