virus in system volume information?

triggerhappy

hallo,

bräuchte bitte mal eure hilfe,
vor zwei tagen hat avira das erste mal gemeckert nachdem ich ein java update von sun erlaubt habe, kommen viren jetzt auch schon vom hersteller?
war in eile habe daher nur zugriff verweigert, späterer scan mit malewarebytes brachte selbe meldung, habe virus in quarantäne verschoben, wo er allerdings nicht mehr ist!!! und auch nicht mehr gefunden wird..

SPR/Fake.Reg.Genie
C:SystemVolumeInformation
\...\A0019808.exe

hatte um die 5 ähnlichen warnungen..

habe jetzt im logfile vom avirascan die dateien wieder gefunden, habe versucht über google herauszufinden wie ich jetzt am besten vorgehe, nur erscheint es mir ein wenig wahnwitzig, wenn ich jetzt einfach dort auf verdacht alle .exe dateien per hand lösche.. da ich ja schließlich nicht weiss was da jetzt hingehört und was nicht..
wär toll wenn mir jmd helfen könnte!!!!

hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:22:23, on 30.08.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\cisvc.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Java\jre6\bin\jusched.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
c:\programme\avira\antivir desktop\avcenter.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/german/partner/de/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1235489033390
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238200549390
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe

--
End of file - 5328 bytes

und ein kurzer auszug von avira

C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP128\snapshot\
ComDb.Dat
domain.txt
_REGISTRY_MACHINE_SAM
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_USER_.DEFAULT
_REGISTRY_USER_NTUSER_S-1-5-18
_REGISTRY_USER_NTUSER_S-1-5-19
_REGISTRY_USER_NTUSER_S-1-5-20
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1003
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1005
_REGISTRY_USER_USRCLASS_S-1-5-19
_REGISTRY_USER_USRCLASS_S-1-5-20
_REGISTRY_USER_USRCLASS_S-1-5-21-1085031214-492894223-839522115-1003
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP128\snapshot\Repository\
$WinMgmt.CFG
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP128\snapshot\Repository\FS\
INDEX.BTR
INDEX.MAP
MAPPING.VER
MAPPING1.MAP
MAPPING2.MAP
OBJECTS.DATA
OBJECTS.MAP
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP129\
A0019804.ini
A0019805.lnk
A0019806.lnk
A0019807.lnk
A0019812.exe
change.log.1
drivetable.txt
RestorePointSize
rp.log
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP129\snapshot\
ComDb.Dat
domain.txt
_REGISTRY_MACHINE_SAM
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_USER_.DEFAULT
_REGISTRY_USER_NTUSER_S-1-5-18
_REGISTRY_USER_NTUSER_S-1-5-19
_REGISTRY_USER_NTUSER_S-1-5-20
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1003
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1005
_REGISTRY_USER_USRCLASS_S-1-5-19
_REGISTRY_USER_USRCLASS_S-1-5-20
_REGISTRY_USER_USRCLASS_S-1-5-21-1085031214-492894223-839522115-1003
_REGISTRY_USER_USRCLASS_S-1-5-21-1085031214-492894223-839522115-1005
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP129\snapshot\Repository\
$WinMgmt.CFG
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP129\snapshot\Repository\FS\
INDEX.BTR
INDEX.MAP
MAPPING.VER
MAPPING1.MAP
MAPPING2.MAP
OBJECTS.DATA
OBJECTS.MAP
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP130\
A0019813.lnk
A0019814.lnk
A0019815.lnk
A0019816.lnk
A0019817.lnk
A0019818.lnk
A0019819.lnk
A0019820.lnk
A0019821.lnk
A0019822.lnk
A0019823.dll
A0019824.dll
A0019825.dll
A0019826.manifest
A0019827.manifest
A0019828.dll
A0019829.dll
A0019830.dll
A0019831.manifest
A0019832.dll
A0019833.dll
A0019834.dll
A0019835.manifest
A0019836.manifest
A0019837.dll
A0019838.dll
A0019839.manifest
A0019840.dll
A0019841.dll
A0019842.dll
A0019843.manifest
A0019844.manifest
A0019845.dll
A0019846.dll
A0019847.manifest
A0019848.dll
A0019849.dll
A0019850.sys
A0019851.sys
A0019852.sys
A0019853.exe
A0019854.exe
A0019855.exe
A0019856.exe
A0019857.ico
A0019858.exe
change.log.1
drivetable.txt
RestorePointSize
rp.log
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP130\snapshot\
ComDb.Dat
domain.txt
_REGISTRY_MACHINE_SAM
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_USER_.DEFAULT
_REGISTRY_USER_NTUSER_S-1-5-18
_REGISTRY_USER_NTUSER_S-1-5-19
_REGISTRY_USER_NTUSER_S-1-5-20
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1003
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1005
_REGISTRY_USER_USRCLASS_S-1-5-19
_REGISTRY_USER_USRCLASS_S-1-5-20
_REGISTRY_USER_USRCLASS_S-1-5-21-1085031214-492894223-839522115-1003
_REGISTRY_USER_USRCLASS_S-1-5-21-1085031214-492894223-839522115-1005
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP130\snapshot\Repository\
$WinMgmt.CFG
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP130\snapshot\Repository\FS\
INDEX.BTR
INDEX.MAP
MAPPING.VER
MAPPING1.MAP
MAPPING2.MAP
OBJECTS.DATA
OBJECTS.MAP
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP131\
A0019859.msi
A0019860.ini
A0019861.ini
A0019862.ini
A0019863.ini
A0019864.inf
A0019865.PNF
A0019866.ini
A0019867.lnk
A0019868.LNK
A0019869.LNK
A0019870.LNK
A0019871.LNK
A0019872.LNK
A0019873.LNK
A0019874.ini
A0019875.ini
A0019876.mfl
A0019877.ini
A0019878.mfl
A0019879.ini
A0019880.ini
A0019881.ini
A0019882.ini
A0019883.inf
A0019884.PNF
A0019885.mfl
A0019886.ini
A0019887.ini
A0019888.ini
A0019889.ini
A0019890.TAG
A0019891.ini
A0019892.ini
A0019893.ini
A0019894.ini
A0019895.ini
A0019896.lnk
A0019897.TAG
A0019898.mfl
A0019899.ini
A0019900.lnk
A0019901.lnk
A0019902.lnk
A0019903.lnk
A0019904.lnk
A0019905.lnk
A0019906.lnk
A0019907.lnk
A0019908.lnk
A0019909.lnk
A0019910.lnk
A0019911.lnk
A0019912.lnk
A0019913.lnk
A0019914.lnk
A0019915.lnk
A0019916.lnk
A0019917.lnk
A0019918.lnk
A0019919.lnk
A0019920.lnk
A0019921.lnk
A0019922.lnk
A0019923.lnk
A0019924.lnk
A0019925.lnk
A0019926.lnk
A0019927.lnk
A0019928.lnk
A0019929.lnk
A0019930.lnk
A0019931.lnk
A0019932.ini
A0019933.exe
A0019933.exe:Zone.Identifier
A0019934.ini
A0019936.dll
A0019937.dll
A0019938.dll
A0019939.dll
A0019940.dll
A0019941.dll
A0019942.dll
A0019943.dll
A0019944.dll
A0019945.dll
A0019946.dll
A0019947.dll
A0019948.dll
A0019949.dll
A0019950.dll
A0019951.ini
A0020952.ini
A0020953.ini
A0020954.ini
A0020955.inf
A0020956.PNF
A0020957.ini
A0020958.ini
A0020959.ini
A0020960.ini
A0020961.ini
A0020962.ini
change.log.1
change.log.2
change.log.3
change.log.4
change.log.5
change.log.6
change.log.7
change.log.8
drivetable.txt
RestorePointSize
rp.log
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP131\snapshot\
ComDb.Dat
domain.txt
_REGISTRY_MACHINE_SAM
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_USER_.DEFAULT
_REGISTRY_USER_NTUSER_S-1-5-18
_REGISTRY_USER_NTUSER_S-1-5-19
_REGISTRY_USER_NTUSER_S-1-5-20
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1003
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1005
_REGISTRY_USER_USRCLASS_S-1-5-19
_REGISTRY_USER_USRCLASS_S-1-5-20
_REGISTRY_USER_USRCLASS_S-1-5-21-1085031214-492894223-839522115-1003
_REGISTRY_USER_USRCLASS_S-1-5-21-1085031214-492894223-839522115-1005
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP131\snapshot\Repository\
$WinMgmt.CFG
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP131\snapshot\Repository\FS\
INDEX.BTR
INDEX.MAP
MAPPING.VER
MAPPING1.MAP
MAPPING2.MAP
OBJECTS.DATA
OBJECTS.MAP
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP132\
A0020963.ini
A0020964.ini
A0020965.ini
A0020966.ini
A0020967.ini
A0020968.ini
A0020969.ini
A0020970.ini
A0020971.ini
A0020972.ini
A0020973.lnk
A0020974.lnk
A0020975.lnk
A0020976.lnk
A0020977.lnk
A0020978.lnk
A0020979.ini
A0020980.ini
A0020981.ini
A0020982.ini
A0020983.dll
A0020984.dll
A0020985.dll
A0020986.dll
A0020987.dll
A0020988.dll
A0020989.dll
A0020990.dll
A0020991.dll
A0020992.dll
A0020993.dll
A0020994.dll
A0020995.dll
A0020996.dll
A0020997.lnk
A0020998.lnk
A0020999.lnk
A0021000.lnk
A0021001.lnk
A0021002.lnk
A0021003.lnk
A0021004.lnk
A0021005.lnk
A0021006.lnk
A0021007.lnk
A0021008.lnk
A0021009.mfl
A0021010.ini
A0021011.ini
A0021012.ini
A0021013.ini
A0021014.ini
A0021015.mfl
A0021016.ini
A0021017.ini
A0021018.ini
A0021019.ini
A0021020.dll
A0021021.dll
A0021022.dll
A0021023.dll
A0021024.dll
A0021025.dll
A0021026.dll
A0021027.dll
A0021028.dll
A0021029.dll
A0021030.dll
A0021031.dll
A0021032.dll
A0021033.dll
A0021034.ini
A0021035.ini
A0021036.ini
A0021037.ini
change.log.1
change.log.2
change.log.3
change.log.4
change.log.5
change.log.6
change.log.7
drivetable.txt
RestorePointSize
rp.log
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP132\snapshot\
ComDb.Dat
domain.txt
_REGISTRY_MACHINE_SAM
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_USER_.DEFAULT
_REGISTRY_USER_NTUSER_S-1-5-18
_REGISTRY_USER_NTUSER_S-1-5-19
_REGISTRY_USER_NTUSER_S-1-5-20
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1003
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1005
_REGISTRY_USER_USRCLASS_S-1-5-19
_REGISTRY_USER_USRCLASS_S-1-5-20
_REGISTRY_USER_USRCLASS_S-1-5-21-1085031214-492894223-839522115-1005
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP132\snapshot\Repository\
$WinMgmt.CFG
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP132\snapshot\Repository\FS\
INDEX.BTR
INDEX.MAP
MAPPING.VER
MAPPING1.MAP
MAPPING2.MAP
OBJECTS.DATA
OBJECTS.MAP
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP133\
A0021038.ini
A0021039.ini
A0021040.ini
A0021041.ini
A0021042.lnk
A0021043.ini
A0021044.ini
A0021045.ini
A0021046.ini
A0021047.ini
A0021048.mfl
A0021049.ini
A0021050.ini
A0021051.ini
A0021052.mfl
A0021053.ini
A0021054.ini
A0021055.ini
A0021056.ini
A0021057.inf
A0021058.PNF
A0021059.ini
A0021060.dll
A0021061.dll
A0021062.dll
A0021063.dll
A0021064.dll
A0021065.dll
A0021066.dll
A0021067.dll
A0021068.dll
A0021069.dll
A0021070.dll
A0021071.dll
A0021072.dll
A0021073.dll
A0021074.mfl
A0021075.ini
A0021076.ini
A0021077.ini
A0021078.ini
A0021079.mfl
A0021080.ini
A0021081.manifest
A0021082.dll
A0021083.dll
A0021084.ini
A0021085.mfl
change.log.1
change.log.2
change.log.3
change.log.4
drivetable.txt
RestorePointSize
rp.log
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP133\snapshot\
ComDb.Dat
domain.txt
_REGISTRY_MACHINE_SAM
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_USER_.DEFAULT
_REGISTRY_USER_NTUSER_S-1-5-18
_REGISTRY_USER_NTUSER_S-1-5-19
_REGISTRY_USER_NTUSER_S-1-5-20
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1003
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1005
_REGISTRY_USER_USRCLASS_S-1-5-19
_REGISTRY_USER_USRCLASS_S-1-5-20
_REGISTRY_USER_USRCLASS_S-1-5-21-1085031214-492894223-839522115-1005
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP133\snapshot\Repository\
$WinMgmt.CFG
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP133\snapshot\Repository\FS\
INDEX.BTR
INDEX.MAP
MAPPING.VER
MAPPING1.MAP
MAPPING2.MAP
OBJECTS.DATA
OBJECTS.MAP
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP134\
A0021086.mfl
A0021087.ini
A0021088.ini
A0021089.ini
A0021090.ini
A0021091.mfl
A0021092.dll
A0021093.dll
A0021094.dll
A0021095.dll
A0021096.dll
A0021097.dll
A0021098.dll
A0021099.dll
A0021100.dll
A0021101.dll
A0021102.dll
A0021103.dll
A0021104.dll
A0021105.dll
A0021106.dll
A0021107.dll
A0021108.dll
A0021109.dll
A0021110.ini
A0021111.ini
A0021112.ini
A0021113.ini
A0021114.mfl
change.log.1
change.log.2
change.log.3
drivetable.txt
RestorePointSize
rp.log
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP134\snapshot\
ComDb.Dat
domain.txt
_REGISTRY_MACHINE_SAM
_REGISTRY_MACHINE_SECURITY
_REGISTRY_MACHINE_SOFTWARE
_REGISTRY_MACHINE_SYSTEM
_REGISTRY_USER_.DEFAULT
_REGISTRY_USER_NTUSER_S-1-5-18
_REGISTRY_USER_NTUSER_S-1-5-19
_REGISTRY_USER_NTUSER_S-1-5-20
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1003
_REGISTRY_USER_NTUSER_S-1-5-21-1085031214-492894223-839522115-1005
_REGISTRY_USER_USRCLASS_S-1-5-19
_REGISTRY_USER_USRCLASS_S-1-5-20
_REGISTRY_USER_USRCLASS_S-1-5-21-1085031214-492894223-839522115-1005
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP134\snapshot\Repository\
$WinMgmt.CFG
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP134\snapshot\Repository\FS\
INDEX.BTR
INDEX.MAP
MAPPING.VER
MAPPING1.MAP
MAPPING2.MAP
OBJECTS.DATA
OBJECTS.MAP
C:\System Volume Information\_restore{1E9F494D-B84E-4F9E-8217-50E56345C954}\RP135\
A0021115.ini
A0021116.ini
A0021117.ini
A0021118.ini
A0021119.dll
A0021120.dll
A0021121.dll
A0021122.dll
A0021123.dll
A0021124.dll
A0021125.dll
A0021126.dll
A0021127.dll
A0021128.dll
A0021129.dll
A0021130.dll
A0021131.dll
A0021132.dll
A0021133.mfl
A0021134.ini
A0021135.ini
A0021136.ini
A0021137.ini
A0021138.ini
A0021139.ini
A0021140.ini
A0021141.ini
A0021142.ini
A0021143.lnk
A0021144.lnk
A0021145.lnk
A0021146.lnk
A0021147.lnk
A0021148.lnk
A0021149.lnk
A0021150.lnk
A0021151.lnk
A0021152.lnk
A0021153.lnk
A0021154.lnk
A0021155.lnk
A0021156.lnk
A0021157.lnk
A0021158.lnk
A0021159.lnk
A0021160.lnk
A0021161.lnk
A0021162.lnk
A0021163.lnk
A0021164.lnk
A0021165.lnk
A0021166.lnk
A0021167.lnk
A0021168.lnk
A0021169.lnk
A0021170.lnk
A0021171.lnk
A0021172.lnk
A0021173.lnk
A0021174.lnk
A0021175.lnk
A0021176.lnk
A0021177.lnk
A0021178.lnk
A0021179.lnk
A0021180.ini
A0021181.lnk
A0021182.ini
A0021184.LNK
A0021185.LNK
A0021186.LNK
A0021187.LNK
A0021188.LNK
A0021189.LNK
A0021190.ini
A0021191.ini
A0021192.ref
A0021193.lnk
A0021194.lnk
A0021195.lnk
A0021196.lnk
A0021197.lnk
A0021198.lnk
A0021199.lnk
change.log.1
change.log.2
change.log.3
change.log.4
drivetable.txt
RestorePointSize
rp.log