Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Doppelklick auf Internet öffnet nur den Prozess, nicht das Fenster(Ob IE,FF oder Opera) (https://www.trojaner-board.de/91976-doppelklick-internet-oeffnet-nur-prozess-fenster-ob-ie-ff-opera.html)

Wolfen 21.10.2010 18:45
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 19:39:14 on 21.10.2010

OS: Windows 7 Ultimate Edition (Build 7600), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.10

Scanner Settings
Rootkits detection (hidden registry)
Rootkits detection (hidden files)
Retrieve files information
Check Microsoft signatures

Filters
Trusted entries
Empty entries
Hidden registry entries (rootkit activity)
Exclusively opened files
Not found files
Files without detailed information
Existing files
Non-startable services
Non-startable drivers
Active entries
Disabled entries

  Risk Name Publisher Full Path Status
Control Panel Objects
%SystemRoot%\system32
 ||    "DivXControlPanelApplet.cpl" "DivX, Inc." D:\Windows\system32\DivXControlPanelApplet.cpl File exists
 |||||| "nvcpl.cpl" "NVIDIA Corporation" D:\Windows\system32\nvcpl.cpl File exists
 |||||| "PhysX.cpl"  D:\Windows\system32\PhysX.cpl File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
 |||||| "mlcfg32.cpl" "Microsoft Corporation" D:\PROGRA~1\MIF5BA~1\Office12\MLCFG32.CPL File exists
 |||||| "QuickTime" "Apple Inc." D:\Program Files\QuickTime\QTSystem\QuickTime.cpl File exists
Drivers
HKLM\SYSTEM\CurrentControlSet\Services
 |||||| "avgio" (avgio) "Avira GmbH" D:\Program Files\Avira\AntiVir Desktop\avgio.sys File exists
 |||||| "avgntflt" (avgntflt) "Avira GmbH" D:\Windows\System32\DRIVERS\avgntflt.sys File exists
 |||||| "avipbb" (avipbb) "Avira GmbH" D:\Windows\System32\DRIVERS\avipbb.sys File exists
        "catchme" (catchme)  D:\Users\XXXXXX\AppData\Local\Temp\catchme.sys File not found
 |||||| "gdrv" (gdrv) "Windows (R) 2000 DDK provider" D:\Windows\gdrv.sys File exists
        "pwddyfob" (pwddyfob)  D:\Users\XXXX\AppData\Local\Temp\pwddyfob.sys Hidden registry entry, rootkit activity | File not found
 |||||| "SCDEmu" (SCDEmu) "PowerISO Computing, Inc." D:\Windows\system32\drivers\SCDEmu.sys File exists
 |||||| "ssmdrv" (ssmdrv) "Avira GmbH" D:\Windows\System32\DRIVERS\ssmdrv.sys File exists
 |||||| "TuneUpUtilitiesDrv" (TuneUpUtilitiesDrv) "TuneUp Software" D:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys File exists
Explorer
HKLM\Software\Classes\Folder\shellex\ColumnHandlers
 |||||| {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" "Adobe Systems, Inc." D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll File exists
HKLM\Software\Classes\Protocols\Filter
 |||||| {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" "Microsoft Corporation" D:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL File exists
HKLM\Software\Classes\Protocols\Handler
 |||||| {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" "Microsoft Corporation" D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll File exists
 |||||| {03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" "Microsoft Corporation" D:\Program Files\Windows Live\Mail\mailcomm.dll File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
 |||||| {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists
        {AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"  File not found | COM-object registry key not found
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
 |||||| {0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" "Microsoft Corporation" D:\Program Files\Windows Live\Mail\mailcomm.dll File exists
 |||||| {A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" "NVIDIA Corporation" D:\Windows\system32\nvcpl.dll File exists
 |||||| {872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" "Advanced Micro Devices, Inc." D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll File exists
 ||    {D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" "DivX, Inc." D:\Program Files\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll File exists
 ||    {83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" "DivX, Inc." D:\Program Files\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll File exists
 |||||| {99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists
 |||||| {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists
 |||||| {920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists
 |||||| {16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists
 |||||| {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists
 |||||| {2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists
        {72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper"  File not found | COM-object registry key not found
 |||||| {6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists
 |||||| {B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists
 |||||| {A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists
 |||||| {387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll File exists
 |||||| {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" "Apple Inc." D:\Program Files\iTunes\iTunesMiniPlayer.dll File exists
 |||||| {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\msohevi.dll File exists
 |||||| {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" "Microsoft Corporation" D:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll File exists
 |||||| {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" "Microsoft Corporation" D:\PROGRA~1\MIF5BA~1\Office12\ONFILTER.DLL File exists
 |||||| {00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" "Microsoft Corporation" D:\PROGRA~1\MIF5BA~1\Office12\MLSHEXT.DLL File exists
 |||||| {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" "Microsoft Corporation" D:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll File exists
 |||||| {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" "NVIDIA Corporation" D:\Windows\system32\nvshext.dll File exists
 |||||| {FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" "NVIDIA Corporation" D:\Windows\system32\nvcpl.dll File exists
 |||||| {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" "Microsoft Corporation" D:\PROGRA~1\MIF5BA~1\Office12\OLKFSTUB.DLL File exists
 |||||| {967B2D40-8B7D-4127-9049-61EA0C2C6DCE} "PowerISO" "PowerISO Computing, Inc." D:\Program Files\PowerISO\PWRISOSH.DLL File exists
 |||||| {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" "RealNetworks, Inc." D:\Program Files\Real\RealPlayer\rpshell.dll File exists
 |||||| {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" "Avira GmbH" D:\Program Files\Avira\AntiVir Desktop\shlext.dll File exists
 |||||| {5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" "Advanced Micro Devices, Inc." D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll File exists
        {4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" "TuneUp Software" D:\Program Files\TuneUp Utilities 2010\DseShExt-x86.dll File exists
        {4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" "TuneUp Software" D:\Program Files\TuneUp Utilities 2010\SDShelEx-win32.dll File exists
        {44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" "TuneUp Software" D:\Windows\System32\uxtuneup.dll File exists
 |||||| {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" "Microsoft Corporation" D:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe File exists
 |||||| {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" "Microsoft Corporation" D:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe File exists
 |||||| {00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" "Microsoft Corporation" D:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll File exists
 |||||| {00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" "Microsoft Corporation" D:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll File exists
 |||||| {00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" "Microsoft Corporation" D:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll File exists
 |||||| {00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" "Microsoft Corporation" D:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe File exists
 |||||| {00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" "Microsoft Corporation" D:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll File exists
 |||||| {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" "Alexander Roshal" D:\Program Files\WinRAR\rarext.dll File exists
 |||||| {06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" "Microsoft Corporation" D:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe File exists
Internet Explorer
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
        ITBar7Height "ITBar7Height"  File not found | COM-object registry key not found
        "ITBar7Layout"  File not found | COM-object registry key not found
        "{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"  File not found | COM-object registry key not found
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks
 ||    {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} "DeviceVM Url Search Hook" "DeviceVM Inc." D:\Windows\System32\dvmurl.dll File exists
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units
 ||||  {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab "Sun Microsystems, Inc." D:\Program Files\Java\jre6\bin\jp2iexp.dll File exists
 ||||  {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab "Sun Microsystems, Inc." D:\Program Files\Java\jre6\bin\jp2iexp.dll File exists
 ||||  {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab "Sun Microsystems, Inc." D:\Program Files\Java\jre6\bin\npjpi160_15.dll File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
 |||||| {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" "Adobe Systems Incorporated" D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll File exists
 ||||  {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" "Sun Microsystems, Inc." D:\Program Files\Java\jre6\bin\jp2ssv.dll File exists
Logon
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
 |||||| "desktop.ini"  D:\Users\XXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini File exists
%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup
 |||||| "desktop.ini"  D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
 |||||| "avgnt" "Avira GmbH" "D:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min File exists
 |||||| "Malwarebytes Anti-Malware (reboot)" "Malwarebytes Corporation" "D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript File exists
Print Monitors
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
 |||||| "Send To Microsoft OneNote Monitor" "Microsoft Corporation" D:\Windows\system32\msonpmon.dll File exists
Services
HKLM\SYSTEM\CurrentControlSet\Services
        "@%SystemRoot%\System32\uxtuneup.dll,-4096" (UxTuneUp) "TuneUp Software" D:\Windows\System32\uxtuneup.dll File exists
        "@D:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe,-1" (TuneUp.Defrag) "TuneUp Software" D:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe File exists
        "Acronis OS Selector Reinstall Service" (AcronisOSSReinstallSvc)  D:\Windows\system32\drivers\AcronisOSSReinstallSvc.sys File not found
 |||||| "Apple Mobile Device" (Apple Mobile Device) "Apple Inc." D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe File exists
 |||||| "Avira AntiVir Guard" (AntiVirService) "Avira GmbH" D:\Program Files\Avira\AntiVir Desktop\avguard.exe File exists
 |||||| "Avira AntiVir Planer" (AntiVirSchedulerService) "Avira GmbH" D:\Program Files\Avira\AntiVir Desktop\sched.exe File exists
 |||||| "Dienst "Bonjour"" (Bonjour Service) "Apple Inc." D:\Program Files\Bonjour\mDNSResponder.exe File exists
 |||||| "ES lite Service for program management." (ES lite Service)  D:\Program Files\Gigabyte\EasySaver\ESSVR.EXE File found, but it contains no detailed information
        "Google Software Updater" (gusvc)  D:\Windows\system32\drivers\gusvc.sys File not found
 ||||  "InstallDriver Table Manager" (IDriverT) "Macrovision Corporation" D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe File exists
 |||||| "iPod-Dienst" (iPod Service) "Apple Inc." D:\Program Files\iPod\bin\iPodService.exe File exists
 |||||| "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) "Microsoft Corporation" D:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe File exists
 |||||| "Microsoft Office Diagnostics Service" (odserv) "Microsoft Corporation" D:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE File exists
 |||||| "Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) "Microsoft Corporation" D:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe File exists
 |||||| "NVIDIA Display Driver Service" (nvsvc) "NVIDIA Corporation" D:\Windows\system32\nvvsvc.exe File exists
 |||||| "Office Source Engine" (ose) "Microsoft Corporation" D:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE File exists
 |||||| "PnkBstrA" (PnkBstrA)  D:\Windows\system32\PnkBstrA.exe File found, but it contains no detailed information
 |||||| "PnkBstrB" (PnkBstrB)  D:\Windows\system32\PnkBstrB.exe File found, but it contains no detailed information
        "TuneUp Utilities Service" (TuneUp.UtilitiesSvc) "TuneUp Software" D:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe File exists
Winsock Providers
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries
 |||||| "mdnsNSP" "Apple Inc." D:\Program Files\Bonjour\mdnsNSP.dll File exists

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Is des normal das der meine Festplatte nich erkennt? O.o
Code:
GMER 1.0.15.15477 - hxxp://www.gmer.net
Rootkit quick scan 2010-10-21 19:08:21
Windows 6.1.7600
Running: vdgb4w4b.exe; Driver: D:\Users\Florian\AppData\Local\Temp\pwddyfob.sys


---- Devices - GMER 1.0.15 ----

Device          \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0                                                                                                      86F73292
Device          \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1                                                                                                      86F73292
Device          \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP3T1L0-6                                                                                            86F73292
Device          \Driver\atapi -> DriverStartIo \Device\Ide\IdePort2                                                                                                      86F73292
Device          \Driver\atapi -> DriverStartIo \Device\Ide\IdePort3                                                                                                      86F73292

AttachedDevice  \FileSystem\fastfat \Fat                                                                                                                                fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

Device          \Device\Ide\IdeDeviceP1T0L0-1 -> \??\IDE#DiskWDC_WD5000AACS-00G8B1___________________05.04C05#5&2819dde3&0&1.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}  device not found

---- EOF - GMER 1.0.15 ----

Code:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:           
Windows Version:        Windows 7 Ultimate Edition
Windows Information:        (build 7600), 32-bit
Base Board Manufacturer:    Gigabyte Technology Co., Ltd.
BIOS Manufacturer:        Award Software International, Inc.
System Manufacturer:        Gigabyte Technology Co., Ltd.
System Product Name:        GA-MA780G-UD3H
Logical Drives Mask:        0x0000003d

Kernel Drivers (total 211):
  0x8363A000 \SystemRoot\system32\ntkrnlpa.exe
  0x83603000 \SystemRoot\system32\halmacpi.dll
  0x87105000 \SystemRoot\system32\kdcom.dll
  0x83C3A000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll
  0x83C45000 \SystemRoot\system32\PSHED.dll
  0x83C56000 \SystemRoot\system32\BOOTVID.dll
  0x83C5E000 \SystemRoot\system32\CLFS.SYS
  0x83CA0000 \SystemRoot\system32\CI.dll
  0x83D4B000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x83DBC000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x83E22000 \SystemRoot\system32\DRIVERS\ACPI.sys
  0x83E6A000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
  0x83E73000 \SystemRoot\system32\DRIVERS\msisadrv.sys
  0x83E7B000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
  0x83E86000 \SystemRoot\system32\DRIVERS\pci.sys
  0x83EB0000 \SystemRoot\System32\drivers\partmgr.sys
  0x83EC1000 \SystemRoot\system32\DRIVERS\volmgr.sys
  0x83ED1000 \SystemRoot\System32\drivers\volmgrx.sys
  0x83F1C000 \SystemRoot\system32\DRIVERS\pciide.sys
  0x83F23000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
  0x83F31000 \SystemRoot\System32\drivers\mountmgr.sys
  0x83F47000 \SystemRoot\system32\DRIVERS\atapi.sys
  0x83F50000 \SystemRoot\system32\DRIVERS\ataport.SYS
  0x83F73000 \SystemRoot\system32\DRIVERS\amdxata.sys
  0x83F7C000 \SystemRoot\system32\drivers\fltmgr.sys
  0x83FB0000 \SystemRoot\system32\drivers\fileinfo.sys
  0x8C42A000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8C559000 \SystemRoot\System32\Drivers\msrpc.sys
  0x8C584000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8C597000 \SystemRoot\System32\Drivers\cng.sys
  0x8C400000 \SystemRoot\System32\drivers\pcw.sys
  0x8C40E000 \SystemRoot\System32\Drivers\Fs_Rec.sys
  0x8C611000 \SystemRoot\system32\drivers\ndis.sys
  0x8C6C8000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8C706000 \SystemRoot\System32\Drivers\ksecpkg.sys
  0x8C811000 \SystemRoot\System32\drivers\tcpip.sys
  0x8C95A000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x8C98B000 \SystemRoot\system32\DRIVERS\vmstorfl.sys
  0x8C994000 \SystemRoot\system32\DRIVERS\volsnap.sys
  0x8C9D3000 \SystemRoot\System32\Drivers\spldr.sys
  0x8C72B000 \SystemRoot\System32\drivers\rdyboost.sys
  0x8C9DB000 \SystemRoot\System32\Drivers\mup.sys
  0x8C9EB000 \SystemRoot\System32\drivers\hwpolicy.sys
  0x8C758000 \SystemRoot\System32\DRIVERS\fvevol.sys
  0x8C800000 \SystemRoot\system32\DRIVERS\disk.sys
  0x8C78A000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
  0x8C7D4000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8C7F3000 \SystemRoot\System32\Drivers\Null.SYS
  0x8C600000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8C417000 \SystemRoot\System32\drivers\vga.sys
  0x83FC1000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x83FE2000 \SystemRoot\System32\drivers\watchdog.sys
  0x8C607000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8C5F4000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x83FEF000 \SystemRoot\system32\drivers\rdprefmp.sys
  0x83E00000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x83E0B000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x83DCA000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x83DE1000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x9163A000 \SystemRoot\system32\drivers\afd.sys
  0x91694000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x916C6000 \SystemRoot\system32\DRIVERS\wfplwf.sys
  0x916CD000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x916EC000 \SystemRoot\system32\DRIVERS\vwififlt.sys
  0x916FD000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x9170B000 \SystemRoot\system32\DRIVERS\serial.sys
  0x91725000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x91738000 \SystemRoot\System32\Drivers\Uim_IM.sys
  0x91756000 \SystemRoot\System32\Drivers\UimFIO.SYS
  0x91787000 \SystemRoot\system32\DRIVERS\UimBus.sys
  0x9178E000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x9179E000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x917A4000 \SystemRoot\System32\Drivers\SCDEmu.SYS
  0x917B2000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x917F3000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x91600000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x9160A000 \SystemRoot\System32\drivers\discache.sys
  0x91A13000 \SystemRoot\system32\drivers\csc.sys
  0x91A77000 \SystemRoot\System32\Drivers\dfsc.sys
  0x91A8F000 \SystemRoot\system32\DRIVERS\blbdrive.sys
  0x91A9D000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x91ABF000 \??\D:\Program Files\Avira\AntiVir Desktop\avgio.sys
  0x91AC1000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x91AE2000 \SystemRoot\system32\DRIVERS\amdppm.sys
  0x91AF3000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
  0x91AFC000 \SystemRoot\system32\DRIVERS\atikmpag.sys
  0x9202F000 \SystemRoot\system32\DRIVERS\atipmdag.sys
  0x91B26000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x92590000 \SystemRoot\System32\drivers\dxgmms1.sys
  0x925C9000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x92000000 \SystemRoot\system32\DRIVERS\Rt86win7.sys
  0x92025000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0x9643B000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x96486000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x96495000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0x9649B000 \SystemRoot\system32\DRIVERS\1394ohci.sys
  0x964C7000 \SystemRoot\system32\DRIVERS\fdc.sys
  0x964D2000 \SystemRoot\system32\DRIVERS\serenum.sys
  0x964DC000 \SystemRoot\system32\DRIVERS\parport.sys
  0x964F4000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
  0x96501000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
  0x96513000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x9652B000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x96536000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x96558000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x96570000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x96587000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x9659E000 \SystemRoot\system32\DRIVERS\rdpbus.sys
  0x965A8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x965B5000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x965C2000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x965C4000 \SystemRoot\system32\DRIVERS\ks.sys
  0x96400000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x96A22000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x96A66000 \SystemRoot\system32\DRIVERS\flpydisk.sys
  0x96A70000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x96A81000 \SystemRoot\system32\drivers\AtiHdmi.sys
  0x96A9F000 \SystemRoot\system32\drivers\portcls.sys
  0x96ACE000 \SystemRoot\system32\drivers\drmk.sys
  0x81E2D000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8203C000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x82049000 \SystemRoot\System32\Drivers\dump_dumpata.sys
  0x82054000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0x8205D000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
  0x8206E000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x82079000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8208C000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x82093000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x82610000 \SystemRoot\System32\win32k.sys
  0x82095000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8209F000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x820AA000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x820C1000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0x820CD000 \SystemRoot\system32\DRIVERS\NuidFltr.sys
  0x820D4000 \SystemRoot\system32\drivers\usbaudio.sys
  0x820E8000 \SystemRoot\System32\Drivers\BTHUSB.sys
  0x820FA000 \SystemRoot\System32\Drivers\bthport.sys
  0x8215E000 \SystemRoot\system32\DRIVERS\rfcomm.sys
  0x82182000 \SystemRoot\system32\DRIVERS\BthEnum.sys
  0x8218F000 \SystemRoot\system32\DRIVERS\bthpan.sys
  0x821AA000 \SystemRoot\system32\DRIVERS\bthmodem.sys
  0x821BC000 \SystemRoot\system32\drivers\modem.sys
  0x821C9000 \SystemRoot\system32\DRIVERS\BthAvrcp.sys
  0x821D3000 \SystemRoot\system32\DRIVERS\hidbth.sys
  0x821EE000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x82870000 \SystemRoot\System32\TSDDD.dll
  0x828A0000 \SystemRoot\System32\cdd.dll
  0x828C0000 \SystemRoot\System32\ATMFD.DLL
  0x81E00000 \SystemRoot\system32\drivers\luafv.sys
  0x96AE7000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x96AFC000 \SystemRoot\system32\drivers\WudfPf.sys
  0x9F947000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
  0x9F949000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x9F959000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x9F99F000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x9F9AF000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x9F000000 \SystemRoot\system32\drivers\HTTP.sys
  0x9F085000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9F09E000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9F0B0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x9F0D3000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9F10E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x9F129000 \SystemRoot\system32\DRIVERS\parvdm.sys
  0x9F130000 \SystemRoot\system32\drivers\peauth.sys
  0x9F1C7000 \SystemRoot\System32\Drivers\secdrv.SYS
  0x9F1D1000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x9F1F2000 \SystemRoot\System32\drivers\tcpipreg.sys
  0x9F269000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9F2B8000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9F309000 \??\D:\Windows\gdrv.sys
  0x9F30C000 \??\D:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys
  0x9F30D000 \??\D:\Users\XXXXX\AppData\Local\Temp\pwddyfob.sys
  0x778B0000 \Windows\System32\ntdll.dll
  0x483B0000 \Windows\System32\smss.exe
  0x77AF0000 \Windows\System32\apisetschema.dll
  0x00BD0000 \Windows\System32\autochk.exe
  0x77A90000 \Windows\System32\gdi32.dll
  0x779F0000 \Windows\System32\usp10.dll
  0x77770000 \Windows\System32\urlmon.dll
  0x776E0000 \Windows\System32\oleaut32.dll
  0x77630000 \Windows\System32\rpcrt4.dll
  0x775F0000 \Windows\System32\ws2_32.dll
  0x775E0000 \Windows\System32\normaliz.dll
  0x775D0000 \Windows\System32\lpk.dll
  0x77500000 \Windows\System32\user32.dll
  0x774F0000 \Windows\System32\psapi.dll
  0x77390000 \Windows\System32\ole32.dll
  0x77340000 \Windows\System32\Wldap32.dll
  0x772E0000 \Windows\System32\shlwapi.dll
  0x770E0000 \Windows\System32\iertutil.dll
  0x76FE0000 \Windows\System32\wininet.dll
  0x76F00000 \Windows\System32\kernel32.dll
  0x76E30000 \Windows\System32\msctf.dll
  0x76E10000 \Windows\System32\sechost.dll
  0x76D70000 \Windows\System32\advapi32.dll
  0x76D50000 \Windows\System32\imm32.dll
  0x76100000 \Windows\System32\shell32.dll
  0x760F0000 \Windows\System32\nsi.dll
  0x76060000 \Windows\System32\clbcatq.dll
  0x75FE0000 \Windows\System32\comdlg32.dll
  0x75F30000 \Windows\System32\msvcrt.dll
  0x75F00000 \Windows\System32\imagehlp.dll
  0x75EA0000 \Windows\System32\difxapi.dll
  0x75D00000 \Windows\System32\setupapi.dll
  0x75BE0000 \Windows\System32\crypt32.dll
  0x75BB0000 \Windows\System32\wintrust.dll
  0x75B60000 \Windows\System32\KernelBase.dll
  0x75AD0000 \Windows\System32\comctl32.dll
  0x75AA0000 \Windows\System32\cfgmgr32.dll
  0x75A80000 \Windows\System32\devobj.dll
  0x75A70000 \Windows\System32\msasn1.dll

Processes (total 47):
      0 System Idle Process
      4 System
    352 D:\Windows\System32\smss.exe
    488 csrss.exe
    568 csrss.exe
    576 D:\Windows\System32\wininit.exe
    624 D:\Windows\System32\winlogon.exe
    672 D:\Windows\System32\services.exe
    680 D:\Windows\System32\lsass.exe
    688 D:\Windows\System32\lsm.exe
    784 D:\Windows\System32\svchost.exe
    892 D:\Windows\System32\svchost.exe
    988 D:\Windows\System32\atiesrxx.exe
    1032 D:\Windows\System32\svchost.exe
    1072 D:\Windows\System32\svchost.exe
    1108 D:\Windows\System32\svchost.exe
    1288 D:\Windows\System32\svchost.exe
    1336 D:\Windows\System32\atieclxx.exe
    1484 D:\Windows\System32\svchost.exe
    1712 D:\Windows\System32\dwm.exe
    1732 D:\Windows\explorer.exe
    1772 D:\Windows\System32\spoolsv.exe
    1852 D:\Windows\System32\taskhost.exe
    1888 D:\Program Files\Avira\AntiVir Desktop\sched.exe
    1952 D:\Windows\System32\svchost.exe
    496 D:\Program Files\Avira\AntiVir Desktop\avguard.exe
    564 D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    800 D:\Program Files\Bonjour\mDNSResponder.exe
    908 D:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    1364 D:\Program Files\Gigabyte\EasySaver\essvr.exe
    1516 D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    1824 D:\Windows\System32\conhost.exe
    1584 D:\Windows\System32\svchost.exe
    1120 D:\Windows\System32\PnkBstrA.exe
    2128 D:\Windows\System32\PnkBstrB.exe
    2252 D:\Windows\System32\svchost.exe
    2292 D:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
    2444 D:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
    2800 D:\Windows\System32\svchost.exe
    3656 D:\Program Files\Windows Media Player\wmpnetwk.exe
    3784 D:\Windows\System32\svchost.exe
    996 WmiPrvSE.exe
    3308 D:\Program Files\Mozilla Firefox\firefox.exe
    3292 D:\Windows\System32\svchost.exe
    3416 D:\Users\XXX\Desktop\MBRCheck.exe
    1228 D:\Windows\System32\conhost.exe
    2732 D:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000003d`093bfc00  (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x0000006d`dd072c00  (NTFS)

PhysicalDrive0 Model Number: WDCWD5000AACS-00G8B1, Rev: 05.04C05

      Size  Device Name          MBR Status
  --------------------------------------------
    465 GB  \\.\PhysicalDrive0  Windows 7 MBR code detected
            SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79


Done!

cosinus 21.10.2010 19:14
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Wolfen 21.10.2010 20:59
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 10/21/2010 at 09:10 PM

Application Version : 4.44.1000

Core Rules Database Version : 5729
Trace Rules Database Version: 3541

Scan type      : Complete Scan
Total Scan Time : 00:47:45

Memory items scanned      : 652
Memory threats detected  : 0
Registry items scanned    : 11073
Registry threats detected : 0
File items scanned        : 128358
File threats detected    : 5

Trojan.Agent/Gen
    D:\$RECYCLE.BIN\S-1-5-21-1070812797-3716082595-222804077-1001\$R9NAJ5Q.EXE
    D:\USERS\xXXXX\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\INDNAQE2.DEFAULT\CACHE\BC5CA455D01

Adware.Tracking Cookie
    media.mtvnservices.com [ D:\Windows\System32\config\systemprofile\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PFP5TZUX ]
    s1.media.howtospendit.com [ D:\Windows\System32\config\systemprofile\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PFP5TZUX ]
    secure-us.imrworldwide.com [ D:\Windows\System32\config\systemprofile\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\PFP5TZUX ]



Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4904

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

21.10.2010 21:51:06
mbam-log-2010-10-21 (21-51-06).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 270651
Laufzeit: 36 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

cosinus 21.10.2010 21:09
Sieht ok aus, da wurden nur Cookies/Überreste gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

Wolfen 21.10.2010 21:17
Liste der Anhänge anzeigen (Anzahl: 1)
Immer noch das gleiche Problem :/ und ich kann keine Windows Updates mehr machen bzw. dannach suchen da kommt immer die Fehlermeldung Code 80072EFE .

Und mir is schon aufgefallen das sich während dem surfen ab und zu von alleine ein neuer Tab öffnet mit einer komisch URL die mich dann aber immer auf google weitergeleitet hat. Während ich das hier grad geschrieben habe ist das auch wieder passiert und diesmal kein google sonder das hier: siehe Anhang .

cosinus 21.10.2010 21:19
Das schon beachtet => Möglicherweise treten vorübergehend Verbindungsfehler auf, wenn Sie Updates mithilfe von Windows Update oder Microsoft Update installieren

Wolfen 21.10.2010 21:25
Möglicher Grund:
Zitat:
Anwendungen oder Prozesse, die die Internetkommunikation beeinträchtigen
Kann ja am Virus liegen.
Mir gings aber eher weniger um die Windows Updates als um den Virus siehe Bild... Muss ja schon ein Virus vorhanden sein der es Verursacht das sich die Seite öffnet.

Ich verzweifel noch. Hab jetzt mit zig Programmen alles durchgescannt aber ich werd "es" nicht los.

Edit: Da ich das Problem nicht los werde wollt ich nochmal fragen ob das so funtionieren würde.

Zitat:
Wollte nur fragen ob ich einfach auf Meiner C Partition nochmal Windows 7 installieren kann und dannach D formatiere. Beide Partitionen sind ~250 GB groß. Zurzeit ist mein Windows auf D installiert. Weil dann könnte ich meine Daten die ich brauche (Eigentlich eh nur Musik und Filme) Auf C kopieren und dann D formatieren.

cosinus 21.10.2010 22:10
Ja das funktioniert. Ob das Update danach wieder läuft wirste sehen :D

Wolfen 24.10.2010 01:41
So endlich fertig. Funktioniert wieder alles. Vielen Dank für die 1a Hilfe =)


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:48 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131