Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   komplettes Reinigen meines PC's ... (https://www.trojaner-board.de/95592-komplettes-reinigen-meines-pcs.html)

achtzylinder 11.02.2011 08:45
komplettes Reinigen meines PC's ...
 
Hallo Leute,

Vorweg: Nutze Windows 7, habe Internetzugang und nutze Kaspersky Internet Security!

ich habe seit ein paar Wochen etliche Viren auf meinem PC und weiß nicht, wie ich alle herunter bekommen soll. Ein paar sind schon weg, aber nicht alle.

Beispielsweise habe ich den "kb.dll" drauf, welcher sich nicht löschen lässt, nur mit Kaspersky. Allerdings wenn dann mein PC neustartet, startet er nicht, sondern muss via Windows repariert werden. Und soweit ich weiß, ist er immernoch drauf.

Folgende Symptome hab ich außerdem:

-Google Chrome startet nicht mehr
-Firefox ging etliche Zeit auch nicht
-Wenn ich bei Firefox Google nutze und dann auf den gesuchten Link klicke, leitet es mich ständig auf irgendwelche anderen Seiten, nur nicht auf die wo ich hin will
-Postbank Online Banking: Wenn ich mich einlogge, will jemand 30 TAN Nummern von meinem Zettel haben. Sprich mich will jemand Phishen. Die TAN Liste auf Zetteln gibts nicht mehr und das Problem ist nur bei Firefox so. Wenn ichs mit dem Internet Explorer mache, gehts einwandfrei.
-Mir kommt es so vor, als ob in der Nacht einfach mein PC startet. Mein Bruder fing letztens an "Wieso lässt du dein PC über die Nacht an?" ... ich setze ihn egtl. IMMER in "Energie Sparen", er ist zwar nicht ganz aus, aber eben Standby wo man nix mehr vom PC hören sollte. Außerdem fing er letztens in der Nacht an zu Piepen, als ob er zu heiß werden würde, ihr müsstet ja wissen was ich meine..


Könnt ihr mir bitte bei meinem Problem helfen und Programme sagen, womit ich alles runter bekomme? Soll ich erstmal nen Hijackthis-logfile Posten?

Wäre schön, ich kriege alles behoben da ich keine Lust auf Formatieren habe :(

cosinus 11.02.2011 09:33
Hallo und :hallo:

Zitat:
habe Internetzugang und nutze Kaspersky Internet Security!
Wozu? Suites sind kontraproduktiv, empfehlenswerter sind meiner Meinung nach reine Virenscanner in Verbindung mit der Windows-Firewall.

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

achtzylinder 11.02.2011 13:55
Malwarebyteslog von Heute:

Zitat:
Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes

Datenbank Version: 5740

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

11.02.2011 13:51:37
mbam-log-2011-02-11 (13-51-37).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 548501
Laufzeit: 1 Stunde(n), 27 Minute(n), 29 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 5

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini (Trojan.Agent) -> Value: userini -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{AA2FEB3F-249E-3CF7-B5BB-59786E7F32B5} (Trojan.ZbotR.Gen) -> Value: {AA2FEB3F-249E-3CF7-B5BB-59786E7F32B5} -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini (Trojan.Agent) -> Value: userini -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\cxlacuxatx.exe (Trojan.SpyEyes) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\Users\gti_kevin\AppData\Local\Temp\~.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\Desktop\explorer.exe (Trojan.Patch) -> Not selected for removal.
c:\Users\gti_kevin\Desktop\neuer ordner\PROGS\corelpaintshoppro-setup+crack\corel.paint.shop.pro.photo.x2.ultimate.v12.5.multilingual.incl.keymaker-core\CORE10k.EXE (Dont.Steal.Our.Software) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Roaming\Ugwa\upso.exe (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.
c:\cxlacuxatx.exe\config.bin (Trojan.SpyEyes) -> Quarantined and deleted successfully.

Malwarebyteslog vom 29.12.2010

Zitat:
Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes

Datenbank Version: 5415

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

29.12.2010 15:01:38
mbam-log-2010-12-29 (15-01-38).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|F:\|)
Durchsuchte Objekte: 537292
Laufzeit: 1 Stunde(n), 21 Minute(n), 25 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 29

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adatadrv (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{1CBC5192-28B4-82F6-13FA-B3D6C71DC29A} (Trojan.Dropper) -> Value: {1CBC5192-28B4-82F6-13FA-B3D6C71DC29A} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\bk (Malware.Trace) -> Value: bk -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\RegistryMonitor2 (Malware.Trace) -> Value: RegistryMonitor2 -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\gti_kevin\AppData\Roaming\Cuvii\elvan.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Windows\System32\drivers\adatadrv.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\ADCDA2\adatadrv.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\ADCDA2\ad_inst.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\ADCDA2\CRACK\adatadrv.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\ADCDA2\CRACK\ad_inst.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\program files\TOUJjmMq\ojbpglvc.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\program files\windows\setup.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Local\Temp\19792079 (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Local\Temp\8581677.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Local\Temp\tmp2b517db1\ALL.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Local\Temp\tmp823f4bac\Output.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Local\Temp\tmpc69d2c69\Output.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Local\Temp\tmpd4c47709\ALL.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Roaming\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Roaming\Diluf\utady.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Roaming\microsoft\Windows\start menu\Programs\Startup\ojbpglvc.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Roaming\nyvqyyevyct1vobgjtcujsjrpwrirat2\csrss.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Roaming\xssend2\svcnost.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\Desktop\neuer ordner\downloads1\tweak_pdf_converter_2.0\tweak_pdf_converter_2.0\tweak pdf converter 2.0\Keygen\Keygen.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\Desktop\neuer ordner\PROGS\corelpaintshoppro-setup+crack\corel.paint.shop.pro.photo.x2.ultimate.v12.5.multilingual.incl.keymaker-core\CR-PS125.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\Desktop\neuer ordner\PROGS\musicmatch_jukebox_plus_10.00.4033_inc_crack_keymaker\musicmatch jukebox plus 10.00.4033 inc crack keymaker\jukebox plus 10 upgrade key generator.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\Desktop\ultraiso premium edition 9.3.6.2750 multilanguage retail+serial\keygen.exe (Riskware.Tool.CK) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\downloads\backups\backup-20101229-030034-507-sishzm32.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\downloads\backups\backup-20101229-030440-710-sishzm32.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Windows\System32\driverstore\filerepository\adatadrv.inf_x86_neutral_ebb1b5244f11e2be\adatadrv.sys (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Roaming\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
c:\Windows\System32\qtplugin.exe (Rootkit.Agent) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\AppData\Roaming\abpzlw.dat (Malware.Trace) -> Quarantined and deleted successfully.

achtzylinder 11.02.2011 14:35
OTL Logfile!


OTL Logfile:
Code:
OTL logfile created on: 11.02.2011 14:23:00 - Run 2
OTL by OldTimer - Version 3.2.20.6    Folder = C:\Users\gti_kevin\Downloads
 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 33,00% Memory free
6,00 Gb Paging File | 4,00 Gb Available in Paging File | 60,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,08 Gb Total Space | 55,89 Gb Free Space | 18,75% Space Free | Partition Type: NTFS
Drive F: | 37,25 Gb Total Space | 1,42 Gb Free Space | 3,81% Space Free | Partition Type: NTFS
Drive J: | 465,76 Gb Total Space | 385,89 Gb Free Space | 82,85% Space Free | Partition Type: NTFS
 
Computer Name: GTI_KEVINSPC | User Name: gti_kevin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\gti_kevin\Downloads\OTL(2).exe (OldTimer Tools)
PRC - C:\Users\gti_kevin\Desktop\ManaBars.exe ()
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Programme\SugarSync\SugarSyncManager.exe (SugarSync, Inc.)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10i_Plugin.exe (Adobe Systems, Inc.)
PRC - C:\Programme\DotAzilla\DotAzilla.exe ()
PRC - C:\Programme\Warcraft III\war3.exe (Blizzard Entertainment)
PRC - C:\Programme\Java\jre6\bin\javaws.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe (Corel, Inc.)
PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Programme\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe (Kaspersky Lab)
PRC - C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
PRC - c:\Programme\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Programme\Warcraft III\Wc3Assistant.exe ()
PRC - C:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech Inc.)
PRC - C:\Programme\Common Files\Logitech\khalshared\KHALMNPR.exe (Logitech Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\gti_kevin\Downloads\OTL(2).exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - C:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - C:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - C:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - C:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - C:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) --  File not found
SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Stereo Service) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
SRV - (OpenVPNService) -- C:\Program Files\OpenVPN\bin\openvpnserv.exe ()
SRV - (AVP) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (TuneUp.Defrag) -- C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software)
SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
SRV - (WwanSvc) -- C:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) -- C:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) -- C:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) -- C:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) -- C:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) -- C:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) -- C:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) -- C:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) -- C:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) -- C:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (Dhcp) -- C:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) -- C:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) -- C:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX-Installer (AxInstSV) -- C:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) -- C:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) -- C:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (OMSI download service) -- C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe ()
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (PSI_SVC_2) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (F-Secure Standalone Minifilter) -- C:\Users\GTI_KE~1\AppData\Local\Temp\OnlineScanner\Anti-Virus\fsgk.sys ()
DRV - (mv2) -- C:\Windows\System32\drivers\mv2.sys (UVNC BVBA)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (tap0901) -- C:\Windows\System32\drivers\tap0901.sys (The OpenVPN Project)
DRV - (easytether) -- C:\Windows\System32\drivers\easytthr.sys (Mobile Stream)
DRV - (ISODrive) -- C:\Programme\UltraISO\drivers\ISODrive.sys (EZB Systems, Inc.)
DRV - (KLIF) -- C:\Windows\System32\drivers\klif.sys (Kaspersky Lab)
DRV - (kl1) -- C:\Windows\System32\drivers\kl1.sys (Kaspersky Lab)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (KSecPkg) -- C:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (HTCAND32) -- C:\Windows\System32\drivers\ANDROIDUSB.sys (HTC, Corporation)
DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys ()
DRV - (TuneUpUtilitiesDrv) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (EverestDriver) -- C:\Programme\Lavalys\EVEREST Ultimate Edition\kerneld.wnt ()
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV - (cmdide) -- C:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) -- C:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) -- C:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) -- C:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) -- C:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) -- C:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) -- C:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) -- C:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) -- C:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) -- C:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) -- C:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) -- C:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) -- C:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) -- C:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) -- C:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) -- C:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) -- C:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) -- C:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) -- C:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) -- C:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) -- C:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) -- C:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) -- C:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) -- C:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (vhdmp) -- C:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (vdrvroot) -- C:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) -- C:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) -- C:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) -- C:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) -- C:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) -- C:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) -- C:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) -- C:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) -- C:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) -- C:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) -- C:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) -- C:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) -- C:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) -- C:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) -- C:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifibus) -- C:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) -- C:\Windows\system32\DRIVERS\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) -- C:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (mshidkmdf) -- C:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) -- C:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) -- C:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) -- C:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) -- C:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (discache) -- C:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (AcpiPmi) -- C:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) -- C:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) -- C:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) -- C:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) -- C:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (b57nd60x) -- C:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (ebdrv) -- C:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) -- C:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (NPF) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies)
DRV - (klmouflt) -- C:\Windows\System32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (KLIM6) -- C:\Windows\System32\drivers\klim6.sys (Kaspersky Lab)
DRV - (ggsemc) -- C:\Windows\System32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV - (ggflt) -- C:\Windows\System32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV - (klbg) -- C:\Windows\system32\drivers\klbg.sys (Kaspersky Lab)
DRV - (NSHE) -- C:\Windows\System32\drivers\NSHE.SYS (T0r0 2008)
DRV - (s0017mdm) -- C:\Windows\System32\drivers\s0017mdm.sys (MCCI Corporation)
DRV - (s0017unic) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM) -- C:\Windows\System32\drivers\s0017unic.sys (MCCI Corporation)
DRV - (s0017mgmt) Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0017mgmt.sys (MCCI Corporation)
DRV - (s0017obex) -- C:\Windows\System32\drivers\s0017obex.sys (MCCI Corporation)
DRV - (s0017bus) Sony Ericsson Device 0017 driver (WDM) -- C:\Windows\System32\drivers\s0017bus.sys (MCCI Corporation)
DRV - (s0017nd5) Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS) -- C:\Windows\System32\drivers\s0017nd5.sys (MCCI Corporation)
DRV - (s0017mdfl) -- C:\Windows\System32\drivers\s0017mdfl.sys (MCCI Corporation)
DRV - (adfs) -- C:\Windows\System32\drivers\adfs.sys (Adobe Systems, Inc.)
DRV - (Sentinel) -- C:\Windows\System32\Drivers\SENTINEL.SYS (SafeNet, Inc.)
DRV - (SNTNLUSB) -- C:\Windows\System32\drivers\SNTNLUSB.SYS (SafeNet, Inc.)
DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (L8042Kbd) -- C:\Windows\System32\drivers\L8042Kbd.sys (Logitech Inc.)
DRV - (Hardlock) -- C:\Windows\system32\drivers\hardlock.sys (Aladdin Knowledge Systems Ltd.)
DRV - (speedfan) -- C:\Windows\system32\speedfan.sys (Windows (R) 2000 DDK provider)
DRV - (vsbus) -- C:\Windows\System32\drivers\vsb.sys (ELTIMA Software)
DRV - (vserial) -- C:\Windows\System32\drivers\vserial.sys (ELTIMA Software)
DRV - (ABIT-IO) -- C:\Programme\U-ABIT\abitEQ\ABIT-IO.sys ()
DRV - (giveio) -- C:\Windows\system32\giveio.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B8 92 B8 62 BB A8 CA 01  [binary data]
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.1.3
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:6.4.7
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10
FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:3.6
FF - prefs.js..extensions.enabledItems: {ED0CF0C8-62F1-4865-A3FD-2E2A2B50FAFA}:1.0
FF - prefs.js..extensions.enabledItems: jetpack@labs.mozilla.com:0.8.2
FF - prefs.js..extensions.enabledItems: linkfilter@kaspersky.ru:9.0.0.459
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.1
FF - prefs.js..extensions.enabledItems: {D02B1E87-A8C6-433f-9B5C-2CEC4A072736}:04.10.00.03
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.2.1.3
FF - prefs.js..extensions.enabledItems: extension@virtusdesigns.com:3.6.7
FF - prefs.js..extensions.enabledItems: {464F169E-ACE1-4C5F-A778-A433A3DABBAE}:1.0
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1
FF - prefs.js..extensions.enabledItems: {3713a489-0634-4472-8456-dc7abd7eba00}:1.3.1
FF - prefs.js..extensions.enabledItems: {5c8bfb7c-9a54-11dc-8314-0800200c9a66}:3.6.7
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q="
 
 
FF - HKLM\software\mozilla\Firefox\extensions\\{ED0CF0C8-62F1-4865-A3FD-2E2A2B50FAFA}: C:\Users\gti_kevin\AppData\Roaming\5008 [2010.12.20 00:23:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.29 03:20:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.29 02:52:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\THBExt [2009.12.19 13:07:39 | 000,000,000 | ---D | M]
 
[2009.12.18 20:23:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Extensions
[2011.02.11 12:15:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions
[2010.11.26 20:47:06 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2010.11.26 20:47:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.12.20 17:22:26 | 000,000,000 | ---D | M] (Qute) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{36C13C8F-54F1-412e-8177-2E411719162D}
[2010.11.26 20:47:03 | 000,000,000 | ---D | M] (Abaca classic) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{3713a489-0634-4472-8456-dc7abd7eba00}
[2010.11.26 20:46:57 | 000,000,000 | ---D | M] (Aero Fox XL) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
[2010.11.16 18:02:48 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.11.26 20:46:57 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2010.02.21 22:50:03 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.11.18 21:24:05 | 000,000,000 | ---D | M] (Easy Youtube Video Downloader) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}
[2009.12.20 17:22:27 | 000,000,000 | ---D | M] (Fasterfox) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{c36177c0-224a-11da-8cd6-0800200c9a66}
[2010.12.02 23:31:54 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2009.12.20 17:22:27 | 000,000,000 | ---D | M] (SignupShield) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{D02B1E87-A8C6-433f-9B5C-2CEC4A072736}
[2010.11.18 21:24:04 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2009.12.20 17:22:27 | 000,000,000 | ---D | M] (Miint) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{d596c130-b00a-11db-abbd-0800200c9a66}
[2010.11.18 21:24:03 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
[2009.12.20 17:22:29 | 000,000,000 | ---D | M] (Aeon) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{ded0fc70-7215-4802-afeb-b2982d3e7225}
[2010.11.18 21:23:59 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009.12.20 17:22:25 | 000,000,000 | ---D | M] (Chromifox Basic) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\chromifox@altmusictv.com
[2010.12.02 23:31:52 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\engine@conduit.com
[2010.11.18 21:23:43 | 000,000,000 | ---D | M] (Virtus Search Opt-in) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\extension@virtusdesigns.com
[2010.11.26 20:47:16 | 000,000,000 | ---D | M] (Jetpack Prototype) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\jetpack@labs.mozilla.com
[2010.11.26 20:47:08 | 000,000,000 | ---D | M] (Personas) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\personas@christopher.beard
[2010.11.18 21:23:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\extension@virtusdesigns.com\chrome
[2010.11.26 20:47:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{3713a489-0634-4472-8456-dc7abd7eba00}\chrome\mozapps\extensions
[2010.11.26 20:47:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\win\mozapps\extensions
[2009.12.20 17:22:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\gti_kevin\AppData\Roaming\mozilla\Firefox\Profiles\63uyhucl.default\extensions\{ded0fc70-7215-4802-afeb-b2982d3e7225}\chrome\mozapps\extensions
[2011.02.09 20:28:02 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-1.xml
[2009.03.28 01:05:56 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-10.xml
[2009.04.23 14:03:22 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-11.xml
[2009.04.28 22:15:54 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-12.xml
[2009.06.13 19:23:32 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-13.xml
[2009.07.22 20:44:50 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-14.xml
[2009.10.29 07:53:42 | 000,000,961 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-15.xml
[2009.12.20 17:22:44 | 000,000,961 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-16.xml
[2010.02.24 17:29:12 | 000,000,961 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-17.xml
[2010.04.20 20:49:41 | 000,000,961 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-18.xml
[2010.07.27 12:31:54 | 000,000,961 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-19.xml
[2008.09.15 16:03:42 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-2.xml
[2010.09.14 19:20:09 | 000,000,961 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-20.xml
[2010.11.18 12:01:50 | 000,000,961 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-21.xml
[2010.12.28 22:14:23 | 000,000,961 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-22.xml
[2010.12.29 02:53:16 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-23.xml
[2008.09.24 16:55:40 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-3.xml
[2008.09.28 11:36:34 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-4.xml
[2008.11.14 21:42:36 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-5.xml
[2008.12.19 13:35:48 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-6.xml
[2009.01.21 14:13:22 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-7.xml
[2009.02.04 22:57:08 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-8.xml
[2009.03.05 22:32:46 | 000,000,950 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin-9.xml
[2010.11.16 18:02:48 | 000,000,168 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin.gif
[2010.11.16 18:02:48 | 000,000,618 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin.src
[2010.06.21 16:35:24 | 000,001,042 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\icqplugin.xml
[2010.11.26 20:47:48 | 000,001,201 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\Mozilla\Firefox\Profiles\63uyhucl.default\searchplugins\winamp-search.xml
[2011.01.11 22:13:51 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.06.26 14:33:52 | 000,000,000 | ---D | M] (VMLoad) -- C:\Programme\Mozilla Firefox\extensions\{464F169E-ACE1-4C5F-A778-A433A3DABBAE}
[2009.12.19 11:59:33 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
[2010.06.26 14:33:52 | 000,000,000 | ---D | M] (VMLoad) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{464F169E-ACE1-4C5F-A778-A433A3DABBAE}
[2010.02.08 23:28:03 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
[2009.12.19 11:59:33 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\LINKFILTER@KASPERSKY.RU
[2010.12.20 00:23:44 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\GTI_KEVIN\APPDATA\ROAMING\5008
[2010.12.03 19:14:08 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.12.03 19:14:08 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.12.03 19:14:08 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.12.03 19:14:08 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.12.03 19:14:08 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.01.24 20:52:45 | 000,002,353 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1      activate.adobe.com
O1 - Hosts: 127.0.0.1      practivate.adobe.com
O1 - Hosts: 127.0.0.1      adobeereg.com
O1 - Hosts: 127.0.0.1      hxxp://www.adobeereg.com
O1 - Hosts: 127.0.0.1      activate.adobe.com
O1 - Hosts: 127.0.0.1      activate-sea.adobe.com
O1 - Hosts: 127.0.0.1      activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1      wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1      192.150.18.108
O1 - Hosts: 127.0.0.1      activate.adobe.com:443
O1 - Hosts: 127.0.0.1      3dns-3.adobe.com
O1 - Hosts: 127.0.0.1      3dns-2.adobe.com
O1 - Hosts: 127.0.0.1      adobeereg.com
O1 - Hosts: 127.0.0.1      www.adobeereg.com
O1 - Hosts: 127.0.0.1      activate.adobe.com
O1 - Hosts: 127.0.0.1      activate-sea.adobe.com
O1 - Hosts: 127.0.0.1      activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1      wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1      192.150.18.108
O1 - Hosts: 127.0.0.1      adobeereg.com
O1 - Hosts: 127.0.0.1      www.adobeereg.com
O1 - Hosts: 127.0.0.1      activate.adobe.com
O1 - Hosts: 127.0.0.1      activate-sea.adobe.com
O1 - Hosts: 127.0.0.1      activate-sjc0.adobe.com
O1 - Hosts: 22 more lines...
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll (Kaspersky Lab)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (VMLoadHBO Class) - {C17C7688-31D1-46D7-8C9B-5D253E4F5D5E} - C:\Users\gti_kevin\AppData\Roaming\VMLoad\addin\VMLoad.dll (TODO: <Company name>)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe (Kaspersky Lab)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Corel File Shell Monitor]  File not found
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKCU..\Run: [{AA2FEB3F-249E-3CF7-B5BB-59786E7F32B5}]  File not found
O4 - HKCU..\Run: [ABIT uGuruIII] C:\Programme\U-ABIT\abitEQ\abiteq.exe (Universal ABIT Corporation)
O4 - HKCU..\Run: [Corel Photo Downloader] c:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe (Corel, Inc.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [Sony Ericsson PC Suite] C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe (Sony Ericsson Mobile Communications AB)
O4 - HKCU..\Run: [SugarSync] C:\Program Files\SugarSync\SugarSyncManager.exe (SugarSync, Inc.)
O4 - Startup: C:\Users\gti_kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\gti_kevin\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll ()
O9 - Extra 'Tools' menuitem : Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll ()
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll (Kaspersky Lab)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\mzvkbd3.dll (Kaspersky Lab)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2010\kloehk.dll (Kaspersky Lab)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Program Files\TOUJjmMq\ojbpglvc.exe) -  File not found
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\klogon: DllName - C:\Windows\system32\klogon.dll - C:\Windows\System32\klogon.dll (Kaspersky Lab)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - J:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{6ae84d34-ec96-11de-bfa3-00183802b7cb}\Shell - "" = AutoRun
O33 - MountPoints2\{6ae84d34-ec96-11de-bfa3-00183802b7cb}\Shell\AutoRun\command - "" = G:\Autorun.exe
O33 - MountPoints2\{6ae84d44-ec96-11de-bfa3-00183802b7cb}\Shell - "" = AutoRun
O33 - MountPoints2\{6ae84d44-ec96-11de-bfa3-00183802b7cb}\Shell\AutoRun\command - "" = H:\Autorun.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: aticli - (C:\Windows\system32\exe2strB.dll) - C:\Windows\System32\exe2strB.dll ()
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.02.09 16:02:20 | 000,000,000 | ---D | C] -- C:\Users\gti_kevin\Desktop\Bong Bande - BandenUrlaub an der WestKueste
[2011.02.09 14:20:41 | 002,329,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.02.09 14:20:21 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.02.09 14:20:19 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.02.09 14:20:19 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011.02.09 14:20:18 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.02.09 14:20:18 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011.02.09 14:20:18 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011.02.09 14:20:17 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011.02.09 14:20:17 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.02.09 14:20:17 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011.02.09 14:20:09 | 003,901,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2011.02.09 14:20:08 | 003,957,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2011.02.09 14:19:57 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011.02.09 14:19:57 | 000,428,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011.02.09 14:19:53 | 000,294,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011.02.09 14:19:53 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011.02.09 14:19:49 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\upnp.dll
[2011.02.09 14:19:47 | 000,080,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\davclnt.dll
[2011.02.09 14:19:47 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscapi.dll
[2011.02.09 14:19:47 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slwga.dll
[2011.02.09 14:19:43 | 000,219,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys
[2011.02.08 22:53:40 | 000,000,000 | ---D | C] -- C:\Users\gti_kevin\Desktop\Lena-Good_News-2011-VOiCE
[2011.01.28 12:33:40 | 000,000,000 | ---D | C] -- C:\Users\gti_kevin\Documents\Magischer Aktenkoffer
[2011.01.28 12:23:41 | 000,000,000 | ---D | C] -- C:\Users\gti_kevin\AppData\Local\SugarSync
[2011.01.28 12:23:28 | 000,000,000 | ---D | C] -- C:\Programme\SugarSync
[2011.01.22 21:38:53 | 000,000,000 | ---D | C] -- C:\Users\gti_kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DotAlicious Gaming Client
[2011.01.19 20:33:46 | 002,614,272 | ---- | C] (Microsoft Corporation) -- C:\Users\gti_kevin\Desktop\explorer.exe
[2011.01.19 20:33:35 | 000,000,000 | ---D | C] -- C:\ProgramData\F-Secure
[2011.01.19 20:30:42 | 002,614,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2011.01.19 20:01:38 | 000,000,000 | -HSD | C] -- C:\found.000
[2011.01.19 19:02:11 | 000,000,000 | ---D | C] -- C:\Users\gti_kevin\AppData\Roaming\EurekaLog
[2011.01.19 12:44:54 | 000,000,000 | ---D | C] -- C:\Programme\Neuer Ordner
[2011.01.19 12:44:46 | 000,000,000 | ---D | C] -- C:\Programme\Dotalicious
[2011.01.19 12:20:24 | 000,000,000 | ---D | C] -- C:\Programme\Emsisoft Anti-Malware
[2011.01.19 12:20:24 | 000,000,000 | ---D | C] -- C:\Users\gti_kevin\Documents\Anti-Malware
[2011.01.12 14:57:18 | 000,573,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll
[2011.01.12 14:57:16 | 003,181,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll
[2011.01.12 14:57:16 | 001,170,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll
[2011.01.12 14:57:16 | 001,074,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll
[2011.01.12 14:57:16 | 000,801,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll
[2011.01.12 14:57:16 | 000,739,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll
[2011.01.12 14:57:16 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2011.01.12 14:57:16 | 000,283,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2011.01.12 14:57:15 | 001,619,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMVDECOD.DLL
[2011.01.12 14:57:15 | 001,495,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ExplorerFrame.dll
[2011.01.12 14:57:15 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll
[2011.01.12 14:57:15 | 000,196,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll
[2011.01.12 14:57:15 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll
[2011.01.12 14:57:15 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll
[2011.01.12 14:57:15 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll
[2010.01.10 13:15:31 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\gti_kevin\AppData\Roaming\pcouffin.sys
[2010.01.02 20:09:08 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpeC41B.dll
[2009.12.19 12:45:24 | 000,258,048 | ---- | C] (Blizzard Entertainment) -- C:\Programme\Frozen Throne.exe
[2009.12.19 12:42:59 | 000,258,048 | ---- | C] (Blizzard Entertainment) -- C:\Programme\Warcraft III.exe
[2009.12.19 12:42:59 | 000,258,048 | ---- | C] (Blizzard Entertainment) -- C:\Programme\Frozen Throne (2).exe
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.02.11 13:51:45 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\esexfqp.sys
[2011.02.11 13:45:05 | 000,001,134 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-284188799-1376492326-2770973094-1000UA.job
[2011.02.11 13:45:05 | 000,001,082 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-284188799-1376492326-2770973094-1000Core.job
[2011.02.11 12:30:13 | 000,016,944 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.02.11 12:30:13 | 000,016,944 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.02.11 12:14:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.02.10 13:56:28 | 2415,566,848 | -HS- | M] () -- C:\hiberfil.sys
[2011.02.10 03:26:18 | 002,360,912 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.02.10 03:02:57 | 000,002,421 | ---- | M] () -- C:\Users\gti_kevin\Desktop\Google Chrome.lnk
[2011.02.09 00:11:36 | 000,651,976 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.02.09 00:11:36 | 000,614,038 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.02.09 00:11:36 | 000,129,734 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.02.09 00:11:36 | 000,106,158 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.02.03 06:45:07 | 000,219,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys
[2011.01.28 12:23:38 | 000,001,896 | ---- | M] () -- C:\Users\Public\Desktop\SugarSync Manager.lnk
[2011.01.27 14:42:21 | 000,042,631 | ---- | M] () -- C:\Users\gti_kevin\Desktop\1-34b6948e2fe3f3dc988e51de81fba62b.jpg
[2011.01.27 14:42:07 | 000,037,349 | ---- | M] () -- C:\Users\gti_kevin\Desktop\1-8eece6d25b7d10b6bff1ff30839aba1c.jpg
[2011.01.26 20:21:26 | 000,001,041 | ---- | M] () -- C:\Users\gti_kevin\AppData\Roaming\vso_ts_preview.xml
[2011.01.23 23:48:22 | 000,111,104 | ---- | M] () -- C:\Users\gti_kevin\Desktop\ManaBars.exe
[2011.01.23 23:48:22 | 000,010,752 | ---- | M] () -- C:\Users\gti_kevin\Desktop\mana.dll
[2011.01.23 23:48:22 | 000,000,056 | ---- | M] () -- C:\Users\gti_kevin\Desktop\Dota-Utilities.URL
[2011.01.21 15:28:00 | 000,329,232 | ---- | M] () -- C:\Users\gti_kevin\Desktop\Bild 003 _2_.jpg
[2011.01.21 15:26:22 | 000,910,714 | ---- | M] () -- C:\Users\gti_kevin\Desktop\IMG_0296.jpg
[2011.01.20 23:22:22 | 000,011,364 | ---- | M] () -- C:\Users\gti_kevin\Desktop\lastsettings.w3a
[2011.01.19 20:34:52 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Users\gti_kevin\Desktop\explorer.exe
[2011.01.19 20:34:41 | 000,049,152 | ---- | M] () -- C:\Users\gti_kevin\Desktop\EXE2STRB.DLL
[2011.01.17 13:27:26 | 000,178,019 | ---- | M] () -- C:\Users\gti_kevin\Desktop\septemberr2009.jpg
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.02.11 13:51:45 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\esexfqp.sys
[2011.01.28 12:23:38 | 000,001,908 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SugarSync Manager.lnk
[2011.01.28 12:23:38 | 000,001,896 | ---- | C] () -- C:\Users\Public\Desktop\SugarSync Manager.lnk
[2011.01.27 14:42:20 | 000,042,631 | ---- | C] () -- C:\Users\gti_kevin\Desktop\1-34b6948e2fe3f3dc988e51de81fba62b.jpg
[2011.01.27 14:42:03 | 000,037,349 | ---- | C] () -- C:\Users\gti_kevin\Desktop\1-8eece6d25b7d10b6bff1ff30839aba1c.jpg
[2011.01.26 01:11:13 | 003,116,335 | ---- | C] () -- C:\Users\gti_kevin\Desktop\Ist es der Hass (Sake Mc).mp3
[2011.01.26 01:10:58 | 005,126,719 | ---- | C] () -- C:\Users\gti_kevin\Desktop\17-Rap ohne Gage outro (CarloCashfeat el nino ).mp3
[2011.01.21 15:27:58 | 000,329,232 | ---- | C] () -- C:\Users\gti_kevin\Desktop\Bild 003 _2_.jpg
[2011.01.21 15:26:20 | 000,910,714 | ---- | C] () -- C:\Users\gti_kevin\Desktop\IMG_0296.jpg
[2011.01.19 20:42:22 | 000,011,364 | ---- | C] () -- C:\Users\gti_kevin\Desktop\lastsettings.w3a
[2011.01.19 20:42:17 | 000,445,952 | ---- | C] () -- C:\Users\gti_kevin\Desktop\Wc3Assistant.exe
[2011.01.19 20:34:41 | 000,049,152 | ---- | C] () -- C:\Users\gti_kevin\Desktop\EXE2STRB.DLL
[2011.01.17 13:27:25 | 000,178,019 | ---- | C] () -- C:\Users\gti_kevin\Desktop\septemberr2009.jpg
[2011.01.13 22:23:29 | 000,002,421 | ---- | C] () -- C:\Users\gti_kevin\Desktop\Google Chrome.lnk
[2011.01.04 12:14:23 | 000,056,261 | ---- | C] () -- C:\Programme\CustomKeys.txt
[2010.12.28 20:53:19 | 000,049,152 | ---- | C] () -- C:\Windows\System32\exe2strB.dll
[2010.12.27 02:08:33 | 000,004,608 | ---- | C] () -- C:\Users\gti_kevin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.12.27 02:06:22 | 000,000,088 | RHS- | C] () -- C:\ProgramData\274D8C6694.sys
[2010.12.27 02:06:21 | 000,002,516 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2010.12.11 21:19:15 | 000,184,320 | ---- | C] () -- C:\Windows\System32\libfaac.dll
[2010.10.18 21:04:12 | 000,000,033 | ---- | C] () -- C:\Windows\ETKINST.INI
[2010.10.14 01:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2010.10.02 16:08:03 | 000,000,319 | ---- | C] () -- C:\Windows\game.ini
[2010.09.15 18:47:13 | 000,000,047 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2010.09.07 19:40:20 | 000,000,000 | ---- | C] () -- C:\Windows\DbgOut.INI
[2010.08.28 00:05:36 | 000,069,632 | R--- | C] () -- C:\Windows\System32\xmltok.dll
[2010.08.28 00:05:36 | 000,036,864 | R--- | C] () -- C:\Windows\System32\xmlparse.dll
[2010.06.02 16:06:03 | 000,000,160 | ---- | C] () -- C:\Users\gti_kevin\AppData\Roaming\default.rss
[2010.06.01 18:24:47 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2010.06.01 18:24:47 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2010.05.04 15:41:41 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2010.05.03 17:59:18 | 000,000,648 | ---- | C] () -- C:\Windows\PhotoBee.INI
[2010.03.20 02:41:26 | 000,138,184 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.02.06 12:54:30 | 000,006,836 | ---- | C] () -- C:\Windows\System32\UNWISE.INI
[2010.01.10 14:27:59 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2010.01.10 13:16:54 | 000,001,041 | ---- | C] () -- C:\Users\gti_kevin\AppData\Roaming\vso_ts_preview.xml
[2010.01.10 13:16:24 | 000,000,034 | ---- | C] () -- C:\Users\gti_kevin\AppData\Roaming\pcouffin.log
[2010.01.10 13:15:31 | 000,087,608 | ---- | C] () -- C:\Users\gti_kevin\AppData\Roaming\inst.exe
[2010.01.10 13:15:31 | 000,007,887 | ---- | C] () -- C:\Users\gti_kevin\AppData\Roaming\pcouffin.cat
[2010.01.10 13:15:31 | 000,001,144 | ---- | C] () -- C:\Users\gti_kevin\AppData\Roaming\pcouffin.inf
[2009.12.27 02:03:06 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009.12.25 19:49:05 | 000,004,767 | ---- | C] () -- C:\Windows\Irremote.ini
[2009.12.19 13:00:34 | 000,691,696 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2009.10.21 10:22:00 | 000,315,392 | ---- | C] () -- C:\Windows\System32\drivers\yk62x86.sys
[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.07.14 00:24:44 | 000,003,584 | ---- | C] () -- C:\Windows\System32\kb.dll
[1996.04.03 20:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:8FF81EB0

< End of report >
--- --- ---

cosinus 11.02.2011 15:56
Zitat:
c:\Users\gti_kevin\Desktop\neuer ordner\downloads1\tweak_pdf_converter_2.0\tweak_pdf_converter_2.0\tweak pdf converter 2.0\Keygen\Keygen.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\Desktop\neuer ordner\PROGS\corelpaintshoppro-setup+crack\corel.paint.shop.pro.photo.x2.ultimate.v12.5.multilingual.incl.keymaker-core\CR-PS125.exe (Trojan.Dropper.PGen) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\Desktop\neuer ordner\PROGS\musicmatch_jukebox_plus_10.00.4033_inc_crack_keymaker\musicmatch jukebox plus 10.00.4033 inc crack keymaker\jukebox plus 10 upgrade key generator.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
c:\Users\gti_kevin\Desktop\ultraiso premium edition 9.3.6.2750 multilanguage retail+serial\keygen.exe (Riskware.Tool.CK) -> Quarantined and deleted successfully.
Dateien, die crack.exe, keygen.exe oder patch.exe heißen, sind zu 99,9% gefährliche Schädlinge, mit denen man nicht spaßen sollte. Ausserdem sind diese illegal und wir unterstützen die Verwendung von geklauter Software nicht. Somit beschränkt sich der Support auf Anleitung zur kompletten Neuinstallation!!

achtzylinder 11.02.2011 16:14
Hallo,
jetzt hab Dich mal nicht so!

"neuer Ordner" ist nicht mein Ordner, das war ein Sicherungsordner von einem Freund. Ist ja auch Egal und trägt nix zur Sache.


Kannst du mir nun BITTE weiterhelfen, oder nicht? Ich kenne mich in der Sache überhaupt nicht aus und benötige Ernsthaft Hilfe!


Ich habe nun alles mit Malwarebytes gelöscht, bis auf "explorer.Exe" (wenn ich die Lösche ists doch ganz vorbei, oder?)

Wie dem auch sei: Nach dem Neustart kann ich wieder kein Firefox.exe starten!

cosinus 11.02.2011 19:33
Zitat:
jetzt hab Dich mal nicht so!
Ich führe hier keine sinnlosen Diskussionen. Format c:, over and out...
Ausreden mit "Sicherungsordner von einem Kumpel" kauf ich dir auch nicht ab, offensichtlich ist ein gecracktes Adobe CS4 bei dir installiert :stirn:

http://www.world-of-smilies.com/wos_...eschlossen.gif


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:49 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131