Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Trojaner mit weißen Bildschirm / GVU Trojaner

Trojaner mit weißen Bildschirm / GVU Trojaner


Plagegeister aller Art und deren Bekämpfung: Trojaner mit weißen Bildschirm / GVU Trojaner

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

 
Vorheriger Beitrag Vorheriger Beitrag   Nächster Beitrag Nächster Beitrag
Alt 19.03.2013, 18:15   #7
Mooohaha
 
Trojaner mit weißen Bildschirm / GVU Trojaner - Standard

Trojaner mit weißen Bildschirm / GVU Trojaner


Der Rechner läuft eigentlich ganz ok.

Fixlog OTL

Code:
ATTFilter
OTL logfile created on: 19.03.2013 15:15:50 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Sven\Downloads
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,68 Gb Total Physical Memory | 1,70 Gb Available Physical Memory | 63,35% Memory free
5,35 Gb Paging File | 4,43 Gb Available in Paging File | 82,65% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 297,99 Gb Total Space | 172,80 Gb Free Space | 57,99% Space Free | Partition Type: NTFS
 
Computer Name: SVEN-PC | User Name: Sven | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.03.18 17:22:27 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sven\Downloads\OTL.exe
PRC - [2013.03.18 11:24:00 | 001,822,424 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_6_602_180.exe
PRC - [2013.01.27 11:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft Security Client\MsMpEng.exe
PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.11.23 03:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2012.08.22 12:59:57 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 13:17:56 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmplayer.exe
PRC - [2010.10.01 08:48:18 | 000,727,664 | ---- | M] () -- C:\Programme\STMicroelectronics\AccelerometerP11\FF_Protection.exe
PRC - [2010.06.03 14:40:00 | 001,664,304 | ---- | M] (Validity Sensors, Inc.) -- C:\Windows\System32\vcsFPService.exe
PRC - [2010.04.07 03:35:04 | 000,495,708 | ---- | M] (IDT, Inc.) -- C:\Programme\IDT\WDM\sttray.exe
PRC - [2010.04.07 03:35:04 | 000,229,458 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_f39a6924a795ad94\stacsv.exe
PRC - [2009.03.03 01:43:08 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_f39a6924a795ad94\AEstSrv.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.03.18 11:23:59 | 014,717,144 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_6_602_180.dll
MOD - [2012.11.28 14:13:52 | 000,087,952 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2012.11.28 14:13:30 | 001,242,512 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2012.08.22 12:59:55 | 002,003,424 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2010.10.01 08:48:18 | 000,727,664 | ---- | M] () -- C:\Programme\STMicroelectronics\AccelerometerP11\FF_Protection.exe
 
 
========== Services (SafeList) ==========
 
SRV - [2013.03.18 11:24:11 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.01.27 11:11:46 | 000,295,232 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Programme\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV - [2013.01.27 11:11:46 | 000,020,456 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.08.22 12:59:56 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2010.11.20 13:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.06.03 14:40:00 | 001,664,304 | ---- | M] (Validity Sensors, Inc.) [Auto | Running] -- C:\Windows\System32\vcsFPService.exe -- (vcsFPService)
SRV - [2010.04.07 03:35:04 | 000,229,458 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_f39a6924a795ad94\stacsv.exe -- (STacSV)
SRV - [2010.01.09 20:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 20:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.03.03 01:43:08 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_f39a6924a795ad94\AEstSrv.exe -- (AESTFilters)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\ComboFix\mbr.sys -- (mbr)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\Sven\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - [2013.01.20 15:59:04 | 000,100,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\winusb.sys -- (WinUSB)
DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.09.29 09:38:00 | 000,043,888 | ---- | M] (ST Microelectronics) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Accelern.sys -- (Acceler)
DRV - [2010.08.20 10:04:38 | 000,017,648 | ---- | M] (ST Microelectronics) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\stdcfltn.sys -- (stdcfltn)
DRV - [2010.06.22 02:37:38 | 000,105,576 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2010.05.25 02:30:42 | 009,936,744 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010.04.07 03:35:04 | 000,423,936 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2009.09.17 18:54:14 | 000,041,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (HECI)
DRV - [2009.08.10 10:06:08 | 000,171,520 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2009.07.14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-2793288743-862573930-1894794103-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hs-pforzheim.de/
IE - HKU\S-1-5-21-2793288743-862573930-1894794103-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-2793288743-862573930-1894794103-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 48 AB 2F 30 3D 31 CD 01  [binary data]
IE - HKU\S-1-5-21-2793288743-862573930-1894794103-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2793288743-862573930-1894794103-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2793288743-862573930-1894794103-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\S-1-5-21-2793288743-862573930-1894794103-1000\..\SearchScopes\{DE9B607A-0CB2-43D9-BF2B-04D585FD465A}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^DE&apn_uid=98096429-1920-473D-B8BD-164BAE0B2FF4&apn_sauid=48ACDBB4-27CC-4141-89CE-090EB504EE7F
IE - HKU\S-1-5-21-2793288743-862573930-1894794103-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: plugin@yontoo.com:1.20.02
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.22 12:59:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.05.16 20:28:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sven\AppData\Roaming\mozilla\Extensions
[2013.02.22 16:58:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sven\AppData\Roaming\mozilla\Firefox\Profiles\dreg8xm8.default\extensions
[2013.02.22 16:58:12 | 000,021,487 | ---- | M] () (No name found) -- C:\Users\Sven\AppData\Roaming\mozilla\firefox\profiles\dreg8xm8.default\extensions\plugin@yontoo.com.xpi
[2012.12.11 17:22:01 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\Sven\AppData\Roaming\mozilla\firefox\profiles\dreg8xm8.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.02.14 17:11:59 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Sven\AppData\Roaming\mozilla\firefox\profiles\dreg8xm8.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.05.16 20:28:03 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.08.22 12:59:57 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.07.24 11:55:50 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.07.24 11:55:50 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.07.24 11:55:50 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.24 11:55:50 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.07.24 11:55:49 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.24 11:55:49 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2013.03.19 15:11:48 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [FreeFallProtection] C:\Programme\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SysTrayApp] C:\Programme\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - Startup: C:\Users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Sven\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2793288743-862573930-1894794103-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2793288743-862573930-1894794103-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2793288743-862573930-1894794103-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Sven\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm File not found
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O16 - DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} hxxp://support.dell.com/systemprofiler/DellSystemLite.CAB (DellSystemLite.Scanner)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.120.1 192.168.120.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C1ADE783-1BF5-451B-B988-DBC7DFE78D44}: DhcpNameServer = 192.168.120.1 192.168.120.10
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C6993E1D-37E2-4BE7-8C34-BF8A649C3AEA}: DhcpNameServer = 192.168.120.1 192.168.120.10
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.03.19 15:13:09 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2013.03.19 15:13:07 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2013.03.19 15:13:07 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Local\temp
[2013.03.19 15:06:12 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2013.03.19 15:06:12 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2013.03.19 15:06:12 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2013.03.19 15:06:07 | 000,000,000 | ---D | C] -- C:\Qoobox
[2013.03.19 15:05:54 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2013.03.19 15:05:14 | 005,041,561 | R--- | C] (Swearware) -- C:\Users\Sven\Desktop\ComboFix.exe
[2013.03.18 10:22:55 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2013.03.18 10:10:19 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2013.03.11 11:56:25 | 000,000,000 | ---D | C] -- C:\Users\Sven\Desktop\Filme
[2013.02.23 00:27:26 | 000,000,000 | --SD | C] -- C:\Users\Sven\Documents\Meine Datenquellen
[2013.02.18 20:55:10 | 000,000,000 | ---D | C] -- C:\Users\Sven\AppData\Roaming\ObviousIdea
[2013.02.18 20:53:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ObviousIdea
[2013.02.18 20:53:53 | 000,000,000 | ---D | C] -- C:\Program Files\ObviousIdea
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.19 15:11:48 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2013.03.19 15:05:19 | 005,041,561 | R--- | M] (Swearware) -- C:\Users\Sven\Desktop\ComboFix.exe
[2013.03.19 14:56:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.03.19 14:53:23 | 000,014,224 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.19 14:53:23 | 000,014,224 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.19 14:45:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.19 14:45:05 | 2156,867,584 | -HS- | M] () -- C:\hiberfil.sys
[2013.03.18 16:48:34 | 000,377,856 | ---- | M] () -- C:\Users\Sven\Desktop\3mrsrxkm.exe
[2013.03.18 16:47:09 | 000,000,000 | ---- | M] () -- C:\Users\Sven\defogger_reenable
[2013.03.18 16:46:49 | 000,050,477 | ---- | M] () -- C:\Users\Sven\Desktop\Defogger.exe
[2013.03.17 17:00:04 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.03.17 17:00:04 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.03.17 17:00:04 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.03.17 17:00:04 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.03.13 16:46:16 | 079,069,091 | ---- | M] () -- C:\Users\Sven\Desktop\Blaze Tha Don - Jung, talentiert und broke (2013).zip
[2013.03.10 11:15:20 | 000,130,069 | ---- | M] () -- C:\Users\Sven\Desktop\BEL6_Teilnehmer-Feedbackgespäch_13_03_21-22.pdf
[2013.02.19 20:33:44 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
 
========== Files Created - No Company Name ==========
 
[2013.03.19 15:06:12 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2013.03.19 15:06:12 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2013.03.19 15:06:12 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2013.03.19 15:06:12 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2013.03.19 15:06:12 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2013.03.18 16:48:33 | 000,377,856 | ---- | C] () -- C:\Users\Sven\Desktop\3mrsrxkm.exe
[2013.03.18 16:47:09 | 000,000,000 | ---- | C] () -- C:\Users\Sven\defogger_reenable
[2013.03.18 16:46:48 | 000,050,477 | ---- | C] () -- C:\Users\Sven\Desktop\Defogger.exe
[2013.03.13 16:45:36 | 079,069,091 | ---- | C] () -- C:\Users\Sven\Desktop\Blaze Tha Don - Jung, talentiert und broke (2013).zip
[2013.03.10 11:15:17 | 000,130,069 | ---- | C] () -- C:\Users\Sven\Desktop\BEL6_Teilnehmer-Feedbackgespäch_13_03_21-22.pdf
[2013.02.01 18:18:12 | 000,009,273 | ---- | C] () -- C:\Users\Sven\AppData\Local\recently-used.xbel
[2012.12.23 14:46:49 | 000,118,476 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2012.09.28 17:11:06 | 000,000,416 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2012.09.28 17:11:06 | 000,000,026 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2012.05.16 15:38:35 | 000,870,560 | ---- | C] () -- C:\Windows\System32\igkrng575.bin
[2012.05.16 15:38:35 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2012.05.16 15:38:35 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2012.05.16 15:38:34 | 000,127,868 | ---- | C] () -- C:\Windows\System32\igcompkrng575.bin
[2012.05.16 15:38:34 | 000,104,796 | ---- | C] () -- C:\Windows\System32\igfcg575m.bin
[2012.05.16 15:38:34 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2012.05.13 13:37:57 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012.05.12 09:04:23 | 000,654,166 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2012.05.12 09:04:23 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2012.05.12 09:04:23 | 000,130,006 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2012.05.12 09:04:23 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2012.01.10 20:12:34 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2012.01.10 20:12:12 | 000,094,208 | ---- | C] () -- C:\Windows\System32\IccLibDll.dll
[2011.06.10 05:34:52 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.08.09 10:22:31 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Ashampoo
[2012.06.15 13:01:05 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Audacity
[2012.08.08 15:51:00 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Canneverbe Limited
[2013.03.19 14:48:23 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\Dropbox
[2013.03.01 17:28:57 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\DVDVideoSoft
[2013.02.18 20:59:19 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\ObviousIdea
[2012.05.16 08:29:28 | 000,000,000 | ---D | M] -- C:\Users\Sven\AppData\Roaming\PCDr
 
========== Purity Check ==========
 
 

< End of report >
Code:
ATTFilter
All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-2793288743-862573930-1894794103-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DE9B607A-0CB2-43D9-BF2B-04D585FD465A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE9B607A-0CB2-43D9-BF2B-04D585FD465A}\ not found.
Prefs.js: plugin@yontoo.com:1.20.02 removed from extensions.enabledAddons
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: Sven
->Temp folder emptied: 97395 bytes
->Temporary Internet Files folder emptied: 72878534 bytes
->Java cache emptied: 1664750 bytes
->FireFox cache emptied: 98021059 bytes
->Flash cache emptied: 1080 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 8080 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 165,00 mb
 
 
OTL by OldTimer - Version 3.2.69.0 log created on 03192013_171228

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
Malware

Code:
ATTFilter
 Malwarebytes Anti-Malware  (Test) 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.03.19.07

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Sven :: SVEN-PC [Administrator]

Schutz: Aktiviert

19.03.2013 17:17:08
mbam-log-2013-03-19 (17-17-08).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 200269
Laufzeit: 3 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Eset

Code:
ATTFilter
C:\Qoobox\Quarantine\C\Users\Sven\AppData\Roaming\skype.dat.vir	a variant of Win32/Kryptik.AWXN trojan
C:\Users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\dreg8xm8.default\extensions\plugin@yontoo.com.xpi	Win32/Adware.Yontoo application
Security Check

Code:
ATTFilter
 Results of screen317's Security Check version 0.99.61  
 Windows 7 Service Pack 1 x86 (UAC is disabled!)  
 Internet Explorer 9  
``````````````Antivirus/Firewall Check:`````````````` 
Microsoft Security Essentials   
  (On Access scanning disabled!) 
 Error obtaining update status for antivirus!  
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.70.0.1100  
 JavaFX 2.1.0    
 Java 7 Update 17  
 Adobe Flash Player 	11.6.602.180  
 Adobe Reader 10.1.6 Adobe Reader out of Date!  
 Mozilla Firefox 14.0.1 Firefox out of Date!  
````````Process Check: objlist.exe by Laurent````````  
 Microsoft Security Essentials MSMpEng.exe 
 Microsoft Security Essentials msseces.exe 
 Malwarebytes Anti-Malware mbamservice.exe  
 Malwarebytes Anti-Malware mbamgui.exe  
 Malwarebytes Anti-Malware mbam.exe  
 Malwarebytes' Anti-Malware mbamscheduler.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

 

Themen zu Trojaner mit weißen Bildschirm / GVU Trojaner
andere, anderen, bekannte, bezahlen, bildschirm, desktop, diverse, folge, hinweis, interne, internetverbindung, kopieren, laptop, nummer, stehe, systems, systemstart, threads, troja, trojaner, verbindung, weiße, weißer, windows


« Polizei Virus eingefangen | RiverNileCasino Spyware? in PUPSC durch Search&Destroy gefunden »


Ähnliche Themen: Trojaner mit weißen Bildschirm / GVU Trojaner


  1. PC zeigt beim hochfahren nur einen weißen Bildschirm. Abgesicherter Modus funktioniert nicht.
    Plagegeister aller Art und deren Bekämpfung - 17.11.2014 (20)
  2. Nur noch einen weißen Bildschirm beim hochfahren des Laptops
    Plagegeister aller Art und deren Bekämpfung - 04.06.2014 (27)
  3. Windows startet mit einen weißen Bildschirm
    Plagegeister aller Art und deren Bekämpfung - 05.08.2013 (19)
  4. Bundesamt-Trojaner, Windows durch weißen Bildschirm gesperrt, 100€ Paysafe
    Log-Analyse und Auswertung - 22.04.2013 (1)
  5. Kann nichts mehr machen außer weißen Bildschirm anstarren
    Plagegeister aller Art und deren Bekämpfung - 01.02.2013 (30)
  6. Trojaner liefert weißen Desktopblocker "Das Programm kann die Webseite nicht anzeigen"
    Plagegeister aller Art und deren Bekämpfung - 28.09.2012 (12)
  7. Ich habe nur mehr einen weißen bildschirm nach der anmeldung von windows 7! Schätze es ist ein Trojaner. Bitte um Hilfe!
    Plagegeister aller Art und deren Bekämpfung - 11.09.2012 (13)
  8. winarchiv.exe erzeugt weißen Bildschirm unter XP
    Plagegeister aller Art und deren Bekämpfung - 05.06.2012 (1)
  9. winarchiv.exe erzeugt weißen Bildschirm unter XP
    Alles rund um Windows - 04.06.2012 (2)
  10. PC blockiert durch weißen Bildschirm: "...Verbindung wird hergestellt"
    Log-Analyse und Auswertung - 12.04.2012 (3)
  11. Trojaner mit weißen Bildschirm "Warten die Verbindung wird hergestellt" Virus (cgs8h0/Y6drxuj c7ti)
    Log-Analyse und Auswertung - 03.04.2012 (3)
  12. (3x) Trojaner mit weißen Bildschirm Warten die...
    Mülltonne - 02.04.2012 (1)
  13. (2x) Trojaner mit weißen Bildschirm "Warten die Verbindung wird hergestellt" Virus (Y6drxujc7ti.exe)
    Mülltonne - 02.04.2012 (1)
  14. Trojaner mit weißen Bildschirm "Warten die Verbindung wird hergestellt"
    Log-Analyse und Auswertung - 01.04.2012 (12)
  15. Windows zeigt nach booten weißen Bildschirm mit Meldung
    Plagegeister aller Art und deren Bekämpfung - 29.03.2012 (38)
  16. Suche nach angepasstem Script nach Gema-Virus und weißen Bildschirm mit ...
    Plagegeister aller Art und deren Bekämpfung - 25.03.2012 (1)
  17. Virus mit Ensperrung 50 € mit einem Weißen Bildschirm
    Plagegeister aller Art und deren Bekämpfung - 30.12.2011 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Trojaner mit weißen Bildschirm / GVU Trojaner - Der Rechner läuft eigentlich ganz ok. Fixlog OTL Code: Alles auswählen Aufklappen ATTFilter OTL logfile created on: 19.03.2013 15:15:50 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = - Trojaner mit weißen Bildschirm / GVU Trojaner...
Archiv
Du betrachtest: Trojaner mit weißen Bildschirm / GVU Trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131