Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   GEMA sperrvirus, (https://www.trojaner-board.de/110266-gema-sperrvirus.html)

Lausitz 21.02.2012 19:30
GEMA sperrvirus,
 
Mein Rechner ist durch einen GEMA- sperrvirus gesperrt. Durch Zahlung von 50€ solle ich meinen Rechner wieder nutzen können. Ich habe einen virenscanner auf dem System (avar), und nutze Win 7 ultima.ich habe keine Möglichkeit die Sperre zu umgehen auch nicht mit dem taskmanager. Was muss ich tun?

cosinus 21.02.2012 19:40
Funktioniert noch der abgesicherte Modus mit Netzwerktreibern?




Abgesicherter Modus zur Bereinigung
  • Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
  • Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

    Windows im abgesicherten Modusstarten

Lausitz 21.02.2012 20:21
Nein, ich kann den Rechner zwar im abgesicherten Modus starten aber nach dem hochfahren ist der Rechner gleich wieder mit dem Sperrbildschirm der GEMA gesperrt.

cosinus 21.02.2012 20:56
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten - im BIOS musst du vorher AHCI ausschalten, sonst gibt es sehr wahrscheinlich einen BlueScreen beim Booten von OTLPE (welches auf WinXP basiert)

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.
  • Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
  • Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
  • Lege eine leere CD in Deinen Brenner.
  • ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
  • Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
  • Du kannst nun die Fenster des Brennprogramms schließen.
Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD
  • Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • OTLpe sollte nun starten.
  • Drücke Run Scan, um den Scan zu starten.
  • Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
  • Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
  • Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt.

Lausitz 22.02.2012 15:00
ich hab die cd erstellt, gebootet aber ich habe raidlaufwerke die jetzt nachdem ich ahci ausgeschaltet habe nicht mehr angezeigt werden. mache ich was falsch oder was muss ich jetzt machen?

Lausitz 22.02.2012 15:23
ich glaube es hat jetyt doch geklappt....OTL Logfile:
Code:
OTL logfile created on: 2/22/2012 3:16:30 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
64bit-Windows 7 Ultimate Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 540.89 Gb Total Space | 237.77 Gb Free Space | 43.96% Space Free | Partition Type: NTFS
Drive D: | 931.41 Gb Total Space | 503.07 Gb Free Space | 54.01% Space Free | Partition Type: NTFS
Drive E: | 931.51 Gb Total Space | 922.35 Gb Free Space | 99.02% Space Free | Partition Type: NTFS
Drive J: | 390.62 Gb Total Space | 388.63 Gb Free Space | 99.49% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011/09/06 15:45:28 | 000,044,768 | ---- | M] (AVAST Software) [Auto] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2010/03/30 05:02:08 | 000,189,304 | ---- | M] (AVM Berlin) [Auto] -- C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe -- (nwtsrv)
SRV:64bit: - [2010/03/30 05:01:06 | 000,143,224 | ---- | M] (AVM Berlin) [Auto] -- C:\Program Files\FRITZ!Fernzugang\certsrv.exe -- (certsrv)
SRV:64bit: - [2010/03/30 04:59:54 | 000,335,224 | ---- | M] (AVM Berlin) [Auto] -- C:\Program Files\FRITZ!Fernzugang\avmike.exe -- (avmike)
SRV:64bit: - [2009/07/20 05:36:14 | 000,160,784 | ---- | M] (Logitech, Inc.) [Auto] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 20:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2007/02/22 11:09:34 | 000,377,072 | ---- | M] (XIMETA, Inc.) [Auto] -- C:\Program Files\NDAS\System\ndassvc.exe -- (ndassvc)
SRV - [2012/02/10 14:47:36 | 003,340,064 | ---- | M] () [Auto] -- C:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll -- (Akamai)
SRV - [2011/11/03 06:06:56 | 002,152,152 | ---- | M] (Lavasoft Limited) [Auto] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2011/08/19 03:26:50 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto] -- C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2011/04/22 07:21:10 | 000,092,592 | ---- | M] (TomTom) [Auto] -- C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2011/03/21 07:21:24 | 000,632,832 | ---- | M] (Nokia) [On_Demand] -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2010/10/22 06:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2010/05/15 16:11:43 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/03/25 07:39:22 | 000,490,280 | ---- | M] (Nero AG) [Auto] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) @C:\Program Files (x86)
SRV - [2010/03/18 06:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 13:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2010/02/19 06:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/08/19 12:56:38 | 000,090,112 | ---- | M] (ASUSTeK Computer Inc.) [Auto] -- C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe -- (AsSysCtrlService)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011/11/03 06:06:56 | 000,069,376 | ---- | M] (Lavasoft AB) [File_System | Boot] -- C:\Windows\System32\drivers\Lbd.sys -- (Lbd)
DRV:64bit: - [2011/09/06 15:36:30 | 000,065,368 | ---- | M] (AVAST Software) [File_System | Auto] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2011/08/19 03:27:30 | 004,869,024 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\lvuvc64.sys -- (LVUVC64) Logitech QuickCam Pro 9000(UVC)
DRV:64bit: - [2011/08/19 03:27:30 | 000,351,136 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\lvrs64.sys -- (LVRS64)
DRV:64bit: - [2011/08/17 04:04:34 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nmwcdnsux64.sys -- (nmwcdnsux64)
DRV:64bit: - [2011/08/17 04:04:28 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nmwcdnsucx64.sys -- (nmwcdnsucx64)
DRV:64bit: - [2011/08/17 03:58:26 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)
DRV:64bit: - [2011/08/17 03:58:22 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser_lowerfltx64.sys -- (upperdev)
DRV:64bit: - [2011/08/17 03:58:20 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmbox64.sys -- (nmwcdc)
DRV:64bit: - [2011/08/17 03:58:16 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmbx64.sys -- (nmwcd)
DRV:64bit: - [2011/06/10 00:34:52 | 000,539,240 | ---- | M] (Realtek                                            ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011/05/10 01:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/12/03 13:02:28 | 000,230,352 | ---- | M] (TrueCrypt Foundation) [Kernel | System] -- C:\Windows\System32\drivers\truecrypt.sys -- (truecrypt)
DRV:64bit: - [2010/11/25 05:27:40 | 000,120,408 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 06:03:42 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010/11/20 05:43:57 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser.sys -- (usbser)
DRV:64bit: - [2010/05/07 11:43:30 | 000,030,304 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\LVPr2M64.sys -- (LVPr2Mon)
DRV:64bit: - [2010/05/07 11:43:30 | 000,030,304 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\LVPr2M64.sys -- (LVPr2M64)
DRV:64bit: - [2010/03/30 05:00:16 | 000,412,024 | ---- | M] (AVM Berlin) [Kernel | On_Demand] -- C:\Windows\System32\drivers\avmnwim.sys -- (NWIM)
DRV:64bit: - [2009/07/16 04:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2009/07/13 19:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009/07/13 19:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009/07/13 19:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009/07/13 19:06:48 | 000,067,072 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\BTHPRINT.SYS -- (BTHprint)
DRV:64bit: - [2009/07/08 20:00:00 | 000,055,280 | ---- | M] (Sonic Solutions) [Kernel | Boot] -- C:\Windows\System32\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:64bit: - [2009/06/17 11:54:46 | 000,040,976 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV:64bit: - [2009/06/17 11:54:30 | 000,057,872 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2009/06/17 11:54:22 | 000,055,312 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2009/06/17 11:53:34 | 000,030,736 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV:64bit: - [2009/06/17 03:35:20 | 000,026,112 | ---- | M] (TerraTec Electronic GmbH.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\UDST7000HID.sys -- (UDST7000HID)
DRV:64bit: - [2009/06/17 03:35:18 | 000,527,872 | ---- | M] (TerraTec Electronic GmbH.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\UDST7000Bda.sys -- (UDST7000BDA)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- C:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2008/10/24 07:25:00 | 000,032,768 | ---- | M] (CSR) [Kernel | On_Demand] -- C:\Windows\System32\drivers\csrbcx64.sys -- (CSRBC)
DRV:64bit: - [2008/08/28 06:44:42 | 000,025,600 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\pccsmcfdx64.sys -- (pccsmcfd)
DRV:64bit: - [2008/03/13 07:51:00 | 000,068,800 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ftdibus.sys -- (SMA_USBBUS)
DRV:64bit: - [2007/02/22 11:09:40 | 000,235,760 | ---- | M] (XIMETA, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ndasscsi.sys -- (ndasscsi)
DRV:64bit: - [2007/02/22 11:09:38 | 000,536,816 | ---- | M] (XIMETA, Inc.) [File_System | System] -- C:\Windows\System32\drivers\ndasfat.sys -- (ndasfat)
DRV:64bit: - [2007/02/22 11:09:36 | 000,339,696 | ---- | M] (XIMETA, Inc.) [Kernel | Boot] -- C:\Windows\System32\drivers\lfsfilt.sys -- (lfsfilt)
DRV:64bit: - [2007/02/22 11:09:36 | 000,108,784 | ---- | M] (XIMETA, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ndasbus.sys -- (ndasbus)
DRV:64bit: - [2007/02/22 11:09:36 | 000,096,496 | ---- | M] (XIMETA, Inc.) [Kernel | Boot] -- C:\Windows\System32\drivers\lpx.sys -- (lpx)
DRV - [2011/11/16 12:21:38 | 000,017,152 | ---- | M] () [Kernel | On_Demand] -- C:\Program Files (x86)\Lavasoft\Ad-Aware\kernexplorer64.sys -- (Lavasoft Kernexplorer)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Bernd_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland: Hotmail, Skype und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\Bernd_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\Bernd_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Bernd_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3C 65 82 FE C2 7A CB 01  [binary data]
IE - HKU\Bernd_ON_C\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKU\Bernd_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Bernd_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;127.0.0.1:9421;
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: MapShare-status@tomtom.com:1.7.1
FF - prefs.js..extensions.enabledItems: baseTheme@tomtom.com:1.0.2
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ [2010/10/30 08:45:40 | 000,000,000 | ---D | M]
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=: 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@gamersfirst.com/LiveLauncher:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files (x86)\Virtual Earth 3D\ [2010/10/30 08:45:40 | 000,000,000 | ---D | M]
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2010/05/17 12:46:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010/07/09 06:59:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/08/30 04:56:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2010/05/17 12:46:22 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011/08/30 04:56:34 | 000,000,000 | ---D | M]
 
[2010/05/15 12:12:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bernd\AppData\Roaming\Mozilla\Extensions
[2010/05/15 12:12:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Bernd\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
[2011/11/17 11:43:07 | 000,000,000 | ---D | M] (Map status indicator) -- C:\PROGRAM FILES (X86)\TOMTOM HOME 2\XUL\EXTENSIONS\MAPSHARE-STATUS@TOMTOM.COM
 
O1 HOSTS File: ([2010/09/28 09:47:15 | 000,000,002 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (SplitButtonBHO Class) - {C0C86BBE-9509-4296-8459-FDBFDAF4B673} - C:\Program Files\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll (AVM Berlin)
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKLM\..\Toolbar: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files (x86)\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\Bernd_ON_C\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Bluetooth Connection Assistant]  File not found
O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [0ZL5KpKbdq59PFw] C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe (StompSoft, Inc.)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [Host System]  File not found
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Lexware GmbH & Co. KG)
O4 - HKLM..\Run: [LWS] C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.)
O4 - HKLM..\Run: [NBAgent] C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [NSU_agent] C:\Program Files (x86)\Nokia\Nokia Software Updater\nsu3ui_agent.exe ()
O4 - HKLM..\Run: [QFan Help] C:\Program Files (x86)\ASUS\AI Suite\QFan3\QFanHelp.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched]  File not found
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TurboV EVO] C:\Program Files (x86)\ASUS\TurboV EVO\TurboV_EVO.exe (ASUSTeK Computer Inc.)
O4 - HKU\Bernd_ON_C..\Run: []  File not found
O4 - HKU\Bernd_ON_C..\Run: [0ZL5KpKbdq59PFw] C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe (StompSoft, Inc.)
O4 - HKU\Bernd_ON_C..\Run: [1]  File not found
O4 - HKU\Bernd_ON_C..\Run: [AdobeBridge] C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe (Adobe Systems, Inc.)
O4 - HKU\Bernd_ON_C..\Run: [Akamai NetSession Interface] C:\Users\Bernd\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKU\Bernd_ON_C..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]  File not found
O4 - HKU\Bernd_ON_C..\Run: [BitTorrent DNA] C:\Program Files (x86)\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKU\Bernd_ON_C..\Run: [Device Detector]  File not found
O4 - HKU\Bernd_ON_C..\Run: [Host System]  File not found
O4 - HKU\Bernd_ON_C..\Run: [Logitech Vid] C:\Program Files (x86)\Logitech\Vid HD\Vid.exe (Logitech Inc.)
O4 - HKU\Bernd_ON_C..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKU\Bernd_ON_C..\Run: [NokiaOviSuite2] C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe (Nokia)
O4 - HKU\Bernd_ON_C..\Run: [Remote Control Editor] C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe (Elgato Systems)
O4 - HKU\Bernd_ON_C..\Run: [TomTomHOME.exe] C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKU\LocalService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin]  File not found
O4 - Startup: C:\Users\Bernd\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!Fernzugang.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: Host System = C:\Users\Bernd\AppData\Roaming\local.exe
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\Bernd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Bernd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Bernd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Bernd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: FRITZ!Box Dial - C:\Program Files\FRITZ!Box\AddOn (IE)\fb_addon_dial_ie.htm ()
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: FRITZ!Box Dial - C:\Program Files\FRITZ!Box\AddOn (IE)\fb_addon_dial_ie.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9:64bit: - Extra Button: FRITZ!Box AddOn - {328ECD19-C167-40eb-A0C7-16FE7634105F} - C:\Program Files\FRITZ!Box\AddOn (IE)\FBoxIESplitButton.dll (AVM Berlin)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab (20-20 3D Viewer for IKEA)
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_Win32.cab (20-20 3D Viewer)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\x-owacid {0215258f-f0a8-49de-bf1b-0ff02eda8807} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe) - C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe (StompSoft, Inc.)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Bernd_ON_C Winlogon: Shell - (C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe) - C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe (StompSoft, Inc.)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{3e7407ed-c899-11df-b42a-e0cb4e9e1472}\Shell - "" = AutoRun
O33 - MountPoints2\{3e7407ed-c899-11df-b42a-e0cb4e9e1472}\Shell\AutoRun\command - "" = M:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (lsdelete) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/02/21 12:31:50 | 000,000,000 | ---D | C] -- C:\Users\Bernd\AppData\Roaming\HPAppData
[2012/02/21 12:16:08 | 000,301,056 | ---- | C] (StompSoft, Inc.) -- C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe
[2012/02/16 14:20:52 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmled.dll
[2012/02/16 14:20:51 | 002,308,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012/02/16 14:20:51 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012/02/16 14:20:50 | 001,798,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9.dll
[2012/02/16 14:20:50 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012/02/16 14:20:50 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012/02/16 14:20:50 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012/02/16 14:20:50 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012/02/16 14:20:49 | 001,493,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012/02/16 14:20:49 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012/02/16 14:20:49 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2012/02/16 14:20:49 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012/02/16 12:21:55 | 000,509,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntshrui.dll
[2012/02/16 12:21:53 | 000,515,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\timedate.cpl
[2012/02/16 12:21:53 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\timedate.cpl
[2012/02/16 12:21:48 | 000,634,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvcrt.dll
[2012/02/12 06:42:25 | 000,000,000 | ---D | C] -- C:\Bilder Garten
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/02/21 13:51:48 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/02/21 13:40:52 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2012/02/21 13:40:30 | 2145,923,071 | -HS- | M] () -- C:\hiberfil.sys
[2012/02/21 12:29:30 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/02/21 12:26:13 | 000,014,608 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/02/21 12:26:13 | 000,014,608 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/02/21 12:16:06 | 000,301,056 | ---- | M] (StompSoft, Inc.) -- C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe
[2012/02/21 12:04:05 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/02/21 11:22:33 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012/02/20 14:47:09 | 000,100,864 | ---- | M] () -- C:\Users\Bernd\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/02/20 14:47:01 | 2083,679,168 | ---- | M] () -- C:\Users\Bernd\Documents\capture547.avi
[2012/02/20 13:45:36 | 000,000,064 | ---- | M] () -- C:\Windows\SysWow64\rp_stats.dat
[2012/02/20 13:45:36 | 000,000,044 | ---- | M] () -- C:\Windows\SysWow64\rp_rules.dat
[2012/02/18 08:13:32 | 004,985,632 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012/02/16 14:28:19 | 000,657,542 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/02/16 14:28:19 | 000,618,818 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/02/16 14:28:19 | 000,130,914 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/02/16 14:28:19 | 000,107,138 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/02/16 14:27:11 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012/02/16 13:34:26 | 758,220,306 | ---- | M] () -- C:\Users\Bernd\Documents\capture-435.avi
[2012/02/15 14:08:06 | 1912,618,348 | ---- | M] () -- C:\Users\Bernd\Documents\capture-457.avi
[2012/02/14 14:11:03 | 2061,841,724 | ---- | M] () -- C:\Users\Bernd\Documents\capture-6575.avi
[2012/02/13 13:43:31 | 2512,770,232 | ---- | M] () -- C:\Users\Bernd\Documents\capture34645.avi
[2012/02/12 13:42:00 | 000,327,680 | ---- | M] () -- C:\Users\Bernd\Documents\Zeichnung1.vsd
[2012/02/10 14:22:35 | 717,167,968 | ---- | M] () -- C:\Users\Bernd\Documents\capture-7698.avi
[2012/02/08 14:35:49 | 1243,691,256 | ---- | M] () -- C:\Users\Bernd\Documents\capture-42365.avi
[2012/02/07 16:20:06 | 416,460,316 | ---- | M] () -- C:\Users\Bernd\Documents\capture-325.avi
[2012/02/06 15:56:41 | 967,855,862 | ---- | M] () -- C:\Users\Bernd\Documents\capture-547.avi
[2012/01/28 08:34:40 | 101,106,267 | ---- | M] () -- C:\Users\Bernd\Documents\12 Clear Water Trailer.m4v
[2012/01/28 08:33:59 | 043,440,343 | ---- | M] () -- C:\Users\Bernd\Documents\05 Echt.m4v
[2012/01/27 05:41:59 | 000,927,020 | ---- | M] () -- C:\Users\Bernd\Documents\kamin2.JPG
[2012/01/27 05:36:36 | 001,579,978 | ---- | M] () -- C:\Users\Bernd\Documents\kamin.JPG
[2012/01/26 16:39:36 | 034,660,453 | ---- | M] () -- C:\Users\Bernd\Documents\capture-4365.avi
[2012/01/25 12:31:41 | 1116,251,818 | ---- | M] () -- C:\Users\Bernd\Documents\capture-243.avi
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/02/21 11:15:19 | 000,000,408 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2012/02/20 14:47:18 | 2083,679,168 | ---- | C] () -- C:\Users\Bernd\Documents\capture547.avi
[2012/02/16 13:34:38 | 758,220,306 | ---- | C] () -- C:\Users\Bernd\Documents\capture-435.avi
[2012/02/15 14:10:43 | 1912,618,348 | ---- | C] () -- C:\Users\Bernd\Documents\capture-457.avi
[2012/02/14 14:11:21 | 2061,841,724 | ---- | C] () -- C:\Users\Bernd\Documents\capture-6575.avi
[2012/02/13 13:44:14 | 2512,770,232 | ---- | C] () -- C:\Users\Bernd\Documents\capture34645.avi
[2012/02/12 13:41:59 | 000,327,680 | ---- | C] () -- C:\Users\Bernd\Documents\Zeichnung1.vsd
[2012/02/10 14:22:48 | 717,167,968 | ---- | C] () -- C:\Users\Bernd\Documents\capture-7698.avi
[2012/02/08 14:36:10 | 1243,691,256 | ---- | C] () -- C:\Users\Bernd\Documents\capture-42365.avi
[2012/02/07 16:20:25 | 416,460,316 | ---- | C] () -- C:\Users\Bernd\Documents\capture-325.avi
[2012/02/06 15:57:05 | 967,855,862 | ---- | C] () -- C:\Users\Bernd\Documents\capture-547.avi
[2012/01/28 09:17:54 | 038,585,613 | ---- | C] () -- C:\Users\Bernd\Documents\19 Rock Therapy.m4v
[2012/01/28 09:17:53 | 042,290,161 | ---- | C] () -- C:\Users\Bernd\Documents\22 Just Can't Get Enough.m4v
[2012/01/28 09:17:52 | 042,975,990 | ---- | C] () -- C:\Users\Bernd\Documents\18 Bildergalerie.m4v
[2012/01/28 09:17:50 | 043,440,343 | ---- | C] () -- C:\Users\Bernd\Documents\05 Echt.m4v
[2012/01/28 09:17:49 | 043,755,813 | ---- | C] () -- C:\Users\Bernd\Documents\19 Nur noch kurz die Welt retten.m4v
[2012/01/28 09:17:48 | 044,791,291 | ---- | C] () -- C:\Users\Bernd\Documents\07 Die Härte.m4v
[2012/01/28 09:17:46 | 045,502,844 | ---- | C] () -- C:\Users\Bernd\Documents\08 Wenn Worte meine Sprache wären.m4v
[2012/01/28 09:17:45 | 045,732,651 | ---- | C] () -- C:\Users\Bernd\Documents\20 Nur noch kurz die Welt retten.m4v
[2012/01/28 09:17:43 | 045,766,142 | ---- | C] () -- C:\Users\Bernd\Documents\11 Halt mich.m4v
[2012/01/28 09:17:42 | 046,419,320 | ---- | C] () -- C:\Users\Bernd\Documents\21 Just Can't Get Enough.m4v
[2012/01/28 09:17:40 | 081,643,990 | ---- | C] () -- C:\Users\Bernd\Documents\24 _Wenn Worte meine Sprache wären_.m4v
[2012/01/28 09:17:37 | 099,014,867 | ---- | C] () -- C:\Users\Bernd\Documents\14 Einblicke in Atemlos.m4v
[2012/01/28 09:17:34 | 101,106,267 | ---- | C] () -- C:\Users\Bernd\Documents\12 Clear Water Trailer.m4v
[2012/01/28 09:17:31 | 113,216,144 | ---- | C] () -- C:\Users\Bernd\Documents\17 Polarstern.m4v
[2012/01/28 09:17:27 | 182,726,408 | ---- | C] () -- C:\Users\Bernd\Documents\13 Adele 21 - A Track By Track Inter.m4v
[2012/01/28 09:17:23 | 202,824,991 | ---- | C] () -- C:\Users\Bernd\Documents\16 Studiosession - Schiller mit Jaki.m4v
[2012/01/28 09:17:17 | 213,656,786 | ---- | C] () -- C:\Users\Bernd\Documents\25 _Wenn Worte meine Sprache wären_.m4v
[2012/01/28 09:17:13 | 256,263,270 | ---- | C] () -- C:\Users\Bernd\Documents\15 Elektronik-Symphonie_ Wasser.m4v
[2012/01/28 09:17:07 | 292,356,212 | ---- | C] () -- C:\Users\Bernd\Documents\13 Doku.m4v
[2012/01/28 09:17:01 | 516,584,965 | ---- | C] () -- C:\Users\Bernd\Documents\33 Interview Peter Maffay.m4v
[2012/01/28 09:15:46 | 047,583,954 | ---- | C] () -- C:\Users\Bernd\Documents\20 Business Paris.m4v
[2012/01/28 09:15:45 | 047,630,931 | ---- | C] () -- C:\Users\Bernd\Documents\18 Demo (Letzter Tag).m4v
[2012/01/28 09:15:44 | 048,098,431 | ---- | C] () -- C:\Users\Bernd\Documents\23 Keine Zeit.m4v
[2012/01/28 09:15:43 | 048,180,931 | ---- | C] () -- C:\Users\Bernd\Documents\21 Mondfinsternis.m4v
[2012/01/28 09:15:42 | 050,066,461 | ---- | C] () -- C:\Users\Bernd\Documents\14 Just in Love.m4v
[2012/01/28 09:15:41 | 050,504,212 | ---- | C] () -- C:\Users\Bernd\Documents\22 Mehr davon.m4v
[2012/01/28 09:15:40 | 050,596,204 | ---- | C] () -- C:\Users\Bernd\Documents\06 Back It Up.m4v
[2012/01/28 09:15:39 | 050,996,508 | ---- | C] () -- C:\Users\Bernd\Documents\20 Walk This Way.m4v
[2012/01/28 09:15:39 | 050,971,968 | ---- | C] () -- C:\Users\Bernd\Documents\22 Lied 3 - Du bist die.m4v
[2012/01/28 09:15:38 | 051,210,298 | ---- | C] () -- C:\Users\Bernd\Documents\01 Airplanes in My Head.m4v
[2012/01/28 09:15:37 | 052,136,185 | ---- | C] () -- C:\Users\Bernd\Documents\05 A Night Like This.m4v
[2012/01/28 09:15:37 | 052,084,402 | ---- | C] () -- C:\Users\Bernd\Documents\32 Tabaluga & die Zeichen der Zeit.m4v
[2012/01/28 09:15:36 | 052,614,624 | ---- | C] () -- C:\Users\Bernd\Documents\03 Just the Way You Are (Bonus Track.m4v
[2012/01/28 09:15:35 | 053,074,437 | ---- | C] () -- C:\Users\Bernd\Documents\23 Lied 2 - Kopf hoch, tanzen.m4v
[2012/01/28 09:15:34 | 054,104,419 | ---- | C] () -- C:\Users\Bernd\Documents\21 Lied 1 - Stück vom Himmel.m4v
[2012/01/28 09:15:34 | 053,666,109 | ---- | C] () -- C:\Users\Bernd\Documents\16 Mensch.m4v
[2012/01/28 09:15:33 | 054,469,556 | ---- | C] () -- C:\Users\Bernd\Documents\04 Marie (English Version).m4v
[2012/01/28 09:14:33 | 055,698,838 | ---- | C] () -- C:\Users\Bernd\Documents\09 Morgenrot (Trance Mix Radio Edit).m4v
[2012/01/28 09:14:32 | 056,233,549 | ---- | C] () -- C:\Users\Bernd\Documents\14 Fanatisch..m4v
[2012/01/28 09:14:30 | 057,487,672 | ---- | C] () -- C:\Users\Bernd\Documents\17 Der Weg.m4v
[2012/01/28 09:14:29 | 058,036,461 | ---- | C] () -- C:\Users\Bernd\Documents\03 Full Moon.m4v
[2012/01/28 09:14:28 | 058,502,088 | ---- | C] () -- C:\Users\Bernd\Documents\15 Da Da Da (Ich lieb dich nicht, du.m4v
[2012/01/28 09:14:27 | 059,348,256 | ---- | C] () -- C:\Users\Bernd\Documents\05 Fisch im Netz.m4v
[2012/01/28 09:14:25 | 060,445,752 | ---- | C] () -- C:\Users\Bernd\Documents\13 Ich dreh mich um dich.m4v
[2012/01/28 09:14:24 | 061,323,004 | ---- | C] () -- C:\Users\Bernd\Documents\12 Bleibt alles anders.m4v
[2012/01/28 09:14:23 | 062,982,540 | ---- | C] () -- C:\Users\Bernd\Documents\02 Was soll das.m4v
[2012/01/28 09:14:22 | 063,316,460 | ---- | C] () -- C:\Users\Bernd\Documents\19 Zum Meer.m4v
[2012/01/28 09:14:21 | 065,420,212 | ---- | C] () -- C:\Users\Bernd\Documents\10 Bochum.m4v
[2012/01/28 09:14:20 | 065,632,874 | ---- | C] () -- C:\Users\Bernd\Documents\34 Die Zeit hält nur in Träumen an.m4v
[2012/01/28 09:14:19 | 065,937,122 | ---- | C] () -- C:\Users\Bernd\Documents\24 Lied 6 - Leb in meiner Welt (Live.m4v
[2012/01/28 09:14:18 | 065,990,222 | ---- | C] () -- C:\Users\Bernd\Documents\06 Chaos.m4v
[2012/01/28 09:14:17 | 066,401,575 | ---- | C] () -- C:\Users\Bernd\Documents\15 Right By Your Side.m4v
[2012/01/28 09:14:16 | 067,475,506 | ---- | C] () -- C:\Users\Bernd\Documents\08 Land Unter.m4v
[2012/01/28 09:14:15 | 070,630,996 | ---- | C] () -- C:\Users\Bernd\Documents\21 Ich laufe.m4v
[2012/01/28 09:14:15 | 068,101,391 | ---- | C] () -- C:\Users\Bernd\Documents\20 Zeit, dass sich was dreht (Deutsc.m4v
[2012/01/28 09:12:09 | 069,486,999 | ---- | C] () -- C:\Users\Bernd\Documents\35 Making of _Die Zeit hält nur in T.m4v
[2012/01/27 05:41:59 | 000,927,020 | ---- | C] () -- C:\Users\Bernd\Documents\kamin2.JPG
[2012/01/27 05:36:35 | 001,579,978 | ---- | C] () -- C:\Users\Bernd\Documents\kamin.JPG
[2012/01/26 16:39:59 | 034,660,453 | ---- | C] () -- C:\Users\Bernd\Documents\capture-4365.avi
[2012/01/25 12:31:53 | 1116,251,818 | ---- | C] () -- C:\Users\Bernd\Documents\capture-243.avi
[2012/01/22 06:21:17 | 000,000,000 | ---- | C] () -- C:\Users\Bernd\AppData\Local\{CFE9FD9C-A9D0-4366-9CAB-465F24DE71F1}
[2011/12/05 11:45:15 | 000,000,032 | ---- | C] () -- C:\Users\Bernd\AppData\Roaming\kl
[2011/10/22 10:50:55 | 000,000,000 | ---- | C] () -- C:\Users\Bernd\AppData\Local\{C6ECBAE6-5B94-4AD4-A328-3DF5EC22E889}
[2011/08/30 04:54:07 | 000,234,208 | ---- | C] () -- C:\Windows\hpoins35.dat
[2011/08/30 04:54:07 | 000,000,778 | ---- | C] () -- C:\Windows\hpomdl35.dat
[2011/08/29 09:56:27 | 000,000,778 | ---- | C] () -- C:\Windows\hpomdl35.dat.temp
[2011/08/19 03:26:20 | 010,898,456 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2011/08/19 03:26:20 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2011/08/19 03:26:20 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2011/04/23 11:25:40 | 000,000,064 | ---- | C] () -- C:\Windows\SysWow64\rp_stats.dat
[2011/04/23 11:25:40 | 000,000,044 | ---- | C] () -- C:\Windows\SysWow64\rp_rules.dat
[2011/03/18 02:41:39 | 000,252,928 | ---- | C] () -- C:\Windows\SysWow64\DShowRdpFilter.dll
[2011/01/26 10:35:35 | 000,007,616 | ---- | C] () -- C:\Users\Bernd\AppData\Local\Resmon.ResmonCfg
[2010/12/17 07:34:11 | 000,100,864 | ---- | C] () -- C:\Users\Bernd\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/16 08:39:36 | 000,165,376 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2010/12/16 08:39:36 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010/12/16 08:39:33 | 000,790,528 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010/12/16 08:39:33 | 000,134,144 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010/12/16 08:39:33 | 000,108,032 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010/09/08 10:06:12 | 000,147,520 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2010/09/03 11:59:24 | 000,000,000 | ---- | C] () -- C:\Users\Bernd\AppData\Roaming\chrtmp
[2010/07/10 05:30:30 | 001,526,060 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010/07/09 12:39:03 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010/06/11 16:59:49 | 000,011,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys
[2010/06/11 16:59:49 | 000,010,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys
[2010/06/11 16:36:41 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\AsIO.dll
[2010/06/11 16:36:41 | 000,013,440 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys
[2010/06/11 16:36:41 | 000,013,368 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsUpIO.sys
[2010/06/11 16:36:22 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2010/05/16 12:13:44 | 000,016,384 | ---- | C] () -- C:\Windows\SysWow64\FileOps.exe
[2010/05/15 16:05:22 | 000,000,162 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/05/15 12:20:39 | 000,000,000 | ---- | C] () -- C:\Windows\HPMProp.INI
[2009/11/17 10:11:26 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\dnt27VC8.dll
[2009/11/17 10:09:36 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\dntvmc27VC8.dll
[2009/11/17 10:09:20 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\dntvm27VC8.dll
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- C:\Windows\SysWow64\ir32_32.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2007/07/03 09:44:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\ALZALZ.BIN
[2007/07/03 09:44:10 | 000,044,544 | ---- | C] () -- C:\Windows\SysWow64\ALZZip.BIN
 
========== LOP Check ==========
 
[2010/05/15 15:35:18 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\ACD Systems
[2011/12/30 06:35:51 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\AVM
[2010/05/16 05:25:41 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\DataDesign
[2012/02/21 12:16:46 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\DNA
[2010/11/18 05:59:39 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\elsterformular
[2010/11/21 12:09:15 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\Haite
[2010/05/15 12:02:57 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\Leadertech
[2011/06/13 08:11:28 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\Lexware
[2010/05/18 10:05:45 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\Nokia
[2011/12/05 11:07:35 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\PC Suite
[2011/06/03 00:51:35 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\SMA
[2010/05/15 15:12:39 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\TerraTec
[2010/05/15 12:12:31 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\TomTom
[2010/12/03 13:11:30 | 000,000,000 | ---D | M] -- C:\Users\Bernd\AppData\Roaming\TrueCrypt
[2010/05/15 15:34:42 | 000,000,000 | ---D | M] -- C:\ProgramData\ACD Systems
[2010/05/15 11:38:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Alwil Software
[2010/05/15 10:32:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2010/06/12 11:24:24 | 000,000,000 | ---D | M] -- C:\ProgramData\ASUS OC Profiles
[2011/12/30 06:34:16 | 000,000,000 | ---D | M] -- C:\ProgramData\AVM
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2010/05/15 10:32:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2010/11/18 05:59:02 | 000,000,000 | ---D | M] -- C:\ProgramData\elsterformular
[2010/05/15 10:32:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2011/12/05 11:09:12 | 000,000,000 | ---D | M] -- C:\ProgramData\Installations
[2010/12/02 12:19:40 | 000,000,000 | ---D | M] -- C:\ProgramData\Lexware
[2010/05/17 13:21:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Nokia
[2010/05/17 12:45:35 | 000,000,000 | ---D | M] -- C:\ProgramData\OviInstallerCache
[2010/06/27 05:53:58 | 000,000,000 | ---D | M] -- C:\ProgramData\PC Suite
[2011/11/07 11:41:29 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files
[2010/07/09 12:43:14 | 000,000,000 | ---D | M] -- C:\ProgramData\regid.1986-12.com.adobe
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2010/05/15 10:32:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2010/05/15 12:16:21 | 000,000,000 | ---D | M] -- C:\ProgramData\TechSmith
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2010/05/15 15:11:48 | 000,000,000 | ---D | M] -- C:\ProgramData\TerraTec
[2010/07/18 07:53:26 | 000,000,000 | ---D | M] -- C:\ProgramData\TomTom
[2010/05/15 10:32:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2010/05/16 05:13:56 | 000,000,000 | ---D | M] -- C:\ProgramData\World Money
[2010/07/20 14:00:33 | 000,000,000 | ---D | M] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2011/03/25 11:24:44 | 000,000,000 | -H-D | M] -- C:\ProgramData\{B9365670-BD70-4096-864E-93B3DBFCC02B}
[2012/02/21 13:40:52 | 000,000,408 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2012/01/19 13:07:45 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
--- --- ---

Lausitz 22.02.2012 15:31
eine datei mit namen extras.txt finde ich aber nicht unter c:

cosinus 22.02.2012 19:26
Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKU\Bernd_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;127.0.0.1:9421;
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [0ZL5KpKbdq59PFw] C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe (StompSoft, Inc.)
O4 - HKLM..\Run: [Host System]  File not found
O4 - HKLM..\Run: [SunJavaUpdateSched]  File not found
O4 - HKU\Bernd_ON_C..\Run: []  File not found
O4 - HKU\Bernd_ON_C..\Run: [0ZL5KpKbdq59PFw] C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe (StompSoft, Inc.)
O4 - HKU\Bernd_ON_C..\Run: [1]  File not found
O4 - HKU\Bernd_ON_C..\Run: [Akamai NetSession Interface] C:\Users\Bernd\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKU\Bernd_ON_C..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]  File not found
O4 - HKU\Bernd_ON_C..\Run: [BitTorrent DNA] C:\Program Files (x86)\DNA\btdna.exe (BitTorrent, Inc.)
O4 - HKU\Bernd_ON_C..\Run: [Device Detector]  File not found
O4 - HKU\Bernd_ON_C..\Run: [Host System]  File not found
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: Host System = C:\Users\Bernd\AppData\Roaming\local.exe
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\Bernd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Bernd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Bernd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Bernd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKLM Winlogon: Shell - (C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe) - C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe (StompSoft, Inc.)
O20 - HKU\Bernd_ON_C Winlogon: Shell - (C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe) - C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe (StompSoft, Inc.)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{3e7407ed-c899-11df-b42a-e0cb4e9e1472}\Shell - "" = AutoRun
O33 - MountPoints2\{3e7407ed-c899-11df-b42a-e0cb4e9e1472}\Shell\AutoRun\command - "" = M:\LaunchU3.exe -a
:Files
C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe
C:\Users\Bernd\AppData\Local\{CFE9FD9C-A9D0-4366-9CAB-465F24DE71F1}
C:\Users\Bernd\AppData\Roaming\kl
C:\Users\Bernd\AppData\Local\{C6ECBAE6-5B94-4AD4-A328-3DF5EC22E889}
:Commands
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

Lausitz 23.02.2012 15:33
========== OTL ==========
HKU\Bernd_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\0ZL5KpKbdq59PFw deleted successfully.
C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\Host System deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
Registry key HKEY_USERS\Bernd_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\Bernd_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
File C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe not found.
Registry key HKEY_USERS\Bernd_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\Bernd_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
C:\Users\Bernd\AppData\Local\Akamai\netsession_win.exe moved successfully.
Registry key HKEY_USERS\Bernd_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\Bernd_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
C:\Program Files (x86)\DNA\btdna.exe moved successfully.
Registry key HKEY_USERS\Bernd_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\Bernd_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_USERS\LocalService_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce not found.
Registry key HKEY_USERS\NetworkService_ON_C\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\\Host System deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLinkedConnections deleted successfully.
Registry value HKEY_USERS\Bernd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_USERS\Bernd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDesktop deleted successfully.
Registry value HKEY_USERS\Bernd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.
Registry value HKEY_USERS\Bernd_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe deleted successfully.
File C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe not found.
Registry value HKEY_USERS\Bernd_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe deleted successfully.
File C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe not found.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3e7407ed-c899-11df-b42a-e0cb4e9e1472}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3e7407ed-c899-11df-b42a-e0cb4e9e1472}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3e7407ed-c899-11df-b42a-e0cb4e9e1472}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3e7407ed-c899-11df-b42a-e0cb4e9e1472}\ not found.
File M:\LaunchU3.exe -a not found.
========== FILES ==========
File\Folder C:\Users\Bernd\AppData\Roaming\jj65sirug4.exe not found.
C:\Users\Bernd\AppData\Local\{CFE9FD9C-A9D0-4366-9CAB-465F24DE71F1} moved successfully.
C:\Users\Bernd\AppData\Roaming\kl moved successfully.
C:\Users\Bernd\AppData\Local\{C6ECBAE6-5B94-4AD4-A328-3DF5EC22E889} moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTLPE by OldTimer - Version 3.1.48.0 log created on 02232012_153902

Lausitz 23.02.2012 17:23
kannste mir mal sagen wie dieser schei..... Virus trotz Virenscanner auf meinen Rechner gekommen ist. Bekommst du das wieder hin???

cosinus 23.02.2012 17:47
Startet Windows wieder normal? Oder zumindest im abgesicherten Modus?

Zitat:
Virus trotz Virenscanner auf meinen Rechner gekommen ist. Bekommst du das wieder hin???
Wenn du diese Frage stellst, hast du prinzipiell irgendwas nicht verstanden wie Virenscanner funktionieren. Ein Virenscanner ist ein sehr unzuverlässiger Schutz.

Lausitz 23.02.2012 18:22
Der Rechner startet scheinbar ganz normal. Muss ich jetzt noch was machen? Was kann ich tun damit dieser Virus (Trojaner) was auch immer nicht wieder meinen rechner befällt??? Scheinbar reicht AVAST allein nicht aus. Bisher hast du tolle Arbeit geleistet. Als Dank hatte ich gestern schon ne Überweisung getätigt.

Lausitz 23.02.2012 18:47
der Desktop ist allerdings ganz leer, d.h. alle verknüpfungen sind weg. Aber das ist wohl nicht so schlimm.

Lausitz 23.02.2012 19:10
ups die icons sind jetzt wieder da. dan läuft der rechner jetzt wieder wie vorher.

cosinus 23.02.2012 21:01
Bitte nun routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden.

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:45 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131