Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Onlinezugang gesperrt - Trojaner Gosi, TAN-Fenster, andere Schädlinge ? (https://www.trojaner-board.de/95321-onlinezugang-gesperrt-trojaner-gosi-tan-fenster-andere-schaedlinge.html)

cosinus 04.02.2011 15:28
Hallo ruhig bleiben! Nichts voreilig unternehmen, das mit CONVERT war als Hinweis gedacht, das machen wir dann wenn wir durch sind!! Deswegen hb ich auch extra keine genauen Befehle gepostet! :balla:

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

Albino2004 04.02.2011 15:36
Zitat:
Zitat von cosinus (Beitrag 616663)
Hallo ruhig bleiben! Nichts voreilig unternehmen, das mit CONVERT war als Hinweis gedacht, das machen wir dann wenn wir durch sind!! Deswegen hb ich auch extra keine genauen Befehle gepostet! :balla:
Oh Sorry, jetzt ist Convert durch :headbang: -> Da zu dem Zeitpunkt keine weiterere Anweisung kam, hab' ich halt vermutet, Du erwartet es.

Soll ich nun wie beschrieben mit GMER und OSAM weitermachen :confused:

cosinus 04.02.2011 15:46
Naja, nun ist es egal. Sei es drum. Hat C: jetzt NTFS?

Albino2004 04.02.2011 15:53
Ja c: hat nun NTFS !

Ich führe jetzt mal GMER und OSAM aus und poste dann die LOGS.

Albino2004 04.02.2011 20:57
So, die knappen 220 Minuten kamen mir wie Stunden vor :party:

Hier die 3 Logs:

Code:
GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-02-04 20:32:39
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 FUJITSU_MHV2120BH_PL rev.00000029
Running: emopy2v1.exe; Driver: C:\DOKUME~1\Admin\LOKALE~1\Temp\pwtdrpoc.sys


---- System - GMER 1.0.15 ----

SSDT            BA690D46                                                                                                            ZwCreateKey
SSDT            BA690D3C                                                                                                            ZwCreateThread
SSDT            BA690D4B                                                                                                            ZwDeleteKey
SSDT            BA690D55                                                                                                            ZwDeleteValueKey
SSDT            BA690D5A                                                                                                            ZwLoadKey
SSDT            BA690D28                                                                                                            ZwOpenProcess
SSDT            BA690D2D                                                                                                            ZwOpenThread
SSDT            BA690D64                                                                                                            ZwReplaceKey
SSDT            BA690D5F                                                                                                            ZwRestoreKey
SSDT            BA690D50                                                                                                            ZwSetValueKey

---- Kernel code sections - GMER 1.0.15 ----

.text          C:\WINDOWS\system32\DRIVERS\ati2mtag.sys                                                                            section is writeable [0xB99DD000, 0x1C5D58, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                            VMkbd.sys (VMware keyboard filter driver (32-bit)/VMware, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                            VMkbd.sys (VMware keyboard filter driver (32-bit)/VMware, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                            SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device          \Driver\usbuhci \Device\USBFDO-0                                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbuhci \Device\USBFDO-1                                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbuhci \Device\USBFDO-2                                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbuhci \Device\USBFDO-3                                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)
Device          \Driver\usbehci \Device\USBFDO-4                                                                                    hcmon.sys (VMware USB monitor/VMware, Inc.)

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                            fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b  0xC8 0x28 0x51 0xAF ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b  0x6A 0x9C 0xD6 0x61 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016  0xFF 0x7C 0x85 0xE0 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48  0x3E 0x1E 0x9E 0xE0 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472  0xF5 0x1D 0x4D 0x73 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d  0xB0 0x18 0xED 0xA7 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b  0x31 0x77 0xE1 0xBA ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d  0x01 0x3A 0x48 0xFC ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3  0x51 0xFA 0x6E 0x91 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b  0x37 0xA4 0xAA 0xC3 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6  0xE3 0x0E 0x66 0xD5 ...
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32                                 
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel                    Apartment
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL
Reg            HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2  0x05 0x73 0x21 0xDD ...

---- EOF - GMER 1.0.15 ----
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 20:40:08 on 04.02.2011

OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 6.00.2900.5512

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"camcpl.cpl" - "Logitech Inc." - C:\WINDOWS\system32\camcpl.cpl
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\WINDOWS\system32\DivXControlPanelApplet.cpl
"IfxSpMgt.cpl" - "Infineon Technologies AG" - C:\WINDOWS\system32\IfxSpMgt.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"LocalCOM.cpl" - "東芝公司" - C:\WINDOWS\system32\LocalCOM.cpl
"PCWizard.cpl" - "CPUID" - C:\WINDOWS\system32\PCWizard.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"aslm75" (aslm75) - ? - C:\Programme\ASUS\Splendid\aslm75.sys  (File found, but it contains no detailed information)
"ASPI32" (ASPI32) - "Adaptec" - C:\WINDOWS\system32\drivers\ASPI32.sys
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"AVM USB-Fernanschluss" (avmaura) - "AVM Berlin" - C:\WINDOWS\System32\DRIVERS\avmaura.sys
"Bluetooth Audio Device (WDM) from TOSHIBA" (TosRfSnd) - "TOSHIBA Corporation" - C:\WINDOWS\System32\drivers\TosRfSnd.sys
"Bluetooth Personal Area Network from TOSHIBA" (tosrfnds) - "TOSHIBA Corporation." - C:\WINDOWS\System32\DRIVERS\tosrfnds.sys
"Bluetooth Port Driver from Toshiba" (tosporte) - "TOSHIBA Corporation" - C:\WINDOWS\System32\DRIVERS\tosporte.sys
"Bluetooth RFBNEP from TOSHIBA" (Tosrfbnp) - "TOSHIBA Corporation" - C:\WINDOWS\System32\Drivers\tosrfbnp.sys
"Bluetooth RFBUS from TOSHIBA" (Tosrfbd) - "TOSHIBA CORPORATION" - C:\WINDOWS\System32\Drivers\tosrfbd.sys
"Bluetooth RFCOMM from TOSHIBA" (Tosrfcom) - "TOSHIBA Corporation" - C:\WINDOWS\System32\Drivers\tosrfcom.sys
"Bluetooth RFHID from TOSHIBA" (Tosrfhid) - "TOSHIBA Corporation." - C:\WINDOWS\System32\DRIVERS\Tosrfhid.sys
"Bluetooth USB Controller" (Tosrfusb) - "TOSHIBA CORPORATION" - C:\WINDOWS\System32\Drivers\tosrfusb.sys
"catchme" (catchme) - ? - C:\cofi\catchme.sys  (File not found)
"FwHookDrv" (FwHookDrv) - ? - C:\WINDOWS\system32\drivers\FwHookDrv.sys  (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"Intel(R) PRO/Wireless 3945ABG Adaptertreiber für Windows XP 32 Bit" (NETw3x32) - ? - C:\WINDOWS\System32\DRIVERS\NETw3x32.sys  (File not found)
"IVI ASPI Shell" (Iviaspi) - "InterVideo, Inc." - C:\WINDOWS\System32\drivers\iviaspi.sys
"Lavalys EVEREST Kernel Driver" (EverestDriver) - ? - C:\Programme\Lavalys\EVEREST Home Edition\kerneld.wnt  (File found, but it contains no detailed information)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"Logitech QuickCam IM(PID_PEPI)" (PID_PEPI) - ? - C:\WINDOWS\System32\DRIVERS\LV302V32.SYS  (File not found)
"Low level access layer for CD devices" (Pcouffin) - "VSO Software" - C:\WINDOWS\System32\Drivers\Pcouffin.sys
"Padus ASPI Shell" (pfc) - "Padus, Inc." - C:\WINDOWS\System32\drivers\pfc.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"PersonalSecureDrive" (PersonalSecureDrive) - "Infineon Technologies AG" - C:\WINDOWS\System32\drivers\psd.sys
"Pinnacle Marvin Bus" (MarvinBus) - "Pinnacle Systems GmbH" - C:\WINDOWS\System32\DRIVERS\MarvinBus.sys
"pwtdrpoc" (pwtdrpoc) - ? - C:\DOKUME~1\Admin\LOKALE~1\Temp\pwtdrpoc.sys  (Hidden registry entry, rootkit activity | File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"smserial" (smserial) - ? - C:\WINDOWS\System32\DRIVERS\smserial.sys  (File not found)
"Splitcam, WDM Camera Stream Splitter" (SPLITCAM) - "LoteSoft Co." - C:\WINDOWS\System32\DRIVERS\splitcam.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"Telescope Driver" (PAC7302) - "PixArt Imaging Inc." - C:\WINDOWS\System32\DRIVERS\PAC7302.SYS
"TOSHIBA Bluetooth HID port driver" (toshidpt) - "TOSHIBA Corporation." - C:\WINDOWS\System32\drivers\Toshidpt.sys
"U3sHlpDr" (U3sHlpDr) - ? - C:\WINDOWS\System32\Drivers\U3sHlpDr.sys  (File found, but it contains no detailed information)
"VBoxNetFlt Service" (VBoxNetFlt) - "Windows (R) Server 2003 DDK provider" - C:\WINDOWS\System32\DRIVERS\VBoxNetFlt.sys
"VirtualBox Service" (VBoxDrv) - ? - C:\WINDOWS\System32\DRIVERS\VBoxDrv.sys  (File found, but it contains no detailed information)
"VirtualBox USB Monitor Driver" (VBoxUSBMon) - "Sun Microsystems, Inc." - C:\WINDOWS\System32\DRIVERS\VBoxUSBMon.sys
"VMware Bridge Protocol" (VMnetBridge) - "VMware, Inc." - C:\WINDOWS\System32\DRIVERS\vmnetbridge.sys
"VMware hcmon" (hcmon) - "VMware, Inc." - C:\WINDOWS\system32\drivers\hcmon.sys
"VMware kbd" (vmkbd) - "VMware, Inc." - C:\WINDOWS\system32\drivers\VMkbd.sys
"VMware Network Application Interface" (VMnetuserif) - "VMware, Inc." - C:\WINDOWS\system32\drivers\vmnetuserif.sys
"VMware vmci" (vmci) - "VMware, Inc." - C:\WINDOWS\system32\Drivers\vmci.sys
"VMware vmx86" (vmx86) - "VMware, Inc." - C:\WINDOWS\system32\Drivers\vmx86.sys
"Vstor2 WS60 Virtual Storage Driver" (vstor2-ws60) - "VMware, Inc." - C:\Programme\VMware\VMware Player\vstor2-ws60.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
"WinPcap Packet Driver (WPRO_40_1123)" (WPRO_40_1123) - ? - C:\WINDOWS\System32\drivers\WPRO_40_1123.sys  (File not found)

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll
{79BC0345-1015-11D2-A299-006008312725} "blue.shell" - ? -  (File not found | COM-object registry key not found)
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)
{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3} "Eigene Logitech-Bilder" - "Logitech Inc." - C:\Programme\Logitech\Video\Namespc2.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{59850401-6664-101B-B21C-00AA004BA90B} "Microsoft Office Binder Unbind" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office\1031\UNBIND.DLL
{D9872D13-7651-4471-9EEE-F0A00218BEBB} "Multiscan" - ? -  (File not found | COM-object registry key not found)
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL
{E08BF9C5-191E-4B15-8F67-2622B4DB5580} "PSDShCtrl Class" - "Infineon Technologies AG" - C:\Programme\Infineon\Security Platform Software\PSDShExt.dll
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Programme\rpshell.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{DBD8E168-244D-448C-9922-25508950D1DC} "USIShellExt Class" - "Ulead Systems, Inc." - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\USIShex.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
<binary data> "PDFCreator Toolbar" - ? - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx / hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} "PDFCreator Toolbar" - ? - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{C451C08A-EC37-45DF-AAAD-18B51AB5E837} "PDFCreator Toolbar Helper" - ? - C:\Programme\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
{3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - C:\Programme\rpbrowserrecordplugin.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
"The Dude.lnk" - ? - C:\Programme\Dude\dude.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"Bluetooth Manager.lnk" - "東芝公司。" - C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\Autostart\desktop.ini
"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office\OSA9.EXE  (Shortcut exists | File exists)
"Picture Motion Browser Medien-Prüfung.lnk" - "Sony Corporation" - C:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe  (Shortcut exists | File exists)
"Symantec Fax Starter Edition-Anschluss.lnk" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office\1031\OLFSNT40.EXE  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"ReadyNAS Remote" - "NETGEAR" - C:\Programme\NETGEAR ReadyNAS\Remote\bin\ReadyNASRemote.exe
"TomTomHOME.exe" - "TomTom" - "C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe"
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"ABLKSR" - "ASYSTeK Computer INC." - C:\WINDOWS\ABLKSR\ABLKSR.exe
"ACMON" - "ATK" - C:\Programme\ASUS\Splendid\ACMON.exe
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"ATKMEDIA" - "ASUSTeK Computer INC." - C:\Programme\ASUS\ATK Media\DMEDIA.EXE
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"DivXUpdate" - ? - "C:\Programme\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"IntelWireless" - "Intel(R) Corporation" - "C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
"IntelZeroConfig" - "Intel(R) Corporation" - "C:\Programme\Intel\WiFi\bin\ZCfgSvc.exe"
"LogitechVideoRepair" - "Logitech Inc." - C:\Programme\Logitech\Video\ISStart.exe
"LogitechVideoTray" - "Logitech Inc." - C:\Programme\Logitech\Video\LogiTray.exe
"NeroFilterCheck" - "Nero AG" - C:\WINDOWS\system32\NeroCheck.exe
"PAC7302_Monitor" - "PixArt Imaging Incorporation" - C:\WINDOWS\PixArt\PAC7302\Monitor.exe
"PCMService" - "CyberLink Corp." - "C:\Programme\ASUS\Mobile Theater\PCMService.exe"
"Power_Gear" - "ASUSTeK Computer Inc." - C:\Programme\ASUS\Power4 Gear\BatteryLife.exe 1
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\QTTask.exe" -atboottime
"RemoteControl" - "Cyberlink Corp." - C:\Programme\ASUSTek\ASUSDVD\PDVDServ.exe
"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Java\jre6\bin\jusched.exe"
"USBToolTip" - "Pinnacle Systems GmbH" - "C:\Programme\Pinnacle\Shared Files\\Programs\USBTip\USBTip.exe"
"UVS12 Preload" - "Ulead Systems, Inc." - C:\Programme\Corel\Corel VideoStudio 12\uvPL.exe
"VMonitorVMUVC" - "Vimicro Corporation" - "C:\Programme\Vimicro\VMUVC\VMonitor.exe" VMUVC
"VMware hqtray" - "VMware, Inc." - "C:\Programme\VMware\VMware Player\hqtray.exe"
"Wireless Console 2" - ? - C:\Programme\Wireless Console 2\wcourier.exe

[Network Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----
"IntelNetProvCredMan" - "Intel(R) Corporation" - C:\WINDOWS\system32\netprovcredman.dll

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"FRITZ!fax Color Port Monitor" - "AVM Berlin GmbH" - C:\WINDOWS\system32\FritzColorPort.dll
"FRITZ!fax Port Monitor" - "AVM Berlin GmbH" - C:\WINDOWS\system32\FritzPort.dll
"OLFax Ports" - "Microsoft Corporation" - C:\WINDOWS\system32\OLFMNT40.DLL
"PDFCreator" - ? - C:\WINDOWS\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
"Toshiba Bluetooth Monitor" - "Toshiba America Business Solutions, Inc." - C:\WINDOWS\system32\tbtmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"AVM FRITZ!web Routing Service" (de_serv) - "AVM Berlin" - C:\Programme\Gemeinsame Dateien\AVM\de_serv.exe
"CyberLink Background Capture Service (CBCS)" (CLCapSvc) - ? - C:\Programme\ASUS\Mobile Theater\Kernel\TV\CLCapSvc.exe
"CyberLink Media Library Service" (CyberLink Media Library Service) - "Cyberlink" - C:\Programme\ASUS\Mobile Theater\Kernel\CLML_NTService\CLMLServer.exe
"CyberLink Task Scheduler (CTS)" (CLSched) - ? - C:\Programme\ASUS\Mobile Theater\Kernel\TV\CLSched.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - c:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Programme\Intel\WiFi\bin\EvtEng.exe
"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe
"Intel(R) PROSet/Wireless WiFi Service" (S24EventMonitor) - "Intel(R) Corporation" - C:\Programme\Intel\WiFi\bin\S24EvMon.exe
"ITE Remote Control Service" (ITECIRService) - "ITE Tech. Inc." - C:\WINDOWS\system32\RemoteControlService.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
"MotoHelper Service" (MotoHelper) - ? - C:\Programme\Motorola\MotoHelper\MotoHelperService.exe  (File not found)
"NSClientpp (Nagios) 0.3.5.2 2008-09-24 w32" (NSClientpp) - ? - C:\Programme\NSClient++\nsclient++.exe  (File found, but it contains no detailed information)
"PCLEPCI" (PCLEPCI) - "Pinnacle Systems GmbH" - C:\WINDOWS\system32\drivers\pclepci.sys
"Personal Secure Drive Service" (PersonalSecureDriveService) - "Infineon Technologies AG" - c:\Programme\Infineon\Security Platform Software\PSDsrvc.EXE
"Security Platform Management Service" (IFXSpMgtSrv) - "Infineon Technologies AG" - c:\WINDOWS\system32\IFXSPMGT.exe
"SiSoftware Database Agent Service" (SandraDataSrv) - "SiSoftware" - C:\Programme\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
"SiSoftware Sandra Agent Service" (SandraTheSrv) - "SiSoftware" - C:\Programme\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
"TomTomHOMEService" (TomTomHOMEService) - "TomTom" - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe
"Trusted Platform Core Service" (IFXTCS) - "Infineon Technologies AG" - c:\WINDOWS\system32\IFXTCS.exe
"Ulead Burning Helper" (UleadBurningHelper) - "Ulead Systems, Inc." - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
"VMware Agent Service" (ufad-ws60) - "VMware, Inc." - C:\Programme\VMware\VMware Player\vmware-ufad.exe
"VMware Authorization Service" (VMAuthdService) - "VMware, Inc." - C:\Programme\VMware\VMware Player\vmware-authd.exe
"VMware DHCP Service" (VMnetDHCP) - "VMware, Inc." - C:\WINDOWS\system32\vmnetdhcp.exe
"VMware NAT Service" (VMware NAT Service) - "VMware, Inc." - C:\WINDOWS\system32\vmnat.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"IfxWlxEN" - "Infineon Technologies AG" - C:\WINDOWS\system32\IfxWlxEN.dll
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----
"VMCI sockets DGRAM" - "VMware, Inc." - C:\Programme\VMware\VMware Player\vsocklib.dll
"VMCI sockets STREAM" - "VMware, Inc." - C:\Programme\VMware\VMware Player\vsocklib.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Code:
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows XP Professional
Windows Information:                Service Pack 3 (build 2600)
Logical Drives Mask:                0x0000005c

Kernel Drivers (total 162):
  0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
  0x806E5000 \WINDOWS\system32\hal.dll
  0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
  0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
  0xB9F78000 ACPI.sys
  0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
  0xB9F67000 pci.sys
  0xBA0A8000 isapnp.sys
  0xBA0B8000 ohci1394.sys
  0xBA0C8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
  0xBA4BC000 compbatt.sys
  0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
  0xBA670000 pciide.sys
  0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
  0xBA0D8000 MountMgr.sys
  0xB9F48000 ftdisk.sys
  0xBA5AC000 dmload.sys
  0xB9F22000 dmio.sys
  0xBA4C4000 ACPIEC.sys
  0xBA671000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
  0xBA330000 PartMgr.sys
  0xBA0E8000 VolSnap.sys
  0xB9F0A000 atapi.sys
  0xBA0F8000 disk.sys
  0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
  0xB9EEA000 fltmgr.sys
  0xB9ED8000 sr.sys
  0xBA118000 PxHelp20.sys
  0xB9EC1000 KSecDD.sys
  0xB9EAE000 WudfPf.sys
  0xB9E21000 Ntfs.sys
  0xB9DF4000 NDIS.sys
  0xB9DDA000 Mup.sys
  0xBA158000 \SystemRoot\system32\DRIVERS\nic1394.sys
  0xBA5B0000 \SystemRoot\system32\DRIVERS\ATKACPI.sys
  0xBA178000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0xB99DC000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
  0xB99C8000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
  0xB99A0000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0xB9964000 \SystemRoot\system32\DRIVERS\yk51x86.sys
  0xB9561000 \SystemRoot\system32\DRIVERS\NETw5x32.sys
  0xBA368000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0xB953D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0xBA370000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0xB9448000 \SystemRoot\system32\DRIVERS\AVerBDA3x.sys
  0xB9425000 \SystemRoot\system32\DRIVERS\ks.sys
  0xBA55C000 \SystemRoot\system32\DRIVERS\BdaSup.SYS
  0xB9411000 \SystemRoot\system32\DRIVERS\sdbus.sys
  0xBA388000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
  0xBA198000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
  0xB939D000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
  0xBA1A8000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0xBA3A8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0xBA3B8000 \??\C:\WINDOWS\system32\drivers\VMkbd.sys
  0xB936E000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0xBA5B8000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0xBA3C8000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0xBA5BC000 \SystemRoot\system32\DRIVERS\ITECIR.sys
  0xBA3D8000 \SystemRoot\system32\DRIVERS\generic.sys
  0xBA1B8000 \SystemRoot\system32\DRIVERS\IFXTPM.SYS
  0xBA578000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0xB9355000 \SystemRoot\system32\DRIVERS\avmaura.sys
  0xBA3E8000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0xBA1C8000 \SystemRoot\System32\Drivers\tosrfcom.sys
  0xBA1E8000 \SystemRoot\system32\DRIVERS\splitcam.sys
  0xBA1F8000 \SystemRoot\system32\DRIVERS\STREAM.SYS
  0xBA77F000 \SystemRoot\system32\DRIVERS\audstub.sys
  0xBA258000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0xBA594000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0xB933E000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0xBA268000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0xBA278000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0xB928D000 \SystemRoot\system32\DRIVERS\psched.sys
  0xBA288000 \SystemRoot\system32\DRIVERS\msgpc.sys
  0xBA418000 \SystemRoot\system32\DRIVERS\ptilink.sys
  0xBA428000 \SystemRoot\system32\DRIVERS\raspti.sys
  0xBA298000 \SystemRoot\system32\DRIVERS\leafnets.sys
  0xBA2A8000 \SystemRoot\System32\Drivers\Pcouffin.sys
  0xB925D000 \SystemRoot\system32\DRIVERS\rdpdr.sys
  0xBA2B8000 \SystemRoot\system32\DRIVERS\termdd.sys
  0xB9221000 \SystemRoot\system32\DRIVERS\VBoxNetFlt.sys
  0xBA5C4000 \SystemRoot\system32\DRIVERS\swenum.sys
  0xB91C3000 \SystemRoot\system32\DRIVERS\update.sys
  0xB9DA2000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0xB9D9E000 \SystemRoot\system32\DRIVERS\vmnetadapter.sys
  0xB9D9A000 \SystemRoot\system32\DRIVERS\VMNET.SYS
  0xBA2C8000 \SystemRoot\system32\DRIVERS\tosporte.sys
  0xBA2D8000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0xACCE1000 \SystemRoot\system32\drivers\RtkHDAud.sys
  0xACCBD000 \SystemRoot\system32\drivers\portcls.sys
  0xBA318000 \SystemRoot\system32\drivers\drmk.sys
  0xBA168000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0xBA490000 \SystemRoot\System32\drivers\psd.sys
  0xBA5CC000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0xBA7DC000 \SystemRoot\System32\Drivers\Null.SYS
  0xBA5D0000 \SystemRoot\System32\Drivers\Beep.SYS
  0xBA4B0000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0xBA340000 \SystemRoot\System32\drivers\vga.sys
  0xBA5D4000 \SystemRoot\System32\Drivers\mnmdd.SYS
  0xBA5D8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0xBA360000 \SystemRoot\System32\Drivers\Msfs.SYS
  0xBA380000 \SystemRoot\System32\Drivers\Npfs.SYS
  0xB9251000 \SystemRoot\system32\DRIVERS\rasacd.sys
  0xACC62000 \SystemRoot\system32\DRIVERS\ipsec.sys
  0xACC09000 \SystemRoot\system32\DRIVERS\tcpip.sys
  0xACBB9000 \SystemRoot\system32\DRIVERS\netbt.sys
  0xACB93000 \SystemRoot\system32\DRIVERS\ipnat.sys
  0xBA1D8000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0xB9239000 \SystemRoot\System32\drivers\ws2ifsl.sys
  0xBA208000 \SystemRoot\system32\DRIVERS\arp1394.sys
  0xACB71000 \SystemRoot\System32\drivers\afd.sys
  0xBA218000 \SystemRoot\system32\DRIVERS\netbios.sys
  0xBA228000 \SystemRoot\system32\DRIVERS\VBoxUSBMon.sys
  0xBA238000 \SystemRoot\System32\Drivers\tosrfusb.sys
  0xACB5A000 \SystemRoot\system32\DRIVERS\VBoxDrv.sys
  0xBA3B0000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0xACB2F000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0xACABF000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xB931E000 \SystemRoot\System32\Drivers\Fips.SYS
  0xACA99000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0xBA5E0000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
  0xBA3F0000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0xACA56000 \SystemRoot\System32\Drivers\tosrfbd.sys
  0xACA32000 \SystemRoot\System32\Drivers\Fastfat.SYS
  0xB92EE000 \SystemRoot\system32\DRIVERS\Tosrfhid.sys
  0xB92DE000 \SystemRoot\System32\Drivers\tosrfbnp.sys
  0xBA440000 \SystemRoot\system32\DRIVERS\tosrfnds.sys
  0xBA76B000 \SystemRoot\system32\drivers\Toshidpt.sys
  0xB929E000 \SystemRoot\system32\drivers\HIDCLASS.SYS
  0xACA75000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0xAC902000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0xBA5EA000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
  0xBF800000 \SystemRoot\System32\win32k.sys
  0xACA2E000 \SystemRoot\System32\drivers\Dxapi.sys
  0xBA458000 \SystemRoot\System32\watchdog.sys
  0xBF000000 \SystemRoot\System32\drivers\dxg.sys
  0xBA6D7000 \SystemRoot\System32\drivers\dxgthk.sys
  0xBF012000 \SystemRoot\System32\ati2dvag.dll
  0xBF065000 \SystemRoot\System32\ati2cqag.dll
  0xBF0FE000 \SystemRoot\System32\atikvmag.dll
  0xBF182000 \SystemRoot\System32\atiok3x2.dll
  0xBF1CD000 \SystemRoot\System32\ati3duag.dll
  0xBF572000 \SystemRoot\System32\ativvaxx.dll
  0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
  0xAA5AD000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0xBA480000 \SystemRoot\system32\DRIVERS\vmnetbridge.sys
  0xAA575000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0xAA565000 \SystemRoot\system32\DRIVERS\s24trans.sys
  0xAA188000 \SystemRoot\system32\drivers\wdmaud.sys
  0xAA3B5000 \SystemRoot\system32\drivers\sysaudio.sys
  0xAA1BD000 \??\C:\WINDOWS\system32\drivers\hcmon.sys
  0xAA19D000 \??\C:\WINDOWS\system32\Drivers\vmci.sys
  0xA9ED2000 \??\C:\WINDOWS\system32\Drivers\vmx86.sys
  0xAA25D000 \SystemRoot\System32\Drivers\ASPI32.SYS
  0xA9BAA000 \SystemRoot\system32\DRIVERS\srv.sys
  0xBA6AA000 \??\C:\WINDOWS\System32\Drivers\U3sHlpDr.sys
  0xBA358000 \??\C:\WINDOWS\system32\drivers\vmnetuserif.sys
  0xA99EE000 \??\C:\Programme\VMware\VMware Player\vstor2-ws60.sys
  0xA8F97000 \SystemRoot\System32\Drivers\HTTP.sys
  0xA877E000 \??\C:\DOKUME~1\Admin\LOKALE~1\Temp\pwtdrpoc.sys
  0xA86B0000 \SystemRoot\system32\drivers\kmixer.sys
  0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 79):
      0 System Idle Process
      4 System
    1884 C:\WINDOWS\system32\smss.exe
    1408 csrss.exe
    548 C:\WINDOWS\system32\winlogon.exe
    1216 C:\WINDOWS\system32\services.exe
    1124 C:\WINDOWS\system32\lsass.exe
    592 C:\WINDOWS\system32\ati2evxx.exe
    700 C:\WINDOWS\system32\svchost.exe
    920 svchost.exe
    448 C:\WINDOWS\system32\svchost.exe
    536 C:\WINDOWS\system32\svchost.exe
    636 C:\WINDOWS\system32\ati2evxx.exe
    236 C:\Programme\Intel\WiFi\bin\S24EvMon.exe
    1480 svchost.exe
    1948 svchost.exe
    1820 C:\WINDOWS\system32\spoolsv.exe
    188 C:\Programme\Avira\AntiVir Desktop\SCHED.EXE
    152 C:\Programme\Avira\AntiVir Desktop\AVGUARD.EXE
    1424 C:\Programme\Asus\Mobile Theater\Kernel\TV\CLCapSvc.exe
    1088 C:\Programme\Asus\Mobile Theater\Kernel\CLML_NTService\CLMLServer.exe
    1784 C:\Programme\Asus\Mobile Theater\Kernel\CLML_NTService\CLMLService.exe
    1792 C:\Programme\Intel\WiFi\bin\EvtEng.exe
    440 C:\Programme\Avira\AntiVir Desktop\AVSHADOW.EXE
    1552 C:\WINDOWS\system32\IFXSPMGT.exe
    1380 C:\WINDOWS\explorer.exe
    1980 C:\WINDOWS\system32\IFXTCS.exe
    2448 C:\WINDOWS\system32\RemoteControlService.exe
    2784 C:\Programme\Java\jre6\bin\jqs.exe
    3076 C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
    3964 C:\Programme\NSClient++\nsclient++.exe
    1512 C:\Programme\Infineon\Security Platform Software\PSDsrvc.EXE
    2836 C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe
    2772 C:\WINDOWS\system32\svchost.exe
    3104 C:\Programme\TomTom HOME 2\TomTomHOMEService.exe
    4084 C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
    2188 C:\WINDOWS\system32\vmnat.exe
    3332 C:\Programme\Asus\Mobile Theater\Kernel\TV\CLSched.exe
    3892 C:\WINDOWS\system32\vmnetdhcp.exe
    3540 C:\WINDOWS\ATK0100\HControl.exe
    2076 C:\WINDOWS\RTHDCPL.exe
    376 C:\Programme\Asus\ATK Media\DMedia.exe
    2668 C:\Programme\Synaptics\SynTP\SynTPEnh.exe
    2964 C:\Programme\Wireless Console 2\wcourier.exe
    3120 C:\Programme\Asus\Splendid\ACMON.exe
    3484 C:\Programme\Asus\Mobile Theater\PCMService.exe
    3632 C:\WINDOWS\ATK0100\ATKOSD.exe
    396 C:\Programme\ASUSTek\ASUSDVD\PDVDServ.exe
    3536 C:\WINDOWS\system32\ACEngSvr.exe
    4068 C:\Programme\Logitech\Video\LogiTray.exe
    1152 C:\Programme\Vimicro\VMUVC\VMonitor.exe
    2064 C:\WINDOWS\vsnp2std.exe
    2096 C:\Programme\VMware\VMware Player\hqtray.exe
    3260 C:\Programme\Java\jre6\bin\jusched.exe
    876 C:\Programme\Asus\Power4 Gear\BatteryLife.exe
    3344 C:\Programme\Intel\WiFi\bin\ZCfgSvc.exe
    3796 C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\iFrmewrk.exe
    1288 C:\Programme\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
    3840 C:\WINDOWS\PixArt\PAC7302\Monitor.exe
    3324 C:\Programme\DivX\DivX Update\DivXUpdate.exe
    648 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
    3472 C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    3676 C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe
    2212 C:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    2224 C:\WINDOWS\system32\wbem\wmiapsrv.exe
    2252 wmiprvse.exe
    3028 C:\Programme\Infineon\Security Platform Software\PSDrt.exe
    3856 C:\WINDOWS\system32\LVCOMSX.EXE
    3880 alg.exe
    3876 C:\Programme\Infineon\Security Platform Software\SpTNA.exe
    3088 C:\Programme\Logitech\Video\FxSvr2.exe
    2336 C:\Programme\Dude\dude.exe
    3396 C:\WINDOWS\system32\wbem\unsecapp.exe
    2588 wmiprvse.exe
    4132 C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    1108 C:\WINDOWS\system32\svchost.exe
    944 C:\Programme\osam_autorun_manager_5_0_portable\osam.exe
    1988 C:\WINDOWS\system32\taskmgr.exe
    5160 C:\Dokumente und Einstellungen\Admin\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`77226600  (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000000f`bd7d3400  (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (FAT32)

PhysicalDrive0 Model Number: FUJITSUMHV2120BHPL, Rev: 00000029

      Size  Device Name          MBR Status
  --------------------------------------------
    111 GB  \\.\PhysicalDrive0  Unknown MBR code
            SHA1: BF2D42FD1274B534E9CA35C31D53BF8CE7AB2960


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!
Achso, kam bisher wohl noch nicht zur Sprache, habe älteres Ubuntu auch auf der Platte - falls es von Interesse ist !

cosinus 04.02.2011 21:01
Zitat:
Achso, kam bisher wohl noch nicht zur Sprache, habe älteres Ubuntu auch auf der Platte - falls es von Interesse ist !
Dann geht auch der unbekannte MBR i.O.

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Albino2004 04.02.2011 23:52
Hier nun die beiden Logs:

Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5679

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

04.02.2011 22:04:35
mbam-log-2011-02-04 (22-04-17).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 282606
Laufzeit: 52 Minute(n), 55 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\FwHookDrv (Rogue.WinDefender) -> No action taken.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 02/04/2011 at 11:32 PM

Application Version : 4.48.1000

Core Rules Database Version : 6344
Trace Rules Database Version: 4156

Scan type      : Complete Scan
Total Scan Time : 01:18:09

Memory items scanned      : 865
Memory threats detected  : 0
Registry items scanned    : 8205
Registry threats detected : 0
File items scanned        : 122840
File threats detected    : 1

Trojan.Agent/Gen-MSFake
        C:\_OTL\MOVEDFILES\02032011_214431\C_WINDOWS\SYSTEM32\COMPIPV6.DLL

Was bedeutet dies nun, kannst Du mir bitte zusätzlich zum weiteren Vorgehen auch die beiden nachfolgenden Fragen beantworten:

- Wieso zeigt mir Malwarebytes immer noch einen infizierten REG-Schlüssel, muss hier noch was getan werden ?

- War die COMPIPV6.DLL der Schädling, hab' ich mir den am 28.01.11 eingefangen ?

cosinus 06.02.2011 19:47
Zitat:
- Wieso zeigt mir Malwarebytes immer noch einen infizierten REG-Schlüssel, muss hier noch was getan werden ?
Das sind Überreste wieso wurden die nicht entfernt?

Zitat:
- War die COMPIPV6.DLL der Schädling, hab' ich mir den am 28.01.11 eingefangen ?
Ist ein Schädling, den wir mit OTL gefixt haben und in der Quarantäne liegt (man achte auf den Ordner) - dort ist er harmlos weil isoliert.

Albino2004 07.02.2011 12:13
Zitat:
Zitat von cosinus (Beitrag 617486)
Das sind Überreste wieso wurden die nicht entfernt?
Wie im allerersten Log zu sehen, hatte ich mittels Malwarebytes versucht zu löschen, ist aber nach Neustart immer wieder da.

Haben eben erneut Malwarebytes ausgeführt, gelöscht, Neustart und nochmal mit Malwarebytes überprüft, immer noch nicht gelöscht :heulen:

Was nun ?

cosinus 07.02.2011 13:51
POste nochmal frische OTL-Logs.

Albino2004 07.02.2011 14:22
Anbei :kaffee:

cosinus 07.02.2011 15:15
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
[2009.01.11 20:41:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Heove
[2009.09.05 23:05:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Huag
[2009.08.08 03:26:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Yxoqny
[2009.12.15 23:27:54 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010.04.19 08:45:28 | 000,000,012 | ---- | C] () -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\kcmdte.dat
[2010.04.17 20:28:56 | 000,000,012 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\kcmdte.dat
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {1392B8D2-5C05-419F-A8F6-B9F15A596612} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Albino2004 07.02.2011 16:04
Hier das Log

cosinus 07.02.2011 16:08
ok. findet Malwarebytes immer noch und wieder wieder den einen Eintrag?

Albino2004 07.02.2011 16:26
Ja leider, auch nach erneutem Löschversuch und Neustart findet Malwarebytes weiterhin diesen Eintrag !


Alle Zeitangaben in WEZ +1. Es ist jetzt 07:38 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131