Hallo liebes Trojaner-Board,
leider hat es nun auch mich erwischt.
Seit einigen Tagen hab ich nun den Trojaner auf dem Bildschirm, wenn ich den Laptop starte.
Ich habe mir andere Posts durchgelesen und schonmal ein Scanlog erstellt:

OTL logfile created on: 5/26/2013 9:11:20 PM - Run 
OTLPE by OldTimer - Version 3.1.46.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 40.00 Gb Total Space | 19.56 Gb Free Space | 48.91% Space Free | Partition Type: NTFS
Drive D: | 1.86 Gb Total Space | 1.84 Gb Free Space | 99.05% Space Free | Partition Type: FAT32
Drive E: | 191.87 Gb Total Space | 155.65 Gb Free Space | 81.12% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet003
 
========== Win32 Services (SafeList) ==========
 
SRV - [2013/01/23 07:52:53 | 000,182,784 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Documents and Settings\SP000073\4348738.dll -- (winmgmt)
SRV - [2012/10/14 06:14:46 | 000,255,488 | ---- | M] (Ryan Conrad) [Auto] -- C:\Program Files\Droid Explorer\DroidExplorer.Service.exe -- (DroidExplorerService)
SRV - [2012/10/08 11:40:38 | 000,166,912 | ---- | M] () [Auto] -- C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2012/06/20 07:58:47 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/08/04 12:54:46 | 001,626,152 | ---- | M] (Trend Micro Inc.) [Auto] -- C:\Program Files\OfficeScan NT\tmlisten.exe -- (tmlisten)
SRV - [2011/08/04 12:46:38 | 001,530,104 | ---- | M] (Trend Micro Inc.) [Auto] -- C:\Program Files\OfficeScan NT\ntrtscan.exe -- (ntrtscan)
SRV - [2011/06/10 06:17:38 | 000,345,616 | ---- | M] (Trend Micro Inc.) [On_Demand] -- C:\Program Files\BM\TMBMSRV.exe -- (TMBMServer)
SRV - [2011/04/15 07:20:54 | 000,689,680 | ---- | M] (Trend Micro Inc.) [On_Demand] -- C:\Program Files\OfficeScan NT\TmProxy.exe -- (TmProxy)
SRV - [2011/03/24 16:24:30 | 000,266,322 | ---- | M] (IDT, Inc.) [Auto] -- C:\Program Files\IDT\WDM\stacsv.exe -- (STacSV)
SRV - [2011/03/16 05:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/02/04 01:38:34 | 000,072,296 | ---- | M] (O2Micro International) [Auto] -- C:\WINDOWS\system32\drivers\o2flash.exe -- (O2FLASH)
SRV - [2011/01/25 09:33:34 | 006,080,000 | ---- | M] (Riverbed Technology, Inc) [Auto] -- C:\Program Files\Riverbed\Steelhead Mobile\rbtmon.exe -- (RVBD_SH_Mobile_Monitor)
SRV - [2011/01/25 09:33:34 | 000,864,768 | ---- | M] (Riverbed Technology, Inc) [Auto] -- C:\Program Files\Riverbed\Steelhead Mobile\rbtlogger.exe -- (RVBD_SH_Mobile_Logger)
SRV - [2011/01/20 05:27:22 | 000,378,224 | ---- | M] (Dell Inc.) [Auto] -- C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe -- (dcpsysmgrsvc)
SRV - [2010/11/08 09:42:26 | 000,069,632 | ---- | M] ((C) 2005 - 2010 Siemens AG) [Auto] -- C:\WINDOWS\system32\MCSvc.exe -- (MCsvc)
SRV - [2010/10/10 10:09:52 | 000,291,504 | ---- | M] (Aventail Corporation) [Auto] -- C:\WINDOWS\system32\ngvpnmgr.exe -- (NgVpnMgr)
SRV - [2007/07/03 11:44:40 | 000,061,440 | ---- | M] (British Telecommunications Plc.) [Auto] -- C:\Program Files\BT Common Client\btomosrv.exe -- (BT Common Client)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (ZTEusbser6k)
DRV - File not found [Kernel | On_Demand] --  -- (ZTEusbnmea)
DRV - File not found [Kernel | On_Demand] --  -- (ZTEusbmdm6k)
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (smsmdd)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand] --  -- (massfilter_hs)
DRV - File not found [Kernel | On_Demand] --  -- (massfilter)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2012/12/12 04:37:10 | 000,027,136 | ---- | M] (CSR/PLT) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\csrbcx86.sys -- (CSRBC)
DRV - [2012/09/25 17:46:20 | 000,021,248 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\htcnprot.sys -- (htcnprot)
DRV - [2012/08/20 10:48:44 | 000,015,576 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\pwdrvio.sys -- (pwdrvio)
DRV - [2012/08/20 10:48:44 | 000,010,200 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\pwdspio.sys -- (pwdspio)
DRV - [2011/07/12 05:44:10 | 000,262,416 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\Program Files\OfficeScan NT\TmXpflt.sys -- (TmFilter)
DRV - [2011/07/12 05:43:58 | 000,036,624 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\Program Files\OfficeScan NT\TmPreflt.sys -- (TmPreFilter)
DRV - [2011/07/12 05:09:32 | 001,405,720 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\Program Files\OfficeScan NT\vsapiNT.sys -- (VSApiNt)
DRV - [2011/06/10 06:06:22 | 000,068,368 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\tmactmon.sys -- (tmactmon)
DRV - [2011/06/10 06:06:06 | 000,059,152 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\tmevtmgr.sys -- (tmevtmgr)
DRV - [2011/06/10 06:05:52 | 000,178,448 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm)
DRV - [2011/03/24 16:24:40 | 000,037,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2011/03/24 16:24:40 | 000,037,032 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem)
DRV - [2011/03/24 16:24:36 | 000,033,832 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\cvusbdrv.sys -- (cvusbdrv)
DRV - [2011/03/24 16:24:30 | 001,660,451 | ---- | M] (IDT, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2011/03/24 16:24:30 | 000,113,664 | ---- | M] (Andrea Electronics Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AESTAud.sys -- (AESTAud)
DRV - [2011/02/04 01:38:34 | 000,063,136 | ---- | M] (O2Micro ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\o2sdjxp.sys -- (O2SDJRDR)
DRV - [2011/02/04 01:38:34 | 000,061,728 | ---- | M] (O2Micro ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\o2mdrxp.sys -- (O2MDRRDR)
DRV - [2011/02/04 01:38:30 | 000,043,888 | ---- | M] (ST Microelectronics) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Accelern.sys -- (Acceler)
DRV - [2011/01/25 09:33:36 | 000,424,704 | ---- | M] (Riverbed Technology, Inc) [Kernel | On_Demand] -- C:\Program Files\Riverbed\Steelhead Mobile\rbt.sys -- (RBT)
DRV - [2011/01/04 07:14:38 | 007,391,744 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NETwNx32.sys -- (NETwNx32) ___ Intel(R)
DRV - [2010/12/20 20:27:06 | 000,174,248 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\e1c5132.sys -- (e1cexpress) Intel(R)
DRV - [2010/11/08 14:05:38 | 000,090,448 | ---- | M] (Trend Micro Inc.) [Kernel | System] -- C:\WINDOWS\system32\drivers\tmtdi.sys -- (tmtdi)
DRV - [2010/10/15 04:29:14 | 000,260,864 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV - [2010/10/10 09:47:18 | 000,077,336 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ngvpn.sys -- (NgVpn)
DRV - [2010/10/10 09:47:18 | 000,027,160 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nglog.sys -- (NgLog)
DRV - [2010/10/10 09:47:18 | 000,025,112 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ngwfp.sys -- (NgWfp)
DRV - [2010/10/10 09:47:18 | 000,023,064 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ngfilter.sys -- (NgFilter)
DRV - [2010/08/20 05:04:38 | 000,017,648 | ---- | M] (ST Microelectronics) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\stdcfltn.sys -- (stdcfltn)
DRV - [2010/08/02 10:18:46 | 000,132,624 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2010/05/12 14:17:00 | 000,255,096 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2010/02/19 04:00:18 | 000,909,864 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2010/02/19 04:00:18 | 000,556,200 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2010/02/19 04:00:18 | 000,118,440 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2010/02/19 04:00:18 | 000,047,656 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2009/06/10 10:49:32 | 000,024,576 | ---- | M] (HTC, Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2009/03/10 04:43:54 | 000,108,928 | ---- | M] (LSI Corporation) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\symmpi.sys -- (Symmpi)
DRV - [2009/01/28 23:29:42 | 000,277,032 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\mv64xx.sys -- (mv64xx)
DRV - [2007/05/01 22:21:47 | 000,017,968 | ---- | M] (VMware, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\vmscsi.sys -- (vmscsi)
DRV - [2007/04/20 05:14:06 | 000,024,560 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\btwsp50.sys -- (BTWSp50)
DRV - [2006/06/14 06:53:00 | 000,029,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbccid.sys -- (USBCCID)
DRV - [2006/04/24 11:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata)
DRV - [2005/11/04 02:12:18 | 000,004,992 | ---- | M] (written by © Markus Treinen 2000 - 2005 for Siemens Business Services) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nbtdet.sys -- (NbtDet)
DRV - [2004/05/07 18:11:14 | 000,251,194 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\a320raid.sys -- (a320raid)
DRV - [2003/04/28 09:15:38 | 000,140,544 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\fasttx2k.sys -- (fasttx2k)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = https://intranet.enterprise.siemens.com
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
IE - HKU\cins001z_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = https://intranet.siemens-enterprise.com
IE - HKU\cins001z_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\cins001z_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\cins001z_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
 
IE - HKU\SP000073_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://intranet.siemens-enterprise.com
IE - HKU\SP000073_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\SP000073_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\SteelheadMobileCertificateManager@riverbed.com: C:\Program Files\Riverbed\Steelhead Mobile\shmcert [2011/09/19 08:33:56 | 000,000,000 | ---D | M]
 
 
Hosts file not found
O2 - BHO: (CFindNum Class) - {1B5DFDB7-F1F3-4C64-95B7-8EE2D3ABDC64} - C:\Program Files\Enterprise\OpenScape Desktop Client\System\CDialFunction.dll (Cycos AG)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [OfficeScanNT Monitor] C:\Program Files\OfficeScan NT\pccntmon.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Plantronics MyHeadset Updater] C:\Program Files\Plantronics\MyHeadsetUpdater\MyHeadsetUpdater.exe (Plantronics)
O4 - HKLM..\Run: [SB] C:\Program Files\Enterprise\Bulletin\SB.exe (SEN IT)
O4 - HKLM..\Run: [Steelhead Mobile] C:\Program Files\Riverbed\Steelhead Mobile\shmobile.exe (Riverbed Technology, Inc)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKU\SP000073_ON_C..\Run: []  File not found
O4 - HKU\SP000073_ON_C..\Run: [Akamai NetSession Interface]  File not found
O4 - HKU\SP000073_ON_C..\Run: [Steam]  File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell System Manager.lnk = C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe (Dell Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MobileXpress.lnk = C:\Program Files\BT Common Client\btomo.exe (British Telecommunications Plc.)
O4 - Startup: C:\Documents and Settings\SP000073\Start Menu\Programs\Startup\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPublishingWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWebServices = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoOnlinePrintsWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\kerberos\parameters: supportedencryptiontypes = 2147483644
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 1
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 1
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O9 - Extra Button: IE Integration - {36F3A721-3A5D-4fbf-B77A-F49B99671595} - C:\Program Files\Enterprise\OpenScape Desktop Client\System\CyConfigMenu.dll (Cycos AG)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O15 - HKU\cins001z_ON_C\..Trusted Domains: abatos.com ([]* in Local intranet)
O15 - HKU\cins001z_ON_C\..Trusted Domains: siemens.de ([vssonline.mchh] * in Local intranet)
O15 - HKU\cins001z_ON_C\..Trusted Domains: siemens.net ([*.ww200] * in Local intranet)
O15 - HKU\SP000073_ON_C\..Trusted Domains: abatos.com ([]* in Lokales Intranet)
O15 - HKU\SP000073_ON_C\..Trusted Domains: siemens.de ([vssonline.mchh] * in Lokales Intranet)
O15 - HKU\SP000073_ON_C\..Trusted Domains: siemens.net ([*.ww200] * in Lokales Intranet)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1291379611426 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1291379666235 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {F53270D3-0E32-48B7-B63B-159E33210F70} https://www.g-dms.com/img/webexp/lledit.cab (Livelink Edit Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = global-ad.net
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O18 - Protocol\Handler\saphtmlp {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\SAPGUI710\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\sapr3 {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\SAPGUI710\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} -  File not found
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2010/12/03 07:26:59 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/04/23 14:28:59 | 000,182,784 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\SP000073\4348738.dll
[2011/12/15 05:43:03 | 003,145,728 | ---- | C] (SAP Technology,Inc) -- C:\Program Files\Common Files\sapxlhelper.dll
[2011/12/15 05:43:02 | 000,626,688 | ---- | C] (SAP AG) -- C:\Program Files\Common Files\sapconsaccess.dll
[2011/12/15 05:43:02 | 000,192,512 | ---- | C] (SAP Tech Inc.) -- C:\Program Files\Common Files\sapconsr3.dll
[2011/12/15 05:43:01 | 000,040,960 | ---- | C] (SAP-TECHNOLOGY) -- C:\Program Files\Common Files\DigitalSignature.ocx
[2011/06/29 05:59:56 | 000,004,096 | ---- | C] ( ) -- C:\WINDOWS\System32\IGFXDEVLib.dll
 
========== Files - Modified Within 30 Days ==========
 
[2013/05/22 16:29:07 | 3398,389,760 | -HS- | M] () -- C:\hiberfil.sys
[2013/05/22 15:48:57 | 000,004,312 | RHS- | M] () -- C:\Documents and Settings\SP000073\ntuser.pol
[2013/05/22 15:48:29 | 095,023,320 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\8378434.pad
[2013/05/22 15:47:10 | 000,002,184 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
 
========== Files Created - No Company Name ==========
 
[2013/05/22 15:47:06 | 3398,389,760 | -HS- | C] () -- C:\hiberfil.sys
[2013/04/23 14:27:12 | 000,336,256 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/01/23 07:52:53 | 095,023,320 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\8378434.pad
[2013/01/17 04:21:11 | 000,708,552 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2012/12/13 04:55:48 | 002,872,000 | ---- | C] () -- C:\WINDOWS\System32\pwNative.exe
[2012/12/13 04:55:48 | 000,015,576 | ---- | C] () -- C:\WINDOWS\System32\pwdrvio.sys
[2012/12/13 04:55:48 | 000,010,200 | ---- | C] () -- C:\WINDOWS\System32\pwdspio.sys
[2012/07/26 09:42:35 | 000,005,632 | ---- | C] () -- C:\Documents and Settings\SP000073\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/06/06 09:46:37 | 000,000,158 | ---- | C] () -- C:\WINDOWS\ricdb.ini
[2012/05/29 03:31:15 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/15 05:43:02 | 001,167,872 | ---- | C] () -- C:\Program Files\Common Files\SAPActiveXL.xlt
[2011/12/15 05:43:02 | 000,949,760 | ---- | C] () -- C:\Program Files\Common Files\SAPActiveXL_nosig.xlt
[2011/12/15 05:39:45 | 001,064,960 | ---- | C] () -- C:\WINDOWS\System32\h5krnl32.dll
[2011/12/15 05:39:45 | 000,188,928 | ---- | C] () -- C:\WINDOWS\System32\h5icon32.dll
[2011/12/15 05:39:45 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\h5menu32.dll
[2011/12/15 05:39:45 | 000,095,744 | ---- | C] () -- C:\WINDOWS\System32\h5rtf32.dll
[2011/12/15 05:39:45 | 000,051,200 | ---- | C] () -- C:\WINDOWS\System32\h5tool32.dll
[2011/12/05 10:38:12 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2011/10/05 13:23:28 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2011/09/19 07:39:17 | 000,004,312 | RHS- | C] () -- C:\Documents and Settings\SP000073\ntuser.pol
[2011/09/19 07:24:15 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011/09/19 07:19:29 | 000,003,496 | RHS- | C] () -- C:\Documents and Settings\cins001z\ntuser.pol
[2011/06/29 05:59:57 | 000,783,644 | ---- | C] () -- C:\WINDOWS\System32\igkrng600.bin
[2011/06/29 05:59:56 | 000,201,496 | ---- | C] () -- C:\WINDOWS\System32\igfcg600m.bin
[2011/06/29 05:59:56 | 000,145,804 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng600.bin
[2011/06/29 05:59:55 | 000,000,151 | ---- | C] () -- C:\WINDOWS\System32\GfxUI.exe.config
[2010/12/03 15:09:25 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2010/12/03 15:09:18 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2010/12/03 15:09:18 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2010/12/03 15:09:15 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2010/12/03 15:09:14 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2010/12/03 15:09:09 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2010/12/03 15:08:57 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2010/12/03 15:08:57 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2010/12/03 15:08:34 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2010/12/03 15:08:21 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2010/12/03 09:48:42 | 000,000,398 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010/12/03 08:22:04 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/12/03 07:27:23 | 000,032,256 | ---- | C] () -- C:\WINDOWS\System32\ntrights.exe
[2010/12/03 07:27:23 | 000,000,933 | ---- | C] () -- C:\WINDOWS\System32\NBTDet.ini
[2010/12/03 07:27:22 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\LockKBM.dll
[2010/12/03 07:24:33 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/10/10 10:11:34 | 000,127,152 | ---- | C] () -- C:\WINDOWS\ngmsi.dll
[2010/10/10 10:10:50 | 000,015,024 | ---- | C] () -- C:\WINDOWS\ngutil.exe
[2010/07/08 10:03:46 | 000,000,040 | ---- | C] () -- C:\WINDOWS\System32\OEMInfo.ini
[2010/02/16 03:04:28 | 002,860,384 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2009/01/20 06:32:04 | 000,024,056 | ---- | C] () -- C:\WINDOWS\System32\providers.bin
[2008/05/26 15:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 15:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008/02/25 16:23:10 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2008/02/25 16:23:10 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
[2007/09/27 04:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 04:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 04:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2006/12/07 05:26:28 | 000,000,316 | ---- | C] () -- C:\WINDOWS\fcxlrpw.ini
[2001/11/14 06:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2012/05/29 05:39:03 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Application Data\Aventail
[2011/09/19 07:28:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\cins001z\Application Data\MobileXpress Client
[2012/01/13 05:05:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Aventail
[2012/12/18 10:39:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\DroidExplorer
[2013/01/11 08:52:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\.minecraft
[2012/05/30 02:35:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Aventail
[2012/12/19 03:47:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Boot Animation Factory
[2011/11/28 07:56:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\DirectPrint
[2012/12/18 09:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\DroidExplorer
[2012/12/12 04:40:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\HTC
[2012/12/19 03:32:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012/05/29 05:39:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\MobileXpress Client
[2011/12/02 05:43:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Siemens
[2011/12/15 07:30:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\TclTk
[2011/10/02 04:16:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Telefónica
[2013/01/07 07:22:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Ubisoft
[2011/09/19 07:40:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Windows Desktop Search
[2011/09/29 11:51:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Windows Search
[2011/09/19 07:49:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Aventail
[2011/09/19 07:28:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BT Common Client
[2011/12/05 10:38:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FreePDF
[2012/11/12 05:06:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Jabra
[2011/09/19 07:28:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MobileXpress client
[2013/01/20 07:33:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Native Instruments
[2012/06/06 09:46:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RICOH
[2011/09/19 08:33:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Riverbed
[2011/12/02 05:42:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Siemens
[2013/01/07 07:25:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Solidshield
[2011/09/19 07:31:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
 
========== Purity Check ==========
 
 
< End of report >
         

Ich hoffe Ihr könnt mir helfen,
vielen Dank im Voraus

MFG BadCedrick

Das sieht mir sehr nach gewerblicher Nutzung aus. Siehe hier: http://www.trojaner-board.de/108422-...-anfragen.html

Nunja es handelt sich hierbei nicht um einen Geschäfts-Laptop.
Ich habe einen neuen Laptop zum Arbeiten bekommen,
durfte jedoch den alten für eine kleine Summe behalten.
Also geht keinerlei Gefahr für die Firma aus.
Ich hoffe ihr könnt mir trozdem helfen.

MFG BadCedrick

In Ordnung.

!! Hinweis an Mitlesende !!
Dieses Thema und die Anweisungen sind nur für diesen speziellen Fall gedacht.
Sie könnten andere Computer schwer beschädigen. Öffnet bitte euer eigenes Thema.

Ich werde dir bei deinem Problem helfen. Die Bereinigung funktioniert nur, wenn du dich an die folgenden Regeln hälst:

Bitte lesen:
Regeln für die Bereinigung

• Illegal genutzte Software
  Beim ersten Anzeichen wird der Support ohne Diskussion eingestellt. Also sorge bitte vorher dafür, dass hier nichts mehr auftaucht.
• Keine Garantie
  Wir werden uns Mühe geben, aber einen 100% sicheren und sauberen Computer bekommst du nicht zurück. Der einzig sichere Weg ist die Formatierung mit Neuaufsetzen.
• Keine Alleingänge
  Die Bereinigung funktioniert nur, wenn du genau das machst, was ich anweise. Installiere/deinstalliere keine Software, führe keine Scans durch, die ich dir nicht angewiesen habe. Poste dein Thema in keinem anderen Forum und folge nicht den Anweisungen anderer Helfer. Du raubst damit allen Beteiligten nur Zeit.
• Aufmerksam lesen und nachfragen
  Lies jede Anleitung genau durch. Bei Unklarheiten bitte vorher nachfragen. Arbeite die Schritte in der Reihenfolge ab und antworte dann erst nach dem letzten Schritt oder wenn du eine Frage hast.
• Richtig antworten
  • Nachdem du alle Schritte abgearbeitet hast gibst du mir bitte zu jedem Schritt eine Rückmeldung (Logfile oder Antwort) und das gesammelt in einer Antwort.
  • Mache deinen Namen nur dann unkenntlich, wenn es wirklich sein muss.
  • Logfiles bitte zwischen Code-Tags platzieren (im Antwortfenster das #-Symbol anklicken) sieht dann so aus:
    [CODE] (Logfile) [/CODE]
  • Hinweis in eigener Sache: Angehängte oder gezippte Logfiles erschweren mir die Arbeit massiv! Mache das also nur, wenn das Logfile zu groß ist, um es direkt zu posten.
• Keine privaten Nachrichten
  Ich sehe es, wenn du geantwortet hast, du mußt mich nicht benachrichtigen. Schicke mir nur dann eine PM wenn ich drei Tage nicht geantwortet habe und nur dann.
• Wie läuft die Bereinigung ab?
  Ganz grob: Analyse > Bereinigung > Kontrolle mit Updates > Fertig. Ob fertig oder nicht werde ich dir ganz deutlich mitteilen, du brauchst nicht nachzufragen.

Lesestoff:
Hinweise: Gewerblich genutzte Rechner

• Die Hilfe, die wir hier anbieten, erfolgt für den User auf eigene Gefahr. Auch wenn wir uns nach bestem Wissen bemühen, so besteht doch das Risiko, dass der Computer im Laufe der Bereinigung evtl. nicht mehr startbar sein könnte oder es zu Datenverlust kommen kann. Für eine Sicherung der vorhandenen Arbeits- und ggf. Kundendaten hat der User selbst zu sorgen. Eine Haftung ist durch die Nutzungsvereinbarung auf jeden Fall ausgeschlossen. Darauf wurde hiermit hingewiesen.
• Weiterhin wird hiermit darauf hingewiesen, dass in den zu postenden Logfiles eventuell Kundendaten mit anfallen könnten, beispielsweise dann, wenn infizierte Dokumente nach Kundennamen benannt wurden. Trojaner-Board wird die Logfiles im Nachhinein nicht abändern oder den Thread löschen.
• Die Bereinigung erfolgt für kleine Unternehmen kostenfrei. Du hast allerdings die Möglichkeit uns mit einer Spende zu unterstützen.

Nur falls Informationen sichtbar werden, wir editieren sie nicht.



Computer mit Combofix entsperren

Warnung: Diese Anleitung ist nur für diesen speziellen Fall gedacht und kann andere Computer evtl. schwer beschädigen. Zudem darf Combofix nur ausgeführt werden, wenn dies von einem erfahrenen Helfer angewiesen wird!

1. Combofix kopieren
   • Lade dir Combofix an einem sauberen Rechner (evtl. Nachbar, Freund, ...) von einem dieser Downloadlinks: Link
   • Kopiere die Datei auf deinen USB-Stick (nicht in einen Unterordner!)
2. Start mit Eingabeaufforderung
   • Schliesse den präparierten USB-Stick an den infizierten Rechner an und starte ihn.
   • Drücke beim Start einige Male die F8-Taste bis das Bootmenü von Windows erscheint und wähle Abgesicherter Modus mit Eingabeaufforderung.
   • Nach einigen Sekunden sollte ein schwarzes Fenster mit dem blinkenden Cursor erscheinen.
3. Combofix starten
   • Tippe explorer (Enter)
   • Finde den USB-Stick und starte Combofix mit einem Doppelklick.
   • Sollte es versuchen die Wiederherstellungskonsole zu installieren, dann lasse dies zu.
   • Übergehe alle anderen Warnungen mit OK.
4. Logfile posten
   • Es könnte eine Warnung erscheinen, ob du wieder den abgesicherten Modus ausführen willst. Klicke dann JA.
   • Entweder wird ein Editor angezeigt oder das Logfile befindet sich hier: c:\combofix.txt
   • Poste mir dieses Logfile in CODE-Tags (#-Symbol im Forumseditor anklicken)
   • Sollte ein Fehler kommen, dass ein Registrierungsschlüssel einem ungültigem Vorgang unterzogen wurde, dann starte den Rechner neu. Das behebt das Problem.

Ok schonmal vielen Dank,
jedoch bleibe ich schon bei Punkt C stehen denn dort möchte Windows mein Passwort wissen bevor die Eingabeaufforderung kommt, nimmt es jedoch nicht an. Was kann ich nun tun?

Es geht um das Passwort des Adminstrators. Mit dem Benutzer musst du dich anmelden.

Tja wies aussieht scheiterts hier. Er will das Passwort nicht annehmen.
Gibt es noch eine andere Methode den Trojaner vom Laptop zu bekommen?
Villeicht wie bei den anderen mithilfe eines Fixlogs und der Oldtimer-CD?

MFG BadCedrick

Natürlich gibt es das, aber so wäre das wesentlich einfacher gewesen.

Fix mit OTLpe

Warnung: Dieses Skript wurde nur für diesen User und diese spezielle Situation geschrieben. Auf anderen Computern ausgeführt kann es nachhaltige Schäden anrichten!
Hinweis: Wenn du deinen Benutzernamen unkenntlich gemacht hast, musst du wieder deinen richtigen Namen einsetzen, ansonsten wird das Skript nicht funktionieren.

• Starte den infizierten Rechner mit der OTLpe-CD und starte OTLpe.
• Falls du keine Internetverbindung hast:
  1. Drücke Windows-Taste + R > notepad (reinschreiben) > OK
  2. Kopiere das Fixskript in den Editor und speichere die Datei als Fix.txt
  3. Kopiere dir die Fix.txt auf einen USB-Stick.
  4. Schliesse den Stick an den infizierten Rechner an und kopiere dir die Datei auf den Desktop.
• Füge das Skript in das Feld Custom Scans / Fixes ein:

:OTL
O4 - Startup: C:\Documents and Settings\SP000073\Start Menu\Programs\Startup\runctf.lnk
         

• Schliesse bitte nun alle anderen Programme.
• Klicke nun bitte auf den Fix Button.
• Nach dem Neustart findest Du ein Textdokument auf deinem Desktop. (Auch zu finden unter C:\OTLpe\MovedFiles\<datum_nummer.log>)
• Kopiere nun den Inhalt hier in deinen Thread, möglichst in Code-Tags.

Hinweis: Die Ausführung des Kommandos kann einige Minuten dauern und OTLpe scheint in dieser Zeit nicht zu reagieren. Bitte geduldig sein!

Frage:

• Kannst du jetzt wieder in den normalen Modus booten? (Wir sind aber noch nicht fertig!)

Danach:

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Combofix wird überprüfen, ob die Microsoft Windows Wiederherstellungskonsole installiert ist.
  Ist diese nicht installiert, erlaube Combofix diese herunter zu laden und zu installieren. Folge dazu einfach den Anweisungen und aktzeptiere die Endbenutzer-Lizenz.
  Bei heutiger Malware ist dies sehr empfehlenswert, da diese uns eine Möglichkeit bietet, dein System zu reparieren, falls etwas schief geht.
  Bestätige die Information, dass die Wiederherstellungskonsole installiert wurde mit Ja.
  Hinweis: Ist diese bereits installiert, wird Combofix mit der Malwareentfernung fortfahren.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es eine Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Also der fix ist recht schnell durchgelaufen, folgender log ist dabei rausgepurzelt:

========== OTL ==========
C:\Documents and Settings\SP000073\Start Menu\Programs\Startup\runctf.lnk moved successfully.
 
OTLPE by OldTimer - Version 3.1.46.0 log created on 05272013_010146
         

Nach einem Neustart in den normalen Modus kam die Anmeldung wieder. Das Passwort hat er diesmal angenommen aber der Trojaner war immernoch zu sehen.

MFG BadCedrick

Ja ich habe leider übersehen, dass du die unangenehme Variante hast:

Nochmal OTLpe hiermit bitte:

:files
C:\Documents and Settings\SP000073\4348738.dll
         

Leider bin ich jetzt erst wieder dazu gekommen weiter zu machen jedoch auch mit dem Fix keine Besserung. Ich gebe dir nochmal den zugehörigen log:

========== FILES ==========
C:\Documents and Settings\SP000073\4348738.dll moved successfully.
 
OTLPE by OldTimer - Version 3.1.46.0 log created on 05272013_074903
         

Scheint wirklich eine sehr unangenehme Variante zu sein.

MFG BadCedrick

Dann mache mir bitte nochmal ein neues Logfile - eigentlich solltest du normal booten können .... hm.

So hier nochmal der neue Scan:

OTL logfile created on: 5/27/2013 9:21:34 AM - Run 
OTLPE by OldTimer - Version 3.1.46.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 40.00 Gb Total Space | 19.57 Gb Free Space | 48.92% Space Free | Partition Type: NTFS
Drive D: | 1.86 Gb Total Space | 1.85 Gb Free Space | 99.74% Space Free | Partition Type: FAT32
Drive E: | 191.87 Gb Total Space | 155.65 Gb Free Space | 81.12% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet003
 
========== Win32 Services (SafeList) ==========
 
SRV - [2013/01/23 07:52:53 | 000,182,784 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Documents and Settings\SP000073\4348738.dll -- (winmgmt)
SRV - [2012/10/14 06:14:46 | 000,255,488 | ---- | M] (Ryan Conrad) [Auto] -- C:\Program Files\Droid Explorer\DroidExplorer.Service.exe -- (DroidExplorerService)
SRV - [2012/10/08 11:40:38 | 000,166,912 | ---- | M] () [Auto] -- C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2012/06/20 07:58:47 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/08/04 12:54:46 | 001,626,152 | ---- | M] (Trend Micro Inc.) [Auto] -- C:\Program Files\OfficeScan NT\tmlisten.exe -- (tmlisten)
SRV - [2011/08/04 12:46:38 | 001,530,104 | ---- | M] (Trend Micro Inc.) [Auto] -- C:\Program Files\OfficeScan NT\ntrtscan.exe -- (ntrtscan)
SRV - [2011/06/10 06:17:38 | 000,345,616 | ---- | M] (Trend Micro Inc.) [On_Demand] -- C:\Program Files\BM\TMBMSRV.exe -- (TMBMServer)
SRV - [2011/04/15 07:20:54 | 000,689,680 | ---- | M] (Trend Micro Inc.) [On_Demand] -- C:\Program Files\OfficeScan NT\TmProxy.exe -- (TmProxy)
SRV - [2011/03/24 16:24:30 | 000,266,322 | ---- | M] (IDT, Inc.) [Auto] -- C:\Program Files\IDT\WDM\stacsv.exe -- (STacSV)
SRV - [2011/03/16 05:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/02/04 01:38:34 | 000,072,296 | ---- | M] (O2Micro International) [Auto] -- C:\WINDOWS\system32\drivers\o2flash.exe -- (O2FLASH)
SRV - [2011/01/25 09:33:34 | 006,080,000 | ---- | M] (Riverbed Technology, Inc) [Auto] -- C:\Program Files\Riverbed\Steelhead Mobile\rbtmon.exe -- (RVBD_SH_Mobile_Monitor)
SRV - [2011/01/25 09:33:34 | 000,864,768 | ---- | M] (Riverbed Technology, Inc) [Auto] -- C:\Program Files\Riverbed\Steelhead Mobile\rbtlogger.exe -- (RVBD_SH_Mobile_Logger)
SRV - [2011/01/20 05:27:22 | 000,378,224 | ---- | M] (Dell Inc.) [Auto] -- C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe -- (dcpsysmgrsvc)
SRV - [2010/11/08 09:42:26 | 000,069,632 | ---- | M] ((C) 2005 - 2010 Siemens AG) [Auto] -- C:\WINDOWS\system32\MCSvc.exe -- (MCsvc)
SRV - [2010/10/10 10:09:52 | 000,291,504 | ---- | M] (Aventail Corporation) [Auto] -- C:\WINDOWS\system32\ngvpnmgr.exe -- (NgVpnMgr)
SRV - [2007/07/03 11:44:40 | 000,061,440 | ---- | M] (British Telecommunications Plc.) [Auto] -- C:\Program Files\BT Common Client\btomosrv.exe -- (BT Common Client)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (ZTEusbser6k)
DRV - File not found [Kernel | On_Demand] --  -- (ZTEusbnmea)
DRV - File not found [Kernel | On_Demand] --  -- (ZTEusbmdm6k)
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (smsmdd)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand] --  -- (massfilter_hs)
DRV - File not found [Kernel | On_Demand] --  -- (massfilter)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2012/12/12 04:37:10 | 000,027,136 | ---- | M] (CSR/PLT) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\csrbcx86.sys -- (CSRBC)
DRV - [2012/09/25 17:46:20 | 000,021,248 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\htcnprot.sys -- (htcnprot)
DRV - [2012/08/20 10:48:44 | 000,015,576 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\pwdrvio.sys -- (pwdrvio)
DRV - [2012/08/20 10:48:44 | 000,010,200 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\pwdspio.sys -- (pwdspio)
DRV - [2011/07/12 05:44:10 | 000,262,416 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\Program Files\OfficeScan NT\TmXpflt.sys -- (TmFilter)
DRV - [2011/07/12 05:43:58 | 000,036,624 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\Program Files\OfficeScan NT\TmPreflt.sys -- (TmPreFilter)
DRV - [2011/07/12 05:09:32 | 001,405,720 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\Program Files\OfficeScan NT\vsapiNT.sys -- (VSApiNt)
DRV - [2011/06/10 06:06:22 | 000,068,368 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\tmactmon.sys -- (tmactmon)
DRV - [2011/06/10 06:06:06 | 000,059,152 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\tmevtmgr.sys -- (tmevtmgr)
DRV - [2011/06/10 06:05:52 | 000,178,448 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm)
DRV - [2011/03/24 16:24:40 | 000,037,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2011/03/24 16:24:40 | 000,037,032 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem)
DRV - [2011/03/24 16:24:36 | 000,033,832 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\cvusbdrv.sys -- (cvusbdrv)
DRV - [2011/03/24 16:24:30 | 001,660,451 | ---- | M] (IDT, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2011/03/24 16:24:30 | 000,113,664 | ---- | M] (Andrea Electronics Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AESTAud.sys -- (AESTAud)
DRV - [2011/02/04 01:38:34 | 000,063,136 | ---- | M] (O2Micro ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\o2sdjxp.sys -- (O2SDJRDR)
DRV - [2011/02/04 01:38:34 | 000,061,728 | ---- | M] (O2Micro ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\o2mdrxp.sys -- (O2MDRRDR)
DRV - [2011/02/04 01:38:30 | 000,043,888 | ---- | M] (ST Microelectronics) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Accelern.sys -- (Acceler)
DRV - [2011/01/25 09:33:36 | 000,424,704 | ---- | M] (Riverbed Technology, Inc) [Kernel | On_Demand] -- C:\Program Files\Riverbed\Steelhead Mobile\rbt.sys -- (RBT)
DRV - [2011/01/04 07:14:38 | 007,391,744 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NETwNx32.sys -- (NETwNx32) ___ Intel(R)
DRV - [2010/12/20 20:27:06 | 000,174,248 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\e1c5132.sys -- (e1cexpress) Intel(R)
DRV - [2010/11/08 14:05:38 | 000,090,448 | ---- | M] (Trend Micro Inc.) [Kernel | System] -- C:\WINDOWS\system32\drivers\tmtdi.sys -- (tmtdi)
DRV - [2010/10/15 04:29:14 | 000,260,864 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV - [2010/10/10 09:47:18 | 000,077,336 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ngvpn.sys -- (NgVpn)
DRV - [2010/10/10 09:47:18 | 000,027,160 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nglog.sys -- (NgLog)
DRV - [2010/10/10 09:47:18 | 000,025,112 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ngwfp.sys -- (NgWfp)
DRV - [2010/10/10 09:47:18 | 000,023,064 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ngfilter.sys -- (NgFilter)
DRV - [2010/08/20 05:04:38 | 000,017,648 | ---- | M] (ST Microelectronics) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\stdcfltn.sys -- (stdcfltn)
DRV - [2010/08/02 10:18:46 | 000,132,624 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2010/05/12 14:17:00 | 000,255,096 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2010/02/19 04:00:18 | 000,909,864 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2010/02/19 04:00:18 | 000,556,200 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2010/02/19 04:00:18 | 000,118,440 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2010/02/19 04:00:18 | 000,047,656 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2009/06/10 10:49:32 | 000,024,576 | ---- | M] (HTC, Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2009/03/10 04:43:54 | 000,108,928 | ---- | M] (LSI Corporation) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\symmpi.sys -- (Symmpi)
DRV - [2009/01/28 23:29:42 | 000,277,032 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\mv64xx.sys -- (mv64xx)
DRV - [2007/05/01 22:21:47 | 000,017,968 | ---- | M] (VMware, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\vmscsi.sys -- (vmscsi)
DRV - [2007/04/20 05:14:06 | 000,024,560 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\btwsp50.sys -- (BTWSp50)
DRV - [2006/06/14 06:53:00 | 000,029,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbccid.sys -- (USBCCID)
DRV - [2006/04/24 11:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata)
DRV - [2005/11/04 02:12:18 | 000,004,992 | ---- | M] (written by © Markus Treinen 2000 - 2005 for Siemens Business Services) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nbtdet.sys -- (NbtDet)
DRV - [2004/05/07 18:11:14 | 000,251,194 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\a320raid.sys -- (a320raid)
DRV - [2003/04/28 09:15:38 | 000,140,544 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\fasttx2k.sys -- (fasttx2k)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = https://intranet.enterprise.siemens.com
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
IE - HKU\cins001z_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = https://intranet.siemens-enterprise.com
IE - HKU\cins001z_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\cins001z_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\cins001z_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
 
IE - HKU\SP000073_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://intranet.siemens-enterprise.com
IE - HKU\SP000073_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\SP000073_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\SteelheadMobileCertificateManager@riverbed.com: C:\Program Files\Riverbed\Steelhead Mobile\shmcert [2011/09/19 08:33:56 | 000,000,000 | ---D | M]
 
 
Hosts file not found
O2 - BHO: (CFindNum Class) - {1B5DFDB7-F1F3-4C64-95B7-8EE2D3ABDC64} - C:\Program Files\Enterprise\OpenScape Desktop Client\System\CDialFunction.dll (Cycos AG)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [OfficeScanNT Monitor] C:\Program Files\OfficeScan NT\pccntmon.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Plantronics MyHeadset Updater] C:\Program Files\Plantronics\MyHeadsetUpdater\MyHeadsetUpdater.exe (Plantronics)
O4 - HKLM..\Run: [SB] C:\Program Files\Enterprise\Bulletin\SB.exe (SEN IT)
O4 - HKLM..\Run: [Steelhead Mobile] C:\Program Files\Riverbed\Steelhead Mobile\shmobile.exe (Riverbed Technology, Inc)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKU\SP000073_ON_C..\Run: []  File not found
O4 - HKU\SP000073_ON_C..\Run: [Akamai NetSession Interface]  File not found
O4 - HKU\SP000073_ON_C..\Run: [Steam]  File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell System Manager.lnk = C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe (Dell Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MobileXpress.lnk = C:\Program Files\BT Common Client\btomo.exe (British Telecommunications Plc.)
O4 - Startup: C:\Documents and Settings\SP000073\Start Menu\Programs\Startup\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPublishingWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWebServices = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoOnlinePrintsWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\kerberos\parameters: supportedencryptiontypes = 2147483644
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 1
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 1
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O9 - Extra Button: IE Integration - {36F3A721-3A5D-4fbf-B77A-F49B99671595} - C:\Program Files\Enterprise\OpenScape Desktop Client\System\CyConfigMenu.dll (Cycos AG)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O15 - HKU\cins001z_ON_C\..Trusted Domains: abatos.com ([]* in Local intranet)
O15 - HKU\cins001z_ON_C\..Trusted Domains: siemens.de ([vssonline.mchh] * in Local intranet)
O15 - HKU\cins001z_ON_C\..Trusted Domains: siemens.net ([*.ww200] * in Local intranet)
O15 - HKU\SP000073_ON_C\..Trusted Domains: abatos.com ([]* in Lokales Intranet)
O15 - HKU\SP000073_ON_C\..Trusted Domains: siemens.de ([vssonline.mchh] * in Lokales Intranet)
O15 - HKU\SP000073_ON_C\..Trusted Domains: siemens.net ([*.ww200] * in Lokales Intranet)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1291379611426 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1291379666235 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {F53270D3-0E32-48B7-B63B-159E33210F70} https://www.g-dms.com/img/webexp/lledit.cab (Livelink Edit Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = global-ad.net
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O18 - Protocol\Handler\saphtmlp {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\SAPGUI710\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\sapr3 {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\SAPGUI710\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} -  File not found
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2010/12/03 07:26:59 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/05/27 01:51:24 | 000,182,784 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\SP000073\4348738.dll
[2011/12/15 05:43:03 | 003,145,728 | ---- | C] (SAP Technology,Inc) -- C:\Program Files\Common Files\sapxlhelper.dll
[2011/12/15 05:43:02 | 000,626,688 | ---- | C] (SAP AG) -- C:\Program Files\Common Files\sapconsaccess.dll
[2011/12/15 05:43:02 | 000,192,512 | ---- | C] (SAP Tech Inc.) -- C:\Program Files\Common Files\sapconsr3.dll
[2011/12/15 05:43:01 | 000,040,960 | ---- | C] (SAP-TECHNOLOGY) -- C:\Program Files\Common Files\DigitalSignature.ocx
[2011/06/29 05:59:56 | 000,004,096 | ---- | C] ( ) -- C:\WINDOWS\System32\IGFXDEVLib.dll
 
========== Files - Modified Within 30 Days ==========
 
[2013/05/27 01:52:03 | 000,004,312 | RHS- | M] () -- C:\Documents and Settings\SP000073\ntuser.pol
[2013/05/27 01:51:46 | 095,023,320 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\8378434.pad
[2013/05/27 01:50:37 | 3398,389,760 | -HS- | M] () -- C:\hiberfil.sys
[2013/05/26 16:37:12 | 000,002,184 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
 
========== Files Created - No Company Name ==========
 
[2013/05/26 19:04:16 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\SP000073\Start Menu\Programs\Startup\runctf.lnk
[2013/05/26 19:03:27 | 3398,389,760 | -HS- | C] () -- C:\hiberfil.sys
[2013/04/23 14:27:12 | 000,336,256 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/01/23 07:52:53 | 095,023,320 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\8378434.pad
[2013/01/17 04:21:11 | 000,708,552 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2012/12/13 04:55:48 | 002,872,000 | ---- | C] () -- C:\WINDOWS\System32\pwNative.exe
[2012/12/13 04:55:48 | 000,015,576 | ---- | C] () -- C:\WINDOWS\System32\pwdrvio.sys
[2012/12/13 04:55:48 | 000,010,200 | ---- | C] () -- C:\WINDOWS\System32\pwdspio.sys
[2012/07/26 09:42:35 | 000,005,632 | ---- | C] () -- C:\Documents and Settings\SP000073\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/06/06 09:46:37 | 000,000,158 | ---- | C] () -- C:\WINDOWS\ricdb.ini
[2012/05/29 03:31:15 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/15 05:43:02 | 001,167,872 | ---- | C] () -- C:\Program Files\Common Files\SAPActiveXL.xlt
[2011/12/15 05:43:02 | 000,949,760 | ---- | C] () -- C:\Program Files\Common Files\SAPActiveXL_nosig.xlt
[2011/12/15 05:39:45 | 001,064,960 | ---- | C] () -- C:\WINDOWS\System32\h5krnl32.dll
[2011/12/15 05:39:45 | 000,188,928 | ---- | C] () -- C:\WINDOWS\System32\h5icon32.dll
[2011/12/15 05:39:45 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\h5menu32.dll
[2011/12/15 05:39:45 | 000,095,744 | ---- | C] () -- C:\WINDOWS\System32\h5rtf32.dll
[2011/12/15 05:39:45 | 000,051,200 | ---- | C] () -- C:\WINDOWS\System32\h5tool32.dll
[2011/12/05 10:38:12 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2011/10/05 13:23:28 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2011/09/19 07:39:17 | 000,004,312 | RHS- | C] () -- C:\Documents and Settings\SP000073\ntuser.pol
[2011/09/19 07:24:15 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011/09/19 07:19:29 | 000,003,496 | RHS- | C] () -- C:\Documents and Settings\cins001z\ntuser.pol
[2011/06/29 05:59:57 | 000,783,644 | ---- | C] () -- C:\WINDOWS\System32\igkrng600.bin
[2011/06/29 05:59:56 | 000,201,496 | ---- | C] () -- C:\WINDOWS\System32\igfcg600m.bin
[2011/06/29 05:59:56 | 000,145,804 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng600.bin
[2011/06/29 05:59:55 | 000,000,151 | ---- | C] () -- C:\WINDOWS\System32\GfxUI.exe.config
[2010/12/03 15:09:25 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2010/12/03 15:09:18 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2010/12/03 15:09:18 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2010/12/03 15:09:15 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2010/12/03 15:09:14 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2010/12/03 15:09:09 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2010/12/03 15:08:57 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2010/12/03 15:08:57 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2010/12/03 15:08:34 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2010/12/03 15:08:21 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2010/12/03 09:48:42 | 000,000,398 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010/12/03 08:22:04 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/12/03 07:27:23 | 000,032,256 | ---- | C] () -- C:\WINDOWS\System32\ntrights.exe
[2010/12/03 07:27:23 | 000,000,933 | ---- | C] () -- C:\WINDOWS\System32\NBTDet.ini
[2010/12/03 07:27:22 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\LockKBM.dll
[2010/12/03 07:24:33 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/10/10 10:11:34 | 000,127,152 | ---- | C] () -- C:\WINDOWS\ngmsi.dll
[2010/10/10 10:10:50 | 000,015,024 | ---- | C] () -- C:\WINDOWS\ngutil.exe
[2010/07/08 10:03:46 | 000,000,040 | ---- | C] () -- C:\WINDOWS\System32\OEMInfo.ini
[2010/02/16 03:04:28 | 002,860,384 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2009/01/20 06:32:04 | 000,024,056 | ---- | C] () -- C:\WINDOWS\System32\providers.bin
[2008/05/26 15:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 15:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008/02/25 16:23:10 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2008/02/25 16:23:10 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
[2007/09/27 04:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 04:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 04:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2006/12/07 05:26:28 | 000,000,316 | ---- | C] () -- C:\WINDOWS\fcxlrpw.ini
[2001/11/14 06:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2012/05/29 05:39:03 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Application Data\Aventail
[2011/09/19 07:28:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\cins001z\Application Data\MobileXpress Client
[2012/01/13 05:05:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Aventail
[2012/12/18 10:39:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\DroidExplorer
[2013/01/11 08:52:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\.minecraft
[2012/05/30 02:35:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Aventail
[2012/12/19 03:47:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Boot Animation Factory
[2011/11/28 07:56:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\DirectPrint
[2012/12/18 09:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\DroidExplorer
[2012/12/12 04:40:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\HTC
[2012/12/19 03:32:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012/05/29 05:39:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\MobileXpress Client
[2011/12/02 05:43:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Siemens
[2011/12/15 07:30:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\TclTk
[2011/10/02 04:16:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Telefónica
[2013/01/07 07:22:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Ubisoft
[2011/09/19 07:40:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Windows Desktop Search
[2011/09/29 11:51:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Windows Search
[2011/09/19 07:49:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Aventail
[2011/09/19 07:28:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BT Common Client
[2011/12/05 10:38:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FreePDF
[2012/11/12 05:06:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Jabra
[2011/09/19 07:28:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MobileXpress client
[2013/01/20 07:33:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Native Instruments
[2012/06/06 09:46:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RICOH
[2011/09/19 08:33:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Riverbed
[2011/12/02 05:42:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Siemens
[2013/01/07 07:25:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Solidshield
[2011/09/19 07:31:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
 
========== Purity Check ==========
 
 
< End of report >
         

MFG BadCedrick

EIgentlich nicht, habe das schon gefühlte 2000 mal entfernt. Next Try.

:files
C:\Documents and Settings\SP000073\Start Menu\Programs\Startup\runctf.lnk
C:\Documents and Settings\All Users\Application Data\8378434.pad
C:\Documents and Settings\SP000073\4348738.dll
         

Hallo, benötigst Du noch weiterhin Hilfe ?

Sollte ich innerhalb der nächsten 24 Stunden keine Antwort von dir erhalten, werde ich dein Thema aus meinen Abos nehmen und bekomme dadurch keine Nachricht über neue Antworten.

Das Verschwinden der Symptome bedeutet nicht, dass dein System schon sauber ist