GVU Trojaner hat Laptop erwischt

OTL logfile created on: 5/26/2013 9:11:20 PM - Run 
OTLPE by OldTimer - Version 3.1.46.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 40.00 Gb Total Space | 19.56 Gb Free Space | 48.91% Space Free | Partition Type: NTFS
Drive D: | 1.86 Gb Total Space | 1.84 Gb Free Space | 99.05% Space Free | Partition Type: FAT32
Drive E: | 191.87 Gb Total Space | 155.65 Gb Free Space | 81.12% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet003
 
========== Win32 Services (SafeList) ==========
 
SRV - [2013/01/23 07:52:53 | 000,182,784 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Documents and Settings\SP000073\4348738.dll -- (winmgmt)
SRV - [2012/10/14 06:14:46 | 000,255,488 | ---- | M] (Ryan Conrad) [Auto] -- C:\Program Files\Droid Explorer\DroidExplorer.Service.exe -- (DroidExplorerService)
SRV - [2012/10/08 11:40:38 | 000,166,912 | ---- | M] () [Auto] -- C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2012/06/20 07:58:47 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/08/04 12:54:46 | 001,626,152 | ---- | M] (Trend Micro Inc.) [Auto] -- C:\Program Files\OfficeScan NT\tmlisten.exe -- (tmlisten)
SRV - [2011/08/04 12:46:38 | 001,530,104 | ---- | M] (Trend Micro Inc.) [Auto] -- C:\Program Files\OfficeScan NT\ntrtscan.exe -- (ntrtscan)
SRV - [2011/06/10 06:17:38 | 000,345,616 | ---- | M] (Trend Micro Inc.) [On_Demand] -- C:\Program Files\BM\TMBMSRV.exe -- (TMBMServer)
SRV - [2011/04/15 07:20:54 | 000,689,680 | ---- | M] (Trend Micro Inc.) [On_Demand] -- C:\Program Files\OfficeScan NT\TmProxy.exe -- (TmProxy)
SRV - [2011/03/24 16:24:30 | 000,266,322 | ---- | M] (IDT, Inc.) [Auto] -- C:\Program Files\IDT\WDM\stacsv.exe -- (STacSV)
SRV - [2011/03/16 05:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/02/04 01:38:34 | 000,072,296 | ---- | M] (O2Micro International) [Auto] -- C:\WINDOWS\system32\drivers\o2flash.exe -- (O2FLASH)
SRV - [2011/01/25 09:33:34 | 006,080,000 | ---- | M] (Riverbed Technology, Inc) [Auto] -- C:\Program Files\Riverbed\Steelhead Mobile\rbtmon.exe -- (RVBD_SH_Mobile_Monitor)
SRV - [2011/01/25 09:33:34 | 000,864,768 | ---- | M] (Riverbed Technology, Inc) [Auto] -- C:\Program Files\Riverbed\Steelhead Mobile\rbtlogger.exe -- (RVBD_SH_Mobile_Logger)
SRV - [2011/01/20 05:27:22 | 000,378,224 | ---- | M] (Dell Inc.) [Auto] -- C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe -- (dcpsysmgrsvc)
SRV - [2010/11/08 09:42:26 | 000,069,632 | ---- | M] ((C) 2005 - 2010 Siemens AG) [Auto] -- C:\WINDOWS\system32\MCSvc.exe -- (MCsvc)
SRV - [2010/10/10 10:09:52 | 000,291,504 | ---- | M] (Aventail Corporation) [Auto] -- C:\WINDOWS\system32\ngvpnmgr.exe -- (NgVpnMgr)
SRV - [2007/07/03 11:44:40 | 000,061,440 | ---- | M] (British Telecommunications Plc.) [Auto] -- C:\Program Files\BT Common Client\btomosrv.exe -- (BT Common Client)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (ZTEusbser6k)
DRV - File not found [Kernel | On_Demand] --  -- (ZTEusbnmea)
DRV - File not found [Kernel | On_Demand] --  -- (ZTEusbmdm6k)
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (smsmdd)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand] --  -- (massfilter_hs)
DRV - File not found [Kernel | On_Demand] --  -- (massfilter)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2012/12/12 04:37:10 | 000,027,136 | ---- | M] (CSR/PLT) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\csrbcx86.sys -- (CSRBC)
DRV - [2012/09/25 17:46:20 | 000,021,248 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\htcnprot.sys -- (htcnprot)
DRV - [2012/08/20 10:48:44 | 000,015,576 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\pwdrvio.sys -- (pwdrvio)
DRV - [2012/08/20 10:48:44 | 000,010,200 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\pwdspio.sys -- (pwdspio)
DRV - [2011/07/12 05:44:10 | 000,262,416 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\Program Files\OfficeScan NT\TmXpflt.sys -- (TmFilter)
DRV - [2011/07/12 05:43:58 | 000,036,624 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\Program Files\OfficeScan NT\TmPreflt.sys -- (TmPreFilter)
DRV - [2011/07/12 05:09:32 | 001,405,720 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\Program Files\OfficeScan NT\vsapiNT.sys -- (VSApiNt)
DRV - [2011/06/10 06:06:22 | 000,068,368 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\tmactmon.sys -- (tmactmon)
DRV - [2011/06/10 06:06:06 | 000,059,152 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\tmevtmgr.sys -- (tmevtmgr)
DRV - [2011/06/10 06:05:52 | 000,178,448 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm)
DRV - [2011/03/24 16:24:40 | 000,037,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2011/03/24 16:24:40 | 000,037,032 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem)
DRV - [2011/03/24 16:24:36 | 000,033,832 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\cvusbdrv.sys -- (cvusbdrv)
DRV - [2011/03/24 16:24:30 | 001,660,451 | ---- | M] (IDT, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2011/03/24 16:24:30 | 000,113,664 | ---- | M] (Andrea Electronics Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AESTAud.sys -- (AESTAud)
DRV - [2011/02/04 01:38:34 | 000,063,136 | ---- | M] (O2Micro ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\o2sdjxp.sys -- (O2SDJRDR)
DRV - [2011/02/04 01:38:34 | 000,061,728 | ---- | M] (O2Micro ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\o2mdrxp.sys -- (O2MDRRDR)
DRV - [2011/02/04 01:38:30 | 000,043,888 | ---- | M] (ST Microelectronics) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Accelern.sys -- (Acceler)
DRV - [2011/01/25 09:33:36 | 000,424,704 | ---- | M] (Riverbed Technology, Inc) [Kernel | On_Demand] -- C:\Program Files\Riverbed\Steelhead Mobile\rbt.sys -- (RBT)
DRV - [2011/01/04 07:14:38 | 007,391,744 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NETwNx32.sys -- (NETwNx32) ___ Intel(R)
DRV - [2010/12/20 20:27:06 | 000,174,248 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\e1c5132.sys -- (e1cexpress) Intel(R)
DRV - [2010/11/08 14:05:38 | 000,090,448 | ---- | M] (Trend Micro Inc.) [Kernel | System] -- C:\WINDOWS\system32\drivers\tmtdi.sys -- (tmtdi)
DRV - [2010/10/15 04:29:14 | 000,260,864 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV - [2010/10/10 09:47:18 | 000,077,336 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ngvpn.sys -- (NgVpn)
DRV - [2010/10/10 09:47:18 | 000,027,160 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nglog.sys -- (NgLog)
DRV - [2010/10/10 09:47:18 | 000,025,112 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ngwfp.sys -- (NgWfp)
DRV - [2010/10/10 09:47:18 | 000,023,064 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ngfilter.sys -- (NgFilter)
DRV - [2010/08/20 05:04:38 | 000,017,648 | ---- | M] (ST Microelectronics) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\stdcfltn.sys -- (stdcfltn)
DRV - [2010/08/02 10:18:46 | 000,132,624 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2010/05/12 14:17:00 | 000,255,096 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2010/02/19 04:00:18 | 000,909,864 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2010/02/19 04:00:18 | 000,556,200 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2010/02/19 04:00:18 | 000,118,440 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2010/02/19 04:00:18 | 000,047,656 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2009/06/10 10:49:32 | 000,024,576 | ---- | M] (HTC, Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2009/03/10 04:43:54 | 000,108,928 | ---- | M] (LSI Corporation) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\symmpi.sys -- (Symmpi)
DRV - [2009/01/28 23:29:42 | 000,277,032 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\mv64xx.sys -- (mv64xx)
DRV - [2007/05/01 22:21:47 | 000,017,968 | ---- | M] (VMware, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\vmscsi.sys -- (vmscsi)
DRV - [2007/04/20 05:14:06 | 000,024,560 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\btwsp50.sys -- (BTWSp50)
DRV - [2006/06/14 06:53:00 | 000,029,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbccid.sys -- (USBCCID)
DRV - [2006/04/24 11:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata)
DRV - [2005/11/04 02:12:18 | 000,004,992 | ---- | M] (written by © Markus Treinen 2000 - 2005 for Siemens Business Services) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nbtdet.sys -- (NbtDet)
DRV - [2004/05/07 18:11:14 | 000,251,194 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\a320raid.sys -- (a320raid)
DRV - [2003/04/28 09:15:38 | 000,140,544 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\fasttx2k.sys -- (fasttx2k)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = https://intranet.enterprise.siemens.com
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
IE - HKU\cins001z_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = https://intranet.siemens-enterprise.com
IE - HKU\cins001z_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\cins001z_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\cins001z_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
 
IE - HKU\SP000073_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://intranet.siemens-enterprise.com
IE - HKU\SP000073_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\SP000073_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\SteelheadMobileCertificateManager@riverbed.com: C:\Program Files\Riverbed\Steelhead Mobile\shmcert [2011/09/19 08:33:56 | 000,000,000 | ---D | M]
 
 
Hosts file not found
O2 - BHO: (CFindNum Class) - {1B5DFDB7-F1F3-4C64-95B7-8EE2D3ABDC64} - C:\Program Files\Enterprise\OpenScape Desktop Client\System\CDialFunction.dll (Cycos AG)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [OfficeScanNT Monitor] C:\Program Files\OfficeScan NT\pccntmon.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Plantronics MyHeadset Updater] C:\Program Files\Plantronics\MyHeadsetUpdater\MyHeadsetUpdater.exe (Plantronics)
O4 - HKLM..\Run: [SB] C:\Program Files\Enterprise\Bulletin\SB.exe (SEN IT)
O4 - HKLM..\Run: [Steelhead Mobile] C:\Program Files\Riverbed\Steelhead Mobile\shmobile.exe (Riverbed Technology, Inc)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKU\SP000073_ON_C..\Run: []  File not found
O4 - HKU\SP000073_ON_C..\Run: [Akamai NetSession Interface]  File not found
O4 - HKU\SP000073_ON_C..\Run: [Steam]  File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell System Manager.lnk = C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe (Dell Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MobileXpress.lnk = C:\Program Files\BT Common Client\btomo.exe (British Telecommunications Plc.)
O4 - Startup: C:\Documents and Settings\SP000073\Start Menu\Programs\Startup\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPublishingWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWebServices = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoOnlinePrintsWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\kerberos\parameters: supportedencryptiontypes = 2147483644
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 1
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 1
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O9 - Extra Button: IE Integration - {36F3A721-3A5D-4fbf-B77A-F49B99671595} - C:\Program Files\Enterprise\OpenScape Desktop Client\System\CyConfigMenu.dll (Cycos AG)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O15 - HKU\cins001z_ON_C\..Trusted Domains: abatos.com ([]* in Local intranet)
O15 - HKU\cins001z_ON_C\..Trusted Domains: siemens.de ([vssonline.mchh] * in Local intranet)
O15 - HKU\cins001z_ON_C\..Trusted Domains: siemens.net ([*.ww200] * in Local intranet)
O15 - HKU\SP000073_ON_C\..Trusted Domains: abatos.com ([]* in Lokales Intranet)
O15 - HKU\SP000073_ON_C\..Trusted Domains: siemens.de ([vssonline.mchh] * in Lokales Intranet)
O15 - HKU\SP000073_ON_C\..Trusted Domains: siemens.net ([*.ww200] * in Lokales Intranet)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1291379611426 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1291379666235 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {F53270D3-0E32-48B7-B63B-159E33210F70} https://www.g-dms.com/img/webexp/lledit.cab (Livelink Edit Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = global-ad.net
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O18 - Protocol\Handler\saphtmlp {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\SAPGUI710\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\sapr3 {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\SAPGUI710\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} -  File not found
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2010/12/03 07:26:59 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/04/23 14:28:59 | 000,182,784 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\SP000073\4348738.dll
[2011/12/15 05:43:03 | 003,145,728 | ---- | C] (SAP Technology,Inc) -- C:\Program Files\Common Files\sapxlhelper.dll
[2011/12/15 05:43:02 | 000,626,688 | ---- | C] (SAP AG) -- C:\Program Files\Common Files\sapconsaccess.dll
[2011/12/15 05:43:02 | 000,192,512 | ---- | C] (SAP Tech Inc.) -- C:\Program Files\Common Files\sapconsr3.dll
[2011/12/15 05:43:01 | 000,040,960 | ---- | C] (SAP-TECHNOLOGY) -- C:\Program Files\Common Files\DigitalSignature.ocx
[2011/06/29 05:59:56 | 000,004,096 | ---- | C] ( ) -- C:\WINDOWS\System32\IGFXDEVLib.dll
 
========== Files - Modified Within 30 Days ==========
 
[2013/05/22 16:29:07 | 3398,389,760 | -HS- | M] () -- C:\hiberfil.sys
[2013/05/22 15:48:57 | 000,004,312 | RHS- | M] () -- C:\Documents and Settings\SP000073\ntuser.pol
[2013/05/22 15:48:29 | 095,023,320 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\8378434.pad
[2013/05/22 15:47:10 | 000,002,184 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
 
========== Files Created - No Company Name ==========
 
[2013/05/22 15:47:06 | 3398,389,760 | -HS- | C] () -- C:\hiberfil.sys
[2013/04/23 14:27:12 | 000,336,256 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/01/23 07:52:53 | 095,023,320 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\8378434.pad
[2013/01/17 04:21:11 | 000,708,552 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2012/12/13 04:55:48 | 002,872,000 | ---- | C] () -- C:\WINDOWS\System32\pwNative.exe
[2012/12/13 04:55:48 | 000,015,576 | ---- | C] () -- C:\WINDOWS\System32\pwdrvio.sys
[2012/12/13 04:55:48 | 000,010,200 | ---- | C] () -- C:\WINDOWS\System32\pwdspio.sys
[2012/07/26 09:42:35 | 000,005,632 | ---- | C] () -- C:\Documents and Settings\SP000073\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/06/06 09:46:37 | 000,000,158 | ---- | C] () -- C:\WINDOWS\ricdb.ini
[2012/05/29 03:31:15 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/15 05:43:02 | 001,167,872 | ---- | C] () -- C:\Program Files\Common Files\SAPActiveXL.xlt
[2011/12/15 05:43:02 | 000,949,760 | ---- | C] () -- C:\Program Files\Common Files\SAPActiveXL_nosig.xlt
[2011/12/15 05:39:45 | 001,064,960 | ---- | C] () -- C:\WINDOWS\System32\h5krnl32.dll
[2011/12/15 05:39:45 | 000,188,928 | ---- | C] () -- C:\WINDOWS\System32\h5icon32.dll
[2011/12/15 05:39:45 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\h5menu32.dll
[2011/12/15 05:39:45 | 000,095,744 | ---- | C] () -- C:\WINDOWS\System32\h5rtf32.dll
[2011/12/15 05:39:45 | 000,051,200 | ---- | C] () -- C:\WINDOWS\System32\h5tool32.dll
[2011/12/05 10:38:12 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2011/10/05 13:23:28 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2011/09/19 07:39:17 | 000,004,312 | RHS- | C] () -- C:\Documents and Settings\SP000073\ntuser.pol
[2011/09/19 07:24:15 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011/09/19 07:19:29 | 000,003,496 | RHS- | C] () -- C:\Documents and Settings\cins001z\ntuser.pol
[2011/06/29 05:59:57 | 000,783,644 | ---- | C] () -- C:\WINDOWS\System32\igkrng600.bin
[2011/06/29 05:59:56 | 000,201,496 | ---- | C] () -- C:\WINDOWS\System32\igfcg600m.bin
[2011/06/29 05:59:56 | 000,145,804 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng600.bin
[2011/06/29 05:59:55 | 000,000,151 | ---- | C] () -- C:\WINDOWS\System32\GfxUI.exe.config
[2010/12/03 15:09:25 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2010/12/03 15:09:18 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2010/12/03 15:09:18 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2010/12/03 15:09:15 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2010/12/03 15:09:14 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2010/12/03 15:09:09 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2010/12/03 15:08:57 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2010/12/03 15:08:57 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2010/12/03 15:08:34 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2010/12/03 15:08:21 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2010/12/03 09:48:42 | 000,000,398 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010/12/03 08:22:04 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/12/03 07:27:23 | 000,032,256 | ---- | C] () -- C:\WINDOWS\System32\ntrights.exe
[2010/12/03 07:27:23 | 000,000,933 | ---- | C] () -- C:\WINDOWS\System32\NBTDet.ini
[2010/12/03 07:27:22 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\LockKBM.dll
[2010/12/03 07:24:33 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/10/10 10:11:34 | 000,127,152 | ---- | C] () -- C:\WINDOWS\ngmsi.dll
[2010/10/10 10:10:50 | 000,015,024 | ---- | C] () -- C:\WINDOWS\ngutil.exe
[2010/07/08 10:03:46 | 000,000,040 | ---- | C] () -- C:\WINDOWS\System32\OEMInfo.ini
[2010/02/16 03:04:28 | 002,860,384 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2009/01/20 06:32:04 | 000,024,056 | ---- | C] () -- C:\WINDOWS\System32\providers.bin
[2008/05/26 15:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 15:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008/02/25 16:23:10 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2008/02/25 16:23:10 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
[2007/09/27 04:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 04:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 04:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2006/12/07 05:26:28 | 000,000,316 | ---- | C] () -- C:\WINDOWS\fcxlrpw.ini
[2001/11/14 06:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2012/05/29 05:39:03 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Application Data\Aventail
[2011/09/19 07:28:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\cins001z\Application Data\MobileXpress Client
[2012/01/13 05:05:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Aventail
[2012/12/18 10:39:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\DroidExplorer
[2013/01/11 08:52:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\.minecraft
[2012/05/30 02:35:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Aventail
[2012/12/19 03:47:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Boot Animation Factory
[2011/11/28 07:56:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\DirectPrint
[2012/12/18 09:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\DroidExplorer
[2012/12/12 04:40:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\HTC
[2012/12/19 03:32:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012/05/29 05:39:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\MobileXpress Client
[2011/12/02 05:43:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Siemens
[2011/12/15 07:30:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\TclTk
[2011/10/02 04:16:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Telefónica
[2013/01/07 07:22:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Ubisoft
[2011/09/19 07:40:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Windows Desktop Search
[2011/09/29 11:51:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Windows Search
[2011/09/19 07:49:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Aventail
[2011/09/19 07:28:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BT Common Client
[2011/12/05 10:38:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FreePDF
[2012/11/12 05:06:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Jabra
[2011/09/19 07:28:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MobileXpress client
[2013/01/20 07:33:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Native Instruments
[2012/06/06 09:46:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RICOH
[2011/09/19 08:33:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Riverbed
[2011/12/02 05:42:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Siemens
[2013/01/07 07:25:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Solidshield
[2011/09/19 07:31:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
 
========== Purity Check ==========
 
 
< End of report >