Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Bundespolizeitrojaner auf Firmenlaptop (https://www.trojaner-board.de/133848-bundespolizeitrojaner-firmenlaptop.html)

Can418 17.04.2013 16:43
Bundespolizeitrojaner auf Firmenlaptop
 
Hallo liebes Trojanerboard,

schlechte Nachrichten von mir, es hat meinen Firmenlaptop getroffen.
Ich bitte euch um Hilfe.
Die OTL-Disk hab ich schonmal erstellt und hab sie nun wieder eingelegt,
geladen und den Scan drüberlaufen lassen:

Code:
OTL logfile created on: 4/17/2013 5:34:22 PM - Run
OTLPE by OldTimer - Version 3.1.46.0    Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 40.00 Gb Total Space | 17.72 Gb Free Space | 44.30% Space Free | Partition Type: NTFS
Drive D: | 191.87 Gb Total Space | 155.65 Gb Free Space | 81.12% Space Free | Partition Type: NTFS
Drive E: | 7.50 Gb Total Space | 3.99 Gb Free Space | 53.17% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet003
 
========== Win32 Services (SafeList) ==========
 
SRV - [2013/01/23 07:52:53 | 000,182,784 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Documents and Settings\SP000073\4348738.dll -- (winmgmt)
SRV - [2012/10/14 06:14:46 | 000,255,488 | ---- | M] (Ryan Conrad) [Auto] -- C:\Program Files\Droid Explorer\DroidExplorer.Service.exe -- (DroidExplorerService)
SRV - [2012/10/08 11:40:38 | 000,166,912 | ---- | M] () [Auto] -- C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service)
SRV - [2012/06/20 07:58:47 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2011/08/04 12:54:46 | 001,626,152 | ---- | M] (Trend Micro Inc.) [Auto] -- C:\Program Files\OfficeScan NT\tmlisten.exe -- (tmlisten)
SRV - [2011/08/04 12:46:38 | 001,530,104 | ---- | M] (Trend Micro Inc.) [Auto] -- C:\Program Files\OfficeScan NT\ntrtscan.exe -- (ntrtscan)
SRV - [2011/06/10 06:17:38 | 000,345,616 | ---- | M] (Trend Micro Inc.) [On_Demand] -- C:\Program Files\BM\TMBMSRV.exe -- (TMBMServer)
SRV - [2011/04/15 07:20:54 | 000,689,680 | ---- | M] (Trend Micro Inc.) [On_Demand] -- C:\Program Files\OfficeScan NT\TmProxy.exe -- (TmProxy)
SRV - [2011/03/24 16:24:30 | 000,266,322 | ---- | M] (IDT, Inc.) [Auto] -- C:\Program Files\IDT\WDM\stacsv.exe -- (STacSV)
SRV - [2011/03/16 05:42:06 | 000,407,336 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011/02/04 01:38:34 | 000,072,296 | ---- | M] (O2Micro International) [Auto] -- C:\WINDOWS\system32\drivers\o2flash.exe -- (O2FLASH)
SRV - [2011/01/25 09:33:34 | 006,080,000 | ---- | M] (Riverbed Technology, Inc) [Auto] -- C:\Program Files\Riverbed\Steelhead Mobile\rbtmon.exe -- (RVBD_SH_Mobile_Monitor)
SRV - [2011/01/25 09:33:34 | 000,864,768 | ---- | M] (Riverbed Technology, Inc) [Auto] -- C:\Program Files\Riverbed\Steelhead Mobile\rbtlogger.exe -- (RVBD_SH_Mobile_Logger)
SRV - [2011/01/20 05:27:22 | 000,378,224 | ---- | M] (Dell Inc.) [Auto] -- C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe -- (dcpsysmgrsvc)
SRV - [2010/11/08 09:42:26 | 000,069,632 | ---- | M] ((C) 2005 - 2010 Siemens AG) [Auto] -- C:\WINDOWS\system32\MCSvc.exe -- (MCsvc)
SRV - [2010/10/10 10:09:52 | 000,291,504 | ---- | M] (Aventail Corporation) [Auto] -- C:\WINDOWS\system32\ngvpnmgr.exe -- (NgVpnMgr)
SRV - [2007/07/03 11:44:40 | 000,061,440 | ---- | M] (British Telecommunications Plc.) [Auto] -- C:\Program Files\BT Common Client\btomosrv.exe -- (BT Common Client)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (ZTEusbser6k)
DRV - File not found [Kernel | On_Demand] --  -- (ZTEusbnmea)
DRV - File not found [Kernel | On_Demand] --  -- (ZTEusbmdm6k)
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (smsmdd)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | On_Demand] --  -- (massfilter_hs)
DRV - File not found [Kernel | On_Demand] --  -- (massfilter)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2012/12/12 04:37:10 | 000,027,136 | ---- | M] (CSR/PLT) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\csrbcx86.sys -- (CSRBC)
DRV - [2012/09/25 17:46:20 | 000,021,248 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\htcnprot.sys -- (htcnprot)
DRV - [2012/08/20 10:48:44 | 000,015,576 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\pwdrvio.sys -- (pwdrvio)
DRV - [2012/08/20 10:48:44 | 000,010,200 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\pwdspio.sys -- (pwdspio)
DRV - [2011/07/12 05:44:10 | 000,262,416 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\Program Files\OfficeScan NT\TmXpflt.sys -- (TmFilter)
DRV - [2011/07/12 05:43:58 | 000,036,624 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\Program Files\OfficeScan NT\TmPreflt.sys -- (TmPreFilter)
DRV - [2011/07/12 05:09:32 | 001,405,720 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\Program Files\OfficeScan NT\vsapiNT.sys -- (VSApiNt)
DRV - [2011/06/10 06:06:22 | 000,068,368 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\tmactmon.sys -- (tmactmon)
DRV - [2011/06/10 06:06:06 | 000,059,152 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\tmevtmgr.sys -- (tmevtmgr)
DRV - [2011/06/10 06:05:52 | 000,178,448 | ---- | M] (Trend Micro Inc.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm)
DRV - [2011/03/24 16:24:40 | 000,037,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver)
DRV - [2011/03/24 16:24:40 | 000,037,032 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwmodem.sys -- (btwmodem)
DRV - [2011/03/24 16:24:36 | 000,033,832 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\cvusbdrv.sys -- (cvusbdrv)
DRV - [2011/03/24 16:24:30 | 001,660,451 | ---- | M] (IDT, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2011/03/24 16:24:30 | 000,113,664 | ---- | M] (Andrea Electronics Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AESTAud.sys -- (AESTAud)
DRV - [2011/02/04 01:38:34 | 000,063,136 | ---- | M] (O2Micro ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\o2sdjxp.sys -- (O2SDJRDR)
DRV - [2011/02/04 01:38:34 | 000,061,728 | ---- | M] (O2Micro ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\o2mdrxp.sys -- (O2MDRRDR)
DRV - [2011/02/04 01:38:30 | 000,043,888 | ---- | M] (ST Microelectronics) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Accelern.sys -- (Acceler)
DRV - [2011/01/25 09:33:36 | 000,424,704 | ---- | M] (Riverbed Technology, Inc) [Kernel | On_Demand] -- C:\Program Files\Riverbed\Steelhead Mobile\rbt.sys -- (RBT)
DRV - [2011/01/04 07:14:38 | 007,391,744 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NETwNx32.sys -- (NETwNx32) ___ Intel(R)
DRV - [2010/12/20 20:27:06 | 000,174,248 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\e1c5132.sys -- (e1cexpress) Intel(R)
DRV - [2010/11/08 14:05:38 | 000,090,448 | ---- | M] (Trend Micro Inc.) [Kernel | System] -- C:\WINDOWS\system32\drivers\tmtdi.sys -- (tmtdi)
DRV - [2010/10/15 04:29:14 | 000,260,864 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV - [2010/10/10 09:47:18 | 000,077,336 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ngvpn.sys -- (NgVpn)
DRV - [2010/10/10 09:47:18 | 000,027,160 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nglog.sys -- (NgLog)
DRV - [2010/10/10 09:47:18 | 000,025,112 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ngwfp.sys -- (NgWfp)
DRV - [2010/10/10 09:47:18 | 000,023,064 | ---- | M] (Aventail Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ngfilter.sys -- (NgFilter)
DRV - [2010/08/20 05:04:38 | 000,017,648 | ---- | M] (ST Microelectronics) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\stdcfltn.sys -- (stdcfltn)
DRV - [2010/08/02 10:18:46 | 000,132,624 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2010/05/12 14:17:00 | 000,255,096 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2010/02/19 04:00:18 | 000,909,864 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2010/02/19 04:00:18 | 000,556,200 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio)
DRV - [2010/02/19 04:00:18 | 000,118,440 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS)
DRV - [2010/02/19 04:00:18 | 000,047,656 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2009/06/10 10:49:32 | 000,024,576 | ---- | M] (HTC, Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ANDROIDUSB.sys -- (HTCAND32)
DRV - [2009/03/10 04:43:54 | 000,108,928 | ---- | M] (LSI Corporation) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\symmpi.sys -- (Symmpi)
DRV - [2009/01/28 23:29:42 | 000,277,032 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\mv64xx.sys -- (mv64xx)
DRV - [2007/05/01 22:21:47 | 000,017,968 | ---- | M] (VMware, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\vmscsi.sys -- (vmscsi)
DRV - [2007/04/20 05:14:06 | 000,024,560 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\btwsp50.sys -- (BTWSp50)
DRV - [2006/06/14 06:53:00 | 000,029,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\usbccid.sys -- (USBCCID)
DRV - [2006/04/24 11:52:28 | 000,100,736 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata)
DRV - [2005/11/04 02:12:18 | 000,004,992 | ---- | M] (written by © Markus Treinen 2000 - 2005 for Siemens Business Services) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nbtdet.sys -- (NbtDet)
DRV - [2004/05/07 18:11:14 | 000,251,194 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\a320raid.sys -- (a320raid)
DRV - [2003/04/28 09:15:38 | 000,140,544 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled] -- C:\WINDOWS\system32\DRIVERS\fasttx2k.sys -- (fasttx2k)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = https://intranet.enterprise.siemens.com
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" =
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
IE - HKU\cins001z_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = https://intranet.siemens-enterprise.com
IE - HKU\cins001z_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\cins001z_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\cins001z_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
 
IE - HKU\SP000073_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://intranet.siemens-enterprise.com
IE - HKU\SP000073_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\SP000073_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "AutoConfigURL" = hxxp://172.28.12.5/accelerated_pac_base.pac
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\SteelheadMobileCertificateManager@riverbed.com: C:\Program Files\Riverbed\Steelhead Mobile\shmcert [2011/09/19 08:33:56 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2008/04/14 08:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (CFindNum Class) - {1B5DFDB7-F1F3-4C64-95B7-8EE2D3ABDC64} - C:\Program Files\Enterprise\OpenScape Desktop Client\System\CDialFunction.dll (Cycos AG)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe ()
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [OfficeScanNT Monitor] C:\Program Files\OfficeScan NT\pccntmon.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [Plantronics MyHeadset Updater] C:\Program Files\Plantronics\MyHeadsetUpdater\MyHeadsetUpdater.exe (Plantronics)
O4 - HKLM..\Run: [SB] C:\Program Files\Enterprise\Bulletin\SB.exe (SEN IT)
O4 - HKLM..\Run: [Steelhead Mobile] C:\Program Files\Riverbed\Steelhead Mobile\shmobile.exe (Riverbed Technology, Inc)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKU\SP000073_ON_C..\Run: []  File not found
O4 - HKU\SP000073_ON_C..\Run: [Akamai NetSession Interface]  File not found
O4 - HKU\SP000073_ON_C..\Run: [Steam] D:\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell System Manager.lnk = C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe (Dell Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MobileXpress.lnk = C:\Program Files\BT Common Client\btomo.exe (British Telecommunications Plc.)
O4 - Startup: C:\Documents and Settings\SP000073\Start Menu\Programs\Startup\runctf.lnk = X:\I386\SYSTEM32\RUNDLL32.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPublishingWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWebServices = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoOnlinePrintsWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: disablecad = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\kerberos\parameters: supportedencryptiontypes = 2147483644
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 1
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKU\cins001z_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 1
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O7 - HKU\SP000073_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O9 - Extra Button: IE Integration - {36F3A721-3A5D-4fbf-B77A-F49B99671595} - C:\Program Files\Enterprise\OpenScape Desktop Client\System\CyConfigMenu.dll (Cycos AG)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O15 - HKU\cins001z_ON_C\..Trusted Domains: abatos.com ([]* in Local intranet)
O15 - HKU\cins001z_ON_C\..Trusted Domains: siemens.de ([vssonline.mchh] * in Local intranet)
O15 - HKU\cins001z_ON_C\..Trusted Domains: siemens.net ([*.ww200] * in Local intranet)
O15 - HKU\SP000073_ON_C\..Trusted Domains: abatos.com ([]* in Lokales Intranet)
O15 - HKU\SP000073_ON_C\..Trusted Domains: siemens.de ([vssonline.mchh] * in Lokales Intranet)
O15 - HKU\SP000073_ON_C\..Trusted Domains: siemens.net ([*.ww200] * in Lokales Intranet)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1291379611426 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1291379666235 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {F53270D3-0E32-48B7-B63B-159E33210F70} https://www.g-dms.com/img/webexp/lledit.cab (Livelink Edit Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 172.28.64.1 194.25.2.129 62.72.64.237
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = global-ad.net
O18 - Protocol\Handler\saphtmlp {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\SAPGUI710\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O18 - Protocol\Handler\sapr3 {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - C:\Program Files\SAP\SAPGUI710\SAPgui\SAPHTMLP.DLL (SAP AG, Walldorf)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2010/12/03 07:26:59 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2013/02/18 13:22:32 | 000,000,128 | ---- | M] () - E:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/01/23 07:52:51 | 000,182,784 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\SP000073\4348738.dll
[2011/12/15 05:43:03 | 003,145,728 | ---- | C] (SAP Technology,Inc) -- C:\Program Files\Common Files\sapxlhelper.dll
[2011/12/15 05:43:02 | 000,626,688 | ---- | C] (SAP AG) -- C:\Program Files\Common Files\sapconsaccess.dll
[2011/12/15 05:43:02 | 000,192,512 | ---- | C] (SAP Tech Inc.) -- C:\Program Files\Common Files\sapconsr3.dll
[2011/12/15 05:43:01 | 000,040,960 | ---- | C] (SAP-TECHNOLOGY) -- C:\Program Files\Common Files\DigitalSignature.ocx
[2011/06/29 05:59:56 | 000,004,096 | ---- | C] ( ) -- C:\WINDOWS\System32\IGFXDEVLib.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/01/23 07:52:55 | 000,002,864 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\8378434.js
[2013/01/23 07:52:53 | 095,023,320 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\8378434.pad
[2013/01/17 04:21:11 | 000,708,552 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2013/01/14 04:05:42 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/12/13 04:55:48 | 002,872,000 | ---- | C] () -- C:\WINDOWS\System32\pwNative.exe
[2012/12/13 04:55:48 | 000,015,576 | ---- | C] () -- C:\WINDOWS\System32\pwdrvio.sys
[2012/12/13 04:55:48 | 000,010,200 | ---- | C] () -- C:\WINDOWS\System32\pwdspio.sys
[2012/07/26 09:42:35 | 000,005,632 | ---- | C] () -- C:\Documents and Settings\SP000073\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/06/06 09:46:37 | 000,000,158 | ---- | C] () -- C:\WINDOWS\ricdb.ini
[2012/05/29 03:31:15 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011/12/15 05:43:02 | 001,167,872 | ---- | C] () -- C:\Program Files\Common Files\SAPActiveXL.xlt
[2011/12/15 05:43:02 | 000,949,760 | ---- | C] () -- C:\Program Files\Common Files\SAPActiveXL_nosig.xlt
[2011/12/15 05:39:45 | 001,064,960 | ---- | C] () -- C:\WINDOWS\System32\h5krnl32.dll
[2011/12/15 05:39:45 | 000,188,928 | ---- | C] () -- C:\WINDOWS\System32\h5icon32.dll
[2011/12/15 05:39:45 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\h5menu32.dll
[2011/12/15 05:39:45 | 000,095,744 | ---- | C] () -- C:\WINDOWS\System32\h5rtf32.dll
[2011/12/15 05:39:45 | 000,051,200 | ---- | C] () -- C:\WINDOWS\System32\h5tool32.dll
[2011/12/05 10:38:12 | 000,000,043 | ---- | C] () -- C:\WINDOWS\gswin32.ini
[2011/10/05 13:23:28 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI
[2011/09/19 08:22:30 | 000,009,176 | ---- | C] () -- C:\WINDOWS\cfgall.ini
[2011/09/19 07:39:17 | 000,004,312 | RHS- | C] () -- C:\Documents and Settings\SP000073\ntuser.pol
[2011/09/19 07:24:15 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011/09/19 07:19:29 | 000,003,496 | RHS- | C] () -- C:\Documents and Settings\cins001z\ntuser.pol
[2011/06/29 05:59:57 | 000,783,644 | ---- | C] () -- C:\WINDOWS\System32\igkrng600.bin
[2011/06/29 05:59:56 | 000,201,496 | ---- | C] () -- C:\WINDOWS\System32\igfcg600m.bin
[2011/06/29 05:59:56 | 000,145,804 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng600.bin
[2011/06/29 05:59:55 | 000,000,151 | ---- | C] () -- C:\WINDOWS\System32\GfxUI.exe.config
[2010/12/03 15:09:25 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2010/12/03 15:09:18 | 000,529,824 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2010/12/03 15:09:18 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2010/12/03 15:09:18 | 000,096,658 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2010/12/03 15:09:18 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2010/12/03 15:09:15 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2010/12/03 15:09:14 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2010/12/03 15:09:09 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2010/12/03 15:08:57 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2010/12/03 15:08:57 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2010/12/03 15:08:34 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2010/12/03 15:08:21 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2010/12/03 09:48:42 | 000,000,398 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010/12/03 08:22:04 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/12/03 08:20:49 | 000,336,256 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/12/03 07:30:25 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/12/03 07:27:23 | 000,032,256 | ---- | C] () -- C:\WINDOWS\System32\ntrights.exe
[2010/12/03 07:27:23 | 000,000,933 | ---- | C] () -- C:\WINDOWS\System32\NBTDet.ini
[2010/12/03 07:27:22 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\LockKBM.dll
[2010/12/03 07:24:33 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/10/10 10:11:34 | 000,127,152 | ---- | C] () -- C:\WINDOWS\ngmsi.dll
[2010/10/10 10:10:50 | 000,015,024 | ---- | C] () -- C:\WINDOWS\ngutil.exe
[2010/07/08 10:03:46 | 000,000,040 | ---- | C] () -- C:\WINDOWS\System32\OEMInfo.ini
[2010/02/16 03:04:28 | 002,860,384 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2009/01/20 06:32:04 | 000,024,056 | ---- | C] () -- C:\WINDOWS\System32\providers.bin
[2008/05/26 15:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 15:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008/02/25 16:23:10 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2008/02/25 16:23:10 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
[2007/09/27 04:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 04:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 04:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2006/12/07 05:26:28 | 000,000,316 | ---- | C] () -- C:\WINDOWS\fcxlrpw.ini
[2001/11/14 06:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2012/05/29 05:39:03 | 000,000,000 | ---D | M] -- C:\WINDOWS\system32\config\systemprofile\Application Data\Aventail
[2011/09/19 07:28:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\cins001z\Application Data\MobileXpress Client
[2012/01/13 05:05:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Aventail
[2012/12/18 10:39:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\DroidExplorer
[2013/01/11 08:52:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\.minecraft
[2012/05/30 02:35:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Aventail
[2012/12/19 03:47:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Boot Animation Factory
[2011/11/28 07:56:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\DirectPrint
[2012/12/18 09:36:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\DroidExplorer
[2012/12/12 04:40:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\HTC
[2012/12/19 03:32:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
[2012/05/29 05:39:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\MobileXpress Client
[2011/12/02 05:43:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Siemens
[2011/12/15 07:30:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\TclTk
[2011/10/02 04:16:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Telefónica
[2013/01/07 07:22:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Ubisoft
[2011/09/19 07:40:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Windows Desktop Search
[2011/09/29 11:51:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SP000073\Application Data\Windows Search
[2011/09/19 07:49:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Aventail
[2011/09/19 07:28:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BT Common Client
[2011/12/05 10:38:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\FreePDF
[2012/11/12 05:06:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Jabra
[2011/09/19 07:28:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MobileXpress client
[2013/01/20 07:33:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Native Instruments
[2012/06/06 09:46:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RICOH
[2011/09/19 08:33:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Riverbed
[2011/12/02 05:42:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Siemens
[2013/01/07 07:25:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Solidshield
[2011/09/19 07:31:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2013/01/20 07:34:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{4A818508-3355-4FBC-B302-D53B599DD9D5}
 
========== Purity Check ==========
 
 
< End of report >
Ich hoffe Ihr könnt mir schnell helfen,
da ich erhlich gesagt keine Lust habe,
zu unseren Admin mit dem Problem zu rennen.

Ich danke euch schonmal im Voraus für eure Hilfe

MFG Can418

aharonov 17.04.2013 16:52
Hi,

Zitat:
es hat meinen Firmenlaptop getroffen.
Nimm dazu bitte zuerst folgende Hinweise zur Kenntnis:

Hinweise zu gewerblich genutzten Rechnern
  • Für gewerblich genutzte Rechner sind in erster Linie nicht wir sondern der firmeneigene IT-Support zuständig. Nur bei kleinen Unternehmen ohne einen eigenen IT-Support machen wir aber gerne eine Ausnahme und schauen uns den Rechner an.
  • Es gilt aber zu bedenken, dass eine Malware-Bereinigung prinzipiell keine absolute Sicherheit bieten kann und immer ein kleines Restrisiko bestehen bleibt. Speziell wenn sich sensible Firmen- oder Kundendaten auf dem Rechner befinden, sollte man bei Anzeichen von schwerwiegendem Malwarebefall ein Formatieren der Festplatte und Neuinstallieren des Systems ins Auge fassen.
  • Weiter weisen wir darauf hin, dass wir keinerlei Haftung übernehmen für den Fall, dass etwas schief läuft. Auch bist du selbst dafür verantwortlich, dass in den geposteten Logfiles keine internen Informationen auftauchen, welche nicht öffentlich einsehbar sein dürfen. Solche Einträge aber bitte nicht einfach ganz löschen, sondern klar erkennbar zensieren.
  • Die Hilfestellung erfolgt auch in diesem Fall kostenlos. Es besteht aber die Möglichkeit, das Forum mit einer kleinen Spende zu unterstützen.

Can418 17.04.2013 17:08
Alles klar, zur Kenntnis genommen. Schade aber da führt kein Weg daran vorbei.
Kleine Aktualisierung zu dem Thema, habe nun meinen Laptop neugestartet und der Trojaner war noch immer zu sehen.
Nach einen Druck auf den Ausschalter schloss sich das besagte Trojaner-Fenster und ich konnte den Runterfahrprozess aufhalten,
indem ich bei einem Fenster für sofort beenden auf das X geklickt habe.
Habt ihr einen Tipp wie ich mit laufenden OS den Trojaner aufspüren bzw. bereinigen kann?
Sollte ich Maleware Programme installieren und wenn ja welche?

Vielen Dank
Can418

aharonov 17.04.2013 17:26
Hallo,

Zitat:
Habt ihr einen Tipp wie ich mit laufenden OS den Trojaner aufspüren bzw. bereinigen kann?
Also selber würd ich da nicht einfach etwas rumbasteln, da ist unter anderem ein Windows-Dienst befallen bei dir.
Das ist klar Sache des Admins. Im Ausnahmefall, dass es grad anders nicht geht, mach ich das auch (aber unter oben genannten Voraussetzungen).

aharonov 22.04.2013 16:14
Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Ich bekomme somit keine Benachrichtigung mehr über neue Antworten.
Solltest du das Thema erneut brauchen, schicke mir bitte eine PM und wir machen hier weiter.

Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:06 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19