| |
| |||||||
Log-Analyse und Auswertung: qtwebkit4.dll und virenbefall?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
22.10.2011, 10:48
| #1 |
 |  qtwebkit4.dll und virenbefall? Ich bin nicht sicher ob es sich um ein Virus/Trojanerproblem handelt. Die Symptome sind folgende: 1. TurboMed lässt sich nicht vollständig installieren 2. Wenn ich versuche mir die datei qtwebkit4.dll im verzeichnis von turbomed-verzeichnis anzugucken friert der rechner ein. Wenn ich versuche die gleiche Datei in einem anderen Verzeichnis anzugucken freiert der Rechner ebenfalls ein. Das Programm ist auf mehreren anderen Rechnern installiert und das Problem tritt nur auf einem Rechner auf. Vielen Dank! Hier die Scanlogs otl, gmer und extras: OTL Logfile: Code:
ATTFilter OTL logfile created on: 21.10.2011 20:14:52 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\S7\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1014,42 Mb Total Physical Memory | 444,20 Mb Available Physical Memory | 43,79% Memory free 2,37 Gb Paging File | 1,88 Gb Available in Paging File | 79,16% Paging File free Paging file location(s): C:\pagefile.sys 1512 1512 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 35,66 Gb Total Space | 21,75 Gb Free Space | 60,99% Space Free | Partition Type: NTFS Drive G: | 36,15 Gb Total Space | 30,04 Gb Free Space | 83,09% Space Free | Partition Type: NTFS Computer Name: S7 | User Name: S7 | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.10.21 20:08:18 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\S7\Desktop\OTL.exe PRC - [2010.09.24 10:54:20 | 000,372,736 | ---- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WLanNetService.exe PRC - [2010.07.20 02:00:00 | 001,904,640 | ---- | M] (AVM Berlin) -- C:\Programme\avmwlanstick\WLanGUI.exe PRC - [2009.04.29 20:07:00 | 000,144,888 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan Enterprise\Mcshield.exe PRC - [2009.04.29 20:07:00 | 000,124,240 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan Enterprise\shstat.exe PRC - [2009.04.29 20:07:00 | 000,070,216 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\mfevtps.exe PRC - [2009.04.29 20:07:00 | 000,062,800 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan Enterprise\VsTskMgr.exe PRC - [2009.04.29 20:07:00 | 000,027,960 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan Enterprise\mfeann.exe PRC - [2009.04.29 20:07:00 | 000,021,256 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\VirusScan Enterprise\EngineServer.exe PRC - [2009.01.16 16:00:00 | 000,226,624 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\Common Framework\naPrdMgr.exe PRC - [2009.01.16 16:00:00 | 000,136,512 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\Common Framework\UdaterUI.exe PRC - [2009.01.16 16:00:00 | 000,103,744 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\Common Framework\FrameworkService.exe PRC - [2009.01.16 16:00:00 | 000,091,456 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee\Common Framework\McTray.exe PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2006.02.17 15:26:32 | 000,073,728 | ---- | M] (Hewlett-Packard Company) -- c:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe PRC - [2003.10.08 02:00:00 | 000,106,496 | ---- | M] (AVM Berlin) -- C:\Programme\KEN!\kentbcli.exe PRC - [2003.10.08 02:00:00 | 000,049,204 | ---- | M] (AVM Berlin) -- C:\Programme\KEN!\kencli.exe ========== Modules (No Company Name) ========== MOD - [2009.01.16 16:00:00 | 000,057,344 | ---- | M] () -- C:\Programme\McAfee\Common Framework\boost_thread-vc71-mt-1_32.dll MOD - [2005.08.22 15:38:16 | 003,264,512 | ---- | M] () -- C:\Programme\McAfee\Common Framework\cryptocme2.dll MOD - [2003.10.08 02:00:00 | 000,827,392 | ---- | M] () -- C:\Programme\KEN!\libeay32.dll MOD - [2003.10.08 02:00:00 | 000,159,744 | ---- | M] () -- C:\Programme\KEN!\ssleay32.dll ========== Win32 Services (SafeList) ========== SRV - [2010.09.24 10:54:20 | 000,372,736 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\avmwlanstick\WLanNetService.exe -- (AVM WLAN Connection Service) SRV - [2009.04.29 20:07:00 | 000,144,888 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Programme\McAfee\VirusScan Enterprise\Mcshield.exe -- (McShield) SRV - [2009.04.29 20:07:00 | 000,070,216 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\WINDOWS\system32\mfevtps.exe -- (mfevtp) SRV - [2009.04.29 20:07:00 | 000,062,800 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Programme\McAfee\VirusScan Enterprise\VsTskMgr.exe -- (McTaskManager) SRV - [2009.04.29 20:07:00 | 000,021,256 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Programme\McAfee\VirusScan Enterprise\EngineServer.exe -- (McAfeeEngineService) SRV - [2009.01.16 16:00:00 | 000,103,744 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Programme\McAfee\Common Framework\FrameworkService.exe -- (McAfeeFramework) SRV - [2006.02.17 15:26:32 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- c:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService) SRV - [2004.10.22 03:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2003.10.08 02:00:00 | 000,049,204 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Programme\KEN!\kencli.exe -- (KEN Client Service) ========== Driver Services (SafeList) ========== DRV - [2010.12.30 10:54:06 | 000,034,736 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RKHit.sys -- (RkHit) DRV - [2010.07.20 02:00:00 | 000,925,600 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\fwlanusb4.sys -- (fwlanusb4) DRV - [2010.07.20 02:00:00 | 000,004,352 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avmeject.sys -- (avmeject) DRV - [2009.04.29 20:07:00 | 000,342,128 | ---- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk) DRV - [2009.04.29 20:07:00 | 000,091,640 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk) DRV - [2009.04.29 20:07:00 | 000,075,704 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeapfk.sys -- (mfeapfk) DRV - [2009.04.29 20:07:00 | 000,065,224 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdet.sys -- (mferkdet) DRV - [2009.04.29 20:07:00 | 000,063,696 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfetdik.sys -- (mfetdik) DRV - [2009.04.29 20:07:00 | 000,043,288 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk) DRV - [2007.10.18 15:41:42 | 000,362,837 | ---- | M] (Illusion & Hope.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\BT848.sys -- (BT848) DRV - [2006.06.28 18:53:00 | 000,244,864 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp) DRV - [2006.05.16 02:32:58 | 004,275,712 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2006.04.06 01:00:00 | 000,264,704 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\fwlanusb.sys -- (FWLANUSB) DRV - [2005.01.13 14:46:16 | 000,069,632 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15.sys) DRV - [2003.10.08 02:00:00 | 000,057,664 | ---- | M] (AVM Berlin) [Kernel | Auto | Running] -- C:\WINDOWS\System32\Drivers\ndc.sys -- (ndc) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/sp/*hxxp://de.yahoo.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.**********.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 1.1.1.1:80 FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) O1 HOSTS File: ([2004.08.04 06:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan Enterprise\scriptsn.dll (McAfee, Inc.) O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - No CLSID value found. O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found. O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\WLanGUI.exe (AVM Berlin) O4 - HKLM..\Run: [KEN Taskbar Client] C:\Programme\KEN!\kentbcli.exe (AVM Berlin) O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Programme\McAfee\Common Framework\udaterui.exe (McAfee, Inc.) O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe () O4 - HKLM..\Run: [pcsafedoctor.exe] C:\Programme\PCSafeDoctor\pcsafedoctor.exe () O4 - HKLM..\Run: [ShStatEXE] C:\Programme\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\ISDNWatch.lnk = C:\Programme\FRITZ!\IWatch.exe (AVM Berlin) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1280336752734 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{70227248-20F8-4081-AA0C-E16582837FCB}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EBC353CE-835E-4F89-AC8E-2FC658DC2BC1}: NameServer = 192.168.0.10,192.168.0.1 O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2011.10.19 18:06:45 | 000,000,075 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{c6009f75-8632-11e0-a68e-001921066ab0}\Shell - "" = AutoRun O33 - MountPoints2\{c6009f75-8632-11e0-a68e-001921066ab0}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{c6009f75-8632-11e0-a68e-001921066ab0}\Shell\AutoRun\command - "" = D:\pushinst.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789) ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {EFCE7BE0-510E-4932-9475-F44CD90DE16A} - Microsoft .NET Framework 1.1 Security Update (KB2572067) ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE NetSvcs: 6to4 - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - StartUpReg: Alcmtr - hkey= - key= - C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) MsConfig - StartUpReg: eDataSecurity Loader - hkey= - key= - File not found MsConfig - StartUpReg: eRecoveryService - hkey= - key= - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (Acer Inc.) MsConfig - StartUpReg: HotKeysCmds - hkey= - key= - File not found MsConfig - StartUpReg: IgfxTray - hkey= - key= - File not found MsConfig - StartUpReg: IMEKRMIG6.1 - hkey= - key= - C:\WINDOWS\ime\imkr6_1\imekrmig.exe (Microsoft Corporation) MsConfig - StartUpReg: IMJPMIG8.1 - hkey= - key= - C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation) MsConfig - StartUpReg: LaunchApp - hkey= - key= - C:\WINDOWS\Alaunch.exe (Acer Inc.) MsConfig - StartUpReg: Persistence - hkey= - key= - File not found MsConfig - StartUpReg: PHIME2002A - hkey= - key= - File not found MsConfig - StartUpReg: PHIME2002ASync - hkey= - key= - File not found MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 0 MsConfig - State: "startup" - 2 CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.10.21 20:08:00 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\S7\Desktop\OTL.exe [2011.10.21 19:43:55 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\PCSafeDoctor [2011.10.21 19:43:41 | 000,000,000 | ---D | C] -- C:\Programme\PCSafeDoctor [2011.10.21 19:41:33 | 042,290,883 | ---- | C] (pcsafedoctor.com, Inc. ) -- C:\Dokumente und Einstellungen\S7\Desktop\PCSafeDoctor_Setup.exe [2011.10.20 22:46:44 | 000,139,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwd.sys [2011.10.20 22:46:34 | 000,010,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndistapi.sys [2011.10.19 18:28:52 | 000,004,352 | ---- | C] (AVM Berlin) -- C:\WINDOWS\System32\drivers\avmeject.sys [2011.10.19 18:28:09 | 000,925,600 | ---- | C] (AVM GmbH) -- C:\WINDOWS\System32\drivers\fwlanusb4.sys [2011.10.19 18:28:08 | 000,078,336 | ---- | C] (AVM Berlin) -- C:\WINDOWS\System32\fwlan4ci.dll [2011.10.19 18:20:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\S7\AVM_Driver [2011.09.26 11:41:54 | 000,614,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\uiautomationcore.dll [2007.10.17 18:44:19 | 000,016,384 | ---- | C] ( ) -- C:\WINDOWS\System32\ClearEvent.exe [2007.10.17 18:41:11 | 000,049,152 | ---- | C] ( ) -- C:\WINDOWS\System32\SysMonitor.exe [8 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.10.21 20:09:34 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.10.21 20:09:20 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.10.21 20:09:19 | 1063,768,064 | -HS- | M] () -- C:\hiberfil.sys [2011.10.21 20:08:18 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\S7\Desktop\OTL.exe [2011.10.21 20:07:18 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\S7\defogger_reenable [2011.10.21 20:07:03 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\S7\Desktop\Defogger.exe [2011.10.21 19:45:19 | 000,000,022 | ---- | M] () -- C:\WINDOWS\tpcsd [2011.10.21 19:43:56 | 000,000,708 | ---- | M] () -- C:\Dokumente und Einstellungen\S7\Desktop\pcsafedoctor.lnk [2011.10.21 19:43:28 | 042,290,883 | ---- | M] (pcsafedoctor.com, Inc. ) -- C:\Dokumente und Einstellungen\S7\Desktop\PCSafeDoctor_Setup.exe [2011.10.21 09:16:02 | 000,175,464 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.10.20 22:52:21 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2011.10.19 18:06:45 | 000,000,075 | ---- | M] () -- C:\AUTOEXEC.BAT [2011.10.19 18:04:25 | 000,000,624 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\TurboMed.lnk [2011.10.19 17:16:21 | 000,011,517 | ---- | M] () -- C:\WINDOWS\Global.ini [2011.10.03 10:34:11 | 005,971,456 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll [2011.09.26 11:41:54 | 000,614,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\uiautomationcore.dll [2011.09.26 11:41:54 | 000,023,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\oleaccrc.dll [2011.09.26 11:41:54 | 000,023,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\oleaccrc.dll [2011.09.26 11:41:20 | 000,220,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\oleacc.dll [8 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp files -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.10.21 20:07:18 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\S7\defogger_reenable [2011.10.21 20:07:03 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\S7\Desktop\Defogger.exe [2011.10.21 19:45:19 | 000,000,022 | ---- | C] () -- C:\WINDOWS\tpcsd [2011.10.21 19:43:56 | 000,000,708 | ---- | C] () -- C:\Dokumente und Einstellungen\S7\Desktop\pcsafedoctor.lnk [2011.10.21 19:43:43 | 000,034,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\RKHit.sys [2011.10.19 18:28:14 | 000,013,202 | ---- | C] () -- C:\WINDOWS\instwcli.inf [2011.10.19 18:28:09 | 000,049,792 | ---- | C] () -- C:\WINDOWS\System32\drivers\fwlanusb4.bin [2011.07.10 14:48:25 | 000,011,517 | ---- | C] () -- C:\WINDOWS\Global.ini [2011.05.24 20:53:46 | 000,097,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\Fwusb1b.bin [2010.07.29 08:07:08 | 000,000,135 | ---- | C] () -- C:\Dokumente und Einstellungen\S7\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2008.06.28 11:04:36 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BarCode.ini [2007.11.12 20:55:21 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\capi2032.dll [2007.10.18 21:09:06 | 000,000,010 | ---- | C] () -- C:\WINDOWS\popcinfo.dat [2007.10.18 17:15:39 | 000,051,200 | ---- | C] () -- C:\Dokumente und Einstellungen\S7\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.10.17 22:32:07 | 000,000,644 | ---- | C] () -- C:\Dokumente und Einstellungen\S7\Lokale Einstellungen\Anwendungsdaten\FASTWiz.html [2007.10.17 22:14:05 | 001,843,200 | ---- | C] () -- C:\WINDOWS\System32\ltmm_n.dll [2007.10.17 22:14:05 | 000,068,096 | ---- | C] () -- C:\WINDOWS\System32\lfplt11n.dll [2007.10.17 21:40:21 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2007.10.17 18:45:12 | 000,000,046 | ---- | C] () -- C:\WINDOWS\commercial.ini [2007.07.11 01:27:51 | 000,348,880 | ---- | C] () -- C:\WINDOWS\System32\igmedkrn.dll [2007.07.11 01:27:51 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4642.dll [2006.07.19 20:15:52 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2006.07.19 20:15:40 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2006.07.19 20:12:48 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll [2006.07.19 20:11:54 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll [2006.07.19 20:11:54 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll [2006.07.19 20:11:54 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll [2006.07.19 20:11:54 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll [2006.07.19 20:10:32 | 000,392,842 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2006.07.19 20:10:32 | 000,381,828 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2006.07.19 20:10:32 | 000,064,650 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2006.07.19 20:10:32 | 000,053,572 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2006.07.19 20:04:44 | 000,175,464 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2006.07.19 19:47:28 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2006.07.19 19:45:48 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2006.06.21 23:11:38 | 000,000,083 | ---- | C] () -- C:\WINDOWS\ALaunch.ini [2005.11.16 22:11:52 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\Kill1211.exe [2005.10.31 03:17:38 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll [2005.10.26 00:25:28 | 000,008,073 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2005.07.15 01:48:00 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2005.07.12 14:44:42 | 000,015,872 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD64.DLL [2004.08.04 06:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2004.08.04 06:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2004.08.04 06:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2004.08.04 06:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2004.08.04 06:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2004.08.04 06:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2004.08.04 06:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2004.08.04 06:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004.08.04 06:00:00 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2004.08.04 06:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2004.08.04 06:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2004.03.23 16:38:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD.dll [2003.08.07 09:51:32 | 000,024,576 | -H-- | C] () -- C:\WINDOWS\System32\reboot.exe [2003.08.06 19:32:24 | 000,024,576 | -H-- | C] () -- C:\WINDOWS\System32\KCMDNIns.exe [2003.03.14 12:24:00 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\ZyDelReg.exe [2002.05.24 00:34:46 | 000,032,768 | ---- | C] () -- C:\WINDOWS\AMOVE.EXE [2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll [2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll [2001.08.26 03:04:08 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2001.08.26 03:02:42 | 000,004,524 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll [2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll [2007.10.17 18:47:33 | 000,000,000 | ---D | M] -- C:\Acer [2007.11.13 16:36:17 | 000,000,000 | -H-D | M] -- C:\BJPrinter [2011.05.26 09:17:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen [2007.07.11 01:23:26 | 000,000,000 | ---D | M] -- C:\dotnetfx [2007.07.11 01:27:48 | 000,000,000 | ---D | M] -- C:\drv [2007.07.11 01:27:39 | 000,000,000 | ---D | M] -- C:\GUIDE [2007.07.11 01:24:06 | 000,000,000 | ---D | M] -- C:\i386 [2011.10.21 17:20:21 | 000,000,000 | ---D | M] -- C:\ifap [2011.10.21 19:43:41 | 000,000,000 | R--D | M] -- C:\Programme [2011.05.26 12:35:07 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2007.12.13 19:25:57 | 000,000,000 | ---D | M] -- C:\SiS [2007.07.11 01:24:48 | 000,000,000 | ---D | M] -- C:\SYSINFO [2011.10.21 20:17:17 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.10.19 17:15:31 | 000,000,000 | ---D | M] -- C:\TurboMed [2007.07.11 01:24:49 | 000,000,000 | ---D | M] -- C:\VALUEADD [2011.10.21 20:09:55 | 000,000,000 | ---D | M] -- C:\WINDOWS [2009.12.07 09:24:35 | 000,000,000 | ---D | M] -- C:\zemo < %PROGRAMFILES%\*.exe > Invalid Environment Variable: LOCALAPPDATA < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > [1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < MD5 for: EXPLORER.EXE > [2004.08.04 06:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe < MD5 for: REGEDIT.EXE > [2004.08.04 06:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\i386\REGEDIT.EXE [2004.08.04 06:00:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=8193CE5FB09E83F2699FD65BBCBE2FD2 -- C:\WINDOWS\$NtServicePackUninstall$\regedit.exe [2008.04.14 07:53:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\regedit.exe [2008.04.14 07:53:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\ServicePackFiles\i386\regedit.exe < MD5 for: USERINIT.EXE > [2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008.04.14 07:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe [2004.08.04 06:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe < MD5 for: WINLOGON.EXE > [2004.08.04 06:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 07:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-07-15 12:49:42 < > < End of report > |
| Themen zu qtwebkit4.dll und virenbefall? |
| .dll, 0x00000001, acer, adobe, askbar, bho, c:\windows\system32\rundll32.exe, dateien, dllcache, einstellungen, error, explorer, format, homepage, logfile, microsoft, nicht sicher, pdf, plug-in, programm, realtek, registry, rundll, security, security update, software, stick, usb, windows media player, winlogon, winlogon.exe |
Baum-Darstellung