Windows 7: ddlhost.exe zieht gesamten Arbeitsspeicher

Erichx

Hallo,

ich nutze Windows 7 auf einem Imac und habe seit einigen Tagen das Problem, dass die Arbeitsspeicherauslastung jedesmal wenige Minuten nach dem Hochfahren bei über 90% liegt. Der Task-Manager zeigt an, dass die Datei ddlhost.exe fast den gesamten RAM in Anspruch nimmt. Ich kann die Prozessstruktur beenden und dann, ohne das ich Einschränkungen merke, den Computer benutzen. Tue ich das nicht können die laufenden Programme nicht weiter ausgeführt werden und der Rechner stürzt ab.
Ich würde gerne wissen was da los ist und habe Angst, dass ich mir einen Trojaner eingefangen haben könnte. Die übliche Internetrecherche hat mir nicht weitergeholfen.

Die Zwischenspeicherungen von Miniaturansichten habe ich schon deaktiviert.
Im Anhang füge ich einen screenshot vom process explorer bei.

Ich habe die hier beschriebenen Schritte befolgt:

http://www.trojaner-board.de/139852-...-ram-win7.html
und hoffe ihr könnt mir weiterhelfen.



Hier die log. Daten, gemäß eurer Anleitung:


defogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:09 on 31/01/2014 (Erik)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-


FRST:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-01-2014 01
Ran by Erik (administrator) on ERIK-PC on 31-01-2014 18:12:50
Running from C:\Users\Erik\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Windows\System32\AppleOSSMgr.exe
(Apple Inc.) C:\Windows\System32\AppleTimeSrv.exe
(Apple Inc.) C:\Program Files\Boot Camp\Bootcamp.exe
(Dropbox, Inc.) C:\Users\Erik\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Smartbar) C:\Users\Erik\AppData\Local\Smartbar\Application\Smartbar.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Apple_KbdMgr] - C:\Program Files\Boot Camp\Bootcamp.exe [644920 2010-10-06] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKCU\...\Run: [Browser Infrastructure Helper] - C:\Users\Erik\AppData\Local\Smartbar\Application\Smartbar.exe [20760 2013-11-21] (Smartbar)
HKCU\...\Policies\Explorer: [NoThumbnailCache] 1
Startup: C:\Users\Erik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Erik\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b55dd269-4f73-bbec-1586-f9f2fde307ab&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=22/01/2014&type=hp1000
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b55dd269-4f73-bbec-1586-f9f2fde307ab&searchtype=hp&fr=linkury-tb&installDate=22/01/2014&type=hp1000
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b55dd269-4f73-bbec-1586-f9f2fde307ab&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=22/01/2014&type=hp1000
SearchScopes: HKLM - DefaultScope {A04F8E38-1F1D-4B10-96E2-789259D692E1} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM - {A04F8E38-1F1D-4B10-96E2-789259D692E1} URL = hxxp://www.sm.de/?q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b55dd269-4f73-bbec-1586-f9f2fde307ab&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=22/01/2014&type=hp1000
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b55dd269-4f73-bbec-1586-f9f2fde307ab&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=22/01/2014&type=hp1000
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b55dd269-4f73-bbec-1586-f9f2fde307ab&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=22/01/2014&type=hp1000
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b55dd269-4f73-bbec-1586-f9f2fde307ab&searchtype=ds&p={searchTerms}&fr=linkury-tb&installDate=22/01/2014&type=hp1000
SearchScopes: HKCU - {A04F8E38-1F1D-4B10-96E2-789259D692E1} URL = hxxp://www.sm.de/?q={searchTerms}
BHO: Yahoo Community Smartbar (by Linkury)Engine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO-x32: Yahoo Community Smartbar (by Linkury)Engine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\e8jc5zqo.default
FF DefaultSearchEngine: Web Search
FF SearchEngineOrder.1: SuchMaschine
FF SelectedSearchEngine: Web Search
FF Homepage: hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b55dd269-4f73-bbec-1586-f9f2fde307ab&searchtype=hp&fr=linkury-tb&installDate=22/01/2014&type=hp1000
FF Keyword.URL: hxxp://feed.helperbar.com/?publisher=YahooOC&dpid=YahooOC&co=DE&userid=b55dd269-4f73-bbec-1586-f9f2fde307ab&searchtype=ds&fr=linkury-tb&installDate=22/01/2014&type=hp1000&p=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\e8jc5zqo.default\searchplugins\search_engine.xml
FF SearchPlugin: C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\e8jc5zqo.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Users\Erik\AppData\Roaming\Mozilla\Firefox\Profiles\e8jc5zqo.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml


Addition:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-01-2014 01
Ran by Erik at 2014-01-31 18:13:30
Running from C:\Users\Erik\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Apple Software Update (x32 Version: 2.1.1.116 - Apple Inc.)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
AWIN NotenBox 7 (x32 Version: 7 - AWIN Software)
Boot Camp-Dienste (Version: 3.1.36 - Apple Inc.)
Digitale Schulbücher (x32 Version: 1.1.0.65 - VBM Service GmbH)
Dropbox (HKCU Version: 2.4.11 - Dropbox, Inc.)
English G Lighthouse 1 DFF digital (x32 Version: 1.0.59.0 - Cornelsen Verlag)
English G Lighthouse 2 DFF digital (x32 Version: 1.0.19.0 - Cornelsen Schulverlage)
Google+ Auto Backup (x32 Version: 1.0.21.81 - Google)
Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
LibreOffice 4.1 Help Pack (German) (x32 Version: 4.1.4.2 - The Document Foundation)
LibreOffice 4.1.4.2 (x32 Version: 4.1.4.2 - The Document Foundation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 24.2.0 - Mozilla)
Mozilla Thunderbird 24.2.0 (x86 de) (x32 Version: 24.2.0 - Mozilla)
myFuNe 2.0 (x32 Version: - Senatorin für Bildung in Bremen/Germany)
Picasa 3 (x32 Version: 3.9 - Google, Inc.)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5936 - Realtek Semiconductor Corp.)
VLC media player 2.1.2 (Version: 2.1.2 - VideoLAN)
Windows-Treiberpaket - Apple Inc. (AppleUSBEthernet) Net (01/11/2008 3.10.3.9) (Version: 01/11/2008 3.10.3.9 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Bluetooth (03/01/2010 3.0.0.5) (Version: 03/01/2010 3.0.0.5 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Bluetooth Enabler (06/27/2007 2.0.0.1) (Version: 06/27/2007 2.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Broadcom Bluetooth (03/01/2010 3.1.0.3) (Version: 03/01/2010 3.1.0.3 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Built-in iSight (10/25/2007 2.0.1.0) (Version: 10/25/2007 2.0.1.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Display (01/23/2009 3.0.0.0) (Version: 01/23/2009 3.0.0.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple IR Receiver (02/21/2008 2.0.4.0) (Version: 02/21/2008 2.0.4.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Keyboard (03/24/2010 3.1.0.3) (Version: 03/24/2010 3.1.0.3 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Multitouch (02/11/2010 3.1.0.0) (Version: 02/11/2010 3.1.0.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Multitouch Mouse (02/11/2010 3.1.0.0) (Version: 02/11/2010 3.1.0.0 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple ODD (01/17/2008 2.0.2.2) (Version: 01/17/2008 2.0.2.2 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Trackpad (07/13/2009 3.0.0.1) (Version: 07/13/2009 3.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Trackpad Enabler (07/13/2009 3.0.0.1) (Version: 07/13/2009 3.0.0.1 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Wireless Mouse (11/30/2009 3.0.0.6) (Version: 11/30/2009 3.0.0.6 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. Apple Wireless Trackpad (04/12/2010 3.1.0.5) (Version: 04/12/2010 3.1.0.5 - Apple Inc.)
Windows-Treiberpaket - Apple Inc. System (08/22/2008 2.1.1.1) (Version: 08/22/2008 2.1.1.1 - Apple Inc.)
Windows-Treiberpaket - Atheros Communications Inc. (athr) Net (11/18/2009 8.0.0.258) (Version: 11/18/2009 8.0.0.258 - Atheros Communications Inc.)
Windows-Treiberpaket - Broadcom (b57nd60a) Net (02/09/2010 14.0.0.7) (Version: 02/09/2010 14.0.0.7 - Broadcom)
Windows-Treiberpaket - Broadcom (BCM43XX) Net (08/21/2009 5.60.18.8) (Version: 08/21/2009 5.60.18.8 - Broadcom)
Windows-Treiberpaket - Cirrus Logic, Inc. (CirrusFilter) MEDIA (04/28/2010 6.6001.1.25) (Version: 04/28/2010 6.6001.1.25 - Cirrus Logic, Inc.)
Windows-Treiberpaket - Intel (e1express) Net (02/06/2008 9.12.17.0) (Version: 02/06/2008 9.12.17.0 - Intel)
Windows-Treiberpaket - Intel (E1G60) Net (01/08/2008 8.3.9.0) (Version: 01/08/2008 8.3.9.0 - Intel)
Windows-Treiberpaket - Intel (e1kexpress) Net (07/22/2008 10.3.45.0) (Version: 07/22/2008 10.3.45.0 - Intel)
Windows-Treiberpaket - Intel (e1qexpress) Net (08/05/2008 10.3.49.0) (Version: 08/05/2008 10.3.49.0 - Intel)
Windows-Treiberpaket - Intel (e1yexpress) Net (07/16/2008 9.52.10.0) (Version: 07/16/2008 9.52.10.0 - Intel)
Windows-Treiberpaket - Intel Net (02/06/2008 9.12.18.0) (Version: 02/06/2008 9.12.18.0 - Intel)
Windows-Treiberpaket - Intel Net (06/13/2008 9.52.9.0) (Version: 06/13/2008 9.52.9.0 - Intel)
Windows-Treiberpaket - Intel Net (07/22/2008 10.3.45.0) (Version: 07/22/2008 10.3.45.0 - Intel)
Windows-Treiberpaket - Intel Net (08/05/2008 10.3.49.0) (Version: 08/05/2008 10.3.49.0 - Intel)
Windows-Treiberpaket - Intel Net (11/07/2007 8.10.1.0) (Version: 11/07/2007 8.10.1.0 - Intel)
Windows-Treiberpaket - Intel System (07/20/2007 1.2.76.0) (Version: 07/20/2007 1.2.76.0 - Intel)
Windows-Treiberpaket - Marvell (yukonx64) Net (12/06/2007 10.51.1.3) (Version: 12/06/2007 10.51.1.3 - Marvell)
Yahoo Community Smartbar (x32 Version: 10.179.66.13636 - Linkury Inc.) <==== ATTENTION

==================== Restore Points =========================

11-01-2014 10:04:47 Geplanter Prüfpunkt
11-01-2014 12:00:35 Installiert Digitale Schulbücher
16-01-2014 02:00:24 Windows Update
16-01-2014 18:34:34 Installed Java 7 Update 51
26-01-2014 12:16:12 TuneUp Utilities 2014 wird entfernt
26-01-2014 12:17:32 TuneUp Utilities 2014 (de-DE) wird entfernt
26-01-2014 15:39:56 Windows Update
30-01-2014 13:34:31 Windows Update
31-01-2014 13:38:01 RegClean Pro Fr, Jan 31, 14 14:37




GMER Logfile:
--- --- ---

Angehängte Grafiken

process2.jpg (118,1 KB, 168x aufgerufen)