Virus, Trojaner oder defektes Betriebssystem?

Fudi

Hallo,

ich habe seit ein paar Tagen ein großes Problem.


Seit ich einen neuen DSL-Router (FRITZ!BOX Phone WLAN 7050) über einen Switch angestöpselt habe, und danach noch das Programm CFOS deinstalliert habe kann ich keine Office 2000 Anwendungen und Photoshop 6.0 mehr starten.

System: WIN2000

Meldung:
Programmfehler

photoshop.exe hat einen Fehler verusacht. Das Programm wird
geschlossen. Starten Sie die Anwendung neu.


Was ich bisher versucht habe:

escan -> nichts gefunden
gegoogelt -> nichts gefunden
chkdsk -> Fehler gefunden und behoben
hijackthis -> ich denk das passt alles


Ich hoffe Ihr könnt mir helfen, vielen Dank schon mal.

Gruß Fudi

hier nun zwei log-Files zum einen die von HijackThis und von DrWatson.

Logfile of HijackThis v1.99.1
Scan saved at 15:20:09, on 26.07.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
D:\F-Prot\fpavupdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\Tablet.exe
C:\WINNT\system32\TSSsvc.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\RunDll32.exe
C:\WINNT\htpatch.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\QuickTime\qttask.exe
D:\F-Prot\F-Sched.exe
D:\F-Prot\F-StopW.EXE
C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\WINNT\system32\WTablet\TabUserW.exe
C:\Programme\iPod\bin\iPodService.exe
C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE
C:\WINNT\system32\taskmgr.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Install File\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Acrobat\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Programme\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FRISK FP-Scheduler] D:\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] D:\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: TabUserW.exe.lnk = C:\WINNT\system32\WTablet\TabUserW.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/099dddd4...dxIE601_de.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2C4C44E2-AC62-4189-9DCB-43D38408704A}: NameServer = 192.168.120.252,192.168.120.253
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: AVM FRITZ!web Routing Service (de_serv) - AVM Berlin - D:\ISDN\de_serv.exe
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - D:\F-Prot\fpavupdm.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINNT\system32\Tablet.exe
O23 - Service: TSStalk Windows 2000 Service (TSSsvc) - Thursby Software Systems, Inc. - C:\WINNT\system32\TSSsvc.EXE



DRWTSN32.LOG



Anwendungsausnahme aufgetreten:
Anwendung: (pid=364)
Wann: 26.07.2005 @ 14:41:30.062
Ausnahmenummer: c0000005 (Zugriffsverletzung)

*----> Systeminformationen <----*
Computername: BENNY
Benutzername: Benny
Prozessoranzahl: 1
Prozessortyp: x86 Family 6 Model 10 Stepping 0
Windows 2000-Version: 5.0
Aktuelles Build: 2195
Service Pack: 4
Aktueller Typ: Uniprocessor Free
Firma:
Besitzer: Benny

*----> Taskliste <----*
0 Idle.exe
8 System.exe
144 smss.exe
172 csrss.exe
192 winlogon.exe
220 services.exe
232 lsass.exe
412 svchost.exe
440 SPOOLSV.exe
468 ati2evxx.exe
500 svchost.exe
520 fpavupdm.exe
564 regsvc.exe
604 mstask.exe
640 Tablet.exe
728 tsssvc.exe
776 winmgmt.exe
788 svchost.exe
972 explorer.exe
1032 rundll32.exe
1056 htpatch.exe
1012 atiptaxx.exe
1100 iTunesHelper.ex.exe
1112 qttask.exe
1120 F-Sched.exe
1136 F-StopW.exe
1160 jusched.exe
1172 DATALA~1.exe
1180 TRAYAP~1.exe
1188 realsched.exe
1196 TabUserW.exe
1296 iPodService.exe
1356 SERVIC~1.exe
364 Photoshp.exe
1548 taskmgr.exe
288 drwtsn32.exe
0 _Total.exe

(00400000 - 011BF000)
(77880000 - 77901000)
(77E70000 - 77F36000)
(79350000 - 793B2000)
(77D20000 - 77D91000)
(77E00000 - 77E65000)
(77F40000 - 77F7C000)
(76B00000 - 76B3F000)
(70A70000 - 70AD4000)
(78000000 - 78045000)
(71710000 - 71794000)
(77580000 - 777CE000)
(10000000 - 10133000)
(00230000 - 0037F000)
(77A40000 - 77B37000)
(77540000 - 77571000)
(750E0000 - 7512F000)
(79430000 - 7943F000)
(75130000 - 75136000)
(750C0000 - 750CF000)
(74FA0000 - 74FB4000)
(74F90000 - 74F98000)
(77940000 - 7796B000)
(77970000 - 77994000)
(74FC0000 - 74FC9000)
(00380000 - 003A5000)
(011C0000 - 01229000)
(77810000 - 77817000)
(75940000 - 75946000)
(779A0000 - 77A3B000)
(671B0000 - 671BD000)
(78310000 - 783A1000)
(791A0000 - 79203000)
(02AA0000 - 02C84000)
(02C90000 - 02F09000)
(02F10000 - 02F20000)
(777F0000 - 7780E000)
(782F0000 - 78301000)
(60600000 - 60644000)

Statusabbild für Threadkennung 0x604

eax=00000844 ebx=00000000 ecx=00000211 edx=00000000 esi=00000000 edi=00161328
eip=6061fdc3 esp=0012eb2c ebp=0012eb34 iopl=0 nv up ei pl nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000216


Funktion: DrvConvertDevMode
6061fda4 3bfe cmp edi,esi
6061fda6 7608 jbe DrvConvertDevMode+0x80c4 (606238b0)
6061fda8 3bf8 cmp edi,eax
6061fdaa 0f8278010000 jb DrvConvertDevMode+0x473c (6061ff28)
6061fdb0 f7c703000000 test edi,0x3
6061fdb6 7514 jnz DrvDocumentEvent+0xef1 (6062becc)
6061fdb8 c1e902 shr ecx,0x2
6061fdbb 83e203 and edx,0x3
6061fdbe 83f908 cmp ecx,0x8
6061fdc1 7229 jb 6062f0ec
FEHLER ->6061fdc3 f3a5 rep movsd ds:00000000=???????? es:00161328=00000000
6061fdc5 ff2495d8fe6160 ds:00000000=????????
jmp dword ptr [DrvConvertDevMode+0x46ec (6061fed8)+edx*4]
6061fdcc 8bc7 mov eax,edi
6061fdce ba03000000 mov edx,0x3
6061fdd3 83e904 sub ecx,0x4
6061fdd6 720c jb DrvConvertDevMode+0xc8f8 (606280e4)
6061fdd8 83e003 and eax,0x3
6061fddb 03c8 add ecx,eax
6061fddd ff2485f0fd6160 ds:00000844=????????
jmp dword ptr [DrvConvertDevMode+0x4604 (6061fdf0)+eax*4]
6061fde4 ff248de8fe6160 ds:00000211=????????
jmp dword ptr [DrvConvertDevMode+0x46fc (6061fee8)+ecx*4]
6061fdeb 90 nop
6061fdec ff248d6cfe6160 ds:00000211=????????
jmp dword ptr [DrvConvertDevMode+0x4680 (6061fe6c)+ecx*4]

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0012EB34 6062A627 00161328 00000000 00000844 00000000 !DrvConvertDevMode
0012ED64 6062A277 03033538 60600000 0012EDAC FFFFFFFF !DrvAdvancedDocumentProperties
0012EDD0 76B02E3C 00000000 00135104 0015F9F2 00161328 !DrvDocumentPropertySheets
0012EDFC 76B02D9A 00000000 00135104 0015F9F2 00000000 comdlg32!PrintDlgA
0012F680 0015B5B0 00000000 00000000 00000000 00000000 comdlg32!PrintDlgA
00000000 00000000 00000000 00000000 00000000 00000000 <nosymbols>

*----> Raw Stack Dump <----*
0012eb2c ac ed 12 00 00 00 00 00 - 64 ed 12 00 27 a6 62 60 ........d...'.b`
0012eb3c 28 13 16 00 00 00 00 00 - 44 08 00 00 00 00 00 00 (.......D.......
0012eb4c ac ed 12 00 ac ed 12 00 - 00 00 00 00 00 00 00 00 ................
0012eb5c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012eb6c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012eb7c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012eb8c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012eb9c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012ebac 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012ebbc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012ebcc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0012ebdc 00 00 00 00 43 00 3a 00 - 5c 00 57 00 49 00 4e 00 ....C.:.\.W.I.N.
0012ebec 4e 00 54 00 5c 00 73 00 - 79 00 73 00 74 00 65 00 N.T.\.s.y.s.t.e.
0012ebfc 6d 00 33 00 32 00 5c 00 - 73 00 70 00 e8 85 63 60 m.3.2.\.s.p...c`
0012ec0c 60 85 63 60 00 00 00 00 - 06 00 00 00 64 ec 12 00 `.c`........d...
0012ec1c d2 88 88 77 d2 ec 12 00 - 0c 00 00 00 00 00 60 60 ...w..........``
0012ec2c b8 85 63 60 e8 85 63 60 - d0 ec 12 00 01 00 00 00 ..c`..c`........
0012ec3c 00 00 00 00 f8 00 60 60 - 34 ec 12 00 cc ec 12 00 ......``4.......
0012ec4c 28 ed 12 00 01 00 00 00 - 74 ec 12 00 74 22 89 77 (.......t...t".w
0012ec5c 00 00 60 60 00 00 00 00 - 38 ed 12 00 85 2c 89 77 ..``....8....,.w

Statusabbild für Threadkennung 0x2f0

eax=00acd290 ebx=00000000 ecx=0001004f edx=00000000 esi=77894086 edi=000000a8
eip=77894091 esp=0302ff58 ebp=0302ff7c iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246


Funktion: ZwWaitForSingleObject
77894086 b8ea000000 mov eax,0xea
7789408b 8d542404 lea edx,[esp+0x4] ss:03ab9e3f=????????
7789408f cd2e int 2e
77894091 c20c00 ret 0xc
77894094 8a5001 mov dl,[eax+0x1] ds:01557176=??
77894097 3a5101 cmp dl,[ecx+0x1] ds:00a99f35=c0
7789409a 0f8598c7ffff jne RtlEqualPrefixSid+0x44 (77890838)
778940a0 84d2 test dl,dl
778940a2 7410 jz RtlQueryAtomInAtomTable+0x31 (77894fb4)
778940a4 0fb6d2 movzx edx,dl
778940a7 33ff xor edi,edi
778940a9 8d72ff lea esi,[edx+0xff] ds:00a89ee6=027c249c
778940ac 85f6 test esi,esi
778940ae 0f8f04100100 jnle RtlEraseUnicodeString+0x4e (778a50b8)
778940b4 b001 mov al,0x1

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0302FF7C 77E81B1B 000000A8 FFFFFFFF 00000000 00ACD11B ntdll!ZwWaitForSingleObject
0302FFEC 00000000 00ACD290 00000000 00000000 000000C8 kernel32!WaitForSingleObject

*----> Raw Stack Dump <----*
0302ff58 c2 c4 e8 77 a8 00 00 00 - 00 00 00 00 00 00 00 00 ...w............
0302ff68 0c 1b e8 77 02 00 00 00 - 00 00 00 00 01 01 00 00 ...w............
0302ff78 01 01 00 00 ec ff 02 03 - 1b 1b e8 77 a8 00 00 00 ...........w....
0302ff88 ff ff ff ff 00 00 00 00 - 1b d1 ac 00 a8 00 00 00 ................
0302ff98 ff ff ff ff 00 00 00 00 - 01 00 00 00 a4 d2 ac 00 ................
0302ffa8 b4 ff 02 03 02 00 00 00 - bc f8 12 00 00 00 00 00 ................
0302ffb8 7c 98 e7 77 00 00 00 00 - bc f8 12 00 01 00 00 00 |..w............
0302ffc8 00 00 00 00 00 d0 fd 7f - 4f 00 01 00 c0 ff 02 03 ........O.......
0302ffd8 4f 00 01 00 ff ff ff ff - b4 f0 e8 77 60 d3 e7 77 O..........w`..w
0302ffe8 00 00 00 00 00 00 00 00 - 00 00 00 00 90 d2 ac 00 ................
0302fff8 00 00 00 00 00 00 00 00 - c8 00 00 00 00 01 00 00 ................
03030008 ff ee ff ee 02 10 00 00 - 00 00 00 00 00 fe 00 00 ................
03030018 00 00 10 00 00 20 00 00 - 00 02 00 00 00 20 00 00 ..... ....... ..
03030028 57 01 00 00 ff ef fd 7f - 0e 00 08 06 00 00 00 00 W...............
03030038 00 00 00 00 00 00 00 00 - 00 00 00 00 98 05 03 03 ................
03030048 0f 00 00 00 f8 ff ff ff - 50 00 03 03 50 00 03 03 ........P...P...
03030058 40 06 03 03 00 00 00 00 - 00 00 00 00 00 00 00 00 @...............
03030068 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
03030078 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
03030088 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................