|
Log-Analyse und Auswertung: 2 Bluescreens hintereinanderWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
01.03.2009, 00:19 | #1 |
| 2 Bluescreens hintereinander Hi, ich hatte grade im Abstandt von ca. 5 Minuten 2 Bluescreens . Sie sind erschienen und waren nach ner Millisekunde wieder weg und mein Laptop is dann neu gestartet. Hier mein HijackThis logfile: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:12:41, on 01.03.2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\savedump.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Programme\ATKGFNEX\GFNEXSrv.exe h:\Programme\Lavasoft\Ad-Aware\AAWService.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe h:\Programme\CPUCooL\CooLSrv.exe C:\Programme\ICQ6Toolbar\ICQ Service.exe C:\Programme\Java\jre6\bin\jqs.exe C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Wireless Console 2\wcourier.exe C:\Programme\Atheros\ACU.exe C:\WINDOWS\RTHDCPL.EXE C:\Programme\ASUS\ATK Hotkey\MsgTranAgt.exe C:\Programme\ASUS\ATK Hotkey\HControlUser.exe C:\Programme\ASUS\ATK Hotkey\HControl.exe C:\Programme\ASUS\ATK Media\DMedia.exe C:\Programme\ATKOSD2\ATKOSD2.exe C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Programme\Synaptics\SynTP\SynTPEnh.exe C:\Programme\Java\jre6\bin\jusched.exe H:\Programme\Steganos Safe Home\SteganosHotKeyService.exe H:\Programme\Microsoft Office\Office12\GrooveMonitor.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe H:\Programme\Lavasoft\Ad-Aware\AAWTray.exe C:\Programme\ASUS\ATK Hotkey\ATKOSD.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\ASUS\ATK Hotkey\WDC.exe C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe C:\Programme\SpeedswitchXP\SpeedswitchXP.exe H:\Programme\Core Temp\Core Temp.exe H:\Programme\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe H:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h++p://start.icq.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h++p://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q= R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = h++p://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = h++p://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=%s R3 - URLSearchHook: (no name) - - (no file) R3 - URLSearchHook: (no name) - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - (no file) R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll R3 - URLSearchHook: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Programme\TorrentMan\tbTor1.dll O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - H:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll O2 - BHO: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Programme\TorrentMan\tbTor1.dll O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - h:\Programme\Megaupload\Mega Manager\MegaIEMn.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll O3 - Toolbar: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Programme\TorrentMan\tbTor1.dll O4 - HKLM\..\Run: [Wireless Console 2] "C:\Programme\Wireless Console 2\wcourier.exe" O4 - HKLM\..\Run: [ACU] C:\Programme\Atheros\ACU.exe -nogui O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [MsgTranAgt] C:\Programme\ASUS\ATK Hotkey\MsgTranAgt.exe O4 - HKLM\..\Run: [HControlUser] C:\Programme\ASUS\ATK Hotkey\HControlUser.exe O4 - HKLM\..\Run: [ATKHOTKEY] C:\Programme\ASUS\ATK Hotkey\HControl.exe O4 - HKLM\..\Run: [ATKMEDIA] C:\Programme\ASUS\ATK Media\DMedia.exe O4 - HKLM\..\Run: [ATKOSD2] "C:\Programme\ATKOSD2\ATKOSD2.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [SAFEHOME HotKeys] "h:\Programme\Steganos Safe Home\SteganosHotKeyService.exe" O4 - HKLM\..\Run: [GrooveMonitor] "H:\Programme\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [Ad-Watch] h:\Programme\Lavasoft\Ad-Aware\AAWTray.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Programme\Gemeinsame Dateien\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [SpeedswitchXP] C:\Programme\SpeedswitchXP\SpeedswitchXP.exe O4 - HKCU\..\Run: [Core Temp] "H:\Programme\Core Temp\Core Temp.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] h:\Programme\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\DOKUME~1\Computerbesitzer\LOKALE~1\Temp\E_SC.tmp" /EF "HKCU" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Verknüpfung mit Projekt1.lnk = H:\Dev-Cpp\Projekt1.exe O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - d:\Programme\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - d:\Programme\ICQ6.5\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - H:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O23 - Service: Atheros-Konfigurationsdienst (ACS) - Atheros - C:\WINDOWS\system32\acs.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: ATKGFNEX Service (ATKGFNEXSrv) - Unknown owner - C:\Programme\ATKGFNEX\GFNEXSrv.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - h:\Programme\CPUCooL\CooLSrv.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - D:\Programme\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - h:\Programme\Lavasoft\Ad-Aware\AAWService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - Unknown owner - d:\Programme\SiSoftware\SiSoftware Sandra Lite 2009.SP2\RpcAgentSrv.exe (file missing) -- End of file - 10387 bytes |
01.03.2009, 10:08 | #2 |
| 2 Bluescreens hintereinander Das mit HijackThis bitte fixen.
__________________R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h++p://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q= R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = h++p://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q= R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = h++p://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=%s R3 - URLSearchHook: (no name) - - (no file) |
01.03.2009, 10:34 | #3 | |
/// AVZ-Toolkit Guru | 2 Bluescreens hintereinander Halli hallo HipTheHop
__________________Um alle weiteren Hilfeleistungen zu erleichtern und deine Systemsicherheit zu erhöhen arbeite bitte folgendes gründlich ab:
Fixe danach bitte folgende Einträge mit HJT: Zitat:
Lade dir das Tool Avenger und speichere es auf dem Desktop
Code:
ATTFilter Folders to delete: C:\Programme\AskBarDis
Lies dir das hier mal durch: http://www.teralink.net/misc/ct_wind...10-110/art.htm
__________________ |
Themen zu 2 Bluescreens hintereinander |
5 minuten, ad-aware, ad-watch, antivir, antivirus, askbar, asus, avira, bho, bluescree, browser, explorer, firefox, hijack, hijackthis, hijackthis logfile, hkus\s-1-5-18, home, internet, internet explorer, logfile, magix, mozilla, neu, plug-in, programme, senden, software, system, temp, wieder weg, windows, windows xp |