![]() |
|
Log-Analyse und Auswertung: pc läuft nicht mehr richtig, friert ein, booted auch schon mal selbst .logfileWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
![]() ![]() | ![]() pc läuft nicht mehr richtig, friert ein, booted auch schon mal selbst .logfile Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:52:55, on 15.04.2010 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Code:
ATTFilter Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\Programme\Webroot\Spy Sweeper\WRConsumerService.exe C:\windows\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\WINDOWS\Explorer.EXE C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\Programme\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\crypserv.exe C:\Programme\Avira\AntiVir Desktop\avshadow.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe C:\Programme\Java\jre6\bin\jqs.exe C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\Programme\SlySoft\AnyDVD\AnyDVD.exe C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Programme\Norton Internet Security\Engine\17.6.0.32\ccSvcHst.exe C:\Programme\Ashampoo\Ashampoo HDD Control\HDDCONTROLGUARD.EXE C:\Programme\DivX\DivX Update\DivXUpdate.exe C:\Programme\Webroot\Spy Sweeper\SpySweeperUI.exe C:\Programme\CDBurnerXP\NMSAccessU.exe C:\Programme\Spyware Terminator\sp_rsser.exe C:\WINDOWS\system32\svchost.exe C:\Programme\AWS\WeatherBug\Weather.exe C:\WINDOWS\System32\TUProgSt.exe C:\Programme\Veoh Networks\VeohWebPlayer\veohwebplayer.exe C:\Programme\NVIDIA Corporation\System Update\UpdateCenterService.exe C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe C:\Programme\DAEMON Tools Lite\daemon.exe C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Programme\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\Programme\Norton Internet Security\Engine\17.6.0.32\ccSvcHst.exe C:\WINDOWS\system32\dllhost.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Trend Micro\HijackThis\****.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ***/www.imdb.com/name/nm0000015/board R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = ***//go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =***://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =***//go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: (no name) - {48405d3d-2674-4cd8-b1ef-9a719443bd3f} - (no file) R3 - URLSearchHook: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\tbVuze.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Programme\Norton Internet Security\Engine\17.6.0.32\coIEPlg.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Programme\Norton Internet Security\Engine\17.6.0.32\IPSBHO.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll O2 - BHO: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\tbVuze.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Programme\Free Download Manager\iefdm2.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll O3 - Toolbar: (no name) - {48405d3d-2674-4cd8-b1ef-9a719443bd3f} - (no file) O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Programme\Norton Internet Security\Engine\17.6.0.32\coIEPlg.dll O3 - Toolbar: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Programme\Vuze_Remote\tbVuze.dll O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [ISUSScheduler] "C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [amd_dc_opt] "C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [AnyDVD] "C:\Programme\SlySoft\AnyDVD\AnyDVD.exe" O4 - HKLM\..\Run: [NokiaMServer] "C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer" /watchfiles startup O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [KernelFaultCheck] "%systemroot%\system32\dumprep" 0 -k O4 - HKLM\..\Run: [Ashampoo HDD Control Guard] "C:\Programme\Ashampoo\Ashampoo HDD Control\HDDCONTROLGUARD.EXE" O4 - HKLM\..\Run: [DivXUpdate] "C:\Programme\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW O4 - HKLM\..\Run: [SpySweeper] "C:\Programme\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [Weather] "C:\Programme\AWS\WeatherBug\Weather.exe" 1 O4 - HKCU\..\Run: [VeohPlugin] "C:\Programme\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programme\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [swg] "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Add to Google Photos Screensa&ver - ***:\WINDOWS\system32\GPhotos.scr/200 O8 - Extra context menu item: Alles mit FDM herunterladen - file:***Programme\Free Download Manager\dlall.htm O8 - Extra context menu item: Google Sidewiki... - r***ogramme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\WINDOWS\system32\shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} - **www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - hxxp://***nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - ***/support.f-secure.com/ols/fscax.cab O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - ***/icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Unknown owner - C:\Programme\a-squared Anti-Malware\a2service.exe (file missing) O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Unknown owner - C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe (file missing) O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: Defragmentation-Service (DfSdkS) - mst software GmbH, Germany - C:\Programme\Ashampoo\Ashampoo HDD Control\Dfsdks.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Programme\Norton Internet Security\Engine\17.6.0.32\ccSvcHst.exe O23 - Service: NMSAccessU - Unknown owner - C:\Programme\CDBurnerXP\NMSAccessU.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia - C:\Programme\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Programme\Spyware Terminator\sp_rsser.exe O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe O23 - Service: Update Center Service (UpdateCenterService) - NVIDIA - C:\Programme\NVIDIA Corporation\System Update\UpdateCenterService.exe O23 - Service: Webroot Spy Sweeper-Engine (WebrootSpySweeperService) - Webroot Software, Inc. (***webroot.com) - C:\Programme\Webroot\Spy Sweeper\SpySweeper.exe O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Programme\Webroot\Spy Sweeper\WRConsumerService.exe O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Programme\Yahoo!\SoftwareUpdate\YahooAUService.exe O24 - Desktop Component 0: (no name) - /www.jamesdean.com/images/photos/torn/pics/jdrs2a3.jpg O24 - Desktop Component 1: (no name) - /www.jamesdean.com/images/photos/torn/pics/jdrs2a1.jpg O24 - Desktop Component 10: (no name) - /i5.ebayimg.com/03/i/001/42/50/dc1c_12.JPG O24 - Desktop Component 11: (no name) - /www.jamesdean.com/images/photos/misc/pics/jd6.jpg O24 - Desktop Component 12: (no name) - ://www.jamesdean.com/images/photos/giant/pics/jd52.jpg O24 - Desktop Component 13: (no name) - ://www.jamesdean.com/images/photos/torn/pics/jdrs1a2.jpg O24 - Desktop Component 14: (no name) - //www.jamesdean.com/images/photos/car/pics/jd34.jpg O24 - Desktop Component 15: (no name) - //www.jamesdean.com/images/photos/misc/pics/jd59.jpg O24 - Desktop Component 16: (no name) - ://www.johngilmore.com/Celebrities/images/dean.strip7.jpg O24 - Desktop Component 17: (no name) - //www.photographersgallery.com/i/full/dean.jpg O24 - Desktop Component 18: (no name) - ://img384.imageshack.us/img384/4869/cambilder026g.jpg O24 - Desktop Component 19: (no name) - //www.oyla9.de/userdaten/581/03890/bilder/jimdeanpierh.jpg O24 - Desktop Component 2: (no name) - //pierangeli.altervista.org/upload/content/Various/WithJamesDean/jimdeanpie.jpg O24 - Desktop Component 3: (no name) - //i5.ebayimg.com/01/i/001/11/1b/8f87_1.JPG O24 - Desktop Component 4: (no name) - ://img194.imageshack.us/img194/6923/cambilder1064.jpg O24 - Desktop Component 5: (no name) - /www.oyla9.de/userdaten/58103890/bilder/jimdeanpierh.jpg O24 - Desktop Component 6: (no name) - ://www.jamesdean.com/images/photos/torn/pics/jdrs1c1.jpg O24 - Desktop Component 7: (no name) - //www.jamesdean.com/images/photos/giant/pics/jd51.jpg O24 - Desktop Component 8: (no name) - h//www.jamesdean.com/images/photos/misc/pics/jd56.jpg O24 - Desktop Component 9: (no name) - //www.johngilmore.com/Celebrities/images/dean.strip6.jpg -- End of file - 13649 bytes Geändert von jimmysgirl (15.04.2010 um 12:57 Uhr) |
Themen zu pc läuft nicht mehr richtig, friert ein, booted auch schon mal selbst .logfile |
antivir, antivir guard, avira, avp, avp.exe, bho, bonjour, cdburnerxp, cs3, desktop, explorer, firefox, free download, google, gupdate, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, intrusion prevention, kaspersky, logfile, mozilla, pc läuft, plug-in, rundll, security, spyware, spyware terminator, symantec, system, webroot, windows, windows xp |