| Meisterzunge | 22.05.2010 12:49 |
svchost.exe stürzt ab
Hi,
meine svchost.exe stürzt seit einer Weile öfter mal ab. Wann genau und woran es liegt kann ich nicht sagen - es kommt mir sehr willkürlich vor!
Wenn das Programm abgestürzt ist funktioniert auf jeden Fall mein Netzwerk nicht mehr.
Hier der Hijack This Log: Zitat:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:43:57, on 22.05.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
G:\Nero Burning Rom 7\InCD\InCDsrv.exe
D:\WINDOWS\system32\Ati2evxx.exe
g:\Steganos Internet Security 12\avgchsvx.exe
g:\Steganos Internet Security 12\avgrsx.exe
g:\Steganos Internet Security 12\avgcsrvx.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\LEXPPS.EXE
D:\WINDOWS\Explorer.EXE
D:\Programme\Lexmark X1100 Series\lxbkbmgr.exe
G:\UltraMon\UltraMon.exe
D:\Programme\Logitech\GamePanel Software\LgDevAgt.exe
D:\Programme\Logitech\GamePanel Software\G-series Software\LGDCore.exe
D:\Programme\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
D:\Programme\Lexmark X1100 Series\lxbkbmon.exe
G:\My Remote Tool\My Remote Tool 2.exe
D:\WINDOWS\system32\rundll32.exe
G:\iTunes\iTunesHelper.exe
G:\UltraMon\UltraMonTaskbar.exe
G:\STEGAN~1\avgtray.exe
G:\Babylon\Babylon.exe
D:\Programme\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
G:\G6 FTP Server\G6FTPTray.exe
G:\Rightmark RMClock Utility 2.35\RMClock.exe
G:\AltDesk\AltDesk.exe
G:\DAEMON Tools\daemon.exe
D:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\WINDOWS\system32\ctfmon.exe
G:\MICROS~4\wcescomm.exe
G:\MICROS~4\rapimgr.exe
G:\GetRight 5.2d\getright.exe
G:\GetRight 5.2d\getright.exe
D:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
D:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe
g:\STEGAN~1\avgwdsvc.exe
g:\Steganos Internet Security 12\avgwdsvc.exe
g:\Steganos Internet Security 12\avgfws9.exe
g:\Steganos Internet Security 12\avgam.exe
D:\Programme\Bonjour\mDNSResponder.exe
g:\Steganos Internet Security 12\avgnsx.exe
g:\G6 FTP Server\G6FTPSERVER.EXE
D:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
G:\3D Studio Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
g:\CDBurner XP\NMSAccessU.exe
D:\WINDOWS\system32\oodag.exe
g:\OpenVPN\bin\openvpnserv.exe
g:\OpenVPN\bin\openvpn.exe
D:\WINDOWS\system32\PnkBstrA.exe
D:\WINDOWS\system32\PnkBstrB.exe
D:\Programme\Cyberlink\Shared files\RichVideo.exe
D:\WINDOWS\system32\tcpsvcs.exe
D:\WINDOWS\System32\snmp.exe
D:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\vmnat.exe
g:\VNC\WinVNC4.exe
G:\VMware Workstation\vmware-authd.exe
D:\WINDOWS\system32\vmnetdhcp.exe
D:\Programme\iPod\bin\iPodService.exe
G:\LaunchExpress\LExpress.exe
J:\Daten CDs\HijackThis\Setup 2.0.4.exe
g:\Steganos Internet Security 12\avgcsrvx.exe
D:\WINDOWS\system32\NOTEPAD.EXE
G:\Firefox\firefox.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hxxp://www.web.de/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - G:\Adobe CS3 Master Collection\/Adobe Contribute CS3/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - G:\GetRight 5.2d\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Java RE 6.0\bin\ssv.dll
O2 - BHO: Babylon IE plugin - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - g:\Babylon\Utils\BabylonIEPI.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\programme\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Programme\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\programme\google\googletoolbar1.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - G:\Adobe CS3 Master Collection\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [Lexmark X1100 Series] "D:\Programme\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [UltraMon] "G:\UltraMon\UltraMon.exe" /auto
O4 - HKLM\..\Run: [Launch LgDevAgt] "D:\Programme\Logitech\GamePanel Software\LgDevAgt.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "D:\Programme\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "D:\Programme\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [MRT2] G:\My Remote Tool\My Remote Tool 2.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\Adobe Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "G:\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] D:\PROGRA~1\GEMEIN~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [AVG9_TRAY] g:\STEGAN~1\avgtray.exe
O4 - HKLM\..\Run: [Babylon Client] g:\Babylon\Babylon.exe -AutoStart
O4 - HKCU\..\Run: [LaunchExpress] G:\LaunchExpress\LExpress.exe
O4 - HKCU\..\Run: [RMClock] "G:\Rightmark RMClock Utility 2.35\RMClockLauncher.exe"
O4 - HKCU\..\Run: [G6FTP Server Tray Monitor] "g:\G6 FTP Server\G6FTPTray.exe"
O4 - HKCU\..\Run: [AltDesk] G:\AltDesk\AltDesk.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "G:\DAEMON Tools\daemon.exe" -autorun
O4 - HKCU\..\Run: [KillCopy] "D:\WINDOWS\system32\killcopy.exe" /kcresume /startup
O4 - HKCU\..\Run: [swg] "D:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "G:\MICROS~4\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: GetRight - Tray Icon.lnk = G:\GetRight 5.2d\getright.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://g:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Hinzufügen zu Kaspersky Anti-Banner - G:\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Translate this web page with Babylon - res://G:\Babylon\Utils\BabylonIEPI.dll/ActionTU.htm
O8 - Extra context menu item: Translate with Babylon - res://G:\Babylon\Utils\BabylonIEPI.dll/Action.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Java RE 6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Java RE 6.0\bin\ssv.dll
O9 - Extra button: Statistik für Web-Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - G:\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - G:\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - G:\MICROS~4\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - g:\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - G:\Babylon\Utils\BabylonIEPI.dll
O9 - Extra 'Tools' menuitem: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - G:\Babylon\Utils\BabylonIEPI.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\windows\system32\nwprovau.dll
O10 - Unknown file in Winsock LSP: g:\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: g:\vmware workstation\vsocklib.dll
O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - file://K:\Microsoft - Tools\Platform SDK\controls\sdkinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{21A63783-6B23-405E-8891-ADFBB1E7D6C2}: NameServer = 192.168.0.1
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - D:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - D:\WINDOWS\system32\browseui.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - D:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe Version Cue CS3 {de_DE} (Adobe Version Cue CS3) - Adobe Systems Incorporated - D:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - D:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Steganos I.S. E-mail Scanner (avg8emc) - Unknown owner - g:\STEGAN~1\avgemc.exe (file missing)
O23 - Service: Steganos I.S. WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - g:\STEGAN~1\avgwdsvc.exe
O23 - Service: Steganos I.S.12 WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - g:\Steganos Internet Security 12\avgwdsvc.exe
O23 - Service: Steganos I.S. Firewall (avgfws8) - Unknown owner - g:\STEGAN~1\avgfws8.exe (file missing)
O23 - Service: Steganos I.S.12 Firewall (avgfws9) - AVG Technologies CZ, s.r.o. - g:\Steganos Internet Security 12\avgfws9.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - D:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - D:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Gene6 FTP Server (G6FTPServer) - Gene6 - g:\G6 FTP Server\G6FTPSERVER.EXE
O23 - Service: Google Updater Service (gusvc) - Google - D:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - G:\Nero Burning Rom 7\InCD\InCDsrv.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - D:\Programme\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - D:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2009 32-bit 32-bit (mi-raysat_3dsMax2009_32) - Unknown owner - G:\3D Studio Max 2009\mentalray\satellite\raysat_3dsMax2009_32server.exe
O23 - Service: NMSAccessU - Unknown owner - g:\CDBurner XP\NMSAccessU.exe
O23 - Service: O&O Defrag - O&O Software GmbH - D:\WINDOWS\system32\oodag.exe
O23 - Service: OpenVPN Service (OpenVPNService) - Unknown owner - g:\OpenVPN\bin\openvpnserv.exe
O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - D:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - D:\Programme\Cyberlink\Shared files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - D:\Programme\WinPcap\rpcapd.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - G:\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - G:\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - D:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - D:\WINDOWS\system32\vmnat.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - g:\VNC\WinVNC4.exe
--
End of file - 13075 bytes
| MyRemoteTool und LExpress sind auf jeden Fall sichere Programme, daran liegt es nicht. Schein alles ok zu sein laut Log!?
Gruß,
Marco | 