Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Sehr hohe CPU Auslastung aufgrund von svchost.exe (https://www.trojaner-board.de/158459-sehr-hohe-cpu-auslastung-aufgrund-svchost-exe.html)

schrauber 25.09.2014 07:49
ProcessExplorer als Ersatz für den Windows Taskmanager installieren

Lade Dir den Process Explorer als Ersatz für den Taskmanager herunter und installiere ihn, hier findest Du eine Anleitung. Das ist ein wesentlich leistungsfähigerer Ersatz für den Windows-Taskmanager. Im Menü unter "Options" kannst Du den ProcessExplorer dauerhaft als Ersatz für den Taskmanager einrichten (Replace Taskmanager). Das ist sehr empfehlenswert, weil der ProcessExplorer erheblich mehr Funktionen als der Taskmanager hat. Wenn Du diese Einstellung gemacht hast, öffnet sich mit der Tastenkombination STRG + ALT + Entf. nicht mehr der Taskmanager, sondern der ProcessExplorer. Das kann jederzeit durch Abhaken dieser Einstellung wieder rückgängig gemacht werden.

Was wir jetzt konkret brauchen: In jeder Zeile steht ein Prozess, ein paar der Zeilen sind keine richtigen Prozesse, sondern nur Pseudoprozesse für die Tätigkeit des Windos-Kernels. Im Menü View => Select Columns wird ein Dialog geöffnet, in dem Du auswählen kannst, welche Spalten mit Informationen zu den Prozessen angezeigt werden sollen. In dem gehe in das Register "Process Performance" und stelle sicher, dass dort "CPU Usage" angehakt ist, "CPU History" wäre ebenfalls sinnvoll. Unter "CPU Usage" wird der aktuelle Wert der Prozessorauslastung für jeden Prozess angezeigt (im Tabellentitel steht nur kurz "CPU"), "CPU History" blendet für jeden Prozess ein Diagramm ein, das eine Kurve mit der Prozessorauslastung für die letzte Zeit anzeigt.

Damit sollte es Dir möglich sein, zu identifizieren, welcher Prozess Deine CPU in Trab hält. Mache einen Doppelklick auf den Prozess. Du kannst von dem ganzen auch einen Screenshot machen und ihn als Anhang mit Deiner Antwort hochladen (auf "Erweitert" unter dem Textfeld klicken und über "Anhänge verwalten" auf Deinem Rechner suchen lassen und über "Hochladen" anhängen).

Lavazzaa 25.09.2014 12:49
Liste der Anhänge anzeigen (Anzahl: 1)
Vielen Dank für ihre Bemühungen. :)

schrauber 25.09.2014 19:06
Aaargh, nicht siezen :D

Geht der Sceen bissl größer? Ich erkenne da unter rundll nen wlaninventory(????) oder so mit knapp 18%, der würde mich näher intressieren. Da auch bitte mal Rechtsklick > Details und davon auch nen Screenshot.

Lavazzaa 25.09.2014 20:14
Liste der Anhänge anzeigen (Anzahl: 1)
Ich würde dir diesen Gefallen mit diesem bestimmten Prozess gerne erfüllen, jedoch ist weder der rundll Prozess noch der andere aufzufinden...

Lavazzaa 26.09.2014 13:59
Liste der Anhänge anzeigen (Anzahl: 4)
Jetzt war er wieder da, ich weiß nicht wieso aber bitteschön.

schrauber 26.09.2014 16:14
Systemsteuerung > Programme und Funktionen > Installierte Programme anzeigen lassen, jetzt auch installierte Windows Updates anzeigen lassen.

Ist KB2952664 installiert?

Lavazzaa 26.09.2014 20:22
Nein

schrauber 27.09.2014 19:15
Sehr komisch.

Frisches FRST Log bitte.

Lavazzaa 28.09.2014 10:07

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2014
Ran by Tim (administrator) on TIM-PC on 28-09-2014 11:02:33
Running from C:\Users\Tim\Desktop
Loaded Profile: Tim (Available profiles: Tim)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(TeamSpeak Systems GmbH) C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\CompatTel\wicainventory.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NUSB3MON] => C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKU\S-1-5-21-3986868162-2867927163-642453104-1000\...\Run: [HydraVisionDesktopManager] => C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-11-01] (AMD)
IFEO\taskmgr.exe: [Debugger] "C:\USERS\TIM\APPDATA\LOCAL\TEMP\RAR$EXA0.357\PROCEXP.EXE"
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x78A3EE000C3BCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\h5gkgok8.default
FF SearchEngineOrder.2: Google
FF SelectedSearchEngine: Google
FF Homepage: about:home
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Tim\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Ghostery - C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\h5gkgok8.default\Extensions\firefox@ghostery.com.xpi [2014-06-18]
FF Extension: Adblock Plus - C:\Users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\h5gkgok8.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-18]

Chrome:
=======
CHR Profile: C:\Users\Tim\AppData\Local\Google\Chrome\User Data\Default
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx []
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-11-01] (Advanced Micro Devices, Inc.) [File not signed]
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-08-08] (LogMeIn, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-05-31] ()
R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [343040 2013-08-08] (Qualcomm Atheros) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-20] (Advanced Micro Devices)
R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [67888 2013-02-13] (Qualcomm Atheros, Inc.)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [31648 2014-05-31] (REALiX(tm))
R3 Ke2200; C:\Windows\System32\DRIVERS\e22w7x64.sys [154320 2013-03-20] (Qualcomm Atheros, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-05-30] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-26 19:44 - 2014-09-26 19:44 - 00000000 ____D () C:\Users\Tim\AppData\Local\Adobe
2014-09-25 14:00 - 2014-09-25 14:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-25 13:39 - 2014-09-25 13:39 - 01188194 _____ () C:\Users\Tim\Downloads\ProcessExplorer.zip
2014-09-24 21:01 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 21:01 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-24 15:40 - 2014-09-24 15:40 - 00918952 _____ (Oracle Corporation) C:\Users\Tim\Downloads\jxpiinstall.exe
2014-09-23 18:36 - 2014-09-28 10:58 - 00000616 _____ () C:\Windows\setupact.log
2014-09-23 18:36 - 2014-09-23 18:36 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-22 13:39 - 2014-09-22 13:39 - 00854417 _____ () C:\Users\Tim\Downloads\SecurityCheck.exe
2014-09-21 19:26 - 2014-09-21 19:26 - 00854417 _____ () C:\Users\Tim\Desktop\SecurityCheck.exe
2014-09-12 13:44 - 2014-09-12 13:44 - 02347384 _____ (ESET) C:\Users\Tim\Downloads\esetsmartinstaller_deu(1).exe
2014-09-12 13:34 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-12 13:34 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-12 13:17 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-12 13:17 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-12 13:17 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 13:17 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 13:17 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-12 13:17 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-12 13:17 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 13:17 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 13:17 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 13:17 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-12 13:17 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-12 13:17 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-12 13:17 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-12 13:17 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 13:17 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-12 13:17 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 13:17 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-12 13:17 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 13:17 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-12 13:17 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-12 13:17 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-12 13:17 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 13:17 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-12 13:17 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-12 13:17 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-12 13:17 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-12 13:17 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-12 13:17 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-12 13:17 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-12 13:17 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 13:17 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-12 13:17 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-12 13:17 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 13:17 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-12 13:17 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-12 13:17 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-12 13:17 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-12 13:17 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 13:17 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-12 13:17 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 13:17 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-12 13:17 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-12 13:17 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-12 13:17 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-12 13:17 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-12 13:17 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 13:17 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-12 13:17 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 13:17 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-12 13:17 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-12 13:17 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-12 13:17 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 13:17 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-12 13:17 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-12 13:17 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-12 13:17 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-12 13:05 - 2014-09-12 13:05 - 02347384 _____ (ESET) C:\Users\Tim\Downloads\esetsmartinstaller_deu.exe
2014-09-12 13:05 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-12 13:05 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-11 22:59 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 22:59 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-11 22:58 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-11 22:58 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-11 22:58 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-11 22:58 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-11 22:58 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-11 22:36 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-11 22:36 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-11 19:57 - 2014-09-11 19:57 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-09-11 19:16 - 2014-09-11 19:16 - 00001532 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2014-09-11 19:16 - 2014-09-11 19:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-09-11 19:15 - 2014-09-11 19:16 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-09-11 19:14 - 2014-09-11 19:17 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\DVDVideoSoft
2014-09-11 19:13 - 2014-09-11 19:14 - 30419936 _____ (DVDVideoSoft Ltd. ) C:\Users\Tim\Downloads\FreeYouTubeToMP3Converter3.12.44.908.exe
2014-09-11 17:20 - 2014-09-11 17:20 - 00001119 _____ () C:\Users\Tim\Desktop\JRT.txt
2014-09-11 16:41 - 2014-09-11 16:41 - 00000000 ____D () C:\Windows\ERUNT
2014-09-11 16:40 - 2014-09-11 16:40 - 01016261 _____ (Thisisu) C:\Users\Tim\Downloads\JRT.exe
2014-09-11 16:39 - 2014-09-11 16:39 - 00001737 _____ () C:\Users\Tim\Desktop\AdwCleaner[S3].txt
2014-09-11 16:23 - 2014-09-11 16:23 - 00002936 _____ () C:\Users\Tim\Desktop\mbam.txt
2014-09-11 13:55 - 2014-09-11 16:22 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-11 13:55 - 2014-09-11 13:55 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-11 13:54 - 2014-09-11 13:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-11 13:54 - 2014-09-11 13:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-11 13:54 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-11 13:54 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-11 13:54 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-11 13:53 - 2014-09-11 13:53 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Tim\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-10 19:33 - 2014-09-10 19:33 - 00049166 _____ () C:\Users\Tim\Desktop\ComboFix.txt
2014-09-10 19:24 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-10 19:24 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-10 19:24 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-10 19:24 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-10 19:24 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-10 19:24 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-10 19:24 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-10 19:24 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-10 18:33 - 2014-09-10 19:15 - 05576885 ____R (Swearware) C:\Users\Tim\Desktop\ComboFix_14_4_30_1.exe
2014-09-10 17:12 - 2014-09-10 19:33 - 00000000 ____D () C:\Qoobox
2014-09-10 17:11 - 2014-09-11 16:18 - 00000000 ____D () C:\Windows\erdnt
2014-09-10 17:07 - 2014-09-10 17:07 - 05576885 ____R (Swearware) C:\Users\Tim\Desktop\ComboFix.exe
2014-09-10 17:04 - 2014-09-10 17:06 - 00028292 _____ () C:\Users\Tim\Desktop\Addition.txt
2014-09-10 14:55 - 2014-09-28 11:02 - 00008459 _____ () C:\Users\Tim\Desktop\FRST.txt
2014-09-10 14:54 - 2014-09-28 11:02 - 00000000 ____D () C:\Users\Tim\Desktop\FRST-OlderVersion
2014-09-10 14:50 - 2014-09-10 14:50 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Tim\Desktop\revosetup.exe
2014-09-10 14:50 - 2014-09-10 14:50 - 00001264 _____ () C:\Users\Tim\Desktop\Revo Uninstaller.lnk
2014-09-10 14:50 - 2014-09-10 14:50 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-09-09 20:38 - 2014-09-09 20:38 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Macromedia
2014-09-09 15:32 - 2014-09-09 15:32 - 00000894 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2014-09-09 15:22 - 2014-09-09 15:29 - 00000000 ____D () C:\Program Files\GIMP 2
2014-09-09 15:21 - 2014-09-09 15:22 - 91931728 _____ (The GIMP Team ) C:\Users\Tim\Downloads\gimp-2.8.14-setup-1.exe
2014-09-09 15:21 - 2014-09-09 15:21 - 00009127 _____ () C:\Users\Tim\Downloads\gimp-2.8.14-setup-1.exe.torrent
2014-09-09 13:25 - 2014-09-09 13:27 - 00027887 _____ () C:\Users\Tim\Downloads\Addition.txt
2014-09-09 13:22 - 2014-09-09 13:27 - 00045201 _____ () C:\Users\Tim\Downloads\FRST.txt
2014-09-09 13:21 - 2014-09-28 11:02 - 00000000 ____D () C:\FRST
2014-09-09 13:20 - 2014-09-28 11:02 - 02108928 _____ (Farbar) C:\Users\Tim\Desktop\FRST64.exe
2014-09-08 16:14 - 2014-09-09 02:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2013
2014-09-08 16:12 - 2014-09-09 02:19 - 00000000 ____D () C:\Program Files (x86)\TuneUp Utilities 2013
2014-09-08 16:09 - 2014-09-09 02:19 - 00000000 __SHD () C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2014-09-08 16:09 - 2014-09-09 02:19 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-09-08 16:07 - 2014-09-08 16:07 - 28181408 _____ (TuneUp Software) C:\Users\Tim\Downloads\TuneUpUtilities2013_de-DE.exe
2014-09-07 21:34 - 2014-09-07 21:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-09-07 21:34 - 2014-09-07 21:34 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-09-02 23:21 - 2014-09-02 23:21 - 00002060 _____ () C:\Users\Public\Desktop\Die*Sims™*3.lnk
2014-09-02 21:55 - 2014-09-02 21:55 - 00001189 _____ () C:\Users\Public\Desktop\Peggle.lnk
2014-09-02 21:23 - 2014-09-09 21:27 - 00000000 ____D () C:\ProgramData\YouTubeAdBlOcckke
2014-09-02 21:22 - 2014-09-22 18:53 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-09-02 21:22 - 2014-09-09 19:24 - 00000000 ____D () C:\ProgramData\8c7e074b404257bc
2014-09-02 21:22 - 2014-09-09 19:24 - 00000000 ____D () C:\Program Files (x86)\YouTubeAdBlOcckke
2014-09-02 21:22 - 2014-09-02 21:22 - 00000000 ____D () C:\Users\Tim\AppData\Local\Comodo
2014-09-02 21:22 - 2014-09-02 21:22 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google
2014-09-02 21:22 - 2014-09-02 21:22 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo
2014-09-02 21:22 - 2014-09-02 21:22 - 00000000 ____D () C:\Users\HomeGroupUser$
2014-09-02 21:22 - 2014-09-02 21:22 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google
2014-09-02 21:22 - 2014-09-02 21:22 - 00000000 ____D () C:\Users\Gast\AppData\Local\Comodo
2014-09-02 21:22 - 2014-09-02 21:22 - 00000000 ____D () C:\Users\Gast
2014-09-02 21:22 - 2014-09-02 21:22 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google
2014-09-02 21:22 - 2014-09-02 21:22 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo
2014-09-02 21:22 - 2014-09-02 21:22 - 00000000 ____D () C:\Users\Administrator
2014-09-02 21:19 - 2014-09-02 21:19 - 04874632 _____ (LionSea Software co., ltd ) C:\Users\Tim\Downloads\setup(1).exe
2014-09-02 21:06 - 2014-09-02 21:06 - 00000000 ____D () C:\ProgramData\McAfee
2014-09-02 20:59 - 2014-09-03 20:07 - 00000000 ____D () C:\Windows\pss
2014-08-30 11:38 - 2014-08-30 11:38 - 00347816 _____ (Microsoft Corporation) C:\Users\Tim\Downloads\MicrosoftFixit.Devices.Run.exe
2014-08-29 19:42 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-29 19:42 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-29 19:42 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-28 11:00 - 2014-05-06 15:24 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\TS3Client
2014-09-28 10:58 - 2014-06-29 20:25 - 00000000 ____D () C:\Users\Tim\AppData\Local\LogMeIn Hamachi
2014-09-28 10:58 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-28 01:44 - 2014-07-28 17:30 - 01562745 _____ () C:\Windows\WindowsUpdate.log
2014-09-28 01:44 - 2014-03-08 22:02 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-09-28 00:16 - 2009-07-14 06:45 - 00020672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-28 00:16 - 2009-07-14 06:45 - 00020672 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-27 12:40 - 2014-05-26 18:07 - 00000000 ____D () C:\ProgramData\Origin
2014-09-27 12:39 - 2014-05-26 18:07 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-09-26 19:11 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-26 18:32 - 2014-03-08 23:04 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-26 14:35 - 2014-08-07 18:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-23 19:31 - 2014-08-17 19:47 - 00001011 _____ () C:\Users\Tim\Desktop\TeamSpeak 3 Client.lnk
2014-09-23 19:30 - 2014-05-30 16:20 - 00007647 _____ () C:\Users\Tim\AppData\Local\Resmon.ResmonCfg
2014-09-23 14:22 - 2014-05-16 15:50 - 00000000 ____D () C:\Windows\Minidump
2014-09-22 18:51 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-09-22 08:42 - 2014-03-08 22:36 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-12 13:37 - 2014-05-07 18:20 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-11 22:48 - 2014-03-08 21:43 - 01592628 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-11 22:48 - 2009-07-14 19:58 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2014-09-11 22:48 - 2009-07-14 19:58 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2014-09-11 22:48 - 2009-07-14 07:13 - 01592628 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-11 22:45 - 2014-03-08 22:31 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-09-11 22:45 - 2014-03-08 22:31 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-09-11 22:44 - 2014-03-08 22:31 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-11 22:44 - 2014-03-08 22:31 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-09-11 22:43 - 2014-05-26 18:56 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-11 22:36 - 2014-05-26 18:56 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-11 16:34 - 2014-06-19 19:20 - 00000000 ____D () C:\AdwCleaner
2014-09-10 19:32 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-09 15:49 - 2014-08-12 14:19 - 00000000 ____D () C:\Users\Tim\.gimp-2.8
2014-09-09 14:14 - 2014-03-08 23:07 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Skype
2014-09-09 02:19 - 2014-03-08 22:38 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\Adobe
2014-09-09 02:19 - 2014-03-08 22:01 - 00000000 ____D () C:\AMD
2014-09-09 02:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-09-09 01:22 - 2014-03-08 21:33 - 00000000 ____D () C:\Users\Tim
2014-09-09 01:14 - 2009-07-14 04:34 - 63176704 _____ () C:\Windows\system32\config\SOFTWARE_tureg_old
2014-09-09 01:14 - 2009-07-14 04:34 - 18612224 _____ () C:\Windows\system32\config\SYSTEM_tureg_old
2014-09-09 01:14 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY_tureg_old
2014-09-09 01:12 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SAM_tureg_old
2014-09-09 01:12 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\DEFAULT_tureg_old
2014-09-09 00:39 - 2014-03-09 04:26 - 00000000 ____D () C:\Windows\Panther
2014-09-08 23:41 - 2014-05-25 17:45 - 00000000 ____D () C:\Users\Tim\AppData\Roaming\.minecraft
2014-09-03 20:10 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-02 23:21 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-09-02 23:17 - 2014-03-08 21:56 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-02 23:12 - 2014-05-29 22:04 - 00447752 _____ (On2.com) C:\Windows\SysWOW64\vp6vfw.dll
2014-09-02 21:54 - 2014-05-26 18:09 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-09-02 21:22 - 2014-05-04 22:30 - 00000000 ____D () C:\Users\Tim\AppData\Local\Google
2014-09-02 21:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2014-09-02 21:07 - 2014-08-14 22:03 - 00000000 ____D () C:\Program Files (x86)\NirSoft
2014-09-02 13:03 - 2014-08-13 11:58 - 00001483 _____ () C:\Users\Public\Desktop\Die Sims 4 Erstelle einen Sim-Demo.lnk
2014-08-30 11:15 - 2009-07-14 06:45 - 00267816 _____ () C:\Windows\system32\FNTCACHE.DAT

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-26 19:02

==================== End Of Log ============================
--- --- ---

schrauber 28.09.2014 16:30
sieht gut aus. Immer noch so hoch?

Lavazzaa 28.09.2014 18:24
Leider ja.

schrauber 29.09.2014 14:02
Aüsserst merkwürdig dass dieses Update bei dir nicht installiert sein soll.

wicainventory. exe causes high CPU usage - Microsoft Community

Mach mal einen Clean boot, dann wieder Dienste einzeln aktivieren.

Lavazzaa 29.09.2014 15:42
Alles ausgeführt. :)

schrauber 30.09.2014 09:15
Wenn du die Dienste einzeln aktivierst immer wieder rebooten udn CPU last checken, bis Du weißt welcher Dienst diesen Prozess startet, der CPU zieht :)

Lavazzaa 02.10.2014 13:42
Ist es normal, dass die CPU Auslastung immer noch so hoch ist, obwohl keiner dieser Dienste aktiviert wurde?


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:30 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130