| |
| |||||||
Log-Analyse und Auswertung: Nach Windowsstart schwarzer Bildschrim (Maus und Taskmanager noch aktiv)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
15.06.2013, 21:16
| #1 |
| |  Nach Windowsstart schwarzer Bildschrim (Maus und Taskmanager noch aktiv) Hallo zusammen, ich bin neu hier und in PC-Angelegenheiten eher von vorgestern... Daher vorab herzlichen Dank für ein Feedback zu meinem Problem. Habe den ganzen Tag in den Foren gelesen und aufgrund meines Problems jetzt eine OTL.txt Datei erstellen lassen. Zuvor habe ich das Programm Hitmanpro via USB Stick auf dem infizierten Rechner durchlaufen lassen. DIeses hat auch einen Virus gefunden (AdvancedPCTweaker_setup.exe war infiziert, nach Löschung blieb der Bildschirm aber schwarz). Danach habe ich über die EIngabeaufforderung versucht die Explorer.exe auszutauschen, da ich vermutete, dass diese defekt ist. Leider auch ohne Erfolg. Die Anleitung dazu habe ich über die HP des BKA Trojaners gefunden. Hier der Inhalt der OTL Logfile: OTL logfile created on: 6/16/2013 1:49:10 AM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE 64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System Internet Explorer (Version = 9.10.9200.16614) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 88.00% Memory free 3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = H: | %SystemRoot% = H:\Windows | %ProgramFiles% = H:\Program Files (x86) Drive C: | 100.00 Mb Total Space | 74.35 Mb Free Space | 74.35% Space Free | Partition Type: NTFS Drive G: | 390.53 Gb Total Space | 242.06 Gb Free Space | 61.98% Space Free | Partition Type: NTFS Drive H: | 540.89 Gb Total Space | 328.26 Gb Free Space | 60.69% Space Free | Partition Type: NTFS Drive J: | 961.96 Mb Total Space | 952.36 Mb Free Space | 99.00% Space Free | Partition Type: FAT32 Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet002 ========== Win32 Services (SafeList) ========== SRV:64bit: - [2013/06/15 10:35:43 | 000,109,352 | ---- | M] (SurfRight B.V.) [Auto] -- H:\Program Files\HitmanPro\hmpsched.exe -- (HitmanProScheduler) SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- H:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2013/06/12 12:15:20 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- H:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013/05/10 03:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto] -- H:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013/04/04 10:46:22 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- H:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013/04/04 10:46:02 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- H:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013/02/28 12:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto] -- H:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2013/02/25 18:32:22 | 001,260,320 | ---- | M] (NVIDIA Corporation) [Auto] -- H:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2013/01/18 02:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto] -- H:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012/01/18 01:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto] -- H:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv) SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- H:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- H:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013/04/04 10:46:26 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System] -- H:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2013/04/04 10:46:26 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto] -- H:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2013/04/04 10:46:26 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System] -- H:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2013/03/22 15:06:41 | 000,828,912 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- H:\Windows\System32\drivers\sptd.sys -- (sptd) DRV:64bit: - [2012/01/18 01:44:36 | 004,865,568 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- H:\Windows\System32\drivers\lvuvc64.sys -- (LVUVC64) Logitech HD Webcam C270(UVC) DRV:64bit: - [2012/01/18 01:44:28 | 000,351,136 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- H:\Windows\System32\drivers\lvrs64.sys -- (LVRS64) DRV:64bit: - [2011/04/24 19:49:16 | 000,087,600 | ---- | M] (Citrix Systems, Inc.) [Kernel | System] -- H:\Windows\System32\drivers\ctxusbm.sys -- (ctxusbm) DRV:64bit: - [2010/11/25 00:59:16 | 000,694,888 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand] -- H:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su) DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2009/10/29 11:23:50 | 001,807,200 | ---- | M] (NXP Semiconductors Germany GmbH) [Kernel | On_Demand] -- H:\Windows\System32\drivers\NxpCap64.sys -- (NxpCap64) DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- H:\Windows\System32\wbem\ntfs.mof -- (Ntfs) DRV:64bit: - [2009/06/10 16:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\nvm62x64.sys -- (NVENETFD) DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- H:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv) DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- H:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- H:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009/03/02 08:12:18 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto] -- H:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT) DRV:64bit: - [2009/03/02 08:12:14 | 000,053,816 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto] -- H:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp) DRV:64bit: - [2007/09/10 02:50:26 | 000,527,360 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand] -- H:\Windows\System32\drivers\PAC7302.SYS -- (PAC7302) DRV:64bit: - [2006/11/30 09:17:56 | 000,033,048 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- H:\Windows\System32\drivers\x10ufx2.sys -- (XUIF) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\JH_ON_H\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs IE - HKU\JH_ON_H\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\JH_ON_H\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\JH_ON_H\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 10 84 2A FC 39 55 CD 01 [binary data] IE - HKU\JH_ON_H\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: H:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: H:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: H:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: H:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: H:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision: H:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming: H:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: H:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) [2013/06/11 03:53:58 | 000,000,000 | ---D | M] (No name found) -- H:\Program Files (x86)\Mozilla Firefox\extensions O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - H:\Windows\System32\drivers\etc\hosts O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - H:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4:64bit: - HKLM..\Run: [PAC7302_Monitor] H:\Windows\PixArt\PAC7302\Monitor.exe (PixArt Imaging Incorporation) O4 - HKLM..\Run: [avgnt] H:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [ConnectionCenter] H:\Program Files (x86)\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.) O4 - HKLM..\Run: [LWS] H:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe (Logitech Inc.) O4 - HKLM..\Run: [PDFPrint] H:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH) O4 - HKU\JH_ON_H..\Run: [Logitech Vid] H:\Program Files (x86)\Logitech\Vid HD\Vid.exe (Logitech Inc.) O4 - HKU\LocalService_ON_H..\Run: [Sidebar] H:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\NetworkService_ON_H..\Run: [Sidebar] H:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\UpdatusUser_ON_H..\Run: [Sidebar] H:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\LocalService_ON_H..\RunOnce: [mctadmin] File not found O4 - HKU\NetworkService_ON_H..\RunOnce: [mctadmin] File not found O4 - HKU\UpdatusUser_ON_H..\RunOnce: [mctadmin] File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O13:64bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O18:64bit: - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - Reg Error: Key error. File not found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - H:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - H:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - H:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found 64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found 64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2013/06/15 10:55:11 | 000,012,872 | ---- | C] (SurfRight B.V.) -- H:\Windows\System32\bootdelete.exe [2013/06/15 10:35:42 | 000,000,000 | ---D | C] -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro [2013/06/15 10:35:42 | 000,000,000 | ---D | C] -- H:\Program Files\HitmanPro [2013/06/15 10:35:14 | 000,000,000 | ---D | C] -- H:\Windows\Minidump [2013/06/15 10:33:02 | 000,000,000 | ---D | C] -- H:\ProgramData\HitmanPro [2013/06/15 07:52:15 | 000,526,336 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\ieui.dll [2013/06/15 07:52:15 | 000,391,168 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\ieui.dll [2013/06/14 10:13:18 | 000,000,000 | ---D | C] -- H:\Users\JH\AppData\Roaming\Juniper Networks [2013/06/12 03:20:48 | 000,136,704 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\iesysprep.dll [2013/06/12 03:20:48 | 000,109,056 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\iesysprep.dll [2013/06/12 03:20:48 | 000,089,600 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\RegisterIEPKEYs.exe [2013/06/12 03:20:48 | 000,071,680 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\RegisterIEPKEYs.exe [2013/06/12 03:20:48 | 000,067,072 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\iesetup.dll [2013/06/12 03:20:48 | 000,061,440 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\iesetup.dll [2013/06/12 03:20:48 | 000,051,712 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\ie4uinit.exe [2013/06/12 03:20:48 | 000,039,936 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\iernonce.dll [2013/06/12 03:20:48 | 000,033,280 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\iernonce.dll [2013/06/12 03:20:47 | 000,603,136 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\msfeeds.dll [2013/06/12 03:20:47 | 000,493,056 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\msfeeds.dll [2013/06/12 03:20:46 | 003,958,784 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\jscript9.dll [2013/06/12 03:20:46 | 000,855,552 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\jscript.dll [2013/06/12 03:20:46 | 000,690,688 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\jscript.dll [2013/06/12 03:20:45 | 002,877,440 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\jscript9.dll [2013/06/12 02:45:37 | 000,751,104 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\win32spl.dll [2013/06/12 02:45:37 | 000,492,544 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\win32spl.dll [2013/06/12 02:45:32 | 000,030,720 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\cryptdlg.dll [2013/06/12 02:45:32 | 000,024,576 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\cryptdlg.dll [2013/06/12 02:45:29 | 001,424,384 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\WindowsCodecs.dll [2013/06/12 02:45:23 | 001,192,448 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\certutil.exe [2013/06/12 02:45:23 | 000,903,168 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\certutil.exe [2013/06/12 02:45:22 | 001,464,320 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\crypt32.dll [2013/06/12 02:45:22 | 000,139,776 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\cryptnet.dll [2013/06/12 02:45:22 | 000,052,224 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\certenc.dll [2013/06/12 02:45:22 | 000,043,008 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\certenc.dll [2013/06/12 02:45:18 | 001,887,232 | ---- | C] (Microsoft Corporation) -- H:\Windows\System32\d3d11.dll [2013/06/12 02:45:18 | 001,505,280 | ---- | C] (Microsoft Corporation) -- H:\Windows\SysWow64\d3d11.dll [2013/06/11 03:54:17 | 000,000,000 | ---D | C] -- H:\Windows\SysWow64\Extensions [2013/06/11 03:54:16 | 000,000,000 | ---D | C] -- H:\Windows\SysWow64\searchplugins [2013/06/11 03:53:58 | 000,000,000 | ---D | C] -- H:\Program Files (x86)\Mozilla Firefox [2013/06/11 03:53:49 | 000,019,632 | ---- | C] (PerformerSoft LLC) -- H:\Windows\System32\roboot64.exe [2013/06/11 03:53:49 | 000,000,000 | ---D | C] -- H:\Users\JH\AppData\Roaming\PerformerSoft [2013/06/11 03:53:49 | 000,000,000 | ---D | C] -- H:\ProgramData\IBUpdaterService [2013/06/11 03:53:49 | 000,000,000 | ---D | C] -- H:\Users\JH\AppData\Roaming\File Scout [2013/06/07 12:11:51 | 000,000,000 | ---D | C] -- H:\Users\JH\AppData\Local\Diagnostics [2013/06/03 17:27:48 | 000,000,000 | ---D | C] -- H:\Users\JH\Desktop\Retail Banking [2013/03/22 16:49:56 | 007,760,687 | ---- | C] (Boraxsoft) -- H:\Users\JH\AppData\Roaming\SetupGFD.exe [2013/03/22 16:49:52 | 005,243,208 | ---- | C] ( ) -- H:\Users\JH\AppData\Roaming\AvsP.exe [2013/03/22 16:49:43 | 005,514,668 | ---- | C] (LIGHTNING UK!) -- H:\Users\JH\AppData\Roaming\Imgburn.exe [2013/03/22 16:49:39 | 005,082,084 | ---- | C] (The Public) -- H:\Users\JH\AppData\Roaming\Avisynth.exe ========== Files - Modified Within 30 Days ========== [2013/06/15 18:06:35 | 000,067,584 | --S- | M] () -- H:\Windows\bootstat.dat [2013/06/15 18:06:03 | 3220,676,608 | -HS- | M] () -- H:\hiberfil.sys [2013/06/15 12:08:18 | 000,009,696 | -H-- | M] () -- H:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013/06/15 12:08:18 | 000,009,696 | -H-- | M] () -- H:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013/06/15 10:55:11 | 000,012,872 | ---- | M] (SurfRight B.V.) -- H:\Windows\System32\bootdelete.exe [2013/06/15 10:43:43 | 000,000,510 | ---- | M] () -- H:\Windows\System32\.crusader [2013/06/15 10:35:43 | 000,000,000 | ---D | M] -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro [2013/06/15 10:35:13 | 378,096,913 | ---- | M] () -- H:\Windows\MEMORY.DMP [2013/06/15 09:15:03 | 000,000,884 | ---- | M] () -- H:\Windows\tasks\Adobe Flash Player Updater.job [2013/06/15 09:11:02 | 000,021,504 | ---- | M] () -- H:\Windows\System32\umstartup.etl [2013/06/12 12:15:20 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- H:\Windows\SysWow64\FlashPlayerApp.exe [2013/06/12 12:15:20 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- H:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013/06/08 10:06:58 | 000,526,336 | ---- | M] (Microsoft Corporation) -- H:\Windows\System32\ieui.dll [2013/06/08 07:40:02 | 000,391,168 | ---- | M] (Microsoft Corporation) -- H:\Windows\SysWow64\ieui.dll [2013/05/21 15:20:14 | 000,002,441 | ---- | M] () -- H:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2013/05/17 08:04:05 | 000,653,928 | ---- | M] () -- H:\Windows\System32\perfh007.dat [2013/05/17 08:04:05 | 000,615,810 | ---- | M] () -- H:\Windows\System32\perfh009.dat [2013/05/17 08:04:05 | 000,129,800 | ---- | M] () -- H:\Windows\System32\perfc007.dat [2013/05/17 08:04:05 | 000,106,190 | ---- | M] () -- H:\Windows\System32\perfc009.dat ========== Files Created - No Company Name ========== [2013/06/15 10:43:43 | 000,000,510 | ---- | C] () -- H:\Windows\System32\.crusader [2013/06/15 10:35:13 | 378,096,913 | ---- | C] () -- H:\Windows\MEMORY.DMP [2013/03/22 16:49:51 | 001,357,348 | ---- | C] () -- H:\Users\JH\AppData\Roaming\MatroskaSplitter.exe [2013/03/22 16:49:50 | 000,117,723 | ---- | C] () -- H:\Users\JH\AppData\Roaming\yuvcodecs-1.3.exe [2012/06/28 16:18:10 | 000,252,928 | ---- | C] () -- H:\Windows\SysWow64\DShowRdpFilter.dll [2012/06/28 12:33:51 | 000,000,480 | ---- | C] () -- H:\Windows\11317231_001216BE_ca.bin [2012/01/18 01:44:00 | 010,920,984 | ---- | C] () -- H:\Windows\SysWow64\LogiDPP.dll [2012/01/18 01:44:00 | 000,336,408 | ---- | C] () -- H:\Windows\SysWow64\DevManagerCore.dll [2012/01/18 01:44:00 | 000,104,472 | ---- | C] () -- H:\Windows\SysWow64\LogiDPPApp.exe [2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- H:\Windows\bootstat.dat [2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- H:\Windows\SysWow64\NOISE.DAT [2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- H:\Windows\SysWow64\dssec.dat [2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- H:\Windows\mib.bin [2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- H:\Windows\SysWow64\BWContextHandler.dll [2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- H:\Windows\SysWow64\ir32_32.dll [2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- H:\Windows\SysWow64\msjetoledb40.dll [2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- H:\Windows\SysWow64\mlang.dat [2007/03/20 10:44:02 | 000,000,566 | ---- | C] () -- H:\Windows\SysWow64\SP7302.ini ========== LOP Check ========== [2012/06/28 09:54:05 | 000,000,000 | -HSD | M] -- H:\ProgramData\Anwendungsdaten [2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Application Data [2012/07/20 11:41:31 | 000,000,000 | ---D | M] -- H:\ProgramData\Citrix [2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Desktop [2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Documents [2012/06/28 09:54:05 | 000,000,000 | -HSD | M] -- H:\ProgramData\Dokumente [2013/03/17 08:57:13 | 000,000,000 | ---D | M] -- H:\ProgramData\elsterformular [2012/06/28 09:54:05 | 000,000,000 | -HSD | M] -- H:\ProgramData\Favoriten [2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Favorites [2013/06/15 10:43:57 | 000,000,000 | ---D | M] -- H:\ProgramData\HitmanPro [2013/06/11 03:53:49 | 000,000,000 | ---D | M] -- H:\ProgramData\IBUpdaterService [2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Start Menu [2012/06/28 09:54:05 | 000,000,000 | -HSD | M] -- H:\ProgramData\Startmenü [2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- H:\ProgramData\Templates [2013/04/18 05:54:10 | 000,000,000 | ---D | M] -- H:\ProgramData\tmp [2012/06/28 09:54:05 | 000,000,000 | -HSD | M] -- H:\ProgramData\Vorlagen [2013/06/11 03:27:05 | 000,032,640 | ---- | M] () -- H:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Was kann ich nun hiermit tun? Ich möchte unbedingt noch einige Daten sichern und dann meinetwegen das BS neu installieren - wenn es keinen anderen Weg gibt. DANKE!!! VG, mythosnds |
|
15.06.2013, 22:25
| #2 |
| /// TB-Ausbilder  |  Nach Windowsstart schwarzer Bildschrim (Maus und Taskmanager noch aktiv)!! Hinweis an Mitlesende !! Dieses Thema und die Anweisungen sind nur für diesen speziellen Fall gedacht. Sie könnten andere Computer schwer beschädigen. Öffnet bitte euer eigenes Thema.  Ich werde dir bei deinem Problem helfen. Die Bereinigung funktioniert nur, wenn du dich an die folgenden Regeln hälst:  Bitte lesen:Regeln für die Bereinigung
Computer mit Combofix entsperren Warnung: Diese Anleitung ist nur für diesen speziellen Fall gedacht und kann andere Computer evtl. schwer beschädigen. Zudem darf Combofix nur ausgeführt werden, wenn dies von einem erfahrenen Helfer angewiesen wird!
__________________ |
|
17.06.2013, 16:47
| #3 |
| /// TB-Ausbilder | Nach Windowsstart schwarzer Bildschrim (Maus und Taskmanager noch aktiv) Fehlende Rückmeldung
__________________Dieses Thema wurde aus den Abos gelöscht. Somit bekomm ich keine Benachrichtigung über neue Antworten. PM an mich falls Du denoch weiter machen willst. Keine Logfiles einsenden, nur kurzer Hinweis, nachdem du deine Logfiles hier eingestellt hast. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist. Jeder andere bitte hier klicken und einen eigenen Thread erstellen
__________________ |
|
| Themen zu Nach Windowsstart schwarzer Bildschrim (Maus und Taskmanager noch aktiv) |
| antivir, autorun, avira, bho, bildschirm, defender, desktop, error, feedback, firefox, flash player, format, helper, home, lightning, logfile, lws.exe, maus, monitor, monitor.exe, plug-in, programm, realtek, registry, scan, software, stick, taskmanager, usb, virus, virus trojaner schwarzer bildschirm win7 hilfe |
Linear-Darstellung
