![]() |
|
Plagegeister aller Art und deren Bekämpfung: Windows7 mit weißem Bildschirm nach dem StartenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
![]() | #1 |
![]() | ![]() Windows7 mit weißem Bildschirm nach dem Starten Hallo, ich bin neu hier im Forum und habe es gerade während meiner suche über Google entdeckt und bin total begeistert wie hier geholfen wird ![]() ![]() Mein Problem: Wenn ich den PC starte erscheint nach dem Anmelden ein weißer Bildschirm (Win7 64bit). Die Maus ist sichtbar aber ich kann nichts auswählen. Wenn ich den Task-Manager versuche zu starten erscheint auch nur der weiße Bildschirm. Da dieses Problem mir recht ähnlich zu den hier schon öfters aufgeführten Problemen gehört habe ich schon mal die "Farbar Recovery Scan Tool 64-Bit-Version" heruntergeladen und einen Scan durchgeführt. Hier der Logfile.... Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-07-2013 01 Ran by SYSTEM on 13-07-2013 17:03:45 Running from H:\ Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log. ==================== Registry (Whitelisted) ================== HKLM\...\Run: [COMODO Internet Security] - "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h [9048392 2011-07-22] (COMODO) HKLM\...\RunOnce: [RPMKickstart] - C:\Program Files\GIGABYTE\SMART6\Recovery\RPMKickstart.exe [2552320 2010-08-23] (Gigabyte Technology CO., LTD.) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [35736 2011-01-30] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [932288 2010-11-10] (Adobe Systems Incorporated) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [SearchSettings] - "C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe" [x] HKLM-x32\...\Run: [NPSStartup] - [x] HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2011-07-05] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421736 2011-08-19] (Apple Inc.) HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3521464 2012-06-08] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-08] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [ISUSScheduler] - "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start [81920 2005-02-17] (InstallShield Software Corporation) HKLM-x32\...\Run: [BCSSync] - "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices [91520 2010-03-13] (Microsoft Corporation) HKLM-x32\...\Run: [gbrspcontrol] - "C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe" -controlservice -slave [1851088 2013-04-17] (Comodo Security Solutions, Inc.) HKU\EvilKnivel\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-05-21] (Google Inc.) HKU\EvilKnivel\...\Run: [KiesHelper] - C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe /s [x] HKU\EvilKnivel\...\Run: [KiesPDLR] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21432 2012-06-08] () HKU\EvilKnivel\...\Run: [ISUSPM Startup] - C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup [221184 2005-02-17] (InstallShield Software Corporation) HKU\EvilKnivel\...\Winlogon: [Shell] explorer.exe,C:\Users\EvilKnivel\AppData\Roaming\cache.dat [54784 2011-11-17] () <==== ATTENTION AppInit_DLLs: C:\Windows\system32\guard64.dll [363560 2011-07-22] (COMODO) AppInit_DLLs-x32: C:\Windows\SysWOW64\guard32.dll [285256 2011-07-22] (COMODO) Startup: C:\ProgramData\Start Menu\Programs\Startup\Start GeekBuddy.lnk ShortcutTarget: Start GeekBuddy.lnk -> C:\Program Files (x86)\COMODO\GeekBuddy\launcher.exe (Comodo Security Solutions Inc.) Startup: C:\Users\EvilKnivel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ==================== Services (Whitelisted) ================= S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-09] (Avira Operations GmbH & Co. KG) S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-09] (Avira Operations GmbH & Co. KG) S2 Brother XP spl Service; C:\Windows\SysWow64\brsvc01a.exe [57344 2002-04-11] (brother Industries Ltd) S2 CLPSLauncher; C:\Program Files (x86)\Common Files\COMODO\launcher_service.exe [70344 2013-04-17] (Comodo Security Solutions Inc.) S2 cmdagent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2528096 2011-07-22] (COMODO) S2 DES2 Service; C:\Program Files (x86)\GIGABYTE\EnergySaver2\des2svr.exe [68136 2009-06-17] () S2 GeekBuddyRSP; C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe [1851088 2013-04-17] (Comodo Security Solutions, Inc.) S2 Smart TimeLock; C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [114688 2009-10-13] (Gigabyte Technology CO., LTD.) S2 Application Updater; "C:\Program Files (x86)\Application Updater\ApplicationUpdater.exe" [x] ==================== Drivers (Whitelisted) ==================== S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-09] (Avira GmbH) S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-09] (Avira GmbH) S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-09-16] (Avira GmbH) S1 CFRMD; C:\Windows\SysWow64\DRIVERS\CFRMD.sys [37976 2012-09-03] (Windows (R) Win 7 DDK provider) S1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [252344 2011-07-22] (COMODO) S1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [41712 2011-07-22] (COMODO) S3 gdrv; C:\Windows\gdrv.sys [25640 2013-07-13] (Windows (R) Server 2003 DDK provider) S3 gdrv; C:\Windows\gdrv.sys [25640 2013-07-13] (Windows (R) Server 2003 DDK provider) S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2012-12-04] () S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2012-12-04] () S1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [92688 2011-07-22] (COMODO) S1 LUMDriver; C:\Windows\system32\drivers\LUMDriver.sys [24848 2008-01-02] (IBM) S1 LUMDriver; C:\Windows\system32\drivers\LUMDriver.sys [24848 2008-01-02] (IBM) S2 BrPar; \SystemRoot\System32\drivers\BrPar64a.sys [x] S1 CFRMD; system32\DRIVERS\CFRMD.sys [x] S1 StarOpen; No ImagePath ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-07-13 17:03 - 2013-07-13 17:03 - 00000000 ____D C:\FRST 2013-07-12 11:00 - 2013-05-29 07:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2013-07-12 11:00 - 2013-05-29 06:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2013-07-12 11:00 - 2013-05-29 06:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2013-07-12 11:00 - 2013-05-29 06:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2013-07-12 11:00 - 2013-05-29 06:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll 2013-07-12 11:00 - 2013-05-29 06:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2013-07-12 11:00 - 2013-05-29 06:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\System32\url.dll 2013-07-12 11:00 - 2013-05-29 06:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2013-07-12 11:00 - 2013-05-29 06:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll 2013-07-12 11:00 - 2013-05-29 06:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2013-07-12 11:00 - 2013-05-29 06:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2013-07-12 11:00 - 2013-05-29 06:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2013-07-12 11:00 - 2013-05-29 06:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2013-07-12 11:00 - 2013-05-29 06:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2013-07-12 11:00 - 2013-05-29 06:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2013-07-12 11:00 - 2013-05-29 06:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll 2013-07-12 11:00 - 2013-05-29 02:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-07-12 11:00 - 2013-05-29 02:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-07-12 11:00 - 2013-05-29 02:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-07-12 11:00 - 2013-05-29 02:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-07-12 11:00 - 2013-05-29 02:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-07-12 11:00 - 2013-05-29 02:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-07-12 11:00 - 2013-05-29 02:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-07-12 11:00 - 2013-05-29 02:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-07-12 11:00 - 2013-05-29 02:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-07-12 11:00 - 2013-05-29 02:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-07-12 11:00 - 2013-05-29 02:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-07-12 11:00 - 2013-05-29 02:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-07-12 11:00 - 2013-05-29 02:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-07-12 11:00 - 2013-05-29 02:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-07-12 11:00 - 2013-05-29 02:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-07-12 11:00 - 2013-05-29 02:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-07-12 08:32 - 2013-06-05 04:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-07-12 08:32 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll 2013-07-12 08:32 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2013-07-12 08:32 - 2013-05-06 07:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL 2013-07-12 08:32 - 2013-05-06 05:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2013-07-12 08:31 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2013-07-12 08:31 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\System32\DWrite.dll 2013-06-23 12:57 - 2013-06-23 12:58 - 00000022 _____ C:\Users\EvilKnivel\Downloads\UM-Rechnungen.zip 2013-06-23 12:57 - 2013-06-23 12:57 - 00000853 _____ C:\Users\EvilKnivel\.recently-used.xbel 2013-06-23 12:20 - 2013-06-23 12:20 - 00022776 ____N C:\Users\EvilKnivel\Desktop\F5D_2013_DM.xls ==================== One Month Modified Files and Folders ======= 2013-07-13 17:03 - 2013-07-13 17:03 - 00000000 ____D C:\FRST 2013-07-13 16:00 - 2011-05-21 16:24 - 01780147 _____ C:\Windows\WindowsUpdate.log 2013-07-13 15:41 - 2011-05-21 16:42 - 00001118 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-07-13 15:37 - 2010-11-21 07:50 - 00654150 _____ C:\Windows\System32\perfh007.dat 2013-07-13 15:37 - 2010-11-21 07:50 - 00130022 _____ C:\Windows\System32\perfc007.dat 2013-07-13 15:37 - 2009-07-14 06:13 - 01498742 _____ C:\Windows\System32\PerfStringBackup.INI 2013-07-13 15:37 - 2009-07-14 05:45 - 00021840 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-07-13 15:37 - 2009-07-14 05:45 - 00021840 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-07-13 15:30 - 2012-10-03 14:47 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys 2013-07-13 15:30 - 2011-05-21 16:42 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-07-13 15:30 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-07-13 15:30 - 2009-07-14 05:51 - 00114057 _____ C:\Windows\setupact.log 2013-07-13 10:42 - 2013-05-08 17:36 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2013-07-12 15:50 - 2012-10-19 23:19 - 00000000 ____D C:\Users\EvilKnivel\Documents\Outlook-Dateien 2013-07-12 15:36 - 2010-11-21 08:00 - 00000000 ____D C:\Program Files\Windows Journal 2013-07-12 15:36 - 2010-11-21 04:47 - 00245914 _____ C:\Windows\PFRO.log 2013-07-12 15:36 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-07-12 15:36 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2013-07-12 15:36 - 2009-07-14 05:45 - 00431608 _____ C:\Windows\System32\FNTCACHE.DAT 2013-07-12 11:04 - 2011-05-21 17:22 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-06-27 18:40 - 2011-08-09 16:52 - 00000000 ____D C:\Users\EvilKnivel\AppData\Roaming\FileZilla 2013-06-27 17:35 - 2011-08-09 17:11 - 00000000 ____D C:\Users\EvilKnivel\AppData\Local\Eclipse 2013-06-23 13:10 - 2012-01-03 18:23 - 00000000 ____D C:\Users\EvilKnivel\.gimp-2.6 2013-06-23 12:58 - 2013-06-23 12:57 - 00000022 _____ C:\Users\EvilKnivel\Downloads\UM-Rechnungen.zip 2013-06-23 12:57 - 2013-06-23 12:57 - 00000853 _____ C:\Users\EvilKnivel\.recently-used.xbel 2013-06-23 12:57 - 2011-05-21 16:24 - 00000000 ____D C:\users\EvilKnivel 2013-06-23 12:28 - 2013-05-12 09:14 - 00000361 _____ C:\Users\EvilKnivel\Desktop\DM-Ergebnisse-Lim.csv 2013-06-23 12:26 - 2013-05-12 09:14 - 00000722 _____ C:\Users\EvilKnivel\Desktop\DM-Ergebnisse-F5D.csv 2013-06-23 12:20 - 2013-06-23 12:20 - 00022776 ____N C:\Users\EvilKnivel\Desktop\F5D_2013_DM.xls 2013-06-13 17:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-06-28 09:31:11 Restore point made on: 2013-07-05 10:32:13 Restore point made on: 2013-07-12 10:56:06 ==================== Memory info =========================== Percentage of memory in use: 15% Total physical RAM: 4013.42 MB Available physical RAM: 3373.04 MB Total Pagefile: 4011.62 MB Available Pagefile: 3365.56 MB Total Virtual: 8192 MB Available Virtual: 8191.85 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:78.12 GB) (Free:23.99 GB) NTFS (Disk=0 Partition=2) Drive e: (Eigene Dateien) (Fixed) (Total:292.97 GB) (Free:104.34 GB) NTFS (Disk=0 Partition=3) Drive f: (Musik) (Fixed) (Total:94.57 GB) (Free:65.46 GB) NTFS (Disk=0 Partition=4) Drive h: (M) (Removable) (Total:1.95 GB) (Free:1.95 GB) FAT32 (Disk=1 Partition=1) Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=0 Partition=1) ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 8E95EC35) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=78 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=293 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=95 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 2 GB) (Disk ID: 406E3519) Partition 1: (Active) - (Size=2 GB) - (Type=0B) LastRegBack: 2013-07-13 15:59 ==================== End Of Log ============================ Vielen Dank im Voraus!!!!!!!!!!! Gruß Chrissel |
Themen zu Windows7 mit weißem Bildschirm nach dem Starten |
.dll, adobe, antivir, association, avg, avira, bildschirm, cache.dat, desktop, explorer, farbar, farbar recovery scan tool, frst.txt, google, home, maus, musik, problem, registry, scan, security, server, services.exe, software, starten, super, svchost.exe, system, task-manager, win7 64bit, windows, winlogon.exe |