|
Log-Analyse und Auswertung: Weißer Bildschirm nach Neustart, scan via FRST.exe --> FRST.txtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
31.07.2013, 19:06 | #1 |
| Weißer Bildschirm nach Neustart, scan via FRST.exe --> FRST.txt Hallo, ich habe oben genanntes Problem und auch schon den frst scanner drüber laufen gelassen. Anbei meine txt Datei mit der Bitte um Hilfe für weitere Vorgehensweise. Vielen Dank im Voraus. Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03 Ran by SYSTEM on 31-07-2013 18:52:03 Running from G:\ Windows 7 Home Premium (X64) OS Language: German Standard Internet Explorer Version 8 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log. ==================== Registry (Whitelisted) ================== HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324608 2010-02-05] (Alcor Micro Corp.) HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-04-16] (Egis Technology Inc.) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10081312 2010-02-22] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [877600 2010-02-22] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2107176 2010-03-11] (Synaptics Incorporated) HKLM\...\Run: [Acer ePower Management] - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [496160 2010-03-09] (Acer Incorporated) HKLM\...\Run: [snpstd3] - C:\Windows\vsnpstd3.exe [835584 2007-05-10] () HKLM\...\InprocServer32: [Default-cscui] <==== ATTENTION! HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation) HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1300560 2010-03-03] (Dritek System Inc.) HKLM-x32\...\Run: [SuiteTray] - C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-04-16] (Egis Technology Inc.) HKLM-x32\...\Run: [EgisUpdate] - C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-10] (Egis Technology Inc.) HKLM-x32\...\Run: [EgisTecPMMUpdate] - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-03-10] (Egis Technology Inc.) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-05] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [MDS_Menu] - C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [ArcadeMovieService] - C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe [124136 2010-04-23] (CyberLink Corp.) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [281768 2010-12-12] (Avira GmbH) HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31072 2008-10-25] (Microsoft Corporation) HKLM-x32\...\Run: [WinampAgent] - "C:\Program Files (x86)\Winamp\winampa.exe" [x] HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-01] (Apple Inc.) HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\Mobile Partner Manager\UIExec.exe [132096 2009-12-02] () HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-02] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2012-01-03] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1391272 2012-01-03] (Ask) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.) HKLM-x32\...\Run: [FixCamera] - C:\Windows\FixCamera.exe [20480 2007-07-11] () HKLM-x32\...\Run: [snpstd3] - C:\Windows\vsnpstd3.exe [835584 2007-05-10] () HKLM-x32\...\Run: [tsnpstd3] - C:\Windows\tsnpstd3.exe [270336 2007-04-20] () HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-14] () HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [154144 2010-01-14] () HKU\Thomas\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe [59240 2012-02-23] (Apple Inc.) HKU\Thomas\...\Winlogon: [Shell] explorer.exe,C:\Users\Thomas\AppData\Roaming\cache.dat [98304 2011-11-16] () <==== ATTENTION Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DesktopVideoPlayer.LNK ShortcutTarget: DesktopVideoPlayer.LNK -> C:\Program Files (x86)\vghd\vghd.exe (Totem Entertainment) ==================== Services (Whitelisted) ================= S4 0163751294517815mcinstcleanup; C:\Windows\TEMP\016375~1.EXE [822048 2010-02-09] (McAfee, Inc.) S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [136360 2011-05-08] (Avira GmbH) S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [269480 2011-07-09] (Avira GmbH) S2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [820768 2010-03-09] (Acer Incorporated) S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.) S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-04-16] (Egis Technology Inc.) S2 RichVideo; C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe [244904 2010-02-03] () S2 UI Assistant Service; C:\Program Files (x86)\Mobile Partner Manager\AssistantServices.exe [246272 2009-12-02] () S2 VMCService; C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [9216 2009-09-11] (Vodafone) ==================== Drivers (Whitelisted) ==================== S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2013-04-02] () S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88288 2011-07-09] (Avira GmbH) S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [123784 2011-07-09] (Avira GmbH) S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-06-29] (Huawei Technologies Co., Ltd.) S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2013-04-02] () S3 SNPSTD3; C:\Windows\System32\DRIVERS\snpstd3.sys [10693120 2007-10-16] (Sonix Co. Ltd.) S0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2011-01-12] (Duplex Secure Ltd.) S2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-11-02] () S2 {6E090BD5-4EF5-4bf0-A968-74049E88E935}; C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\000.fcl [146928 2010-04-22] (CyberLink Corp.) S2 {6E090BD5-4EF5-4bf0-A968-74049E88E935}; C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\000.fcl [146928 2010-04-22] (CyberLink Corp.) S3 UCORESYS; \??\D:\DMIEDIT_utility\UCORESYS.sys [x] S3 UCOREW64; \??\D:\DMIEDIT_utility\UCOREW64.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-07-31 18:51 - 2013-07-31 18:51 - 00000000 ____D C:\FRST 2013-07-30 07:08 - 2013-07-31 08:40 - 00000004 _____ C:\Users\Thomas\AppData\Roaming\cache.ini ==================== One Month Modified Files and Folders ======= 2013-07-31 18:51 - 2013-07-31 18:51 - 00000000 ____D C:\FRST 2013-07-31 08:40 - 2013-07-30 07:08 - 00000004 _____ C:\Users\Thomas\AppData\Roaming\cache.ini 2013-07-31 08:40 - 2010-09-20 05:01 - 01132117 _____ C:\Windows\WindowsUpdate.log 2013-07-31 08:39 - 2010-09-20 14:52 - 00654188 _____ C:\Windows\System32\perfh007.dat 2013-07-31 08:39 - 2010-09-20 14:52 - 00130028 _____ C:\Windows\System32\perfc007.dat 2013-07-31 08:39 - 2009-07-13 21:13 - 01498506 _____ C:\Windows\System32\PerfStringBackup.INI 2013-07-31 08:37 - 2009-07-13 20:51 - 00138517 _____ C:\Windows\setupact.log 2013-07-31 08:32 - 2009-07-13 20:45 - 00009696 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-07-31 08:32 - 2009-07-13 20:45 - 00009696 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-07-31 08:25 - 2011-01-18 11:49 - 00000007 _____ C:\Windows\treeskp.sys 2013-07-31 08:25 - 2011-01-18 11:49 - 00000007 _____ C:\Windows\sbacknt.bin 2013-07-31 08:24 - 2013-03-22 16:36 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-07-31 08:24 - 2013-03-22 16:36 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-07-31 08:24 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-07-31 08:22 - 2011-01-23 08:55 - 78185248 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe 2013-07-30 07:15 - 2012-05-07 05:46 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-07-30 07:07 - 2012-05-07 05:46 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-07-30 07:07 - 2012-05-07 05:46 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-07-30 07:07 - 2012-03-17 12:46 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-07-30 07:06 - 2011-01-24 04:22 - 00000000 ____D C:\Users\Thomas\AppData\Local\Adobe Files to move or delete: ==================== C:\Users\Thomas\AppData\Roaming\cache.dat C:\Users\Thomas\AppData\Roaming\cache.ini ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-04-26 03:41:30 Restore point made on: 2013-05-04 06:49:23 Restore point made on: 2013-05-16 04:49:16 Restore point made on: 2013-05-16 04:52:00 Restore point made on: 2013-05-19 05:02:33 Restore point made on: 2013-05-24 11:27:06 Restore point made on: 2013-05-30 11:35:01 Restore point made on: 2013-06-04 09:01:19 Restore point made on: 2013-06-04 09:02:29 Restore point made on: 2013-06-04 09:03:20 Restore point made on: 2013-06-04 09:07:17 Restore point made on: 2013-06-04 09:11:52 Restore point made on: 2013-06-13 06:00:05 Restore point made on: 2013-06-13 06:36:22 Restore point made on: 2013-06-14 10:26:49 Restore point made on: 2013-06-14 14:06:14 Restore point made on: 2013-06-17 07:38:10 Restore point made on: 2013-06-17 07:38:15 Restore point made on: 2013-06-17 07:38:17 Restore point made on: 2013-06-17 07:38:17 Restore point made on: 2013-06-17 07:38:23 Restore point made on: 2013-06-17 07:38:25 Restore point made on: 2013-06-17 07:38:26 Restore point made on: 2013-06-19 03:46:03 Restore point made on: 2013-06-25 01:30:17 Restore point made on: 2013-07-30 07:09:18 Restore point made on: 2013-07-31 08:20:14 ==================== Memory info =========================== Percentage of memory in use: 19% Total physical RAM: 3764.48 MB Available physical RAM: 3033.84 MB Total Pagefile: 3762.63 MB Available Pagefile: 3027.71 MB Total Virtual: 8192 MB Available Virtual: 8191.85 MB ==================== Drives ================================ Drive c: (Acer) (Fixed) (Total:582.07 GB) (Free:453.56 GB) NTFS (Disk=0 Partition=3) Drive e: (PQSERVICE) (Fixed) (Total:14 GB) (Free:2.24 GB) NTFS (Disk=0 Partition=1) Drive g: () (Removable) (Total:3.72 GB) (Free:3.71 GB) FAT32 (Disk=1 Partition=1) Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: 23E0F7F6) Partition 1: (Not Active) - (Size=14 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=582 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 4 GB) (Disk ID: 6F20736B) No partition Table on disk 1. Disk 1 is a removable device. LastRegBack: 2013-06-16 01:38 ==================== End Of Log ============================ |
31.07.2013, 19:06 | #2 |
/// TB-Ausbilder | Weißer Bildschirm nach Neustart, scan via FRST.exe --> FRST.txtMein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Ich habe dein Thema in Arbeit und melde mich so schnell wie möglich mit weiteren Anweisungen. |
31.07.2013, 19:11 | #3 |
/// TB-Ausbilder | Weißer Bildschirm nach Neustart, scan via FRST.exe --> FRST.txt Servus,
__________________Zuerst müssen wir auf einem sauberen Rechner den Fix erstellen. Das geht so: Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start HKLM\...\InprocServer32: [Default-cscui] <==== ATTENTION! HKLM-x32\...\Run: [] - [x] HKU\Thomas\...\Winlogon: [Shell] explorer.exe,C:\Users\Thomas\AppData\Roaming\cache.dat [98304 2011-11-16] () <==== ATTENTION C:\Users\Thomas\AppData\Roaming\cache.dat C:\Users\Thomas\AppData\Roaming\cache.ini end
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier. Berichte mir, ob du nun wieder normal starten kannst. |
31.07.2013, 19:24 | #4 |
| Weißer Bildschirm nach Neustart, scan via FRST.exe --> FRST.txt vielen Dank für die schnelle Antwort. Der Rechner lässt sich wieder normal starten. Was kann ich nun tun damit dies nicht noch einmal passiert oder ist der Trojaner nun endgültig verschwunden? |
01.08.2013, 09:47 | #5 |
/// TB-Ausbilder | Weißer Bildschirm nach Neustart, scan via FRST.exe --> FRST.txt Servus, Freut mich zu hören. Bitte poste mir noch die Logdatei von FRST(Fix). Diese sollte sich auf dem USB-Stick befinden. Verschiebe bitte die FRST.exe vom USB-Stick auf den Desktop im normalen Modus und führe dort nochmals einen FRST-Scan aus. Es werden 2 Logdateien erstellt. Poste mir bitte diese. |
06.08.2013, 13:05 | #6 |
/// TB-Ausbilder | Weißer Bildschirm nach Neustart, scan via FRST.exe --> FRST.txt Fehlende Rückmeldung Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten. PM an mich falls Du denoch weiter machen willst. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist. Jeder andere bitte hier klicken und einen eigenen Thread erstellen! |
Themen zu Weißer Bildschirm nach Neustart, scan via FRST.exe --> FRST.txt |
.dll, adobe, adobe flash player, antivir, association, avg, avira, bildschirm, desktop, explorer, farbar, farbar recovery scan tool, flash player, frst.exe, frst.txt, home, log, microsoft, neustart, pmmupdate.exe, problem, realtek, registry, scan, secure, security, services.exe, svchost.exe, system, temp, thomas, weißer bildschirm, winlogon.exe |