Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.
das Problem ist schnell geschildert: Anstatt des Desktops erscheint beim Windowsstart nur ein weisser Bildschirm. Fährt man den Rechner über strg-alt-entf herunter, sieht man noch kurz den normalen Desktop bevor das "Windows wird heruntergefahren"-Bild erscheint.
folgende FRST-Log habe ich nach der Anleitung erstellt:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-08-2013
Ran by SYSTEM on 18-08-2013 14:36:34
Running from G:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-16] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] - C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [281768 2010-12-13] (Avira GmbH)
HKLM-x32\...\Run: [IR_SERVER] - C:\PROGRA~2\Realtek\REALTE~1\IR_SERVER.exe [x]
HKLM-x32\...\Run: [ArcSoft Connection Service] - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKU\Linda\...\Winlogon: [Shell] explorer.exe,C:\Users\Linda\AppData\Roaming\skype.dat [69632 2013-08-08] () <==== ATTENTION
==================== Services (Whitelisted) =================
S2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [136360 2011-05-22] (Avira GmbH)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [269480 2011-06-28] (Avira GmbH)
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [167424 2009-09-16] (Intel Corporation)
S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation)
S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation)
S2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2009-09-14] (Sony Corporation)
S2 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [642416 2009-09-14] (Sony Corporation)
S3 VUAgent; C:\Program Files\Sony\VAIO Update 5\VUAgent.exe [1165680 2009-10-30] (Sony Corporation)
S2 VzCdbSvc; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [206336 2009-09-14] (Sony Corporation)
==================== Drivers (Whitelisted) ====================
S3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88288 2011-06-28] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [123784 2011-06-28] (Avira GmbH)
S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-11-12] ()
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-08 20:40 - 2013-08-08 20:40 - 00000000 ____D C:\Users\Linda\AppData\Local\Sony Corporation
2013-08-08 20:36 - 2013-08-18 13:27 - 00000004 _____ C:\Users\Linda\AppData\Roaming\skype.ini
==================== One Month Modified Files and Folders =======
2013-08-18 13:27 - 2013-08-08 20:36 - 00000004 _____ C:\Users\Linda\AppData\Roaming\skype.ini
2013-08-18 13:27 - 2010-05-20 10:28 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-18 13:26 - 2012-09-22 09:03 - 00006058 _____ C:\Windows\setupact.log
2013-08-18 13:26 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-18 13:25 - 2012-03-02 22:01 - 02097111 _____ C:\Windows\WindowsUpdate.log
2013-08-18 13:22 - 2009-07-14 05:45 - 00013664 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-18 13:22 - 2009-07-14 05:45 - 00013664 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-18 13:17 - 2010-05-20 10:28 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-18 13:12 - 2010-05-20 10:28 - 00004120 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-08-18 13:12 - 2010-05-20 10:28 - 00003868 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-08-12 18:15 - 2010-05-20 00:01 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-08-12 17:49 - 2011-03-25 21:05 - 00000000 ____D C:\Users\Linda\AppData\Roaming\DivX
2013-08-08 20:40 - 2013-08-08 20:40 - 00000000 ____D C:\Users\Linda\AppData\Local\Sony Corporation
2013-08-08 20:30 - 2013-06-27 22:10 - 00069632 ____R C:\Users\Linda\AppData\Roaming\skype.dat
2013-07-30 19:46 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\LiveKernelReports
Files to move or delete:
====================
C:\Users\Linda\AppData\Roaming\skype.dat
C:\Users\Linda\AppData\Roaming\skype.ini
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2012-09-12 19:45:39
Restore point made on: 2012-09-18 16:13:43
Restore point made on: 2012-10-15 20:24:21
Restore point made on: 2013-02-23 21:57:11
Restore point made on: 2013-03-23 21:36:13
Restore point made on: 2013-03-23 21:43:13
Restore point made on: 2013-07-24 21:10:28
Restore point made on: 2013-08-12 18:01:45
==================== Memory info ===========================
Percentage of memory in use: 15%
Total physical RAM: 3950.1 MB
Available physical RAM: 3322.25 MB
Total Pagefile: 3948.25 MB
Available Pagefile: 3319.3 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:287.07 GB) (Free:216.74 GB) NTFS
Drive e: (Recovery) (Fixed) (Total:10.92 GB) (Free:0.81 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: () (Removable) (Total:14.93 GB) (Free:8.32 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 27A40C51)
Partition 1: (Not Active) - (Size=11 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=287 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 817C5078)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0B)
LastRegBack: 2013-07-24 21:03
==================== End Of Log ============================
Zum Thema win 7 home premium, weisser Bildschirm - Guten Tag,
das Problem ist schnell geschildert: Anstatt des Desktops erscheint beim Windowsstart nur ein weisser Bildschirm. Fährt man den Rechner über strg-alt-entf herunter, sieht man noch kurz den normalen - win 7 home premium, weisser Bildschirm...
29.08.2013, 14:17
Baum-Darstellung