|
Log-Analyse und Auswertung: Polizeivirus jetzt weißer BildschirmWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
29.10.2013, 14:14 | #1 |
| Polizeivirus jetzt weißer Bildschirm Hallo, habe einen Pc von einem Freund bekommen, der sich anscheinend einen Polizeivirus eingefangen hat. Jetzt wo ich den Pc habe ist jedoch nur noch ein weißer Bildschirm wenn ich beim Administrator-Benutzer einsteigen möchte bei den anderen Benutzern kann man ganz normal einsteigen. Könntet ihr mir bitte weiterhelfen? Vielen Dank im voraus basti2551 |
29.10.2013, 14:25 | #2 |
/// the machine /// TB-Ausbilder | Polizeivirus jetzt weißer Bildschirm hi,
__________________Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8) Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
__________________ |
29.10.2013, 14:46 | #3 |
| Polizeivirus jetzt weißer Bildschirm FRST Logfile:
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-10-2013 Ran by Depp (ATTENTION: The logged in user is not administrator) on MARTIN-PC on 29-10-2013 14:45:11 Running from C:\Users\Depp\Desktop Microsoft Windows 7 Home Premium (X86) OS Language: German Standard Internet Explorer Version 8 Boot Mode: Safe Mode (with Networking) ==================== Processes (Whitelisted) =================== ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9177632 2010-04-23] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1423904 2010-04-23] (Realtek Semiconductor) HKLM\...\Run: [HotkeyApp] - C:\Program Files\Launch Manager\HotkeyApp.exe [200704 2009-12-14] (Wistron) HKLM\...\Run: [LMgrVolOSD] - C:\Program Files\Launch Manager\OSD.exe [348960 2009-12-11] (Wistron Corp.) HKLM\...\Run: [LMgrOSD] - "C:\Program Files\Launch Manager\OSDCtrl.exe" HKLM\...\Run: [Wbutton] - C:\Program Files\Launch Manager\WButton.exe [413696 2010-01-13] (Wistron Corp.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-11] (Synaptics Incorporated) HKLM\...\Run: [CLMLServer] - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [VirtualCloneDrive] - C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [85160 2009-05-26] (Elaborate Bytes AG) HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] () HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2516296 2010-03-25] (CANON INC.) HKLM\...\Run: [CanonSolutionMenuEx] - C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.) HKLM\...\Run: [] - [x] HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [1568976 2012-06-20] (Ask) HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.) HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421776 2012-09-09] (Apple Inc.) MountPoints2: {b26e23ae-b8c9-11df-a22c-806e6f6e6963} - E:\sources\sperr32.exe x64 ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.orf.at/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.) BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files\Microsoft\BingBar\7.2.241.0\BingExt.dll (Microsoft Corporation.) Toolbar: HKCU - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 10.0.0.138 Chrome: ======= CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter} CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\24.0.1312.52\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\24.0.1312.52\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\24.0.1312.52\pdf.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Java Deployment Toolkit 6.0.200.2) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.) CHR Plugin: (Java(TM) Platform SE 6 U20) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.) CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Extension: (Docs) - C:\Users\Depp\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0 CHR Extension: (Google Drive) - C:\Users\Depp\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0 CHR Extension: (YouTube) - C:\Users\Depp\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0 CHR Extension: (Google Search) - C:\Users\Depp\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0 CHR Extension: (Gmail) - C:\Users\Depp\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0 ========================== Services (Whitelisted) ================= S2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] () S2 KMService; C:\Windows\system32\srvany.exe [8192 2010-11-10] () R2 lmhosts; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation) R2 NlaSvc; C:\Windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation) R2 nsi; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation) S2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [244904 2010-02-10] () S3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [118560 2009-10-23] (Wistron Corp.) ==================== Drivers (Whitelisted) ==================== S2 ACEDRV05; C:\Windows\system32\drivers\ACEDRV05.sys [97792 2011-01-17] (Protect Software GmbH) S2 ACEDRV07; C:\Windows\system32\drivers\ACEDRV07.sys [101376 2012-07-07] (Protect Software GmbH) S1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [24232 2009-02-17] (Elaborate Bytes AG) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2010-09-07] () ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-29 14:44 - 2013-10-29 14:44 - 00000000 ____D C:\FRST 2013-10-29 14:44 - 2013-10-28 06:22 - 01089183 _____ (Farbar) C:\Users\Depp\Desktop\FRST.exe 2013-10-29 14:02 - 2013-10-29 14:02 - 00003288 ____N C:\bootsqm.dat ==================== One Month Modified Files and Folders ======= 2013-10-29 14:44 - 2013-10-29 14:44 - 00000000 ____D C:\FRST 2013-10-29 14:43 - 2010-06-28 23:30 - 01507342 _____ C:\Windows\system32\PerfStringBackup.INI 2013-10-29 14:11 - 2009-07-14 05:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-29 14:11 - 2009-07-14 05:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-29 14:07 - 2010-09-05 09:41 - 01248244 _____ C:\Windows\WindowsUpdate.log 2013-10-29 14:05 - 2011-03-04 14:39 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-10-29 14:03 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-10-29 14:03 - 2009-07-14 05:39 - 00159564 _____ C:\Windows\setupact.log 2013-10-29 14:02 - 2013-10-29 14:02 - 00003288 ____N C:\bootsqm.dat 2013-10-28 21:40 - 2011-03-04 14:39 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-10-28 06:22 - 2013-10-29 14:44 - 01089183 _____ (Farbar) C:\Users\Depp\Desktop\FRST.exe 2013-10-19 07:00 - 2010-06-29 00:04 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-10-18 18:26 - 2010-11-10 18:02 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-10-13 02:38 - 2011-12-19 19:49 - 00000000 ____D C:\ProgramData\CanonIJPLM 2013-10-13 02:29 - 2013-03-09 18:45 - 00000000 ___RD C:\Program Files\Skype 2013-10-13 02:29 - 2012-06-10 09:43 - 00000000 ____D C:\ProgramData\Skype Files to move or delete: ==================== C:\ProgramData\l_0_00_re.pad Some content of TEMP: ==================== C:\Users\Depp\AppData\Local\Temp\AskSLib.dll ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ --- --- --- Das wäre das log. danke für deine schnelle Antwort Geändert von basti2551 (29.10.2013 um 15:42 Uhr) |
30.10.2013, 09:41 | #4 |
/// the machine /// TB-Ausbilder | Polizeivirus jetzt weißer Bildschirm Hi, Scan bitte wie oben beschrieben aus der Recovery machen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
30.10.2013, 15:51 | #5 |
| Polizeivirus jetzt weißer Bildschirm Oh sorry hier: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-10-2013 Ran by SYSTEM on MININT-TCIACG7 on 30-10-2013 15:49:26 Running from H:\ Windows 7 Home Premium (X86) OS Language: English(US) Internet Explorer Version 8 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log. ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9177632 2010-04-23] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1423904 2010-04-23] (Realtek Semiconductor) HKLM\...\Run: [HotkeyApp] - C:\Program Files\Launch Manager\HotkeyApp.exe [200704 2009-12-14] (Wistron) HKLM\...\Run: [LMgrVolOSD] - C:\Program Files\Launch Manager\OSD.exe [348960 2009-12-11] (Wistron Corp.) HKLM\...\Run: [LMgrOSD] - "C:\Program Files\Launch Manager\OSDCtrl.exe" HKLM\...\Run: [Wbutton] - C:\Program Files\Launch Manager\WButton.exe [413696 2010-01-13] (Wistron Corp.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-10] (Synaptics Incorporated) HKLM\...\Run: [CLMLServer] - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [VirtualCloneDrive] - C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [85160 2009-05-26] (Elaborate Bytes AG) HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] () HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2516296 2010-03-24] (CANON INC.) HKLM\...\Run: [CanonSolutionMenuEx] - C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.) HKLM\...\Run: [] - [x] HKLM\...\Run: [ApnUpdater] - C:\Program Files\Ask.com\Updater\Updater.exe [1568976 2012-06-20] (Ask) HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.) HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421776 2012-09-09] (Apple Inc.) HKU\ALLE\...\Run: [msnmsgr] - C:\Program Files\Windows Live\Messenger\msnmsgr.exe [ 2010-04-16] (Microsoft Corporation) HKU\ALLE\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2013-04-02] (Google Inc.) HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs HKU\Default User\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs HKU\Martin\...\Run: [OfficeSyncProcess] - C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [ 2013-04-22] (Microsoft Corporation) HKU\Martin\...\Run: [paac.exe] - C:\Users\Martin\AppData\Roaming\Nino\paac.exe HKU\Martin\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [ 2013-07-24] (Skype Technologies S.A.) HKU\Martin\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2013-04-02] (Google Inc.) HKU\Martin\...\Run: [Xytaz] - C:\Users\Martin\AppData\Roaming\Bunovy\nifex.exe HKU\Martin\...\Winlogon: [Shell] explorer.exe,C:\Users\Martin\AppData\Roaming\data.dat [ 2011-11-16] () <==== ATTENTION Startup: C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk ShortcutTarget: ctfmon.lnk -> C:\Users\Martin\AppData\Local\Temp\er_00_0_l.exe (No File) Startup: C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> (No File) Startup: C:\Users\Martin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ========================== Services (Whitelisted) ================= S2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] () S2 KMService; C:\Windows\system32\srvany.exe [8192 2010-11-10] () S2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [244904 2010-02-10] () S3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [118560 2009-10-22] (Wistron Corp.) ==================== Drivers (Whitelisted) ==================== S2 ACEDRV05; C:\Windows\system32\drivers\ACEDRV05.sys [97792 2011-01-17] (Protect Software GmbH) S2 ACEDRV07; C:\Windows\system32\drivers\ACEDRV07.sys [101376 2012-07-07] (Protect Software GmbH) S1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [24232 2009-02-17] (Elaborate Bytes AG) S0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2010-09-07] (Duplex Secure Ltd.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-29 05:45 - 2013-10-29 05:45 - 00016448 _____ C:\Users\Depp\Desktop\Addition.txt 2013-10-29 05:45 - 2013-10-29 05:45 - 00012477 _____ C:\Users\Depp\Desktop\FRST.txt 2013-10-29 05:44 - 2013-10-29 05:44 - 00000000 ____D C:\FRST 2013-10-29 05:44 - 2013-10-27 21:22 - 01089183 _____ (Farbar) C:\Users\Depp\Desktop\FRST.exe 2013-10-29 05:02 - 2013-10-29 05:02 - 00003288 ____N C:\bootsqm.dat 2013-10-12 17:45 - 2013-10-12 17:45 - 00000000 ____D C:\Users\ALLE\Documents\Martin 2013-10-12 17:37 - 2013-10-29 05:37 - 00000004 _____ C:\Users\Martin\AppData\Roaming\settings.ini ==================== One Month Modified Files and Folders ======= 2013-10-29 20:35 - 2010-09-05 00:41 - 01253392 _____ C:\Windows\WindowsUpdate.log 2013-10-29 05:45 - 2013-10-29 05:45 - 00016448 _____ C:\Users\Depp\Desktop\Addition.txt 2013-10-29 05:45 - 2013-10-29 05:45 - 00012477 _____ C:\Users\Depp\Desktop\FRST.txt 2013-10-29 05:45 - 2010-06-28 14:30 - 01507342 _____ C:\Windows\System32\PerfStringBackup.INI 2013-10-29 05:44 - 2013-10-29 05:44 - 00000000 ____D C:\FRST 2013-10-29 05:37 - 2013-10-12 17:37 - 00000004 _____ C:\Users\Martin\AppData\Roaming\settings.ini 2013-10-29 05:11 - 2009-07-13 20:34 - 00009920 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-29 05:11 - 2009-07-13 20:34 - 00009920 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-29 05:06 - 2013-07-17 07:14 - 00000000 ____D C:\Users\Martin\AppData\Roaming\Dropbox 2013-10-29 05:03 - 2009-07-13 20:39 - 00159564 _____ C:\Windows\setupact.log 2013-10-29 05:02 - 2013-10-29 05:02 - 00003288 ____N C:\bootsqm.dat 2013-10-28 11:28 - 2011-10-31 05:37 - 00000000 ____D C:\Users\ALLE\Tracing 2013-10-27 21:22 - 2013-10-29 05:44 - 01089183 _____ (Farbar) C:\Users\Depp\Desktop\FRST.exe 2013-10-18 22:00 - 2010-06-28 15:04 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-10-18 09:26 - 2010-11-10 09:02 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-10-12 17:48 - 2012-06-10 00:44 - 00000000 ____D C:\Users\Martin\AppData\Roaming\Skype 2013-10-12 17:47 - 2013-07-17 07:16 - 00000000 ___RD C:\Users\Martin\Dropbox 2013-10-12 17:45 - 2013-10-12 17:45 - 00000000 ____D C:\Users\ALLE\Documents\Martin 2013-10-12 17:43 - 2012-02-04 02:37 - 00000000 ____D C:\Users\ALLE\AppData\Local\Google 2013-10-12 17:38 - 2011-12-19 10:49 - 00000000 ____D C:\ProgramData\CanonIJPLM 2013-10-12 17:29 - 2013-03-09 09:45 - 00000000 ___RD C:\Program Files\Skype 2013-10-12 17:29 - 2012-06-10 00:43 - 00000000 ____D C:\ProgramData\Skype Files to move or delete: ==================== C:\Users\Martin\AppData\Roaming\data.dat C:\Users\Martin\AppData\Roaming\settings.ini C:\ProgramData\l_0_00_re.pad C:\Users\Martin\AppData\Roaming\i.ini Some content of TEMP: ==================== C:\Users\ALLE\AppData\Local\Temp\AskSLib.dll C:\Users\ALLE\AppData\Local\Temp\aua.exe C:\Users\Depp\AppData\Local\Temp\AskSLib.dll C:\Users\Martin\AppData\Local\Temp\ose00000.exe ==================== Known DLLs (Whitelisted) ============ ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= 15 Restore point made on: 2013-04-28 01:45:50 Restore point made on: 2013-05-19 00:10:32 Restore point made on: 2013-06-21 11:08:54 Restore point made on: 2013-07-12 13:40:18 Restore point made on: 2013-08-18 03:03:41 Restore point made on: 2013-08-24 00:57:47 Restore point made on: 2013-08-27 13:28:35 Restore point made on: 2013-08-30 05:36:40 Restore point made on: 2013-09-06 21:01:37 Restore point made on: 2013-09-15 11:18:22 Restore point made on: 2013-09-16 09:49:54 Restore point made on: 2013-09-22 10:08:25 Restore point made on: 2013-09-29 09:42:35 Restore point made on: 2013-10-12 17:40:17 Restore point made on: 2013-10-18 09:22:03 ==================== Memory info =========================== Percentage of memory in use: 16% Total physical RAM: 2934.6 MB Available physical RAM: 2450.43 MB Total Pagefile: 2932.88 MB Available Pagefile: 2453.91 MB Total Virtual: 2047.88 MB Available Virtual: 1951.12 MB ==================== Drives ================================ Drive c: (BOOT) (Fixed) (Total:424.66 GB) (Free:312.66 GB) NTFS Drive e: (Recover) (Fixed) (Total:40 GB) (Free:18.01 GB) NTFS Drive h: () (Removable) (Total:0.94 GB) (Free:0.17 GB) FAT Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: () (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 466 GB) (Disk ID: 49DC025F) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=425 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=40 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=1 GB) - (Type=12) ======================================================== Disk: 2 (Size: 962 MB) (Disk ID: 0137773A) Partition 1: (Active) - (Size=962 MB) - (Type=06) LastRegBack: 2013-06-21 10:57 ==================== End Of Log ============================ |
31.10.2013, 09:42 | #6 |
/// the machine /// TB-Ausbilder | Polizeivirus jetzt weißer Bildschirm Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\Martin\...\Winlogon: [Shell] explorer.exe,C:\Users\Martin\AppData\Roaming\data.dat [ 2011-11-16] () <==== ATTENTION C:\Users\Martin\AppData\Roaming\data.dat C:\Users\Martin\AppData\Roaming\settings.ini C:\ProgramData\l_0_00_re.pad C:\Users\Martin\AppData\Roaming\i.ini
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier. Rechner normal starten.
__________________ --> Polizeivirus jetzt weißer Bildschirm |
31.10.2013, 16:00 | #7 |
| Polizeivirus jetzt weißer Bildschirm Hier der log: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 28-10-2013 Ran by SYSTEM at 2013-10-31 15:56:01 Run:1 Running from H:\ Boot Mode: Recovery ============================================== Content of fixlist: ***************** HKU\Martin\...\Winlogon: [Shell] explorer.exe,C:\Users\Martin\AppData\Roaming\data.dat [ 2011-11-16] () <==== ATTENTION C:\Users\Martin\AppData\Roaming\data.dat C:\Users\Martin\AppData\Roaming\settings.ini C:\ProgramData\l_0_00_re.pad C:\Users\Martin\AppData\Roaming\i.ini ***************** HKU\Martin\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. C:\Users\Martin\AppData\Roaming\data.dat => Moved successfully. C:\Users\Martin\AppData\Roaming\settings.ini => Moved successfully. C:\ProgramData\l_0_00_re.pad => Moved successfully. "C:\Users\Martin\AppData\Roaming\i.ini" => File/Directory not found. ==== End of Fixlog ==== |
01.11.2013, 11:15 | #8 |
/// the machine /// TB-Ausbilder | Polizeivirus jetzt weißer Bildschirm Kontrollscans im normalen Modus: Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Polizeivirus jetzt weißer Bildschirm |
andere, anderen, benutzern, bildschirm, einsteigen, freund, polizeivirus, schei, weiterhelfen, weißer, weißer bildschirm |