Liebes Forum,

ich habe ein kleines Problem. Mein Rechner startet nicht mehr richtig. Nach dem normalen Start-Procedere bekomme ich (nachdem die blaue Windows-Seite aufgegangen ist) einen rein schwarzen Bildschirm und nichts passiert. Ich kann die Maus noch sehen und bewegen, aber sonst nichts mehr. Den FRST-Scan habe ich natürlich gemacht, er hat das Ergebnis unten gebracht. Nun die Frage: Wer kann mir helfen? Ist es ein Hardware oder Software-Problem, habe ich einen löschbaren Virus oder kann ich die Festplatte wegwerfen?

Bitte um eine kurze Analyse, das wäre sehr hilfreich. Danke schön!

Hans

can result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-05-2014 01
Ran by SYSTEM on MININT-HCVL070 on 10-05-2014 10:17:01
Running from F:\
Windows 7 Professional (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PaperPort PTD] => C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-07-09] (Nuance Communications, Inc.)
HKLM\...\Run: [IndexSearch] => C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-07-09] (Nuance Communications, Inc.)
HKLM\...\Run: [BrMfcWnd] => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [DataCardMonitor] => C:\Program Files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe [253952 2011-04-24] (Huawei Technologies Co., Ltd.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [348664 2012-08-08] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Ocs_SM] => C:\Users\Hans\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-09-16] (OCS)
HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [186408 2013-12-12] (Geek Software GmbH)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-20] (Apple Inc.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [StatusAlerts] => C:\Program Files\HP\StatusAlerts\bin\HPStatusAlerts.exe [313656 2013-04-17] (Hewlett-Packard Company)
Winlogon\Notify\GoToAssist: C:\Program Files\Citrix\GoToAssist\615\G2AWinLogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
HKU\Hans\...\Run: [Updater shortcut] => C:\Program Files\T-Mobile\web'n'walk Manager\WTGU.exe [857544 2008-06-19] ()
HKU\Hans\...\Run: [MobileDocuments] => C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
HKU\Hans\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\Hans\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\Hans\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_12_0_0_77_Plugin.exe [841096 2014-03-15] (Adobe Systems Incorporated)
Startup: C:\Users\Hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> (No File)

========================== Services (Whitelisted) =================

Hi,

das Log ist unvollständig, bitte nochmal posten.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

• Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
• Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
• Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
• Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-05-2014 01
Ran by SYSTEM on MININT-HCVL070 on 10-05-2014 10:17:01
Running from F:\
Windows 7 Professional (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool 
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PaperPort PTD] => C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-07-09] (Nuance Communications, Inc.)
HKLM\...\Run: [IndexSearch] => C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-07-09] (Nuance Communications, Inc.)
HKLM\...\Run: [BrMfcWnd] => C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [DataCardMonitor] => C:\Program Files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe [253952 2011-04-24] (Huawei Technologies Co., Ltd.)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [348664 2012-08-08] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Ocs_SM] => C:\Users\Hans\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-09-16] (OCS)
HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [186408 2013-12-12] (Geek Software GmbH)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-20] (Apple Inc.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [StatusAlerts] => C:\Program Files\HP\StatusAlerts\bin\HPStatusAlerts.exe [313656 2013-04-17] (Hewlett-Packard Company)
Winlogon\Notify\GoToAssist: C:\Program Files\Citrix\GoToAssist\615\G2AWinLogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
HKU\Hans\...\Run: [Updater shortcut] => C:\Program Files\T-Mobile\web'n'walk Manager\WTGU.exe [857544 2008-06-19] ()
HKU\Hans\...\Run: [MobileDocuments] => C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
HKU\Hans\...\Run: [iCloudServices] => C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\Hans\...\Run: [ApplePhotoStreams] => C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\Hans\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\system32\Macromed\Flash\FlashUtil32_12_0_0_77_Plugin.exe [841096 2014-03-15] (Adobe Systems Incorporated)
Startup: C:\Users\Hans\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)

========================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86224 2012-05-10] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-10] (Avira Operations GmbH & Co. KG)
S2 Credential Vault Host Control Service; C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [812392 2009-06-25] (Broadcom Corporation)
S2 Credential Vault Host Storage; C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [26984 2009-06-25] (Broadcom Corporation)
S2 HP DS Service; C:\Program Files\HP\HPBDSService\HPBDSService.exe [13824 2011-10-17] (Hewlett-Packard Company)
S2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [174592 2012-12-04] (HP)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [235696 2014-01-15] (McAfee, Inc.)
S2 SearchAnonymizer; C:\Users\Hans\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2012-09-16] ()
S2 TwonkyMedia; C:\Program Files\TwonkyMedia\twonkymediaserverwatchdog.exe [472664 2010-07-28] (PacketVideo)

==================== Drivers (Whitelisted) ====================

S3 acpials; C:\Windows\System32\DRIVERS\acpials.sys [7680 2009-07-13] (Microsoft Corporation)
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [83392 2012-05-10] (Avira GmbH)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137928 2012-05-10] (Avira GmbH)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36000 2011-12-15] (Avira GmbH)
S3 cvusbdrv; C:\Windows\System32\Drivers\cvusbdrv.sys [33832 2009-06-25] (Broadcom Corporation)
S3 ivusb; C:\Windows\System32\DRIVERS\ivusb.sys [25112 2010-07-28] (Initio Corporation)
S0 PBADRV; C:\Windows\System32\DRIVERS\PBADRV.sys [26608 2008-06-04] (Dell Inc)
S1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-10 10:16 - 2014-05-10 10:17 - 00000000 ____D () C:\FRST
2014-05-01 11:32 - 2014-05-01 12:27 - 00000000 ____D () C:\Users\Hans\Documents\14 Buch
2014-05-01 10:58 - 2014-05-01 10:58 - 00000000 ____D () C:\Users\Hans\AppData\Local\WinZip
2014-04-23 03:43 - 2014-04-23 03:43 - 00000000 ____D () C:\Users\Hans\AppData\Local\HP

==================== One Month Modified Files and Folders =======

2014-05-10 10:17 - 2014-05-10 10:16 - 00000000 ____D () C:\FRST
2014-05-09 23:48 - 2012-01-22 09:10 - 00030054 _____ () C:\Windows\setupact.log
2014-05-08 22:52 - 2012-01-22 11:30 - 00102662 _____ () C:\Windows\PFRO.log
2014-05-01 12:27 - 2014-05-01 11:32 - 00000000 ____D () C:\Users\Hans\Documents\14 Buch
2014-05-01 12:27 - 2012-10-08 10:34 - 00000000 ____D () C:\ProgramData\twonkymedia
2014-05-01 12:27 - 2010-09-24 00:19 - 01832832 _____ () C:\Windows\WindowsUpdate.log
2014-05-01 12:27 - 2010-05-11 08:20 - 00000000 ___RD () C:\Users\Hans\Documents\My Dropbox
2014-05-01 11:36 - 2013-03-27 13:10 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2014-05-01 11:36 - 2012-01-22 08:26 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2014-05-01 11:20 - 2010-11-27 05:39 - 00000000 ____D () C:\Users\Hans\AppData\Roaming\Dropbox
2014-05-01 11:19 - 2014-04-05 01:55 - 00000000 ____D () C:\Users\Hans\AppData\Roaming\HpUpdate
2014-05-01 11:05 - 2010-09-24 00:26 - 01472002 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-05-01 11:02 - 2009-07-13 20:34 - 00014032 _____ () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-01 11:02 - 2009-07-13 20:34 - 00014032 _____ () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-01 11:01 - 2014-04-05 01:50 - 00000000 ____D () C:\ProgramData\HP
2014-05-01 10:58 - 2014-05-01 10:58 - 00000000 ____D () C:\Users\Hans\AppData\Local\WinZip
2014-05-01 10:53 - 2012-10-08 10:34 - 00000000 ____D () C:\Program Files\TwonkyMedia
2014-04-23 03:43 - 2014-04-23 03:43 - 00000000 ____D () C:\Users\Hans\AppData\Local\HP
2014-04-23 03:43 - 2010-11-27 05:41 - 00001029 _____ () C:\Users\Hans\Desktop\Dropbox.lnk
2014-04-23 03:40 - 2012-06-02 01:26 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-04-18 00:26 - 2014-03-30 02:24 - 00000000 ____D () C:\Program Files\Mozilla Firefox

Some content of TEMP:
====================
C:\Users\Hans\AppData\Local\Temp\AskSLib.dll
C:\Users\Hans\AppData\Local\Temp\CommonInstaller.exe
C:\Users\Hans\AppData\Local\Temp\contentDATs.exe
C:\Users\Hans\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpld79pw.dll
C:\Users\Hans\AppData\Local\Temp\mdm_z4_ext_82968648_5508.dll
C:\Users\Hans\AppData\Local\Temp\mdm_z4_ext_83755080_5772.dll
C:\Users\Hans\AppData\Local\Temp\mdm_z4_ext_83886152_4564.dll
C:\Users\Hans\AppData\Local\Temp\mdm_z4_ext_84017224_5240.dll
C:\Users\Hans\AppData\Local\Temp\mdm_z4_ext_84213832_1444.dll
C:\Users\Hans\AppData\Local\Temp\pdf24-creator-update.exe
C:\Users\Hans\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\Hans\AppData\Local\Temp\Setup.exe
C:\Users\Hans\AppData\Local\Temp\UNINSTALL.exe


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2013-06-01 00:25:55
Restore point made on: 2013-08-24 07:51:29
Restore point made on: 2013-10-06 05:25:00
Restore point made on: 2013-12-04 12:30:56
Restore point made on: 2013-12-21 11:25:25
Restore point made on: 2014-01-26 06:25:57
Restore point made on: 2014-03-15 23:05:58
Restore point made on: 2014-04-23 11:02:53

==================== Memory info =========================== 

Percentage of memory in use: 17%
Total physical RAM: 4047.9 MB
Available physical RAM: 3325.91 MB
Total Pagefile: 4046.18 MB
Available Pagefile: 3330.17 MB
Total Virtual: 2047.88 MB
Available Virtual: 1948.65 MB

==================== Drives ================================

Drive c: (int. HDD OS) (Fixed) (Total:231.86 GB) (Free:165.16 GB) NTFS
Drive f: () (Removable) (Total:0.96 GB) (Free:0.39 GB) FAT
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (RECOVERY) (Fixed) (Total:0.73 GB) (Free:0.53 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 30000000)
Partition 1: (Not Active) - (Size=298 MB) - (Type=DE)
Partition 2: (Active) - (Size=750 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=232 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 981 MB) (Disk ID: 00DB73B0)
Partition 1: (Active) - (Size=981 MB) - (Type=06)


LastRegBack: 2014-04-23 10:55

==================== End Of Log ============================
         

--- --- ---

Kein Malware Problem.

Hast Du mehrere Benutzerkonten und kannst in ein anderes normal booten? Geht in diesem der abgesicherte Modus?

Wenn alles mit nein beantwortet wird dann:

Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

LastRegBack: 2014-04-23 10:55
         

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

• Starte deinen Rechner erneut in die Reparaturoptionen
• Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.


Rechner normal starten.

Hallo Schrauber,

vielen Dank erst einmal für die Hilfe.
Leider klappt es noch immer nicht, es ist immer noch ein schwarzer Bildschirm.
Anbei die Angaben aus der Datei.
Wenn Du noch einen Hinweis hast, sehr gerne.
Danke.
Gruß

Hans


Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:09-05-2014 01
Ran by SYSTEM at 2014-05-11 16:22:29 Run:1
Running from F:\
Boot Mode: Recovery

==============================================

Content of fixlist:
*****************
LastRegBack: 2014-04-23 10:55
*****************

DEFAULT hive was successfully copied to System32\config\HiveBackup
DEFAULT hive was successfully restored from registry back up.
SAM hive was successfully copied to System32\config\HiveBackup
SAM hive was successfully restored from registry back up.
SECURITY hive was successfully copied to System32\config\HiveBackup
SECURITY hive was successfully restored from registry back up.
SOFTWARE hive was successfully copied to System32\config\HiveBackup
SOFTWARE hive was successfully restored from registry back up.
SYSTEM hive was successfully copied to System32\config\HiveBackup
SYSTEM hive was successfully restored from registry back up.

==== End of Fixlog ====

Noch ein Nachtrag: Es geht nach einiger Zeit ein Fenster auf, und der Computer sagt mir:

Die Anweisung bei "0x76182F34" verwies auf Speicher bei "0x76182F34". Die erforderlichen Daten wurden aufgrund eines E/A-Fehlers in "0xc0000185" incht an den Arbeitsspeicher übertragen. Klicken Sie auf Ok, um das Programm zu beenden.

Danach passiert auch nichts mehr.

Und meine Fragen oben mit dem mehreren Konten und Safe Mode?

Sonst seh ich da fast keine Option mehr noch was zu retten.

hallo,

nein, ich habe nicht mehr konten und der safe mode geht auch nicht.
wenn er hinüber ist, ist das sehr ärgerlich. kann ich zumindest meine dateien retten, etwa über den ausbau der festplatte?
danke für die hilfe erneut!

Ausbauen, für kleines Geld nen externes Gehäuse kaufen (meines at knapp 8 Euro bei Amazon gekostet) und an einen anderen Laptop mit USB hängen, fertig