Trojaner-Board - Bluescreen bei Start

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Bluescreen bei Start (https://www.trojaner-board.de/138553-bluescreen-start.html)

das beantwortet nicht meine Frage :)

Wie meinst du neu booten? Was muss ich da machen?

Rechner neu starten. Geht das jetzt?

Ne, hat sich leider nichts verändert.

Drücke bitte die

+ R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

Restore point made on: 2013-04-03 22:22:15

Speichere diese bitte als Fixlist.txt auf deinem USB Stick.

Starte deinen Rechner erneut in die Reparaturoptionen
Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 21-07-2013

Ran by SYSTEM at 2013-07-23 13:28:49 Run:2

Running from F:\

Boot Mode: Recovery
 

==============================================
 
 

==== End of Fixlog ====

Hat sich aber nichts verändert, bluescreen ist wie davor immer noch da.

Poste mal bitte ein frisches Scanlog mit FRST aus der recovery.

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-07-2013

Ran by SYSTEM on 23-07-2013 15:14:55

Running from F:\

Windows Vista (TM) Home Premium (X86) OS Language: German Standard

Internet Explorer Version 9

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.
 

==================== Registry (Whitelisted) ==================
 

HKU\Holzer\...\Run: [SmpcSys] - C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe [ 2007-07-19] (Packard Bell BV)

HKU\Holzer\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-19] (Microsoft Corporation)

HKU\Holzer\...\Run: [CollaborationHost] - C:\Windows\system32\p2phost.exe -s [ 2008-01-19] (Microsoft Corporation)

HKU\Holzer\...\Run: [EA Core] - "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent [x]

HKU\Holzer\...\Run: [ISUSPM] - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler [x]

HKU\Holzer\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)

HKU\Holzer\...\Run: [DAEMON Tools Lite] - "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun [x]
 

========================== Services (Whitelisted) =================
 

S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)

S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)

S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)

S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] ()

S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75064 2009-11-02] ()

S2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-03-06] ()

S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation)

S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
 

==================== Drivers (Whitelisted) ====================
 

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [279712 2011-01-08] ()

S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()

S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-08] ()

S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [36240 2007-09-21] (Logitech, Inc.)

S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28432 2007-09-21] (Logitech, Inc.)

S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)

S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)

S1 MpKsl6c2649cd; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E8BA73B3-4F15-4609-83E0-66D7577AF836}\MpKsl6c2649cd.sys [29904 2013-04-04] ()

S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [764520 2012-05-14] (Realtek Semiconductor Corporation                           )

S0 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-04-05] (Duplex Secure Ltd.)

S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)

S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)

S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)

S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]

S3 catchme; \??\C:\Users\Holzer\AppData\Local\Temp\catchme.sys [x]

S3 IpInIp; system32\DRIVERS\ipinip.sys [x]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

S3 pfc; system32\drivers\pfc.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-07-22 21:59 - 2013-07-22 21:59 - 00000000 ____D C:\Windows\System32\config\HiveBackup

2013-07-22 20:21 - 2013-07-22 20:21 - 00000000 ____D C:\FRST
 

==================== One Month Modified Files and Folders =======
 

2013-07-23 13:15 - 2013-02-14 19:10 - 154116324 _____ C:\Windows\MEMORY.DMP

2013-07-23 10:48 - 2008-01-03 04:16 - 00000000 ____D C:\ProgramData\NVIDIA

2013-07-23 10:48 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Public\Desktop

2013-07-23 10:48 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\System32\spool

2013-07-23 10:48 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\System32\Msdtc

2013-07-22 21:59 - 2013-07-22 21:59 - 00000000 ____D C:\Windows\System32\config\HiveBackup

2013-07-22 20:21 - 2013-07-22 20:21 - 00000000 ____D C:\FRST
 

==================== Known DLLs (Whitelisted) ============
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE ASSOCIATION =====================
 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK
 

==================== Restore Points  =========================

Das Log ist nicht komplett, poste es bitte nochmal :)

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-07-2013

Ran by SYSTEM on 23-07-2013 15:14:55

Running from F:\

Windows Vista (TM) Home Premium (X86) OS Language: German Standard

Internet Explorer Version 9

Boot Mode: Recovery
 

The current controlset is ControlSet001
 ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.
 

==================== Registry (Whitelisted) ==================
 

HKU\Holzer\...\Run: [SmpcSys] - C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe [ 2007-07-19] (Packard Bell BV)

HKU\Holzer\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-19] (Microsoft Corporation)

HKU\Holzer\...\Run: [CollaborationHost] - C:\Windows\system32\p2phost.exe -s [ 2008-01-19] (Microsoft Corporation)

HKU\Holzer\...\Run: [EA Core] - "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent [x]

HKU\Holzer\...\Run: [ISUSPM] - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler [x]

HKU\Holzer\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)

HKU\Holzer\...\Run: [DAEMON Tools Lite] - "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun [x]
 

========================== Services (Whitelisted) =================
 

S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)

S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)

S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)

S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] ()

S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75064 2009-11-02] ()

S2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-03-06] ()

S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation)

S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]
 

==================== Drivers (Whitelisted) ====================
 

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [279712 2011-01-08] ()

S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()

S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-08] ()

S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [36240 2007-09-21] (Logitech, Inc.)

S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28432 2007-09-21] (Logitech, Inc.)

S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)

S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)

S1 MpKsl6c2649cd; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E8BA73B3-4F15-4609-83E0-66D7577AF836}\MpKsl6c2649cd.sys [29904 2013-04-04] ()

S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [764520 2012-05-14] (Realtek Semiconductor Corporation                           )

S0 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-04-05] (Duplex Secure Ltd.)

S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)

S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)

S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)

S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]

S3 catchme; \??\C:\Users\Holzer\AppData\Local\Temp\catchme.sys [x]

S3 IpInIp; system32\DRIVERS\ipinip.sys [x]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]

S3 pfc; system32\drivers\pfc.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-07-22 21:59 - 2013-07-22 21:59 - 00000000 ____D C:\Windows\System32\config\HiveBackup

2013-07-22 20:21 - 2013-07-22 20:21 - 00000000 ____D C:\FRST
 

==================== One Month Modified Files and Folders =======
 

2013-07-23 13:15 - 2013-02-14 19:10 - 154116324 _____ C:\Windows\MEMORY.DMP

2013-07-23 10:48 - 2008-01-03 04:16 - 00000000 ____D C:\ProgramData\NVIDIA

2013-07-23 10:48 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Public\Desktop

2013-07-23 10:48 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\System32\spool

2013-07-23 10:48 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\System32\Msdtc

2013-07-22 21:59 - 2013-07-22 21:59 - 00000000 ____D C:\Windows\System32\config\HiveBackup

2013-07-22 20:21 - 2013-07-22 20:21 - 00000000 ____D C:\FRST
 

==================== Known DLLs (Whitelisted) ============
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 

==================== EXE ASSOCIATION =====================
 

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK
 

==================== Restore Points  =========================
 

Restore point made on: 2013-02-17 21:41:49

Restore point made on: 2013-02-18 10:36:54

Restore point made on: 2013-02-21 15:44:45

Restore point made on: 2013-02-24 19:09:01

Restore point made on: 2013-03-01 18:22:58

Restore point made on: 2013-03-04 21:59:29

Restore point made on: 2013-03-09 06:26:53

Restore point made on: 2013-03-11 17:10:55

Restore point made on: 2013-03-12 15:40:13

Restore point made on: 2013-03-12 17:12:40

Restore point made on: 2013-03-12 17:14:43

Restore point made on: 2013-03-12 17:15:10

Restore point made on: 2013-03-12 17:22:16

Restore point made on: 2013-03-14 16:02:56

Restore point made on: 2013-03-18 14:36:34

Restore point made on: 2013-03-21 19:17:31

Restore point made on: 2013-03-22 16:03:31

Restore point made on: 2013-03-27 06:43:22

Restore point made on: 2013-03-31 17:26:12

Restore point made on: 2013-04-03 22:22:15
 

==================== Memory info =========================== 
 

Percentage of memory in use: 14%

Total physical RAM: 3069.88 MB

Available physical RAM: 2635.98 MB

Total Pagefile: 2842.17 MB

Available Pagefile: 2677.25 MB

Total Virtual: 2047.88 MB

Available Virtual: 1979.12 MB
 

==================== Drives ================================
 

Drive c: (HDD) (Fixed) (Total:457.76 GB) (Free:61.71 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive e: (_OEMBP) (Fixed) (Total:8.01 GB) (Free:5.88 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive f: (HITMANPRO) (Removable) (Total:7.44 GB) (Free:7.44 GB) FAT32

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 5C70D25A)

Partition 1: (Not Active) - (Size=8 GB) - (Type=27)

Partition 2: (Active) - (Size=458 GB) - (Type=07 NTFS)
 

========================================================

Disk: 1 (Size: 7 GB) (Disk ID: DB90DBC7)

Partition 1: (Active) - (Size=7 GB) - (Type=0B)
 
 

LastRegBack: 2013-04-04 21:39
 

==================== End Of Log ============================

--- --- ---

Geh nochmal in die Recovery, starte aber kein FRST, sondern tippe

rstrui.exe

und drück Enter.

Der Befehl rstrul.exe konnte bei mir nicht gefunden werden.

Sorry, habs falsch eingegeben, jetzt hats geklappt. Jetzt bin ich bei der systemwiederherstellung gelandet, soll ich da nen wiederherstellungspunkt auswählen?

Konnte keine Systemwiederherstellung machen.

Der Vorgang ist aufgrund eines unbekannten Fehlers fehlgeschlagen.
Falscher Parameter. (0x80070057)

Und wenn ich einen wiederherstellungspunkt auswähle zeigt es mir bei jeden OEMBP (E:) und Boot (x:) Status: Der Datenträger ist am ausgewählten Wiederherstellungspunkt nicht vorhanden.

Also so langsam gehen mir die Ideen aus. ich würd alles formatieren un neu aufsetzen.