Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Bluescreen bei Start (https://www.trojaner-board.de/138553-bluescreen-start.html)

Amstaff3 21.07.2013 17:53
Bluescreen bei Start
 
Hallo zusammen,
Könnte mir vielleicht bitte jemand helfen?
Und zwar habe ich Windows Vista 32Bit und wenn ich meinen Computer starten will kommt für ein paar Sekunden ein Bluescreen und mein Computer startet dann wieder von neu, dies wiederholt sich dann ständig. Kann auch keine systemwiederherstellung mehr machen und komm auch nicht mehr in den abgesicherten Modus.
vielen dank schon im vorraus.
lg

schrauber 21.07.2013 18:03
hi,

was steht im Bluscreen?

Amstaff3 21.07.2013 18:23
Ich kann es leider nicht lesen weil es nach einer Sekunde wieder weg ist und sich der Computer wieder von neu startet aber es fängt mit "a Problem has been detectet...".
Danke schon mal im vorraus dass du mein Problem angenommen hast.
Gruß

schrauber 21.07.2013 21:15
Neu booten, schnell F8 drücken bis die Auswahl Abgesicherter Modus kommt.
Dann

"Automatischen Neustart bei Systemfehler deaktivieren"

auswählen und rebooten. Bluescreen sollte jetzt stehen bleiben. Foto oder abtippen :)

Amstaff3 21.07.2013 22:11
A problem has been detected and Windows has been shut down to prevent damage to your Computer.

A process or thread crucial to system operation has unexpectedly exited or been terminated.

If this is the first time you've seen this stop error Screen, restart your Computer. If this Screen appears again, follow These steps:

Check to make sure any new Hardware or Software is properly installed.
if this a new Installation, ask your Hardware or Software manufacturer for any Windows updates you might Need.

If Problems continue, disable or remove any newly installed Hardware or Software. Disable BIOS Memory Options such as Caching or shadowing. If you Need to use Safe Mode to remove or disable components, restart your Computer, press f8 to select Advance Startup Options, and then select Safe Mode.

Technical Information:

*** STOP: 0x000000F4 (0x00000003,0x884D9AD8,0x884D9C24,0x8202AA40)


Collecting data for Crash dump ...
Initializing disk for Crash dump ...
Beginning dump of physikal Memory.
Dumping physical Memory to disk: 100
Physikal Memory dump complete.
contact your System admin or technical Support Group for further assistance.

schrauber 22.07.2013 09:05
Klasse, der gängigste Bluescreen den man haben kann :)

Irgendwas am System geändert (Hard oder Software)?
Seit wann genau ist das so?
Geht auch kein Safe Mode (keiner der 3)?
Letzte als funktionierend bekannte Version geht auch nicht?

Amstaff3 22.07.2013 09:41
Hi,
Ne, hab nichts am System geändert, ich hatte mal vor ungefähr nen halben Jahr einen Polizeitrojaner, kann es mit dem zusammenhängen?
War auf einer nicht gerade sicheren Seite, dann hat sich mein Computer ausgeschaltet und seitdem habe ich das Problem mit dem Bluescreen.
Ne, geht kein safe mode und auch keine letzte als bekannte funktionierende Version, kann auch keine Systemreperatur oder systemwiederherstellung mehr machen.

schrauber 22.07.2013 10:49
Wenn Du von Windows DVD startest geht keine Systemreparatur? Oder läuft sie und schlägt fehl?

Bis wohin bootet er denn bis der Bluescreen kommt?

Amstaff3 22.07.2013 11:38
Sorry, meinte systemstartreparatur, ne Windows dvd hab ich leider nicht da.
Der bluescreen kommt bevor das anmeldefenster erscheint.

schrauber 22.07.2013 13:37
Hi,

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST Download FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Ja und klicke Untersuchen
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).


Amstaff3 22.07.2013 19:24
Mein Rechner kann kein Boot von einem usb-stick machen, gibts da noch eine andere möglichkeit?


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-07-2013
Ran by SYSTEM on 22-07-2013 20:21:36
Running from F:\
Windows Vista (TM) Home Premium (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKU\Holzer\...\Run: [SmpcSys] - C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe [ 2007-07-19] (Packard Bell BV)
HKU\Holzer\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-19] (Microsoft Corporation)
HKU\Holzer\...\Run: [CollaborationHost] - C:\Windows\system32\p2phost.exe -s [ 2008-01-19] (Microsoft Corporation)
HKU\Holzer\...\Run: [EA Core] - "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent [x]
HKU\Holzer\...\Run: [ISUSPM] - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler [x]
HKU\Holzer\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
HKU\Holzer\...\Run: [DAEMON Tools Lite] - "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun [x]

========================== Services (Whitelisted) =================

S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] ()
S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75064 2009-11-02] ()
S2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-03-06] ()
S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation)
S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [279712 2011-01-08] ()
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-08] ()
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [36240 2007-09-21] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28432 2007-09-21] (Logitech, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
S1 MpKsl6c2649cd; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E8BA73B3-4F15-4609-83E0-66D7577AF836}\MpKsl6c2649cd.sys [29904 2013-04-04] ()
S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [764520 2012-05-14] (Realtek Semiconductor Corporation                          )
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-04-05] (Duplex Secure Ltd.)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Holzer\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 pfc; system32\drivers\pfc.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-22 20:21 - 2013-07-22 20:21 - 00000000 ____D C:\FRST

==================== One Month Modified Files and Folders =======

2013-07-22 20:21 - 2013-07-22 20:21 - 00000000 ____D C:\FRST
2013-07-22 18:55 - 2013-02-14 19:10 - 151961828 _____ C:\Windows\MEMORY.DMP

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-02-17 21:41:49
Restore point made on: 2013-02-18 10:36:54
Restore point made on: 2013-02-21 15:44:45
Restore point made on: 2013-02-24 19:09:01
Restore point made on: 2013-03-01 18:22:58
Restore point made on: 2013-03-04 21:59:29
Restore point made on: 2013-03-09 06:26:53
Restore point made on: 2013-03-11 17:10:55
Restore point made on: 2013-03-12 15:40:13
Restore point made on: 2013-03-12 17:12:40
Restore point made on: 2013-03-12 17:14:43
Restore point made on: 2013-03-12 17:15:10
Restore point made on: 2013-03-12 17:22:16
Restore point made on: 2013-03-14 16:02:56
Restore point made on: 2013-03-18 14:36:34
Restore point made on: 2013-03-21 19:17:31
Restore point made on: 2013-03-22 16:03:31
Restore point made on: 2013-03-27 06:43:22
Restore point made on: 2013-03-31 17:26:12
Restore point made on: 2013-04-03 22:22:15

==================== Memory info ===========================

Percentage of memory in use: 14%
Total physical RAM: 3069.88 MB
Available physical RAM: 2632.5 MB
Total Pagefile: 2842.17 MB
Available Pagefile: 2675.86 MB
Total Virtual: 2047.88 MB
Available Virtual: 1972.5 MB

==================== Drives ================================

Drive c: (HDD) (Fixed) (Total:457.76 GB) (Free:61.76 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (22 Jul 2013) (CDROM) (Total:0.69 GB) (Free:0.66 GB) UDF
Drive e: (_OEMBP) (Fixed) (Total:8.01 GB) (Free:5.88 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HITMANPRO) (Removable) (Total:7.44 GB) (Free:7.44 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 5C70D25A)
Partition 1: (Not Active) - (Size=8 GB) - (Type=27)
Partition 2: (Active) - (Size=458 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7 GB) (Disk ID: DB90DBC7)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)


LastRegBack: 2013-04-04 21:39

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Hat doch geklappt.

schrauber 22.07.2013 20:32
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
LastRegBack: 2013-04-04 21:39

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


Amstaff3 22.07.2013 21:01
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 21-07-2013
Ran by SYSTEM at 2013-07-22 21:59:10 Run:1
Running from J:\
Boot Mode: Recovery

==============================================

DEFAULT hive was successfully copied to System32\config\HiveBackup
DEFAULT hive was successfully restored from registry back up.
SAM hive was successfully copied to System32\config\HiveBackup
SAM hive was successfully restored from registry back up.
SECURITY hive was successfully copied to System32\config\HiveBackup
SECURITY hive was successfully restored from registry back up.
SOFTWARE hive was successfully copied to System32\config\HiveBackup
SOFTWARE hive was successfully restored from registry back up.
SYSTEM hive was successfully copied to System32\config\HiveBackup
SYSTEM hive was successfully restored from registry back up.

==== End of Fixlog ====

schrauber 23.07.2013 08:54
kannst neu booten?

Amstaff3 23.07.2013 09:29

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-07-2013
Ran by SYSTEM on 23-07-2013 10:21:55
Running from F:\
Windows Vista (TM) Home Premium (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKU\Holzer\...\Run: [SmpcSys] - C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe [ 2007-07-19] (Packard Bell BV)
HKU\Holzer\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-19] (Microsoft Corporation)
HKU\Holzer\...\Run: [CollaborationHost] - C:\Windows\system32\p2phost.exe -s [ 2008-01-19] (Microsoft Corporation)
HKU\Holzer\...\Run: [EA Core] - "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent [x]
HKU\Holzer\...\Run: [ISUSPM] - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler [x]
HKU\Holzer\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
HKU\Holzer\...\Run: [DAEMON Tools Lite] - "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun [x]

========================== Services (Whitelisted) =================

S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] ()
S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75064 2009-11-02] ()
S2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-03-06] ()
S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation)
S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [279712 2011-01-08] ()
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-08] ()
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [36240 2007-09-21] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28432 2007-09-21] (Logitech, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
S1 MpKsl6c2649cd; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E8BA73B3-4F15-4609-83E0-66D7577AF836}\MpKsl6c2649cd.sys [29904 2013-04-04] ()
S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [764520 2012-05-14] (Realtek Semiconductor Corporation                          )
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-04-05] (Duplex Secure Ltd.)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Holzer\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 pfc; system32\drivers\pfc.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-22 21:59 - 2013-07-22 21:59 - 00000000 ____D C:\Windows\System32\config\HiveBackup
2013-07-22 20:21 - 2013-07-22 20:21 - 00000000 ____D C:\FRST

==================== One Month Modified Files and Folders =======

2013-07-23 09:16 - 2013-02-14 19:10 - 174661860 _____ C:\Windows\MEMORY.DMP
2013-07-22 21:59 - 2013-07-22 21:59 - 00000000 ____D C:\Windows\System32\config\HiveBackup
2013-07-22 20:21 - 2013-07-22 20:21 - 00000000 ____D C:\FRST

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-02-17 21:41:49
Restore point made on: 2013-02-18 10:36:54
Restore point made on: 2013-02-21 15:44:45
Restore point made on: 2013-02-24 19:09:01
Restore point made on: 2013-03-01 18:22:58
Restore point made on: 2013-03-04 21:59:29
Restore point made on: 2013-03-09 06:26:53
Restore point made on: 2013-03-11 17:10:55
Restore point made on: 2013-03-12 15:40:13
Restore point made on: 2013-03-12 17:12:40
Restore point made on: 2013-03-12 17:14:43
Restore point made on: 2013-03-12 17:15:10
Restore point made on: 2013-03-12 17:22:16
Restore point made on: 2013-03-14 16:02:56
Restore point made on: 2013-03-18 14:36:34
Restore point made on: 2013-03-21 19:17:31
Restore point made on: 2013-03-22 16:03:31
Restore point made on: 2013-03-27 06:43:22
Restore point made on: 2013-03-31 17:26:12
Restore point made on: 2013-04-03 22:22:15

==================== Memory info ===========================

Percentage of memory in use: 15%
Total physical RAM: 3069.88 MB
Available physical RAM: 2592.8 MB
Total Pagefile: 2842.17 MB
Available Pagefile: 2639.38 MB
Total Virtual: 2047.88 MB
Available Virtual: 1978.13 MB

==================== Drives ================================

Drive c: (HDD) (Fixed) (Total:457.76 GB) (Free:61.69 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (_OEMBP) (Fixed) (Total:8.01 GB) (Free:5.88 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HITMANPRO) (Removable) (Total:7.44 GB) (Free:7.44 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 5C70D25A)
Partition 1: (Not Active) - (Size=8 GB) - (Type=27)
Partition 2: (Active) - (Size=458 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7 GB) (Disk ID: DB90DBC7)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)


LastRegBack: 2013-04-04 21:39

==================== End Of Log ============================
--- --- ---

schrauber 23.07.2013 09:48
das beantwortet nicht meine Frage :)

Amstaff3 23.07.2013 09:50
Wie meinst du neu booten? Was muss ich da machen?

schrauber 23.07.2013 09:53
Rechner neu starten. Geht das jetzt?

Amstaff3 23.07.2013 09:57
Ne, hat sich leider nichts verändert.

schrauber 23.07.2013 11:44
Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
Restore point made on: 2013-04-03 22:22:15
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Amstaff3 23.07.2013 12:52
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 21-07-2013
Ran by SYSTEM at 2013-07-23 13:28:49 Run:2
Running from F:\
Boot Mode: Recovery

==============================================


==== End of Fixlog ====
Hat sich aber nichts verändert, bluescreen ist wie davor immer noch da.

schrauber 23.07.2013 14:04
Poste mal bitte ein frisches Scanlog mit FRST aus der recovery.

Amstaff3 23.07.2013 14:15
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-07-2013
Ran by SYSTEM on 23-07-2013 15:14:55
Running from F:\
Windows Vista (TM) Home Premium (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKU\Holzer\...\Run: [SmpcSys] - C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe [ 2007-07-19] (Packard Bell BV)
HKU\Holzer\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-19] (Microsoft Corporation)
HKU\Holzer\...\Run: [CollaborationHost] - C:\Windows\system32\p2phost.exe -s [ 2008-01-19] (Microsoft Corporation)
HKU\Holzer\...\Run: [EA Core] - "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent [x]
HKU\Holzer\...\Run: [ISUSPM] - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler [x]
HKU\Holzer\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
HKU\Holzer\...\Run: [DAEMON Tools Lite] - "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun [x]

========================== Services (Whitelisted) =================

S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] ()
S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75064 2009-11-02] ()
S2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-03-06] ()
S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation)
S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [279712 2011-01-08] ()
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-08] ()
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [36240 2007-09-21] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28432 2007-09-21] (Logitech, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
S1 MpKsl6c2649cd; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E8BA73B3-4F15-4609-83E0-66D7577AF836}\MpKsl6c2649cd.sys [29904 2013-04-04] ()
S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [764520 2012-05-14] (Realtek Semiconductor Corporation                          )
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-04-05] (Duplex Secure Ltd.)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Holzer\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 pfc; system32\drivers\pfc.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-22 21:59 - 2013-07-22 21:59 - 00000000 ____D C:\Windows\System32\config\HiveBackup
2013-07-22 20:21 - 2013-07-22 20:21 - 00000000 ____D C:\FRST

==================== One Month Modified Files and Folders =======

2013-07-23 13:15 - 2013-02-14 19:10 - 154116324 _____ C:\Windows\MEMORY.DMP
2013-07-23 10:48 - 2008-01-03 04:16 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-23 10:48 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Public\Desktop
2013-07-23 10:48 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\System32\spool
2013-07-23 10:48 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\System32\Msdtc
2013-07-22 21:59 - 2013-07-22 21:59 - 00000000 ____D C:\Windows\System32\config\HiveBackup
2013-07-22 20:21 - 2013-07-22 20:21 - 00000000 ____D C:\FRST

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

schrauber 23.07.2013 18:41
Das Log ist nicht komplett, poste es bitte nochmal :)

Amstaff3 23.07.2013 18:55

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-07-2013
Ran by SYSTEM on 23-07-2013 15:14:55
Running from F:\
Windows Vista (TM) Home Premium (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKU\Holzer\...\Run: [SmpcSys] - C:\Program Files\Packard Bell\SetUpMyPC\SmpSys.exe [ 2007-07-19] (Packard Bell BV)
HKU\Holzer\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-19] (Microsoft Corporation)
HKU\Holzer\...\Run: [CollaborationHost] - C:\Windows\system32\p2phost.exe -s [ 2008-01-19] (Microsoft Corporation)
HKU\Holzer\...\Run: [EA Core] - "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent [x]
HKU\Holzer\...\Run: [ISUSPM] - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler [x]
HKU\Holzer\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [ 2009-04-02] (Samsung Electronics Co., Ltd.)
HKU\Holzer\...\Run: [DAEMON Tools Lite] - "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun [x]

========================== Services (Whitelisted) =================

S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [20456 2013-01-27] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [295232 2013-01-27] (Microsoft Corporation)
S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] ()
S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75064 2009-11-02] ()
S2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [266343 2007-03-06] ()
S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation)
S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [x]

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [279712 2011-01-08] ()
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] ()
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-08] ()
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [36240 2007-09-21] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28432 2007-09-21] (Logitech, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [21104 2012-12-14] (Malwarebytes Corporation)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [195296 2013-01-20] (Microsoft Corporation)
S1 MpKsl6c2649cd; c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E8BA73B3-4F15-4609-83E0-66D7577AF836}\MpKsl6c2649cd.sys [29904 2013-04-04] ()
S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [764520 2012-05-14] (Realtek Semiconductor Corporation                          )
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-04-05] (Duplex Secure Ltd.)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x]
S3 catchme; \??\C:\Users\Holzer\AppData\Local\Temp\catchme.sys [x]
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 pfc; system32\drivers\pfc.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-22 21:59 - 2013-07-22 21:59 - 00000000 ____D C:\Windows\System32\config\HiveBackup
2013-07-22 20:21 - 2013-07-22 20:21 - 00000000 ____D C:\FRST

==================== One Month Modified Files and Folders =======

2013-07-23 13:15 - 2013-02-14 19:10 - 154116324 _____ C:\Windows\MEMORY.DMP
2013-07-23 10:48 - 2008-01-03 04:16 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-23 10:48 - 2006-11-02 12:18 - 00000000 __RHD C:\Users\Public\Desktop
2013-07-23 10:48 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\System32\spool
2013-07-23 10:48 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\System32\Msdtc
2013-07-22 21:59 - 2013-07-22 21:59 - 00000000 ____D C:\Windows\System32\config\HiveBackup
2013-07-22 20:21 - 2013-07-22 20:21 - 00000000 ____D C:\FRST

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-02-17 21:41:49
Restore point made on: 2013-02-18 10:36:54
Restore point made on: 2013-02-21 15:44:45
Restore point made on: 2013-02-24 19:09:01
Restore point made on: 2013-03-01 18:22:58
Restore point made on: 2013-03-04 21:59:29
Restore point made on: 2013-03-09 06:26:53
Restore point made on: 2013-03-11 17:10:55
Restore point made on: 2013-03-12 15:40:13
Restore point made on: 2013-03-12 17:12:40
Restore point made on: 2013-03-12 17:14:43
Restore point made on: 2013-03-12 17:15:10
Restore point made on: 2013-03-12 17:22:16
Restore point made on: 2013-03-14 16:02:56
Restore point made on: 2013-03-18 14:36:34
Restore point made on: 2013-03-21 19:17:31
Restore point made on: 2013-03-22 16:03:31
Restore point made on: 2013-03-27 06:43:22
Restore point made on: 2013-03-31 17:26:12
Restore point made on: 2013-04-03 22:22:15

==================== Memory info ===========================

Percentage of memory in use: 14%
Total physical RAM: 3069.88 MB
Available physical RAM: 2635.98 MB
Total Pagefile: 2842.17 MB
Available Pagefile: 2677.25 MB
Total Virtual: 2047.88 MB
Available Virtual: 1979.12 MB

==================== Drives ================================

Drive c: (HDD) (Fixed) (Total:457.76 GB) (Free:61.71 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (_OEMBP) (Fixed) (Total:8.01 GB) (Free:5.88 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HITMANPRO) (Removable) (Total:7.44 GB) (Free:7.44 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 5C70D25A)
Partition 1: (Not Active) - (Size=8 GB) - (Type=27)
Partition 2: (Active) - (Size=458 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7 GB) (Disk ID: DB90DBC7)
Partition 1: (Active) - (Size=7 GB) - (Type=0B)


LastRegBack: 2013-04-04 21:39

==================== End Of Log ============================
--- --- ---

schrauber 23.07.2013 19:18
Geh nochmal in die Recovery, starte aber kein FRST, sondern tippe

rstrui.exe

und drück Enter.

Amstaff3 23.07.2013 19:39
Der Befehl rstrul.exe konnte bei mir nicht gefunden werden.

Sorry, habs falsch eingegeben, jetzt hats geklappt. Jetzt bin ich bei der systemwiederherstellung gelandet, soll ich da nen wiederherstellungspunkt auswählen?

schrauber 23.07.2013 20:58
genau :)

Amstaff3 23.07.2013 22:24
Konnte keine Systemwiederherstellung machen.

Der Vorgang ist aufgrund eines unbekannten Fehlers fehlgeschlagen.
Falscher Parameter. (0x80070057)

Und wenn ich einen wiederherstellungspunkt auswähle zeigt es mir bei jeden OEMBP (E:) und Boot (x:) Status: Der Datenträger ist am ausgewählten Wiederherstellungspunkt nicht vorhanden.

schrauber 24.07.2013 11:08
Also so langsam gehen mir die Ideen aus. ich würd alles formatieren un neu aufsetzen.

Amstaff3 24.07.2013 11:39
Und wie mach ich das am besten?
Wie man merkt hab ich nicht recht viel Ahnung von Computer. :-)

schrauber 24.07.2013 11:57
Von der Windows DVD booten und neu installieren, dabei vorher die Platte formatieren. Deine Daten sind dann aber weg.


Alle Zeitangaben in WEZ +1. Es ist jetzt 04:13 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19