Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   0x000000F4 Bluescreen beim Starten von Laptop (https://www.trojaner-board.de/166189-0x000000f4-bluescreen-beim-starten-laptop.html)

Tiepolo 17.04.2015 13:30
0x000000F4 Bluescreen beim Starten von Laptop
 
Eine Kollegin brachte mir gestern völlig fertig ihr Arbeitslaptop mit wichtigen Dateien, da dieser schon beim Start von Windows einen Bluescreen mit dem Fehler 0x000000F4 verursacht.
Ich habe schon eine Systemwiederherstellung versucht, die ist leider nicht möglich, da alle Wiederherstellungsdateien angeblich beschädigt sind.

Außerdem habe ich versucht, eine Scan Datei mit dem Tool Farbar Recovery Scan Tool zu erstellen.
Leider kommt sowohl bei Version x86 als auch bei Version x64 ein Fehler beim Start vom USB Stick.
x86: "Das zum Unterstützen des Abbildtyps erforderliche Subsystem ist nicht vorhanden."
x64: "Die Version von G:/frst64.exe ist nicht mit der ausgeführten Windows Version kompatibel. [...]"

Leider weiß ich jetzt nicht weiter. Hoffe mir kann wer helfen, da sie wirklich wichtige Finanzdaten auf der Festplatte hat.

Vielen Dank, Grüße :)

schrauber 17.04.2015 13:33
Hi,

geht einer der Safe Modes?

Tiepolo 17.04.2015 13:35
Hallo, leider kann ich auch nicht im abgesicherten Modus starten. Gleicher Bluescreen. Auch die Systemreperatur findet keine Fehler.

schrauber 18.04.2015 07:55
Wie hast Du FRST vom Stick ausgeführt? Über Computer reparieren oder über die DVD?? FRST vom Stick, von Aussen, muss eigentlich immer gehen.



Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST Download FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Ja und klicke Untersuchen
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).


Tiepolo 18.04.2015 11:27
Ah wunderbar. ich habe es jetzt nochmal von einem anderen USB-Stick versucht und siehe da, mit der 64er geht es auf einmal. Hier das Ergebnis:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-04-2015 04
Ran by SYSTEM on MININT-DHG8V21 on 18-04-2015 12:24:17
Running from g:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12452456 2012-02-21] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-02-08] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [1021056 2012-03-08] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [800896 2012-03-08] (Atheros Commnucations)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2886416 2012-03-01] (Synaptics Incorporated)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)
HKLM\...\Run: [InstantUpdate] => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe [124520 2012-04-06] ()
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-01-26] (Apple Inc.)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-05] (NTI Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-03-23] (Dritek System Inc.)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-03-12] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-01-20] (Apple Inc.)
HKLM-x32\...\Run: [ApnUpdater] => C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1648056 2014-01-31] (Ask)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-03-31] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-01] (Oracle Corporation)
HKLM-x32\...\Run: [Syncios device service] => C:\Program Files (x86)\Syncios\SynciosDeviceService.exe [734720 2014-03-27] ()
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [296960 2015-02-02] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Default\...\RunOnce: [ScrSav] => C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162408 2011-09-12] ()
HKU\Default\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Acer.scr [450048 2011-09-12] ()
HKU\Default User\...\RunOnce: [ScrSav] => C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162408 2011-09-12] ()
HKU\Default User\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Acer.scr [450048 2011-09-12] ()
HKU\Meine\...\Run: [winsr] => -autorun
HKU\Meine\...\Run: [logonsc] => "C:\Users\Meine\AppData\Roaming\logonsc.exe" -autorun
HKU\Meine\...\Run: [playl] => -autorun
HKU\Meine\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-12-25] (Google Inc.)
HKU\Meine\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\Meine\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.)
HKU\Meine\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-11-21] (Apple Inc.)
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [220480 2014-06-23] (Client Connect LTD)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [181568 2014-06-23] (Client Connect LTD)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-03-31] (Avira Operations GmbH & Co. KG)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-03-31] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-03-31] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1004032 2015-03-31] (Avira Operations GmbH & Co. KG)
S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [2497856 2014-05-22] ()
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-03-16] ()
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-16] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S2 ZAtheros Wlan Agent; C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe [76960 2012-02-27] (Atheros)
S3 EFS; %SystemRoot%\System32\lsass.exe [X]
S3 KeyIso; %SystemRoot%\system32\lsass.exe [X]
S3 Netlogon; %systemroot%\system32\lsass.exe [X]
S3 ProtectedStorage; %SystemRoot%\system32\lsass.exe [X]
S2 SamSs; %SystemRoot%\system32\lsass.exe [X]
S3 VaultSvc; %SystemRoot%\system32\lsass.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-04] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-04] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S5 volmgrx; C:\Windows\System32\Drivers\volmgrx.sys [363392 2010-11-20] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-18 12:24 - 2015-04-18 12:24 - 00000000 ____D () C:\FRST
2015-04-15 23:13 - 2015-04-17 04:43 - 341382300 _____ () C:\Windows\MEMORY.DMP
2015-04-15 22:45 - 2015-04-15 22:45 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-04-15 22:45 - 2015-04-15 22:45 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-14 22:12 - 2015-03-16 21:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\apisetschema.dll
2015-04-14 22:11 - 2015-03-03 20:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\System32\clfs.sys
2015-04-14 22:11 - 2015-03-03 20:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\System32\clfsw32.dll
2015-04-14 22:11 - 2015-03-03 20:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-14 22:11 - 2015-02-24 19:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\http.sys
2015-04-07 07:42 - 2015-04-07 07:42 - 00000000 ____D () C:\Users\Meine\AppData\Local\elfopatch
2015-04-06 22:11 - 2015-04-06 22:11 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-06 22:11 - 2015-04-06 22:11 - 00000000 ___SD () C:\Windows\System32\GWX
2015-03-29 03:42 - 2015-04-15 05:01 - 00003136 _____ () C:\Windows\System32\Tasks\Registry Optimizer
2015-03-24 22:36 - 2015-03-10 20:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\System32\appraiser.dll
2015-03-24 22:36 - 2015-03-10 20:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\System32\invagent.dll
2015-03-24 22:36 - 2015-03-10 20:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2015-03-24 22:36 - 2015-03-10 20:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\System32\devinv.dll
2015-03-24 22:36 - 2015-03-10 20:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2015-03-24 22:36 - 2015-03-10 20:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\System32\aepic.dll
2015-03-24 22:36 - 2015-03-10 20:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\acmigration.dll
2015-03-24 22:36 - 2015-03-10 20:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-15 22:50 - 2012-06-21 21:13 - 01102253 _____ () C:\Windows\WindowsUpdate.log
2015-04-15 22:49 - 2012-08-31 10:36 - 01596540 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-04-15 22:49 - 2012-06-22 07:00 - 00700126 _____ () C:\Windows\System32\perfh007.dat
2015-04-15 22:49 - 2012-06-22 07:00 - 00149976 _____ () C:\Windows\System32\perfc007.dat
2015-04-15 22:48 - 2009-07-13 21:13 - 01596540 _____ () C:\Windows\System32\PerfStringBackup.INI
2015-04-15 22:46 - 2012-03-28 10:36 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-15 22:45 - 2012-03-28 11:18 - 00000000 ____D () C:\ProgramData\Skype
2015-04-15 22:44 - 2014-11-18 10:45 - 00000000 ____D () C:\Windows\System32\MRT
2015-04-15 22:42 - 2012-12-25 03:12 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-15 22:29 - 2012-12-25 03:12 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-15 22:17 - 2014-11-18 10:45 - 128913832 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2015-04-15 22:11 - 2012-09-02 10:43 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{3C3C0857-0064-4DEE-A512-626EF233EBCC}
2015-04-15 09:32 - 2012-06-21 21:20 - 00000830 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2015-04-15 05:01 - 2014-04-08 21:53 - 00000296 _____ () C:\Windows\Tasks\Registry Optimizer_DEFAULT.job
2015-04-15 03:46 - 2012-03-28 10:36 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-15 03:46 - 2012-03-28 10:36 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-15 03:46 - 2012-03-28 10:36 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-14 21:53 - 2014-04-08 21:53 - 00000304 _____ () C:\Windows\Tasks\Registry Optimizer_UPDATES.job
2015-04-13 23:02 - 2009-07-13 20:45 - 00031248 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-13 23:02 - 2009-07-13 20:45 - 00031248 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-12 03:37 - 2012-08-31 09:18 - 00000000 ____D () C:\Users\Meine\AppData\Local\CrashDumps
2015-04-12 01:51 - 2014-12-26 11:19 - 00000000 ___RD () C:\Users\Meine\iCloudDrive
2015-04-12 01:50 - 2012-06-21 21:20 - 00000828 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2015-04-12 01:45 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-12 01:45 - 2009-07-13 20:51 - 00101182 _____ () C:\Windows\setupact.log
2015-04-09 21:13 - 2014-08-05 23:14 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-09 21:13 - 2012-12-21 14:10 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-04-07 10:47 - 2010-11-20 19:47 - 00951432 _____ () C:\Windows\PFRO.log
2015-04-01 21:25 - 2012-12-29 06:24 - 00000000 ____D () C:\Users\Meine\Desktop\Bilder
2015-04-01 04:00 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\NDF
2015-03-31 23:03 - 2012-12-21 14:15 - 00000000 ____D () C:\Users\Meine\AppData\Roaming\Avira
2015-03-31 23:01 - 2012-12-21 14:10 - 00000000 ____D () C:\ProgramData\Avira
2015-03-25 22:17 - 2014-12-11 23:02 - 00000000 ____D () C:\Windows\System32\appraiser
2015-03-25 22:17 - 2014-05-07 21:10 - 00000000 ___SD () C:\Windows\System32\CompatTel
2015-03-23 02:09 - 2014-06-24 11:32 - 00000000 ____D () C:\Users\Meine\AppData\Local\Adobe

Some content of TEMP:
====================
C:\Users\Meine\AppData\Local\Temp\AskSLib.dll
C:\Users\Meine\AppData\Local\Temp\avgnt.exe
C:\Users\Meine\AppData\Local\Temp\install_flashplayer11x32ax_gtbp_chra_aih.exe
C:\Users\Meine\AppData\Local\Temp\install_flashplayer14x32ax_chra_dy_awa_aih.exe
C:\Users\Meine\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Meine\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Meine\AppData\Local\Temp\nscC7E2.tmp.tbWise.dll
C:\Users\Meine\AppData\Local\Temp\nse6404.exe
C:\Users\Meine\AppData\Local\Temp\nseA6C4.exe
C:\Users\Meine\AppData\Local\Temp\nseAFE9.exe
C:\Users\Meine\AppData\Local\Temp\nseB824.exe
C:\Users\Meine\AppData\Local\Temp\nsj7313.exe
C:\Users\Meine\AppData\Local\Temp\nso6B93.exe
C:\Users\Meine\AppData\Local\Temp\setup.exe
C:\Users\Meine\AppData\Local\Temp\SPSetup.exe
C:\Users\Meine\AppData\Local\Temp\tbedrs.dll
C:\Users\Meine\AppData\Local\Temp\TuneUpUtilities2013_de-DE.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2015-03-12 21:49:35
Restore point made on: 2015-03-18 00:02:34
Restore point made on: 2015-03-18 01:56:06
Restore point made on: 2015-03-18 04:22:31
Restore point made on: 2015-03-24 02:09:48
Restore point made on: 2015-03-25 22:00:41
Restore point made on: 2015-03-30 22:46:42
Restore point made on: 2015-03-31 00:54:02
Restore point made on: 2015-04-03 02:40:48
Restore point made on: 2015-04-05 01:43:56
Restore point made on: 2015-04-06 22:08:24
Restore point made on: 2015-04-06 22:46:04
Restore point made on: 2015-04-06 22:47:17
Restore point made on: 2015-04-06 22:47:59
Restore point made on: 2015-04-06 22:50:26
Restore point made on: 2015-04-06 23:06:11
Restore point made on: 2015-04-06 23:53:54
Restore point made on: 2015-04-07 00:13:20
Restore point made on: 2015-04-07 02:20:57
Restore point made on: 2015-04-15 22:11:27

==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 3889.6 MB
Available physical RAM: 3182.01 MB
Total Pagefile: 3887.8 MB
Available Pagefile: 3171.37 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:281.88 GB) (Free:179.42 GB) NTFS
Drive e: (PQSERVICE) (Fixed) (Total:16.11 GB) (Free:0.75 GB) NTFS
Drive g: () (Removable) (Total:7.47 GB) (Free:3.42 GB) NTFS
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: E3FF1E1C)
Partition 1: (Not Active) - (Size=16.1 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=281.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 7.5 GB) (Disk ID: 13FC6E11)
Partition 1: (Active) - (Size=7.5 GB) - (Type=07 NTFS)


LastRegBack: 2015-04-07 08:29

==================== End Of Log ============================
--- --- ---

schrauber 18.04.2015 23:01
Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKU\Meine\...\Run: [winsr] => -autorun
HKU\Meine\...\Run: [logonsc] => "C:\Users\Meine\AppData\Roaming\logonsc.exe" -autorun
HKU\Meine\...\Run: [playl] => -autorun
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [220480 2014-06-23] (Client Connect LTD)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [181568 2014-06-23] (Client Connect LTD)
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Tiepolo 19.04.2015 13:09
Hallo. Danke schonmal für die Hilfe, dass ist nicht selbstverständlich. :-)

Hier die Fixlog:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-04-2015 04
Ran by SYSTEM at 2015-04-19 14:08:04 Run:1
Running from g:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKU\Meine\...\Run: [winsr] => -autorun
HKU\Meine\...\Run: [logonsc] => "C:\Users\Meine\AppData\Roaming\logonsc.exe" -autorun
HKU\Meine\...\Run: [playl] => -autorun
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [220480 2014-06-23] (Client Connect LTD)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [181568 2014-06-23] (Client Connect LTD)
       
*****************

HKU\Meine\Software\Microsoft\Windows\CurrentVersion\Run\\winsr => value deleted successfully.
HKU\Meine\Software\Microsoft\Windows\CurrentVersion\Run\\logonsc => value deleted successfully.
HKU\Meine\Software\Microsoft\Windows\CurrentVersion\Run\\playl => value deleted successfully.
"C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll" => Value Data removed successfully.
"C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll" => Value Data removed successfully.

==== End of Fixlog 14:08:06 ====

schrauber 19.04.2015 22:11
Rechner normal starten, geht das?

Tiepolo 20.04.2015 05:34
Leider nein. Gleicher Bluescreen wie zuvor :-(

schrauber 20.04.2015 16:38
Dann bitte nochmal aus der Recovery scannen.

Tiepolo 20.04.2015 17:09
Gern doch. Hier das Ergebnis:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-04-2015 04
Ran by SYSTEM on MININT-LGEA1F5 on 20-04-2015 18:07:02
Running from g:\
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12452456 2012-02-21] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-02-08] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [1021056 2012-03-08] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [800896 2012-03-08] (Atheros Commnucations)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2886416 2012-03-01] (Synaptics Incorporated)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)
HKLM\...\Run: [InstantUpdate] => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe [124520 2012-04-06] ()
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-01-26] (Apple Inc.)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-05] (NTI Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-03-23] (Dritek System Inc.)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-03-12] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-01-20] (Apple Inc.)
HKLM-x32\...\Run: [ApnUpdater] => C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1648056 2014-01-31] (Ask)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-03-31] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-01] (Oracle Corporation)
HKLM-x32\...\Run: [Syncios device service] => C:\Program Files (x86)\Syncios\SynciosDeviceService.exe [734720 2014-03-27] ()
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [296960 2015-02-02] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\Default\...\RunOnce: [ScrSav] => C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162408 2011-09-12] ()
HKU\Default\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Acer.scr [450048 2011-09-12] ()
HKU\Default User\...\RunOnce: [ScrSav] => C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe [162408 2011-09-12] ()
HKU\Default User\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Acer.scr [450048 2011-09-12] ()
HKU\Meine\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-12-25] (Google Inc.)
HKU\Meine\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\Meine\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.)
HKU\Meine\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-11-21] (Apple Inc.)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-03-31] (Avira Operations GmbH & Co. KG)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-03-31] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-03-31] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1004032 2015-03-31] (Avira Operations GmbH & Co. KG)
S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [2497856 2014-05-22] ()
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-03-16] ()
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-16] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)
S2 ZAtheros Wlan Agent; C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe [76960 2012-02-27] (Atheros)
S3 EFS; %SystemRoot%\System32\lsass.exe [X]
S3 KeyIso; %SystemRoot%\system32\lsass.exe [X]
S3 Netlogon; %systemroot%\system32\lsass.exe [X]
S3 ProtectedStorage; %SystemRoot%\system32\lsass.exe [X]
S2 SamSs; %SystemRoot%\system32\lsass.exe [X]
S3 VaultSvc; %SystemRoot%\system32\lsass.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-04] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-04] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-07] (Avira Operations GmbH & Co. KG)
S5 volmgrx; C:\Windows\System32\Drivers\volmgrx.sys [363392 2010-11-20] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-18 12:24 - 2015-04-20 18:07 - 00000000 ____D () C:\FRST
2015-04-15 23:13 - 2015-04-20 04:35 - 403824132 _____ () C:\Windows\MEMORY.DMP
2015-04-15 22:45 - 2015-04-15 22:45 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-04-15 22:45 - 2015-04-15 22:45 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-14 22:12 - 2015-03-16 21:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\apisetschema.dll
2015-04-14 22:11 - 2015-03-03 20:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\System32\clfs.sys
2015-04-14 22:11 - 2015-03-03 20:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\System32\clfsw32.dll
2015-04-14 22:11 - 2015-03-03 20:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-14 22:11 - 2015-02-24 19:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\http.sys
2015-04-07 07:42 - 2015-04-07 07:42 - 00000000 ____D () C:\Users\Meine\AppData\Local\elfopatch
2015-04-06 22:11 - 2015-04-06 22:11 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-06 22:11 - 2015-04-06 22:11 - 00000000 ___SD () C:\Windows\System32\GWX
2015-03-29 03:42 - 2015-04-15 05:01 - 00003136 _____ () C:\Windows\System32\Tasks\Registry Optimizer
2015-03-24 22:36 - 2015-03-10 20:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\System32\appraiser.dll
2015-03-24 22:36 - 2015-03-10 20:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\System32\invagent.dll
2015-03-24 22:36 - 2015-03-10 20:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2015-03-24 22:36 - 2015-03-10 20:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\System32\devinv.dll
2015-03-24 22:36 - 2015-03-10 20:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2015-03-24 22:36 - 2015-03-10 20:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\System32\aepic.dll
2015-03-24 22:36 - 2015-03-10 20:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\acmigration.dll
2015-03-24 22:36 - 2015-03-10 20:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-15 23:01 - 2012-06-21 21:13 - 01102253 _____ () C:\Windows\WindowsUpdate.log
2015-04-15 22:49 - 2012-08-31 10:36 - 01596540 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-04-15 22:49 - 2012-06-22 07:00 - 00700126 _____ () C:\Windows\System32\perfh007.dat
2015-04-15 22:49 - 2012-06-22 07:00 - 00149976 _____ () C:\Windows\System32\perfc007.dat
2015-04-15 22:48 - 2009-07-13 21:13 - 01596540 _____ () C:\Windows\System32\PerfStringBackup.INI
2015-04-15 22:46 - 2012-03-28 10:36 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-15 22:45 - 2012-03-28 11:18 - 00000000 ____D () C:\ProgramData\Skype
2015-04-15 22:44 - 2014-11-18 10:45 - 00000000 ____D () C:\Windows\System32\MRT
2015-04-15 22:42 - 2012-12-25 03:12 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-15 22:29 - 2012-12-25 03:12 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-15 22:17 - 2014-11-18 10:45 - 128913832 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2015-04-15 22:11 - 2012-09-02 10:43 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{3C3C0857-0064-4DEE-A512-626EF233EBCC}
2015-04-15 09:32 - 2012-06-21 21:20 - 00000830 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2015-04-15 05:01 - 2014-04-08 21:53 - 00000296 _____ () C:\Windows\Tasks\Registry Optimizer_DEFAULT.job
2015-04-15 03:46 - 2012-03-28 10:36 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-15 03:46 - 2012-03-28 10:36 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-15 03:46 - 2012-03-28 10:36 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-14 21:53 - 2014-04-08 21:53 - 00000304 _____ () C:\Windows\Tasks\Registry Optimizer_UPDATES.job
2015-04-13 23:02 - 2009-07-13 20:45 - 00031248 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-13 23:02 - 2009-07-13 20:45 - 00031248 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-12 03:37 - 2012-08-31 09:18 - 00000000 ____D () C:\Users\Meine\AppData\Local\CrashDumps
2015-04-12 01:51 - 2014-12-26 11:19 - 00000000 ___RD () C:\Users\Meine\iCloudDrive
2015-04-12 01:50 - 2012-06-21 21:20 - 00000828 _____ () C:\Windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2015-04-12 01:45 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-12 01:45 - 2009-07-13 20:51 - 00101182 _____ () C:\Windows\setupact.log
2015-04-09 21:13 - 2014-08-05 23:14 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-09 21:13 - 2012-12-21 14:10 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-04-07 10:47 - 2010-11-20 19:47 - 00951432 _____ () C:\Windows\PFRO.log
2015-04-01 21:25 - 2012-12-29 06:24 - 00000000 ____D () C:\Users\Meine\Desktop\Bilder
2015-04-01 04:00 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\NDF
2015-03-31 23:03 - 2012-12-21 14:15 - 00000000 ____D () C:\Users\Meine\AppData\Roaming\Avira
2015-03-31 23:01 - 2012-12-21 14:10 - 00000000 ____D () C:\ProgramData\Avira
2015-03-25 22:17 - 2014-12-11 23:02 - 00000000 ____D () C:\Windows\System32\appraiser
2015-03-25 22:17 - 2014-05-07 21:10 - 00000000 ___SD () C:\Windows\System32\CompatTel
2015-03-23 02:09 - 2014-06-24 11:32 - 00000000 ____D () C:\Users\Meine\AppData\Local\Adobe

Some content of TEMP:
====================
C:\Users\Meine\AppData\Local\Temp\AskSLib.dll
C:\Users\Meine\AppData\Local\Temp\avgnt.exe
C:\Users\Meine\AppData\Local\Temp\install_flashplayer11x32ax_gtbp_chra_aih.exe
C:\Users\Meine\AppData\Local\Temp\install_flashplayer14x32ax_chra_dy_awa_aih.exe
C:\Users\Meine\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Meine\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Meine\AppData\Local\Temp\nscC7E2.tmp.tbWise.dll
C:\Users\Meine\AppData\Local\Temp\nse6404.exe
C:\Users\Meine\AppData\Local\Temp\nseA6C4.exe
C:\Users\Meine\AppData\Local\Temp\nseAFE9.exe
C:\Users\Meine\AppData\Local\Temp\nseB824.exe
C:\Users\Meine\AppData\Local\Temp\nsj7313.exe
C:\Users\Meine\AppData\Local\Temp\nso6B93.exe
C:\Users\Meine\AppData\Local\Temp\setup.exe
C:\Users\Meine\AppData\Local\Temp\SPSetup.exe
C:\Users\Meine\AppData\Local\Temp\tbedrs.dll
C:\Users\Meine\AppData\Local\Temp\TuneUpUtilities2013_de-DE.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2015-03-12 21:49:35
Restore point made on: 2015-03-18 00:02:34
Restore point made on: 2015-03-18 01:56:06
Restore point made on: 2015-03-18 04:22:31
Restore point made on: 2015-03-24 02:09:48
Restore point made on: 2015-03-25 22:00:41
Restore point made on: 2015-03-30 22:46:42
Restore point made on: 2015-03-31 00:54:02
Restore point made on: 2015-04-03 02:40:48
Restore point made on: 2015-04-05 01:43:56
Restore point made on: 2015-04-06 22:08:24
Restore point made on: 2015-04-06 22:46:04
Restore point made on: 2015-04-06 22:47:17
Restore point made on: 2015-04-06 22:47:59
Restore point made on: 2015-04-06 22:50:26
Restore point made on: 2015-04-06 23:06:11
Restore point made on: 2015-04-06 23:53:54
Restore point made on: 2015-04-07 00:13:20
Restore point made on: 2015-04-07 02:20:57
Restore point made on: 2015-04-15 22:11:27

==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 3889.6 MB
Available physical RAM: 3183.16 MB
Total Pagefile: 3887.8 MB
Available Pagefile: 3173.02 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:281.88 GB) (Free:179.36 GB) NTFS
Drive e: (PQSERVICE) (Fixed) (Total:16.11 GB) (Free:0.75 GB) NTFS
Drive g: () (Removable) (Total:7.47 GB) (Free:3.42 GB) NTFS
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: E3FF1E1C)
Partition 1: (Not Active) - (Size=16.1 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=281.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 7.5 GB) (Disk ID: 13FC6E11)
Partition 1: (Active) - (Size=7.5 GB) - (Type=07 NTFS)


LastRegBack: 2015-04-07 08:29

==================== End Of Log ============================
--- --- ---

schrauber 21.04.2015 08:31
Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
LastRegBack: 2015-04-07 08:29
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Tiepolo 21.04.2015 09:35
Hier das Ergebnis:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-04-2015 04
Ran by SYSTEM at 2015-04-21 10:34:18 Run:2
Running from g:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
LastRegBack: 2015-04-07 08:29
*****************

DEFAULT hive was successfully copied to System32\config\HiveBackup
DEFAULT hive was successfully restored from registry back up.
SAM hive was successfully copied to System32\config\HiveBackup
SAM hive was successfully restored from registry back up.
SECURITY hive was successfully copied to System32\config\HiveBackup
SECURITY hive was successfully restored from registry back up.
SOFTWARE hive was successfully copied to System32\config\HiveBackup
SOFTWARE hive was successfully restored from registry back up.
SYSTEM hive was successfully copied to System32\config\HiveBackup
SYSTEM hive was successfully restored from registry back up.

==== End of Fixlog 10:34:28 ====
Leider Problem weiterhin vorhanden.

schrauber 21.04.2015 13:43
Geht einer der abgesicherten Modi? Mach bitte mal ein Bild von dem Bluescreen.

Tiepolo 21.04.2015 15:01
Leider geht auch kein abgesicherter Modi.

Hier das Bild: hxxp://imgur.com/3J5PQxU


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:46 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131