| |
| |||||||
Log-Analyse und Auswertung: PC nach formatierung wieder infiziertWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
19.10.2009, 21:16
| #3 |
 |  PC nach formatierung wieder infiziert teil 3
__________________2009-10-19 20:41:38 ----A---- C:\Windows\system32\wevtutil.exe 2009-10-19 20:41:38 ----A---- C:\Windows\system32\wevtapi.dll 2009-10-19 20:41:38 ----A---- C:\Windows\system32\WerFaultSecure.exe 2009-10-19 20:41:38 ----A---- C:\Windows\system32\WerFault.exe 2009-10-19 20:41:38 ----A---- C:\Windows\system32\wer.dll 2009-10-19 20:41:38 ----A---- C:\Windows\system32\WebClnt.dll 2009-10-19 20:41:38 ----A---- C:\Windows\system32\webcheck.dll 2009-10-19 20:41:38 ----A---- C:\Windows\system32\advapi32.dll 2009-10-19 20:41:38 ----A---- C:\Windows\system32\adtschema.dll 2009-10-19 20:41:38 ----A---- C:\Windows\system32\adsmsext.dll 2009-10-19 20:41:38 ----A---- C:\Windows\system32\adsldpc.dll 2009-10-19 20:41:37 ----A---- C:\Windows\system32\wmdrmsdk.dll 2009-10-19 20:41:37 ----A---- C:\Windows\system32\wmdrmnet.dll 2009-10-19 20:41:37 ----A---- C:\Windows\system32\wmdrmdev.dll 2009-10-19 20:41:37 ----A---- C:\Windows\system32\WMADMOD.DLL 2009-10-19 20:41:37 ----A---- C:\Windows\system32\wlgpclnt.dll 2009-10-19 20:41:37 ----A---- C:\Windows\system32\Wldap32.dll 2009-10-19 20:41:37 ----A---- C:\Windows\system32\winmm.dll 2009-10-19 20:41:36 ----A---- C:\Windows\system32\WinSCard.dll 2009-10-19 20:41:36 ----A---- C:\Windows\system32\winrnr.dll 2009-10-19 20:41:36 ----A---- C:\Windows\system32\wininet.dll 2009-10-19 20:41:36 ----A---- C:\Windows\system32\winhttp.dll 2009-10-19 20:41:35 ----A---- C:\Windows\system32\wlanui.dll 2009-10-19 20:41:35 ----A---- C:\Windows\system32\wlanpref.dll 2009-10-19 20:41:35 ----A---- C:\Windows\system32\wlanmsm.dll 2009-10-19 20:41:35 ----A---- C:\Windows\system32\wlanhlp.dll 2009-10-19 20:41:35 ----A---- C:\Windows\system32\wlangpui.dll 2009-10-19 20:41:35 ----A---- C:\Windows\system32\winlogon.exe 2009-10-19 20:41:33 ----A---- C:\Windows\system32\sperror.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\spcmsg.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\softkbd.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\SndVol.exe 2009-10-19 20:41:33 ----A---- C:\Windows\system32\SMBHelperClass.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\SmartcardCredentialProvider.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\slwmi.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\slwga.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\slmgr.vbs 2009-10-19 20:41:33 ----A---- C:\Windows\system32\SLCommDlg.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\slcinst.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\SLCExt.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\slcc.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\SLC.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\shwebsvc.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\shsvcs.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\shsetup.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\shdocvw.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\setupapi.dll 2009-10-19 20:41:33 ----A---- C:\Windows\system32\sethc.exe 2009-10-19 20:41:33 ----A---- C:\Windows\system32\services.exe 2009-10-19 20:41:33 ----A---- C:\Windows\system32\sendmail.dll 2009-10-19 20:41:32 ----A---- C:\Windows\system32\shlwapi.dll 2009-10-19 20:41:32 ----A---- C:\Windows\system32\shell32.dll 2009-10-19 20:41:31 ----A---- C:\Windows\system32\Storprop.dll 2009-10-19 20:41:31 ----A---- C:\Windows\system32\stobject.dll 2009-10-19 20:41:31 ----A---- C:\Windows\system32\srchadmin.dll 2009-10-19 20:41:31 ----A---- C:\Windows\system32\sqlsrv32.dll 2009-10-19 20:41:31 ----A---- C:\Windows\system32\spwmp.dll 2009-10-19 20:41:31 ----A---- C:\Windows\system32\spwizui.dll 2009-10-19 20:41:31 ----A---- C:\Windows\system32\spwinsat.dll 2009-10-19 20:41:31 ----A---- C:\Windows\system32\spreview.exe 2009-10-19 20:41:31 ----A---- C:\Windows\system32\spp.dll 2009-10-19 20:41:31 ----A---- C:\Windows\system32\spoolss.dll 2009-10-19 20:41:31 ----A---- C:\Windows\system32\spinstall.exe 2009-10-19 20:13:19 ----RA---- C:\Windows\system32\AsIO.dll 2009-10-19 20:13:18 ----D---- C:\Program Files (x86)\ASUS 2009-10-19 20:12:23 ----D---- C:\Windows\system32\Atheros_L1e 2009-10-19 20:10:47 ----D---- C:\Windows\system32\RTCOM 2009-10-19 20:10:33 ----A---- C:\Windows\DIFxAPI.dll 2009-10-19 20:10:32 ----A---- C:\Windows\SkyTel.exe 2009-10-19 20:10:31 ----A---- C:\Windows\RtlUpd64.exe 2009-10-19 20:10:21 ----D---- C:\Program Files (x86)\Realtek 2009-10-19 20:10:21 ----A---- C:\Windows\RAVCpl64.exe 2009-10-19 20:10:18 ----R---- C:\Windows\RtlExUpd.dll 2009-10-19 20:10:18 ----A---- C:\Windows\HideWin.exe 2009-10-19 20:10:12 ----D---- C:\Program Files (x86)\Common Files\InstallShield 2009-10-19 19:58:47 ----D---- C:\Windows\ASUSInstAll 2009-10-19 19:52:21 ----RA---- C:\Windows\system32\CSVer.dll 2009-10-19 19:52:21 ----D---- C:\Program Files (x86)\Intel 2009-10-19 19:52:09 ----D---- C:\Intel 2009-10-19 19:51:33 ----A---- C:\Windows\Ascd_log.ini 2009-10-19 19:51:16 ----A---- C:\Windows\Ascd_tmp.ini 2009-10-19 19:46:38 ----HD---- C:\Program Files (x86)\InstallShield Installation Information 2009-10-19 19:46:38 ----D---- C:\Program Files (x86)\Razer 2009-10-19 19:46:28 ----D---- C:\Users\alpha\AppData\Roaming\InstallShield 2009-10-19 19:42:19 ----D---- C:\ProgramData\NVIDIA 2009-10-19 19:42:13 ----D---- C:\Program Files (x86)\NVIDIA Corporation 2009-10-19 19:41:42 ----D---- C:\Windows\system32\AGEIA 2009-10-19 19:41:42 ----D---- C:\Program Files (x86)\AGEIA Technologies 2009-10-19 19:41:40 ----SHD---- C:\Windows\Installer 2009-10-19 19:41:39 ----D---- C:\Program Files (x86)\Common Files\Wise Installation Wizard 2009-10-19 19:41:15 ----D---- C:\NVIDIA 2009-10-19 19:38:33 ----D---- C:\Program Files (x86)\Mozilla Firefox 2009-10-19 19:37:17 ----D---- C:\Program Files (x86)\CCleaner 2009-10-19 19:16:31 ----D---- C:\Windows\Panther 2009-10-19 19:16:17 ----RAS---- C:\BOOTSECT.BAK 2009-10-19 19:16:16 ----SHD---- C:\Boot 2009-10-19 18:45:48 ----D---- C:\Users\alpha\AppData\Roaming\Identities 2009-10-19 18:45:44 ----SD---- C:\Users\alpha\AppData\Roaming\Microsoft 2009-10-19 18:45:44 ----D---- C:\Users\alpha\AppData\Roaming\Media Center Programs 2009-10-19 18:43:53 ----SHD---- C:\Programme 2009-10-19 18:43:53 ----SHD---- C:\ProgramData\Vorlagen 2009-10-19 18:43:53 ----SHD---- C:\ProgramData\Startmenü 2009-10-19 18:43:51 ----SHD---- C:\ProgramData\Favoriten 2009-10-19 18:43:51 ----SHD---- C:\ProgramData\Dokumente 2009-10-19 18:43:51 ----SHD---- C:\ProgramData\Anwendungsdaten 2009-10-19 18:43:51 ----SHD---- C:\Dokumente und Einstellungen 2009-10-19 18:43:33 ----D---- C:\Windows\Debug 2009-10-19 18:19:36 ----D---- C:\Windows\SoftwareDistribution 2009-10-19 18:17:17 ----D---- C:\Windows\Prefetch 2009-10-19 18:17:09 ----SHD---- C:\System Volume Information 2009-09-27 16:12:22 ----A---- C:\Windows\system32\nvwgf2um.dll 2009-09-27 16:12:22 ----A---- C:\Windows\system32\nvoglv32.dll 2009-09-27 16:12:22 ----A---- C:\Windows\system32\nvd3dum.dll 2009-09-27 16:12:22 ----A---- C:\Windows\system32\nvcuvid.dll 2009-09-27 16:12:22 ----A---- C:\Windows\system32\nvcuvenc.dll 2009-09-27 16:12:22 ----A---- C:\Windows\system32\nvcuda.dll 2009-09-27 16:12:22 ----A---- C:\Windows\system32\nvapi.dll ======List of files/folders modified in the last 1 months====== 2009-10-19 22:12:32 ----D---- C:\Windows\Temp 2009-10-19 21:51:41 ----RD---- C:\Program Files (x86) 2009-10-19 21:13:28 ----D---- C:\Windows\SysWOW64 2009-10-19 21:10:51 ----HD---- C:\ProgramData 2009-10-19 21:08:56 ----D---- C:\Windows\winsxs 2009-10-19 21:07:19 ----D---- C:\Windows\System32 2009-10-19 21:00:25 ----D---- C:\Windows\Tasks 2009-10-19 21:00:24 ----D---- C:\Windows\Logs 2009-10-19 20:57:55 ----D---- C:\Windows 2009-10-19 20:57:16 ----D---- C:\Windows\inf 2009-10-19 20:56:32 ----RSD---- C:\Windows\assembly 2009-10-19 20:56:32 ----D---- C:\Windows\Microsoft.NET 2009-10-19 20:50:09 ----D---- C:\Windows\servicing 2009-10-19 20:50:09 ----D---- C:\Windows\ehome 2009-10-19 20:50:09 ----D---- C:\Program Files (x86)\Windows Sidebar 2009-10-19 20:50:09 ----D---- C:\Program Files (x86)\Windows Photo Gallery 2009-10-19 20:50:09 ----D---- C:\Program Files (x86)\Windows Media Player 2009-10-19 20:50:09 ----D---- C:\Program Files (x86)\Windows Mail 2009-10-19 20:50:09 ----D---- C:\Program Files (x86)\Windows Calendar 2009-10-19 20:50:09 ----D---- C:\Program Files (x86)\Internet Explorer 2009-10-19 20:50:09 ----D---- C:\Program Files (x86)\Common Files\System 2009-10-19 20:50:05 ----D---- C:\Windows\system32\XPSViewer 2009-10-19 20:50:05 ----D---- C:\Windows\system32\sk-SK 2009-10-19 20:50:05 ----D---- C:\Windows\system32\lv-LV 2009-10-19 20:50:05 ----D---- C:\Windows\system32\ko-KR 2009-10-19 20:50:05 ----D---- C:\Windows\system32\hr-HR 2009-10-19 20:50:05 ----D---- C:\Windows\system32\et-EE 2009-10-19 20:50:05 ----D---- C:\Windows\system32\en-US 2009-10-19 20:50:05 ----D---- C:\Windows\system32\da-DK 2009-10-19 20:50:04 ----D---- C:\Windows\system32\zh-TW 2009-10-19 20:50:04 ----D---- C:\Windows\system32\zh-CN 2009-10-19 20:50:04 ----D---- C:\Windows\system32\wbem 2009-10-19 20:50:04 ----D---- C:\Windows\system32\uk-UA 2009-10-19 20:50:04 ----D---- C:\Windows\system32\tr-TR 2009-10-19 20:50:04 ----D---- C:\Windows\system32\th-TH 2009-10-19 20:50:04 ----D---- C:\Windows\system32\sv-SE 2009-10-19 20:50:04 ----D---- C:\Windows\system32\sr-Latn-CS 2009-10-19 20:50:04 ----D---- C:\Windows\system32\SLUI 2009-10-19 20:50:04 ----D---- C:\Windows\system32\sl-SI 2009-10-19 20:50:04 ----D---- C:\Windows\system32\setup 2009-10-19 20:50:04 ----D---- C:\Windows\system32\ru-RU 2009-10-19 20:50:04 ----D---- C:\Windows\system32\ro-RO 2009-10-19 20:50:04 ----D---- C:\Windows\system32\pt-PT 2009-10-19 20:50:04 ----D---- C:\Windows\system32\pt-BR 2009-10-19 20:50:04 ----D---- C:\Windows\system32\pl-PL 2009-10-19 20:50:04 ----D---- C:\Windows\system32\oobe 2009-10-19 20:50:04 ----D---- C:\Windows\system32\nl-NL 2009-10-19 20:50:04 ----D---- C:\Windows\system32\nb-NO 2009-10-19 20:50:04 ----D---- C:\Windows\system32\migwiz 2009-10-19 20:50:04 ----D---- C:\Windows\system32\migration 2009-10-19 20:50:04 ----D---- C:\Windows\system32\manifeststore 2009-10-19 20:50:04 ----D---- C:\Windows\system32\lt-LT 2009-10-19 20:50:04 ----D---- C:\Windows\system32\ja-JP 2009-10-19 20:50:04 ----D---- C:\Windows\system32\it-IT 2009-10-19 20:50:04 ----D---- C:\Windows\system32\hu-HU 2009-10-19 20:50:04 ----D---- C:\Windows\system32\he-IL 2009-10-19 20:50:04 ----D---- C:\Windows\system32\fr-FR 2009-10-19 20:50:04 ----D---- C:\Windows\system32\fi-FI 2009-10-19 20:50:04 ----D---- C:\Windows\system32\es-ES 2009-10-19 20:50:04 ----D---- C:\Windows\system32\el-GR 2009-10-19 20:50:04 ----D---- C:\Windows\system32\de-DE 2009-10-19 20:50:04 ----D---- C:\Windows\system32\cs-CZ 2009-10-19 20:50:04 ----D---- C:\Windows\system32\bg-BG 2009-10-19 20:50:04 ----D---- C:\Windows\system32\ar-SA 2009-10-19 20:50:04 ----D---- C:\Windows\system32\AdvancedInstallers 2009-10-19 20:49:59 ----D---- C:\Windows\IME 2009-10-19 20:49:52 ----RSD---- C:\Windows\Fonts 2009-10-19 20:49:52 ----D---- C:\Windows\AppPatch 2009-10-19 20:13:19 ----D---- C:\Windows\system32\drivers 2009-10-19 20:13:16 ----RD---- C:\Program Files 2009-10-19 20:10:12 ----D---- C:\Program Files (x86)\Common Files 2009-10-19 19:48:47 ----D---- C:\Windows\LiveKernelReports 2009-10-19 19:41:59 ----D---- C:\Windows\Help 2009-10-19 18:45:58 ----SHD---- C:\$Recycle.Bin 2009-10-19 18:45:44 ----RD---- C:\Users 2009-10-19 18:44:20 ----D---- C:\Windows\rescache ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AsIO;AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [2007-12-17 14392] R3 DAdderFltr;DeathAdder Mouse; C:\Windows\system32\drivers\dadder.sys [] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [] R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys [] R3 L1E;NDIS Miniport Driver for Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller; C:\Windows\system32\DRIVERS\L1E60x64.sys [] R3 MTsensor;ATK0110 ACPI UTILITY; C:\Windows\system32\DRIVERS\ASACPI.sys [] R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [] S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [] S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [] S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [] S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [] S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [] S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [] S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [] S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [] S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [] R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2009-09-27 240232] R3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-03-29 89920] S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-21 19968] -----------------EOF----------------- |
| Themen zu PC nach formatierung wieder infiziert |
| adobe, alle programme, auswerten, c.exe, c:\windows\system32\rundll32.exe, desktop, dll, explorer, firefox, hijack, hijackthis, home, home premium, infiziert, internet, internet explorer, local\temp, mozilla, mp3, nvidia, programdata, programme, registry, rundll, secur, software, system, temp, usb, vista, windows |
Baum-Darstellung