Hallo zusammen,
den Rechner meiner Mutter hat es auch mit diesem Torjaner getroffen. Ich habe die Schritte zur Entfernung (mit Malwarebytes) und die Entschlüsselung mit Ransom File Unlocker vorgenommen. Dabei hatte ich eine sehr gute Erfolgsquote - alle knapp 10.000 Dateien wurden wieder hergestellt.

Nun noch abschließen - zur Sicherstellung, dass ich alles erwischt habe - die Log Files zur Analyse. Ich habe diese schonmal etwas gesichtet und nichts "schlimmes" entdecken können. Aber bitte schaut einmal durch, ob Euch etwas auffällt.

Vielen Dank im Voraus.

Ich beziehe mich auf folgende Schritte: http://www.trojaner-board.de/69886-a...-beachten.html

Schritt 1:
Disable kein Problem, ohne Neustart weiter.

Schritt 2:

DDS:

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_31
Run by Admin at 11:31:03 on 2012-05-05
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3950.2505 [GMT 2:00]
.
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
C:\Program Files (x86)\DYMO\DYMO Label Software\DymoQuickPrint.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe
C:\Program Files (x86)\SONY\Marketing Tools\MarketingTools.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe
C:\Program Files (x86)\PDF24\pdf24.exe
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
C:\Windows\SysWOW64\DllHost.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Sony\VAIO Power Management\SPMService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
C:\Program Files\Sony\VAIO Update Common\VUAgent.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Sony\VAIO Care\VCPerfService.exe
C:\Program Files\Sony\VAIO Care\listener.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Sony\VAIO Care\VCsystray.exe
C:\Program Files\Sony\VAIO Care\VCService.exe
C:\Program Files\Sony\VAIO Care\VCAgent.exe
C:\Windows\System32\vds.exe
C:\Users\Sylvia\Documents\Downloads\Defogger (1).exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\RunDll32.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SVEC&bmod=EU01
uDefault_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVEC&bmod=EU01
mWinlogon: Userinit=userinit.exe,
BHO: Facebook Connect: {11dcafd6-ddba-4ada-998b-996b7b691ae0} - C:\Users\Sylvia\AppData\Roaming\FBConnect\IE\FBConnect.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: Windows Live Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
mRun: [MarketingTools] C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe
mRun: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun: [DLSService] "C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe"
mRun: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe
mRun: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
mRunOnce: [ Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BLUETO~1.LNK - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
IE: {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - {BC0E0A5D-AB5A-4fa4-A5FA-280E1D58EEEE} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{5DB63988-98C6-4312-8B36-AA4B2FAA958F} : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{5DB63988-98C6-4312-8B36-AA4B2FAA958F}\64279647A7E22556075616475627 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{D61CA8A8-A9C5-4B05-8B5C-1FF6CD0702CA} : DhcpNameServer = 192.168.0.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
Notify: VESWinlogon - VESWinlogon.dll
{11DCAFD6-DDBA-4ADA-998B-996B7B691AE0}
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
{9030D464-4C02-4ABF-8ECC-5164760863C6}
{AA58ED58-01DD-4d91-8333-CF10577473F7}
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
{2318C2B1-4965-11d4-9B18-009027A5CD4F}
mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun-x64: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe"
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [PMBVolumeWatcher] C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
mRun-x64: [MarketingTools] C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe
mRun-x64: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
mRun-x64: [DLSService] "C:\Program Files (x86)\DYMO\DYMO Label Software\DLSService.exe"
mRun-x64: [PDFPrint] C:\Program Files (x86)\PDF24\pdf24.exe
mRun-x64: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
mRunOnce-x64: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
mRunOnce-x64: [ Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript
IE-X64: {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
.
================= FIREFOX ===================
.
FF - ProfilePath -
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\system32\Drivers\PxHlpa64.sys --> C:\Windows\system32\Drivers\PxHlpa64.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 AntiVirSchedulerService;Avira AntiVir Planer;C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2010-9-3 136360]
R2 AntiVirService;Avira AntiVir Guard;C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2010-9-3 269480]
R2 avgntflt;avgntflt;C:\Windows\system32\DRIVERS\avgntflt.sys --> C:\Windows\system32\DRIVERS\avgntflt.sys [?]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-1-29 13336]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-5-4 654408]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\SONY\PMB\PMBDeviceInfoProvider.exe [2009-10-24 360224]
R2 rimspci;rimspci;C:\Windows\system32\DRIVERS\rimssne64.sys --> C:\Windows\system32\DRIVERS\rimssne64.sys [?]
R2 risdsnpe;risdsnpe;C:\Windows\system32\DRIVERS\risdsne64.sys --> C:\Windows\system32\DRIVERS\risdsne64.sys [?]
R2 SampleCollector;VAIO Care Performance Service;C:\Program Files\Sony\VAIO Care\VCPerfService.exe [2011-12-5 259192]
R2 uCamMonitor;CamMonitor;C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2010-2-23 104960]
R2 UNS;Intel(R) Management & Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-7-13 2320920]
R2 VCFw;VAIO Content Folder Watcher;C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-9-14 642416]
R2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2010-2-19 529776]
R2 VSNService;VSNService;C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [2010-2-23 821760]
R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys --> C:\Windows\system32\DRIVERS\ArcSoftKsUFilter.sys [?]
R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 SFEP;Sony Firmware Extension Parser;C:\Windows\system32\drivers\SFEP.sys --> C:\Windows\system32\drivers\SFEP.sys [?]
R3 VAIO Power Management;VAIO Power Management;C:\Program Files\Sony\VAIO Power Management\SPMService.exe [2010-2-23 571248]
R3 VCService;VCService;C:\Program Files\Sony\VAIO Care\VCService.exe [2011-12-5 44736]
R3 VUAgent;VUAgent;C:\Program Files\Sony\VAIO Update Common\VUAgent.exe [2012-1-13 1256040]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-23 133104]
S2 Roxio Upnp Server 10;Roxio Upnp Server 10;C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [2009-8-31 362992]
S3 btusbflt;Bluetooth USB Filter;C:\Windows\system32\drivers\btusbflt.sys --> C:\Windows\system32\drivers\btusbflt.sys [?]
S3 btwl2cap;Bluetooth L2CAP Service;C:\Windows\system32\DRIVERS\btwl2cap.sys --> C:\Windows\system32\DRIVERS\btwl2cap.sys [?]
S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]
S3 fsssvc;Windows Live Family Safety-Dienst;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2009-8-5 704864]
S3 gupdatem;Google Update-Dienst (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-2-23 133104]
S3 Impcd;Impcd;C:\Windows\system32\drivers\Impcd.sys --> C:\Windows\system32\drivers\Impcd.sys [?]
S3 IntcDAud;Intel(R) Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-27 129976]
S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [2009-8-31 313840]
S3 SOHCImp;VAIO Media plus Content Importer;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2010-2-23 120104]
S3 SOHDBSvr;VAIO Media plus Database Manager;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2010-2-23 70952]
S3 SOHDms;VAIO Media plus Digital Media Server;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [2010-2-23 427304]
S3 SOHDs;VAIO Media plus Device Searcher;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2010-2-23 75048]
S3 SOHPlMgr;VAIO Media plus Playlist Manager;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2010-2-23 91432]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2010-2-23 361840]
S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2010-2-19 115568]
S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2021-02-01 13:47:05 -------- d-----w- C:\ProgramData\KreilhoferIT
2012-05-04 20:57:45 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{84873056-91DE-48F5-92BD-B5297EE6274B}\offreg.dll
2012-05-04 19:33:47 -------- d-----w- C:\Users\Admin\AppData\Roaming\Malwarebytes
2012-05-04 19:33:29 -------- d-----w- C:\ProgramData\Malwarebytes
2012-05-04 19:33:28 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-05-04 19:33:28 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-05-04 19:15:46 8917360 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{84873056-91DE-48F5-92BD-B5297EE6274B}\mpengine.dll
2012-05-04 19:14:49 -------- d-----w- C:\Users\Admin\AppData\Local\Google
2012-05-04 19:11:15 -------- d-----w- C:\Users\Admin\AppData\Roaming\Avira
2012-05-04 19:09:14 -------- d-----w- C:\Users\Admin\AppData\Local\Sony_Corporation
2012-05-04 19:09:11 -------- d-----w- C:\Users\Admin\AppData\Local\DYMO
2012-05-04 19:09:09 -------- d-----w- C:\Users\Admin\AppData\Roaming\Intel Corporation
2012-05-04 19:09:07 -------- d-----w- C:\Users\Admin\AppData\Local\ATI
2012-04-27 13:40:08 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
2012-04-27 13:40:04 157352 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2012-04-27 13:40:04 129976 ----a-w- C:\Program Files (x86)\Mozilla Firefox\maintenanceservice.exe
2012-04-11 12:09:23 5559152 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-04-11 12:09:23 3968368 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-04-11 12:09:22 3913072 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-04-11 12:02:09 81408 ----a-w- C:\Windows\System32\imagehlp.dll
2012-04-11 12:02:09 5120 ----a-w- C:\Windows\SysWow64\wmi.dll
2012-04-11 12:02:09 5120 ----a-w- C:\Windows\System32\wmi.dll
2012-04-11 12:02:09 23408 ----a-w- C:\Windows\System32\drivers\fs_rec.sys
2012-04-11 12:02:09 220672 ----a-w- C:\Windows\System32\wintrust.dll
2012-04-11 12:02:09 172544 ----a-w- C:\Windows\SysWow64\wintrust.dll
2012-04-11 12:02:09 159232 ----a-w- C:\Windows\SysWow64\imagehlp.dll
.
==================== Find3M ====================
.
2012-03-03 10:51:31 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2012-02-28 06:39:37 1188864 ----a-w- C:\Windows\System32\wininet.dll
2012-02-28 05:38:52 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-02-28 04:31:38 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2012-02-28 03:52:27 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-02-23 08:18:36 279656 ------w- C:\Windows\System32\MpSigStub.exe
2012-02-17 06:38:26 1031680 ----a-w- C:\Windows\System32\rdpcore.dll
2012-02-17 05:34:22 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll
2012-02-17 04:58:24 210944 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-02-17 04:57:32 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys
2012-02-10 06:36:07 1544192 ----a-w- C:\Windows\System32\DWrite.dll
2012-02-10 05:38:43 1077248 ----a-w- C:\Windows\SysWow64\DWrite.dll
2012-02-07 09:02:40 1070352 ----a-w- C:\Windows\SysWow64\MSCOMCTL.OCX
.
============= FINISH: 11:31:53,60 ===============

Die zweite Scan-Ausgabe findet ihr im Anhang.

Schritt 3: Es handelt sich um ein 64Bit System (x64 basierter- PC).

So, das sollte es vorerst ja dann sein. Ich hoffe ich habe nichts vergessen.

Danke schon jetzt für das Feedback.

hi,
1. öffne malwarebytes, logdateien, poste alle berichte.
2. da sie sich evtl. per mail infiziert hatt:
an solchen mails mit rechnung, mahnung und sonstigen anhängen, von unbekannten absendern bin ich interessiert.
wenn du ein mail programm nutzt, dann mail markieren, rechtsklick, speichern unter, typ:
.eml einstellen.
dann mail an:
http://markusg.trojaner-board.de
dort die soeben erstellte datei anhängen.
wenn du deine mails über den browser abrufst, sag mir mal welchen anbieter du nutzt, dann geht das ein bisschen anders.

auch in zukunft bitte so weiterleiten, wenn mails von unbekannten absendern mit anhängen rein kommen.

bitte auch freunde, bekannte etc warnen, sie können die mails ebenso weiter leiten an mich.

Hallo,

ich habe dir die .eml der besagten Mail gerade geschickt.

Hier noch die Logs aus Malwarebytes:

2012/05/04 21:34:39 +0200 SYLVIA-VAIO Admin MESSAGE Executing scheduled update: Daily
2012/05/04 21:34:39 +0200 SYLVIA-VAIO Admin MESSAGE Starting protection
2012/05/04 21:34:40 +0200 SYLVIA-VAIO Admin MESSAGE Database already up-to-date
2012/05/04 21:34:42 +0200 SYLVIA-VAIO Admin MESSAGE Protection started successfully
2012/05/04 21:34:45 +0200 SYLVIA-VAIO Admin MESSAGE Starting IP protection
2012/05/04 21:34:47 +0200 SYLVIA-VAIO Admin MESSAGE IP Protection started successfully
2012/05/04 21:44:45 +0200 SYLVIA-VAIO Sylvia MESSAGE Starting protection
2012/05/04 21:44:48 +0200 SYLVIA-VAIO Sylvia MESSAGE Protection started successfully
2012/05/04 21:44:51 +0200 SYLVIA-VAIO Sylvia MESSAGE Starting IP protection
2012/05/04 21:44:52 +0200 SYLVIA-VAIO Sylvia MESSAGE IP Protection started successfully

2012/05/05 11:21:07 +0200 SYLVIA-VAIO Sylvia MESSAGE Starting protection
2012/05/05 11:21:09 +0200 SYLVIA-VAIO Sylvia MESSAGE Executing scheduled update: Daily
2012/05/05 11:21:10 +0200 SYLVIA-VAIO Sylvia MESSAGE Protection started successfully
2012/05/05 11:21:13 +0200 SYLVIA-VAIO Sylvia MESSAGE Starting IP protection
2012/05/05 11:21:14 +0200 SYLVIA-VAIO Sylvia MESSAGE IP Protection started successfully
2012/05/05 11:21:21 +0200 SYLVIA-VAIO Sylvia MESSAGE Scheduled update executed successfully: database updated from version v2012.05.04.05 to version v2012.05.05.03
2012/05/05 11:21:21 +0200 SYLVIA-VAIO Sylvia MESSAGE Starting database refresh
2012/05/05 11:21:21 +0200 SYLVIA-VAIO Sylvia MESSAGE Stopping IP protection
2012/05/05 11:23:21 +0200 SYLVIA-VAIO Sylvia MESSAGE IP Protection stopped
2012/05/05 11:23:24 +0200 SYLVIA-VAIO Sylvia MESSAGE Database refreshed successfully
2012/05/05 11:23:24 +0200 SYLVIA-VAIO Sylvia MESSAGE Starting IP protection
2012/05/05 11:23:25 +0200 SYLVIA-VAIO Sylvia MESSAGE IP Protection started successfully
2012/05/05 12:05:39 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50352, Process: chrome.exe)
2012/05/05 12:05:39 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50353, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50365, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50366, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50367, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50368, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50369, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50370, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50371, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50372, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50373, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50374, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50375, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50376, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50377, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50378, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50379, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50380, Process: chrome.exe)
2012/05/05 12:06:28 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50381, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50382, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50383, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50384, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50385, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50386, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50387, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50388, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50389, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50390, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50391, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50392, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50393, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50394, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50395, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50396, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50397, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50398, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50399, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50400, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50401, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50402, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50403, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50404, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50405, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50406, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50407, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50408, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50409, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50410, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50411, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50412, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50413, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50414, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50415, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50416, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50417, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50418, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50419, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50420, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50421, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50422, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50423, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50424, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50425, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50426, Process: chrome.exe)
2012/05/05 12:06:36 +0200 SYLVIA-VAIO Sylvia IP-BLOCK 109.163.231.139 (Type: outgoing, Port: 50427, Process: chrome.exe)
2012/05/05 18:21:24 +0200 SYLVIA-VAIO Sylvia MESSAGE Starting protection
2012/05/05 18:21:27 +0200 SYLVIA-VAIO Sylvia MESSAGE Protection started successfully
2012/05/05 18:21:30 +0200 SYLVIA-VAIO Sylvia MESSAGE Starting IP protection
2012/05/05 18:21:32 +0200 SYLVIA-VAIO Sylvia MESSAGE IP Protection started successfully

hi, danke.

gibt nur das protektion log, keines vom scan?