Trojaner-Board - Verschlüsselungstrojaner "Windows Update" (Rechnung.zip) incl. Sperrung aller Dateien

Hallo Trojaner-Board-Gemeinde,

mein Problem ist einer der aktuell umlaufenden Verschlüsselungstrojaner. Es scheinen zwar alle Trojaner aus dem System entfernt zu sein, allerdings sind alle Dateien immer noch gesperrt und unbrauchbar. Daher suche ich hier Hilfe zur Entsperrung der Dateien.
Meine Schwester hat am Freitag, den 18., durch das Öffnen des infizierten eMail-Anhangs "Rechnung.exe" ihren Laptop mit dem Verschlüsselungstrojaner infiziert, der das System sperrt und ein angebliches, kostenpflichtiges "Windows-Update" für 100 € durchführen will.
Daraufhin kam sie zu mir und ich habe es mithilfe des Norton Power Erasers sowie Avira Free geschafft, die Trojaner zu entfernen. Das installierte, mit aktuellem Update versehene Norton Internet Security hatte nicht angeschlagen!
Im Anhang befindet sich das Logfile des Suchlaufs des NPE, bei dem er im abgesicherten Modus das Systemstartobjekt aufgespürt hatte, das sie Systemblockade verursacht hat.
Die Datei befand sich in C:\users\appdata\roaming\vlpywfnxsip\558fd5b42a1c341b43d.exe
Leider habe ich Avira nach Entfernung aller Trojaner wieder deinstalliert, sodass ich zu den anderen Funden weder Details nennen noch Logfiles posten kann :/ Sorry dafür!
Seit den erfolgreichen Virusscans läuft das System nämlich einwandfrei ohne jegliche Beeinträchtigung und es scheinen alle Schädlinge entfernt zu sein. Zunächst hatten wir allerdings nichts von der Verschlüsselung der Dateien bemerkt. Erst gestern ist ihr das aufgefallen.
Fast alle Dateien (sowohl Dokumente als auch Bilder als auch Musik) auf beiden Festplatten wurden umbenannt, tragen nun zufällige Zahlen-und Buchstabenkombinationen als Namen, besitzen keine Dateiendung mehr und sind somit unbenutzbar.
Leider konnte weder ScareUncrypt, noch Avira Ransom File Unlocker noch der DecryptHelper von Matthias einen funktionierenden Schlüssel finden.
Ich kann leider kein Pärchen von Original- und infizierter Datei posten, da mir nur Fotodateien im Original vorliegen und diese zum Anhängen zu groß sind. :/

Allerdings habe ich eine zufällige gesperrte Datei angehängt, damit ihr sehen könnt, wie alle Dateien jetzt aussehen. Das Dokument befindet sich im Verzeichnis C:\Users\Public\Documents\ASUSAccess

Dies ist mein DDS-Log:

.DDS Logfile:

Code:

DDS (Ver_2011-08-26.01) - NTFSAMD64 

Internet Explorer: 9.0.8112.16421

Run by tenni at 22:18:23 on 2012-05-24

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4061.2637 [GMT 2:00]

.

AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\FBAgent.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe

C:\Program Files\ATKGFNEX\GFNEXSrv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE

C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe

C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe

C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

C:\Program Files\P4G\BatteryLife.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\rundll32.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe

C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe

C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe

C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~1.EXE

C:\Program Files\Elantech\ETDCtrl.exe

C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe

C:\Windows\system32\igfxtray.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\ASUS\ASUS WebStorage\EeeStorageUploader.exe

C:\Windows\system32\svchost.exe -k SDRSVC

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\taskeng.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.searchcore.net/426

uDefault_Page_URL = hxxp://asus.msn.com

uURLSearchHooks: UrlSearchHook Class: {00000000-6e41-4fd3-8538-502f5495e5fc} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

BHO: AdblockPro: {04f2568a-3e7a-422d-a71e-dc088a635f7d} - C:\Users\tenni\AppData\Roaming\AdblockPro\IE\AdblockPro.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Norton Identity Protection: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\coIEPlg.dll

BHO: Norton Vulnerability Protection: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\IPS\IPSBHO.DLL

BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: DataMngr: {7da17d5a-5718-4130-a605-fc316c827836} - C:\PROGRA~2\SEARCH~1\Datamngr\BROWSE~1.DLL

BHO: Windows Live Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: AdobeReader: {ac6401e9-813b-46da-b06f-a4ffa2f9ae6d} - C:\Users\tenni\AppData\Roaming\AdobeReader\IE\AdobeReader.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll

BHO: Searchcore Toolbar: {af6ac4f2-9825-4fb6-a600-92bc5361f209} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchcoredtx.dll

BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

BHO: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll"

TB: Searchcore Toolbar: {af6ac4f2-9825-4fb6-a600-92bc5361f209} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchcoredtx.dll

TB: Avira SearchFree Toolbar plus Web Protection: {d4027c7f-154a-4066-a1ad-4243d8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll

TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\coIEPlg.dll

TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

uRun: [Facebook Update] "C:\Users\tenni\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

mRun: [<NO NAME>] 

dRunOnce: [<NO NAME>] 

StartupFolder: C:\Users\tenni\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SRSPRE~1.LNK - 

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Nach Microsoft E&xel exportieren - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab

TCP: DhcpNameServer = 83.169.184.161 192.168.0.1

TCP: Interfaces\{7138EC41-358F-4837-9D12-65D347D722F5} : DhcpNameServer = 83.169.184.161 192.168.0.1

TCP: Interfaces\{7138EC41-358F-4837-9D12-65D347D722F5}\4656661657C647 : DhcpNameServer = 83.169.184.161 192.168.0.1

TCP: Interfaces\{7138EC41-358F-4837-9D12-65D347D722F5}\6427964616 : DhcpNameServer = 192.168.0.1

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

AppInit_DLLs: C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll 

{04F2568A-3E7A-422D-A71E-DC088A635F7D}

{18DF081C-E8AD-4283-A596-FA578C2EBDC3}

BHO-X64: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}

{6D53EC84-6AAE-4787-AEEE-F4628F01010C}

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

{7DA17D5A-5718-4130-A605-FC316C827836}

{9030D464-4C02-4ABF-8ECC-5164760863C6}

{AA58ED58-01DD-4d91-8333-CF10577473F7}

{AC6401E9-813B-46DA-B06F-A4FFA2F9AE6D}

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}

{af6ac4f2-9825-4fb6-a600-92bc5361f209}

{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}

{d2ce3e00-f94a-4740-988e-03dc2f38c34f}

{D4027C7F-154A-4066-A1AD-4243D8127440}

{DBC80044-A445-435b-BC74-9C25C1C588A9}

{2318C2B1-4965-11d4-9B18-009027A5CD4F}

{8dcb7100-df86-4384-8842-8fa844297b3f}

{af6ac4f2-9825-4fb6-a600-92bc5361f209}

{D4027C7F-154A-4066-A1AD-4243D8127440}

{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}

TB-X64: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

mRun-x64: [(Standard)] 

AppInit_DLLs-X64: C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll 

.

============= SERVICES / DRIVERS ===============

.

R0 SymDS;Symantec Data Store;C:\Windows\system32\drivers\NISx64\1307010.005\SYMDS64.SYS --> C:\Windows\system32\drivers\NISx64\1307010.005\SYMDS64.SYS [?]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NISx64\1307010.005\SYMEFA64.SYS --> C:\Windows\system32\drivers\NISx64\1307010.005\SYMEFA64.SYS [?]

R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\BASHDefs\20120517.001\BHDrvx64.sys [2012-5-24 1160824]

R1 ccSet_NIS;Norton Internet Security Settings Manager;C:\Windows\system32\drivers\NISx64\1307010.005\ccSetx64.sys --> C:\Windows\system32\drivers\NISx64\1307010.005\ccSetx64.sys [?]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.5.0.145\Definitions\IPSDefs\20120523.001\IDSviA64.sys [2012-5-24 488568]

R1 SymIRON;Symantec Iron Driver;C:\Windows\system32\drivers\NISx64\1307010.005\Ironx64.SYS --> C:\Windows\system32\drivers\NISx64\1307010.005\Ironx64.SYS [?]

R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\system32\Drivers\NISx64\1307010.005\SYMNETS.SYS --> C:\Windows\system32\Drivers\NISx64\1307010.005\SYMNETS.SYS [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]

R2 AFBAgent;AFBAgent;"C:\Windows\system32\FBAgent.exe" --> C:\Windows\system32\FBAgent.exe [?]

R2 ASMMAP64;ASMMAP64;C:\Program Files\ATKGFNEX\ASMMAP64.sys [2010-8-30 14904]

R2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]

R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\ccsvchst.exe [2012-5-19 138232]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-5-18 138360]

R3 ETD;ELAN PS/2 Port Input Device;C:\Windows\system32\DRIVERS\ETD.sys --> C:\Windows\system32\DRIVERS\ETD.sys [?]

R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);C:\Windows\system32\DRIVERS\L1C62x64.sys --> C:\Windows\system32\DRIVERS\L1C62x64.sys [?]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]

S2 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-8-30 135664]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856]

S2 SupThrSrv;Super Thruster Service;C:\eSupport\SupThrSrv\SupThrSrv.exe --> C:\eSupport\SupThrSrv\SupThrSrv.exe [?]

S3 AmUStor;AM USB Stroage Driver;C:\Windows\system32\drivers\AmUStor.SYS --> C:\Windows\system32\drivers\AmUStor.SYS [?]

S3 fssfltr;fssfltr;C:\Windows\system32\DRIVERS\fssfltr.sys --> C:\Windows\system32\DRIVERS\fssfltr.sys [?]

S3 fsssvc;Windows Live Family Safety;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2008-12-8 533344]

S3 gupdatem;Google Update-Dienst (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-8-30 135664]

S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-1-15 227232]

S3 netr28ux;RT2870-USB-Drahtlos-LAN-Kartentreiber für Vista;C:\Windows\system32\DRIVERS\netr28ux.sys --> C:\Windows\system32\DRIVERS\netr28ux.sys [?]

S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\system32\DRIVERS\SiSG664.sys --> C:\Windows\system32\DRIVERS\SiSG664.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

.

=============== Created Last 30 ================

.

2012-05-23 21:02:11        --------        d-----w-        C:\Neuer Ordner

2012-05-19 07:27:54        405624        ----a-w-        C:\Windows\System32\drivers\NISx64\1307010.005\symnets.sys

2012-05-19 07:27:53        451192        ----a-r-        C:\Windows\System32\drivers\NISx64\1307010.005\symds64.sys

2012-05-19 07:27:53        37496        ----a-w-        C:\Windows\System32\drivers\NISx64\1307010.005\srtspx64.sys

2012-05-19 07:27:53        1092728        ----a-w-        C:\Windows\System32\drivers\NISx64\1307010.005\symefa64.sys

2012-05-19 07:27:52        737912        ----a-w-        C:\Windows\System32\drivers\NISx64\1307010.005\srtsp64.sys

2012-05-19 07:27:52        190072        ----a-w-        C:\Windows\System32\drivers\NISx64\1307010.005\ironx64.sys

2012-05-19 07:27:52        167048        ----a-w-        C:\Windows\System32\drivers\NISx64\1307010.005\ccsetx64.sys

2012-05-19 07:27:03        --------        d-----w-        C:\Windows\System32\drivers\NISx64\1307010.005

2012-05-18 17:07:15        5126        ----a-w-        C:\Windows\System32\PerfStringBackup.TMP

2012-05-18 16:01:23        --------        d-----w-        C:\Program Files\Symantec

2012-05-18 16:00:25        --------        d-----w-        C:\Windows\System32\drivers\NISx64

2012-05-18 16:00:20        --------        d-----w-        C:\Program Files (x86)\Norton Internet Security

2012-05-18 15:06:48        --------        d-----w-        C:\ProgramData\IObit

2012-05-18 15:06:32        --------        d-----w-        C:\Users\tenni\AppData\Roaming\IObit

2012-05-18 15:06:15        --------        d-----w-        C:\Program Files (x86)\IObit

2012-05-18 11:47:05        --------        d-----w-        C:\Program Files (x86)\Ask.com

2012-05-18 11:46:59        --------        d-----w-        C:\Users\tenni\AppData\Local\APN

2012-05-18 11:46:50        --------        d-----w-        C:\ProgramData\Avira

2012-05-18 10:59:58        279656        ------w-        C:\Windows\System32\MpSigStub.exe

2012-05-18 10:59:05        5316        ----a-w-        C:\Windows\SysWow64\PerfStringBackup.TMP

2012-05-18 10:56:14        --------        d-----w-        C:\Windows\SysWow64\Wat

2012-05-18 10:56:13        --------        d-----w-        C:\Windows\System32\Wat

2012-05-18 10:51:52        --------        d-----w-        C:\Users\tenni\AppData\Roaming\Tific

2012-05-18 10:34:53        --------        d-----w-        C:\Users\tenni\AppData\Local\Symantec

2012-05-18 10:20:58        --------        d-----w-        C:\Users\tenni\AppData\Local\NPE

2012-05-17 21:33:29        --------        d-----w-        C:\Windows\pss

2012-05-17 20:28:07        --------        d-----w-        C:\Temp

2012-05-17 16:32:15        --------        d-----w-        C:\Program Files (x86)\Astonsoft

2012-05-17 11:47:03        --------        d-----w-        C:\Users\tenni\AppData\Roaming\EeeStorageUploader

2012-05-12 13:45:08        1544704        ----a-w-        C:\Windows\System32\DWrite.dll

2012-05-12 13:45:07        1077248        ----a-w-        C:\Windows\SysWow64\DWrite.dll

2012-05-12 13:45:00        5559664        ----a-w-        C:\Windows\System32\ntoskrnl.exe

2012-05-12 13:44:57        3146240        ----a-w-        C:\Windows\System32\win32k.sys

2012-05-12 13:44:56        3968368        ----a-w-        C:\Windows\SysWow64\ntkrnlpa.exe

2012-05-12 13:44:55        3913072        ----a-w-        C:\Windows\SysWow64\ntoskrnl.exe

2012-05-12 10:00:08        75120        ----a-w-        C:\Windows\System32\drivers\partmgr.sys

2012-05-12 10:00:06        1918320        ----a-w-        C:\Windows\System32\drivers\tcpip.sys

2012-05-12 09:59:59        1732096        ----a-w-        C:\Program Files\Windows Journal\NBDoc.DLL

2012-05-12 09:59:59        1367552        ----a-w-        C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll

2012-05-12 09:59:58        936960        ----a-w-        C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll

2012-05-12 09:59:57        1402880        ----a-w-        C:\Program Files\Windows Journal\JNWDRV.dll

2012-05-12 09:59:57        1393664        ----a-w-        C:\Program Files\Windows Journal\JNTFiltr.dll

2012-05-06 16:35:29        476960        ----a-w-        C:\Windows\SysWow64\npdeployJava1.dll

2012-05-06 16:35:29        472864        ----a-w-        C:\Windows\SysWow64\deployJava1.dll

2012-05-01 19:44:37        23408        ----a-w-        C:\Windows\System32\drivers\fs_rec.sys

2012-05-01 19:44:35        81408        ----a-w-        C:\Windows\System32\imagehlp.dll

2012-05-01 19:44:35        159232        ----a-w-        C:\Windows\SysWow64\imagehlp.dll

2012-05-01 19:44:34        5120        ----a-w-        C:\Windows\SysWow64\wmi.dll

2012-05-01 19:44:34        5120        ----a-w-        C:\Windows\System32\wmi.dll

2012-05-01 19:44:34        220672        ----a-w-        C:\Windows\System32\wintrust.dll

2012-05-01 19:44:34        172544        ----a-w-        C:\Windows\SysWow64\wintrust.dll

.

==================== Find3M  ====================

.

2012-05-18 16:01:23        175736        ----a-w-        C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2012-04-03 13:52:13        175616        ----a-w-        C:\Windows\System32\msclmd.dll

2012-04-03 13:52:13        152576        ----a-w-        C:\Windows\SysWow64\msclmd.dll

2012-02-28 06:56:48        2311168        ----a-w-        C:\Windows\System32\jscript9.dll

2012-02-28 06:49:56        1390080        ----a-w-        C:\Windows\System32\wininet.dll

2012-02-28 06:48:57        1493504        ----a-w-        C:\Windows\System32\inetcpl.cpl

2012-02-28 06:42:55        2382848        ----a-w-        C:\Windows\System32\mshtml.tlb

2012-02-28 01:18:55        1799168        ----a-w-        C:\Windows\SysWow64\jscript9.dll

2012-02-28 01:11:21        1427456        ----a-w-        C:\Windows\SysWow64\inetcpl.cpl

2012-02-28 01:11:07        1127424        ----a-w-        C:\Windows\SysWow64\wininet.dll

2012-02-28 01:03:16        2382848        ----a-w-        C:\Windows\SysWow64\mshtml.tlb

.

============= FINISH: 22:19:11,40 ===============

--- --- ---

Hoffentlich könnt ihr mir helfen, die Dateien wieder zu entschlüsseln und die Daten meiner Schwester zu retten!
Vielen Dank schon mal im Voraus für eure geopferte Zeit! :)