Trojaner welcher Mailkonten von Outlook hackt und dadurch Spam verschickt

ComboFix 14-06-04.01 - Administrator 05.06.2014  15:12:47.1.4 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3271.2379 [GMT 2:00]
ausgeführt von:: c:\users\Administrator\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\2a49092f-3c72-4834-9487-1d16ec2281ba
C:\System
c:\system\win_qs.jqx
c:\users\scholz\AppData\Roaming\010112.txt
c:\users\scholz\AppData\Roaming\Etwym
c:\users\scholz\AppData\Roaming\Etwym\vyuxe.uci
c:\users\scholz\AppData\Roaming\Imuh
c:\users\scholz\AppData\Roaming\Imuh\undi.vis
c:\users\scholz\AppData\Roaming\Ipdu
c:\users\scholz\AppData\Roaming\Ipdu\mesy.utd
c:\users\scholz\AppData\Roaming\Java\OpenCL.dll
c:\users\scholz\AppData\Roaming\Nerequ
c:\users\scholz\AppData\Roaming\Nerequ\idysm.qaa
c:\users\scholz\AppData\Roaming\Teno
c:\users\scholz\AppData\Roaming\Teno\qagu.tmp
c:\users\scholz\AppData\Roaming\Teno\qagu.upi
c:\windows\IsUn0407.exe
c:\windows\system32\Temp
.
Infizierte Kopie von c:\windows\system32\userinit.exe wurde gefunden und desinfiziert 
Kopie von - c:\windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe wurde wiederhergestellt 
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ACEDRV11
-------\Service_acedrv11
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-05-05 bis 2014-06-05  ))))))))))))))))))))))))))))))
.
.
2014-06-05 13:16 . 2014-06-05 13:16	--------	d-----w-	c:\users\TEMP\AppData\Local\temp
2014-06-05 13:16 . 2014-06-05 13:16	--------	d-----w-	c:\users\scholz\AppData\Local\temp
2014-06-05 13:16 . 2014-06-05 13:16	--------	d-----w-	c:\users\DefaultAppPool\AppData\Local\temp
2014-06-05 13:16 . 2014-06-05 13:16	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-06-05 13:16 . 2014-06-05 13:16	--------	d-----w-	c:\users\adsek\AppData\Local\temp
2014-06-05 13:16 . 2014-06-05 13:16	--------	d-----w-	c:\users\admin\AppData\Local\temp
2014-06-05 13:16 . 2014-06-05 13:16	--------	d-----w-	c:\users\adkar\AppData\Local\temp
2014-06-05 12:48 . 2014-06-05 12:48	--------	d-----w-	c:\users\admin\AppData\Roaming\Apple Computer
2014-06-04 16:38 . 2014-06-04 16:38	--------	d-----w-	c:\users\Administrator\AppData\Local\Apple
2014-06-04 08:15 . 2014-06-04 15:34	--------	d-----w-	C:\FRST
2014-06-03 10:00 . 2014-06-03 12:11	--------	d---a-w-	C:\Kaspersky Rescue Disk 10.0
2014-06-02 14:31 . 2014-06-02 14:31	--------	d-----w-	c:\users\scholz\AppData\Roaming\Foxit Software
2014-06-02 14:31 . 2014-06-02 14:31	--------	d-----w-	c:\users\Public\Foxit Software
2014-06-02 14:31 . 2014-06-02 14:31	--------	d-----w-	c:\program files\Foxit Software
2014-06-02 14:20 . 2014-06-05 12:18	110296	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-02 14:20 . 2014-06-02 14:20	--------	d-----w-	c:\program files\ Malwarebytes Anti-Malware 
2014-06-02 14:20 . 2014-05-12 05:26	51928	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-06-02 14:20 . 2014-05-12 05:25	74456	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-06-02 14:20 . 2014-05-12 05:25	23256	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-06-02 14:14 . 2014-06-02 14:14	--------	d-----w-	c:\windows\Sun
2014-06-02 14:13 . 2014-06-02 14:13	--------	d-----w-	c:\program files\Common Files\Java
2014-06-02 14:13 . 2014-05-07 13:02	96680	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2014-06-02 14:07 . 2014-06-02 14:07	--------	d-----w-	c:\program files\CCleaner
2014-06-02 13:32 . 2014-06-02 13:32	--------	d-----w-	c:\users\scholz\AppData\Local\Adobe
2014-06-02 07:22 . 2014-06-02 07:22	--------	d-----w-	c:\programdata\Malwarebytes
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-13 20:04 . 2014-02-20 08:40	692400	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2014-05-13 20:04 . 2011-09-28 13:00	70832	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-06-02 07:42 . 2014-06-02 07:42	97208	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SfWinStartInfo"="c:\program files\SFirm\sfWinStartupInfo.exe" [2014-04-22 81496]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-02-20 689744]
"USB3MON"="c:\program files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-05-20 291648]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI.exe" [2012-08-07 5986960]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2014-05-07 256896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLUA"= 0 (0x0)
.
R2 Ca1528av;SPCA1528 Video Camera Service;c:\windows\system32\Drivers\Ca1528av.sys [x]
R3 Bulk1528;SPCA1528 Still Camera Service;c:\windows\system32\Drivers\Bulk1528.sys [x]
R3 CBUSB;MARX CryptoTech LP;c:\windows\system32\drivers\CBUSB.sys [2014-02-08 45056]
R3 cjusb;REINER SCT cyberJack USB Driver;c:\windows\system32\DRIVERS\cjusb.sys [2011-03-29 28144]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2013-12-04 108032]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2012-03-10 1343400]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys [2012-05-20 15680]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-12-05 37352]
S1 bizVSerial;Franson VSerial;c:\windows\system32\drivers\bizVSerialNT.sys [2007-05-31 14949]
S2 AntiVirMailService;Avira Email Schutz;c:\program files\Avira\AntiVir Desktop\avmailc.exe [2014-03-13 896592]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-02-20 440400]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2014-02-20 1017424]
S2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\system32\cjpcsc.exe [2011-05-09 508848]
S2 DBService;DATA BECKER Update Service;c:\program files\Common Files\DATA BECKER Shared\DBService.exe [2010-10-28 189776]
S2 FoxitCloudUpdateService;Foxit Cloud Safe Update Service;c:\program files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [2014-03-11 241728]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files\PDF Architect\HelperService.exe [2013-04-08 1320496]
S2 PDF Architect Service;PDF Architect Service;c:\program files\PDF Architect\ConversionService.exe [2013-04-08 799280]
S2 TeamViewer9;TeamViewer 9;c:\program files\TeamViewer\Version9\TeamViewer_Service.exe [2014-04-25 5024576]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys [2012-05-20 350016]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys [2012-05-20 793920]
S3 MEI;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECI.sys [2012-07-17 55104]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2012-06-12 552080]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
iissvcs	REG_MULTI_SZ   	w3svc was
apphost	REG_MULTI_SZ   	apphostsvc
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-20 20:04]
.
2014-06-04 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-02-25 10:22]
.
.
------- Zusätzlicher Suchlauf -------
.
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: Interfaces\{5D47328C-5E64-4718-B37D-748E7E3235CC}: NameServer = 192.168.115.10
TCP: Interfaces\{AB170DDD-617A-4BC1-BDFC-560F47E700CD}: NameServer = 192.168.115.10
DPF: {B1953AD6-C50E-11D3-B020-00A0C9251384} - hxxp://www.o2c.de/download/o2cplayer.cab
FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\xkno36ag.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-Regedit32 - c:\windows\system32\regedit.exe
AddRemove-Cultures2 Demo - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-674125300-1903334115-1943699838-500\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (Administrator)
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,3b,1b,0c,10,ca,
   05,9b,b9,e9,0c,b9,9d,a5,0b,85,6d,fb,dc
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,3b,1b,ab,8f,01,
   6b,c6,87,46,08,aa,e0,8b,86,f8,9a,6b,5c
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,3b,1b,74,cc,25,
   8d,34,1d,d5,04,92,c7,0e,38,7f,4b,25,d9
"{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}"=hex:51,66,7a,6c,4c,1d,3b,1b,53,c6,7c,
   b2,6e,2c,52,08,aa,f1,91,3a,bc,ee,66,42
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,3b,1b,54,18,dd,
   c6,73,f5,31,0d,a0,7f,c3,79,c8,86,ce,b6
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,3b,1b,21,86,10,
   e2,6c,9d,44,00,a3,30,c9,b5,20,95,13,1c
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,3b,1b,6f,c6,ff,
   a0,53,93,ba,5f,a0,e6,5f,fc,c0,49,f3,10
.
[HKEY_USERS\S-1-5-21-674125300-1903334115-1943699838-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (Administrator)
"Timestamp"=hex:d5,ff,a3,47,71,c3,ce,01
.
[HKEY_USERS\S-1-5-21-674125300-1903334115-1943699838-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fe,f1,c5,56,df,aa,db,49,be,ab,b5,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fe,f1,c5,56,df,aa,db,49,be,ab,b5,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(2188)
c:\program files\ArcSoft\PhotoImpression 5\share\pihook.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\crypserv.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conhost.exe
c:\windows\system32\taskhost.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\TeamViewer\Version9\TeamViewer.exe
c:\program files\TeamViewer\Version9\tv_w32.exe
c:\program files\Google\Update\GoogleUpdate.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-06-05  15:21:56 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-06-05 13:21
.
Vor Suchlauf: 13 Verzeichnis(se), 106.620.129.280 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 106.518.372.352 Bytes frei
.
- - End Of File - - 26648D164857347D8C8AD593E10159ED
A36C5E4F47E84449FF07ED3517B43A31