das Versuchskaninchen lebt noch und hat den Test bestanden. Was für ein Nervenkitzel


Hab den ComboFix nochmals neu laufen lassen und während des Laufs nix angefaßt Hier der Post dazu

ComboFix 14-07-25.01 - King 28.07.2014  19:24:19.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2037.1176 [GMT 2:00]
ausgeführt von:: c:\users\King\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\uninstall.exe
c:\uninstall.exe\023.dat
c:\uninstall.exe\023v.dat
c:\uninstall.exe\ActiveDrv.vbs
c:\uninstall.exe\AppDataFile.cfx
c:\uninstall.exe\AppDataFolder.cfx
c:\uninstall.exe\appinit.bad
c:\uninstall.exe\asp.str
c:\uninstall.exe\Assoc.cmd
c:\uninstall.exe\ATTRIB.3XE
c:\uninstall.exe\Auto-RC.cmd
c:\uninstall.exe\av.cmd
c:\uninstall.exe\av.vbs
c:\uninstall.exe\AWF.cmd
c:\uninstall.exe\badclsid
c:\uninstall.exe\BFE.dat
c:\uninstall.exe\Boot-Rk.cmd
c:\uninstall.exe\Boot.bat
c:\uninstall.exe\BootDrv.vbs
c:\uninstall.exe\c.bat
c:\uninstall.exe\c.mrk
c:\uninstall.exe\Catch-sub.cmd
c:\uninstall.exe\catchme.3XE
c:\uninstall.exe\CCS.bat
c:\uninstall.exe\CF-Script.cmd
c:\uninstall.exe\CF5219.3XE
c:\uninstall.exe\CHCP.bat
c:\uninstall.exe\clsid.c
c:\uninstall.exe\clsid.dat
c:\uninstall.exe\Combobatch.bat
c:\uninstall.exe\ComboFix-Download.3XE
c:\uninstall.exe\Create.cmd
c:\uninstall.exe\Creg.dat
c:\uninstall.exe\CregC.cmd
c:\uninstall.exe\CregC.dat
c:\uninstall.exe\CregC_.dat
c:\uninstall.exe\CSCRIPT.3XE
c:\uninstall.exe\d-delA.dat
c:\uninstall.exe\dd.3XE
c:\uninstall.exe\ddsDo.sed
c:\uninstall.exe\de-DE\ATTRIB.3XE.mui
c:\uninstall.exe\de-DE\CF5219.3XE.mui
c:\uninstall.exe\de-DE\cmd.3XE.mui
c:\uninstall.exe\de-DE\CSCRIPT.3XE.mui
c:\uninstall.exe\de-DE\PING.3XE.mui
c:\uninstall.exe\de-DE\REGT.3XE.mui
c:\uninstall.exe\de-DE\ROUTE.3XE.mui
c:\uninstall.exe\DelClsid.bat
c:\uninstall.exe\DelClsid64.bat
c:\uninstall.exe\desktop.ini
c:\uninstall.exe\DesktopFile.cfx
c:\uninstall.exe\DisclaimED.dat
c:\uninstall.exe\DPF.str
c:\uninstall.exe\DrvRun.vbs
c:\uninstall.exe\dumphive.3XE
c:\uninstall.exe\embedded.sed
c:\uninstall.exe\en-US\iexplore.exe
c:\uninstall.exe\ERDNT.e_e
c:\uninstall.exe\ERDNTDOS.LOC
c:\uninstall.exe\ERDNTWIN.LOC
c:\uninstall.exe\ERUNT.3XE
c:\uninstall.exe\erunt.dat
c:\uninstall.exe\ERUNT.LOC
c:\uninstall.exe\Exe.reg
c:\uninstall.exe\extract.3XE
c:\uninstall.exe\FavoriteFolder.cfx
c:\uninstall.exe\FavoritesFile.cfx
c:\uninstall.exe\FD-SV.cmd
c:\uninstall.exe\ffdefstr.dll
c:\uninstall.exe\ffext.pif
c:\uninstall.exe\FileKill.3XE
c:\uninstall.exe\files.pif
c:\uninstall.exe\Fin.dat
c:\uninstall.exe\FIND3M.bat
c:\uninstall.exe\FIXLSP.bat
c:\uninstall.exe\FIXLSP64.cmd
c:\uninstall.exe\FKMGen.cmd
c:\uninstall.exe\ForeignWht
c:\uninstall.exe\GetHive.cmd
c:\uninstall.exe\grep.3XE
c:\uninstall.exe\gsar.3XE
c:\uninstall.exe\handle.3XE
c:\uninstall.exe\hidec.3XE
c:\uninstall.exe\history.bat
c:\uninstall.exe\hwid.pif
c:\uninstall.exe\iexplore.exe
c:\uninstall.exe\image001.gif
c:\uninstall.exe\Imefile.dat
c:\uninstall.exe\Install-RC.cmd
c:\uninstall.exe\iphlpsvc.vista.dat
c:\uninstall.exe\iphlpsvc.w7.dat
c:\uninstall.exe\iphlpsvc.w8.dat
c:\uninstall.exe\katch.cmd
c:\uninstall.exe\Kill-All.cmd
c:\uninstall.exe\King.user.cf
c:\uninstall.exe\kmd.dat
c:\uninstall.exe\KNetSvcs.vbs
c:\uninstall.exe\Lang.bat
c:\uninstall.exe\List-B.bat
c:\uninstall.exe\List-C.bat
c:\uninstall.exe\List-D.bat
c:\uninstall.exe\List.bat
c:\uninstall.exe\lnkread.vbs
c:\uninstall.exe\LocalAppDataFile.cfx
c:\uninstall.exe\LocalAppDataFolder.cfx
c:\uninstall.exe\LocalService.dat
c:\uninstall.exe\LocalServiceNetworkRestricted.dat
c:\uninstall.exe\LocalSettingsFile.cfx
c:\uninstall.exe\LocalSettingsFolder.cfx
c:\uninstall.exe\LocalSystemNetworkRestricted.dat
c:\uninstall.exe\mbr.3XE
c:\uninstall.exe\mbr.chk
c:\uninstall.exe\md5sum.pif
c:\uninstall.exe\MDWht.dat
c:\uninstall.exe\MoveIt.bat
c:\uninstall.exe\MpsSvc.dat
c:\uninstall.exe\mtee.3XE
c:\uninstall.exe\MUI
c:\uninstall.exe\MWindows.dat
c:\uninstall.exe\mynul.dat
c:\uninstall.exe\MZChanged.dat
c:\uninstall.exe\N_\16937
c:\uninstall.exe\N_\3705
c:\uninstall.exe\ncmd.com
c:\uninstall.exe\ND_.bat
c:\uninstall.exe\ND_64.bat
c:\uninstall.exe\ndis_combofix.dat
c:\uninstall.exe\netsvc.bad.dat
c:\uninstall.exe\netsvc.dat
c:\uninstall.exe\NetworkService.dat
c:\uninstall.exe\NirCmd.3XE
c:\uninstall.exe\NircmdB.exe
c:\uninstall.exe\NirCmdC.3XE
c:\uninstall.exe\NIRKMD.3XE
c:\uninstall.exe\NlsLanguageDefault
c:\uninstall.exe\NT-OS.cmd
c:\uninstall.exe\NULL
c:\uninstall.exe\OSid.vbs
c:\uninstall.exe\pausep.3XE
c:\uninstall.exe\PersonalFile.cfx
c:\uninstall.exe\PersonalFolder.cfx
c:\uninstall.exe\pev.3XE
c:\uninstall.exe\PEV.exe
c:\uninstall.exe\pevb.3XE
c:\uninstall.exe\PING.3XE
c:\uninstall.exe\Policies.dat
c:\uninstall.exe\powp.dat
c:\uninstall.exe\Prep.inf
c:\uninstall.exe\ProfilesFile.cfx
c:\uninstall.exe\ProfilesFolder.cfx
c:\uninstall.exe\ProgramsFile.cfx
c:\uninstall.exe\ProgramsFolder.cfx
c:\uninstall.exe\Purity.dat
c:\uninstall.exe\PV.3XE
c:\uninstall.exe\pv.com
c:\uninstall.exe\rar_sfx.cmd
c:\uninstall.exe\RCLink.dat
c:\uninstall.exe\REGDACL.sed
c:\uninstall.exe\RegDo.sed
c:\uninstall.exe\region.dat
c:\uninstall.exe\RegScan.cmd
c:\uninstall.exe\RegScan64.cmd
c:\uninstall.exe\REGT.3XE
c:\uninstall.exe\Resident.txt
c:\uninstall.exe\restore_pt.dat
c:\uninstall.exe\restore_pt.vbs
c:\uninstall.exe\Rkey.cmd
c:\uninstall.exe\rmbr.3XE
c:\uninstall.exe\RNullFix64.3XE
c:\uninstall.exe\rogues.dat
c:\uninstall.exe\ROUTE.3XE
c:\uninstall.exe\run2.sed
c:\uninstall.exe\Rust.str
c:\uninstall.exe\s0rt.3XE
c:\uninstall.exe\safeboot.dat
c:\uninstall.exe\safeboot.def.dat
c:\uninstall.exe\sed.3XE
c:\uninstall.exe\SetEnvmt.bat
c:\uninstall.exe\setpath.3XE
c:\uninstall.exe\setpath_N.cmd
c:\uninstall.exe\SF.exe
c:\uninstall.exe\sfx.cmd
c:\uninstall.exe\ShAccess.dat
c:\uninstall.exe\SnapShot.cmd
c:\uninstall.exe\sqlite3.3XE
c:\uninstall.exe\SRestore.cmd
c:\uninstall.exe\srizbi.md5
c:\uninstall.exe\Start_dat
c:\uninstall.exe\StartMenuFile.cfx
c:\uninstall.exe\StartMenuFolder.cfx
c:\uninstall.exe\StartUpFile.cfx
c:\uninstall.exe\SuppScan.cmd
c:\uninstall.exe\svc_wht.dat
c:\uninstall.exe\SvcDrv.vbs
c:\uninstall.exe\svchost.dat
c:\uninstall.exe\swreg.3XE
c:\uninstall.exe\swsc.3XE
c:\uninstall.exe\swxcacls.3XE
c:\uninstall.exe\system_ini.dat
c:\uninstall.exe\tail.3XE
c:\uninstall.exe\TemplatesFile.cfx
c:\uninstall.exe\TemplatesFolder.cfx
c:\uninstall.exe\toolbar.sed
c:\uninstall.exe\Update-CF.cmd
c:\uninstall.exe\VBR.pif
c:\uninstall.exe\VerCF.bat
c:\uninstall.exe\VikPev00
c:\uninstall.exe\VInfo
c:\uninstall.exe\VInfo2
c:\uninstall.exe\VINFO3
c:\uninstall.exe\Vipev.dat
c:\uninstall.exe\Vista.krl
c:\uninstall.exe\Vista.mac
c:\uninstall.exe\vistaMcode.dat
c:\uninstall.exe\vistareg.dat
c:\uninstall.exe\vun.dat
c:\uninstall.exe\VwinTemp.dacl
c:\uninstall.exe\w7Mcode.dat
c:\uninstall.exe\w8reg.dat
c:\uninstall.exe\Wmi_rem.vbs
c:\uninstall.exe\xpmcode.dat
c:\uninstall.exe\XPSBoot.reg
c:\uninstall.exe\zDomain.dat
c:\uninstall.exe\zhsvc.dat
c:\uninstall.exe\zip.3XE
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-06-28 bis 2014-07-28  ))))))))))))))))))))))))))))))
.
.
2014-07-28 17:32 . 2014-07-28 17:32	--------	d-----w-	c:\users\King\AppData\Local\temp
2014-07-28 17:32 . 2014-07-28 17:32	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-07-28 17:04 . 2014-07-28 17:04	62576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{E4C52842-96FA-477B-B178-135DE816A1A4}\offreg.dll
2014-07-26 07:57 . 2014-07-02 03:11	8217224	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{E4C52842-96FA-477B-B178-135DE816A1A4}\mpengine.dll
2014-07-20 18:11 . 2014-07-20 18:11	--------	d-----w-	c:\users\King\AppData\Roaming\Avira
2014-07-20 18:08 . 2014-07-02 11:06	97648	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-07-20 18:08 . 2014-07-02 11:06	37352	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2014-07-20 18:08 . 2014-07-02 11:06	136216	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-07-20 18:08 . 2014-07-20 18:08	--------	d-----w-	c:\programdata\Avira
2014-07-20 18:08 . 2014-07-20 18:08	--------	d-----w-	c:\program files\Avira
2014-07-20 17:37 . 2014-07-20 17:45	--------	d-----w-	c:\windows\system32\catroot2
2014-07-20 17:25 . 2014-07-28 16:16	--------	d-----w-	c:\windows\system32\wbem\repository
2014-07-20 17:01 . 2014-07-20 17:01	--------	d-----w-	C:\RegBackup
2014-07-20 16:27 . 2014-07-20 16:27	--------	d-----w-	c:\program files\Tweaking.com
2014-07-18 13:36 . 2014-07-24 18:43	--------	d-----w-	c:\windows\ERUNT
2014-07-17 15:46 . 2014-07-17 15:46	--------	d-----w-	c:\program files\Common Files\Java
2014-07-17 15:46 . 2014-07-11 01:02	96680	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2014-07-13 10:11 . 2014-07-21 16:04	110296	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-07-13 10:10 . 2014-05-12 05:26	51928	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-07-13 10:10 . 2014-05-12 05:25	74456	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-07-13 10:10 . 2014-07-13 10:10	--------	d-----w-	c:\program files\ Malwarebytes Anti-Malware 
2014-07-10 15:11 . 2014-06-02 10:31	1218048	----a-w-	c:\program files\Windows Journal\NBDoc.DLL
2014-07-10 15:11 . 2014-06-02 10:30	983552	----a-w-	c:\program files\Windows Journal\JNTFiltr.dll
2014-07-10 15:11 . 2014-06-02 10:30	937472	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2014-07-10 15:11 . 2014-06-02 10:30	965120	----a-w-	c:\program files\Windows Journal\JNWDRV.dll
2014-07-10 15:11 . 2014-06-07 02:08	1305088	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll
2014-07-10 15:11 . 2014-06-07 00:19	2051072	----a-w-	c:\windows\system32\win32k.sys
2014-07-10 15:11 . 2014-06-07 02:08	149504	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\tabskb.dll
2014-07-10 15:11 . 2014-06-07 02:08	114688	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\TipBand.dll
2014-07-10 15:11 . 2014-06-06 08:59	506880	----a-w-	c:\windows\system32\qedit.dll
2014-07-10 15:11 . 2014-05-30 06:53	273408	----a-w-	c:\windows\system32\drivers\afd.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-13 08:26 . 2012-03-31 12:05	699056	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2014-07-13 08:26 . 2011-05-19 14:03	71344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-12 05:25 . 2014-01-19 12:31	23256	----a-w-	c:\windows\system32\drivers\mbam.sys
2005-07-14 11:31	32256	--sh--w-	c:\windows\System32\AVSredirect.dll
2006-05-03 09:06	163328	--sha-r-	c:\windows\System32\flvDX.dll
2007-02-21 10:47	31232	--sha-r-	c:\windows\System32\msfDX.dll
2008-03-16 12:30	216064	--sha-r-	c:\windows\System32\nbDX.dll
2011-02-11 09:26	112128	--sha-r-	c:\windows\System32\OptimFROG.dll
2010-01-06 22:00	107520	--sha-r-	c:\windows\System32\TAKDSDecoder.dll
2012-10-05 17:54	188416	--sha-r-	c:\windows\System32\winDCE32.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 88363]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-11 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-11 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-11 133656]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2013-06-28 2255184]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2014-07-11 256896]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-07-02 750160]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2010-6-13 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2014-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-07-12 21:18]
.
2014-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-07-12 21:18]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
IE: Free YouTube Download - c:\users\King\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\users\King\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\King\AppData\Roaming\Mozilla\Firefox\Profiles\d9ihkatk.default-1368551772266\
FF - prefs.js: browser.startup.homepage - www.google.de
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2014-07-28 19:32
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-07-28  19:35:35
ComboFix-quarantined-files.txt  2014-07-28 17:35
.
Vor Suchlauf: 10 Verzeichnis(se), 17.866.125.312 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 16.462.168.064 Bytes frei
.
- - End Of File - - 126B329332CE955D2E154775EC313679
5C616939100B85E558DA92B899A0FC36
         

Hab danach (diesmal) den ComboFix über WINDOWS Taste und R und ComboFix /uninstall eingetragen und OKgedrückt ... und er ist deinstalliert .... hat auch wunderbar beklappt.

Ich hab jetzt im Windows Explorer folgendes stehn



Normalerweise müßte unter BENUTZER auch der DEFAULT stehn (in der roten Box). Das DEFAULT ist aber weiterhin nur im Bereich RegBackUp (grüne Box).

Ist das schlimm oder soll ich das so lassen???

Der Windows Defender muß immer noch manuell eingeschalten werden. Wäre es in Ordnung, den hier Windows Repair - All in one zu machen?

Ja mach mal das Repair. Der User ist eigentlich schnuppe

• Windows Repair durchgeführt.
• Windows Defender ist wieder aktiv
• Avira neu installiert
• Mit DelFix die verwendeten Programme deinstalliert

Alles läuft nun soweit sauber!!!!!!!!!!!!!!!!!!!!!!!!!!!


Im Windows Explorer wird weiter das RegBackUp angezeigt.



Bleibt das so stehen oder löst sich das irgendwann "in Luft auf" bzw. weißt du, warum das noch da ist und welchen Nutzung das hat?

Den Ordner kannste eigentlich löschen

wird gemacht!

... du bist super Schrauber!!!!!

Gern Geschehen