Virenscanner vor dem Fix bitte abdrehen

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

CustomCLSID: HKU\S-1-5-21-3181699812-3172478678-2042656238-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\Sehrig\AppData\Roaming\ernden\berdis.dll () <==== ATTENTION
Toolbar: HKU\S-1-5-21-3181699812-3172478678-2042656238-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3181699812-3172478678-2042656238-1000 -> {D30A94EE-42D7-4474-AA56-21DDB84AE1D0} URL = 
BHO: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} ->  No File
HKU\S-1-5-21-3181699812-3172478678-2042656238-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKU\S-1-5-21-3181699812-3172478678-2042656238-1000\...\MountPoints2: {faa106ae-d472-11e3-980a-a4badbe848cf} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL M:\start.exe
C:\Users\Sehrig\AppData\Roaming\ernden
EmptyTemp:
Hosts:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

• Starte nun FRST erneut und klicke den Entfernen Button.
• Das Tool erstellt eine Fixlog.txt.
• Poste mir deren Inhalt.

Guten Morgen Cosinus,
hier die Fixlog

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-02-2015 01
Ran by Sehrig at 2015-02-06 09:32:30 Run:2
Running from C:\Users\Sehrig\Desktop
Loaded Profiles: Sehrig (Available profiles: Sehrig)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
ATTFilter

CustomCLSID: HKU\S-1-5-21-3181699812-3172478678-2042656238-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\Sehrig\AppData\Roaming\ernden\berdis.dll () <==== ATTENTION
Toolbar: HKU\S-1-5-21-3181699812-3172478678-2042656238-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3181699812-3172478678-2042656238-1000 -> {D30A94EE-42D7-4474-AA56-21DDB84AE1D0} URL = 
BHO: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} ->  No File
HKU\S-1-5-21-3181699812-3172478678-2042656238-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x00000000
HKU\S-1-5-21-3181699812-3172478678-2042656238-1000\...\MountPoints2: {faa106ae-d472-11e3-980a-a4badbe848cf} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL M:\start.exe
C:\Users\Sehrig\AppData\Roaming\ernden
EmptyTemp:
Hosts:
         
*****************

ATTFilter => Error: No automatic fix found for this entry.
"HKU\S-1-5-21-3181699812-3172478678-2042656238-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}" => Key deleted successfully.
HKU\S-1-5-21-3181699812-3172478678-2042656238-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => value deleted successfully.
HKCR\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Key not found. 
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-21-3181699812-3172478678-2042656238-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D30A94EE-42D7-4474-AA56-21DDB84AE1D0} => Key not found. 
HKCR\CLSID\{D30A94EE-42D7-4474-AA56-21DDB84AE1D0} => Key not found. 
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}" => Key deleted successfully.
HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key not found. 
HKU\S-1-5-21-3181699812-3172478678-2042656238-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoDriveTypeAutoRun => value deleted successfully.
"HKU\S-1-5-21-3181699812-3172478678-2042656238-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{faa106ae-d472-11e3-980a-a4badbe848cf}" => Key deleted successfully.
HKCR\CLSID\{faa106ae-d472-11e3-980a-a4badbe848cf} => Key not found. 
C:\Users\Sehrig\AppData\Roaming\ernden => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 392.8 MB temporary data.


The system needed a reboot. 

==== End of Fixlog 09:32:37 ====
         

Nach dem Neustart ist es im Task Manager bisher ruhig. Ich lasse den PC mal an und beobachte das.
Viele Grüße
Grolltar