Virus eingefangen

ComboFix 15-04-19.01 - PC 23.04.2015  20:05:56.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3327.1762 [GMT 2:00]
ausgeführt von:: c:\users\PC\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Outdated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Antivirus *Disabled/Outdated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-03-23 bis 2015-04-23  ))))))))))))))))))))))))))))))
.
.
2015-04-23 18:13 . 2015-04-23 18:13	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-04-22 17:35 . 2015-04-22 17:35	--------	d-----w-	c:\programdata\Malwarebytes
2015-04-22 17:35 . 2015-04-22 18:22	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-04-22 17:35 . 2015-04-22 18:07	119512	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-04-22 17:33 . 2015-04-22 18:05	92888	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2015-04-21 17:21 . 2015-04-21 17:26	--------	d-----w-	C:\FRST
2015-04-19 12:24 . 2015-04-19 12:24	--------	d-----w-	c:\users\PC\AppData\Roaming\FLEXnet
2015-04-19 11:00 . 2015-04-19 11:00	--------	d-----w-	c:\users\PC\Neuer Ordner
2015-04-17 19:54 . 2015-04-17 19:55	--------	d-----w-	c:\windows\system32\vbox
2015-04-17 19:50 . 2015-04-21 20:28	--------	d-----w-	c:\programdata\AVAST Software
2015-04-17 19:34 . 2014-02-24 22:00	342528	----a-w-	c:\windows\system32\esw2ud.dll
2015-04-17 19:34 . 2012-05-16 22:00	126128	----a-w-	c:\windows\system32\escsvc.exe
2015-04-17 15:56 . 2015-04-17 15:56	--------	d-----w-	c:\users\PC\AppData\Roaming\Avira
2015-04-17 15:55 . 2015-03-24 12:59	37352	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2015-04-17 15:55 . 2015-03-24 12:59	136216	----a-w-	c:\windows\system32\drivers\avipbb.sys
2015-04-17 15:55 . 2015-03-24 12:59	105864	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2015-04-17 15:28 . 2015-04-17 15:28	--------	d-----w-	C:\OETemp
2015-04-14 19:26 . 2015-04-16 02:17	--------	d-----w-	c:\users\PC\{8680f3f1-d5a4-4f00-bcba-04d3bbe2ac43}
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-03-06 04:01 . 2015-03-12 21:16	279040	----a-w-	c:\windows\system32\schannel.dll
2015-02-26 02:01 . 2015-03-12 21:18	3604408	----a-w-	c:\windows\system32\ntkrnlpa.exe
2015-02-26 02:01 . 2015-03-12 21:18	3552184	----a-w-	c:\windows\system32\ntoskrnl.exe
2015-02-26 00:18 . 2015-03-12 21:30	2064384	----a-w-	c:\windows\system32\win32k.sys
2015-02-20 02:03 . 2015-03-12 21:19	34304	----a-w-	c:\windows\system32\atmlib.dll
2015-02-20 00:28 . 2015-03-12 21:19	296960	----a-w-	c:\windows\system32\atmfd.dll
2015-02-13 01:01 . 2015-03-11 16:57	916992	----a-w-	c:\windows\system32\wininet.dll
2015-02-13 01:01 . 2015-03-11 16:57	420864	----a-w-	c:\windows\system32\vbscript.dll
2015-02-13 01:01 . 2015-03-11 16:57	43520	----a-w-	c:\windows\system32\licmgr10.dll
2015-02-13 01:01 . 2015-03-11 16:57	1469440	----a-w-	c:\windows\system32\inetcpl.cpl
2015-02-13 01:01 . 2015-03-11 16:57	71680	----a-w-	c:\windows\system32\iesetup.dll
2015-02-13 01:01 . 2015-03-11 16:57	109056	----a-w-	c:\windows\system32\iesysprep.dll
2015-02-13 01:01 . 2015-03-11 16:57	19456	----a-w-	c:\windows\system32\corpol.dll
2015-02-12 23:31 . 2015-03-11 16:57	385024	----a-w-	c:\windows\system32\html.iec
2015-02-12 23:24 . 2015-03-11 16:57	133632	----a-w-	c:\windows\system32\ieUnatt.exe
2015-02-12 23:24 . 2015-03-11 16:57	1638912	----a-w-	c:\windows\system32\mshtml.tlb
2015-02-10 12:23 . 2013-11-01 18:44	96680	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2015-02-10 12:23 . 2015-02-10 12:25	897960	----a-w-	c:\windows\system32\npdeployJava1.dll
2015-02-10 12:23 . 2015-02-10 12:25	818088	----a-w-	c:\windows\system32\deployJava1.dll
2015-02-09 21:05 . 2012-12-23 14:39	71344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2015-02-09 21:05 . 2012-12-23 14:39	701616	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2015-02-08 20:39 . 2015-02-08 20:39	8464	----a-w-	c:\windows\system32\SpOrder.dll
2015-01-29 01:35 . 2015-03-12 21:31	369664	----a-w-	c:\windows\system32\WMPhoto.dll
2015-01-29 01:35 . 2015-03-12 21:30	975360	----a-w-	c:\windows\system32\WindowsCodecs.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"PhotoShow Deluxe Media Manager"="c:\progra~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" [2005-02-01 163840]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2015-01-23 31087200]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\W32X86\3\E_TATINFE.EXE" [2013-12-16 262208]
"GarminExpressTrayApp"="c:\program files\Garmin\Express Tray\ExpressTray.exe" [2015-01-28 688984]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 4669440]
"Acer Empowering Technology Monitor"="c:\acer\Empowering Technology\SysMonitor.exe" [2007-01-24 319488]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-06 464168]
"Skytel"="Skytel.exe" [2007-06-15 1826816]
"PlayMovie"="c:\program files\Acer Arcade Live\Acer PlayMovie\PMVService.exe" [2007-07-13 178280]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"PDFPrint"="c:\program files\PDF24\pdf24.exe" [2011-02-01 220552]
"Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2013-09-27 559696]
"ApnTBMon"="c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2015-04-06 2005896]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2009-09-11 2403840]
"avgnt"="c:\program files\Avira\Antivirus\avgnt.exe" [2015-03-24 726320]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-02-15 151552]
.
c:\users\PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2006-10-26 98632]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe 9999 [2007-5-7 528384]
PCM Media Sharing.lnk - c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe [2007-5-7 200812]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
S2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2007-04-04 266343]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - BMLoad
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2015-04-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-23 21:05]
.
2015-04-23 c:\windows\Tasks\EPSON XP-225 Series Update {1998D3F2-57DE-4F62-A20D-6554C0D76ED6}.job
- c:\windows\system32\spool\DRIVERS\W32X86\3\E_TTSNFE.EXE [2015-02-25 16:30]
.
2015-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-02 10:47]
.
2015-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-02 10:47]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = about:blank
mWindow Title = Vodafone AG & Co. KG
uSearchURL,(Default) = hxxp://de.rd.yahoo.com/customize/ycomp/defaults/su/*hxxp://de.yahoo.com
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\program files\Avira\Antivirus\avsda.dll
LSP: bmnet.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\xfzrfnrq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.3&q=
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - ExtSQL: !HIDDEN! 2010-07-22 16:28; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: yahoo.ytff.general.dontshowhpoffer - true
pref('extensions.shownSelectionUI',true);
pref('extensions.autoDisableScopes',0);
.
.
------- Dateityp-Verknüpfung -------
.
inifile="%SystemRoot%\system32\NOTEPAD.EXE" %1
txtfile="%SystemRoot%\system32\NOTEPAD.EXE" %1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
HKCU-Run-Acer Tour Reminder - (no file)
HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2015-04-23 20:14
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Live\Acer PlayMovie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_16_0_0_305_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(688)
c:\windows\system32\bmnet.dll
.
- - - - - - - > 'Explorer.exe'(3624)
c:\windows\system32\MsnChatHook.dll
c:\windows\system32\ShowErrMsg.dll
c:\windows\system32\sysenv.dll
c:\windows\system32\BatchCrypto.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\keyManager.dll
.
Zeit der Fertigstellung: 2015-04-23  20:21:09
ComboFix-quarantined-files.txt  2015-04-23 18:21
.
Vor Suchlauf: 14 Verzeichnis(se), 158.374.199.296 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 158.318.854.144 Bytes frei
.
- - End Of File - - 6820F0D3A840C69B14962C91D52ED5D0
A863475757CC50891AA8458C415E4B25