Trojaner-Board - Windows Vista - Laptop läuft auf Hochtouren besonders im Internet

das Versuchskaninchen lebt noch :D und hat den Test bestanden. Was für ein Nervenkitzel :D

Hab den ComboFix nochmals neu laufen lassen und während des Laufs nix angefaßt ;) Hier der Post dazu
Code:
ComboFix 14-07-25.01 - King 28.07.2014  19:24:19.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2037.1176 [GMT 2:00]

ausgeführt von:: c:\users\King\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}

SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\uninstall.exe

c:\uninstall.exe\023.dat

c:\uninstall.exe\023v.dat

c:\uninstall.exe\ActiveDrv.vbs

c:\uninstall.exe\AppDataFile.cfx

c:\uninstall.exe\AppDataFolder.cfx

c:\uninstall.exe\appinit.bad

c:\uninstall.exe\asp.str

c:\uninstall.exe\Assoc.cmd

c:\uninstall.exe\ATTRIB.3XE

c:\uninstall.exe\Auto-RC.cmd

c:\uninstall.exe\av.cmd

c:\uninstall.exe\av.vbs

c:\uninstall.exe\AWF.cmd

c:\uninstall.exe\badclsid

c:\uninstall.exe\BFE.dat

c:\uninstall.exe\Boot-Rk.cmd

c:\uninstall.exe\Boot.bat

c:\uninstall.exe\BootDrv.vbs

c:\uninstall.exe\c.bat

c:\uninstall.exe\c.mrk

c:\uninstall.exe\Catch-sub.cmd

c:\uninstall.exe\catchme.3XE

c:\uninstall.exe\CCS.bat

c:\uninstall.exe\CF-Script.cmd

c:\uninstall.exe\CF5219.3XE

c:\uninstall.exe\CHCP.bat

c:\uninstall.exe\clsid.c

c:\uninstall.exe\clsid.dat

c:\uninstall.exe\Combobatch.bat

c:\uninstall.exe\ComboFix-Download.3XE

c:\uninstall.exe\Create.cmd

c:\uninstall.exe\Creg.dat

c:\uninstall.exe\CregC.cmd

c:\uninstall.exe\CregC.dat

c:\uninstall.exe\CregC_.dat

c:\uninstall.exe\CSCRIPT.3XE

c:\uninstall.exe\d-delA.dat

c:\uninstall.exe\dd.3XE

c:\uninstall.exe\ddsDo.sed

c:\uninstall.exe\de-DE\ATTRIB.3XE.mui

c:\uninstall.exe\de-DE\CF5219.3XE.mui

c:\uninstall.exe\de-DE\cmd.3XE.mui

c:\uninstall.exe\de-DE\CSCRIPT.3XE.mui

c:\uninstall.exe\de-DE\PING.3XE.mui

c:\uninstall.exe\de-DE\REGT.3XE.mui

c:\uninstall.exe\de-DE\ROUTE.3XE.mui

c:\uninstall.exe\DelClsid.bat

c:\uninstall.exe\DelClsid64.bat

c:\uninstall.exe\desktop.ini

c:\uninstall.exe\DesktopFile.cfx

c:\uninstall.exe\DisclaimED.dat

c:\uninstall.exe\DPF.str

c:\uninstall.exe\DrvRun.vbs

c:\uninstall.exe\dumphive.3XE

c:\uninstall.exe\embedded.sed

c:\uninstall.exe\en-US\iexplore.exe

c:\uninstall.exe\ERDNT.e_e

c:\uninstall.exe\ERDNTDOS.LOC

c:\uninstall.exe\ERDNTWIN.LOC

c:\uninstall.exe\ERUNT.3XE

c:\uninstall.exe\erunt.dat

c:\uninstall.exe\ERUNT.LOC

c:\uninstall.exe\Exe.reg

c:\uninstall.exe\extract.3XE

c:\uninstall.exe\FavoriteFolder.cfx

c:\uninstall.exe\FavoritesFile.cfx

c:\uninstall.exe\FD-SV.cmd

c:\uninstall.exe\ffdefstr.dll

c:\uninstall.exe\ffext.pif

c:\uninstall.exe\FileKill.3XE

c:\uninstall.exe\files.pif

c:\uninstall.exe\Fin.dat

c:\uninstall.exe\FIND3M.bat

c:\uninstall.exe\FIXLSP.bat

c:\uninstall.exe\FIXLSP64.cmd

c:\uninstall.exe\FKMGen.cmd

c:\uninstall.exe\ForeignWht

c:\uninstall.exe\GetHive.cmd

c:\uninstall.exe\grep.3XE

c:\uninstall.exe\gsar.3XE

c:\uninstall.exe\handle.3XE

c:\uninstall.exe\hidec.3XE

c:\uninstall.exe\history.bat

c:\uninstall.exe\hwid.pif

c:\uninstall.exe\iexplore.exe

c:\uninstall.exe\image001.gif

c:\uninstall.exe\Imefile.dat

c:\uninstall.exe\Install-RC.cmd

c:\uninstall.exe\iphlpsvc.vista.dat

c:\uninstall.exe\iphlpsvc.w7.dat

c:\uninstall.exe\iphlpsvc.w8.dat

c:\uninstall.exe\katch.cmd

c:\uninstall.exe\Kill-All.cmd

c:\uninstall.exe\King.user.cf

c:\uninstall.exe\kmd.dat

c:\uninstall.exe\KNetSvcs.vbs

c:\uninstall.exe\Lang.bat

c:\uninstall.exe\List-B.bat

c:\uninstall.exe\List-C.bat

c:\uninstall.exe\List-D.bat

c:\uninstall.exe\List.bat

c:\uninstall.exe\lnkread.vbs

c:\uninstall.exe\LocalAppDataFile.cfx

c:\uninstall.exe\LocalAppDataFolder.cfx

c:\uninstall.exe\LocalService.dat

c:\uninstall.exe\LocalServiceNetworkRestricted.dat

c:\uninstall.exe\LocalSettingsFile.cfx

c:\uninstall.exe\LocalSettingsFolder.cfx

c:\uninstall.exe\LocalSystemNetworkRestricted.dat

c:\uninstall.exe\mbr.3XE

c:\uninstall.exe\mbr.chk

c:\uninstall.exe\md5sum.pif

c:\uninstall.exe\MDWht.dat

c:\uninstall.exe\MoveIt.bat

c:\uninstall.exe\MpsSvc.dat

c:\uninstall.exe\mtee.3XE

c:\uninstall.exe\MUI

c:\uninstall.exe\MWindows.dat

c:\uninstall.exe\mynul.dat

c:\uninstall.exe\MZChanged.dat

c:\uninstall.exe\N_\16937

c:\uninstall.exe\N_\3705

c:\uninstall.exe\ncmd.com

c:\uninstall.exe\ND_.bat

c:\uninstall.exe\ND_64.bat

c:\uninstall.exe\ndis_combofix.dat

c:\uninstall.exe\netsvc.bad.dat

c:\uninstall.exe\netsvc.dat

c:\uninstall.exe\NetworkService.dat

c:\uninstall.exe\NirCmd.3XE

c:\uninstall.exe\NircmdB.exe

c:\uninstall.exe\NirCmdC.3XE

c:\uninstall.exe\NIRKMD.3XE

c:\uninstall.exe\NlsLanguageDefault

c:\uninstall.exe\NT-OS.cmd

c:\uninstall.exe\NULL

c:\uninstall.exe\OSid.vbs

c:\uninstall.exe\pausep.3XE

c:\uninstall.exe\PersonalFile.cfx

c:\uninstall.exe\PersonalFolder.cfx

c:\uninstall.exe\pev.3XE

c:\uninstall.exe\PEV.exe

c:\uninstall.exe\pevb.3XE

c:\uninstall.exe\PING.3XE

c:\uninstall.exe\Policies.dat

c:\uninstall.exe\powp.dat

c:\uninstall.exe\Prep.inf

c:\uninstall.exe\ProfilesFile.cfx

c:\uninstall.exe\ProfilesFolder.cfx

c:\uninstall.exe\ProgramsFile.cfx

c:\uninstall.exe\ProgramsFolder.cfx

c:\uninstall.exe\Purity.dat

c:\uninstall.exe\PV.3XE

c:\uninstall.exe\pv.com

c:\uninstall.exe\rar_sfx.cmd

c:\uninstall.exe\RCLink.dat

c:\uninstall.exe\REGDACL.sed

c:\uninstall.exe\RegDo.sed

c:\uninstall.exe\region.dat

c:\uninstall.exe\RegScan.cmd

c:\uninstall.exe\RegScan64.cmd

c:\uninstall.exe\REGT.3XE

c:\uninstall.exe\Resident.txt

c:\uninstall.exe\restore_pt.dat

c:\uninstall.exe\restore_pt.vbs

c:\uninstall.exe\Rkey.cmd

c:\uninstall.exe\rmbr.3XE

c:\uninstall.exe\RNullFix64.3XE

c:\uninstall.exe\rogues.dat

c:\uninstall.exe\ROUTE.3XE

c:\uninstall.exe\run2.sed

c:\uninstall.exe\Rust.str

c:\uninstall.exe\s0rt.3XE

c:\uninstall.exe\safeboot.dat

c:\uninstall.exe\safeboot.def.dat

c:\uninstall.exe\sed.3XE

c:\uninstall.exe\SetEnvmt.bat

c:\uninstall.exe\setpath.3XE

c:\uninstall.exe\setpath_N.cmd

c:\uninstall.exe\SF.exe

c:\uninstall.exe\sfx.cmd

c:\uninstall.exe\ShAccess.dat

c:\uninstall.exe\SnapShot.cmd

c:\uninstall.exe\sqlite3.3XE

c:\uninstall.exe\SRestore.cmd

c:\uninstall.exe\srizbi.md5

c:\uninstall.exe\Start_dat

c:\uninstall.exe\StartMenuFile.cfx

c:\uninstall.exe\StartMenuFolder.cfx

c:\uninstall.exe\StartUpFile.cfx

c:\uninstall.exe\SuppScan.cmd

c:\uninstall.exe\svc_wht.dat

c:\uninstall.exe\SvcDrv.vbs

c:\uninstall.exe\svchost.dat

c:\uninstall.exe\swreg.3XE

c:\uninstall.exe\swsc.3XE

c:\uninstall.exe\swxcacls.3XE

c:\uninstall.exe\system_ini.dat

c:\uninstall.exe\tail.3XE

c:\uninstall.exe\TemplatesFile.cfx

c:\uninstall.exe\TemplatesFolder.cfx

c:\uninstall.exe\toolbar.sed

c:\uninstall.exe\Update-CF.cmd

c:\uninstall.exe\VBR.pif

c:\uninstall.exe\VerCF.bat

c:\uninstall.exe\VikPev00

c:\uninstall.exe\VInfo

c:\uninstall.exe\VInfo2

c:\uninstall.exe\VINFO3

c:\uninstall.exe\Vipev.dat

c:\uninstall.exe\Vista.krl

c:\uninstall.exe\Vista.mac

c:\uninstall.exe\vistaMcode.dat

c:\uninstall.exe\vistareg.dat

c:\uninstall.exe\vun.dat

c:\uninstall.exe\VwinTemp.dacl

c:\uninstall.exe\w7Mcode.dat

c:\uninstall.exe\w8reg.dat

c:\uninstall.exe\Wmi_rem.vbs

c:\uninstall.exe\xpmcode.dat

c:\uninstall.exe\XPSBoot.reg

c:\uninstall.exe\zDomain.dat

c:\uninstall.exe\zhsvc.dat

c:\uninstall.exe\zip.3XE

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-06-28 bis 2014-07-28  ))))))))))))))))))))))))))))))

.

.

2014-07-28 17:32 . 2014-07-28 17:32        --------        d-----w-        c:\users\King\AppData\Local\temp

2014-07-28 17:32 . 2014-07-28 17:32        --------        d-----w-        c:\users\Default\AppData\Local\temp

2014-07-28 17:04 . 2014-07-28 17:04        62576        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{E4C52842-96FA-477B-B178-135DE816A1A4}\offreg.dll

2014-07-26 07:57 . 2014-07-02 03:11        8217224        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{E4C52842-96FA-477B-B178-135DE816A1A4}\mpengine.dll

2014-07-20 18:11 . 2014-07-20 18:11        --------        d-----w-        c:\users\King\AppData\Roaming\Avira

2014-07-20 18:08 . 2014-07-02 11:06        97648        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2014-07-20 18:08 . 2014-07-02 11:06        37352        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2014-07-20 18:08 . 2014-07-02 11:06        136216        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2014-07-20 18:08 . 2014-07-20 18:08        --------        d-----w-        c:\programdata\Avira

2014-07-20 18:08 . 2014-07-20 18:08        --------        d-----w-        c:\program files\Avira

2014-07-20 17:37 . 2014-07-20 17:45        --------        d-----w-        c:\windows\system32\catroot2

2014-07-20 17:25 . 2014-07-28 16:16        --------        d-----w-        c:\windows\system32\wbem\repository

2014-07-20 17:01 . 2014-07-20 17:01        --------        d-----w-        C:\RegBackup

2014-07-20 16:27 . 2014-07-20 16:27        --------        d-----w-        c:\program files\Tweaking.com

2014-07-18 13:36 . 2014-07-24 18:43        --------        d-----w-        c:\windows\ERUNT

2014-07-17 15:46 . 2014-07-17 15:46        --------        d-----w-        c:\program files\Common Files\Java

2014-07-17 15:46 . 2014-07-11 01:02        96680        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll

2014-07-13 10:11 . 2014-07-21 16:04        110296        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys

2014-07-13 10:10 . 2014-05-12 05:26        51928        ----a-w-        c:\windows\system32\drivers\mwac.sys

2014-07-13 10:10 . 2014-05-12 05:25        74456        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys

2014-07-13 10:10 . 2014-07-13 10:10        --------        d-----w-        c:\program files\Malwarebytes Anti-Malware

2014-07-10 15:11 . 2014-06-02 10:31        1218048        ----a-w-        c:\program files\Windows Journal\NBDoc.DLL

2014-07-10 15:11 . 2014-06-02 10:30        983552        ----a-w-        c:\program files\Windows Journal\JNTFiltr.dll

2014-07-10 15:11 . 2014-06-02 10:30        937472        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\journal.dll

2014-07-10 15:11 . 2014-06-02 10:30        965120        ----a-w-        c:\program files\Windows Journal\JNWDRV.dll

2014-07-10 15:11 . 2014-06-07 02:08        1305088        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll

2014-07-10 15:11 . 2014-06-07 00:19        2051072        ----a-w-        c:\windows\system32\win32k.sys

2014-07-10 15:11 . 2014-06-07 02:08        149504        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\tabskb.dll

2014-07-10 15:11 . 2014-06-07 02:08        114688        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\TipBand.dll

2014-07-10 15:11 . 2014-06-06 08:59        506880        ----a-w-        c:\windows\system32\qedit.dll

2014-07-10 15:11 . 2014-05-30 06:53        273408        ----a-w-        c:\windows\system32\drivers\afd.sys

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-07-13 08:26 . 2012-03-31 12:05        699056        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2014-07-13 08:26 . 2011-05-19 14:03        71344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2014-05-12 05:25 . 2014-01-19 12:31        23256        ----a-w-        c:\windows\system32\drivers\mbam.sys

2005-07-14 11:31        32256        --sh--w-        c:\windows\System32\AVSredirect.dll

2006-05-03 09:06        163328        --sha-r-        c:\windows\System32\flvDX.dll

2007-02-21 10:47        31232        --sha-r-        c:\windows\System32\msfDX.dll

2008-03-16 12:30        216064        --sha-r-        c:\windows\System32\nbDX.dll

2011-02-11 09:26        112128        --sha-r-        c:\windows\System32\OptimFROG.dll

2010-01-06 22:00        107520        --sha-r-        c:\windows\System32\TAKDSDecoder.dll

2012-10-05 17:54        188416        --sha-r-        c:\windows\System32\winDCE32.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 88363]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-11 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-11 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-11 133656]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 815104]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]

"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2013-06-28 2255184]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2014-07-11 256896]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-07-02 750160]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2010-6-13 113664]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"SoftwareSASGeneration"= 1 (0x1)

"EnableSecureUIAPath"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk *\0sdnclean.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]

@="Driver"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]

@="Driver"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Inhalt des "geplante Tasks" Ordners

.

2014-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-07-12 21:18]

.

2014-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-07-12 21:18]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.com

uSearchAssistant = hxxp://www.google.com

IE: Free YouTube Download - c:\users\King\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm

IE: Free YouTube to MP3 Converter - c:\users\King\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\King\AppData\Roaming\Mozilla\Firefox\Profiles\d9ihkatk.default-1368551772266\

FF - prefs.js: browser.startup.homepage - www.google.de

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2014-07-28 19:32

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

Zeit der Fertigstellung: 2014-07-28  19:35:35

ComboFix-quarantined-files.txt  2014-07-28 17:35

.

Vor Suchlauf: 10 Verzeichnis(se), 17.866.125.312 Bytes frei

Nach Suchlauf: 11 Verzeichnis(se), 16.462.168.064 Bytes frei

.

- - End Of File - - 126B329332CE955D2E154775EC313679

5C616939100B85E558DA92B899A0FC36
Hab danach (diesmal) den ComboFix über WINDOWS Taste und R und ComboFix /uninstall eingetragen und OKgedrückt ... und er ist deinstalliert .... hat auch wunderbar beklappt.

Ich hab jetzt im Windows Explorer folgendes stehn

Anhang 68495

Normalerweise müßte unter BENUTZER auch der DEFAULT stehn (in der roten Box). Das DEFAULT ist aber weiterhin nur im Bereich RegBackUp (grüne Box).

Ist das schlimm oder soll ich das so lassen???

Der Windows Defender muß immer noch manuell eingeschalten werden. Wäre es in Ordnung, den hier Windows Repair - All in one zu machen?