starker Virenverdacht, langsamer Rechner

ComboFix 14-08-29.03 - Boris 30.08.2014  20:45:54.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3069.1436 [GMT 2:00]
ausgeführt von:: c:\users\Boris\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-07-28 bis 2014-08-30  ))))))))))))))))))))))))))))))
.
.
2014-08-30 19:14 . 2014-08-30 19:14	--------	d-----w-	c:\users\Public\AppData\Local\temp
2014-08-30 19:14 . 2014-08-30 19:14	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-08-30 18:38 . 2014-08-21 02:44	8581864	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{BB4E1C2D-312E-477A-863A-B60D2FEBD081}\mpengine.dll
2014-08-29 10:07 . 2014-08-29 10:10	--------	d-----w-	C:\FRST
2014-08-29 09:06 . 2014-08-22 23:26	2054656	----a-w-	c:\windows\system32\win32k.sys
2014-08-29 09:06 . 2014-08-23 01:03	297984	----a-w-	c:\windows\system32\gdi32.dll
2014-08-29 08:03 . 2014-08-21 02:44	8581864	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-08-17 18:39 . 2014-06-26 22:17	99480	----a-w-	c:\windows\system32\infocardapi.dll
2014-08-17 18:39 . 2014-06-26 22:17	8856	----a-w-	c:\windows\system32\icardres.dll
2014-08-17 18:39 . 2014-06-26 22:17	619664	----a-w-	c:\windows\system32\icardagt.exe
2014-08-17 18:39 . 2014-06-06 04:28	35480	----a-w-	c:\windows\system32\TsWpfWrp.exe
2014-08-17 18:09 . 2014-06-02 10:31	2263552	----a-w-	c:\windows\system32\msi.dll
2014-08-17 18:09 . 2014-06-02 10:30	1993728	----a-w-	c:\windows\system32\authui.dll
2014-08-17 18:09 . 2014-06-02 08:56	82432	----a-w-	c:\windows\system32\consent.exe
2014-08-17 18:09 . 2014-06-02 10:31	332800	----a-w-	c:\windows\system32\msihnd.dll
2014-08-17 18:09 . 2014-06-02 10:30	33280	----a-w-	c:\windows\system32\appinfo.dll
2014-08-17 18:08 . 2014-06-14 00:44	638400	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys
2014-08-17 18:08 . 2014-06-14 00:33	37376	----a-w-	c:\windows\system32\cdd.dll
2014-08-17 18:08 . 2014-07-08 00:46	2048	----a-w-	c:\windows\system32\tzres.dll
2014-08-03 09:53 . 2014-08-03 09:53	188304	----a-w-	c:\program files\Mozilla Firefox\plugins\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-08-17 20:00 . 2012-07-30 14:44	71344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-08-17 20:00 . 2012-07-30 14:44	699568	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2014-07-19 15:09 . 2014-07-03 15:24	110296	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-06 08:59 . 2014-07-10 17:13	506880	----a-w-	c:\windows\system32\qedit.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"RtHDVCpl"="RtHDVCpl.exe" [2007-06-13 4489216]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-08 68640]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 951576]
"SMARTClassroomCoordinator.exe"="c:\program files\SMART Technologies\Education Software\SMARTClassroomCoordinator.exe" [2011-06-22 485232]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"VantageService"="c:\program files\SMART Technologies\Education Software\VantageService.exe" [2013-03-07 190800]
"SMART Board Tools"="c:\program files\SMART Technologies\Education Software\SMARTBoardTools.exe" [2013-01-31 9279824]
"sbsdk-server"="c:\program files\SMART Technologies\Education Software\sbsdk-server\NodeLauncher.exe" [2013-03-07 62800]
"SMART Board Service"="c:\program files\SMART Technologies\Education Software\SMARTBoardService.exe" [2013-03-07 2111824]
"SMART SNMP Agent"="c:\program files\SMART Technologies\Education Software\SMARTSNMPAgent.exe" [2013-03-07 968528]
"SMART Ink"="c:\program files\SMART Technologies\Education Software\SMARTInk.exe" [2013-03-04 99152]
"Response Desktop Menu"="c:\program files\SMART Technologies\Education Software\DesktopMenu.exe" [2013-05-23 1028944]
"ResponseConnectorService"="c:\program files\SMART Technologies\Education Software\response-connector-server\NodeLauncher.exe" [2013-05-23 40448]
"PMBVolumeWatcher"="c:\program files\Sony\PlayMemories Home\PMBVolumeWatcher.exe" [2012-02-15 688184]
.
c:\users\Boris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Boris\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-8-15 36414752]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-4-24 723760]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.150\SSScheduler.exe [2014-4-9 279456]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE -b -l [2001-2-13 83360]
Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2013-12-6 565464]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"NoHotStart"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-07-18 08:53	451872	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-30 20:00]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.samsungcomputer.com/
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Boris\AppData\Roaming\Mozilla\Firefox\Profiles\bk86vv7l.boris\
FF - prefs.js: browser.search.selectedEngine - Google
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - c:\users\Boris\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - c:\users\Boris\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
ShellIconOverlayIdentifiers-{FB314EDD-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDE-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - c:\users\Boris\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
ShellIconOverlayIdentifiers-{FB314EDF-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - c:\users\Boris\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
ShellIconOverlayIdentifiers-{FB314EE0-A251-47B7-93E1-CDD82E34AF8B} - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2014-08-30 21:14
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MWAC]
"ImagePath"="\??\c:\windows\system32\drivers\"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(5096)
c:\windows\system32\btmmhook.dll
.
Zeit der Fertigstellung: 2014-08-30  21:16:29
ComboFix-quarantined-files.txt  2014-08-30 19:16
.
Vor Suchlauf: 14 Verzeichnis(se), 51.553.718.272 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 52.110.118.912 Bytes frei
.
- - End Of File - - 46D71968A2664A832AC5193283EBB95D
61A349592C4728853F4A90FF78F7628E