Vista: Nach BKA Virus startet der Sicherheitsdienst nicht mehr

ComboFix 15-01-04.01 - XXXXXXXXXX 04.01.2015  10:51:58.1.2 - x86
ausgeführt von:: c:\users\XXXXXXXXXX\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.pol
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-12-04 bis 2015-01-04  ))))))))))))))))))))))))))))))
.
.
2015-01-04 10:08 . 2015-01-04 10:28	--------	d-----w-	c:\users\XXXXXXXXXX\AppData\Local\temp
2015-01-04 10:08 . 2015-01-04 10:08	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-01-03 15:14 . 2014-12-15 03:13	9054624	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3BD1902C-1F7D-4BFF-B373-A27F13E01FD5}\mpengine.dll
2015-01-03 15:02 . 2015-01-03 15:15	--------	d-----w-	C:\FRST
2015-01-02 09:49 . 2014-09-10 14:30	908840	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2015-01-02 09:49 . 2014-09-10 14:30	908840	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{12D93B18-DEAD-4118-AA10-523E3404D17F}\gapaengine.dll
2015-01-02 09:48 . 2014-12-15 03:13	9054624	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-12-31 07:56 . 2014-12-31 07:57	--------	d-----w-	c:\program files\Microsoft Security Client
2014-12-31 07:55 . 2010-04-05 20:00	221568	----a-w-	c:\windows\system32\drivers\netio.sys
2014-12-10 12:15 . 2014-11-04 00:19	2048	----a-w-	c:\windows\system32\tzres.dll
2014-12-10 12:14 . 2014-11-07 01:33	974848	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-12-10 12:14 . 2014-10-25 01:01	430080	----a-w-	c:\windows\system32\vbscript.dll
2014-12-10 12:02 . 2014-12-03 02:06	278528	----a-w-	c:\windows\system32\schannel.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-12-31 07:16 . 2012-09-04 08:51	701616	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2014-12-31 07:16 . 2011-09-28 08:23	71344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-12-15 03:13 . 2014-12-31 08:09	9054624	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{ACF956AE-CC0A-4235-9471-2D693A75E6BE}\mpengine.dll
2014-10-30 11:24 . 2009-10-02 17:18	229000	------w-	c:\windows\system32\MpSigStub.exe
2014-10-25 01:00 . 2014-12-10 12:00	53760	----a-w-	c:\windows\apppatch\iebrshim.dll
2014-10-24 01:04 . 2014-11-12 12:16	67072	----a-w-	c:\windows\system32\packager.dll
2014-10-24 01:03 . 2014-11-19 12:00	499200	----a-w-	c:\windows\system32\kerberos.dll
2014-10-18 01:08 . 2014-11-12 12:13	564224	----a-w-	c:\windows\system32\oleaut32.dll
2014-10-12 23:34 . 2014-11-12 12:00	2054656	----a-w-	c:\windows\system32\win32k.sys
2014-10-10 01:01 . 2014-11-12 12:17	449536	----a-w-	c:\windows\system32\termsrv.dll
2014-10-10 01:00 . 2014-11-12 12:18	146432	----a-w-	c:\windows\system32\msaudite.dll
2014-10-10 01:00 . 2014-11-12 12:17	1259008	----a-w-	c:\windows\system32\lsasrv.dll
2014-10-09 23:22 . 2014-11-12 12:17	619520	----a-w-	c:\windows\system32\adtschema.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-10-15 202024]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-31 102400]
"PLFSetL"="c:\windows\PLFSetL.exe" [2007-07-05 94208]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2007-09-01 32768]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2007-09-06 188416]
"LMgrOSD"="c:\program files\Launch Manager\OSD.exe" [2006-12-26 180224]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2007-09-07 86016]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-12-18 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-18 8501792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-18 81920]
"IndexSearch"="c:\program files\Nuance\PaperPort\IndexSearch.exe" [2010-03-08 46368]
"PaperPort PTD"="c:\program files\Nuance\PaperPort\pptd40nt.exe" [2010-03-08 29984]
"PPort12reminder"="c:\program files\Nuance\PaperPort\Ereg\Ereg.exe" [2010-02-09 328992]
"ControlCenter4"="c:\program files\ControlCenter4\BrCcBoot.exe" [2010-10-26 139264]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2010-06-10 2621440]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-10-11 60712]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-31 4702208]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2014-10-15 157480]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-08-22 974432]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXMediaServer]
2012-11-13 18:13	450560	----a-w-	c:\program files\DivX\DivX Media Server\DivXMediaServer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2012-11-30 02:06	1263512	----a-w-	c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
2007-01-08 21:17	52256	----a-w-	c:\program files\HomeCinema\PowerDVD\Language\Language.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2007-01-19 10:55	5674352	----a-w-	c:\program files\MSN Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF5 Registry Controller]
2010-03-05 17:11	62752	----a-w-	c:\program files\Nuance\PDF Viewer Plus\RegistryController.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFHook]
2010-03-05 18:11	636192	----a-w-	c:\program files\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-10-31 11:35	4702208	----a-w-	c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2014-07-24 17:55	21653096	----a-r-	c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-10-11 10:04	1826816	----a-w-	c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 12:06	254696	----a-w-	c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\toolbar_eula_launcher]
2007-02-09 14:54	16896	----a-w-	c:\program files\GoogleEULA\EULALauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]
2007-09-13 15:32	222504	------w-	c:\program files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-12-13 10:28	1087816	----a-w-	c:\program files\Google\Chrome\Application\39.0.2171.95\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-01-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-04 07:16]
.
2015-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-01-17 17:28]
.
2015-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-01-17 17:28]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: Mit PDF Viewer Plus öffnen - c:\program files\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll/PlusIEContextMenu.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{6C395699-C9E9-4033-BBF3-620ECC9DDFB9}: NameServer = 8.8.8.8,8.8.8.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
FF - ProfilePath - c:\users\XXXXXXXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\pfwduqny.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de
FF - ExtSQL: !HIDDEN! 2009-09-14 15:39; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=86571b630000000000000015af7a28b5&q=
FF - user.js: extensions.BabylonToolbar.id - 86571b630000000000000015af7a28b5
FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}
FF - user.js: extensions.BabylonToolbar.instlDay - 15690
FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.4.9
FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.4.9
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.4.912:34
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar_i.excTlbr - false
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=117023&tt=5012_5
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar.rvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-HotKeysCmds - c:\windows\system32\hkcmd.exe
HKLM-Run-snp2uvc - c:\windows\vsnp2uvc.exe
HKLM-Run-CtrlVol - c:\program files\Launch Manager\CtrlVol.exe
c:\users\XXXXXXXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\E-Mail.lnk - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-MobileDocuments - c:\program files\Common Files\Apple\Internet Services\ubd.exe
AddRemove-Firebird SQL Server D - c:\program files\ALDI Sued Foto Service\Common\Database\instslct.exe
AddRemove-MEDION Fotos auf CD Sued D - c:\program files\ALDI Sued Foto Service\Medion_Fotos_auf_CD_6\instslct.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
.
.
.
**************************************************************************
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
"MSCurrentCountry"=dword:000000b5
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Softex\OmniPass\OmniServ.exe
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\common files\gnab\service\servicecontroller.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Medion\MEDIONbox\Program\GCS.exe
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\program files\Nuance\PaperPort\PDFProFiltSrvPP.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\locator.exe
c:\program files\Sceneo\AbsolutTV\Services\PVR\PVRService.exe
c:\program files\Synology Data Replicator  3\SynoDrService.exe
c:\program files\TeamViewer\TeamViewer_Service.exe
c:\windows\System32\WUDFHost.exe
c:\program files\Microsoft Security Client\NisSrv.exe
c:\windows\system32\conime.exe
c:\program files\Softex\OmniPass\opvapp.exe
c:\program files\TeamViewer\TeamViewer.exe
c:\program files\TeamViewer\tv_w32.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\rundll32.exe
c:\program files\Launch Manager\WisLMSvc.exe
c:\program files\ControlCenter4\BrCtrlCntr.exe
c:\program files\Browny02\BrYNSvc.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Common Files\Nero\Lib\NMIndexingService.exe
c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
c:\program files\ControlCenter4\BrCcUxSys.exe
c:\windows\ehome\ehmsas.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-01-04  11:40:11 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2015-01-04 10:38
.
Vor Suchlauf: 13 Verzeichnis(se), 40.156.606.464 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 40.922.005.504 Bytes frei
.
- - End Of File - - E3D85C2EC4BBDBFBDC829E9DB3BAB99D
5C616939100B85E558DA92B899A0FC36