Windows 7 machts möglich: "Aus Sicherheitsgründen wurde ihr Windowssystem blockiert" eingefangen

ComboFix 11-12-19.01 - Workstation 19.12.2011  18:46:01.1.2 - x64

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4095.2598 [GMT 1:00]

ausgeführt von:: c:\users\surfer\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\surfer\AppData\Roaming\Microsoft\hostrun.exe

c:\windows\IsUn0407.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-11-19 bis 2011-12-19  ))))))))))))))))))))))))))))))

.

.

2011-12-19 17:49 . 2011-12-19 19:29	--------	d-----w-	c:\users\Workstation\AppData\Local\temp

2011-12-19 17:49 . 2011-12-19 17:49	--------	d-----w-	c:\users\Default\AppData\Local\temp

2011-12-18 19:23 . 2011-12-18 19:23	--------	d-----w-	c:\users\surfer\AppData\Roaming\Thunderbird

2011-12-18 19:23 . 2011-12-18 19:23	--------	d-----w-	c:\users\surfer\AppData\Local\Thunderbird

2011-12-18 19:23 . 2011-12-18 19:23	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird

2011-12-16 18:29 . 2011-12-16 18:29	--------	d-----w-	c:\users\surfer\AppData\Roaming\Nokia

2011-12-16 18:29 . 2011-12-16 18:29	--------	d-----w-	c:\users\surfer\AppData\Roaming\Nokia Suite

2011-12-16 18:27 . 2011-12-16 18:27	--------	d-----w-	c:\users\surfer\AppData\Local\Nokia

2011-12-16 18:25 . 2011-12-16 18:25	--------	d-----w-	c:\users\Workstation\AppData\Local\Nokia

2011-12-16 18:25 . 2011-12-16 18:28	--------	d-----w-	c:\programdata\PC Suite

2011-12-16 18:25 . 2011-12-16 18:29	--------	d-----w-	c:\users\surfer\AppData\Roaming\PC Suite

2011-12-16 18:24 . 2011-12-16 18:24	--------	d-----w-	c:\program files (x86)\Common Files\Nokia

2011-12-16 18:24 . 2011-12-16 18:24	--------	d-----w-	c:\programdata\Nokia

2011-12-16 18:23 . 2011-12-16 18:23	--------	d-----w-	c:\program files\DIFX

2011-12-16 18:23 . 2008-08-28 11:44	25600	----a-w-	c:\windows\system32\drivers\pccsmcfdx64.sys

2011-12-16 18:23 . 2011-12-16 18:23	--------	dc----w-	c:\windows\system32\DRVSTORE

2011-12-16 18:23 . 2011-12-16 18:23	--------	d-----w-	c:\program files (x86)\PC Connectivity Solution

2011-12-16 18:22 . 2011-12-16 18:24	--------	d-----w-	c:\program files (x86)\Nokia

2011-12-15 10:44 . 2011-10-26 05:21	43520	----a-w-	c:\windows\system32\csrsrv.dll

2011-12-15 10:44 . 2011-11-24 04:52	3145216	----a-w-	c:\windows\system32\win32k.sys

2011-12-15 10:44 . 2011-10-15 06:31	723456	----a-w-	c:\windows\system32\EncDec.dll

2011-12-15 10:44 . 2011-10-15 05:38	534528	----a-w-	c:\windows\SysWow64\EncDec.dll

2011-12-15 10:43 . 2011-11-05 05:32	2048	----a-w-	c:\windows\system32\tzres.dll

2011-12-15 10:43 . 2011-11-05 04:26	2048	----a-w-	c:\windows\SysWow64\tzres.dll

2011-12-03 19:35 . 2011-12-16 19:41	--------	d-----w-	c:\users\surfer\AppData\Roaming\Irgo

2011-12-03 19:35 . 2011-12-03 19:35	--------	d-----w-	c:\users\surfer\AppData\Roaming\Nousci

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-08 20:26 . 2011-10-26 08:54	130760	----a-w-	c:\windows\system32\drivers\avipbb.sys

2011-11-18 08:49 . 2011-09-29 21:42	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2011-10-27 15:43 . 2011-10-27 15:43	472808	----a-w-	c:\windows\SysWow64\deployJava1.dll

2011-10-19 14:56 . 2011-10-26 08:54	97312	----a-w-	c:\windows\system32\drivers\avgntflt.sys

2011-10-19 14:56 . 2011-10-26 08:54	27760	----a-w-	c:\windows\system32\drivers\avkmgr.sys

2011-09-29 21:21 . 2011-09-29 21:21	91648	----a-w-	c:\windows\system32\SetIEInstalledDate.exe

2011-09-29 21:21 . 2011-09-29 21:21	89088	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe

2011-09-29 21:21 . 2011-09-29 21:21	86528	----a-w-	c:\windows\SysWow64\iesysprep.dll

2011-09-29 21:21 . 2011-09-29 21:21	85504	----a-w-	c:\windows\system32\iesetup.dll

2011-09-29 21:21 . 2011-09-29 21:21	76800	----a-w-	c:\windows\SysWow64\SetIEInstalledDate.exe

2011-09-29 21:21 . 2011-09-29 21:21	76800	----a-w-	c:\windows\system32\tdc.ocx

2011-09-29 21:21 . 2011-09-29 21:21	74752	----a-w-	c:\windows\SysWow64\RegisterIEPKEYs.exe

2011-09-29 21:21 . 2011-09-29 21:21	74752	----a-w-	c:\windows\SysWow64\iesetup.dll

2011-09-29 21:21 . 2011-09-29 21:21	63488	----a-w-	c:\windows\SysWow64\tdc.ocx

2011-09-29 21:21 . 2011-09-29 21:21	603648	----a-w-	c:\windows\system32\vbscript.dll

2011-09-29 21:21 . 2011-09-29 21:21	49664	----a-w-	c:\windows\system32\imgutil.dll

2011-09-29 21:21 . 2011-09-29 21:21	48640	----a-w-	c:\windows\SysWow64\mshtmler.dll

2011-09-29 21:21 . 2011-09-29 21:21	48640	----a-w-	c:\windows\system32\mshtmler.dll

2011-09-29 21:21 . 2011-09-29 21:21	448512	----a-w-	c:\windows\system32\html.iec

2011-09-29 21:21 . 2011-09-29 21:21	420864	----a-w-	c:\windows\SysWow64\vbscript.dll

2011-09-29 21:21 . 2011-09-29 21:21	367104	----a-w-	c:\windows\SysWow64\html.iec

2011-09-29 21:21 . 2011-09-29 21:21	35840	----a-w-	c:\windows\SysWow64\imgutil.dll

2011-09-29 21:21 . 2011-09-29 21:21	30720	----a-w-	c:\windows\system32\licmgr10.dll

2011-09-29 21:21 . 2011-09-29 21:21	23552	----a-w-	c:\windows\SysWow64\licmgr10.dll

2011-09-29 21:21 . 2011-09-29 21:21	222208	----a-w-	c:\windows\system32\msls31.dll

2011-09-29 21:21 . 2011-09-29 21:21	173056	----a-w-	c:\windows\system32\ieUnatt.exe

2011-09-29 21:21 . 2011-09-29 21:21	165888	----a-w-	c:\windows\system32\iexpress.exe

2011-09-29 21:21 . 2011-09-29 21:21	161792	----a-w-	c:\windows\SysWow64\msls31.dll

2011-09-29 21:21 . 2011-09-29 21:21	160256	----a-w-	c:\windows\system32\wextract.exe

2011-09-29 21:21 . 2011-09-29 21:21	152064	----a-w-	c:\windows\SysWow64\wextract.exe

2011-09-29 21:21 . 2011-09-29 21:21	150528	----a-w-	c:\windows\SysWow64\iexpress.exe

2011-09-29 21:21 . 2011-09-29 21:21	142848	----a-w-	c:\windows\SysWow64\ieUnatt.exe

2011-09-29 21:21 . 2011-09-29 21:21	135168	----a-w-	c:\windows\system32\IEAdvpack.dll

2011-09-29 21:21 . 2011-09-29 21:21	12288	----a-w-	c:\windows\system32\mshta.exe

2011-09-29 21:21 . 2011-09-29 21:21	11776	----a-w-	c:\windows\SysWow64\mshta.exe

2011-09-29 21:21 . 2011-09-29 21:21	114176	----a-w-	c:\windows\system32\admparse.dll

2011-09-29 21:21 . 2011-09-29 21:21	111616	----a-w-	c:\windows\system32\iesysprep.dll

2011-09-29 21:21 . 2011-09-29 21:21	110592	----a-w-	c:\windows\SysWow64\IEAdvpack.dll

2011-09-29 21:21 . 2011-09-29 21:21	101888	----a-w-	c:\windows\SysWow64\admparse.dll

2011-09-29 16:29 . 2011-11-09 12:38	1923952	----a-w-	c:\windows\system32\drivers\tcpip.sys

2011-09-21 07:00 . 2011-09-30 09:08	9049936	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D910150D-C71F-4116-B6AE-8C2908B99DA0}\mpengine.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-03-04 2741616]

"NokiaSuite.exe"="c:\program files (x86)\Nokia\Nokia Suite\NokiaSuite.exe" [2011-11-01 1053056]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"PivotSoftware"="c:\program files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe" [2010-05-13 110192]

"DT HWP"="c:\program files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe" [2011-03-02 121456]

"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2011-02-23 371200]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-10-19 258512]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-10-8 113664]

ISDNWatch.lnk - c:\program files (x86)\FRITZ!\IWatch.exe [2011-10-11 341304]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"EnableUIADesktopToggle"= 0 (0x0)

.

R1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

R2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-19 86224]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-09-23 641832]

R2 NVIDIA Performance Driver Service;NVIDIA Performance Driver Service;c:\program files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe [2010-04-30 6237800]

R2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2011-02-16 113264]

R2 StarMoney 7.0 OnlineUpdate;StarMoney 7.0 OnlineUpdate;c:\program files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe [2011-11-08 554160]

R3 AVMCOWAN;AVM ISDN CoNDIS WAN CAPI Driver;c:\windows\system32\DRIVERS\AVMCOWAN.sys [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]

R3 FPCIBASE;AVM FRITZ!Card PCI;c:\windows\system32\DRIVERS\fpcibase.sys [x]

R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

S3 BazisVirtualCDBus;WinCDEmu Virtual Bus Driver;c:\windows\system32\DRIVERS\BazisVirtualCDBus.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2011-03-04 10:29	451872	----a-w-	c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

.

.

--------- x86-64 -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.de/

mLocal Page = c:\windows\SysWOW64\blank.htm

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Workstation\AppData\Roaming\Mozilla\Firefox\Profiles\n87pykme.default\

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-FRITZ! 2.0 - c:\windows\IsUn0407.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-12-19  20:31:56 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-12-19 19:31

.

Vor Suchlauf: 9 Verzeichnis(se), 198.793.949.184 Bytes frei

Nach Suchlauf: 13 Verzeichnis(se), 199.233.187.840 Bytes frei

.

- - End Of File - - 7B94AC9A1A2931D2221C0A610D2DF46E