Trojaner-Board - Windows Defender deaktiviert: durch eine Gruppenrichtlinie geblockt (Fehlercode: 0x800704ec)

Code:
Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version: 04-11-2016

durchgeführt von Christa (13-11-2016 16:33:43) Run:2

Gestartet von C:\Users\Christa\Desktop

Geladene Profile: Christa (Verfügbare Profile: Christa)

Start-Modus: Normal

==============================================
 

fixlist Inhalt:

*****************

start

CMD: type "C:\Windows\System32\GroupPolicy\Machine\Registry.pol"

CMD: type "C:\Windows\System32\GroupPolicy\User\Registry.pol"

Unlock: HKEY_LOCAL_MACHINE\SOFTWARE\Policies

CMD: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies" /S

Unlock: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies

CMD: reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /S

Unlock: HKEY_CURRENT_USER\SOFTWARE\Policies

CMD: reg query "HKEY_CURRENT_USER\SOFTWARE\Policies" /S

Unlock: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies

CMD: reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /S

end

         

*****************
 
 

========= type "C:\Windows\System32\GroupPolicy\Machine\Registry.pol" =========
 

Das System kann den angegebenen Pfad nicht finden.
 

========= Ende von CMD: =========
 
 

========= type "C:\Windows\System32\GroupPolicy\User\Registry.pol" =========
 

Das System kann den angegebenen Pfad nicht finden.
 

========= Ende von CMD: =========
 

"HKEY_LOCAL_MACHINE\SOFTWARE\Policies" => Schlüssel wurde entsperrt
 

========= reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies" /S =========
 
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MRT
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Peernet

    Disabled    REG_DWORD    0x0
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CRLs
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CTLs
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Associations
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Attachments
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Cache
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Explorer
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Network Connections

    NC_PersonalFirewallConfig    REG_DWORD    0x0
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator

    (Standard)    REG_SZ    
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers

    authenticodeenabled    REG_DWORD    0x0
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WSDAPI
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WSDAPI\Discovery Proxies
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender

    DisableAntiSpyware    REG_DWORD    0x1
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client

    fEnableUsbNoAckIsochWriteToDevice    REG_DWORD    0x50

    fEnableUsbBlockDeviceBySetupClass    REG_DWORD    0x1

    fEnableUsbSelectDeviceByInterface    REG_DWORD    0x1
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client\UsbBlockDeviceBySetupClasses

    1000    REG_SZ    {3376f4ce-ff8d-40a2-a80f-bb4359d1415c}
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client\UsbSelectDeviceByInterfaces

    1000    REG_SZ    {6bdd1fc6-810f-11d0-bec7-08002be2092f}
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection

    KnownDllList    REG_SZ    nlhtml.dll

    SFCDisable    REG_DWORD    0x0
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
 

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
 
 

========= Ende von CMD: =========
 

"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" => Schlüssel wurde entsperrt
 

========= reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /S =========
 
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments

    ScanWithAntiVirus    REG_DWORD    0x3
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer

    NoDrives    REG_DWORD    0x0
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum

    {BDEADF00-C265-11D0-BCED-00A0C90AB50F}    REG_DWORD    0x1

    {6DFD7C5C-2451-11d3-A299-00C04F8EF6AF}    REG_DWORD    0x40000021

    {0DF44EAA-FF21-4412-828E-260A8728E7F1}    REG_DWORD    0x20
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ratings
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

    ConsentPromptBehaviorAdmin    REG_DWORD    0x5

    ConsentPromptBehaviorUser    REG_DWORD    0x3

    EnableInstallerDetection    REG_DWORD    0x1

    EnableLUA    REG_DWORD    0x1

    EnableSecureUIAPaths    REG_DWORD    0x1

    EnableUIADesktopToggle    REG_DWORD    0x0

    EnableVirtualization    REG_DWORD    0x1

    PromptOnSecureDesktop    REG_DWORD    0x1

    ValidateAdminCodeSignatures    REG_DWORD    0x0

    dontdisplaylastusername    REG_DWORD    0x0

    legalnoticecaption    REG_SZ    

    legalnoticetext    REG_SZ    

    scforceoption    REG_DWORD    0x0

    shutdownwithoutlogon    REG_DWORD    0x1

    undockwithoutlogon    REG_DWORD    0x1

    FilterAdministratorToken    REG_DWORD    0x0

    SoftwareSASGeneration    REG_DWORD    0x1
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard\ExceptionFormats

    CF_TEXT    REG_DWORD    0x1

    CF_BITMAP    REG_DWORD    0x2

    CF_OEMTEXT    REG_DWORD    0x7

    CF_DIB    REG_DWORD    0x8

    CF_PALETTE    REG_DWORD    0x9

    CF_UNICODETEXT    REG_DWORD    0xd

    CF_DIBV5    REG_DWORD    0x11
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Uninstall
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate
 
 

========= Ende von CMD: =========
 

"HKEY_CURRENT_USER\SOFTWARE\Policies" => Schlüssel wurde entsperrt
 

========= reg query "HKEY_CURRENT_USER\SOFTWARE\Policies" /S =========
 
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\System
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\CA
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\trust
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\AppCompat
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Associations
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Attachments
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Cache
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Explorer
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Group Policy Editor
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows NT
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Power
 

HKEY_CURRENT_USER\SOFTWARE\Policies\Power\PowerSettings
 
 

========= Ende von CMD: =========
 

"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" => Schlüssel wurde entsperrt
 

========= reg query "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies" /S =========
 
 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations
 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments
 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer

    NoDrives    REG_DWORD    0x0

    NoDriveTypeAutoRun    REG_DWORD    0x91
 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext
 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID
 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Network
 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
 

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate
 
 

========= Ende von CMD: =========
 
 

==== Ende von Fixlog 16:33:45 ====