Trojaner-Board - Win 7 Firewall lässt sich nicht mehr aktivieren (Fehlercode Error 0x8007042c)

Combofix Logfile:
Code:
ComboFix 13-01-11.02 - alex 11.01.2013  22:22:51.1.4 - x86

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.2281.1048 [GMT 1:00]

ausgeführt von:: c:\users\alex\Downloads\ComboFix.exe

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\{45970a43-e381-4afd-884b-0bcda073895c}.xps

c:\users\alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\{b05a6350-7bce-4918-804a-de289fb3ad92}.xps

c:\users\alex\AppData\Local\Temp\{5BB9EC2E-DB0E-44AC-B932-07512BA1E011}\fpb.tmp

c:\users\alex\Documents\~archive.pst.tmp

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-12-11 bis 2013-01-11  ))))))))))))))))))))))))))))))

.

.

2013-01-11 21:26 . 2013-01-11 21:29        --------        d-----w-        c:\users\alex\AppData\Local\temp

2013-01-11 21:26 . 2013-01-11 21:26        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-01-11 14:57 . 2013-01-11 14:57        --------        d-----w-        c:\users\alex\AppData\Roaming\Malwarebytes

2013-01-11 14:57 . 2013-01-11 14:57        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2013-01-11 14:57 . 2013-01-11 14:57        --------        d-----w-        c:\programdata\Malwarebytes

2013-01-11 14:57 . 2012-12-14 15:49        21104        ----a-w-        c:\windows\system32\drivers\mbam.sys

2013-01-11 14:56 . 2013-01-11 14:56        --------        d-----w-        c:\users\alex\AppData\Local\Programs

2013-01-09 11:15 . 2013-01-09 11:15        --------        d-----w-        c:\users\alex\AppData\Roaming\Abelssoft

2013-01-09 11:15 . 2013-01-09 11:26        --------        d-----w-        c:\users\alex\AppData\Local\Abelssoft

2013-01-09 11:15 . 2013-01-09 11:26        --------        d-----w-        c:\program files\WashAndGo

2013-01-08 12:30 . 2013-01-08 12:30        --------        d--h--w-        c:\programdata\CanonIJEPPEX

2013-01-08 12:08 . 2013-01-08 12:08        --------        d--h--w-        c:\programdata\CanonIJEGV

2013-01-08 12:00 . 2013-01-08 12:00        --------        d--h--w-        c:\programdata\CanonIJSolutionMenuEX

2013-01-08 12:00 . 2013-01-08 12:00        --------        d--h--w-        c:\programdata\CanonEPP

2013-01-08 11:59 . 2013-01-08 11:59        --------        d-----w-        c:\users\alex\AppData\Roaming\Canon

2013-01-08 11:59 . 2013-01-08 11:59        --------        d--h--w-        c:\programdata\CanonIJMyPrinter

2013-01-08 11:59 . 2013-01-11 14:00        --------        d-----w-        c:\programdata\CanonIJPLM

2013-01-08 11:58 . 2013-01-08 11:58        --------        d-----w-        c:\programdata\Canon IJ Network Tool

2013-01-08 11:58 . 2011-10-14 10:57        102912        ----a-w-        c:\windows\system32\CNC_B2U.dll

2013-01-08 11:58 . 2011-10-14 10:55        272896        ----a-w-        c:\windows\system32\CNC_B2C.dll

2013-01-08 11:58 . 2011-10-14 10:54        98304        ----a-w-        c:\windows\system32\CNC_B2I.dll

2013-01-08 11:58 . 2011-09-22 07:57        316416        ----a-w-        c:\windows\system32\CNC_B2L.dll

2013-01-08 11:58 . 2008-08-25 17:02        15872        ----a-w-        c:\windows\system32\CNHMCA.dll

2013-01-08 11:58 . 2013-01-08 11:58        --------        d--h--w-        c:\programdata\CanonIJFAX

2013-01-08 11:53 . 2013-01-08 11:53        --------        d-----w-        c:\program files\Common Files\CANON

2013-01-08 11:52 . 2013-01-08 11:52        --------        d-----w-        c:\programdata\CanonIJWSpt

2013-01-08 11:48 . 2013-01-08 11:48        --------        d--h--w-        c:\programdata\CanonBJ

2013-01-08 11:48 . 2011-11-03 04:00        84992        ----a-w-        c:\windows\system32\Spool\prtprocs\w32x86\CNMPPB2.DLL

2013-01-08 11:48 . 2011-11-03 04:00        29184        ----a-w-        c:\windows\system32\Spool\prtprocs\w32x86\CNMPDB2.DLL

2013-01-08 11:48 . 2013-01-08 11:48        --------        d--h--w-        c:\windows\system32\CanonIJ Uninstaller Information

2013-01-08 11:48 . 2011-11-03 04:00        311296        ----a-w-        c:\windows\system32\CNMLMB2.DLL

2013-01-08 11:47 . 2011-09-21 04:00        257536        ----a-w-        c:\windows\system32\CNCALB2.DLL

2013-01-08 11:47 . 2011-09-29 09:22        184832        ----a-w-        c:\windows\system32\CNMIUB2.DLL

2013-01-08 11:47 . 2013-01-08 11:47        --------        d-----w-        c:\windows\system32\STRING

2013-01-08 11:47 . 2011-10-03 14:25        35840        ----a-w-        c:\windows\system32\CNMNPUI.DLL

2013-01-08 11:46 . 2013-01-08 11:59        --------        d-----w-        c:\program files\Canon

2013-01-08 07:18 . 2013-01-08 07:18        --------        d-----w-        c:\program files\SmartDraw 2013

2012-12-31 11:35 . 2012-12-31 11:35        --------        d-----w-        c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1

2012-12-31 11:35 . 2012-12-31 11:35        --------        d-----w-        c:\program files\iTunes

2012-12-31 11:35 . 2012-12-31 11:35        --------        d-----w-        c:\program files\iPod

2012-12-18 14:28 . 2012-12-18 14:28        186584        ----a-w-        c:\program files\Internet Explorer\Plugins\nppdf32.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-10-25 02:12 . 2012-10-25 02:12        94208        ----a-w-        c:\windows\system32\QuickTimeVR.qtx

2012-10-25 02:12 . 2012-10-25 02:12        69632        ----a-w-        c:\windows\system32\QuickTime.qts

2012-10-18 17:59 . 2012-11-14 14:14        2345984        ----a-w-        c:\windows\system32\win32k.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^CardOS API.lnk]

backup=c:\windows\pss\CardOS API.lnk.CommonStartup

backupExtension=.CommonStartup

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\CardOS API.lnk

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-12-03 07:35        946352        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apple_KbdMgr]

2011-06-29 05:49        526208        ----a-w-        c:\program files\Boot Camp\Bootcamp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

2012-11-28 13:13        59280        ----a-w-        c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]

2011-07-19 13:23        2567272        ----a-w-        c:\program files\Canon\MyPrinter\BJMYPRT.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx]

2011-08-04 13:41        1637496        ----a-w-        c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]

2011-01-23 17:47        148280        ----a-w-        c:\program files\Lexmark Pro800-Pro900 Series\ezprint.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IJNetworkScannerSelectorEX]

2011-09-27 10:44        439440        ----a-w-        c:\program files\Canon\IJ Network Scanner Selector EX\CNMNSST.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2012-12-12 12:57        152544        ----a-w-        c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxecmon.exe]

2011-01-23 17:47        770728        ----a-w-        c:\program files\Lexmark Pro800-Pro900 Series\lxecmon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2012-10-25 02:12        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

R1 MpKslba5a688c;MpKslba5a688c;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1D1DB472-CF4F-4B95-8E96-7DB666CDF885}\MpKslba5a688c.sys [x]

R2 lxecCATSCustConnectService;lxecCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\lxecserv.exe [x]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]

R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [x]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]

R3 OracleOraDb11g_home1ClrAgent;OracleOraDb11g_home1ClrAgent;c:\oracle\product\11.2.0\dbhome_1\bin\OraClrAgnt.exe [x]

R3 OracleVssWriterACS;Oracle ACS VSS Writer Service;c:\oracle\product\11.2.0\dbhome_1\bin\OraVSSW.exe ACS [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]

R3 Samsung UPD Service2;Samsung UPD Service2;c:\windows\System32\SUPDSvc2.exe [x]

R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]

R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [x]

R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [x]

R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]

R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]

R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R4 OracleJobSchedulerACS;OracleJobSchedulerACS;c:\oracle\product\11.2.0\dbhome_1\Bin\extjob.exe ACS [x]

S0 AppleHFS;AppleHFS; [x]

S0 AppleMNT;AppleMNT; [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AppleOSSMgr;Apple OS Switch Manager;c:\windows\system32\AppleOSSMgr.exe [x]

S2 AppleTimeSrv;Apple-Time-Server;c:\windows\system32\AppleTimeSrv.exe [x]

S2 KeyAgent;KeyAgent;c:\windows\system32\drivers\KeyAgent.sys [x]

S2 lxec_device;lxec_device;c:\windows\system32\lxeccoms.exe [x]

S2 MacHALDriver;Mac HAL;c:\windows\system32\drivers\MacHALDriver.sys [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

S2 OracleOraDb11g_home1TNSListener;OracleOraDb11g_home1TNSListener;c:\oracle\PRODUCT\11.2.0\DBHOME_1\BIN\TNSLSNR  [x]

S2 OracleServiceACS;OracleServiceACS;c:\oracle\product\11.2.0\dbhome_1\bin\ORACLE.EXE ACS [x]

S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]

S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [x]

S3 A38CCID;CCID USB Smart Card Reader;c:\windows\system32\DRIVERS\a38ccid.sys [x]

S3 acpials;ALS-Sensorfilter;c:\windows\system32\DRIVERS\acpials.sys [x]

S3 applebmt;Apple Wireless Mouse;c:\windows\system32\DRIVERS\applebmt.sys [x]

S3 AppleBtBc;Apple Broadcom Built-in Bluetooth;c:\windows\system32\DRIVERS\AppleBtBc.sys [x]

S3 CirrusFilter;CS420xLowerFilter;c:\windows\system32\DRIVERS\CS420x86.sys [x]

S3 IRRemoteFlt;IR Receiver Filter Driver;c:\windows\system32\DRIVERS\IRFilter.sys [x]

S3 KeyMagic;USB Keyboard HID Filter;c:\windows\system32\DRIVERS\KeyMagic.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 MEI;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECI.sys [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2013-01-11 c:\windows\Tasks\AbelssoftPreloader.job

- c:\program files\WashAndGo\AbelssoftPreloader.exe [2013-01-09 19:12]

.

2013-01-11 c:\windows\Tasks\AutoKMS.job

- c:\windows\AutoKMS\AutoKMS.exe [2012-07-09 11:24]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyOverride = *.local

IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

MSConfigStartUp-MSC - c:\program files\Microsoft Security Client\msseces.exe

MSConfigStartUp-SonyAgent - c:\program files\Adobe\Reader 10.0\Reader\ntvdm.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\OracleOraDb11g_home1ClrAgent]

"ImagePath"="c:\oracle\product\11.2.0\dbhome_1\bin\OraClrAgnt.exe agent_sid=CLRExtProc max_dispatchers=2 tcp_dispatchers=0 max_task_threads=6 max_sessions=25 ENVS=\"EXTPROC_DLLS=ONLY:c:\oracle\product\11.2.0\dbhome_1\bin\oraclr11.dll\""

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\OracleOraDb11g_home1TNSListener]

"ImagePath"="c:\oracle\PRODUCT\11.2.0\DBHOME_1\BIN\TNSLSNR "

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\atieclxx.exe

c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\windows\system32\taskhost.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Canon\IJPLM\IJPLMSVC.EXE

c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

c:\oracle\PRODUCT\11.2.0\DBHOME_1\BIN\TNSLSNR.exe

c:\oracle\product\11.2.0\dbhome_1\bin\ORACLE.EXE

c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe

c:\program files\TeamViewer\Version7\TeamViewer.exe

c:\windows\system32\conhost.exe

c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

c:\windows\System32\rundll32.exe

c:\program files\TeamViewer\Version7\tv_w32.exe

c:\windows\System32\WUDFHost.exe

c:\windows\System32\WUDFHost.exe

c:\windows\system32\sppsvc.exe

c:\windows\system32\conhost.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2013-01-11  22:31:01 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2013-01-11 21:31

.

Vor Suchlauf: 13 Verzeichnis(se), 439.932.268.544 Bytes frei

Nach Suchlauf: 19 Verzeichnis(se), 443.273.596.928 Bytes frei

.

- - End Of File - - FB8C1CC6D5F515009DAED92C21F063E1
--- --- ---

Firewall ist wieder aktiv. Soll noch etwas gemacht werden??

Der Windows Defender läßt sich nicht aktivieren. Fehlercode 0x80070005

Kannst Du mir weiter helfen oder wird dieser nicht benötigt, da windows security essential installiert ist.