#4 // / TB-Ausbilder
Windows 10 Datenmüll Gut gemacht! Schritt 1 WARNUNG AN ALLE MITLESER !!!ausschließlich für diesen Nutzer gedacht und sollte niemals 1:1 für ein anderes System angewendet werden! Speichere deine Arbeiten und schließe alle offenen Programme, damit keine Daten verloren gehen. Kopiere den gesamten Inhalt der folgenden Code-Box: Code:
Alles auswählen Aufklappen ATTFilter
Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
HKU\S-1-5-21-2917026532-1704927967-2421539612-1000\...\Policies\system: [shell] explorer.exe <==== ACHTUNG
HKU\S-1-5-21-2917026532-1704927967-2421539612-1000\Software\Policies\...\system: [disablecmd] 0
HKLM\Software\...\Authentication\Credential Providers: [{503739d0-4c5e-4cfd-b3ba-d881334f0df2}] ->
Task: {8CB0EFC7-AD90-4F22-88AB-10C00FCF0E80} - \Microsoft\Windows\Setup\EOSNotify2 -> Keine Datei <==== ACHTUNG
Task: {C7B225A8-4AE9-408D-99AA-8F1EEDC5D12A} - \Microsoft\Windows\Setup\EOSNotify -> Keine Datei <==== ACHTUNG
FF Extension: (Avira Browser Safety) - C:\Users\X1\AppData\Roaming\Mozilla\Firefox\Profiles\HViZUhO5.default\Extensions\abs@avira.com [2015-10-01] [] [ist nicht signiert]
U3 idsvc; kein ImagePath
CustomCLSID: HKU\S-1-5-21-2917026532-1704927967-2421539612-1000_Classes\CLSID\{D4AB823B-3EBC-477B-AA5B-D7061C9E83B0}\InprocServer32 -> C:\PROGRA~2\REBATE~1\RebInf64.dll => Keine Datei
AlternateDataStreams: C:\ProgramData\TEMP:000D6A25 [135]
AlternateDataStreams: C:\ProgramData\TEMP:01D2B3C4 [258]
AlternateDataStreams: C:\ProgramData\TEMP:0406003C [140]
AlternateDataStreams: C:\ProgramData\TEMP:06C34166 [280]
AlternateDataStreams: C:\ProgramData\TEMP:07D64CD9 [274]
AlternateDataStreams: C:\ProgramData\TEMP:084612C9 [476]
AlternateDataStreams: C:\ProgramData\TEMP:08677BDD [117]
AlternateDataStreams: C:\ProgramData\TEMP:089CBF08 [280]
AlternateDataStreams: C:\ProgramData\TEMP:0988A428 [468]
AlternateDataStreams: C:\ProgramData\TEMP:0A5F8BFC [124]
AlternateDataStreams: C:\ProgramData\TEMP:0ADCCF52 [128]
AlternateDataStreams: C:\ProgramData\TEMP:0BF391F5 [119]
AlternateDataStreams: C:\ProgramData\TEMP:0BF4DA47 [272]
AlternateDataStreams: C:\ProgramData\TEMP:0E61938B [119]
AlternateDataStreams: C:\ProgramData\TEMP:102394C6 [148]
AlternateDataStreams: C:\ProgramData\TEMP:113787F5 [106]
AlternateDataStreams: C:\ProgramData\TEMP:14D29229 [234]
AlternateDataStreams: C:\ProgramData\TEMP:160ADF0B [284]
AlternateDataStreams: C:\ProgramData\TEMP:16A4620C [434]
AlternateDataStreams: C:\ProgramData\TEMP:18B3AE54 [97]
AlternateDataStreams: C:\ProgramData\TEMP:1A5207FA [246]
AlternateDataStreams: C:\ProgramData\TEMP:1A7FFE9C [99]
AlternateDataStreams: C:\ProgramData\TEMP:1B927722 [115]
AlternateDataStreams: C:\ProgramData\TEMP:1BD02801 [119]
AlternateDataStreams: C:\ProgramData\TEMP:1E942FB9 [130]
AlternateDataStreams: C:\ProgramData\TEMP:258D2F8B [144]
AlternateDataStreams: C:\ProgramData\TEMP:2775F9E2 [131]
AlternateDataStreams: C:\ProgramData\TEMP:27D1368B [195]
AlternateDataStreams: C:\ProgramData\TEMP:28DB0DC4 [104]
AlternateDataStreams: C:\ProgramData\TEMP:2C678471 [456]
AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F [134]
AlternateDataStreams: C:\ProgramData\TEMP:2E49FF93 [109]
AlternateDataStreams: C:\ProgramData\TEMP:2F5A06FD [130]
AlternateDataStreams: C:\ProgramData\TEMP:30E0D641 [278]
AlternateDataStreams: C:\ProgramData\TEMP:322D2CD3 [434]
AlternateDataStreams: C:\ProgramData\TEMP:3571475C [234]
AlternateDataStreams: C:\ProgramData\TEMP:38FF076E [136]
AlternateDataStreams: C:\ProgramData\TEMP:3AF262FC [139]
AlternateDataStreams: C:\ProgramData\TEMP:3DF14C8F [203]
AlternateDataStreams: C:\ProgramData\TEMP:3E988A0F [99]
AlternateDataStreams: C:\ProgramData\TEMP:41289DF0 [108]
AlternateDataStreams: C:\ProgramData\TEMP:4149A170 [129]
AlternateDataStreams: C:\ProgramData\TEMP:426D1496 [150]
AlternateDataStreams: C:\ProgramData\TEMP:43C9D140 [198]
AlternateDataStreams: C:\ProgramData\TEMP:45F3AD49 [122]
AlternateDataStreams: C:\ProgramData\TEMP:46CBC45C [214]
AlternateDataStreams: C:\ProgramData\TEMP:4A853310 [404]
AlternateDataStreams: C:\ProgramData\TEMP:4D348522 [139]
AlternateDataStreams: C:\ProgramData\TEMP:4E6B8D68 [104]
AlternateDataStreams: C:\ProgramData\TEMP:4EE323A4 [132]
AlternateDataStreams: C:\ProgramData\TEMP:5539129F [123]
AlternateDataStreams: C:\ProgramData\TEMP:5607B58C [141]
AlternateDataStreams: C:\ProgramData\TEMP:57173DB4 [131]
AlternateDataStreams: C:\ProgramData\TEMP:5AC256BC [123]
AlternateDataStreams: C:\ProgramData\TEMP:5B4686D7 [235]
AlternateDataStreams: C:\ProgramData\TEMP:5C3ED5BB [224]
AlternateDataStreams: C:\ProgramData\TEMP:5DB36C47 [134]
AlternateDataStreams: C:\ProgramData\TEMP:60E0AB2A [127]
AlternateDataStreams: C:\ProgramData\TEMP:614F17D3 [131]
AlternateDataStreams: C:\ProgramData\TEMP:627B7F7C [116]
AlternateDataStreams: C:\ProgramData\TEMP:6294B369 [137]
AlternateDataStreams: C:\ProgramData\TEMP:639BB5E9 [504]
AlternateDataStreams: C:\ProgramData\TEMP:639F0420 [410]
AlternateDataStreams: C:\ProgramData\TEMP:661DC753 [131]
AlternateDataStreams: C:\ProgramData\TEMP:6A9EDD31 [244]
AlternateDataStreams: C:\ProgramData\TEMP:6AD1764B [120]
AlternateDataStreams: C:\ProgramData\TEMP:6AD65294 [256]
AlternateDataStreams: C:\ProgramData\TEMP:6B50A605 [123]
AlternateDataStreams: C:\ProgramData\TEMP:6D54EED6 [134]
AlternateDataStreams: C:\ProgramData\TEMP:6DDFD746 [121]
AlternateDataStreams: C:\ProgramData\TEMP:6F1F66C0 [204]
AlternateDataStreams: C:\ProgramData\TEMP:708BB0FA [104]
AlternateDataStreams: C:\ProgramData\TEMP:762408BA [127]
AlternateDataStreams: C:\ProgramData\TEMP:785C7C53 [229]
AlternateDataStreams: C:\ProgramData\TEMP:79112E1D [103]
AlternateDataStreams: C:\ProgramData\TEMP:79C6A9CE [146]
AlternateDataStreams: C:\ProgramData\TEMP:7A2101AB [284]
AlternateDataStreams: C:\ProgramData\TEMP:7ADA8871 [136]
AlternateDataStreams: C:\ProgramData\TEMP:7BB584AA [134]
AlternateDataStreams: C:\ProgramData\TEMP:7D288858 [496]
AlternateDataStreams: C:\ProgramData\TEMP:7DC5D762 [246]
AlternateDataStreams: C:\ProgramData\TEMP:803039D6 [136]
AlternateDataStreams: C:\ProgramData\TEMP:819394CC [140]
AlternateDataStreams: C:\ProgramData\TEMP:85345626 [130]
AlternateDataStreams: C:\ProgramData\TEMP:86148D88 [118]
AlternateDataStreams: C:\ProgramData\TEMP:884C7316 [244]
AlternateDataStreams: C:\ProgramData\TEMP:8B1667C1 [222]
AlternateDataStreams: C:\ProgramData\TEMP:8DD36B71 [140]
AlternateDataStreams: C:\ProgramData\TEMP:8F00BFC0 [196]
AlternateDataStreams: C:\ProgramData\TEMP:8F067037 [201]
AlternateDataStreams: C:\ProgramData\TEMP:8F4E260C [450]
AlternateDataStreams: C:\ProgramData\TEMP:8FA72FF8 [95]
AlternateDataStreams: C:\ProgramData\TEMP:9603033A [266]
AlternateDataStreams: C:\ProgramData\TEMP:97B3B270 [118]
AlternateDataStreams: C:\ProgramData\TEMP:97CA3B9E [143]
AlternateDataStreams: C:\ProgramData\TEMP:993185CB [286]
AlternateDataStreams: C:\ProgramData\TEMP:9C7A32BB [118]
AlternateDataStreams: C:\ProgramData\TEMP:9D03192E [450]
AlternateDataStreams: C:\ProgramData\TEMP:9D2DE4B4 [242]
AlternateDataStreams: C:\ProgramData\TEMP:A10E88DE [284]
AlternateDataStreams: C:\ProgramData\TEMP:A18121AD [264]
AlternateDataStreams: C:\ProgramData\TEMP:A4ACFB14 [111]
AlternateDataStreams: C:\ProgramData\TEMP:A9ABA3FF [128]
AlternateDataStreams: C:\ProgramData\TEMP:AA93EFD3 [246]
AlternateDataStreams: C:\ProgramData\TEMP:AC116044 [116]
AlternateDataStreams: C:\ProgramData\TEMP:AD020DC3 [138]
AlternateDataStreams: C:\ProgramData\TEMP:AE289451 [508]
AlternateDataStreams: C:\ProgramData\TEMP:AE75CCC8 [147]
AlternateDataStreams: C:\ProgramData\TEMP:B1EEADE7 [119]
AlternateDataStreams: C:\ProgramData\TEMP:B36361EE [239]
AlternateDataStreams: C:\ProgramData\TEMP:B4186923 [234]
AlternateDataStreams: C:\ProgramData\TEMP:B522B91B [135]
AlternateDataStreams: C:\ProgramData\TEMP:B64F7263 [143]
AlternateDataStreams: C:\ProgramData\TEMP:B65E763D [512]
AlternateDataStreams: C:\ProgramData\TEMP:B6B87ADA [99]
AlternateDataStreams: C:\ProgramData\TEMP:B709343D [130]
AlternateDataStreams: C:\ProgramData\TEMP:B790962B [270]
AlternateDataStreams: C:\ProgramData\TEMP:B83F1B83 [105]
AlternateDataStreams: C:\ProgramData\TEMP:BABA07C2 [111]
AlternateDataStreams: C:\ProgramData\TEMP:BC898B69 [212]
AlternateDataStreams: C:\ProgramData\TEMP:BC8E9899 [137]
AlternateDataStreams: C:\ProgramData\TEMP:BEB6D0B2 [94]
AlternateDataStreams: C:\ProgramData\TEMP:BECA50FF [135]
AlternateDataStreams: C:\ProgramData\TEMP:BFE54417 [225]
AlternateDataStreams: C:\ProgramData\TEMP:C5E2BAEE [131]
AlternateDataStreams: C:\ProgramData\TEMP:C7857F06 [121]
AlternateDataStreams: C:\ProgramData\TEMP:C7F5E798 [113]
AlternateDataStreams: C:\ProgramData\TEMP:C80AB70B [95]
AlternateDataStreams: C:\ProgramData\TEMP:C98828D3 [141]
AlternateDataStreams: C:\ProgramData\TEMP:CA0CE093 [124]
AlternateDataStreams: C:\ProgramData\TEMP:CB0EB1DE [102]
AlternateDataStreams: C:\ProgramData\TEMP:CC45913B [119]
AlternateDataStreams: C:\ProgramData\TEMP:CF61CE5A [112]
AlternateDataStreams: C:\ProgramData\TEMP:D2397415 [140]
AlternateDataStreams: C:\ProgramData\TEMP:D3331ADB [242]
AlternateDataStreams: C:\ProgramData\TEMP:D3A82449 [130]
AlternateDataStreams: C:\ProgramData\TEMP:D507AEDA [103]
AlternateDataStreams: C:\ProgramData\TEMP:D696AA12 [139]
AlternateDataStreams: C:\ProgramData\TEMP:D6A4A911 [286]
AlternateDataStreams: C:\ProgramData\TEMP:D8A1AC56 [139]
AlternateDataStreams: C:\ProgramData\TEMP:D9B1EB7E [134]
AlternateDataStreams: C:\ProgramData\TEMP:D9EDE5FA [112]
AlternateDataStreams: C:\ProgramData\TEMP:DA7655EA [131]
AlternateDataStreams: C:\ProgramData\TEMP:E07230CC [104]
AlternateDataStreams: C:\ProgramData\TEMP:E0CDBB5A [145]
AlternateDataStreams: C:\ProgramData\TEMP:E153075C [484]
AlternateDataStreams: C:\ProgramData\TEMP:E1610EDC [270]
AlternateDataStreams: C:\ProgramData\TEMP:E1D06077 [146]
AlternateDataStreams: C:\ProgramData\TEMP:E222F217 [125]
AlternateDataStreams: C:\ProgramData\TEMP:E44D7155 [95]
AlternateDataStreams: C:\ProgramData\TEMP:E4BC4A41 [128]
AlternateDataStreams: C:\ProgramData\TEMP:E54FC174 [428]
AlternateDataStreams: C:\ProgramData\TEMP:E5BA9ADD [112]
AlternateDataStreams: C:\ProgramData\TEMP:E6708F08 [236]
AlternateDataStreams: C:\ProgramData\TEMP:EB68CA55 [233]
AlternateDataStreams: C:\ProgramData\TEMP:EB86F355 [243]
AlternateDataStreams: C:\ProgramData\TEMP:EBCF5924 [146]
AlternateDataStreams: C:\ProgramData\TEMP:EC752217 [476]
AlternateDataStreams: C:\ProgramData\TEMP:ED194880 [224]
AlternateDataStreams: C:\ProgramData\TEMP:ED796303 [117]
AlternateDataStreams: C:\ProgramData\TEMP:F1175E1D [506]
AlternateDataStreams: C:\ProgramData\TEMP:F117D09A [234]
AlternateDataStreams: C:\ProgramData\TEMP:F1F936DF [118]
AlternateDataStreams: C:\ProgramData\TEMP:F2AF86D9 [110]
AlternateDataStreams: C:\ProgramData\TEMP:F44D3C53 [101]
AlternateDataStreams: C:\ProgramData\TEMP:F4BF61E8 [492]
AlternateDataStreams: C:\ProgramData\TEMP:F52DB269 [146]
AlternateDataStreams: C:\ProgramData\TEMP:F6CDA594 [228]
AlternateDataStreams: C:\ProgramData\TEMP:F7581CE6 [252]
AlternateDataStreams: C:\ProgramData\TEMP:F760FD47 [114]
AlternateDataStreams: C:\ProgramData\TEMP:F7FFE8AF [259]
AlternateDataStreams: C:\ProgramData\TEMP:F98E6C67 [231]
AlternateDataStreams: C:\ProgramData\TEMP:FBF4285F [137]
AlternateDataStreams: C:\ProgramData\TEMP:FD38E906 [286]
AlternateDataStreams: C:\ProgramData\TEMP:FD786DCA [144]
AlternateDataStreams: C:\ProgramData\TEMP:FDC41D2C [97]
URLSearchHook: HKU\S-1-5-21-2917026532-1704927967-2421539612-1000 - (Kein Name) - {7888381e-e4f0-48f5-a278-b48b0187d950} - Keine Datei
C:\WINDOWS\system32\Tasks\Avira
Task: {0170E4A8-75EF-4FB9-9623-3C86E037CC6A} - System32\Tasks\{5EDF5F80-21D8-44CE-903F-160F6DF55E99} => C:\Windows\system32\pcalua.exe -a "C:\Users\X1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YY7IHIGW\avira_antivirus_premium_de.exe" -d C:\Users\X1\Desktop
S3 phantomtap; C:\WINDOWS\System32\DRIVERS\phantomtap.sys [35664 2020-01-08] (Avira Operations GmbH & Co. KG -> The OpenVPN Project)
C:\WINDOWS\System32\DRIVERS\phantomtap.sys
C:\Users\AllUserName\AppData\Roaming\Avira
powershell: Set-MpPreference -PUAProtection Enabled
powershell: Set-MpPreference -DisableScanningNetworkFiles 0
CMD: sfc /scannow
CMD: dism /online /cleanup-image /restorehealth
CMD: sfc /scannow
Hosts:
RemoveProxy:
EmptyTemp:
End::
Starte nun FRST und klicke direkt den Reparieren Wichtig : Du brauchst den Inhalt der Code-Box nirgends einfügen, da sich FRST den Code aus der Zwischenablage holt! Das Tool führt die gewünschten Schritte aus und erstellt eine fixlog.txt Gegebenenfalls muss dein Rechner neu gestartet werden. Poste mir den Inhalt der fixlog.txt Schritt 2 Starte FRST erneut. Kopiere den Inhalt der folgenden Code-Box oben in das Suchfeld: Code:
Alles auswählen Aufklappen ATTFilter
SearchAll: RebInf64.dll;RebateInformer
Klicke auf den Button Datei-Suche . FRST beginnt mit dem Suchlauf. Das kann einige Zeit dauern, bitte gedulde dich! Am Ende wird eine Textdatei Search.txt Poste mir deren Inhalt mit deiner nächsten Antwort. Schritt 3 Starte FRST erneut und klicke auf Untersuchen . FRST erstellt nun zwei Logdateien (FRST.txt Addition.txt Poste mir beide Logdateien mit deiner nächsten Antwort. Bitte poste mit deiner nächsten Antwort: eine Rückmeldung bezüglich der Deinstallationen die Logdatei des FRST-Fix (fixlog.txt) die Logdatei des FRST-Suchlaufs (Search.txt) die beiden neuen Logdateien von FRST (FRST.txt und Addition.txt)
24.05.2021, 08:01
Baum-Darstellung