Windows 8.1 Probleme nach Windows Update Log-Files zu groß - Teil 1

Start::
SystemRestore: On 
CreateRestorePoint:
CloseProcesses:
HKLM\...\Run: [] => [X]
HKLM\...\Run: [WindowsDefender] => "%ProgramFiles%\Windows Defender\MSASCuiL.exe" (Keine Datei)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1111762605-3097862284-2369679256-1001\...\Run: [VLC Plus Player Updater] => C:\Users\Juergen\AppData\Local\VLC Plus Player Updater\Updater.exe [202056 2022-01-23] (Aller Media e.K. -> ) <==== ACHTUNG
c:\Users\Juergen\AppData\Local\VLC Plus Player Updater
HKU\S-1-5-21-1111762605-3097862284-2369679256-1001\...\Run: [] => [X]
HKU\S-1-5-21-1111762605-3097862284-2369679256-1001\...\MountPoints2: {48a07732-32e9-11e4-be9e-5453ed3b9661} - "G:\launcher.exe" 
HKU\S-1-5-21-1111762605-3097862284-2369679256-1001\...\MountPoints2: {ab02f377-672b-11e6-bf40-5453ed3b9661} - "E:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-18\...\RunOnce: [{90140000-001C-0000-1000-0000000FF1CE}] => C:\WINDOWS\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H (Keine Datei)
Folder: C:\ProgramData\Microsoft Help
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Beschränkung <==== ACHTUNG
Task: {094CD275-5C71-4753-B57E-5566CA859498} - System32\Tasks\Microsoft\Windows\SideShow\AutoWake => {E51DFD48-AA36-4B45-BB52-E831F02E8316}
Task: {0AA0D8DC-B687-40A3-8E45-27ADD1D9E67D} - \Microsoft_Hardware_Launch_rundll32_exe -> Keine Datei <==== ACHTUNG
Task: {0CE6A45C-874F-40BF-9084-74F9E1228310} - System32\Tasks\{85B9C296-77C4-4AE6-B883-8CB1BE430945} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\Juergen\AppData\Roaming\istartsurf\UninstallManager.exe -c -ptid=smt
Task: {0F6DBBD1-1FA5-490B-A482-1F43FCC689E6} - System32\Tasks\Microsoft\Windows\SideShow\SystemDataProviders => {7CCA6768-8373-4D28-8876-83E8B4E3A969}
Task: {12219B30-FA6B-4682-A893-F6B14A984E6A} - kein Dateipfad
Task: {251B68B5-4450-4EE2-B884-823F47FD49BD} - System32\Tasks\{87CB7A52-DB6D-4BE7-8FF7-0B4C0B311A49} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Wajam\uninstall.exe"
Task: {2FFACF0F-AD2C-41F5-A105-D42026728035} - \ASVCI -> Keine Datei <==== ACHTUNG
Task: {6F1CA3AD-5528-4243-A9D6-EB2D954B25B8} - System32\Tasks\{2ABB38EA-2992-4993-ACC7-1101A1D5FE9F} => C:\WINDOWS\system32\pcalua.exe -a "C:\Users\Juergen\Downloads\AudibleDM_iTunesSetup (2).exe" -d C:\Users\Juergen\Downloads
Task: {744182D8-D005-4D10-B0BA-A66AB855E40D} - System32\Tasks\Health-Check-deep => C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\healthcheck.exe -deepscan (Keine Datei)
C:\Program Files (x86)\Innovative Solutions
Task: {87AF006E-39F4-4D18-A6A9-0ED623046A0F} - System32\Tasks\AupAvUpdate => C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\updAvTask.exe -UPDATE (Keine Datei)
Task: {8B6759EE-1C08-4B8F-955C-774AB5A6544E} - System32\Tasks\Microsoft\Windows\SideShow\SessionAgent => {45F26E9E-6199-477F-85DA-AF1EDfE067B1}
Task: {91B6BB43-F064-481D-B5FA-0C8A3C1AD937} - System32\Tasks\UninstallMonitor => C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\uninstaller.exe -AUSCAN (Keine Datei)
Task: {A63F9836-FF21-4B4E-9587-EB935C3EEFD5} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [335416 2020-04-14] (Adobe Inc. -> Adobe)
Task: {B29661EA-B963-4C05-AE19-9DB27EC346FB} - System32\Tasks\{9333F64A-06B8-4C00-BAF8-AF626E5E3587} => C:\WINDOWS\system32\pcalua.exe -a "C:\Users\Juergen\Downloads\AudibleDM_iTunesSetup (1).exe" -d C:\Users\Juergen\Downloads
Task: {C6CD4539-F5C3-4F88-89F9-05DB003DE0C3} - System32\Tasks\{E585DAC8-AAE3-4263-8069-0BE66C3A331A} => "c:\program files (x86)\google\chrome\application\chrome.exe" hxxp://ui.skype.com/ui/0/6.10.60.104/de/abandoninstall?page=tsMain
Task: {C9DCF59E-6B97-4C0C-8641-B8261089C8CA} - System32\Tasks\Microsoft\Windows\MobilePC\HotStart => {06DA0625-9701-43da-BFD7-FBEEA2180A1E}
Task: {D4802B20-3500-4646-9B26-B7DE78AA6E85} - System32\Tasks\Sony Corporation\VAIO Care\UpdateContacts => C:\ProgramData\Sony Corporation\VAIO Care\UpdateContacts.exe taskschedule (Keine Datei)
Task: {DB21EF32-6BA9-4118-BBC1-BC4FF48961E5} - System32\Tasks\Microsoft\Windows\SideShow\GadgetManager => {FF87090D-4A9A-4f47-879B-29A80C355D61}
Task: {EBD4BF5D-7D44-44D8-9393-4C045FC9334E} - System32\Tasks\Adobe Flash Player NPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_363_Plugin.exe [1458232 2020-04-14] (Adobe Inc. -> Adobe)
Task: {F68CA106-ED3C-43FC-90BF-2BA23C597572} - System32\Tasks\Health-Check => C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\healthcheck.exe -scan (Keine Datei)
Task: C:\WINDOWS\Tasks\ARHFCC.job => C:\Users\Juergen\AppData\Roaming\ARHFCC.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\ASVCI.job => C:\Users\Juergen\AppData\Roaming\ASVCI.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\Health-Check-deep.job => C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\healthcheck.exe
Task: C:\WINDOWS\Tasks\Health-Check.job => C:\Program Files (x86)\Innovative Solutions\Advanced Uninstaller PRO\healthcheck.exe
C:\Users\Juergen\AppData\Roaming\ARHFCC.exe
C:\Users\Juergen\AppData\Roaming\ASVCI.exe
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3: <==== ACHTUNG (Beschränkung - Zones)
ProxyEnable: [.DEFAULT] => Proxy ist aktiviert.
ProxyServer: [.DEFAULT] => http=127.0.0.1:52681;https=127.0.0.1:52681
FF Extension: (Avast SafePrice | Vergleich, Angebote, Gutscheine) - C:\Users\Juergen\AppData\Roaming\Mozilla\Firefox\Profiles\d46imrcb.dev-edition-default\Extensions\sp@avast.com.xpi [2021-04-27]
FF Extension: (Avast Online Security) - C:\Users\Juergen\AppData\Roaming\Mozilla\Firefox\Profiles\d46imrcb.dev-edition-default\Extensions\wrc@avast.com.xpi [2021-04-27]
CHR HomePage: Default -> hxxps://de.search.yahoo.com/?type=715483&fr=yo-yhp-ch
CHR StartupUrls: Default -> "hxxp://google.de/"
CHR DefaultSearchKeyword: Default -> google.de_
OPR Notifications: Opera Stable -> hxxps://www.flirt4fuck.com; hxxps://www.manomano.de; hxxps://www.youtube.com; hxxps://www80.hattrick.org; hxxps://www83.hattrick.org; hxxps://www84.hattrick.org
S2 InstallerService; C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe [X]
S3 semav6msr64; \??\C:\WINDOWS\system32\drivers\semav6msr64.sys [X]
S3 semav6thermal64ro; \??\C:\WINDOWS\system32\drivers\semav6thermal64ro.sys [X]
S3 SWDUMon; \SystemRoot\system32\DRIVERS\SWDUMon.sys [X]
2022-10-04 18:59 - 2022-10-04 18:59 - 005960536 _____ (Avira Operations GmbH & Co. KG) C:\Users\Juergen\Downloads\avira_de_sptl1_728604575-1664902718__phpws-spotlight-release.exe
2022-10-10 08:04 - 2020-04-20 22:27 - 000000000 ____D C:\Program Files (x86)\Avira
2014-09-01 10:18 - 2014-09-01 10:18 - 000002086 _____ () C:\Users\Juergen\AppData\Roaming\ARHFCC
2014-09-01 10:18 - 2014-09-01 10:18 - 000001248 _____ () C:\Users\Juergen\AppData\Roaming\ASVCI
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Keine Datei
ContextMenuHandlers2: [ContextMenu] -> {ee10d625-cc60-30a4-b3df-4b349785be6b} => C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Antivirus.ContextMenu.DLL -> Keine Datei
AlternateDataStreams: C:\ProgramData\Temp:373E1720 [121]
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?bcutc=sp-006
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-1111762605-3097862284-2369679256-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
HKU\S-1-5-21-1111762605-3097862284-2369679256-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM -> DefaultScope {554DFEBF-3DC8-4E27-A860-7B615A3CC48E} URL = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {9bb2c1cc-4a7d-4cd5-bce9-0ca5f9ff8391} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {9bb2c1cc-4a7d-4cd5-bce9-0ca5f9ff8391} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {9bb2c1cc-4a7d-4cd5-bce9-0ca5f9ff8391} URL = 
SearchScopes: HKU\S-1-5-21-1111762605-3097862284-2369679256-1001 -> {554DFEBF-3DC8-4E27-A860-7B615A3CC48E} URL = 
Toolbar: HKU\S-1-5-21-1111762605-3097862284-2369679256-1001 -> Kein Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} -  Keine Datei
Toolbar: HKU\S-1-5-21-1111762605-3097862284-2369679256-1001 -> Kein Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  Keine Datei

startpowershell:
Set-Service -Name "BITS" -StartupType Manual -Verbose
Set-Service -Name "Dhcp" -StartupType Automatic -Verbose
Set-Service -Name "EventLog" -StartupType Automatic -Verbose
Set-Service -Name "EventSystem" -StartupType Automatic -Verbose
Set-Service -Name "nsi" -StartupType Automatic -Verbose
Set-Service -Name "RasMan" -StartupType Manual -Verbose
Set-Service -Name "SDRSVC" -StartupType Manual -Verbose
Set-Service -Name "SstpSvc" -StartupType Manual -Verbose
Set-Service -Name "TrustedInstaller" -StartupType Manual -Verbose
Set-Service -Name "VSS" -StartupType Manual -Verbose
Set-Service -Name "Winmgmt" -StartupType Automatic -Verbose
Set-Service -Name "wuauserv" -StartupType Manual -Verbose

Set-MpPreference -DisableAutoExclusions $true -Force
set-mppreference -mapsreporting basic -Force
set-mppreference -DisableRealtimeMonitoring $false -Force
set-mppreference -DisablePrivacyMode $true -Force
set-mppreference -DisableIOAVProtection $false -Force
set-mppreference -CheckForSignaturesBeforeRunningScan $true -Force
set-mppreference -PUAProtection enabled -Force
Set-MpPreference -DisableBehaviorMonitoring $false -Force
Set-MpPreference -SignatureScheduleDay Everyday -force
set-mppreference -RealTimeProtectionEnabled $true -force
set-mppreference -OnAccessProtectionEnabled $true -force

Function Remove-all-windefend-excludes {
$Paths=(Get-MpPreference).ExclusionPath
$Extensions=(Get-MpPreference).ExclusionExtension
$Processes=(Get-MpPreference).ExclusionProcess
foreach ($Path in $Paths) { Remove-MpPreference -ExclusionPath $Path -force}
foreach ($Extension in $Extensions) { Remove-MpPreference -ExclusionExtension $Extension -force}
foreach ($Process in $Processes) { Remove-MpPreference -ExclusionProcess $Process -force}
}
Set-MpPreference -DisableAutoExclusions $true -Force
Remove-all-windefend-excludes
endpowershell:

CMD: WMIC SERVICE WHERE Name="dcomlaunch" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="nsi" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="dhcp" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="rpcss" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="rpceptmapper" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="winmgmt" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="sdrsvc" set startmode="manual"
CMD: WMIC SERVICE WHERE Name="vss" set startmode="manual"
CMD: WMIC SERVICE WHERE Name="eventlog" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="bfe" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="eventsystem" set startmode="auto"
CMD: WMIC SERVICE WHERE Name="msiserver" set startmode="manual"
CMD: WMIC SERVICE WHERE Name="sstpsvc" set startmode="manual"
CMD: WMIC SERVICE WHERE Name="rasman" set startmode="manual"
CMD: WMIC SERVICE WHERE Name="trustedinstaller" set startmode="auto"
CMD: net start sdrsvc
CMD: net start vss
CMD: net start rpcss
CMD: net start eventsystem
CMD: net start winmgmt
CMD: net start msiserver
CMD: net start bfe
CMD: net start trustedinstaller
CMD: WMIC SERVICE WHERE Name="windefend" CALL ChangeStartMode "automatic"
CMD: WMIC SERVICE WHERE Name="windefend" CALL startservice
CMD: WMIC SERVICE WHERE Name="securityhealthservice" CALL ChangeStartMode "automatic"
CMD: WMIC SERVICE WHERE Name="securityhealthservice" CALL startservice
CMD: net start windefend
CMD: net start mpssvc
CMD: net start mpsdrv

CMD: netsh winsock reset
CMD: netsh int ip reset
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: ipconfig /flushdns
CMD: ipconfig /registerdns
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh winhttp reset proxy
CMD: Bitsadmin /Reset /Allusers
CMD: Winmgmt /salvagerepository 
CMD: Winmgmt /resetrepository 
CMD: winmgmt /resyncperf
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: sfc /scannow

Hosts:
RemoveProxy:
EmptyTemp:
End::