Avira Sicherheitswarnung "Potenzielle Bedrohung blockiert Dateiname: Memorybuffer........"

schdohni · 07.11.2022, 12:16

Hallo,

seit ein paar Tagen bekomme ich beim Start des PCs (Windows 10 Pro, 64 Bit) über Avira die auf Screenshot 1 ersichtliche Warnmeldung angezeigt.

Wenn ich dann in der Quarantäne nachschaue, ist sie leer. Ich habe generell mal nach den Begriffen gegoogelt, aber konnte keine Schlüsse daraus ziehen. Auf Screenshot 2 sind die aufgeklappten Details zu der Warnmeldung ersichtlich. Ebenso habe ich die beiden von FRST erstellten .txt Dateien bereits angehängt.

Welche Bedrohung ist das, könnt ihr mir bei der Beseitung helfen und warum ist nichts in der Quarantäne?

Mit freundlichen Grüßen und vielen Dank im voraus,
Ralph

cosinus · 07.11.2022, 12:23

Zuerst mal: Avira und das alte Java 8 komplett deinstallieren. Dann gehts weiter.
Und Logfiles bitte künftig nur in CODE-Tags posten, nicht in den Anhang!

schdohni · 07.11.2022, 12:54

Hallo Cosinus,

vielen Dank für die schnelle Rückmeldung.

Zitat:

Zitat von cosinus

Zuerst mal: Avira und das alte Java 8 komplett deinstallieren. Dann gehts weiter.

ist erledigt

Zitat:

Zitat von cosinus

Und Logfiles bitte künftig nur in CODE-Tags posten, nicht in den Anhang!

Was sind "CODE-Tags" und wie geht das?

Grüße, Ralph

cosinus · 07.11.2022, 12:57

adwCleaner

Führe AdwCleaner gemäß der bebilderten Anleitung aus und poste abschließend die Logdatei in CODE-Tags.

adwcleaner bitte wiederholen falls es Funde gab.

Posten in CODE-Tags

Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

schdohni · 07.11.2022, 14:09

Code:

ATTFilter

# -------------------------------
# Malwarebytes AdwCleaner 8.4.0.0
# -------------------------------
# Build:    08-30-2022
# Database: 2022-10-10.1 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    11-07-2022
# Duration: 00:00:01
# OS:       Windows 10 (Build 19044.2130)
# Cleaned:  19
# Failed:   1


***** [ Services ] *****

Deleted       WCAssistantService

***** [ Folders ] *****

Deleted       C:\Program Files (x86)\Lavasoft\Web Companion
Deleted       C:\ProgramData\Application Data\Lavasoft\Web Companion
Deleted       C:\ProgramData\Lavasoft\Web Companion
Deleted       C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft\WebCompanion
Deleted       C:\Users\schdohni\AppData\Local\Lavasoft\WEBCOMPANION.EXE_URL_SIQ0LWF3TZGXP2KHFKLLYBK3IDTBEHNG
Deleted       C:\Users\schdohni\AppData\Roaming\Lavasoft\Web Companion

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted       HKCU\Software\Lavasoft\Web Companion
Deleted       HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|Web Companion
Deleted       HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
Deleted       HKCU\Software\Microsoft\Windows\CurrentVersion\Run|Web Companion
Deleted       HKLM\Software\Microsoft\Shared Tools\MSConfig\services\WCAssistantService
Deleted       HKLM\Software\Wow6432Node\Lavasoft\Web Companion
Deleted       HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f389f9d2-ece4-4b5e-acee-e1ed06932ead}|DisplayIcon
Deleted       HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f389f9d2-ece4-4b5e-acee-e1ed06932ead}|DisplayName
Deleted       HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f389f9d2-ece4-4b5e-acee-e1ed06932ead}|UninstallString
Deleted       HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
Deleted       HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
Not Deleted   HKCU\SOFTWARE\E830AF50B2B0417819725010A63A71B5

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

Deleted       Startfenster

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [3383 octets] - [07/11/2022 13:59:39]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

wie angewiesen, habe ich den Scan wiederholt, hier der neue Log:

Code:

ATTFilter

# -------------------------------
# Malwarebytes AdwCleaner 8.4.0.0
# -------------------------------
# Build:    08-30-2022
# Database: 2022-10-10.1 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    11-07-2022
# Duration: 00:00:00
# OS:       Windows 10 (Build 19044.2130)
# Cleaned:  0
# Failed:   1


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Not Deleted   HKCU\SOFTWARE\E830AF50B2B0417819725010A63A71B5

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [3383 octets] - [07/11/2022 13:59:39]
AdwCleaner[C00].txt - [3205 octets] - [07/11/2022 14:00:21]
AdwCleaner[S01].txt - [1584 octets] - [07/11/2022 14:07:03]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ##########

Aber auch hier hat er wieder einen Fund gehabt, habe ich wieder in die quarantäne verschoben und den scan zum dritten mal gestartet, dieser Fund taucht aber anscheinend immer wieder auf.

cosinus · 07.11.2022, 14:20

Dann jetzt neue FRST-Logs.

schdohni · 07.11.2022, 16:36

erldigt, hier die Logs:

Code:

ATTFilter

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 06-11-2022
durchgeführt von schdohni (07-11-2022 16:33:15)
Gestartet von C:\Users\schdohni\Downloads
Microsoft Windows 10 Pro Version 21H2 19044.2130 (X64) (2021-01-30 18:43:38)
Start-Modus: Normal
==========================================================


==================== Konten: =============================


(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

Administrator (S-1-5-21-144240348-1158812916-3569957004-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-144240348-1158812916-3569957004-503 - Limited - Disabled)
Gast (S-1-5-21-144240348-1158812916-3569957004-501 - Limited - Disabled)
pbrei (S-1-5-21-144240348-1158812916-3569957004-1002 - Limited - Disabled)
schdo (S-1-5-21-144240348-1158812916-3569957004-1003 - Limited - Disabled)
schdohni (S-1-5-21-144240348-1158812916-3569957004-1001 - Administrator - Enabled) => C:\Users\schdohni
WDAGUtilityAccount (S-1-5-21-144240348-1158812916-3569957004-504 - Limited - Disabled)

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Enabled - Up to date) {88AE6B46-DC3C-455A-A21B-085F285A3546}
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {33CF8AA2-FA06-4AD4-98AB-332D53DD7FFB}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

A Way Out (HKLM-x32\...\{E8D752CF-2FCC-470D-B0C5-4BFC6F42ACCE}) (Version: 1.0.62.0 - Electronic Arts, Inc.)
Amazon Games (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\{4DD10B06-78A4-4E6F-AA39-25E9C38FA568}) (Version: 2.3.8336.1 - Amazon.com Services, Inc.)
Anno 1800 (HKLM-x32\...\Uplay Install 4553) (Version:  - Ubisoft)
ArtMoney SE v8.12.1 64-bits (HKLM-x32\...\ArtMoney SE_is1) (Version: 8.12.1 - System SoftLab)
Aslain's WoWs Modpack Version 11.8.0.09 (HKLM-x32\...\ASLAINSWARSHIPSTEST_is1) (Version: 11.8.0.09 - Aslain)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Burning Crusade Classic (HKLM-x32\...\Burning Crusade Classic) (Version:  - Blizzard Entertainment)
calibre (HKLM-x32\...\{D3CF17E8-ECE2-4B16-86D3-1C6B2F94BF8C}) (Version: 5.44.0 - Kovid Goyal)
cFosSpeed 11.11 (HKLM\...\cFosSpeed) (Version: 11.11 - cFos Software GmbH, Bonn)
Command & Conquer™ 3 Tiberium Wars and Kane's Wrath (HKLM-x32\...\{35A2FE53-CC80-4D17-941F-3A7C82824FC7}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
Command & Conquer™: Generals and Zero Hour (HKLM-x32\...\{609F6FD5-4B22-4D7A-AD30-8C9DD480D5BE}) (Version: 1.0.0.0 - Electronic Arts, Inc.)
CPUID CPU-Z MSI 1.94 (HKLM\...\CPUID CPU-Z MSI_is1) (Version: 1.94 - CPUID, Inc.)
CSGO Demos Manager version 2.14.2 (HKLM-x32\...\{2CC5723B-69A1-4B82-AA32-34968284F9C3}_is1) (Version: 2.14.2 - AkiVer)
CurseForge (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Overwolf_cchhcaiapeikjbdbpfplgmpobbcdkdaphclbmkbj) (Version: 0.206.3.6102 - Overwolf app)
Diablo II Resurrected (HKLM-x32\...\Diablo II Resurrected) (Version:  - Blizzard Entertainment)
Discord (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Discord) (Version: 1.0.9004 - Discord Inc.)
Dropbox (HKLM-x32\...\Dropbox) (Version: 160.4.4703 - Dropbox, Inc.)
Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.639.1 - Dropbox, Inc.) Hidden
DZLauncher version 0.1.6.8 (HKLM-x32\...\{1E299AE2-74C8-4CD8-6B17-A86E0ED3C4D2}_is1) (Version: 0.1.6.8 - Maca134)
DZSALauncher version 0.0.5.1 (HKLM-x32\...\DZSALauncher_is1) (Version: 0.0.5.1 - Maca134)
ecomDATA Cloud Installer Version 2.1.0.0 (HKLM-x32\...\{54A20923-6908-4E03-9DE8-22D6C6FF7693}_is1) (Version: 2.1.0.0 - ecomDATA GmbH)
ENE_DRAM_RGB_AIO (HKLM\...\{1745D314-9077-46C9-8562-1C62BAE189B7}) (Version: 1.0.2.33 - Ene Tech.) Hidden
ENE_DRAM_RGB_AIO (HKLM-x32\...\{5d801c90-9d81-4c67-be5b-07e5855dc22e}) (Version: 1.0.2.33 - Ene Tech.) Hidden
ENE_EHD_M2_HAL (HKLM\...\{37A48B7F-D4EA-4863-844E-A284E2AA3C5D}) (Version: 1.0.8.13 - ENE TECHNOLOGY INC.) Hidden
ENE_EHD_M2_HAL (HKLM-x32\...\{54d3d2b5-db16-446d-b6dd-f4964b166b3b}) (Version: 1.0.8.13 - ENE TECHNOLOGY INC.) Hidden
ENE_MousePad_HAL (HKLM\...\{9E97178A-ADB8-4778-BE60-7E28E2A72721}) (Version: 1.0.2.0 - ENE TECHNOLOGY INC.) Hidden
ENE_MousePad_HAL (HKLM-x32\...\{c2c794a4-7986-4c45-884d-d4ca43b88df9}) (Version: 1.0.2.0 - ENE TECHNOLOGY INC.) Hidden
ENE_X-JMI_HAL (HKLM\...\{2B8E611F-0B51-4FAC-87BB-AF50D82E7DDA}) (Version: 1.0.5.1 - ENE Tech) Hidden
ENE_X-JMI_HAL (HKLM-x32\...\{50ec3a07-291b-463e-be86-487eb8cbb71c}) (Version: 1.0.5.1 - ENE Tech) Hidden
Epic Games Launcher (HKLM-x32\...\{2A27CA16-E158-4B0A-A502-3E6364B1F03E}) (Version: 1.2.17.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (HKLM\...\{F9C5C994-F6B9-4D75-B3E7-AD01B84073E9}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Epic Online Services (HKLM-x32\...\{19695986-25CE-41AC-9C6F-54794653EDBA}) (Version: 2.0.36.0 - Epic Games, Inc.)
ESL Meisterschaft (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\5a2808bf6e493134) (Version: 1.0.26.0 - Anybrain S.A.)
FACEIT (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\FACEIT) (Version: 1.31.1 - FACEIT Ltd.)
FACEIT Anti-Cheat (HKLM\...\{1419E44C-0EF4-4822-9194-9F1A4D43973D}_is1) (Version: 2.0 - FACEIT LTD)
Far Cry 4 (HKLM-x32\...\Uplay Install 420) (Version:  - Ubisoft)
FileZilla Client 3.55.0 (HKLM-x32\...\FileZilla Client) (Version: 3.55.0 - Tim Kosse)
Genshin Impact (HKLM\...\Genshin Impact) (Version: 2.21.1.0 - COGNOSPHERE PTE. LTD.)
Ghost Recon Breakpoint (HKLM-x32\...\Uplay Install 11903) (Version:  - Ubisoft)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 107.0.5304.88 - Google LLC)
HCS VoicePacks Deutsch AURORA version 2.1 (HKLM-x32\...\{D53FEFBB-C717-403A-8246-D8F2BFC507DA}_is1) (Version: 2.1 - HCS VoicePacks Ltd)
HLSW v1.4.0.2 (HKLM-x32\...\HLSW_is1) (Version:  - Stripf Software)
Intel(R) Chipset Device Software (HKLM\...\{06D713D6-9845-436D-B857-5BF2596B4554}) (Version: 10.1.18634.8254 - Intel Corporation) Hidden
Intel(R) Chipset Device Software (HKLM-x32\...\{99926fb7-5da9-4101-b79f-eec3674ca64b}) (Version: 10.1.18634.8254 - Intel(R) Corporation)
IrfanView 4.60 (64-bit) (HKLM\...\IrfanView64) (Version: 4.60 - Irfan Skiljan)
Java(TM) SE Development Kit 16.0.2 (64-bit) (HKLM\...\{84539E3B-68B6-54F1-9CA3-EA920673C714}) (Version: 16.0.2.0 - Oracle Corporation)
Launcher Prerequisites (x64) (HKLM-x32\...\{43a03b9c-4770-409c-a999-587b60700b63}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
League of Legends (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Riot Game league_of_legends.live) (Version:  - Riot Games, Inc)
LibreOffice 7.1.3.2 (HKLM\...\{76B2DBF3-5773-4463-9EEB-D4A099EB6265}) (Version: 7.1.3.2 - The Document Foundation)
Logitech G HUB (HKLM\...\{521c89be-637f-4274-a840-baaf7460c2b2}) (Version: 2022.10.326382 - Logitech)
LogMeIn Hamachi (HKLM-x32\...\{B49685C9-32FA-4194-A43F-DAF6BD60F2EC}) (Version: 2.3.0.78 - LogMeIn, Inc.) Hidden
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.3.0.78 - LogMeIn, Inc.)
Microsoft 365 Apps for Enterprise - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 16.0.15726.20174 - Microsoft Corporation)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 107.0.1418.35 - Microsoft Corporation)
Microsoft Edge WebView2-Laufzeit (HKLM-x32\...\Microsoft EdgeWebView) (Version: 107.0.1418.35 - Microsoft Corporation)
Microsoft GameInput (HKLM-x32\...\{B71DA3AB-24EC-9E95-A79B-7B5F92B0CEDD}) (Version: 10.1.22621.1846 - Microsoft Corporation)
Microsoft OneDrive (HKLM\...\OneDriveSetup.exe) (Version: 22.212.1009.0004 - Microsoft Corporation)
Microsoft Teams (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Teams) (Version: 1.4.00.11161 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{7B1FCD52-8F6B-4F12-A143-361EA39F5E7C}) (Version: 3.67.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (HKLM\...\{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (HKLM\...\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM-x32\...\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM-x32\...\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (HKLM\...\{929FBD26-9020-399B-9A7A-751D61F0B942}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (HKLM\...\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (HKLM-x32\...\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (HKLM-x32\...\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}) (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.31.31103 (HKLM-x32\...\{2aaf1df0-eb13-4099-9992-962bb4e596d1}) (Version: 14.31.31103.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.31.31103 (HKLM-x32\...\{41d7b770-418a-43b7-95a5-f925fff05789}) (Version: 14.31.31103.0 - Microsoft Corporation)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.31.31103 (HKLM\...\{A977984B-9244-49E3-BD24-43F0A8009667}) (Version: 14.31.31103 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.31.31103 (HKLM\...\{A181A302-3F6D-4BAD-97A8-A426A6499D78}) (Version: 14.31.31103 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.31.31103 (HKLM-x32\...\{5720EC03-F26F-40B7-980C-50B5D420B5DE}) (Version: 14.31.31103 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.31.31103 (HKLM-x32\...\{799E3FFF-705C-461F-B400-6DE27398B3E5}) (Version: 14.31.31103 - Microsoft Corporation) Hidden
Minecraft Launcher (HKLM-x32\...\{733C3ACB-432D-4880-B0E1-660000D7974D}) (Version: 1.0.0.0 - Mojang)
Mozilla Firefox (x64 de) (HKLM\...\Mozilla Firefox 106.0.5 (x64 de)) (Version: 106.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 91.5.1 - Mozilla)
Mozilla Thunderbird (x64 de) (HKLM\...\Mozilla Thunderbird 102.4.1 (x64 de)) (Version: 102.4.1 - Mozilla)
MSI SDK (HKLM-x32\...\{EE7D557C-3AE7-4348-8DCA-3A89790D0002}}_is1) (Version: 2.2021.0716.01 - MSI)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 8.1.7 - Notepad++ Team)
NVIDIA FrameView SDK 1.2.7521.31103277 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_FrameViewSdk) (Version: 1.2.7521.31103277 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.25.1.27 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.25.1.27 - NVIDIA Corporation)
NVIDIA Grafiktreiber 516.94 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 516.94 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.39.14 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.39.14 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.21.0713 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.21.0713 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.15726.20096 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.15726.20096 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM\...\{90160000-008C-0407-1000-0000000FF1CE}) (Version: 16.0.15726.20096 - Microsoft Corporation) Hidden
Origin (HKLM-x32\...\Origin) (Version: 10.5.115.51547 - Electronic Arts, Inc.)
Overwolf (HKLM-x32\...\Overwolf) (Version: 0.204.2.2 - Overwolf Ltd.)
Paradox Launcher v2 (HKLM\...\{8C5CF4CE-D589-40B4-A77F-01FD64602C50}) (Version: 2.4.0 - Paradox Interactive)
PhraseExpress v15.0.87 (HKLM-x32\...\PhraseExpress_is1) (Version: 15.0.87 - Bartels Media GmbH)
Plarium Play (HKLM-x32\...\{41000c3b-605f-4f82-b39c-1b52479da52a}) (Version: 6.9.0 - Plarium)
Plarium Play (HKLM-x32\...\{7568A7FF-8F47-4A59-822C-7B601CD36AAA}) (Version: 6.9.0 - Plarium) Hidden
PS Remote Play (HKLM-x32\...\{B20F88DD-3B23-4AFD-A3A7-E23E71DD8372}) (Version: 5.0.0.02220 - Sony Interactive Entertainment Inc.)
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
Razer Cortex (HKLM-x32\...\Razer Cortex_is1) (Version: 10.3.7.0 - Razer Inc.)
Razer Synapse (HKLM-x32\...\Razer Synapse) (Version: 3.7.1015.100615 - Razer Inc.)
Realtek Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.9084.1 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 10.46.1231.2020 - Realtek)
Riot Vanguard (HKLM\...\Riot Vanguard) (Version:  - Riot Games, Inc.)
Rockstar Games Launcher (HKLM-x32\...\Rockstar Games Launcher) (Version: 1.0.65.1069 - Rockstar Games)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 2.1.5.1 - Rockstar Games)
Satisfactory Mod Manager 2.8.1 (HKLM\...\05aa181a-e2c4-5231-ae02-02af49144086) (Version: 2.8.1 - mircearoata)
SimCity™ (HKLM-x32\...\{F70FDE4B-8F86-4eb6-8C8E-636EC89F6419}) (Version: 4.0.98.0213 - Electronic Arts)
Spotify (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Spotify) (Version: 1.1.80.699.gc3dac750 - Spotify AB)
Star Wars™: The Old Republic™ (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.0.0.0 - Electronic Arts)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Tangysoft (HKLM-x32\...\Tangysoft_is1) (Version:  - Tangysoft Ltd.)
Teams Machine-Wide Installer (HKLM-x32\...\{731F6BAA-A986-45A4-8936-7C3AAAAA760B}) (Version: 1.4.0.7174 - Microsoft Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.5.6 - TeamSpeak Systems GmbH)
TeamViewer (HKLM\...\TeamViewer) (Version: 15.30.3 - TeamViewer)
The Secret of Monkey Island: Special Edition (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\AmazonGames/The Secret of Monkey Island -) (Version:  - LucasFilm Games)
Tom Clancys Rainbow Six Extraction (HKLM-x32\...\Uplay Install 5271) (Version:  - Ubisoft)
Tom Clancy's The Division 2 (HKLM-x32\...\Uplay Install 4932) (Version:  - Ubisoft)
Ubisoft Connect (HKLM-x32\...\Uplay) (Version: 121.0.10451 - Ubisoft)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{6753CC12-A884-47B2-9270-F5CD31B6F256}) (Version: 2.67.0.0 - Microsoft Corporation) Hidden
Update for Windows 10 for x64-based Systems (KB4480730) (HKLM\...\{0746492E-47B6-4251-940C-44462DFD74BB}) (Version: 2.55.0.0 - Microsoft Corporation)
VALORANT (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Riot Game valorant.live) (Version:  - Riot Games, Inc)
VdhCoApp 1.6.1 (HKLM\...\weh-iss-net.downloadhelper.coapp_is1) (Version:  - DownloadHelper)
VLC media player (HKLM\...\VLC media player) (Version: 3.0.12 - VideoLAN)
VoiceAttack version 1.8.9 (HKLM-x32\...\{D6EDF6DB-029E-4A34-A3A0-D960CB0FCB2A}_is1) (Version: 1.8.9 - VoiceAttack.com)
Wargaming.net Game Center (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Wargaming.net Game Center) (Version: 22.3.2.9972 - Wargaming.net)
WD_BLACK AN1500 (HKLM\...\{085E2365-0A70-4230-B664-02D5E4FE7E9C}) (Version: 1.0.12.0 - ENE TECHNOLOGY INC.) Hidden
WD_BLACK AN1500 (HKLM-x32\...\{9c94735f-73fd-4b0f-9ddb-8be7b3cc4681}) (Version: 1.0.12.0 - ENE TECHNOLOGY INC.) Hidden
WD_BLACK D50 (HKLM\...\{BDE43F26-5917-44F8-B86A-F1D9A6B80B32}) (Version: 1.0.9.0 - ENE TECHNOLOGY INC.) Hidden
WD_BLACK D50 (HKLM-x32\...\{a1d1ba00-92b7-4a99-8ebd-65b25c0e9e44}) (Version: 1.0.9.0 - ENE TECHNOLOGY INC.) Hidden
WhatsApp (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\WhatsApp) (Version: 2.2242.6 - WhatsApp)
Windows 10-Update-Assistent (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.23258 - Microsoft Corporation)
Windows-PC-Integritätsprüfung (HKLM\...\{B3956CF3-F6C5-4567-AC38-1FD4432B319C}) (Version: 3.6.2204.08001 - Microsoft Corporation)
WinRAR 6.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 6.00.0 - win.rar GmbH)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version:  - Blizzard Entertainment)
World_of_Warships (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\WOWS.WW.PRODUCTION) (Version:  - Wargaming.net)
Zoom (HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\ZoomUMX) (Version: 5.8.4 (1736) - Zoom Video Communications, Inc.)

Packages:
=========
Autodesk SketchBook -> C:\Program Files\WindowsApps\89006A2E.AutodeskSketchBook_5.1.0.0_x64__tf1gferkr813w [2022-02-19] (Autodesk Inc.)
Bubble Witch 3 Saga -> C:\Program Files\WindowsApps\king.com.BubbleWitch3Saga_7.25.54.0_x64__kgqvnymyfvs32 [2022-10-25] (king.com)
Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.230.400.0_x64__kgqvnymyfvs32 [2022-11-04] (king.com)
DragonCenter -> C:\Program Files\WindowsApps\9426MICRO-STARINTERNATION.DragonCenter_2.0.121.0_x64__kzh8wxbdkxb8p [2022-09-22] (MICRO-STAR INTERNATIONAL CO., LTD) [Startup Task]
March of Empires: War of Lords -> C:\Program Files\WindowsApps\A278AB0D.MarchofEmpires_6.8.1.0_x86__h6adky7gbf63m [2022-11-07] (Gameloft SE)
Media Engine-Add-On für Fotos -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2022-02-19] (Microsoft Corporation)
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2022-02-19] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2022-02-19] (Microsoft Corporation) [MS Ad]
Microsoft Minesweeper -> C:\Program Files\WindowsApps\Microsoft.MicrosoftMinesweeper_4.2.10101.0_x64__8wekyb3d8bbwe [2022-10-14] (Microsoft Studios) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.14.9130.0_x64__8wekyb3d8bbwe [2022-09-17] (Microsoft Studios) [MS Ad]
NVIDIA Control Panel -> C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_8.1.963.0_x64__56jybvy8sckqj [2022-10-18] (NVIDIA Corp.)
PPTX Viewer -> C:\Program Files\WindowsApps\22450.PPTXViewer_1.2.3.0_x64__0aqw1zw0x2snt [2022-07-22] (韵华软件)
Realtek Audio Control -> C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.29.256.0_x64__dt26b99r8h8gj [2022-02-19] (Realtek Semiconductor Corp)
Township -> C:\Program Files\WindowsApps\PLRWORLDWIDESALES.TOWNSHIP_2021.950.1.0_x64__1feq88045d2v2 [2022-09-24] (Playrix)
XING -> C:\Program Files\WindowsApps\XINGAG.XING_4.0.9.0_x86__xpfg3f7e9an52 [2022-02-19] (New Work SE)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-144240348-1158812916-3569957004-1001_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32 -> C:\Users\schdohni\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.21063.3\x64\Microsoft.Teams.AddinLoader.dll (Microsoft Corporation -> Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-144240348-1158812916-3569957004-1001_Classes\CLSID\{E31EA727-12ED-4702-820C-4B6445F28E1B} -> [RC-Profis Dropbox] => C:\Users\schdohni\RC-Profis Dropbox [2021-06-09 14:42]
ShellIconOverlayIdentifiers: [    OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [    OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [    OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [    OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [    OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [    OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [    OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [   DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [    OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [    OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [    OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [    OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [    OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [    OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [    OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [   DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2021-10-15] (Notepad++ -> )
ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2020-12-01] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2020-12-01] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers2: [ContextMenu] -> {ee10d625-cc60-30a4-b3df-4b349785be6b} => C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Antivirus.ContextMenu.DLL -> Keine Datei
ContextMenuHandlers3: [ContextMenu] -> {ee10d625-cc60-30a4-b3df-4b349785be6b} => C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Antivirus.ContextMenu.DLL -> Keine Datei
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncShell64.dll [2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.56.0.dll [2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_47917a79b8c7fd22\nvshext.dll [2022-07-28] (Nvidia Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2020-12-01] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2020-12-01] (win.rar GmbH -> Alexander Roshal)

==================== Codecs (Nicht auf der Ausnahmeliste) ====================

==================== Verknüpfungen & WMI ========================

==================== Geladene Module (Nicht auf der Ausnahmeliste) =============


==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\UpdateLock-D78BF5DD33499EC2:A4C50C4FA2 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FACEIT AC.lnk:550995E265 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk:980850BA8A [3442]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) =================

==================== Internet Explorer (Nicht auf der Ausnahmeliste) ==========

BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\Office16\OCHelper.dll [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\sharepoint.com -> hxxps://freaks4ugaminggmbh-files.sharepoint.com

==================== Hosts Inhalt: =========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2017-03-18 22:03 - 2017-03-18 22:01 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts

==================== Andere Bereiche ===========================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files\Common Files\Oracle\Java\javapath;C:\Program Files (x86)\Razer Chroma SDK\bin;C:\Program Files\Razer Chroma SDK\bin;C:\Program Files (x86)\Razer\ChromaBroadcast\bin;C:\Program Files\Razer\ChromaBroadcast\bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\NVIDIA Corporation\NVIDIA NvDLISR;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps;C:\Program Files (x86)\Calibre2\;E:\99damage\CSGO Demos Manager
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\schdohni\Downloads\785330.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: )
 ist aktiviert.

Network Binding:
=============
Ethernet: cFosSpeed for faster Internet connections (NDIS 6) -> cfosspeed (enabled) 
WLAN: cFosSpeed for faster Internet connections (NDIS 6) -> cfosspeed (enabled) 

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

MSCONFIG\Services: BEService => 3
MSCONFIG\Services: cFosSpeedS => 2
MSCONFIG\Services: CortexLauncherService => 2
MSCONFIG\Services: EasyAntiCheat => 3
MSCONFIG\Services: EasyAntiCheat_EOS => 3
MSCONFIG\Services: FACEITService => 3
MSCONFIG\Services: GoogleChromeElevationService => 3
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: Hamachi2Svc => 2
MSCONFIG\Services: Intel(R) Capability Licensing Service TCP IP Interface => 3
MSCONFIG\Services: Intel(R) TPM Provisioning Service => 2
MSCONFIG\Services: jhi_service => 2
MSCONFIG\Services: LightKeeperService => 2
MSCONFIG\Services: LMIGuardianSvc => 2
MSCONFIG\Services: LMS => 2
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: Mystic_Light_Service => 2
MSCONFIG\Services: Origin Client Service => 3
MSCONFIG\Services: Origin Web Helper Service => 2
MSCONFIG\Services: OverwolfUpdater => 3
MSCONFIG\Services: Plarium Play Client Service => 2
MSCONFIG\Services: RtkAudioUniversalService => 2
MSCONFIG\Services: TeamViewer => 2
MSCONFIG\Services: vgc => 3
HKLM\...\StartupApproved\Run: => "SecurityHealth"
HKLM\...\StartupApproved\Run: => "RtkAudUService"
HKLM\...\StartupApproved\Run: => "Riot Vanguard"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "TeamsMachineInstaller"
HKLM\...\StartupApproved\Run32: => "LogMeIn Hamachi Ui"
HKLM\...\StartupApproved\Run32: => "RazerCortex"
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\StartupApproved\Run: => "PlariumPlay"
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\StartupApproved\Run: => "FACEIT"
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\StartupApproved\Run: => "Wargaming.net Game Center"
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\StartupApproved\Run: => "com.squirrel.Teams.Teams"
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\StartupApproved\Run: => "Overwolf"
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\StartupApproved\Run: => "Discord"
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_40630843975B47C797D06FD044331A1D"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{353E4A71-F92B-4256-A162-38A9DCCC1141}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (Nvidia Corporation -> NVIDIA Corporation)
FirewallRules: [{3E6D3200-C030-4B1E-A9F7-C836EEA93A18}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (Nvidia Corporation -> NVIDIA Corporation)
FirewallRules: [{48D94AC9-5B6D-4739-A399-36E3676C6D0F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{929B8F4E-113C-4172-AFD1-37657EDCB452}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [TCP Query User{E2B7179D-A990-4DE8-8405-6307A01D6330}C:\programdata\wargaming.net\gamecenter\wgc.exe] => (Allow) C:\programdata\wargaming.net\gamecenter\wgc.exe (Wargaming.net Limited -> Wargaming.net)
FirewallRules: [UDP Query User{2C00ABC1-3995-422A-86D9-891424345CA0}C:\programdata\wargaming.net\gamecenter\wgc.exe] => (Allow) C:\programdata\wargaming.net\gamecenter\wgc.exe (Wargaming.net Limited -> Wargaming.net)
FirewallRules: [TCP Query User{A24B5A11-98B7-491F-AB17-921BAA226EEF}C:\programdata\wargaming.net\gamecenter\wgc.exe] => (Allow) C:\programdata\wargaming.net\gamecenter\wgc.exe (Wargaming.net Limited -> Wargaming.net)
FirewallRules: [UDP Query User{27601B55-DB7F-4C0A-B863-77CD96F5AF95}C:\programdata\wargaming.net\gamecenter\wgc.exe] => (Allow) C:\programdata\wargaming.net\gamecenter\wgc.exe (Wargaming.net Limited -> Wargaming.net)
FirewallRules: [TCP Query User{ABE75D66-CB0F-442D-A290-0204A06CE1C2}C:\program files\lghub\lghub_agent.exe] => (Allow) C:\program files\lghub\lghub_agent.exe (Logitech Inc -> Logitech, Inc.)
FirewallRules: [UDP Query User{9BB6B9DF-3FC7-4748-9042-E38D2C3C61F8}C:\program files\lghub\lghub_agent.exe] => (Allow) C:\program files\lghub\lghub_agent.exe (Logitech Inc -> Logitech, Inc.)
FirewallRules: [{5F1CBAF9-2BCC-4195-84E2-BA8705BAE619}] => (Allow) C:\Program Files (x86)\PhraseExpress\PhraseExpress.exe (Bartels Media GmbH -> Bartels Media GmbH)
FirewallRules: [TCP Query User{32A84AD2-F0AF-4EF4-88E5-B17ED2C05D7A}D:\epic games\satisfactoryexperimental\satisfactory mod manager\satisfactory mod manager.exe] => (Allow) D:\epic games\satisfactoryexperimental\satisfactory mod manager\satisfactory mod manager.exe (mircearoata) [Datei ist nicht signiert]
FirewallRules: [UDP Query User{A3A59D16-25A9-4073-9DC3-D505144B09F7}D:\epic games\satisfactoryexperimental\satisfactory mod manager\satisfactory mod manager.exe] => (Allow) D:\epic games\satisfactoryexperimental\satisfactory mod manager\satisfactory mod manager.exe (mircearoata) [Datei ist nicht signiert]
FirewallRules: [TCP Query User{D6FD9FDD-2D9F-45B1-A5BF-76912794053B}D:\epic games\satisfactoryexperimental\engine\binaries\win64\factorygame-win64-shipping.exe] => (Allow) D:\epic games\satisfactoryexperimental\engine\binaries\win64\factorygame-win64-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [UDP Query User{0418044A-4863-410C-A1E2-56A01A293FE7}D:\epic games\satisfactoryexperimental\engine\binaries\win64\factorygame-win64-shipping.exe] => (Allow) D:\epic games\satisfactoryexperimental\engine\binaries\win64\factorygame-win64-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [TCP Query User{716D78FD-5D47-4AA9-8CFE-8EFA3F156F61}C:\program files (x86)\hlsw\hlsw.exe] => (Allow) C:\program files (x86)\hlsw\hlsw.exe (Stripf Software) [Datei ist nicht signiert]
FirewallRules: [UDP Query User{B62B6154-08B3-4830-A9C1-FC61EBD29B58}C:\program files (x86)\hlsw\hlsw.exe] => (Allow) C:\program files (x86)\hlsw\hlsw.exe (Stripf Software) [Datei ist nicht signiert]
FirewallRules: [TCP Query User{DE140EF7-1DF8-468E-8795-FEA8BDA159A8}C:\program files\lghub\lghub_agent.exe] => (Allow) C:\program files\lghub\lghub_agent.exe (Logitech Inc -> Logitech, Inc.)
FirewallRules: [UDP Query User{7548284D-0D6A-42A2-8C93-1AF775FCC071}C:\program files\lghub\lghub_agent.exe] => (Allow) C:\program files\lghub\lghub_agent.exe (Logitech Inc -> Logitech, Inc.)
FirewallRules: [TCP Query User{83ACDDB3-4CF8-4917-A0EB-D7DD1EFA8CDC}C:\program files (x86)\hlsw\hlsw.exe] => (Allow) C:\program files (x86)\hlsw\hlsw.exe (Stripf Software) [Datei ist nicht signiert]
FirewallRules: [UDP Query User{E3313233-00FC-4D2D-8D4C-D696BA3DECC4}C:\program files (x86)\hlsw\hlsw.exe] => (Allow) C:\program files (x86)\hlsw\hlsw.exe (Stripf Software) [Datei ist nicht signiert]
FirewallRules: [TCP Query User{594E00AE-75D4-4013-8794-A9198BCB582C}D:\epic games\satisfactoryexperimental\engine\binaries\win64\factorygame-win64-shipping.exe] => (Allow) D:\epic games\satisfactoryexperimental\engine\binaries\win64\factorygame-win64-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [UDP Query User{B63C655D-ACBB-4633-98C9-8B212888D0E6}D:\epic games\satisfactoryexperimental\engine\binaries\win64\factorygame-win64-shipping.exe] => (Allow) D:\epic games\satisfactoryexperimental\engine\binaries\win64\factorygame-win64-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{9C904093-AE7C-4FAE-9BC5-C8BE3F40702E}] => (Allow) D:\ubisoft\Ubisoft Game Launcher\games\Ghost Recon Breakpoint\GRB_BE.exe (BattlEye Innovations e.K. -> BattlEye Innovations)
FirewallRules: [{6FD05E2A-FAC2-4C63-A811-EA659D962C5B}] => (Allow) D:\ubisoft\Ubisoft Game Launcher\games\Ghost Recon Breakpoint\GRB_BE.exe (BattlEye Innovations e.K. -> BattlEye Innovations)
FirewallRules: [{60DFD2C7-E4AF-4255-80FC-DA5BB7D62881}] => (Allow) D:\ubisoft\Ubisoft Game Launcher\games\Tom Clancy's The Division 2\TheDivision2.exe (Ubisoft Entertainment Sweden AB -> Ubisoft)
FirewallRules: [{795BCFDE-A82B-4BD9-8935-43C0BC703338}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{7046F309-7FA9-4BBB-B8E3-E5A57FB767F3}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{F69E37D0-81BD-4E38-BBB5-F1703D270E87}D:\epic games\snowrunner\en_us\sources\bin\snowrunner.exe] => (Allow) D:\epic games\snowrunner\en_us\sources\bin\snowrunner.exe (Focus Home Interactive S.A -> Focus Home Interactive)
FirewallRules: [UDP Query User{6DA7EDE3-85B9-4C50-AE37-3BE50C12B795}D:\epic games\snowrunner\en_us\sources\bin\snowrunner.exe] => (Allow) D:\epic games\snowrunner\en_us\sources\bin\snowrunner.exe (Focus Home Interactive S.A -> Focus Home Interactive)
FirewallRules: [{9F437D49-89DA-46C3-ABF3-50BB46A6422C}] => (Allow) D:\Origin\AWayOut\Haze1\Binaries\Win64\AWayOut.exe (Hazelight Studios AB -> Hazelight Studios AB)
FirewallRules: [{44C6E650-7314-49FD-8702-6DCBAAE1AD82}] => (Allow) D:\Origin\AWayOut\Haze1\Binaries\Win64\AWayOut.exe (Hazelight Studios AB -> Hazelight Studios AB)
FirewallRules: [{BD64F905-6FC6-48AB-8540-0929858E19DD}] => (Allow) D:\Origin\AWayOut\Haze1\Binaries\Win64\AWayOut_friend.exe (Hazelight Studios AB -> Hazelight Studios AB)
FirewallRules: [{15060A47-DD45-4B4F-B530-BF553CAEA385}] => (Allow) D:\Origin\AWayOut\Haze1\Binaries\Win64\AWayOut_friend.exe (Hazelight Studios AB -> Hazelight Studios AB)
FirewallRules: [TCP Query User{33FF347B-17EA-4210-8BA1-E69C25E2AE88}C:\users\schdohni\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\schdohni\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [UDP Query User{DDAA56C1-B063-48EC-960D-E54D686C93FF}C:\users\schdohni\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\schdohni\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [TCP Query User{276AB7F5-16FE-4968-91AE-3617A58C3141}D:\minecraft\runtime\java-runtime-alpha\windows-x64\java-runtime-alpha\bin\javaw.exe] => (Allow) D:\minecraft\runtime\java-runtime-alpha\windows-x64\java-runtime-alpha\bin\javaw.exe
FirewallRules: [UDP Query User{FBF7E175-98A6-4234-97EC-98BAAC92EE3E}D:\minecraft\runtime\java-runtime-alpha\windows-x64\java-runtime-alpha\bin\javaw.exe] => (Allow) D:\minecraft\runtime\java-runtime-alpha\windows-x64\java-runtime-alpha\bin\javaw.exe
FirewallRules: [TCP Query User{8EF070AA-4F03-4EA1-A274-3620DE804975}C:\program files\java\jdk-16.0.2\bin\java.exe] => (Allow) C:\program files\java\jdk-16.0.2\bin\java.exe
FirewallRules: [UDP Query User{FBA36B08-0287-4C50-8BA9-A1C1DF774853}C:\program files\java\jdk-16.0.2\bin\java.exe] => (Allow) C:\program files\java\jdk-16.0.2\bin\java.exe
FirewallRules: [TCP Query User{517060E6-84FC-4CD2-9C9B-6FFF7ED87D6E}C:\users\schdohni\appdata\local\microsoft\teams\current\teams.exe] => (Allow) C:\users\schdohni\appdata\local\microsoft\teams\current\teams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [UDP Query User{D517F070-7268-404E-8EE3-A82664EF22BC}C:\users\schdohni\appdata\local\microsoft\teams\current\teams.exe] => (Allow) C:\users\schdohni\appdata\local\microsoft\teams\current\teams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{A1A8F05E-1325-4004-ACB9-E075748BAC3F}C:\riot games\riot client\riotclientservices.exe] => (Allow) C:\riot games\riot client\riotclientservices.exe (Riot Games, Inc. -> Riot Games, Inc.)
FirewallRules: [UDP Query User{932903C9-F455-45CE-981C-D9983FFB408B}C:\riot games\riot client\riotclientservices.exe] => (Allow) C:\riot games\riot client\riotclientservices.exe (Riot Games, Inc. -> Riot Games, Inc.)
FirewallRules: [TCP Query User{29750DA8-F698-4C98-BAF2-E9AB9151F99D}C:\users\schdohni\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\schdohni\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [UDP Query User{1CDF2137-23CF-439E-B031-36E6F7D0AF19}C:\users\schdohni\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\schdohni\appdata\roaming\spotify\spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [TCP Query User{BFF89029-EC7E-4CAE-93D6-387B7ADE8BDB}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [UDP Query User{6C221E6C-27F7-4B69-A8B0-2E5D965A3940}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{5B0ADFA5-0CD1-4892-9BAB-43E4A1923313}] => (Allow) C:\Users\schdohni\AppData\Roaming\Zoom\bin\Zoom.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)
FirewallRules: [{96687724-DE9A-40FE-AF8B-3C5E9D39CD45}] => (Allow) D:\ubisoft\Ubisoft Game Launcher\games\Anno 1800\Bin\Win64\Anno1800.exe (UBISOFT ENTERTAINMENT INC. -> Ubisoft) [Datei ist nicht signiert]
FirewallRules: [TCP Query User{76002A31-0661-4913-910A-3E3E0C74E14F}D:\epic games\satisfactoryearlyaccess\engine\binaries\win64\factorygame-win64-shipping.exe] => (Allow) D:\epic games\satisfactoryearlyaccess\engine\binaries\win64\factorygame-win64-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [UDP Query User{D12BB544-0F5F-4762-B082-36FF208F5E25}D:\epic games\satisfactoryearlyaccess\engine\binaries\win64\factorygame-win64-shipping.exe] => (Allow) D:\epic games\satisfactoryearlyaccess\engine\binaries\win64\factorygame-win64-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{88B810EF-6097-4C91-93F2-D007989B7BD6}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{90B5F95B-5F10-4F78-B3B0-748BB7514138}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{D43A66C2-20DE-4369-A6B8-9B0657EAF5DD}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{2F0FC524-F60B-462F-9662-3E4550D2C863}D:\blizzard\warcraft iii\_retail_\x86_64\warcraft iii.exe] => (Allow) D:\blizzard\warcraft iii\_retail_\x86_64\warcraft iii.exe (Blizzard Entertainment, Inc. -> Blizzard Entertainment, Inc)
FirewallRules: [UDP Query User{99074CCF-426C-4780-A2D8-B497BDA311FB}D:\blizzard\warcraft iii\_retail_\x86_64\warcraft iii.exe] => (Allow) D:\blizzard\warcraft iii\_retail_\x86_64\warcraft iii.exe (Blizzard Entertainment, Inc. -> Blizzard Entertainment, Inc)
FirewallRules: [TCP Query User{0BC8DFDF-C5CA-4DF7-BB94-B360C62F2B60}D:\minecraft\runtime\java-runtime-beta\windows-x64\java-runtime-beta\bin\javaw.exe] => (Allow) D:\minecraft\runtime\java-runtime-beta\windows-x64\java-runtime-beta\bin\javaw.exe
FirewallRules: [UDP Query User{F6E9437B-5AF8-4FC2-B688-A13F551935C6}D:\minecraft\runtime\java-runtime-beta\windows-x64\java-runtime-beta\bin\javaw.exe] => (Allow) D:\minecraft\runtime\java-runtime-beta\windows-x64\java-runtime-beta\bin\javaw.exe
FirewallRules: [TCP Query User{B9E27D5B-A5BE-441C-8EF1-93B0BE72CE4A}C:\users\schdohni\curseforge\minecraft\install\runtime\java-runtime-beta\windows-x64\java-runtime-beta\bin\javaw.exe] => (Allow) C:\users\schdohni\curseforge\minecraft\install\runtime\java-runtime-beta\windows-x64\java-runtime-beta\bin\javaw.exe
FirewallRules: [UDP Query User{7DC942BA-BE9C-47C7-8BD3-564BE8C792B9}C:\users\schdohni\curseforge\minecraft\install\runtime\java-runtime-beta\windows-x64\java-runtime-beta\bin\javaw.exe] => (Allow) C:\users\schdohni\curseforge\minecraft\install\runtime\java-runtime-beta\windows-x64\java-runtime-beta\bin\javaw.exe
FirewallRules: [TCP Query User{9C483060-3FE7-4102-84F3-7C2460C1C4A3}D:\epic games\launcher\engine\binaries\win64\epicwebhelper.exe] => (Allow) D:\epic games\launcher\engine\binaries\win64\epicwebhelper.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [UDP Query User{C442E8FA-B323-48A8-A04E-FF31A99331BA}D:\epic games\launcher\engine\binaries\win64\epicwebhelper.exe] => (Allow) D:\epic games\launcher\engine\binaries\win64\epicwebhelper.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [{F9DE4E3C-A701-49D3-97D6-5EFE4CC58C2B}] => (Allow) C:\Program Files (x86)\Sony\PS Remote Play\RemotePlay.exe (Sony Interactive Entertainment Inc. -> Sony Interactive Entertainment Inc.)
FirewallRules: [TCP Query User{2DB4FBA2-D023-41FB-B0BA-2E3BD5FD4A9F}D:\epic games\satisfactoryearlyaccess\engine\binaries\win64\factorygame-win64-shipping.exe] => (Allow) D:\epic games\satisfactoryearlyaccess\engine\binaries\win64\factorygame-win64-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [UDP Query User{85880FD2-FA25-4A47-9D49-A6908B257CB4}D:\epic games\satisfactoryearlyaccess\engine\binaries\win64\factorygame-win64-shipping.exe] => (Allow) D:\epic games\satisfactoryearlyaccess\engine\binaries\win64\factorygame-win64-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{60BACA20-5117-46CA-81FB-A0447BB99D96}] => (Allow) D:\Origin\Command and Conquer 3 TW and KW\CNC3Launcher.exe (Kalloc Studios, Inc. -> Kalloc Studios) [Datei ist nicht signiert]
FirewallRules: [{1AF59003-18C2-421A-9EB7-A50C5D282AC0}] => (Allow) D:\Origin\Command and Conquer 3 TW and KW\CNC3Launcher.exe (Kalloc Studios, Inc. -> Kalloc Studios) [Datei ist nicht signiert]
FirewallRules: [{A52B344B-B0E6-4CE0-9CD0-5E7A6CDB4F06}] => (Allow) D:\Origin\Command and Conquer Generals Zero Hour\Generals.exe (Kalloc Studios, Inc. -> Kalloc Studios) [Datei ist nicht signiert]
FirewallRules: [{404E2C01-4296-4184-8C8D-16AD070A9054}] => (Allow) D:\Origin\Command and Conquer Generals Zero Hour\Generals.exe (Kalloc Studios, Inc. -> Kalloc Studios) [Datei ist nicht signiert]
FirewallRules: [TCP Query User{223D36FF-E52D-43AE-9CBB-D7B313F421CB}D:\minecraft\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe] => (Allow) D:\minecraft\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe
FirewallRules: [UDP Query User{3599B7D7-F9C6-4F3E-A808-75CB1ACCE1A9}D:\minecraft\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe] => (Allow) D:\minecraft\runtime\java-runtime-gamma\windows-x64\java-runtime-gamma\bin\javaw.exe
FirewallRules: [TCP Query User{09DE41DB-44C5-4304-B7E2-AA356840FD4D}D:\origin\command and conquer generals zero hour\command and conquer generals zero hour\generals.exe] => (Allow) D:\origin\command and conquer generals zero hour\command and conquer generals zero hour\generals.exe (Kalloc Studios, Inc. -> ) [Datei ist nicht signiert]
FirewallRules: [UDP Query User{7FDA06E8-11AF-4CB7-8F6B-1028FC32D7BC}D:\origin\command and conquer generals zero hour\command and conquer generals zero hour\generals.exe] => (Allow) D:\origin\command and conquer generals zero hour\command and conquer generals zero hour\generals.exe (Kalloc Studios, Inc. -> ) [Datei ist nicht signiert]
FirewallRules: [{03B007B5-B0BF-4F33-BC41-58F5E6C26DAB}] => (Allow) D:\ubisoft\Ubisoft Game Launcher\games\Far Cry 4\bin\FarCry4.exe (Ubisoft Entertainment -> Ubisoft Entertainment)
FirewallRules: [{5EF2E258-09EA-4D4E-9298-DB1F70C3E1E5}] => (Allow) D:\ubisoft\Ubisoft Game Launcher\games\Far Cry 4\bin\FarCry4.exe (Ubisoft Entertainment -> Ubisoft Entertainment)
FirewallRules: [{D9764C66-0387-431F-A466-EBB778A5E5F3}] => (Allow) D:\ubisoft\Ubisoft Game Launcher\games\Far Cry 4\bin\FarCry4.exe (Ubisoft Entertainment -> Ubisoft Entertainment)
FirewallRules: [{02F8AB7F-51A6-4C5A-BC97-AB65BB8B0881}] => (Allow) D:\ubisoft\Ubisoft Game Launcher\games\Far Cry 4\bin\FarCry4.exe (Ubisoft Entertainment -> Ubisoft Entertainment)
FirewallRules: [{27FB0262-58DD-4DFB-97C3-32947E683034}] => (Allow) D:\ubisoft\Ubisoft Game Launcher\games\Far Cry 4\bin\IGE_WPF64.exe (UBISOFT ENTERTAINMENT INC. -> Ubisoft)
FirewallRules: [{6F2B3171-086B-42B1-9CD6-E0360924E0F4}] => (Allow) D:\ubisoft\Ubisoft Game Launcher\games\Far Cry 4\bin\IGE_WPF64.exe (UBISOFT ENTERTAINMENT INC. -> Ubisoft)
FirewallRules: [{788249AC-E0F5-4129-915E-65F80EBD4835}] => (Allow) D:\ubisoft\Ubisoft Game Launcher\games\Far Cry 4\bin\IGE_WPF64.exe (UBISOFT ENTERTAINMENT INC. -> Ubisoft)
FirewallRules: [{3B3291E7-9ECD-4816-977F-031BFAF82C3D}] => (Allow) D:\ubisoft\Ubisoft Game Launcher\games\Far Cry 4\bin\IGE_WPF64.exe (UBISOFT ENTERTAINMENT INC. -> Ubisoft)
FirewallRules: [{EDE1E7AA-6DC9-4940-8952-F5426440A76D}] => (Allow) C:\Program Files\TeamViewer\TeamViewer.exe (TeamViewer Germany GmbH -> TeamViewer Germany GmbH)
FirewallRules: [{5BB34784-3797-47DF-A684-4585630DA442}] => (Allow) C:\Program Files\TeamViewer\TeamViewer.exe (TeamViewer Germany GmbH -> TeamViewer Germany GmbH)
FirewallRules: [{A8BAA26D-A274-4874-A4D7-2E14C4DDEEFB}] => (Allow) C:\Program Files\TeamViewer\TeamViewer_Service.exe (TeamViewer Germany GmbH -> TeamViewer Germany GmbH)
FirewallRules: [{E8E12B4E-89EB-4CAB-AB8E-70C0E3B248DC}] => (Allow) C:\Program Files\TeamViewer\TeamViewer_Service.exe (TeamViewer Germany GmbH -> TeamViewer Germany GmbH)
FirewallRules: [{93814151-9362-4D8D-A0D5-F8A6AA334579}] => (Allow) D:\Origin\SimCity\SimCity\SimCity.exe (Electronic Arts -> Electronic Arts Inc.)
FirewallRules: [{499FBC87-9E5E-42DF-95BF-F2CE8B82BC67}] => (Allow) D:\Origin\SimCity\SimCity\SimCity.exe (Electronic Arts -> Electronic Arts Inc.)
FirewallRules: [{6AC4A5B8-47DC-4DDF-B5D6-EAE719527CA4}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (Nvidia Corporation -> NVIDIA Corporation)
FirewallRules: [{7621C409-495D-4CE0-A448-CCF74BC54073}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (Nvidia Corporation -> NVIDIA Corporation)
FirewallRules: [{E4114F72-01C0-4AD8-ACC8-1839B719E966}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (Nvidia Corporation -> NVIDIA Corporation)
FirewallRules: [{1351C962-5EF7-44F3-A55D-A70F1AE9E73B}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (Nvidia Corporation -> NVIDIA Corporation)
FirewallRules: [{9DFED71F-8BF1-46F1-B2B3-C5105F2460B7}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{0539D245-5034-4A3D-892B-1BF9C89EB647}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{ADE4C9D0-BB5D-4789-97EB-D2F9FC85CC8B}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{C6CFF9E8-FF18-4B6E-B2C0-222AD8429834}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{D836D136-879F-434A-8759-8D147C6C0756}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto V\PlayGTAV.exe (Rockstar Games, Inc. -> Rockstar Games)
FirewallRules: [{3505D851-70E6-416A-8A28-2F05DC3B7CE0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Grand Theft Auto V\PlayGTAV.exe (Rockstar Games, Inc. -> Rockstar Games)
FirewallRules: [TCP Query User{DE755121-D4B9-4167-B12F-A11AA22AFFD2}C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe (Rockstar Games, Inc. -> Rockstar Games)
FirewallRules: [UDP Query User{6AD74B64-ECF7-4B5B-9728-806DC6968FA9}C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\grand theft auto v\gta5.exe (Rockstar Games, Inc. -> Rockstar Games)
FirewallRules: [{DC8765D3-376C-40A0-9FC3-EB565FBCD0B2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Mini Motorways\Mini Motorways.exe () [Datei ist nicht signiert]
FirewallRules: [{4421D534-21D9-48C1-BDF7-A6449D6F87B4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Mini Motorways\Mini Motorways.exe () [Datei ist nicht signiert]
FirewallRules: [{72F738DA-5E57-4EDF-8A8B-7923DAAE360A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Destroy All Humans!\DH.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{B08F52DA-40D0-4BEE-B418-A5DF8C1FAC78}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Destroy All Humans!\DH.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{0B37156D-7068-4997-8AC2-E535B60F76CA}] => (Allow) C:\Program Files (x86)\Overwolf\0.204.0.1\OverwolfBrowser.exe => Keine Datei
FirewallRules: [{5C4B4517-0CC3-4A48-B197-6B690BB319BA}] => (Allow) C:\Program Files (x86)\Overwolf\0.204.0.1\OverwolfBrowser.exe => Keine Datei
FirewallRules: [{35F9081D-DBD4-4CC9-A86F-C2EA969A0155}] => (Block) C:\Program Files (x86)\Overwolf\0.204.0.1\OverwolfBrowser.exe => Keine Datei
FirewallRules: [{E823A47F-7E72-44C5-88D6-9B95AF727A9F}] => (Block) C:\Program Files (x86)\Overwolf\0.204.0.1\OverwolfBrowser.exe => Keine Datei
FirewallRules: [{7AF0167C-3E95-468E-B20E-FE3965DB2B2B}] => (Allow) C:\Program Files (x86)\Overwolf\0.204.2.2\OverwolfBrowser.exe (Overwolf Ltd -> Overwolf LTD)
FirewallRules: [{98964CF6-BF9B-4B6C-A15A-0DCEC3416C14}] => (Allow) C:\Program Files (x86)\Overwolf\0.204.2.2\OverwolfBrowser.exe (Overwolf Ltd -> Overwolf LTD)
FirewallRules: [{8BAE51FB-3093-4999-97A2-0B474487A731}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\7 Days To Die\7dLauncher.exe () [Datei ist nicht signiert]
FirewallRules: [{528A40A1-A407-431C-AB55-13ED22CB514A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\7 Days To Die\7dLauncher.exe () [Datei ist nicht signiert]
FirewallRules: [TCP Query User{A46B9386-E794-43E4-BA3F-56984E45EBF7}C:\program files (x86)\steam\steamapps\common\7 days to die\7daystodie.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\7 days to die\7daystodie.exe () [Datei ist nicht signiert]
FirewallRules: [UDP Query User{B5101E46-A78A-4BD0-9808-4A8B69622F02}C:\program files (x86)\steam\steamapps\common\7 days to die\7daystodie.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\7 days to die\7daystodie.exe () [Datei ist nicht signiert]
FirewallRules: [{D39695DC-D7B8-409E-8B7A-317655C86044}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.89.3403.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{E221FBDB-B05F-4D0A-9A83-FD5738EFAF5E}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.89.3403.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{8EAD3DD7-A6C0-4E57-B292-6D135A4A94FB}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.89.3403.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{B3E1E3B0-66EF-4A63-9240-FDCAE52672D5}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.89.3403.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{0B2D8B14-AA38-4257-987A-9B75C6EDBD1F}] => (Allow) D:\SteamLibrary\steamapps\common\Counter-Strike Global Offensive\csgo.exe (Valve Corp. -> )
FirewallRules: [{F98DFFC8-6FAA-4843-8EA1-3F8D0EAC86DC}] => (Allow) D:\SteamLibrary\steamapps\common\Counter-Strike Global Offensive\csgo.exe (Valve Corp. -> )
FirewallRules: [{FC11F0EC-C427-4C30-A98E-16A7D534A9ED}] => (Allow) D:\SteamLibrary\steamapps\common\Escape Simulator\Escape Simulator.exe () [Datei ist nicht signiert]
FirewallRules: [{BCF76D7D-4ACA-4902-B95E-D8AD7CDCA24B}] => (Allow) D:\SteamLibrary\steamapps\common\Escape Simulator\Escape Simulator.exe () [Datei ist nicht signiert]
FirewallRules: [{3BEC0F0E-9C7E-4E44-BCBE-C13F7A444B00}] => (Allow) D:\SteamLibrary\steamapps\common\Vampire Survivors\VampireSurvivors.exe (Luca Galante) [Datei ist nicht signiert]
FirewallRules: [{4320E6BD-87C0-4BC1-AD34-2393DFDFBB54}] => (Allow) D:\SteamLibrary\steamapps\common\Vampire Survivors\VampireSurvivors.exe (Luca Galante) [Datei ist nicht signiert]
FirewallRules: [{84C8CE71-2E80-4D71-BB41-145FD9B421AA}] => (Allow) D:\SteamLibrary\steamapps\common\Brotato\Brotato.exe (Thomas Gervraud) [Datei ist nicht signiert]
FirewallRules: [{EB7D36B5-83A0-4FBC-B024-6913A52820A4}] => (Allow) D:\SteamLibrary\steamapps\common\Brotato\Brotato.exe (Thomas Gervraud) [Datei ist nicht signiert]
FirewallRules: [{469F2A34-B52E-4063-8996-585BB73B4330}] => (Allow) D:\SteamLibrary\steamapps\common\Factorio\bin\x64\factorio.exe (Wube Software) [Datei ist nicht signiert]
FirewallRules: [{F3700817-AC5E-4025-B99E-E850B342825E}] => (Allow) D:\SteamLibrary\steamapps\common\Factorio\bin\x64\factorio.exe (Wube Software) [Datei ist nicht signiert]
FirewallRules: [{F5C96186-3D76-4D28-BCD0-0280240BCA20}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe (Dropbox, Inc -> Dropbox, Inc.)
FirewallRules: [{BAD7F682-E000-46BE-96BA-742C4F421783}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{97958EBB-0474-4B72-B12C-1CE5F8176E55}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\107.0.1418.35\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{C6D39D07-1B09-4CF7-AD78-160C203AC82A}] => (Allow) LPort=32682
FirewallRules: [{575CF0D1-AE09-4397-8C89-E580C8C3CE9C}] => (Allow) D:\SteamLibrary\steamapps\common\Cosmoteer\Bin\Cosmoteer.exe (Walternate Realities LLC -> Cosmoteer)
FirewallRules: [{7AAA5919-7517-48C7-86CD-3294352BE445}] => (Allow) D:\SteamLibrary\steamapps\common\Cosmoteer\Bin\Cosmoteer.exe (Walternate Realities LLC -> Cosmoteer)

==================== Wiederherstellungspunkte =========================

07-11-2022 12:50:37 Removed Java 8 Update 331 (64-bit)

==================== Fehlerhafte Geräte im Gerätemanager ============

Name: HP EWS
Description: HP EWS
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PS/2-Standardtastatur
Description: PS/2-Standardtastatur
Class Guid: {4d36e96b-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standardtastaturen)
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: Microsoft PS/2-Maus
Description: Microsoft PS/2-Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: G19 Gaming Keyboard (Display interface)
Description: G19 Gaming Keyboard (Display interface)
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Fehlereinträge in der Ereignisanzeige: ========================

Applikationsfehler:
==================
Error: (11/07/2022 12:52:31 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: endpointprotection.exe, Version: 1.0.2210.133, Zeitstempel: 0x635c67c6
Name des fehlerhaften Moduls: sentry.dll_unloaded, Version: 3.0.2210.21, Zeitstempel: 0x6344f2bc
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000b6127
ID des fehlerhaften Prozesses: 0x18e0
Startzeit der fehlerhaften Anwendung: 0x01d8f29760febccc
Pfad der fehlerhaften Anwendung: C:\Program Files\Avira\Endpoint Protection SDK\endpointprotection.exe
Pfad des fehlerhaften Moduls: sentry.dll
Berichtskennung: cec0ec12-f4a0-4a69-91dc-b73f667c31e7
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (11/07/2022 12:03:57 PM) (Source: Microsoft-Windows-Perflib) (EventID: 1023) (User: NT-AUTORITÄT)
Description: Windows kann die erweiterbare Leistungsindikator-DLL "C:\WINDOWS\system32\sysmain.dll" nicht laden (Win32-Fehlercode 126).

Error: (11/07/2022 11:58:43 AM) (Source: DbxSvc) (EventID: 281) (User: )
Description: CertFindCertificateInStore failed with: (-2146885628) Das Objekt oder die Eigenschaft wurde nicht gefunden.

Error: (11/07/2022 11:58:43 AM) (Source: DbxSvc) (EventID: 281) (User: )
Description: CertFindCertificateInStore failed with: (-2146885628) Das Objekt oder die Eigenschaft wurde nicht gefunden.

Error: (11/07/2022 11:58:43 AM) (Source: DbxSvc) (EventID: 322) (User: )
Description: Failed to get driver message: (-2147024890) Das Handle ist ungültig.

Error: (11/07/2022 11:58:43 AM) (Source: DbxSvc) (EventID: 281) (User: )
Description: CertFindCertificateInStore failed with: (-2146885628) Das Objekt oder die Eigenschaft wurde nicht gefunden.

Error: (11/07/2022 11:58:42 AM) (Source: DbxSvc) (EventID: 281) (User: )
Description: CertFindCertificateInStore failed with: (-2146885628) Das Objekt oder die Eigenschaft wurde nicht gefunden.

Error: (11/07/2022 11:58:29 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: mme.exe, Version: 1.8.0.0, Zeitstempel: 0x63664353
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 10.0.19041.2130, Zeitstempel: 0xb0fac6c9
Ausnahmecode: 0xe0434352
Fehleroffset: 0x000000000002cd29
ID des fehlerhaften Prozesses: 0xd04
Startzeit der fehlerhaften Anwendung: 0x01d8f297d9dd9ef9
Pfad der fehlerhaften Anwendung: C:\ProgramData\Epsonhp\mmi\mme.exe
Pfad des fehlerhaften Moduls: C:\WINDOWS\System32\KERNELBASE.dll
Berichtskennung: 277038db-553e-4f95-aca7-fe71ce878a26
Vollständiger Name des fehlerhaften Pakets: 
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:


Systemfehler:
=============
Error: (11/07/2022 02:09:15 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "DbxSvc" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.

Error: (11/07/2022 02:09:15 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "NVIDIA LocalSystem Container" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 6000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/07/2022 02:09:15 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Microsoft Office-Klick-und-Los-Dienst" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.

Error: (11/07/2022 02:09:15 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "NVIDIA Display Container LS" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 6000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/07/2022 02:09:15 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "LGHUB Updater Service" wurde unerwartet beendet. Dies ist bereits 3 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/07/2022 02:09:15 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "GameInput Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 1000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/07/2022 02:07:19 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Razer Chroma SDK Service" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (11/07/2022 02:07:19 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "DbxSvc" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.


Windows Defender:
================
Date: 2022-11-07 14:17:45
Description: 
Microsoft Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:MSIL/Artemis.NEA!MTB&threatid=2147832825&enterprise=0
Name: Trojan:MSIL/Artemis.NEA!MTB
Schweregrad: Schwerwiegend
Kategorie: Trojaner
Pfad: file:_C:\Users\schdohni\AppData\Roaming\Tfjxfz\Vaweceoo.exe; regkey:_HKCU@S-1-5-21-144240348-1158812916-3569957004-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\Vaweceoo; runkey:_HKCU@S-1-5-21-144240348-1158812916-3569957004-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\Vaweceoo
Erkennungsursprung: Lokaler Computer
Erkennungstype: Konkret
Erkennungsquelle: System
Benutzer: NT-AUTORITÄT\SYSTEM
Prozessname: Unknown
Sicherheitsversion: AV: 1.377.1436.0, AS: 1.377.1436.0, NIS: 1.377.1436.0
Modulversion: AM: 1.1.19700.3, NIS: 1.1.19700.3

Date: 2022-10-01 20:10:16
Description: 
Microsoft Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:Win32/Wacatac.H!ml&threatid=2147814523&enterprise=0
Name: Trojan:Win32/Wacatac.H!ml
Schweregrad: Schwerwiegend
Kategorie: Trojaner
Pfad: process:_pid:17516,ProcessStart:133091213583417855
Erkennungsursprung: Unbekannt
Erkennungstype: FastPath
Erkennungsquelle: System
Benutzer: NT-AUTORITÄT\SYSTEM
Prozessname: C:\Users\schdohni\AppData\Roaming\Tfjxfz\Vaweceoo.exe
Sicherheitsversion: AV: 1.375.1331.0, AS: 1.375.1331.0, NIS: 1.375.1331.0
Modulversion: AM: 1.1.19600.3, NIS: 1.1.19600.3

Date: 2022-09-24 07:47:00
Description: 
Microsoft Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDownloader:MSIL/RedLineStealer.KL!MTB&threatid=2147831486&enterprise=0
Name: TrojanDownloader:MSIL/RedLineStealer.KL!MTB
Schweregrad: Schwerwiegend
Kategorie: Downloadtrojaner
Pfad: amsi:_\Device\HarddiskVolume6\Users\schdohni\AppData\Local\Temp\Data02\svc.exe
Erkennungsursprung: Unbekannt
Erkennungstype: Konkret
Erkennungsquelle: AMSI
Benutzer: SCHDOHNI\schdohni
Prozessname: C:\Users\schdohni\AppData\Local\Temp\Data02\svc.exe
Sicherheitsversion: AV: 1.375.854.0, AS: 1.375.854.0, NIS: 1.375.854.0
Modulversion: AM: 1.1.19600.3, NIS: 1.1.19600.3

Date: 2022-09-20 18:51:46
Description: 
Die Microsoft Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {45E74064-A675-43D6-B0DA-D634D5BA9DBA}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT-AUTORITÄT\SYSTEM

Date: 2022-09-20 15:02:28
Description: 
Die Microsoft Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {83A16A50-4C64-40DD-8372-DB0D6E1184B9}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT-AUTORITÄT\SYSTEM

CodeIntegrity:
===============
Date: 2022-11-07 14:15:29
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume6\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.4-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume6\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2022-11-07 12:52:31
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume6\Windows\System32\aepic.dll because the set of per-page image hashes could not be found on the system.

Date: 2022-11-07 11:58:51
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Mozilla Firefox\firefox.exe) attempted to load \Device\HarddiskVolume6\Program Files\Mozilla Firefox\mozavcodec.dll that did not meet the Microsoft signing level requirements.

Date: 2022-11-07 11:58:51
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume6\Program Files\Mozilla Firefox\firefox.exe) attempted to load \Device\HarddiskVolume6\Program Files\Mozilla Firefox\mozavutil.dll that did not meet the Microsoft signing level requirements.

Date: 2022-11-07 11:57:02
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume6\Program Files\Avira\Endpoint Protection SDK\amsi\x64\avamsi.dll because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Speicherinformationen =========================== 

BIOS: American Megatrends Inc. A.60 12/15/2020
Hauptplatine: Micro-Star International Co., Ltd. MEG Z490 UNIFY (MS-7C71)
Prozessor: Intel(R) Core(TM) i7-10700K CPU @ 3.80GHz
Prozentuale Nutzung des RAM: 21%
Installierter physikalischer RAM: 32688.29 MB
Verfügbarer physikalischer RAM: 25699.19 MB
Summe virtueller Speicher: 37552.29 MB
Verfügbarer virtueller Speicher: 28302.94 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:930.42 GB) (Free:457.75 GB) (Model: Samsung SSD 970 EVO Plus 1TB) NTFS
Drive d: (Brain) (Fixed) (Total:1863.02 GB) (Free:1135.23 GB) (Model: Samsung SSD 970 EVO Plus 2TB) NTFS
Drive e: (Mind) (Fixed) (Total:1863.01 GB) (Free:1663.06 GB) (Model: ST2000DM001-9YN164) NTFS
Drive f: (Download) (Fixed) (Total:1863.01 GB) (Free:1030.54 GB) (Model: ST2000DM001-9YN164) NTFS
Drive y: (XXX) (Fixed) (Total:9313.97 GB) (Free:7539.32 GB) (Model: WD Elements 25A3 USB Device) NTFS

\\?\Volume{7f402591-bd71-443f-95c6-829a19212e99}\ (Wiederherstellung) (Fixed) (Total:0.44 GB) (Free:0.43 GB) NTFS
\\?\Volume{01a03bbe-a72a-4e8d-b998-d11a47cd4a46}\ () (Fixed) (Total:0.54 GB) (Free:0.08 GB) NTFS
\\?\Volume{9ac2bdb1-8751-4bcc-b288-77feefdb58ef}\ () (Fixed) (Total:0.09 GB) (Free:0.07 GB) FAT32

==================== MBR & Partitionstabelle ====================

==========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: 73F55819)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

==========================================================
Disk: 1 (Size: 1863 GB) (Disk ID: A0AF2BB2)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

==========================================================
Disk: 2 (Protective MBR) (Size: 931.5 GB) (Disk ID: 00000000)

Partition: GPT.

==========================================================
Disk: 3 (Protective MBR) (Size: 1863 GB) (Disk ID: 00000000)

Partition: GPT.

==========================================================
Disk: 4 (Size: 9314 GB) (Disk ID: 16F2A91F)

Partition: GPT.

==================== Ende von Addition.txt =======================

schdohni · 07.11.2022, 16:38

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 06-11-2022
durchgeführt von schdohni (Administrator) auf SCHDOHNI (Micro-Star International Co., Ltd. MS-7C71) (07-11-2022 16:32:09)
Gestartet von C:\Users\schdohni\Downloads
Geladene Profile: schdohni
Plattform: Microsoft Windows 10 Pro Version 21H2 19044.2130 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: FF
Start-Modus: Normal

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(C:\Program Files\LGHUB\lghub_agent.exe ->) (Logitech Inc -> Logitech, Inc.) C:\Program Files\LGHUB\logi_crashpad_handler.exe <2>
(C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe ->) (Nvidia Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe <3>
(C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe ->) (Nvidia Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe
(C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.4-0\MsMpEng.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.4-0\MpCopyAccelerator.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.152\GoogleCrashHandler64.exe
(Logitech Inc -> Logitech, Inc.) C:\Program Files\LGHUB\lghub_agent.exe
(Malwarebytes Inc. -> Malwarebytes) C:\Users\schdohni\Downloads\adwcleaner.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <9>
(Nvidia Corporation -> Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(services.exe ->) (Logitech Inc -> Logitech, Inc.) C:\Program Files\LGHUB\lghub_updater.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft GameInput\x64\gameinputsvc.exe <2>
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.GamingServices_7.70.13002.0_x64__8wekyb3d8bbwe\gamingservices.exe
(services.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.GamingServices_7.70.13002.0_x64__8wekyb3d8bbwe\gamingservicesnet.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.4-0\MsMpEng.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.4-0\NisSrv.exe
(services.exe ->) (Nvidia Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <3>
(services.exe ->) (Nvidia Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_47917a79b8c7fd22\Display.NvContainer\NVDisplay.Container.exe <2>
(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzChromaStreamServer.exe
(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKServer.exe
(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe
(svchost.exe ->) (Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(svchost.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2103.8.0_x64__8wekyb3d8bbwe\Calculator.exe
(svchost.exe ->) (Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.YourPhone_1.22082.119.0_x64__8wekyb3d8bbwe\PhoneExperienceHost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_3dd75df32535321a\RtkAudUService64.exe [1361000 2021-09-27] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [Riot Vanguard] => C:\Program Files\Riot Vanguard\vgtray.exe [3071192 2022-08-30] (Riot Games, Inc. -> Riot Games, Inc.)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [11209952 2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
HKLM-x32\...\Run: [TeamsMachineInstaller] => C:\Program Files (x86)\Teams Installer\Teams.exe [109324536 2021-03-12] (Microsoft Corporation -> Microsoft Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [RazerCortex] => C:\Program Files (x86)\Razer\Razer Cortex\RazerCortex.exe [543736 2022-10-08] (Razer USA Ltd. -> Razer Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [7039464 2022-05-18] (LogMeIn, Inc. -> LogMeIn Inc.)
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [2630016 2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [Wargaming.net Game Center] => C:\ProgramData\Wargaming.net\GameCenter\wgc.exe [2158912 2022-09-20] (Wargaming.net Limited -> Wargaming.net)
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [LGHUB] => C:\Program Files\LGHUB\lghub.exe [152025856 2022-10-26] (Logitech Inc -> Logitech, Inc.)
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [Discord] => C:\Users\schdohni\AppData\Local\Discord\Update.exe [1512616 2022-02-17] (Discord Inc. -> GitHub)
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [Synapse3] => C:\Program Files (x86)\Razer\Synapse3\WPFUI\Framework\Razer Synapse 3 Host\Razer Synapse 3.exe [3538440 2022-10-06] (Razer USA Ltd. -> Razer Inc.)
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [PlariumPlay] => C:\Users\schdohni\AppData\Local\Plarium\PlariumPlay\PlariumPlay --args -run-with-os (Keine Datei)
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1802584 2022-09-22] (Overwolf Ltd -> Overwolf Ltd.)
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [FACEIT] => C:\Users\schdohni\AppData\Local\FACEIT\update.exe [2277496 2021-06-25] (FACE IT LIMITED -> )
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [] => [X]
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [com.squirrel.Teams.Teams] => C:\Users\schdohni\AppData\Local\Microsoft\Teams\Update.exe [2454184 2021-06-15] (Microsoft 3rd Party Application Component -> Microsoft Corporation)
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [Spotify] => C:\Users\schdohni\AppData\Roaming\Spotify\Spotify.exe [19268536 2022-05-31] (Spotify AB -> Spotify Ltd)
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [MicrosoftEdgeAutoLaunch_40630843975B47C797D06FD044331A1D] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 [3891624 2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [4234088 2022-10-19] (Valve Corp. -> Valve Corporation)
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Winlogon: [Shell] explorer.exe,"C:\ProgramData\Panasonic\nnu.exe,C:\ProgramData\Adobe\udp.exe,C:\ProgramData\Sharp\onn.exe,C:\ProgramData\Epsonhp\mmi\mme.exe,C:\ProgramData\Sun\Omg\dwm.exe" <==== ACHTUNG
HKU\S-1-5-18\...\Run: [Synapse3] => C:\Program Files (x86)\Razer\Synapse3\WPFUI\Framework\Razer Synapse 3 Host\Razer Synapse 3.exe [3538440 2022-10-06] (Razer USA Ltd. -> Razer Inc.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\107.0.5304.88\Installer\chrmstp.exe [2022-11-02] (Google LLC -> Google LLC)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PhraseExpress.lnk [2021-05-02]
ShortcutTarget: PhraseExpress.lnk -> C:\Program Files (x86)\PhraseExpress\phraseexpress.exe (Bartels Media GmbH -> Bartels Media GmbH)
GroupPolicy: Beschränkung ? <==== ACHTUNG
GroupPolicy-Firefox: Beschränkung <==== ACHTUNG
Policies: C:\ProgramData\NTUSER.pol: Beschränkung <==== ACHTUNG

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {01FB95FD-D8C9-495F-BDBF-9A9CD8EB6B08} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [8576000 2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {052E19D3-B87A-410A-BBBE-7F8560FB8CC5} - System32\Tasks\NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1654272 2022-03-30] (Nvidia Corporation -> NVIDIA Corporation)
Task: {0A94A861-5C13-4B8B-9800-CD9E02396B57} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154456 2021-05-01] (Google LLC -> Google LLC)
Task: {0DC7899E-2D89-4391-AC01-078B2627CB26} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4166528 2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
Task: {11F77134-B065-44B9-B376-F09062B7AF38} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [8576000 2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {19243180-E748-400C-8B6B-B6200E970D23} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {1CF36CC6-6EE1-4E09-BECF-AF2D76A9685A} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.4-0\MpCmdRun.exe [1567336 2022-11-07] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {247A8B37-ABE6-4E9B-8159-5379DB948225} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-144240348-1158812916-3569957004-1001 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4166528 2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
Task: {292488B1-95AC-4508-81AD-DEFAE78C7ECC} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.4-0\MpCmdRun.exe [1567336 2022-11-07] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {2FDD5F54-7E63-43DD-A8A7-A50729BC8CF1} - System32\Tasks\MSI Task Host - MSI.True Color => C:\Program Files (x86)\MSI\One Dragon Center\True Color\MSI.True Color.exe [47416 2021-03-29] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.)
Task: {47839B9E-6258-4BC7-A210-128DDA862F4B} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [3342080 2022-03-30] (Nvidia Corporation -> NVIDIA Corporation)
Task: {4D1C7C1C-CD06-40D8-A7BF-67C4F0A259FB} - System32\Tasks\RazerCortexScheduleClean => C:\Program Files (x86)\Razer\Razer Cortex\RazerCortex.exe [543736 2022-10-08] (Razer USA Ltd. -> Razer Inc.)
Task: {4DB1DF86-8215-494A-87C0-D631909B25AA} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [26154960 2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {4E21F346-B80D-4D39-B9AD-7F20CC8DD645} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [1003128 2022-03-01] (Nvidia Corporation -> NVIDIA Corporation) -> -d "C:\Program Files\NVIDIA Corporation\NvDriverUpdateCheck" -l 3 -f C:\ProgramData\NVIDIA\NvContainerDriverUpdateCheck.log
Task: {5C60797B-D0FE-4AB5-803A-76248CC57452} - System32\Tasks\MSI Task Host - LEDKeeper2_Host => C:\Program Files (x86)\MSI\One Dragon Center\Mystic_Light\LEDKeeper2.exe [1712976 2021-07-16] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.)
Task: {5E749CE0-9B6D-405F-82B6-C6D95AF57C2A} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.4-0\MpCmdRun.exe [1567336 2022-11-07] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {64ADE185-F2AB-4BA9-B6E0-96DFFDD4D424} - System32\Tasks\Microsoft\Office\Office Serviceability Manager => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\officesvcmgr.exe [3834520 2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {6900F14A-0045-4BA0-A671-B0896C6F623A} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.4-0\MpCmdRun.exe [1567336 2022-11-07] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {73D98472-BD66-4A79-90F9-2329142D846D} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [144312 2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {7632AE2D-4321-4453-AB16-D27D2AAF3952} - System32\Tasks\NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1654272 2022-03-30] (Nvidia Corporation -> NVIDIA Corporation)
Task: {786664AB-DA85-4246-8D47-3F4C2792FB06} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [906752 2022-03-30] (Nvidia Corporation -> NVIDIA Corporation)
Task: {7FA379CC-56C0-4B6C-A345-E49C1366CAF6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154456 2021-05-01] (Google LLC -> Google LLC)
Task: {8E4621CC-7882-4D6F-8BF7-080B11BE5D2C} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe [2577752 2022-09-22] (Overwolf Ltd -> Overwolf LTD)
Task: {925EC42D-BC90-4304-A1A8-6B2090E30260} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\operfmon.exe [66936 2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {A1C1B099-2CB9-476B-AC99-96A817038135} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [144312 2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {A2C47E81-F6B2-4B77-BBC6-7EB8376A9D49} - System32\Tasks\NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1654272 2022-03-30] (Nvidia Corporation -> NVIDIA Corporation)
Task: {B658A6AB-417A-43B1-8FF9-00C0FA945E57} - System32\Tasks\NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1654272 2022-03-30] (Nvidia Corporation -> NVIDIA Corporation)
Task: {CCF43E81-AC21-476C-A5CA-5974A217A5A5} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [906752 2022-03-30] (Nvidia Corporation -> NVIDIA Corporation)
Task: {DC9B1162-4268-476B-A6EC-F1F39959D943} - System32\Tasks\MSI Task Host - Detect_Monitor => C:\Program Files (x86)\MSI\One Dragon Center\MSI.NotifyServer.exe [78648 2021-04-01] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.)
Task: {E0BFE5F0-491B-4310-862C-CF0805845BCD} - System32\Tasks\MSI Task Host - DisplayID => C:\Program Files (x86)\MSI\One Dragon Center\MSI.NotifyServer.exe [78648 2021-04-01] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.)
Task: {E664D8C7-756D-40D5-BAB0-1DFB046B70DF} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [646344 2022-03-30] (Nvidia Corporation -> NVIDIA Corporation)
Task: {E9CB72BE-7F79-4C69-9A2C-0F6D21E3A4A0} - System32\Tasks\Intel PTT EK Recertification => C:\WINDOWS\System32\DriverStore\FileRepository\iclsclient.inf_amd64_76523213b78d9046\lib\IntelPTTEKRecertification.exe [818008 2021-09-15] (Intel Corporation -> Intel(R) Corporation)
Task: {EB3FE529-F48E-4C94-A89E-9F4AF4A55DCD} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [26154960 2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {ED1C0D26-74BE-47F5-95F0-6EEE6FFAADFA} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [130320 2021-11-10] (Dropbox, Inc -> Dropbox, Inc.)
Task: {F37006D5-23DB-493C-A27C-643D15CF10F9} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [130320 2021-11-10] (Dropbox, Inc -> Dropbox, Inc.)
Task: {F4D76FCF-123A-4173-93D1-24435E60E10A} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe do-task "308046B0AF4A39CB"

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3: <==== ACHTUNG (Beschränkung - Zones)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{1d4b000c-5d1a-42d5-97e6-39ae2dec5aeb}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{76d346b4-8414-4abc-8bf4-2f765bdd1843}: [DhcpNameServer] 192.168.0.1

Edge: 
=======
Edge Profile: C:\Users\schdohni\AppData\Local\Microsoft\Edge\User Data\Default [2022-11-07]

FireFox:
========
FF DefaultProfile: q3dnqrki.default
FF ProfilePath: C:\Users\schdohni\AppData\Roaming\Mozilla\Firefox\Profiles\q3dnqrki.default [2021-08-07]
FF Extension: (Avira Browser Safety) - C:\Users\schdohni\AppData\Roaming\Mozilla\Firefox\Profiles\q3dnqrki.default\Extensions\abs@avira.com [2021-01-30]
FF ProfilePath: C:\Users\schdohni\AppData\Roaming\Mozilla\Firefox\Profiles\q8q3vpbg.default-release [2022-11-07]
FF Homepage: Mozilla\Firefox\Profiles\q8q3vpbg.default-release -> www.google.de
FF Notifications: Mozilla\Firefox\Profiles\q8q3vpbg.default-release -> hxxps://www.lieferando.de; hxxps://login.schulmanager-online.de
FF Extension: (ProxTube) - C:\Users\schdohni\AppData\Roaming\Mozilla\Firefox\Profiles\q8q3vpbg.default-release\Extensions\ich@maltegoetz.de.xpi [2021-05-13]
FF Extension: (WEB.DE MailCheck) - C:\Users\schdohni\AppData\Roaming\Mozilla\Firefox\Profiles\q8q3vpbg.default-release\Extensions\toolbar@web.de.xpi [2022-07-01]
FF Extension: (uBlock Origin) - C:\Users\schdohni\AppData\Roaming\Mozilla\Firefox\Profiles\q8q3vpbg.default-release\Extensions\uBlock0@raymondhill.net.xpi [2022-09-20]
FF Extension: (99Stalker) - C:\Users\schdohni\AppData\Roaming\Mozilla\Firefox\Profiles\q8q3vpbg.default-release\Extensions\{021225af-c052-4ea6-a128-f94f10cf1148}.xpi [2022-08-30]
FF Extension: (Flash- und Video-Download) - C:\Users\schdohni\AppData\Roaming\Mozilla\Firefox\Profiles\q8q3vpbg.default-release\Extensions\{18685d90-c845-4a82-999f-fbba0e8aca3b}.xpi [2021-09-18]
FF Extension: (Clippings) - C:\Users\schdohni\AppData\Roaming\Mozilla\Firefox\Profiles\q8q3vpbg.default-release\Extensions\{91aa5abe-9de4-4347-b7b5-322c38dd9271}.xpi [2022-09-19]
FF Extension: (Video DownloadHelper) - C:\Users\schdohni\AppData\Roaming\Mozilla\Firefox\Profiles\q8q3vpbg.default-release\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2021-07-01]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=3.0.12 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2021-01-04] (VideoLAN -> VideoLAN)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2022-11-04] (Microsoft Corporation -> Microsoft Corporation)

Chrome: 
=======
CHR Profile: C:\Users\schdohni\AppData\Local\Google\Chrome\User Data\Default [2022-11-07]
CHR StartupUrls: Default -> "hxxps://www.twitch.tv/directory/following"
CHR Extension: (Google Übersetzer) - C:\Users\schdohni\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2022-03-10]
CHR Extension: (BetterTTV) - C:\Users\schdohni\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2022-10-02]
CHR Extension: (Ban Checker for Steam) - C:\Users\schdohni\AppData\Local\Google\Chrome\User Data\Default\Extensions\canbadmphamemnmdfngmcabnjmjgaiki [2022-05-23]
CHR Extension: (BlockSite: Websites blockieren & Konzentriert bleiben) - C:\Users\schdohni\AppData\Local\Google\Chrome\User Data\Default\Extensions\eiimnmioipafcokbfikbljfdeojpcgbh [2022-10-19]
CHR Extension: (Google Docs Offline) - C:\Users\schdohni\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2022-08-25]
CHR Extension: (AdBlock*– der beste Ad-Blocker) - C:\Users\schdohni\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2022-10-29]
CHR Extension: (flashkill) - C:\Users\schdohni\AppData\Local\Google\Chrome\User Data\Default\Extensions\haodokcagfamodepjecmfemicdkdcekk [2022-08-12]
CHR Extension: (Web Safety) - C:\Users\schdohni\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfhcmdonhekjhfbjmeacdjbhlfgpjabp [2021-08-07]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\schdohni\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-05-01]
CHR HKLM-x32\...\Chrome\Extension: [mfhcmdonhekjhfbjmeacdjbhlfgpjabp]

==================== Dienste (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S4 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [8923096 2022-07-23] (BattlEye Innovations e.K. -> )
S4 cFosSpeedS; C:\Program Files\cFosSpeed\spd.exe [611592 2021-06-07] (cFos Software GmbH -> cFos Software GmbH)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [12516280 2022-11-04] (Microsoft Corporation -> Microsoft Corporation)
S2 CortexLauncherService; C:\Program Files (x86)\Razer\Razer Cortex\CortexLauncherService.exe [588200 2022-10-08] (Razer USA Ltd. -> Razer Inc.)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [130320 2021-11-10] (Dropbox, Inc -> Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [130320 2021-11-10] (Dropbox, Inc -> Dropbox, Inc.)
S2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [46824 2022-10-28] (Dropbox, Inc -> Dropbox, Inc.)
S4 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [803440 2021-06-07] (EasyAntiCheat Oy -> EasyAntiCheat Ltd)
S3 EasyAntiCheat_EOS; C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.exe [584680 2022-10-12] (EasyAntiCheat Oy -> Epic Games, Inc.)
S3 EpicOnlineServices; C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe [934352 2022-07-11] (Epic Games Inc. -> Epic Games, Inc.)
S4 FACEITService; C:\Program Files\FACEIT AC\faceitservice.exe [25595848 2021-06-11] (FACE IT LIMITED -> )
S3 FileSyncHelper; C:\Program Files\Microsoft OneDrive\22.212.1009.0004\FileSyncHelper.exe [3475328 2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
S4 Hamachi2Svc; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [3848680 2022-05-18] (LogMeIn, Inc. -> LogMeIn Inc.)
R2 LGHUBUpdaterService; C:\Program Files\LGHUB\lghub_updater.exe [10097408 2022-10-26] (Logitech Inc -> Logitech, Inc.)
S4 LightKeeperService; C:\Program Files (x86)\MSI\One Dragon Center\Mystic_Light\LightKeeperService.exe [86776 2020-12-23] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star INT'L CO., LTD.)
S4 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [419248 2016-05-27] (LogMeIn, Inc. -> LogMeIn, Inc.)
S2 MSI Foundation Service; C:\Program Files (x86)\MSI\One Dragon Center\Game_Summary\FoundationService\MSIAPService.exe [75216 2020-09-23] (Micro-Star International CO., LTD. -> Micro-Star International Co., Ltd.)
S2 MSI_Central_Service; C:\Program Files (x86)\MSI\One Dragon Center\MSI_Central_Service.exe [147088 2020-07-10] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.)
S2 MSI_Companion_Service; C:\Program Files (x86)\MSI\One Dragon Center\Game_Summary\MSI_Companion_Service.exe [143160 2021-03-31] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star INT'L CO., LTD.)
S2 MSI_VoiceControl_Service; C:\Program Files (x86)\MSI\One Dragon Center\VoiceControl\VoiceControl_Service.exe [36152 2021-06-07] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star INT'L CO., LTD.)
S4 Mystic_Light_Service; C:\Program Files (x86)\MSI\One Dragon Center\Mystic_Light\Mystic_Light_Service.exe [39760 2021-05-11] (MICRO-STAR INTERNATIONAL CO., LTD. -> Micro-Star Int'l Co., Ltd.)
S3 OfficeSvcManagerAddons; C:\WINDOWS\system32\dllhost.exe /Processid:{2CA2E202-932F-4BA2-8771-195BB86398F5} [21312 2020-11-19] (Microsoft Windows -> Microsoft Corporation)
S3 OneDrive Updater Service; C:\Program Files\Microsoft OneDrive\22.212.1009.0004\OneDriveUpdaterService.exe [3840896 2022-11-03] (Microsoft Corporation -> Microsoft Corporation)
S4 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2579272 2022-08-09] (Electronic Arts, Inc. -> Electronic Arts)
S4 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3497808 2022-08-09] (Electronic Arts, Inc. -> Electronic Arts)
S4 OverwolfUpdater; C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe [2577752 2022-09-22] (Overwolf Ltd -> Overwolf LTD)
S4 Plarium Play Client Service; C:\Users\schdohni\AppData\Local\Plarium\PlariumPlay\6.9.0-0.0.0\PlariumPlayClientService\PlariumPlayClientService.exe [98936 2021-12-30] (Plarium Global Ltd -> )
R2 Razer Chroma SDK Server; C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKServer.exe [2032040 2022-09-27] (Razer USA Ltd. -> Razer Inc.)
R2 Razer Chroma SDK Service; C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe [480176 2022-09-19] (Razer USA Ltd. -> Razer Inc.)
R2 Razer Chroma Stream Server; C:\Program Files (x86)\Razer Chroma SDK\bin\RzChromaStreamServer.exe [1354232 2022-06-15] (Razer USA Ltd. -> Razer Inc.)
S2 Razer Game Manager Service; C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe [254224 2021-11-16] (Razer USA Ltd. -> Razer Inc)
S2 Razer Game Manager Service 3; C:\Program Files (x86)\Razer\Razer Services\GMS3\GameManagerService3.exe [362760 2022-09-21] (Razer USA Ltd. -> Razer Inc)
S2 Razer Synapse Service; C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe [300552 2022-10-05] (Razer USA Ltd. -> Razer Inc.)
S3 Rockstar Service; C:\Program Files\Rockstar Games\Launcher\RockstarService.exe [2072408 2022-10-12] (Rockstar Games, Inc. -> Rockstar Games)
S2 RzActionSvc; C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe [537912 2022-08-12] (Razer USA Ltd. -> Razer Inc.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [224192 2022-09-13] (Microsoft Windows Publisher -> Microsoft Corporation)
S4 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [16187368 2022-05-11] (TeamViewer Germany GmbH -> TeamViewer Germany GmbH)
S4 vgc; C:\Program Files\Riot Vanguard\vgc.exe [10420944 2022-08-30] (Riot Games, Inc. -> Riot Games, Inc.)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.4-0\NisSrv.exe [3191224 2022-11-07] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2210.4-0\MsMpEng.exe [133536 2022-11-07] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_47917a79b8c7fd22\Display.NvContainer\NVDisplay.Container.exe -s NVDisplay.ContainerLocalSystem -f %ProgramData%\NVIDIA\NVDisplay.ContainerLocalSystem.log -l 3 -d C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_47917a79b8c7fd22\Display.NvContainer\plugins\LocalSystem -r -p 30000 -cfg NVDisplay.ContainerLocalSystem\LocalSystem

===================== Treiber (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R1 cFosSpeed; C:\WINDOWS\system32\DRIVERS\cfosspeed6.sys [1767224 2021-06-07] (cFos Software GmbH -> cFos Software GmbH)
R1 CTIIO; C:\WINDOWS\system32\drivers\CtiIo64.sys [17944 2021-10-12] (Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Innovation Co., LTd.)
R1 EneTechIo; C:\Windows\system32\drivers\ene.sys [20992 2020-05-12] (Microsoft Windows Hardware Compatibility Publisher -> )
R0 FACEIT; C:\WINDOWS\System32\Drivers\FACEIT.sys [11293168 2021-06-13] (FACE IT LIMITED -> )
S3 Hamachi; C:\WINDOWS\system32\DRIVERS\Hamdrv.sys [45680 2022-05-18] (Microsoft Windows Hardware Compatibility Publisher -> LogMeIn Inc.)
R3 logi_audio_surround; C:\WINDOWS\system32\drivers\logi_audio_surround.sys [52536 2022-09-08] (Logitech Inc -> Logitech)
R3 logi_joy_bus_enum; C:\WINDOWS\system32\drivers\logi_joy_bus_enum.sys [44880 2022-09-22] (Logitech Inc -> Logitech)
R3 logi_joy_vir_hid; C:\WINDOWS\system32\drivers\logi_joy_vir_hid.sys [32080 2022-09-22] (Logitech Inc -> Logitech)
R3 logi_joy_xlcore; C:\WINDOWS\system32\drivers\logi_joy_xlcore.sys [73040 2022-09-22] (Logitech Inc -> Logitech)
R3 MpKsl42f8c0d0; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3D8D8899-37F6-439C-8A85-3D1F16AD76FA}\MpKslDrv.sys [228632 2022-11-07] (Microsoft Windows -> Microsoft Corporation)
R1 MSIO; C:\Windows\system32\drivers\MsIo64.sys [17424 2020-01-19] (Microsoft Windows Hardware Compatibility Publisher -> MICSYS Technology Co., LTd)
R3 NTIOLib_CC_COMM; C:\Program Files (x86)\MSI\One Dragon Center\Lib\SYS\NTIOLib_X64.sys [14288 2017-07-10] (MICRO-STAR INTERNATIONAL CO., LTD. -> MSI)
R3 NTIOLib_MysticLight; C:\Program Files (x86)\MSI\One Dragon Center\Mystic_Light\Lib\NTIOLib_X64.sys [14288 2017-07-11] (MICRO-STAR INTERNATIONAL CO., LTD. -> MSI)
R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [48552 2021-11-01] (Microsoft Windows Hardware Compatibility Publisher -> NVIDIA Corporation)
R3 RzCommon; C:\WINDOWS\System32\drivers\RzCommon.sys [55128 2021-06-10] (Razer USA Ltd. -> Razer Inc)
S3 RzDev_022b; C:\WINDOWS\System32\drivers\RzDev_022b.sys [56152 2021-03-22] (Razer USA Ltd. -> Razer Inc)
R3 RzDev_0244; C:\WINDOWS\System32\drivers\RzDev_0244.sys [61272 2021-03-30] (Razer USA Ltd. -> Razer Inc)
S1 vgk; C:\Program Files\Riot Vanguard\vgk.sys [8736232 2022-08-30] (Riot Games, Inc. -> Riot Games, Inc.)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [49616 2022-11-07] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [469280 2022-11-07] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [95520 2022-11-07] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2022-11-07 13:58 - 2022-11-07 14:00 - 000000000 ____D C:\AdwCleaner
2022-11-07 13:58 - 2022-11-07 13:58 - 008791352 _____ (Malwarebytes) C:\Users\schdohni\Downloads\adwcleaner.exe
2022-11-07 13:36 - 2022-11-07 13:36 - 003171725 _____ C:\Users\schdohni\Downloads\191114FbZ490_PARD (7).pdf
2022-11-07 12:54 - 2022-11-07 12:54 - 000000000 ____D C:\WINDOWS\system32\Tasks\Avira
2022-11-07 12:05 - 2022-11-07 12:07 - 000082900 _____ C:\Users\schdohni\Downloads\Addition.txt
2022-11-07 12:03 - 2022-11-07 16:32 - 000034341 _____ C:\Users\schdohni\Downloads\FRST.txt
2022-11-07 12:03 - 2022-11-07 16:32 - 000000000 ____D C:\FRST
2022-11-07 12:03 - 2022-11-07 12:03 - 002374656 _____ (Farbar) C:\Users\schdohni\Downloads\FRST64.exe
2022-11-07 07:15 - 2022-11-07 07:15 - 000043023 _____ C:\Users\schdohni\Downloads\Entschuldigungsformular 07.11.22.pdf
2022-11-07 07:14 - 2022-11-07 07:14 - 000042878 _____ C:\Users\schdohni\Downloads\Entschuldigungsformular 27.10.22.pdf
2022-11-05 18:24 - 2019-02-13 15:33 - 000000000 ____D C:\ProgramData\Epsonhp
2022-11-05 18:01 - 2022-11-05 18:01 - 005012816 _____ C:\Users\schdohni\Downloads\EOS_0002e01166564b9ca6ec378834b931a3.zip
2022-11-05 18:01 - 2022-11-05 17:58 - 034078736 _____ C:\Users\schdohni\Downloads\EOS_0002e01166564b9ca6ec378834b931a3.map
2022-11-05 18:01 - 2022-11-05 17:58 - 000027494 _____ C:\Users\schdohni\Downloads\EOS_0002e01166564b9ca6ec378834b931a3.ttp.bak
2022-11-05 18:01 - 2022-11-05 17:58 - 000027494 _____ C:\Users\schdohni\Downloads\EOS_0002e01166564b9ca6ec378834b931a3.ttp
2022-11-05 11:30 - 2022-11-05 11:30 - 000112700 _____ C:\Users\schdohni\Downloads\1-263.webp
2022-11-04 22:13 - 2022-11-04 22:13 - 020525271 _____ C:\Users\schdohni\Downloads\M8PRO manual.pdf
2022-11-02 07:27 - 2022-11-02 07:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2022-10-31 16:18 - 2022-10-31 16:18 - 000000000 ____D C:\Users\schdohni\AppData\LocalLow\miHoYo
2022-10-31 16:01 - 2022-10-31 19:04 - 000000000 ____D C:\Program Files\Genshin Impact
2022-10-31 16:01 - 2022-10-31 16:01 - 124097752 _____ (HoYoverse) C:\Users\schdohni\Downloads\GenshinImpact_install_20221018235802.exe
2022-10-31 16:01 - 2022-10-31 16:01 - 000000000 ____D C:\Users\schdohni\AppData\Local\HoYoverse
2022-10-31 16:01 - 2022-10-31 16:01 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Genshin Impact
2022-10-28 20:54 - 2022-10-28 20:55 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\paradox-launcher-v2
2022-10-28 20:54 - 2022-10-28 20:54 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\Paradox Interactive
2022-10-28 20:54 - 2022-10-28 20:54 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Paradox Interactive
2022-10-28 20:54 - 2022-10-28 20:54 - 000000000 ____D C:\Users\schdohni\AppData\Local\Paradox Interactive
2022-10-28 10:29 - 2022-10-28 10:29 - 000405950 _____ C:\Users\schdohni\Downloads\944498_2f959b81-81b7-44d6-9b87-306a46aab36c.jpeg
2022-10-28 07:42 - 2022-10-28 07:42 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-stable.sys
2022-10-28 07:42 - 2022-10-28 07:42 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-dev.sys
2022-10-28 07:42 - 2022-10-28 07:42 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx-canary.sys
2022-10-28 07:42 - 2022-10-28 07:42 - 000047600 _____ (Dropbox, Inc.) C:\WINDOWS\system32\Drivers\dbx.sys
2022-10-28 07:42 - 2022-10-28 07:42 - 000046824 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2022-10-27 23:14 - 2022-10-27 23:14 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\Brotato
2022-10-26 12:51 - 2022-10-26 13:11 - 000000000 ____D C:\ESD
2022-10-26 12:48 - 2022-10-26 12:48 - 000000000 ___HD C:\$Windows.~WS
2022-10-26 12:48 - 2022-10-26 12:48 - 000000000 ____D C:\$WINDOWS.~BT
2022-10-26 12:08 - 2022-10-26 12:09 - 000000000 ____D C:\Program Files\LGHUB
2022-10-26 12:08 - 2022-10-26 12:08 - 000000650 _____ C:\Users\Public\Desktop\Logitech G HUB.lnk
2022-10-26 12:08 - 2022-10-26 12:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logi
2022-10-26 06:23 - 2022-10-26 06:23 - 000000000 ____D C:\Program Files (x86)\Windows Kits
2022-10-26 06:23 - 2022-10-26 06:23 - 000000000 ____D C:\Program Files (x86)\Microsoft GameInput
2022-10-23 21:54 - 2022-10-30 18:06 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\Vampire_Survivors
2022-10-23 21:54 - 2022-10-23 21:54 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\Vampire_Survivors_Data
2022-10-23 21:54 - 2022-10-23 21:54 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\Vampire_Survivors_156366524
2022-10-23 13:46 - 2022-10-23 13:46 - 000042880 _____ C:\Users\schdohni\Downloads\Entschuldigungsformular 21.10.22-1.pdf
2022-10-21 22:25 - 2022-10-21 22:25 - 000739595 _____ C:\Users\schdohni\Downloads\WizardTower-20221021T212501Z-001.zip
2022-10-21 07:11 - 2022-10-21 07:11 - 000042880 _____ C:\Users\schdohni\Downloads\Entschuldigungsformular 21.10.22.pdf
2022-10-20 12:39 - 2022-10-20 12:39 - 000002216 _____ C:\Users\schdohni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Firefox Privater Modus.lnk
2022-10-20 06:39 - 2022-10-20 06:39 - 000042815 _____ C:\Users\schdohni\Downloads\Entschuldigungsformular 20.10.22.pdf
2022-10-19 16:51 - 2022-10-19 17:05 - 000016378 _____ C:\Users\schdohni\Downloads\Amazon Vendor Programm Produktliste 2022- OHNE ZF.xlsx
2022-10-18 15:43 - 2022-10-18 19:05 - 000021374 _____ C:\Users\schdohni\Downloads\Amazon Vendor Programm Produktliste 2022-.xlsx
2022-10-18 06:38 - 2022-10-18 06:38 - 000013353 _____ C:\Users\schdohni\Downloads\Vector Garantie 2022 (1).xlsx
2022-10-13 10:48 - 2022-10-13 10:48 - 000189704 _____ C:\Users\schdohni\Downloads\CJ.pdf
2022-10-13 10:47 - 2022-10-13 10:49 - 000189176 _____ C:\Users\schdohni\Downloads\Theresa.pdf
2022-10-13 10:45 - 2022-10-13 10:45 - 000190003 _____ C:\Users\schdohni\Downloads\christoph.pdf
2022-10-12 13:40 - 2022-10-12 13:40 - 000095828 _____ C:\Users\schdohni\Downloads\Liste schussbarer Waffen mit Picatinny Schiene.pdf
2022-10-12 11:58 - 2022-10-12 16:52 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\7DaysToDie
2022-10-12 11:58 - 2022-10-12 11:58 - 000000000 ____D C:\Users\schdohni\AppData\LocalLow\The Fun Pimps
2022-10-12 11:51 - 2022-10-12 11:55 - 4231101458 _____ C:\Users\schdohni\Downloads\DarknessFallsA20.zip
2022-10-12 06:59 - 2022-10-12 06:59 - 002260480 _____ C:\WINDOWS\system32\TextInputMethodFormatter.dll
2022-10-12 06:59 - 2022-10-12 06:59 - 001333760 _____ C:\WINDOWS\SysWOW64\TextInputMethodFormatter.dll
2022-10-12 06:59 - 2022-10-12 06:59 - 000288768 _____ C:\WINDOWS\system32\Windows.Management.InprocObjects.dll
2022-10-12 06:59 - 2022-10-12 06:59 - 000060928 _____ C:\WINDOWS\system32\runexehelper.exe
2022-10-12 06:59 - 2022-10-12 06:59 - 000048640 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2022-10-12 06:59 - 2022-10-12 06:59 - 000039936 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2022-10-12 06:59 - 2022-10-12 06:59 - 000012253 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2022-10-12 06:55 - 2022-10-12 06:55 - 000000000 ___HD C:\$WinREAgent

==================== Ein Monat (geänderte) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2022-11-07 16:31 - 2021-05-05 06:50 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\Tangysoft
2022-11-07 16:31 - 2021-05-03 22:00 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\vlc
2022-11-07 16:30 - 2021-05-01 19:06 - 000000000 ____D C:\Users\schdohni\AppData\Local\LGHUB
2022-11-07 16:28 - 2019-12-07 10:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2022-11-07 16:21 - 2021-05-01 20:06 - 000000000 ____D C:\Program Files (x86)\Google
2022-11-07 16:21 - 2020-11-18 23:50 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2022-11-07 14:18 - 2022-09-24 06:22 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\Tfjxfz
2022-11-07 14:09 - 2021-01-30 16:17 - 000000000 ____D C:\ProgramData\NVIDIA
2022-11-07 14:09 - 2021-01-30 12:27 - 000000000 ____D C:\Users\schdohni\AppData\LocalLow\Mozilla
2022-11-07 14:00 - 2021-08-07 19:13 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\Lavasoft
2022-11-07 14:00 - 2021-08-07 19:13 - 000000000 ____D C:\Users\schdohni\AppData\Local\Lavasoft
2022-11-07 14:00 - 2021-08-07 19:13 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2022-11-07 14:00 - 2021-08-07 19:13 - 000000000 ____D C:\Program Files (x86)\Lavasoft
2022-11-07 14:00 - 2021-08-07 19:12 - 000000000 ____D C:\ProgramData\Lavasoft
2022-11-07 14:00 - 2021-05-01 19:06 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\LGHUB
2022-11-07 13:59 - 2022-09-23 12:39 - 000000000 ____D C:\Program Files (x86)\Steam
2022-11-07 13:59 - 2021-05-03 18:56 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\WhatsApp
2022-11-07 13:02 - 2020-11-19 00:51 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2022-11-07 12:54 - 2021-01-30 12:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2022-11-07 12:54 - 2021-01-30 12:34 - 000000000 ____D C:\ProgramData\Avira
2022-11-07 12:54 - 2021-01-30 12:34 - 000000000 ____D C:\Program Files (x86)\Avira
2022-11-07 12:52 - 2022-10-01 19:08 - 007638432 _____ C:\WINDOWS\system32\rtp.db
2022-11-07 12:52 - 2019-12-07 10:14 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2022-11-07 12:50 - 2021-08-07 19:54 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2022-11-07 12:50 - 2021-08-07 19:45 - 000000000 ____D C:\Program Files\Java
2022-11-07 12:47 - 2022-06-22 13:40 - 000003968 _____ C:\WINDOWS\system32\Tasks\RazerCortexScheduleClean
2022-11-07 12:02 - 2021-01-30 19:48 - 001713042 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2022-11-07 12:02 - 2019-12-07 15:51 - 000739414 _____ C:\WINDOWS\system32\perfh007.dat
2022-11-07 12:02 - 2019-12-07 15:51 - 000149046 _____ C:\WINDOWS\system32\perfc007.dat
2022-11-07 12:02 - 2019-12-07 10:13 - 000000000 ____D C:\WINDOWS\INF
2022-11-07 11:58 - 2022-06-08 19:21 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\DropboxElectron
2022-11-07 11:58 - 2021-06-09 14:40 - 000000000 ____D C:\Users\schdohni\AppData\Local\Dropbox
2022-11-07 11:58 - 2021-05-17 13:11 - 000000000 ____D C:\Users\schdohni\AppData\Local\CrashDumps
2022-11-07 11:55 - 2022-09-24 06:21 - 000000000 ____D C:\ProgramData\Panasonic
2022-11-07 11:54 - 2021-01-30 19:39 - 000008192 ___SH C:\DumpStack.log.tmp
2022-11-07 11:54 - 2020-11-19 00:51 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2022-11-07 11:54 - 2019-12-07 10:03 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2022-11-07 11:47 - 2022-09-07 06:21 - 000000000 ____D C:\Program Files\Mozilla Firefox
2022-11-07 11:47 - 2022-08-24 06:28 - 000000000 ____D C:\Program Files\Mozilla Thunderbird
2022-11-07 11:47 - 2021-06-24 18:38 - 000000000 ____D C:\Program Files\Microsoft OneDrive
2022-11-07 11:47 - 2021-01-30 12:27 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2022-11-07 11:37 - 2019-12-07 10:14 - 000000000 ___HD C:\Program Files\WindowsApps
2022-11-07 11:37 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2022-11-07 07:46 - 2022-02-08 23:23 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2022-11-07 01:03 - 2021-05-01 18:58 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\TS3Client
2022-11-06 12:44 - 2022-04-28 20:37 - 000000000 ____D C:\Users\schdohni\AppData\Local\WhatsApp
2022-11-05 23:00 - 2022-02-26 12:22 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\Spotify
2022-11-05 23:00 - 2022-02-26 12:22 - 000000000 ____D C:\Users\schdohni\AppData\Local\Spotify
2022-11-05 17:51 - 2020-11-19 00:53 - 000002436 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2022-11-05 17:51 - 2020-11-19 00:53 - 000002274 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk
2022-11-05 16:34 - 2022-01-13 08:16 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2022-11-05 16:34 - 2021-01-30 12:27 - 000001005 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2022-11-05 14:22 - 2021-05-02 17:04 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\discord
2022-11-05 14:18 - 2022-02-19 16:05 - 000000000 ____D C:\Users\schdohni\AppData\Local\Discord
2022-11-05 07:59 - 2021-09-24 13:42 - 000000000 ____D C:\Users\Public\Security Sessions
2022-11-04 20:02 - 2021-05-07 02:34 - 000000000 ____D C:\Users\schdohni\dwhelper
2022-11-04 13:06 - 2022-09-24 06:21 - 000000000 ____D C:\ProgramData\Adobe
2022-11-04 07:22 - 2021-06-09 14:53 - 000000000 ____D C:\Program Files\Microsoft Office
2022-11-03 15:42 - 2021-06-09 14:56 - 000003194 _____ C:\WINDOWS\system32\Tasks\OneDrive Per-Machine Standalone Update Task
2022-11-03 15:42 - 2021-06-09 14:56 - 000002148 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2022-11-02 18:09 - 2021-05-01 20:06 - 000002239 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2022-11-02 18:09 - 2021-05-01 20:06 - 000002198 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2022-11-02 07:27 - 2021-06-09 14:40 - 000000000 ____D C:\Program Files (x86)\Dropbox
2022-11-01 15:14 - 2019-12-07 10:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2022-10-31 16:21 - 2021-02-07 00:39 - 000000000 ____D C:\Users\schdohni\AppData\Local\D3DSCache
2022-10-30 20:36 - 2021-01-30 12:16 - 000000000 ____D C:\ProgramData\Package Cache
2022-10-30 20:34 - 2022-09-20 14:13 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2022-10-30 15:29 - 2021-02-03 15:31 - 000000000 ____D C:\Users\schdohni\OneDrive\Dokumente\PhraseExpress
2022-10-29 11:28 - 2021-02-04 00:08 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\Factorio
2022-10-28 20:54 - 2021-01-30 16:17 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2022-10-26 13:11 - 2021-01-30 19:20 - 000000000 ___DC C:\WINDOWS\Panther
2022-10-26 06:23 - 2022-05-22 09:27 - 002815456 _____ (Microsoft Corporation) C:\WINDOWS\system32\xgameruntime.dll
2022-10-26 06:23 - 2022-05-22 09:27 - 000452048 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameplatformservices.dll
2022-10-26 06:23 - 2022-05-22 09:27 - 000243168 _____ (Microsoft Corporation) C:\WINDOWS\system32\gamingservicesproxy.dll
2022-10-26 06:23 - 2022-05-22 09:27 - 000198096 _____ (Microsoft Corporation) C:\WINDOWS\system32\gameconfighelper.dll
2022-10-26 06:23 - 2022-05-22 09:27 - 000153048 _____ (Microsoft Corporation) C:\WINDOWS\system32\gamelaunchhelper.dll
2022-10-26 06:23 - 2022-05-22 09:27 - 000131072 _____ (Microsoft Corporation) C:\WINDOWS\system32\gamingtcuihelpers.dll
2022-10-24 13:09 - 2021-06-09 14:42 - 000000000 ___RD C:\Users\schdohni\RC-Profis Dropbox
2022-10-19 16:51 - 2021-01-25 16:30 - 000000000 ____D C:\Users\schdohni\AppData\Local\Packages
2022-10-12 16:52 - 2021-06-07 19:45 - 000000000 ____D C:\Users\schdohni\AppData\Roaming\EasyAntiCheat
2022-10-12 10:53 - 2022-07-08 06:05 - 000001157 _____ C:\Users\Public\Desktop\Razer Cortex.lnk
2022-10-12 10:53 - 2022-06-22 13:40 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer Cortex
2022-10-12 10:53 - 2021-02-07 22:06 - 000000000 ____D C:\Users\schdohni\AppData\Local\Razer
2022-10-12 10:53 - 2021-02-07 22:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
2022-10-12 10:52 - 2021-05-01 16:59 - 000000000 ____D C:\Program Files (x86)\Razer Chroma SDK
2022-10-12 07:50 - 2020-11-18 23:50 - 000638648 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2022-10-12 07:49 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2022-10-12 07:49 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SystemResources
2022-10-12 07:49 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2022-10-12 07:49 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2022-10-12 07:49 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\Dism
2022-10-12 07:48 - 2019-12-07 15:54 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2022-10-12 07:48 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\Provisioning
2022-10-12 07:48 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2022-10-12 07:48 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2022-10-12 07:01 - 2019-12-07 10:15 - 000208384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msclmd.dll
2022-10-12 07:01 - 2019-12-07 10:14 - 000232448 _____ (Microsoft Corporation) C:\WINDOWS\system32\msclmd.dll
2022-10-12 07:01 - 2019-12-07 10:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2022-10-12 06:59 - 2020-11-19 00:53 - 003015168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2022-10-12 06:55 - 2021-01-30 12:22 - 000000000 ____D C:\WINDOWS\system32\MRT
2022-10-12 06:53 - 2021-01-30 12:22 - 147398024 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2022-10-12 06:09 - 2020-11-19 00:53 - 000003756 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2022-10-12 06:09 - 2020-11-19 00:53 - 000003632 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2022-10-12 03:39 - 2022-06-07 19:36 - 000316920 _____ (Microsoft Corporation) C:\WINDOWS\system32\GameInputRedist.dll
2022-10-12 01:55 - 2022-06-07 19:36 - 000199672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GameInputRedist.dll
2022-10-09 16:15 - 2021-05-20 21:25 - 000000000 ____D C:\Program Files (x86)\Overwolf

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========

2021-05-05 20:31 - 2021-12-11 16:52 - 000210775 _____ () C:\Users\schdohni\AppData\Local\PlariumPlay.log
2021-05-15 15:52 - 2021-09-05 22:33 - 000007603 _____ () C:\Users\schdohni\AppData\Local\Resmon.ResmonCfg

==================== SigCheck ============================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

==================== Ende von FRST.txt ========================

M-K-D-B · 07.11.2022, 17:32

Ich übernehme ab hier.

Zitat:

Zitat von schdohni

Welche Bedrohung ist das, könnt ihr mir bei der Beseitung helfen und warum ist nichts in der Quarantäne?

Avira hat die Malware nicht erkannt (daher konnte auch nichts in die Quarantäne verschoben werden), sondern nur einen unerlaubten Zugriff blockiert.
Wir können dir helfen.

Der Windows Defender ist ja schon eingeschritten und hat einen Teil der Malware eliminiert:

Code:

ATTFilter

https://go.microsoft.com/fwlink/?linkid=37020&name=Trojan:MSIL/Artemis.NEA!MTB&threatid=2147832825&enterprise=0
Name: Trojan:MSIL/Artemis.NEA!MTB
Schweregrad: Schwerwiegend
Kategorie: Trojaner
Pfad: file:_C:\Users\schdohni\AppData\Roaming\Tfjxfz\Vaweceoo.exe; regkey:_HKCU@S-1-5-21-144240348-1158812916-3569957004-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\Vaweceoo; runkey:_HKCU@S-1-5-21-144240348-1158812916-3569957004-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\\Vaweceoo

Aber es gibt noch einiges zu tun.

Bitte erst die gesamte Anleitung lesen, bevor du loslegst!

Schritt 1
WARNUNG AN ALLE MITLESER !!!
Dieses FRST-Script ist ausschließlich für diesen Nutzer gedacht und sollte niemals 1:1 für ein anderes System verwendet werden!

Speichere deine Arbeiten und schließe alle offenen Programme, damit keine Daten verloren gehen.

Kopiere den gesamten Inhalt der folgenden Code-Box:

Code:

ATTFilter

Start::
SystemRestore: On 
CreateRestorePoint:
CloseProcesses:

VirusTotal: C:\ProgramData\Panasonic\nnu.exe;C:\ProgramData\Adobe\udp.exe;C:\ProgramData\Sharp\onn.exe
VirusTotal: C:\ProgramData\Epsonhp\mmi\mme.exe;C:\ProgramData\Sun\Omg\dwm.exe
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Winlogon: [Shell] explorer.exe,"C:\ProgramData\Panasonic\nnu.exe,C:\ProgramData\Adobe\udp.exe,C:\ProgramData\Sharp\onn.exe,C:\ProgramData\Epsonhp\mmi\mme.exe,C:\ProgramData\Sun\Omg\dwm.exe" <==== ACHTUNG
C:\ProgramData\Panasonic\nnu.exe
C:\ProgramData\Adobe\udp.exe
C:\ProgramData\Sharp\onn.exe
C:\ProgramData\Epsonhp\mmi\mme.exe
C:\ProgramData\Sun\Omg\dwm.exe
Folder: C:\ProgramData\Panasonic
Folder: C:\ProgramData\Adobe
Folder: C:\ProgramData\Sharp
Folder: C:\ProgramData\Epsonhp
Folder: C:\ProgramData\Sun
CMD: dir "C:\ProgramData"

HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [Vaweceoo] => C:\Users\schdohni\AppData\Roaming\Tfjxfz\Vaweceoo.exe [314633728 2022-09-23] (Google LLC) [Datei ist nicht signiert]
Folder: C:\Users\schdohni\AppData\Roaming\Tfjxfz
CMD: dir "C:\Users\schdohni\AppData\Roaming"

Unlock: HKCU\SOFTWARE\E830AF50B2B0417819725010A63A71B5
CMD: reg query "HKCU\SOFTWARE\E830AF50B2B0417819725010A63A71B5" /S

HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [PlariumPlay] => C:\Users\schdohni\AppData\Local\Plarium\PlariumPlay\PlariumPlay --args -run-with-os (Keine Datei)
HKU\S-1-5-21-144240348-1158812916-3569957004-1001\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Beschränkung <==== ACHTUNG
GroupPolicy: Beschränkung ? <==== ACHTUNG
GroupPolicy-Firefox: Beschränkung <==== ACHTUNG
Policies: C:\ProgramData\NTUSER.pol: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3: <==== ACHTUNG (Beschränkung - Zones)
FF Extension: (Avira Browser Safety) - C:\Users\schdohni\AppData\Roaming\Mozilla\Firefox\Profiles\q3dnqrki.default\Extensions\abs@avira.com [2021-01-30]
C:\Program Files (x86)\Lavasoft
C:\ProgramData\Application Data\Lavasoft
C:\ProgramData\Lavasoft
C:\Users\AllUserName\AppData\Local\Lavasoft
C:\Users\AllUserName\AppData\Roaming\Lavasoft
DeleteKey: HKCU\Software\Lavasoft
DeleteKey: HKLM\Software\Wow6432Node\Lavasoft
2022-11-07 12:54 - 2021-01-30 12:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2022-11-07 12:54 - 2021-01-30 12:34 - 000000000 ____D C:\ProgramData\Avira
2022-11-07 12:54 - 2021-01-30 12:34 - 000000000 ____D C:\Program Files (x86)\Avira
C:\Users\AllUserName\AppData\Local\Avira
C:\Users\AllUserName\AppData\Roaming\Avira
ContextMenuHandlers2: [ContextMenu] -> {ee10d625-cc60-30a4-b3df-4b349785be6b} => C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Antivirus.ContextMenu.DLL -> Keine Datei
ContextMenuHandlers3: [ContextMenu] -> {ee10d625-cc60-30a4-b3df-4b349785be6b} => C:\Program Files (x86)\Avira\Security\Antivirus.ContextMenu\Antivirus.ContextMenu.DLL -> Keine Datei
AlternateDataStreams: C:\ProgramData\UpdateLock-D78BF5DD33499EC2:A4C50C4FA2 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FACEIT AC.lnk:550995E265 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk:980850BA8A [3442]

startpowershell:
Function Remove-all-windefend-excludes {
$Paths=(Get-MpPreference).ExclusionPath
$Extensions=(Get-MpPreference).ExclusionExtension
$Processes=(Get-MpPreference).ExclusionProcess
foreach ($Path in $Paths) { Remove-MpPreference -ExclusionPath $Path -force}
foreach ($Extension in $Extensions) { Remove-MpPreference -ExclusionExtension $Extension -force}
foreach ($Process in $Processes) { Remove-MpPreference -ExclusionProcess $Process -force}
}
Set-MpPreference -DisableAutoExclusions $true -Force
Remove-all-windefend-excludes
endpowershell:
CMD: netsh winsock reset
CMD: netsh int ip reset
CMD: ipconfig /flushdns
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh winhttp reset proxy
CMD: Bitsadmin /Reset /Allusers
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
Hosts:
RemoveProxy:
EmptyTemp:
End::

Starte nun FRST und klicke direkt auf den Button Reparieren.
Wichtig: Du brauchst den Inhalt der Code-Box nirgends einfügen, da sich FRST den Code aus der Zwischenablage holt!

Wichtig:
- Bitte gedulde dich, sobald du die Reparatur gestartet hast. Je nach Art und Umfang der notwendigen Reparaturen kann dies einige Minuten dauern.
  Eventuell erhältst du während der Reparatur auch die Information "keine Rückmeldung" von FRST. Das ist normal, du musst nichts weiter tun, nur warten.
- Mit diesem Fix werden alle temporären Dateien/Browserdaten sowie der Papierkorb gelöscht.
Das Tool führt die gewünschten Schritte aus und erstellt eine fixlog.txt im selben Verzeichnis, in dem sich FRST befindet.
Gegebenenfalls muss dein Rechner neu gestartet werden.
Poste mir den Inhalt der fixlog.txt mit deiner nächsten Antwort.

Schritt 2

Starte FRST erneut und klicke auf Untersuchen.
FRST erstellt nun zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort:

die Logdatei des FRST-Fix (fixlog.txt)
die beiden neuen Logdateien von FRST (FRST.txt und Addition.txt)

schdohni · 07.11.2022, 17:40

Hallo M-K-D-B,

vielen Dank, allerdings bleibe ich schon am Anfang stecken, wenn ich den Button Reparieren nutzen möchte, kommt folgende Meldung:

"fixlist.txt wurde nicht gefunden.

Die fixlist.txt muss sich im gleichen Ordner/Verzeichnis wie das programm befinden."

M-K-D-B · 07.11.2022, 17:44

Zitat:

Zitat von schdohni

"fixlist.txt wurde nicht gefunden.

Die fixlist.txt muss sich im gleichen Ordner/Verzeichnis wie das programm befinden."

Hast du wirklich den gesamten Inhalt der Code-Box markiert und dann kopiert (STRG + C)?
Wirklich alles? Inklusive der Zeilen Start:: und End:: ?
Das ist sehr wichtig.

schdohni · 07.11.2022, 20:00

Hallo,

Problem hat sich kurz nach meinem Post behoben, anscheinend wollte mein Rechner STRG+C nicht nehmen, aber mit rechtsklick kopieren ging es. Da die Aktion aber den Browser geschlossen hat und ich diesen wärend dem Vorgang nicht wieder öffnen wollte, konnte ich nicht Bescheid geben.

nun habe ich allerdings ein anderes Problem, die Seite möchte mir den Code nicht annehmen.

Wer lesen kann ist klar im Vorteil, mein Text ist mit 1,2 Millionen Zeichen wohl zu lang. Diesen nun aber in lauter Teile mit 120000 Zeichen aufzuteilen ist auch nicht unkompliziert, anscheinend ist die Möglichkeit des Uploads einer Datei aber auch nicht mehr gegeben.

M-K-D-B · 07.11.2022, 20:30

Ein Upload ist möglich.

Rechtsklick auf die fixlog.txt > Senden an > Zip-komprimierter Ordner.
Die Zip Datei kannst du dann im nächsten Post als Anhang hochladen.

schdohni · 07.11.2022, 21:21

Eben da liegt das Problem, bei meinem ersten Post hier im Thread hatte ich hier über dem Textfenster noch um einiges mehr Buttons, unter anderem eines um Anhänge hoch zu laden bei dem sich das Fenster dafür öffnete.
Jetzt habe ich in der Leiste nur noch folgende Funktionen:
- Textformatierung entfernen
- Größe
- Fett
- Kursiv
- Unterstrichen
- Textfarbe
- Link einfügen
- Grafik einfügen
- Zitat einfügen
- Youtube code einfügen
- Code einfügen

M-K-D-B · 07.11.2022, 21:24

Und was wird dir angezeigt, wenn du darunter auf den Button "Erweitert" klickst?

07.11.2022, 12:23	#2
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Avira Sicherheitswarnung "Potenzielle Bedrohung blockiert Dateiname: Memorybuffer........" Zuerst mal: Avira und das alte Java 8 komplett deinstallieren. Dann gehts weiter. Und Logfiles bitte künftig nur in CODE-Tags posten, nicht in den Anhang! __________________ __________________

07.11.2022, 14:20	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Avira Sicherheitswarnung "Potenzielle Bedrohung blockiert Dateiname: Memorybuffer........" Dann jetzt neue FRST-Logs. __________________ --> Avira Sicherheitswarnung "Potenzielle Bedrohung blockiert Dateiname: Memorybuffer........"

07.11.2022, 20:30	#13
M-K-D-B /// TB-Ausbilder	Avira Sicherheitswarnung "Potenzielle Bedrohung blockiert Dateiname: Memorybuffer........" Ein Upload ist möglich. Rechtsklick auf die fixlog.txt > Senden an > Zip-komprimierter Ordner. Die Zip Datei kannst du dann im nächsten Post als Anhang hochladen.

07.11.2022, 21:24	#15
M-K-D-B /// TB-Ausbilder	Avira Sicherheitswarnung "Potenzielle Bedrohung blockiert Dateiname: Memorybuffer........" Und was wird dir angezeigt, wenn du darunter auf den Button "Erweitert" klickst?

Avira Sicherheitswarnung "Potenzielle Bedrohung blockiert Dateiname: Memorybuffer........"

Plagegeister aller Art und deren Bekämpfung: Avira Sicherheitswarnung "Potenzielle Bedrohung blockiert Dateiname: Memorybuffer........"