Mail Account wurde gehackt + Drohmail mit korrektem Passowrt bekommen

dommymaster · 02.08.2024, 19:16

fixlog:

Code:

ATTFilter

Entfernungsergebnis von Farbar Recovery Scan Tool (x64) Version: 02-08.2024
durchgeführt von do83h (02-08-2024 15:33:45) Run:3
Gestartet von C:\Users\do83h\Downloads
Geladene Profile: do83h
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
Start::
CreateRestorePoint:
CloseProcesses:
AV: McAfee VirusScan (Disabled - Up to date) {9D4501E6-72F6-2877-C789-89AF6F535B2C}
FW: McAfee Firewall (Disabled) {A57E80C3-3899-292F-ECD6-209A91801C57}
AlternateDataStreams: C:\Windows:CM_460d012b145979dbf37dc3b0d01ccb88c0d32947f35d43424efdd9b5dd3d14d5 [74]
AlternateDataStreams: C:\Windows:CM_663b0d0a539d6165560218efcbd7453ad718e66208ff706cc3a31c7a8e4b9b0e [74]
AlternateDataStreams: C:\ProgramData\Temp:0FF263E8 [254]
SearchScopes: HKU\S-1-5-21-584500284-1391629960-3397962802-1005 -> DefaultScope {4226AE2E-DA9C-4FEC-ADD0-2938E5D206C9} URL = 
SearchScopes: HKU\S-1-5-21-584500284-1391629960-3397962802-1005 -> {4226AE2E-DA9C-4FEC-ADD0-2938E5D206C9} URL = 
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [] => [X]
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Policies\Explorer: [] 
HKU\S-1-5-18\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Beschränkung <==== ACHTUNG
FF ProfilePath: C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\3uauklfr.default [nicht gefunden] <==== ACHTUNG
FF NewTab: Mozilla\Firefox\Profiles\bxljijxg.dominik -> hxxps://mynewtab.co?pId=IC150206&searchEngine=bing&iDate=110620
FF Notifications: Mozilla\Firefox\Profiles\bxljijxg.dominik -> hxxps://www.planetromeo.com; hxxps://www.jako.de; hxxps://www.romeo.com; hxxps://www.facebook.com
FF SearchPlugin: C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\bxljijxg.dominik\searchplugins\Yahoo Search.xml [2022-06-17]
FF Homepage: Mozilla\Firefox\Profiles\79tx312p.default-release -> hxxps://mynewtab.co?pId=IC150206&searchEngine=bing&iDate=110620
FF NewTab: Mozilla\Firefox\Profiles\79tx312p.default-release -> hxxps://mynewtab.co?pId=IC150206&searchEngine=bing&iDate=110620
FF SearchPlugin: C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\79tx312p.default-release\searchplugins\Yahoo Search.xml [2022-06-17]
CHR Notifications: Default -> hxxps://business.facebook.com; hxxps://www.fmscout.com
S2 AvgWscReporter; "C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /runassvc /rpcserver [X]
C:\Program Files\AVG
2024-07-28 21:56 - 2024-07-28 21:56 - 000001256 _____ C:\Users\do83h\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Safer Web.lnk
2024-07-28 21:56 - 2024-07-28 21:56 - 000000000 ____D C:\ProgramData\DNSBackup
2024-07-28 21:55 - 2024-07-29 18:26 - 000000000 ____D C:\Users\do83h\AppData\Roaming\ReasonLabs
2024-07-28 21:55 - 2024-07-29 18:26 - 000000000 ____D C:\ProgramData\ReasonLabs
2024-07-28 21:55 - 2024-07-28 21:55 - 000001252 _____ C:\Users\do83h\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RAV VPN.lnk
2024-07-28 21:55 - 2024-07-28 21:55 - 000000000 ____D C:\ProgramData\VPNBackup
2024-07-28 21:54 - 2024-07-28 21:54 - 014351560 _____ (Cheat Engine ) C:\Users\do83h\Downloads\CheatEngine681.exe
2024-07-28 21:52 - 2024-07-29 18:26 - 000000000 ____D C:\Program Files\ReasonLabs
2024-07-28 21:47 - 2024-07-28 21:47 - 003226144 _____ ( ) C:\Users\do83h\Downloads\CheatEngine75.exe
CMD: netsh winsock reset
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh winhttp reset proxy
CMD: Bitsadmin /Reset /Allusers
CMD: Winmgmt /salvagerepository 
CMD: Winmgmt /verifyrepository
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
Hosts:
RemoveProxy:
EmptyTemp:
End::
*****************

CreateRestorePoint: Fehler(1=2%) -> Erstellen eines Wiederherstellungspunktes gescheitert.
Prozesse erfolgreich geschlossen.
"AV: McAfee VirusScan (Disabled - Up to date) {9D4501E6-72F6-2877-C789-89AF6F535B2C}" => nicht gefunden
"FW: McAfee Firewall (Disabled) {A57E80C3-3899-292F-ECD6-209A91801C57}" => nicht gefunden
"C:\Windows" => ":CM_460d012b145979dbf37dc3b0d01ccb88c0d32947f35d43424efdd9b5dd3d14d5" ADS nicht gefunden.
"C:\Windows" => ":CM_663b0d0a539d6165560218efcbd7453ad718e66208ff706cc3a31c7a8e4b9b0e" ADS nicht gefunden.
"C:\ProgramData\Temp" => ":0FF263E8" ADS nicht gefunden.
"HKU\S-1-5-21-584500284-1391629960-3397962802-1005\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => nicht gefunden
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4226AE2E-DA9C-4FEC-ADD0-2938E5D206C9} => nicht gefunden
"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\" => nicht gefunden
"HKU\S-1-5-21-584500284-1391629960-3397962802-1005\Software\Microsoft\Windows\CurrentVersion\Run\\" => nicht gefunden
"HKU\S-1-5-21-584500284-1391629960-3397962802-1005\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\" => nicht gefunden
"HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\" => nicht gefunden
HKLM\SOFTWARE\Policies\Mozilla => nicht gefunden
"FF NewTab: Mozilla\Firefox\Profiles\bxljijxg.dominik -> hxxps://mynewtab.co?pId=IC150206&searchEngine=bing&iDate=110620" => nicht gefunden
"FF Notifications:" => erfolgreich entfernt
"C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\bxljijxg.dominik\searchplugins\Yahoo Search.xml" => nicht gefunden
"FF Homepage: Mozilla\Firefox\Profiles\79tx312p.default-release -> hxxps://mynewtab.co?pId=IC150206&searchEngine=bing&iDate=110620" => nicht gefunden
"FF NewTab: Mozilla\Firefox\Profiles\79tx312p.default-release -> hxxps://mynewtab.co?pId=IC150206&searchEngine=bing&iDate=110620" => nicht gefunden
"C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\79tx312p.default-release\searchplugins\Yahoo Search.xml" => nicht gefunden
"Chrome Notifications:" => nicht gefunden
AvgWscReporter => Dienst nicht gefunden.
"C:\Program Files\AVG" => nicht gefunden
"C:\Users\do83h\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Safer Web.lnk" => nicht gefunden
"C:\ProgramData\DNSBackup" => nicht gefunden
"C:\Users\do83h\AppData\Roaming\ReasonLabs" => nicht gefunden
"C:\ProgramData\ReasonLabs" => nicht gefunden
"C:\Users\do83h\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RAV VPN.lnk" => nicht gefunden
"C:\ProgramData\VPNBackup" => nicht gefunden
"C:\Users\do83h\Downloads\CheatEngine681.exe" => nicht gefunden
"C:\Program Files\ReasonLabs" => nicht gefunden
"C:\Users\do83h\Downloads\CheatEngine75.exe" => nicht gefunden

========= netsh winsock reset =========


Der Winsock-Katalog wurde zurckgesetzt.
Sie mssen den Computer neu starten, um den Vorgang abzuschlieáen.



========= Ende von CMD: =========


========= netsh advfirewall reset =========

OK.



========= Ende von CMD: =========


========= netsh advfirewall set allprofiles state ON =========

OK.



========= Ende von CMD: =========


========= netsh winhttp reset proxy =========


Aktuelle WinHTTP-Proxyeinstellungen:

    DirectAccess (kein Proxyserver).



========= Ende von CMD: =========


========= Bitsadmin /Reset /Allusers =========


BITSADMIN version 3.0
BITS administration utility.
(C) Copyright Microsoft Corp.

{5116DF5A-4B0C-42EB-BBF2-D0D46933742A} canceled.
1 out of 1 jobs canceled.


========= Ende von CMD: =========


========= Winmgmt /salvagerepository =========

Das WMI-Repository ist konsistent.


========= Ende von CMD: =========


========= Winmgmt /verifyrepository =========

Das WMI-Repository ist konsistent.


========= Ende von CMD: =========


========= "%WINDIR%\SYSTEM32\lodctr.exe" /R =========


Info: Die Leistungsindikatoreinstellung konnte erfolgreich aus dem Systemsicherungsspeicher neu erstellt werden.

========= Ende von CMD: =========


========= "%WINDIR%\SysWOW64\lodctr.exe" /R =========


Info: Die Leistungsindikatoreinstellung konnte erfolgreich aus dem Systemsicherungsspeicher neu erstellt werden.

========= Ende von CMD: =========


========= "%WINDIR%\SYSTEM32\lodctr.exe" /R =========


Info: Die Leistungsindikatoreinstellung konnte erfolgreich aus dem Systemsicherungsspeicher neu erstellt werden.

========= Ende von CMD: =========


========= "%WINDIR%\SysWOW64\lodctr.exe" /R =========


Info: Die Leistungsindikatoreinstellung konnte erfolgreich aus dem Systemsicherungsspeicher neu erstellt werden.

========= Ende von CMD: =========

C:\Windows\System32\Drivers\etc\hosts => erfolgreich verschoben
Hosts erfolgreich wiederhergestellt.

========= RemoveProxy: =========

"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => erfolgreich entfernt
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => erfolgreich entfernt
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => erfolgreich entfernt
"HKU\S-1-5-21-584500284-1391629960-3397962802-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => erfolgreich entfernt
"HKU\S-1-5-21-584500284-1391629960-3397962802-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => erfolgreich entfernt


========= Ende von RemoveProxy: =========


=========== EmptyTemp: ==========

FlushDNS => abgeschlossen
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 5242904 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 0 B
Windows/system/drivers => 116830 B
Edge => 0 B
Chrome => 0 B
Firefox => 115653648 B
Opera => 14402079 B

Temp, IE cache, history, cookies, recent:
Default => 7680 B
ProgramData => 7680 B
Public => 7680 B
systemprofile => 595830331 B
systemprofile32 => 595830331 B
LocalService => 596825969 B
NetworkService => 597185427 B
do83h => 836192626 B

RecycleBin => 416990 B
EmptyTemp: => 3.1 GB temporäre Dateien entfernt.

================================


Das System musste neu gestartet werden.

==== Ende von Fixlog 15:35:59 ====

M-K-D-B · 03.08.2024, 12:38

Gut gemacht.

Nun bitte ESET und KVRT ausführen.

Schritt 1
Führe ESET Online Scanner (EOS) gemäß der bebilderten Anleitung aus und poste abschließend die Logdatei.

Schritt 2
Führe das Kaspersky Virus Removal Tool (KVRT) gemäß der bebilderten Anleitung aus und poste abschließend die Logdateien.

dommymaster · 04.08.2024, 21:11

Der ESET Online Scanner (EOS) schließt sich immer automatisch während er die Updates vor dem Scan macht.

Scheint also irgendwie nicht zu klappen.

Sollt ich den Kaspersky Virus Removal Tool (KVRT) dann mal machen bzw. trotzdem machen?

M-K-D-B · 04.08.2024, 21:22

Zitat:

Zitat von dommymaster

Sollt ich den Kaspersky Virus Removal Tool (KVRT) dann mal machen bzw. trotzdem machen?

Ja bitte.

dommymaster · 07.08.2024, 19:56

Dieses KVRT hat nach Punkt 7 aufgehört, die Möglichkeit zu: "Disinfect and restart the computer" kam nicht.

Hier der Report:

Code:

ATTFilter

<Report>
    <Metadata Version="1" PCID="{88A20BB3-D361-5953-AAD6-198A86F0376F}" LastModification="2024.08.07 20:51:14.411" />
    <EventBlocks>
        <Block0 Type="Scan" Processed="3913402" Found="13" Neutralized="0">
            <Event0 Action="Scan" Time="133673536484926712" Object="" Info="Started" />
            <Event1 Action="Detect" Time="133673538464098507" Object="C:\Users\do83h\OneDrive\Dokumente\GermanFunScript\mIRC\mirc.exe" Info="not-a-virus:Client-IRC.Win32.mIRC.621" />
            <Event2 Action="Detect" Time="133673540646398266" Object="C:\FRST\Quarantine\C\Users\do83h\Downloads\CheatEngine75.exe.xBAD" Info="not-a-virus:Downloader.Win32.Bundler.gen" />
            <Event3 Action="Detect" Time="133673540748827414" Object="C:\FRST\Quarantine\C\Users\do83h\Downloads\CheatEngine681.exe.xBAD" Info="not-a-virus:HEUR:Downloader.Win32.Funshion.gen" />
            <Event4 Action="Detect" Time="133673582435791298" Object="C:\Users\do83h\OneDrive\Dokumente\GermanFunScript\mirc (2).exe" Info="not-a-virus:Client-IRC.Win32.mIRC.621" />
            <Event5 Action="Detect" Time="133673582435940901" Object="C:\Users\do83h\OneDrive\Dokumente\GermanFunScript\Tools\nukenabber.exe" Info="not-a-virus:UDS:NetTool" />
            <Event6 Action="Detect" Time="133675219912099587" Object="G:\___Formatierung April 2019\Sicherungen vom alten PC\GermanFunScript\Tools\nukenabber.exe" Info="not-a-virus:UDS:NetTool" />
            <Event7 Action="Detect" Time="133675219912256105" Object="G:\___Formatierung April 2019\Sicherungen vom alten PC\Firefox Profil\MozillaProfil\CT2269050\Dialogs\settings.js" Info="not-a-virus:HEUR:WebToolbar.JS.Condonit" />
            <Event8 Action="Detect" Time="133675240185756742" Object="G:\__Neuer PC Medion Oktober 2020\Sicherungen vom alten PC\Firefox Profil\MozillaProfil\CT2269050\Dialogs\settings.js" Info="not-a-virus:HEUR:WebToolbar.JS.Condonit" />
            <Event9 Action="Detect" Time="133675240347724916" Object="G:\__Neuer PC Medion Oktober 2020\Sicherungen vom alten PC\GermanFunScript\Mirc.exe" Info="not-a-virus:Client-IRC.Win32.mIRC.602" />
            <Event10 Action="Detect" Time="133675240576237453" Object="G:\__Neuer PC Medion Oktober 2020\Sicherungen vom alten PC\GermanFunScript\Tools\nukenabber.exe" Info="not-a-virus:UDS:NetTool" />
            <Event11 Action="Detect" Time="133675240867743751" Object="G:\__Neuer PC Medion Oktober 2020\EXEn für Programm\CheatEngine681.exe" Info="not-a-virus:HEUR:Downloader.Win32.Funshion.gen" />
            <Event12 Action="Scan" Time="133675245877414282" Object="" Info="Finished" />
            <Event13 Action="Select action" Time="133675302460625902" Object="C:\Users\do83h\OneDrive\Dokumente\GermanFunScript\mIRC\mirc.exe" Info="Skip" />
            <Event14 Action="Select action" Time="133675302460625902" Object="C:\FRST\Quarantine\C\Users\do83h\Downloads\CheatEngine681.exe.xBAD" Info="Skip" />
            <Event15 Action="Select action" Time="133675302460625902" Object="C:\FRST\Quarantine\C\Users\do83h\Downloads\CheatEngine75.exe.xBAD" Info="Skip" />
            <Event16 Action="Select action" Time="133675302460625902" Object="C:\Users\do83h\OneDrive\Dokumente\GermanFunScript\mirc (2).exe" Info="Skip" />
            <Event17 Action="Select action" Time="133675302460625902" Object="C:\Users\do83h\OneDrive\Dokumente\GermanFunScript\Tools\nukenabber.exe" Info="Skip" />
            <Event18 Action="Select action" Time="133675302460625902" Object="G:\___Formatierung April 2019\Sicherungen vom alten PC\Firefox Profil\MozillaProfil\CT2269050\Dialogs\settings.js" Info="Skip" />
            <Event19 Action="Select action" Time="133675302460625902" Object="G:\___Formatierung April 2019\Sicherungen vom alten PC\GermanFunScript\Tools\nukenabber.exe" Info="Skip" />
            <Event20 Action="Select action" Time="133675302460625902" Object="G:\__Neuer PC Medion Oktober 2020\Sicherungen vom alten PC\Firefox Profil\MozillaProfil\CT2269050\Dialogs\settings.js" Info="Skip" />
            <Event21 Action="Select action" Time="133675302460625902" Object="G:\__Neuer PC Medion Oktober 2020\Sicherungen vom alten PC\GermanFunScript\Mirc.exe" Info="Skip" />
            <Event22 Action="Select action" Time="133675302460625902" Object="G:\__Neuer PC Medion Oktober 2020\Sicherungen vom alten PC\GermanFunScript\Tools\nukenabber.exe" Info="Skip" />
            <Event23 Action="Select action" Time="133675302460625902" Object="G:\__Neuer PC Medion Oktober 2020\EXEn für Programm\CheatEngine681.exe" Info="Skip" />
        </Block0>
    </EventBlocks>
</Report>

M-K-D-B · 07.08.2024, 21:19

Zitat:

Zitat von dommymaster

Dieses KVRT hat nach Punkt 7 aufgehört, die Möglichkeit zu: [CFSCRIPT]"Disinfect and restart the computer" kam nicht.

Die Möglichkeit gibt es schon, du hast aber "Skip" ausgewählt (siehe Logdatei).

Aktive Malware wurde aber keine gefunden, das ist schon mal gut.

Da ESET nicht funktionierte, schlage ich vor, wir machen nun eine Kontrolle mit SecurityCheck und FRST.

Schritt 1

Starte FRST erneut und klicke auf Untersuchen.
FRST erstellt nun zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Schritt 2
Führe SecurityCheck (SC) gemäß der bebilderten Anleitung aus und füge die Logdatei als Anhang hinzu.

dommymaster · 08.08.2024, 19:11

FRST

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 02-08.2024
durchgeführt von do83h (Administrator) auf DESKTOP-V3T0UTA (MEDION E63007) (08-08-2024 20:04:38)
Gestartet von C:\Users\do83h\Downloads\FRST64.exe
Geladene Profile: do83h
Plattform: Microsoft Windows 10 Home Version 22H2 19045.4651 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: FF
Start-Modus: Normal

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe <2>
(Autodesk, Inc. -> Autodesk) C:\Users\do83h\AppData\Local\Programs\Autodesk\Genuine Service\GenuineService.exe
(Autodesk, Inc. -> Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe
(C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe ->) (Autodesk, Inc. -> Autodesk) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AcWebBrowser\AcWebBrowser.exe <3>
(C:\Program Files (x86)\Citrix\ICA Client\concentr.exe ->) (Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe
(C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe ->) (Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfServicePlugin.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
(Cisco Systems, Inc. -> Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\AnalyticsSrv.exe
(Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
(DriverStore\FileRepository\cui_dch.inf_amd64_ba5b1813656e5c27\igfxCUIService.exe ->) (Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_ba5b1813656e5c27\igfxEM.exe
(explorer.exe ->) (477B7FBA-7EF8-4233-86D2-322330786803 -> ) C:\Program Files\WindowsApps\3138AweZip.AweZip_1.4.36.0_x64__ffd303wmbhcjt\ArchiveObserver\ArchiveObserver.exe
(explorer.exe ->) (Google LLC -> ) C:\Program Files\Google\Drive\googledrivesync.exe <2>
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <5>
(explorer.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(explorer.exe ->) (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe
(Hewlett-Packard Company -> Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Intel Corporation -> ) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MusNotifyIcon.exe
(Mozilla Corporation -> Mozilla Foundation) C:\Program Files\Mozilla Firefox\pingsender.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(services.exe ->) (Autodesk, Inc. -> Autodesk Inc.) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe
(services.exe ->) (Autodesk, Inc. -> Autodesk) C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.0.3194\AdskLicensingService\AdskLicensingService.exe
(services.exe ->) (Cisco Systems, Inc. -> Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(services.exe ->) (Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe
(services.exe ->) (Flexera Software LLC -> Flexera) C:\Program Files (x86)\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService.exe
(services.exe ->) (Geek Software GmbH -> geek software GmbH) C:\Program Files\PDF24\pdf24.exe <2>
(services.exe ->) (Hewlett-Packard Company -> HP) C:\Windows\System32\HPSIsvc.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe
(services.exe ->) (Intel Corporation -> ) C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe
(services.exe ->) (Intel Corporation -> ) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_af50fdb80983f7bc\jhi_service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\lms.inf_amd64_a55aa2cd52a3429d\LMS.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe
(services.exe ->) (Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_ba5b1813656e5c27\igfxCUIService.exe
(services.exe ->) (Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_e8f9f51120464f93\IntelCpHDCPSvc.exe
(services.exe ->) (Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_e8f9f51120464f93\IntelCpHeciSvc.exe
(services.exe ->) (Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iastorac.inf_amd64_6ca78a08b838e305\RstMwService.exe
(services.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpDefenderCoreService.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MsMpEng.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\NisSrv.exe
(services.exe ->) (Nuance Communications, Inc. -> Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe
(services.exe ->) (Nuance Communications, Inc. -> Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\loggerservice.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c60facea9c32a6cb\RtkAudUService64.exe <2>
(services.exe ->) (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
(services.exe ->) (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG) C:\Program Files\CodeMeter\Runtime\bin\CmWebAdmin.exe
(sihost.exe ->) (Microsoft Corporation -> ) C:\Program Files\WindowsApps\Microsoft.MSPaint_6.2405.19017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
(svchost.exe ->) (24803D75-212C-471A-BC57-9EF86AB91435 -> ) C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2429.10.0_x64__cv1g1gvanyjgm\WhatsApp.exe
(svchost.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(svchost.exe ->) (Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(svchost.exe ->) (Flexera Software LLC -> Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\agent.exe
(svchost.exe ->) (Flexera Software LLC -> Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(svchost.exe ->) (Google LLC -> Google LLC) C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe <6>
(svchost.exe ->) (Intel Corporation -> Intel Corporation) C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Windows\System32\CompatTelRunner.exe <3>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe <2>

==================== Registry (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtkAudUService] => C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c60facea9c32a6cb\RtkAudUService64.exe [3380320 2021-11-18] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch [3831808 2021-08-30] (Microsoft Windows Hardware Compatibility Publisher -> Logitech)
HKLM\...\Run: [PDF24] => C:\Program Files\PDF24\pdf24.exe [645976 2024-03-05] (Geek Software GmbH -> geek software GmbH)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard Company -> Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Autodesk Desktop App] => C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe [665384 2019-12-05] (Autodesk, Inc. -> Autodesk, Inc.)
HKLM-x32\...\Run: [Autodesk Genuine Service ] => C:\Users\do83h\AppData\Local\Programs\Autodesk\Genuine Service\GenuineService.exe [1077864 2020-01-02] (Autodesk, Inc. -> Autodesk)
HKLM-x32\...\Run: [TeamsMachineInstaller] => C:\Program Files (x86)\Teams Installer\Teams.exe [109324536 2021-03-12] (Microsoft Corporation -> Microsoft Corporation)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [1713432 2021-09-17] (Cisco Systems, Inc. -> Cisco Systems, Inc.)
HKLM-x32\...\Run: [InstallHelper] => C:\Program Files (x86)\Citrix\Citrix Workspace 2405\InstallHelper.exe [675128 2024-07-08] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\isuspm.exe [2075480 2013-06-24] (Flexera Software LLC -> Flexera Software LLC.)
HKLM-x32\...\Run: [DNS7reminder] => C:\Program Files (x86)\Nuance\NaturallySpeaking13\Ereg\Ereg.exe [325960 2014-05-30] (Nuance Communications, Inc. -> Nuance Communications, Inc.)
HKLM-x32\...\Run: [AnalyticsSrv] => C:\Program Files (x86)\Citrix\ICA Client\Receiver\AnalyticsSrv.exe [2857328 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [3068544 2024-07-02] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [1040000 2024-07-02] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-19\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\95.0.0.0\GoogleDriveFS.exe [60931688 2024-08-01] (Google LLC -> Google, Inc.)
HKU\S-1-5-20\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\95.0.0.0\GoogleDriveFS.exe [60931688 2024-08-01] (Google LLC -> Google, Inc.)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [4407656 2024-07-17] (Valve Corp. -> Valve Corporation)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [EpicGamesLauncher] => C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe [33000928 2021-04-07] (Epic Games Inc. -> Epic Games, Inc.)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [49958368 2022-02-01] (Google LLC -> )
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [com.squirrel.Teams.Teams] => C:\Users\do83h\AppData\Local\Microsoft\Teams\Update.exe [2454184 2021-07-14] (Microsoft 3rd Party Application Component -> Microsoft Corporation)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\95.0.0.0\GoogleDriveFS.exe [60931688 2024-08-01] (Google LLC -> Google, Inc.)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [2075480 2013-06-24] (Flexera Software LLC -> Flexera Software LLC.)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [MicrosoftEdgeAutoLaunch_87671BE690C6185EAE66EBDAEE7802D1] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [3814968 2024-08-01] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\MountPoints2: {11ae930c-1cdb-11eb-a845-6c6a77606d86} - "H:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\MountPoints2: {2d9bfd5a-ab41-11eb-a86b-6c6a77606d86} - "H:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\MountPoints2: {2f109b79-53b8-11ec-a87f-6c6a77606d86} - "H:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\MountPoints2: {8e9c3683-068a-11ed-a89a-6c6a77606d86} - "H:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\MountPoints2: {d00a6513-1e96-11ee-a8c0-6c6a77606d86} - "H:\HiSuiteDownLoader.exe" 
HKU\S-1-5-18\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\95.0.0.0\GoogleDriveFS.exe [60931688 2024-08-01] (Google LLC -> Google, Inc.)
HKLM\...\Windows x64\Print Processors\HPM11M13PrintProc: C:\Windows\System32\spool\prtprocs\x64\HPM11M13PP.DLL [74240 2016-02-25] (Microsoft Windows Hardware Compatibility Publisher -> )
HKLM\...\Print\Monitors\HP BC11 Status Monitor: C:\Windows\system32\hpinkstsBC11LM.dll [331664 2012-06-12] (Hewlett Packard -> Hewlett-Packard Co.)
HKLM\...\Print\Monitors\HP Discovery Port Monitor (HP Photosmart 7520 series): C:\Windows\system32\HPDiscoPMBC11.dll [741480 2012-10-17] (Hewlett Packard -> Hewlett-Packard Co.)
HKLM\...\Print\Monitors\HPM11M13LM: C:\Windows\system32\HPM11M13LM.DLL [288768 2016-02-25] (Microsoft Windows Hardware Compatibility Publisher -> )
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\127.0.6533.99\Installer\chrmstp.exe [2024-08-07] (Google LLC -> Google LLC)
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{60f15951-e7ef-11ea-b28e-c4b301b9ed33}] -> C:\Program Files (x86)\Citrix\ICA Client\CitrixEnterpriseBrowser\126.1.1.22\Installer\chrmstp.exe [2024-07-20] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
Startup: C:\Users\do83h\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 7520 series.lnk [2024-08-08]
ShortcutAndArgument: Tintenwarnungen überwachen - HP Photosmart 7520 series.lnk -> C:\Windows\system32\RunDll32.exe => "C:\Program Files\HP\HP Photosmart 7520 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=TH4A1710WP05YY;CONNECTION=USB;MONITOR=1;
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodeMeter Control Center.lnk [2021-11-01]
ShortcutTarget: CodeMeter Control Center.lnk -> C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {F574530D-F2B2-44CB-AF37-D06E115518A2} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1558984 2024-06-25] (Adobe Inc. -> Adobe Inc.)
Task: {7C6AAADD-6794-4CEC-842E-F176CA9317EC} - System32\Tasks\G2MUpdateTask-S-1-5-21-584500284-1391629960-3397962802-1005 => C:\Users\do83h\AppData\Local\GoToMeeting\19992\g2mupdate.exe [34872 2024-06-22] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {8ED46F6B-D868-45F9-A5DA-F936D7B2E679} - System32\Tasks\G2MUploadTask-S-1-5-21-584500284-1391629960-3397962802-1005 => C:\Users\do83h\AppData\Local\GoToMeeting\19992\g2mupload.exe [34872 2024-06-22] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {40C3BD78-F59E-4D2F-AE22-905EE6793F9D} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem128.0.6597.0{93A54F35-F806-45F6-8563-F73C85EA83CF} => C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe [4889704 2024-07-15] (Google LLC -> Google LLC)
Task: {F59146C7-C25F-4DE3-99D4-7D64FB97AAD4} - System32\Tasks\HPCustParticipation HP Photosmart 7520 series => C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPCustPartic.exe [4119656 2012-10-17] (Hewlett Packard -> Hewlett-Packard Co.)
Task: {8BC77DBC-D5D6-45D8-B1C0-099E91C2647D} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132 => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [4922296 2023-12-19] (Intel Corporation -> Intel Corporation)
Task: {964B9470-0064-4BA7-9FBA-4D49F23DA117} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132-Logon => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [4922296 2023-12-19] (Intel Corporation -> Intel Corporation)
Task: {A160F302-5259-4CC8-88D7-5327AE03EDBA} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe  --automatic (Keine Datei)
Task: {514A5D14-4EB0-4135-A4F7-B073E9143C98} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [28499640 2024-07-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {CAD81E66-1FF7-42F0-B65F-A45A8FC9B502} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [28499640 2024-07-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {B8540C44-B70A-4B2A-B861-15AFF54DC5B0} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [221368 2024-07-14] (Microsoft Corporation -> Microsoft Corporation)
Task: {4EDC9E48-4E12-4EAC-A8F7-5CF3BC16A301} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [221368 2024-07-14] (Microsoft Corporation -> Microsoft Corporation)
Task: {040310DD-CB77-43E4-8279-924E17C6B61B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_ERROR_HB => C:\Windows\System32\MRT.exe [194135240 2024-07-13] (Microsoft Windows -> Microsoft Corporation) -> C:\Windows\system32\/EHB /HeartbeatFailure "SubmitHeartbeatReportData" /HeartbeatError "0x80072ee7"
Task: {A79195FD-FBEB-4433-886D-0B3991E80CC6} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MpCmdRun.exe [1678960 2024-07-17] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {5B046FA0-3D68-4B79-B2E1-95E49AB68E9E} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MpCmdRun.exe [1678960 2024-07-17] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {0ACBBB3B-FCFF-48EA-A20D-6565123DAAAB} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MpCmdRun.exe [1678960 2024-07-17] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {D9F0F6F7-AA53-4BB6-975D-A100E33BC50D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MpCmdRun.exe [1678960 2024-07-17] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {AF02A63D-FDCC-4CFB-A094-48A4E4432387} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [677448 2024-07-28] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (Der Dateneintrag hat 6 weitere Zeichen).
Task: {A6AD9B04-DC41-4297-AAA7-93567DEC2F32} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-584500284-1391629960-3397962802-1005 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [677448 2024-07-28] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (Der Dateneintrag hat 6 weitere Zeichen).
Task: {9AAE5F33-1CA5-4B5D-9110-F8CF75FDB1CA} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [34376 2024-07-28] (Mozilla Corporation -> Mozilla Foundation)
Task: {4EBFE576-7342-41DC-8E7A-E73D2197F550} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4209072 2024-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {E65BF73C-EB8F-452B-979A-36C9931D7E92} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-584500284-1391629960-3397962802-1005 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4209072 2024-08-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {6C00A265-94E7-4865-B2EC-59EFABDAE67F} - System32\Tasks\Opera scheduled Autoupdate 1605363011 => C:\Users\do83h\AppData\Local\Programs\Opera\launcher.exe [1538584 2020-03-03] (Opera Software AS -> Opera Software)
Task: {675DE520-3CEC-43D1-B092-71526D2C28F9} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => C:\Windows\System32\Wscript.exe [196608 2024-07-13] (Microsoft Windows -> Microsoft Corporation) -> C:\Program Files\Intel\SUR\QUEENCREEK\x64\//B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs"

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-584500284-1391629960-3397962802-1005.job => C:\Users\do83h\AppData\Local\GoToMeeting\19992\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-584500284-1391629960-3397962802-1005.job => C:\Users\do83h\AppData\Local\GoToMeeting\19992\g2mupload.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{0894d97c-231f-418b-bd94-97d6dc7075e5}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{0894d97c-231f-418b-bd94-97d6dc7075e5}: [DhcpDomain] speedport.ip
Tcpip\..\Interfaces\{a88c09f9-bd5a-4696-92a9-0f25bebc004b}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{a88c09f9-bd5a-4696-92a9-0f25bebc004b}: [DhcpDomain] speedport.ip
Tcpip\..\Interfaces\{a88c09f9-bd5a-4696-92a9-0f25bebc004b}\D4167656E6471675C414E4D233A49575: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{a88c09f9-bd5a-4696-92a9-0f25bebc004b}\D4167656E6471675C414E4D233A49575: [DhcpDomain] speedport.ip

Edge: 
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\do83h\AppData\Local\Microsoft\Edge\User Data\Default [2024-08-08]
Edge Extension: (Google Docs Offline) - C:\Users\do83h\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-07-13]
Edge Extension: (Edge relevant text changes) - C:\Users\do83h\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-01-24]
Edge HKLM-x32\...\Edge\Extension: [mielbhbkcliienpdicphhecpodcaeefg]

FireFox:
========
FF DefaultProfile: 79tx312p.default-release
FF ProfilePath: C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\bxljijxg.dominik [2024-08-02]
FF Homepage: Mozilla\Firefox\Profiles\bxljijxg.dominik -> hxxps://www.google.com/
FF Extension: (Citavi Picker) - C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\bxljijxg.dominik\Extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}.xpi [2023-05-02]
FF ProfilePath: G:\__Neuer PC Medion Oktober 2020\aktuelles Firefox Profil\60zvykgg.Standard-Benutzer-1601207510285 [2020-10-29]
FF Extension: (Citavi Picker) - G:\__Neuer PC Medion Oktober 2020\aktuelles Firefox Profil\60zvykgg.Standard-Benutzer-1601207510285\Extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}.xpi [2024-08-02]
FF ProfilePath: C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\79tx312p.default-release [2024-08-02]
FF Extension: (Citavi Picker) - C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\79tx312p.default-release\Extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}.xpi [2024-08-02]
FF Extension: (Citavi Picker) - C:\Program Files\Mozilla Firefox\distribution\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}.xpi [2023-03-23]
FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: (SmartPrintButton) - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011-01-26] [] [ist nicht signiert]
FF Plugin: nuance.com/DgnRia2_x86_64 -> C:\Program Files (x86)\Nuance\NaturallySpeaking13\Program\x64\npDgnRia2_x64.dll [2018-09-24] (Nuance Communications, Inc. -> Nuance Communications, Inc.)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2024-05-19] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2024-05-19] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2024-07-23] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: nuance.com/DgnRia2 -> C:\Program Files (x86)\Nuance\NaturallySpeaking13\Program\npDgnRia2.dll [2018-09-24] (Nuance Communications, Inc. -> Nuance Communications, Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\do83h\AppData\Local\Google\Chrome\User Data\Default [2024-08-02]
CHR Extension: (Google Docs Offline) - C:\Users\do83h\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-07-12]
CHR Extension: (Anwendungs-Launcher für Drive (von Google)) - C:\Users\do83h\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2023-08-23]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\do83h\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-01-29]
CHR Extension: (Citavi Picker) - C:\Users\do83h\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2023-07-13]
CHR HKU\S-1-5-21-584500284-1391629960-3397962802-1005\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn]

Opera: 
=======
OPR Profile: C:\Users\do83h\AppData\Roaming\Opera Software\Opera Stable [2024-08-02]

==================== Dienste (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe [1047416 2019-12-05] (Autodesk, Inc. -> Autodesk Inc.)
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [172992 2024-06-25] (Adobe Inc. -> Adobe Inc.)
R2 AdskLicensingService; C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingService\AdskLicensingService.exe [16930616 2019-12-18] (Autodesk, Inc. -> Autodesk)
S3 appprotectionsvc; C:\Program Files (x86)\Citrix\ICA Client\appprotection.exe [717896 2024-06-15] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [14012384 2024-07-04] (Microsoft Corporation -> Microsoft Corporation)
R2 CmWebAdmin.exe; C:\Program Files\CodeMeter\Runtime\bin\CmWebAdmin.exe [10759616 2021-09-29] (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG)
S3 CtxAdpPolicy; C:\Program Files (x86)\Citrix\AppDataProtection\CtxAdpPolicy.exe [330608 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S3 CtxPkm; C:\Program Files (x86)\Citrix\AppDataProtection\CtxPkm.exe [1242992 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
R2 CWAUpdaterService; C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe [1708344 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
R2 DragonLoggerService; C:\Program Files (x86)\Common Files\Nuance\loggerservice.exe [151560 2018-09-24] (Nuance Communications, Inc. -> Nuance Communications, Inc.)
R2 DSAService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe [45464 2024-08-01] (Intel Corporation -> Intel)
R2 DSAUpdateService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe [296856 2024-08-01] (Intel Corporation -> Intel)
S3 FileSyncHelper; C:\Program Files\Microsoft OneDrive\24.141.0714.0003\FileSyncHelper.exe [3523088 2024-08-02] (Microsoft Corporation -> Microsoft Corporation)
R2 HPPrintScanDoctorService; C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe [241104 2024-08-07] (HP Inc. -> HP Inc.)
R2 HPSIService; C:\Windows\system32\HPSIsvc.exe [128272 2016-03-30] (Hewlett-Packard Company -> HP)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [8901528 2024-07-18] (Malwarebytes Inc. -> Malwarebytes)
S3 MBVpnTunnelService; C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe [3073888 2024-05-27] (Malwarebytes Inc. -> Malwarebytes)
R2 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpDefenderCoreService.exe [1427024 2024-08-08] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 OneDrive Updater Service; C:\Program Files\Microsoft OneDrive\24.141.0714.0003\OneDriveUpdaterService.exe [3863568 2024-08-02] (Microsoft Corporation -> Microsoft Corporation)
R2 PDF24; C:\Program Files\PDF24\pdf24.exe [645976 2024-03-05] (Geek Software GmbH -> geek software GmbH)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\NisSrv.exe [3199648 2024-08-08] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MsMpEng.exe [133704 2024-08-08] (Microsoft Windows Publisher -> Microsoft Corporation)
S2 rsVPNClientSvc; C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe [X]
S2 rsVPNSvc; "C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 acsock; C:\Windows\system32\DRIVERS\acsock64.sys [300456 2021-09-17] (Microsoft Windows Hardware Compatibility Publisher -> Cisco Systems, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [209088 2022-07-19] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [199312 2022-07-19] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [46704 2022-07-19] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R2 BdDci; C:\Windows\system32\DRIVERS\bddci.sys [367096 2023-03-18] (Bitdefender SRL -> Bitdefender)
S3 CLVirtualBus01; C:\Windows\System32\drivers\CLVirtualBus01.sys [113888 2018-05-02] (CyberLink Corp. -> CyberLink)
S3 ctxapdriver; C:\Windows\system32\DRIVERS\ctxapdriver.sys [81560 2024-06-14] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S3 ctxapinject; C:\Windows\system32\DRIVERS\ctxapinject.sys [128664 2024-06-14] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S4 ctxapusbfilter; C:\Windows\system32\DRIVERS\ctxapusbfilter.sys [60472 2024-06-14] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S4 CtxDs2; C:\Windows\System32\drivers\CtxDs2.sys [186424 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S4 CtxDt2; C:\Windows\System32\drivers\CtxDt2.sys [228296 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S4 CtxIsolate; C:\Windows\System32\drivers\CtxIsolate.sys [336840 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S4 CtxSupport; C:\Windows\System32\drivers\CtxSupport.sys [107976 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
R2 ctxusbm; C:\Windows\system32\DRIVERS\ctxusbmon.sys [160832 2024-07-02] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus2.sys [167440 2022-09-30] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
R2 googledrivefs31626; C:\Program Files\Google\Drive File Stream\Drivers\31626\googledrivefs31626.sys [384096 2024-07-17] (Microsoft Windows Hardware Compatibility Publisher -> Google, Inc.)
S3 iaLPSS2_GPIO2_ICL; C:\Windows\System32\DriverStore\FileRepository\ialpss2_gpio2_icl.inf_amd64_90beccc7e046abab\iaLPSS2_GPIO2_ICL.sys [132872 2020-04-27] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_I2C_ICL; C:\Windows\System32\DriverStore\FileRepository\ialpss2_i2c_icl.inf_amd64_c8c0638291b9b209\iaLPSS2_I2C_ICL.sys [200456 2020-04-27] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_SPI_ICL; C:\Windows\System32\DriverStore\FileRepository\ialpss2_spi_icl.inf_amd64_66a759065dfa6f64\iaLPSS2_SPI_ICL.sys [160024 2020-04-27] (Intel Corporation -> Intel Corporation)
R2 mbamchameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [221264 2024-08-07] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\Windows\System32\DRIVERS\MbamElam.sys [21480 2023-05-17] (Microsoft Windows Early Launch Anti-Malware Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [239568 2024-08-02] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MpKsl3625c029; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{A18D9C54-0B0D-4EA6-B599-8D5BAFFEAFDB}\MpKslDrv.sys [271640 2024-08-08] (Microsoft Windows -> Microsoft Corporation)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [29192 2016-03-17] (Microsoft Windows Hardware Compatibility Publisher -> Marvell Semiconductor, Inc.)
S0 ProtectedELAM; C:\Windows\System32\drivers\protected_elam.sys [18912 2022-09-27] (Microsoft Windows Early Launch Anti-Malware Publisher -> TODO: <Company name>)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [174112 2022-09-30] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
S3 ss_conn_usb_driver2; C:\Windows\System32\Drivers\ss_conn_usb_driver2.sys [50720 2022-09-30] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
S3 Usbnet; C:\Windows\System32\drivers\usbnet.sys [46080 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
S3 vpnva; C:\Windows\System32\drivers\vpnva64-6.sys [74064 2021-09-17] (Cisco Systems, Inc. -> Cisco Systems, Inc.)
S0 WdBoot; C:\Windows\System32\drivers\wd\WdBoot.sys [22080 2024-08-08] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\wd\WdFilter.sys [602504 2024-08-08] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\drivers\wd\WdNisDrv.sys [105864 2024-08-08] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2024-08-07 20:51 - 2024-08-07 20:52 - 000000004 ____H C:\ProgramData\cm-lock
2024-08-07 18:01 - 2024-08-07 18:01 - 000001514 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel Driver & Support Assistant.lnk
2024-08-07 18:01 - 2024-08-07 18:01 - 000000000 ____D C:\Program Files (x86)\Intel
2024-08-05 19:43 - 2024-08-05 19:46 - 000000000 ____D C:\KVRT2020_Data
2024-08-05 19:40 - 2024-08-05 19:42 - 111753072 _____ (AO Kaspersky Lab) C:\Users\do83h\OneDrive\Bilder\Desktop\KVRT.exe
2024-08-04 21:59 - 2024-08-04 22:05 - 000001382 _____ C:\Users\do83h\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk
2024-08-04 21:59 - 2024-08-04 22:04 - 000001288 _____ C:\Users\do83h\OneDrive\Bilder\Desktop\ESET Online Scanner.lnk
2024-08-04 21:57 - 2024-08-04 21:58 - 008389496 _____ (ESET) C:\Users\do83h\Downloads\esetonlinescanner.exe
2024-08-04 21:55 - 2024-08-04 21:59 - 000000000 ____D C:\Users\do83h\AppData\Local\ESET
2024-08-04 21:53 - 2024-08-04 21:53 - 010351480 _____ (ESET) C:\Users\do83h\Downloads\eset_smart_security_premium_live_installer.exe
2024-08-02 15:27 - 2024-08-02 15:27 - 000003466 _____ C:\Users\do83h\Downloads\kvzxmyidrjqipqqc.txt
2024-08-02 15:19 - 2024-08-02 15:35 - 000010310 _____ C:\Users\do83h\Downloads\Fixlog.txt
2024-08-02 15:19 - 2024-08-02 15:19 - 000003466 _____ C:\Users\do83h\Downloads\gsvvqskfezicl.txt
2024-07-29 18:28 - 2024-07-29 18:31 - 000085704 _____ C:\Users\do83h\Downloads\Addition.txt
2024-07-29 18:26 - 2024-08-08 20:05 - 000038048 _____ C:\Users\do83h\Downloads\FRST.txt
2024-07-28 08:46 - 2024-08-02 15:36 - 000000000 ____D C:\Program Files\Mozilla Firefox
2024-07-26 14:53 - 2024-07-26 14:53 - 002523036 _____ C:\Users\do83h\Downloads\SfV_Bestellung_87580143463.pdf
2024-07-24 17:41 - 2024-07-24 17:41 - 002591728 _____ (Malwarebytes) C:\Users\do83h\OneDrive\Bilder\Desktop\MBSetup(1).exe
2024-07-23 19:00 - 2024-07-23 19:00 - 000288888 _____ C:\Users\do83h\OneDrive\Dokumente\Ausweis Vorne und hinten.pdf
2024-07-22 18:03 - 2024-07-24 18:02 - 000000000 ____D C:\Users\do83h\Downloads\Trojaner Board
2024-07-22 17:44 - 2024-08-02 15:19 - 002397184 _____ (Farbar) C:\Users\do83h\Downloads\FRST64.exe
2024-07-20 17:04 - 2024-07-20 17:04 - 000002588 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix Workspace.lnk
2024-07-20 17:04 - 2024-07-20 17:04 - 000000000 ____D C:\ProgramData\Citrix
2024-07-13 14:16 - 2024-07-13 14:16 - 000000000 ____D C:\Windows\system32\compatrel
2024-07-13 11:20 - 2024-07-13 11:20 - 000021724 _____ C:\Windows\SysWOW64\IntegratedServicesRegionPolicySet.json
2024-07-13 11:19 - 2024-07-13 11:19 - 000021724 _____ C:\Windows\system32\IntegratedServicesRegionPolicySet.json
2024-07-13 11:09 - 2024-07-13 11:09 - 000000000 ___HD C:\$WinREAgent

==================== Ein Monat (geänderte) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2024-08-08 20:04 - 2023-04-23 12:32 - 000000000 ____D C:\FRST
2024-08-08 20:04 - 2022-02-09 19:55 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2024-08-08 20:04 - 2020-10-29 13:58 - 000000000 ____D C:\Users\do83h
2024-08-08 20:04 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\AppReadiness
2024-08-08 20:03 - 2021-12-19 00:44 - 000000000 ____D C:\Windows\SystemTemp
2024-08-08 20:03 - 2020-06-15 08:59 - 000000000 ____D C:\Windows\system32\Drivers\wd
2024-08-08 20:01 - 2021-11-01 18:16 - 000000068 ___SH C:\Windows\system32\Drivers\WppRecorder.winsecurity
2024-08-08 20:01 - 2020-10-29 14:03 - 000000000 __SHD C:\Users\do83h\IntelGraphicsProfiles
2024-08-07 21:30 - 2019-12-07 11:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2024-08-07 21:29 - 2020-10-29 14:48 - 000000000 ____D C:\Program Files (x86)\Steam
2024-08-07 21:27 - 2023-05-19 17:17 - 000000000 ____D C:\Users\do83h\AppData\Local\Malwarebytes
2024-08-07 21:15 - 2020-10-29 15:00 - 000000000 ____D C:\Users\do83h\AppData\Local\D3DSCache
2024-08-07 21:13 - 2020-10-31 17:15 - 000000000 ____D C:\Users\do83h\AppData\Roaming\Microsoft\Word
2024-08-07 21:02 - 2023-05-01 23:04 - 000000000 ____D C:\Users\do83h\OneDrive\Dokumente\Citavi 6
2024-08-07 21:02 - 2021-11-01 18:16 - 000000068 ___SH C:\Windows\system32\Drivers\WdfLdr.winsecurity
2024-08-07 21:01 - 2020-07-02 08:37 - 000739414 _____ C:\Windows\system32\perfh007.dat
2024-08-07 21:01 - 2020-07-02 08:37 - 000149046 _____ C:\Windows\system32\perfc007.dat
2024-08-07 21:01 - 2020-06-15 09:07 - 001713106 _____ C:\Windows\system32\PerfStringBackup.INI
2024-08-07 21:01 - 2019-12-07 11:13 - 000000000 ____D C:\Windows\INF
2024-08-07 20:52 - 2019-12-07 11:14 - 000000000 ___HD C:\Program Files\WindowsApps
2024-08-07 20:51 - 2021-08-26 13:18 - 000000000 ____D C:\Program Files\Microsoft OneDrive
2024-08-07 20:51 - 2021-07-10 00:47 - 000001426 _____ C:\Windows\system32\default_error_stack-000000-000000.txt
2024-08-07 20:51 - 2020-06-15 08:59 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2024-08-07 20:51 - 2019-12-07 11:03 - 000786432 _____ C:\Windows\system32\config\BBI
2024-08-07 20:49 - 2020-06-15 08:59 - 000000000 ____D C:\Windows\system32\SleepStudy
2024-08-07 18:01 - 2020-10-29 14:59 - 000000000 ____D C:\ProgramData\Package Cache
2024-08-07 17:58 - 2023-08-10 01:17 - 000000000 ____D C:\Windows\system32\Tasks\HP
2024-08-07 17:58 - 2023-07-19 21:20 - 000000000 ____D C:\Program Files\HPPrintScanDoctor
2024-08-07 17:45 - 2020-10-29 14:46 - 000002243 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2024-08-05 21:03 - 2021-06-25 21:49 - 000000000 ____D C:\Users\do83h\OneDrive\Dokumente\GermanFunScript
2024-08-04 22:09 - 2020-12-20 15:00 - 000000000 ____D C:\Users\do83h\AppData\Local\CrashDumps
2024-08-04 22:00 - 2019-12-07 11:14 - 000000000 ___HD C:\Windows\ELAMBKUP
2024-08-04 21:32 - 2020-10-29 21:37 - 000000000 ____D C:\Users\do83h\AppData\Roaming\Microsoft\Excel
2024-08-04 21:13 - 2020-07-02 09:15 - 000002440 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2024-08-02 21:30 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\LiveKernelReports
2024-08-02 20:17 - 2020-10-29 15:32 - 000000000 ____D C:\Users\do83h\Knuddels-Stapp
2024-08-02 20:04 - 2022-01-06 16:39 - 000003592 _____ C:\Windows\system32\Tasks\OneDrive Reporting Task-S-1-5-21-584500284-1391629960-3397962802-1005
2024-08-02 20:04 - 2021-07-14 11:35 - 000003194 _____ C:\Windows\system32\Tasks\OneDrive Per-Machine Standalone Update Task
2024-08-02 20:04 - 2021-07-14 11:35 - 000002152 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2024-08-02 15:59 - 2023-07-09 15:54 - 000297177 _____ C:\Users\do83h\OneDrive\Dokumente\FC Lisboa NEU.xlsx
2024-08-02 15:36 - 2023-05-17 18:52 - 000239568 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2024-08-02 15:36 - 2020-10-29 15:01 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2024-08-02 15:34 - 2022-10-19 13:05 - 000000000 ____D C:\Users\do83h\AppData\LocalLow\Temp
2024-08-02 15:32 - 2022-01-19 15:56 - 000000000 ____D C:\Windows\system32\Tasks\Mozilla
2024-08-02 15:19 - 2023-04-23 12:32 - 000000000 ____D C:\Users\do83h\Downloads\FRST-OlderVersion
2024-08-01 18:35 - 2022-10-11 16:18 - 000002140 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader.lnk
2024-08-01 18:35 - 2020-11-01 15:12 - 000004562 _____ C:\Windows\system32\Tasks\Adobe Acrobat Update Task
2024-08-01 18:26 - 2021-09-22 18:18 - 000002170 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive.lnk
2024-08-01 18:26 - 2020-12-16 00:32 - 000002060 _____ C:\Users\do83h\OneDrive\Bilder\Desktop\Google Drive.lnk
2024-07-29 18:19 - 2020-10-30 00:55 - 000000000 ____D C:\Users\do83h\AppData\Local\Steam
2024-07-28 21:42 - 2020-10-29 15:01 - 000001009 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2024-07-28 21:40 - 2020-07-02 09:15 - 000003756 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2024-07-28 21:40 - 2020-07-02 09:15 - 000003632 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2024-07-24 17:50 - 2023-05-17 18:53 - 000000000 ____D C:\Users\do83h\AppData\LocalLow\IGDump
2024-07-24 17:45 - 2023-05-17 18:52 - 000002097 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2024-07-24 17:42 - 2023-05-17 18:46 - 000000000 ____D C:\ProgramData\Malwarebytes
2024-07-24 17:42 - 2023-05-17 18:46 - 000000000 ____D C:\Program Files\Malwarebytes
2024-07-21 17:10 - 2020-10-29 17:28 - 000000000 ____D C:\Users\do83h\OneDrive\Dokumente\eigene dateien
2024-07-20 17:04 - 2022-11-02 13:40 - 000000000 ____D C:\Program Files (x86)\Citrix
2024-07-14 17:02 - 2021-07-14 16:13 - 000029709 _____ C:\Users\do83h\AppData\Roaming\Durch Trennzeichen getrennte Werte.ADR
2024-07-14 15:31 - 2020-10-30 16:23 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2024-07-13 14:17 - 2021-02-18 14:56 - 000000666 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-584500284-1391629960-3397962802-1005.job
2024-07-13 14:17 - 2021-02-18 14:56 - 000000570 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-584500284-1391629960-3397962802-1005.job
2024-07-13 14:17 - 2020-06-15 08:59 - 000571592 _____ C:\Windows\system32\FNTCACHE.DAT
2024-07-13 14:16 - 2023-12-16 00:56 - 000000000 ____D C:\Windows\InboxApps
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ___RD C:\Windows\ImmersiveControlPanel
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\SysWOW64\Dism
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\SystemResources
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\WinBioPlugIns
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\setup
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\SecureBootUpdates
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\oobe
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\Dism
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\appraiser
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\ShellExperiences
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\ShellComponents
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\PolicyDefinitions
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\bcastdvr
2024-07-13 11:24 - 2019-12-07 11:03 - 000000000 ____D C:\Windows\CbsTemp
2024-07-13 11:19 - 2020-06-15 09:01 - 003016192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintConfig.dll
2024-07-13 11:07 - 2023-10-18 19:00 - 000000000 ____D C:\Program Files (x86)\dotnet
2024-07-13 11:07 - 2020-11-01 17:21 - 000000000 ____D C:\Windows\system32\MRT
2024-07-13 11:04 - 2020-07-02 09:13 - 194135240 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========

2020-12-30 00:50 - 2020-12-30 00:50 - 000000457 _____ () C:\Program Files (x86)\INSTALL.LOG
2021-07-14 16:13 - 2024-07-14 17:02 - 000029709 _____ () C:\Users\do83h\AppData\Roaming\Durch Trennzeichen getrennte Werte.ADR
2020-10-30 15:19 - 2021-06-30 15:53 - 000022399 _____ () C:\Users\do83h\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2023-06-26 23:40 - 2023-06-30 21:25 - 000001435 _____ () C:\Users\do83h\AppData\Roaming\SAS7_000.DAT
2020-10-29 21:51 - 2021-01-06 19:19 - 000000081 _____ () C:\Users\do83h\AppData\Local\.bidstack.fault
2021-03-14 22:46 - 2021-03-14 22:46 - 000000950 _____ () C:\Users\do83h\AppData\Local\recently-used.xbel

==================== SigCheck ============================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

==================== Ende von FRST.txt ========================

Mail Account wurde gehackt + Drohmail mit korrektem Passowrt bekommen

Log-Analyse und Auswertung: Mail Account wurde gehackt + Drohmail mit korrektem Passowrt bekommen