Code:
Alles auswählen Aufklappen ATTFilter
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 14-11-2021
durchgeführt von System_X (Administrator) auf SYSTEM_X-PC (MSI MS-7695) (21-11-2021 19:46:45)
Gestartet von C:\Users\System_X\Desktop
Geladene Profile: System_X
Plattform: Microsoft Windows 10 Pro Version 21H1 19043.1348 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: FF
Start-Modus: Normal
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
() [Datei ist nicht signiert] C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Advanced Micro Devices, Inc. -> Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Advanced Micro Devices, Inc. -> Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Advanced Micro Devices, Inc.) [Datei ist nicht signiert] C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(AppEx Networks Corporation -> AppEx Networks Corporation) C:\Program Files\AMD Quick Stream\AMDQuickStream.exe
(Canon Inc. -> ) C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(FOXIT SOFTWARE INC. -> Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\FoxitPhantomPDFUpdateService.exe
(FOXIT SOFTWARE INC. -> Foxit Software Inc.) F:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitReaderUpdateService.exe
(Ghisler Software GmbH -> Ghisler Software GmbH) F:\totalcmd\TOTALCMD.EXE
(Lavasoft Software Canada Inc. -> ) C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
(Lavasoft Software Canada Inc. -> ) C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe
(Lavasoft Software Canada Inc. -> Lavasoft) C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe <2>
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_3.2110.13603.0_x64__8wekyb3d8bbwe\Cortana.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2103.8.0_x64__8wekyb3d8bbwe\Calculator.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1310_none_7e15ec207c87d405\TiWorker.exe
(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Windows Hardware Compatibility Publisher -> AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2110.6-0\MsMpEng.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2110.6-0\NisSrv.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <11>
(nordvpn s.a. -> TEFINCOM S.A.) C:\Program Files\NordVPN\NordVPN.exe
(nordvpn s.a. -> TEFINCOM S.A.) C:\Program Files\NordVPN\nordvpn-service.exe
(TeamViewer Germany GmbH -> TeamViewer Germany GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Tim Kosse -> FileZilla Project) C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe
(VLC Mobile Remote) [Datei ist nicht signiert] C:\Program Files (x86)\VMR Connect\VMRHub.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-11-04] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [FileZilla Server Interface] => C:\Program Files (x86)\FileZilla Server\FileZilla Server Interface.exe [2770088 2017-02-08] (Tim Kosse -> FileZilla Project)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-2965983169-4173802632-674656348-1000\...\Run: [VMR Connect] => C:\Program Files (x86)\VMR Connect\VMRHub.exe [242688 2021-05-22] (VLC Mobile Remote) [Datei ist nicht signiert]
HKU\S-1-5-21-2965983169-4173802632-674656348-1000\...\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AMDQuickStream.exe [488640 2015-04-06] (AppEx Networks Corporation -> AppEx Networks Corporation)
HKU\S-1-5-21-2965983169-4173802632-674656348-1000\...\Run: [NordVPN] => C:\Program Files\NordVPN\NordVPN.exe [280440 2021-06-06] (nordvpn s.a. -> TEFINCOM S.A.)
HKU\S-1-5-21-2965983169-4173802632-674656348-1000\...\Run: [Skype for Desktop] => C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe [114017640 2021-08-10] (Skype Software Sarl -> Skype Technologies S.A.)
HKU\S-1-5-21-2965983169-4173802632-674656348-1000\...\Run: [Opera Browser Assistant] => C:\Users\System_X\AppData\Local\Programs\Opera\assistant\browser_assistant.exe [4105424 2021-10-14] (Opera Software AS -> Opera Software)
HKU\S-1-5-21-2965983169-4173802632-674656348-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [9250224 2021-11-18] (Lavasoft Software Canada Inc. -> Lavasoft)
HKU\S-1-5-21-2965983169-4173802632-674656348-1000\...\MountPoints2: {d62f0a54-3559-11eb-9d61-8c89a53586cf} - "J:\DTLplus_Launcher.exe"
HKLM\...\Windows x64\Print Processors\Canon TS700 series Print Processor: C:\Windows\System32\spool\prtprocs\x64\CNMPDFD.DLL [482816 2018-09-09] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\...\Print\Monitors\Canon BJ Language Monitor TS700 series: C:\WINDOWS\system32\CNMLMFD.DLL [910848 2018-09-09] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\Software\...\Authentication\Credential Providers: [{503739d0-4c5e-4cfd-b3ba-d881334f0df2}] ->
GroupPolicy: Beschränkung - Chrome <==== ACHTUNG
Policies: C:\ProgramData\NTUSER.pol: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Google: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Edge: Beschränkung <==== ACHTUNG
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0A984834-D009-41B3-9957-6A95DDE8B87D} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe -PvrSchedule (Keine Datei)
Task: {1137CB67-D7A2-4AEE-9BB9-8D7C9C1C2718} - System32\Tasks\MicrosoftEdgeUpdateTaskMachineCore => C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe /c (Keine Datei)
Task: {12B49169-3903-4955-8E6C-FFD4ADBEC8BC} - System32\Tasks\AnwendungsinformationenSmartlocker-FiltertreiberAnwendungsverwaltung => C:\Program Files (x86)\nodejs\node.exe [15017624 2017-05-02] (Node.js Foundation -> Node.js) -> C:\WINDOWS\Installer\{ED5DA7CF-EA8C-42D6-8564-3AB71228AA8E}\{19A2E1C8-4C9B-4B49-B9E7-FC1118EE4344} <==== ACHTUNG
Task: {199FA3DE-B9A0-4364-90E9-E4A9E3DB7FA7} - System32\Tasks\Opera scheduled assistant Autoupdate 1606677923 => C:\Users\System_X\AppData\Local\Programs\Opera\launcher.exe [2265296 2021-11-17] (Opera Software AS -> Opera Software) -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\System_X\AppData\Local\Programs\Opera\assistant" $(Arg0)
Task: {3382EAF8-E4C8-4687-BE24-A488BE2F89E7} - System32\Tasks\Microsoft\Windows\End Of Support\Notify1 => C:\WINDOWS\system32\sipnotify.exe -LogonOrUnlock (Keine Datei)
Task: {33FBF0D8-5ADE-471B-BED2-AF1B04A92CB5} - System32\Tasks\Microsoft\Windows\MobilePC\HotStart => {06DA0625-9701-43da-BFD7-FBEEA2180A1E}
Task: {340A1493-5406-498D-94EF-90D8DB5C40B7} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe /DoActivateWindowsSearch (Keine Datei)
Task: {3A97BF76-9D66-44F9-9CC4-DB27F4CA3747} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -ObjectStoreRecoveryTask (Keine Datei)
Task: {4321C5C0-ADD4-44A3-82DE-16B45FAB1D3B} - System32\Tasks\Microsoft\Windows\SideShow\SessionAgent => {45F26E9E-6199-477F-85DA-AF1EDfE067B1}
Task: {486D715E-6AA2-44CF-BC48-B6990CBB53C6} - System32\Tasks\Microsoft\Windows\Shell\WindowsParentalControlsMigration => {343D770D-7788-47c2-B62A-B7C4CED925CB}
Task: {48D095EE-D533-4ECA-B321-19714981E5CE} - System32\Tasks\Microsoft\VisualStudio\Updates\BackgroundDownload => C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe [65448 2021-08-15] (Microsoft Corporation -> Microsoft)
Task: {5091D259-3F74-443A-BEB2-35CA187779D2} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe /DoReindexSearchRoot (Keine Datei)
Task: {59D8B55B-306C-43FD-9599-49C382F2D4C8} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe /DoConfigureInternetTimeService (Keine Datei)
Task: {59F85656-A527-4D2B-9E75-1F5ADDAD7211} - System32\Tasks\Opera scheduled Autoupdate 1632150877 => C:\Users\System_X\AppData\Local\Programs\Opera\launcher.exe [2265296 2021-11-17] (Opera Software AS -> Opera Software)
Task: {5A38F845-D5F0-4380-AA12-4FBCA1B9E536} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2110.6-0\MpCmdRun.exe [901056 2021-11-02] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {5AF599F0-AA7E-4A5C-8A42-722A8BC61A98} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe /DRMInit (Keine Datei)
Task: {5B42DD9C-5A26-4F27-BB95-34603F0997E5} - System32\Tasks\Microsoft\Windows\Shell\WindowsParentalControls => {DFA14C43-F385-4170-99CC-1B7765FA0E4A}
Task: {64CD4591-8EB0-4DF9-94AA-073F5155298E} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe /OCURActivate (Keine Datei)
Task: {691DE101-A7AB-4F9F-9D2D-C8C167EC01F3} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0) (Keine Datei)
Task: {838E21D7-D24B-4BA1-9764-100706BCFC11} - System32\Tasks\Opera scheduled assistant Autoupdate 1632150902 => C:\Users\System_X\AppData\Local\Programs\Opera\launcher.exe [2265296 2021-11-17] (Opera Software AS -> Opera Software) -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\System_X\AppData\Local\Programs\Opera\assistant" $(Arg0)
Task: {863256B1-F406-4F2F-B5A9-6C54148173E3} - System32\Tasks\Microsoft\Windows\SideShow\AutoWake => {E51DFD48-AA36-4B45-BB52-E831F02E8316}
Task: {88C4F2D3-C9E0-4050-AA65-FA8E617F0F64} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2110.6-0\MpCmdRun.exe [901056 2021-11-02] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {907E0625-B84C-49E3-BA4E-B30A51DAF844} - System32\Tasks\Opera scheduled Autoupdate 1606677923 => C:\Users\System_X\AppData\Local\Programs\Opera\launcher.exe [2265296 2021-11-17] (Opera Software AS -> Opera Software)
Task: {913F802F-78E4-450A-89C1-AE381D3A18F1} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0) (Keine Datei)
Task: {A0CD771A-0858-4EE9-A7A3-16ABB77187A4} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery (Keine Datei)
Task: {A1522808-0229-4A44-B21E-CA519029ACE2} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe -pscn 0 (Keine Datei)
Task: {A3510081-EC92-4B1E-B414-E33168FAD994} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -PvrRecoveryTask (Keine Datei)
Task: {A354C02A-B276-4D0D-A937-76AE142A38AA} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0) (Keine Datei)
Task: {AAE250E8-2F44-4F4A-A416-3F682C1492EA} - System32\Tasks\Microsoft\Windows\SideShow\SystemDataProviders => {7CCA6768-8373-4D28-8876-83E8B4E3A969}
Task: {ABCBA117-4A6F-4E81-906D-C68663EC0846} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe /RestartRecording (Keine Datei)
Task: {B0CBAB43-44FC-469B-A4CE-87426761FDCE} - System32\Tasks\Microsoft\Windows\PerfTrack\BackgroundConfigSurveyor => {EA9155A3-8A39-40b4-8963-D3C761B18371}
Task: {B10D0B96-ED6A-4AA8-9938-F55140C4B876} - System32\Tasks\Microsoft\Windows\End Of Support\Notify2 => C:\WINDOWS\system32\sipnotify.exe -Daily (Keine Datei)
Task: {B36237EB-5AE1-498B-8333-C4535D78B16E} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2110.6-0\MpCmdRun.exe [901056 2021-11-02] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {B7107D6F-22C8-40F0-AC2A-2EB02F024C05} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2110.6-0\MpCmdRun.exe [901056 2021-11-02] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {BBD5EC7A-C32F-408B-99A3-692A4C3A73C1} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -MediaCenterRecoveryTask (Keine Datei)
Task: {BF439720-ADEF-4777-BC72-CC3D8395C6F2} - System32\Tasks\MicrosoftEdgeUpdateTaskMachineUA => C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe /ua /installsource scheduler (Keine Datei)
Task: {C0E34E4F-931B-4697-BF4E-8B9C66E77A1F} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [682936 2021-11-06] (Mozilla Corporation -> Mozilla Foundation)
Task: {C4B471D5-D41B-45F4-ABE8-1BF468B7D8A4} - System32\Tasks\Microsoft\Windows\SideShow\GadgetManager => {FF87090D-4A9A-4f47-879B-29A80C355D61}
Task: {C5A8994C-A705-4DA2-8431-16F886BD50A2} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery (Keine Datei)
Task: {C8488067-87F4-4BBC-9883-B2067827F866} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe -SqlLiteRecoveryTask (Keine Datei)
Task: {CF785A90-CA7C-4665-A2A8-541FDE58FE36} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0) (Keine Datei)
Task: {DADDC033-B572-44BF-A2EC-134A61192EAD} - System32\Tasks\SSTP-Dienst Bluetooth-Unterstützungsdienst AMD => C:\Program Files (x86)\nodejs\node.exe [15017624 2017-05-02] (Node.js Foundation -> Node.js) -> "C:\ProgramData\Package Cache\{18396527-5707-4C95-89A2-C097DF9CC3C5}\{64414CC8-6783-4E72-965B-AE079BFA8815}" <==== ACHTUNG
Task: {DD258411-0DE9-4708-BD0E-E8A8DD92911A} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0) (Keine Datei)
Task: {E788E000-AD0F-41EF-B237-6EE8C5E355BA} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe /PBDADiscovery (Keine Datei)
Task: {FCA58B57-E2BA-43BE-82A4-38DB5CAC7BC8} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe $(Arg0) (Keine Datei)
Task: {FF7F4CF0-F051-4A62-8B81-7413F247FB48} - System32\Tasks\AMD Updater => C:\Program Files\AMD\CIM\\Bin64\InstallManagerApp.exe [10219208 2016-02-26] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\..\Interfaces\{7372BD0F-B956-43F7-AAD3-3B12560909F5}: [NameServer] 1.1.1.1,8.8.8.8
Tcpip\..\Interfaces\{7372BD0F-B956-43F7-AAD3-3B12560909F5}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{a34a4a30-5977-432f-a131-8a086ca375a9}: [NameServer] 103.86.96.100,103.86.99.100
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\System_X\AppData\Local\Microsoft\Edge\User Data\Default [2021-11-21]
Edge Extension: (Malwarebytes Browser Guard) - C:\Users\System_X\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ihcjicgdanjaechkgeegckofjjedodee [2021-11-18]
Edge HKLM-x32\...\Edge\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
FireFox:
========
FF DefaultProfile: avtxbt0o.default
FF ProfilePath: C:\Users\System_X\AppData\Roaming\Mozilla\Firefox\Profiles\avtxbt0o.default [2021-11-21]
FF user.js: detected! => C:\Users\System_X\AppData\Roaming\Mozilla\Firefox\Profiles\avtxbt0o.default\user.js [2021-11-21]
FF Homepage: Mozilla\Firefox\Profiles\avtxbt0o.default -> hxxps://myfiresearch.com/homepage?hp=1&bitmask=9996&pId=JD180501&iDate=2021-10-15 05:14:31&bName=
FF NewTab: Mozilla\Firefox\Profiles\avtxbt0o.default -> hxxps://myfiresearch.com/homepage?hp=1&bitmask=9996&pId=JD180501&iDate=2021-10-15 05:14:31&bName=
FF ProfilePath: C:\Users\System_X\AppData\Roaming\Mozilla\Firefox\Profiles\w6ywzn9z.default-release [2021-11-21]
FF user.js: detected! => C:\Users\System_X\AppData\Roaming\Mozilla\Firefox\Profiles\w6ywzn9z.default-release\user.js [2021-11-21]
FF DownloadDir: F:\backupMaxtor80gb\data\installationen
FF Homepage: Mozilla\Firefox\Profiles\w6ywzn9z.default-release -> hxxps://myfiresearch.com/homepage?hp=1&bitmask=9996&pId=JD180501&iDate=2021-10-15 05:14:31&bName=
FF NewTab: Mozilla\Firefox\Profiles\w6ywzn9z.default-release -> hxxps://myfiresearch.com/homepage?hp=1&bitmask=9996&pId=JD180501&iDate=2021-10-15 05:14:31&bName=
FF Session Restore: Mozilla\Firefox\Profiles\w6ywzn9z.default-release -> ist aktiviert.
FF Notifications: Mozilla\Firefox\Profiles\w6ywzn9z.default-release -> hxxps://www.waz.de; hxxps://www.wetter.com; hxxps://www.finanztrends.de; hxxps://www.instagram.com; hxxps://otupia.de; hxxps://deno-licina.com; hxxps://get-huusk.com; hxxps://www.chess.com; hxxps://tours.comewithyou.com; hxxps://www.francesoir.fr; hxxps://www.giga.de; hxxps://web.whatsapp.com; hxxps://tinder.com; hxxps://lichess.org; hxxps://www.braunschweiger-zeitung.de
FF Extension: (AdBlock*– der beste Ad-Blocker) - C:\Users\System_X\AppData\Roaming\Mozilla\Firefox\Profiles\w6ywzn9z.default-release\Extensions\jid1-NIfFY2CA8fy1tg@jetpack.xpi [2021-10-28]
FF Extension: (MyJDownloader Browser Erweiterung) - C:\Users\System_X\AppData\Roaming\Mozilla\Firefox\Profiles\w6ywzn9z.default-release\Extensions\jid1-OY8Xu5BsKZQa6A@jetpack.xpi [2021-06-25] [UpdateUrl:hxxps://my.jdownloader.org/extensions/firefox.json]
FF Extension: (DuckDuckGo Privacy Essentials) - C:\Users\System_X\AppData\Roaming\Mozilla\Firefox\Profiles\w6ywzn9z.default-release\Extensions\jid1-ZAdIEUB7XOzOJw@jetpack.xpi [2021-10-02]
FF Extension: (Tab Slideshow WE) - C:\Users\System_X\AppData\Roaming\Mozilla\Firefox\Profiles\w6ywzn9z.default-release\Extensions\{ff4c3ef4-7337-4e7f-aa99-77ed911ef8b1}.xpi [2021-11-09]
FF SearchPlugin: C:\Users\System_X\AppData\Roaming\Mozilla\Firefox\Profiles\w6ywzn9z.default-release\searchplugins\My Firefox Search.xml [2021-10-15]
FF HKLM\...\Firefox\Extensions: [{B0A88BA0-6B78-426A-BE8E-571E7D259955}] - C:\WINDOWS\Installer\{3595F20C-BA29-4233-8505-544AB557FF27}\{B0A88BA0-6B78-426A-BE8E-571E7D259955}.xpi
FF Extension: ( ) - C:\WINDOWS\Installer\{3595F20C-BA29-4233-8505-544AB557FF27}\{B0A88BA0-6B78-426A-BE8E-571E7D259955}.xpi [2021-11-21]
FF HKLM-x32\...\Firefox\Extensions: [{B0A88BA0-6B78-426A-BE8E-571E7D259955}] - C:\WINDOWS\Installer\{3595F20C-BA29-4233-8505-544AB557FF27}\{B0A88BA0-6B78-426A-BE8E-571E7D259955}.xpi
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2020-11-23] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.cpdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2020-11-23] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2020-11-23] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2020-11-23] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2020-11-23] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> F:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2020-11-23] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.cpdf -> F:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2020-11-23] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> F:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2020-11-23] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> F:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2020-11-23] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> F:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2020-11-23] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @videolan.org/vlc,version=3.0.14 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2021-05-10] (VideoLAN -> VideoLAN)
Chrome:
=======
CHR Profile: C:\Users\System_X\AppData\Local\Google\Chrome\User Data\Default [2021-08-11]
CHR Extension: (Foxit PDF Creator) - C:\Users\System_X\AppData\Local\Google\Chrome\User Data\Default\Extensions\cifnddnffldieaamihfkhkdgnbhfmaci [2021-04-06]
CHR Extension: (Cookie Watch) - C:\Users\System_X\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmogeohlpljgihhbafbnincahfmafbfn [2021-05-28]
CHR Extension: (AD&POP Block) - C:\Users\System_X\AppData\Local\Google\Chrome\User Data\Default\Extensions\mknlngfeicgfpljigaaeohppjdiaalid [2021-06-02]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\System_X\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-04-01]
CHR Extension: (Chrome Media Router) - C:\Users\System_X\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2021-08-03]
CHR HKLM\...\Chrome\Extension: [cifnddnffldieaamihfkhkdgnbhfmaci] - C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\Creator\ChromeAddin\ChromeAddin.crx [2020-11-23]
CHR HKLM-x32\...\Chrome\Extension: [cifnddnffldieaamihfkhkdgnbhfmaci] - C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\plugins\Creator\ChromeAddin\ChromeAddin.crx [2020-11-23]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
Opera:
=======
OPR Profile: C:\Users\System_X\AppData\Roaming\Opera Software\Opera Stable [2021-11-15]
OPR Notifications: Opera Stable -> hxxps://mugrikees.com; hxxps://www.facebook.com; hxxps://www.giga.de; hxxps://www.youtube.com
OPR DefaultSuggestURL: Opera Stable -> hxxps://www.google.com/complete/search?client=opera&q={searchTerms}&ie={inputEncoding}&oe={outputEncoding}
OPR Extension: (Rich Hints Agent) - C:\Users\System_X\AppData\Roaming\Opera Software\Opera Stable\Extensions\enegjkbbakeegngfapepobipndnebkdk [2021-11-14]
OPR Extension: (Amazon Assistant Promotion) - C:\Users\System_X\AppData\Roaming\Opera Software\Opera Stable\Extensions\kbmoiomgmchbpihhdpabemajcbjpcijk [2021-09-20]
OPR Extension: (Amazon Assistant für Opera) - C:\Users\System_X\AppData\Roaming\Opera Software\Opera Stable\Extensions\mmmbddcnnndpbdflpccgcknaaabgldak [2021-09-20]
==================== Dienste (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-03] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert]
R2 DCIService; C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe [3413424 2021-11-18] (Lavasoft Software Canada Inc. -> )
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [242176 2009-08-07] () [Datei ist nicht signiert]
R2 FileZilla Server; C:\Program Files (x86)\FileZilla Server\FileZilla Server.exe [859304 2017-02-08] (Tim Kosse -> FileZilla Project)
R2 FoxitPhantomPDFUpdateService; C:\Program Files (x86)\Foxit Software\Foxit PhantomPDF\FoxitPhantomPDFUpdateService.exe [2357936 2020-11-23] (FOXIT SOFTWARE INC. -> Foxit Software Inc.)
R2 FoxitReaderUpdateService; F:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitReaderUpdateService.exe [2357936 2020-11-23] (FOXIT SOFTWARE INC. -> Foxit Software Inc.)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [445432 2021-04-19] (Canon Inc. -> )
S3 LxssManagerUser; C:\WINDOWS\system32\lxss\wslclient.dll [304640 2021-11-12] (Microsoft Windows -> Microsoft Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [7477704 2021-08-11] (Malwarebytes Inc -> Malwarebytes)
R2 nordvpn-service; C:\Program Files\NordVPN\nordvpn-service.exe [280440 2021-06-06] (nordvpn s.a. -> TEFINCOM S.A.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [6103464 2021-11-12] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [12757520 2020-12-14] (TeamViewer Germany GmbH -> TeamViewer Germany GmbH)
S3 VSStandardCollectorService150; C:\Program Files (x86)\Microsoft Visual Studio\Shared\Common\DiagnosticsHub.Collection.Service\StandardCollector.Service.exe [147392 2019-04-30] (Microsoft Corporation -> Microsoft Corporation)
R2 WCAssistantService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe [22960 2021-11-18] (Lavasoft Software Canada Inc. -> )
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2110.6-0\NisSrv.exe [2872024 2021-11-02] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2110.6-0\MsMpEng.exe [128376 2021-11-02] (Microsoft Windows Publisher -> Microsoft Corporation)
S4 edgeupdate; "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc [X]
S4 edgeupdatem; "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)
S2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices, Inc. -> Advanced Micro Devices)
R2 APXACC; C:\WINDOWS\system32\DRIVERS\appexDrv.sys [229056 2015-04-03] (AppEx Networks Corporation -> AppEx Networks Corporation)
R2 BdDci; C:\WINDOWS\system32\DRIVERS\bddci.sys [367096 2021-10-15] (Bitdefender SRL -> Bitdefender)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [279040 2019-12-07] (Microsoft Corporation) [Datei ist nicht signiert]
S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [144896 2019-12-07] (Microsoft Corporation) [Datei ist nicht signiert]
R2 DRHARD64; C:\WINDOWS\system32\drivers\DRHARD64.sys [21984 2011-11-03] (Peter A. Gebhard Softwareentwicklung -> Licensed for Gebhard Software)
R2 DRHMSR64; C:\WINDOWS\system32\drivers\DRHMSR64.sys [13760 2013-07-21] (Peter A. Gebhard Softwareentwicklung -> )
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [220752 2021-08-14] (Malwarebytes Inc -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2021-08-11] (Microsoft Windows Early Launch Anti-Malware Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2021-08-13] (Malwarebytes Inc -> Malwarebytes)
R2 NDivert; C:\WINDOWS\System32\drivers\NDivert.sys [105184 2021-05-17] (TEFINCOM S.A. -> )
S3 nlwt; C:\WINDOWS\system32\DRIVERS\nlwt.sys [39360 2021-06-07] (TEFINCOM S.A. -> WireGuard LLC)
R1 nordlwf; C:\WINDOWS\system32\DRIVERS\nordlwf.sys [38608 2020-12-14] (TEFINCOM S.A. -> TEFINCOM S.A.)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [167280 2020-11-11] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R3 tapnordvpn; C:\WINDOWS\System32\drivers\tapnordvpn.sys [44896 2020-06-09] (TEFINCOM S.A. -> The OpenVPN Project)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [48520 2021-11-02] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [435424 2021-11-02] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [86240 2021-11-02] (Microsoft Windows -> Microsoft Corporation)
R3 wintun; C:\WINDOWS\system32\DRIVERS\wintun.sys [29680 2021-10-07] (Microsoft Windows Hardware Compatibility Publisher -> WireGuard LLC)
S3 DRHARD; \??\C:\WINDOWS\system32\DRIVERS\DRHARD.SYS [X]
S3 GPU-Z-v2; \??\C:\Users\System_X\AppData\Local\Temp\GPU-Z-v2.sys [X] <==== ACHTUNG
U3 idsvc; kein ImagePath
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2021-11-21 19:46 - 2021-11-21 19:47 - 000031653 _____ C:\Users\System_X\Desktop\FRST.txt
2021-11-21 19:38 - 2021-11-21 19:36 - 002311680 _____ (Farbar) C:\Users\System_X\Desktop\FRST64(1).exe
2021-11-21 19:31 - 2021-11-21 19:31 - 000000022 _____ C:\WINDOWS\S.dirmngr
2021-11-12 15:17 - 2021-11-12 15:17 - 000151352 _____ C:\WINDOWS\system32\nmscrub.exe
2021-11-12 15:16 - 2021-11-12 15:16 - 000223744 _____ C:\WINDOWS\SysWOW64\TpmTool.exe
2021-11-12 15:16 - 2021-11-12 15:16 - 000060928 _____ C:\WINDOWS\system32\runexehelper.exe
2021-11-12 15:16 - 2021-11-12 15:16 - 000011363 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2021-11-12 15:15 - 2021-11-12 15:15 - 000272384 _____ C:\WINDOWS\system32\TpmTool.exe
2021-11-12 14:06 - 2021-11-12 14:06 - 000000000 ___HD C:\$WinREAgent
2021-11-10 12:43 - 2021-11-10 12:45 - 000000000 ____D C:\abc
2021-11-06 13:46 - 2021-11-06 13:46 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2021-11-05 19:25 - 2021-11-05 19:25 - 000004454 _____ C:\WINDOWS\system32\Tasks\AnwendungsinformationenSmartlocker-FiltertreiberAnwendungsverwaltung
2021-11-05 19:24 - 2021-11-21 19:34 - 000001152 __RSH C:\ProgramData\ntuser.pol
2021-11-04 16:58 - 2021-11-04 16:59 - 101470711 _____ C:\Users\System_X\Ich bleib so scheiße, wie ich binteil2.rar
2021-11-03 15:29 - 2021-11-03 15:29 - 000001156 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Check.lnk
2021-11-03 15:29 - 2021-11-03 15:29 - 000000000 ____D C:\Program Files\PCHealthCheck
2021-11-02 21:34 - 2021-11-21 19:34 - 000000000 ____D C:\Program Files\Mozilla Firefox
2021-10-31 11:51 - 2021-10-31 11:51 - 000000000 _____ C:\ProgramData\UpdateLock-F5BE94A0743D7D60
2021-10-30 20:48 - 2021-10-30 20:48 - 000001120 _____ C:\Users\Public\Desktop\AAX Audio Converter.lnk
2021-10-30 20:48 - 2021-10-30 20:48 - 000000000 ____D C:\Users\System_X\AppData\Local\audiamus
2021-10-30 20:48 - 2021-10-30 20:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\audiamus
2021-10-30 20:48 - 2021-10-30 20:48 - 000000000 ____D C:\Program Files\audiamus
2021-10-30 20:45 - 2021-10-30 20:45 - 000000000 ____D C:\Users\System_X\Documents\MiniTool uTube Downloader
2021-10-30 20:45 - 2021-10-30 20:45 - 000000000 ____D C:\Users\System_X\AppData\Local\MiniTool uTube Downloader
2021-10-30 20:39 - 2021-10-30 20:42 - 000000000 ____D C:\Users\System_X\AppData\Roaming\QtProject
2021-10-30 20:38 - 2021-10-30 20:38 - 000001318 _____ C:\Users\Public\Desktop\MiniTool Video Converter.lnk
2021-10-30 20:38 - 2021-10-30 20:38 - 000000000 ____D C:\Users\System_X\Documents\MiniTool Video Converter
2021-10-30 20:38 - 2021-10-30 20:38 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiniTool Video Converter
2021-10-30 20:37 - 2021-10-30 20:45 - 000000000 ____D C:\Users\System_X\AppData\Local\MiniTool Video Converter
2021-10-30 20:37 - 2021-10-30 20:38 - 000000000 ____D C:\Program Files (x86)\MiniTool Video Converter
2021-10-30 20:37 - 2021-08-11 07:23 - 097788240 _____ (MiniTool ) C:\Users\System_X\Downloads\vc-free.exe
2021-10-30 20:04 - 2021-10-30 20:04 - 000000000 ____D C:\Users\System_X\Documents\Audible
2021-10-22 20:18 - 2021-11-14 13:37 - 000000000 ____D C:\Users\System_X\AppData\Roaming\WhatsApp
2021-10-22 20:18 - 2021-10-22 20:18 - 000002222 _____ C:\Users\System_X\Desktop\WhatsApp.lnk
2021-10-22 20:18 - 2021-10-22 20:18 - 000000000 ____D C:\Users\System_X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WhatsApp
2021-10-22 20:17 - 2021-11-14 12:19 - 000000000 ____D C:\Users\System_X\AppData\Local\WhatsApp
2021-10-22 20:17 - 2021-10-22 20:18 - 000000000 ____D C:\Users\System_X\AppData\Local\SquirrelTemp
==================== Ein Monat (geänderte) ==================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2021-11-21 19:47 - 2021-09-23 14:52 - 000000000 ____D C:\FRST
2021-11-21 19:36 - 2021-03-28 16:09 - 001930124 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2021-11-21 19:36 - 2019-12-07 15:51 - 000821510 _____ C:\WINDOWS\system32\perfh007.dat
2021-11-21 19:36 - 2019-12-07 15:51 - 000183344 _____ C:\WINDOWS\system32\perfc007.dat
2021-11-21 19:36 - 2019-12-07 10:13 - 000000000 ____D C:\WINDOWS\INF
2021-11-21 19:34 - 2020-11-26 15:05 - 000000000 ____D C:\Users\System_X\AppData\LocalLow\Mozilla
2021-11-21 19:32 - 2021-03-28 16:16 - 000000000 ___RD C:\Users\System_X\OneDrive
2021-11-21 19:31 - 2021-09-04 11:07 - 000001134 _____ C:\WINDOWS\system32\config\VSMIDK
2021-11-21 19:31 - 2021-03-28 16:05 - 000008192 ___SH C:\DumpStack.log.tmp
2021-11-21 19:31 - 2020-12-23 21:17 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2021-11-21 19:31 - 2020-11-19 00:51 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2021-11-21 19:31 - 2019-12-07 10:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2021-11-21 19:30 - 2019-12-07 10:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2021-11-21 15:30 - 2020-11-18 23:50 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2021-11-21 15:01 - 2019-12-07 10:14 - 000000000 ___HD C:\Program Files\WindowsApps
2021-11-21 15:01 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2021-11-20 16:49 - 2021-03-28 16:16 - 000003376 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2965983169-4173802632-674656348-1000
2021-11-20 16:49 - 2021-03-28 16:10 - 000002414 _____ C:\Users\System_X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-11-19 14:28 - 2020-11-26 15:05 - 000000000 ____D C:\ProgramData\Mozilla
2021-11-18 20:11 - 2020-11-19 00:54 - 000000000 ____D C:\ProgramData\Packages
2021-11-18 15:29 - 2021-09-20 16:15 - 000004232 _____ C:\WINDOWS\system32\Tasks\Opera scheduled Autoupdate 1632150877
2021-11-18 15:29 - 2021-09-20 16:14 - 000001424 _____ C:\Users\System_X\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera-Browser.lnk
2021-11-17 18:08 - 2021-06-02 16:02 - 000000000 ____D C:\Users\System_X\AppData\Roaming\vlc
2021-11-16 20:03 - 2021-03-28 16:10 - 000000000 ____D C:\Users\System_X
2021-11-15 17:34 - 2020-11-18 23:50 - 000301024 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2021-11-15 17:32 - 2021-09-04 11:06 - 000000000 ___SD C:\WINDOWS\SysWOW64\lxss
2021-11-15 17:32 - 2021-09-04 11:06 - 000000000 ___SD C:\WINDOWS\system32\lxss
2021-11-15 17:32 - 2019-12-07 15:54 - 000000000 ___SD C:\WINDOWS\system32\AppV
2021-11-15 17:32 - 2019-12-07 15:54 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2021-11-15 17:32 - 2019-12-07 10:14 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2021-11-15 17:32 - 2019-12-07 10:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2021-11-15 17:32 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2021-11-15 17:32 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2021-11-15 17:32 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SystemResources
2021-11-15 17:32 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\setup
2021-11-15 17:32 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2021-11-15 17:32 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\Dism
2021-11-15 17:32 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\ShellExperiences
2021-11-15 17:32 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2021-11-15 17:32 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2021-11-15 17:32 - 2019-12-07 10:03 - 000000000 ____D C:\WINDOWS\servicing
2021-11-12 15:22 - 2019-12-07 10:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2021-11-10 08:24 - 2020-11-27 21:11 - 000000000 ____D C:\WINDOWS\system32\MRT
2021-11-10 08:18 - 2020-11-27 21:11 - 141529560 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2021-11-08 17:13 - 2020-11-26 15:05 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2021-11-06 13:46 - 2020-11-26 15:05 - 000000936 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2021-11-05 19:24 - 2020-11-19 00:53 - 000003688 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2021-11-05 19:24 - 2020-11-19 00:53 - 000003464 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2021-11-05 19:24 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2021-11-05 19:24 - 2009-07-14 04:20 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2021-11-02 20:49 - 2020-11-19 00:51 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2021-10-31 10:39 - 2020-11-19 00:53 - 000002446 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2021-10-31 10:39 - 2020-11-19 00:53 - 000002284 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk
2021-10-30 19:37 - 2021-03-31 16:08 - 000000000 ____D C:\Users\System_X\AppData\Local\PlaceholderTileLogoFolder
2021-10-30 19:37 - 2021-03-28 16:13 - 000000000 ____D C:\Users\System_X\AppData\Local\Packages
2021-10-26 17:26 - 2021-06-08 17:22 - 000000000 ____D C:\Users\System_X\AppData\Roaming\TS3Client
2021-10-25 16:53 - 2021-08-18 13:03 - 000000000 ____D C:\Users\System_X\AppData\Local\CrashDumps
2021-10-22 21:27 - 2020-11-27 17:08 - 000000000 ____D C:\Users\System_X\AppData\Roaming\Electrum
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========
2021-09-04 16:38 - 2021-09-13 10:09 - 000000128 _____ () C:\Users\System_X\AppData\Roaming\winscp.rnd
2021-09-04 16:56 - 2021-09-13 10:21 - 000000128 _____ () C:\Users\System_X\AppData\Local\PUTTY.RND
==================== SigCheck ============================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
==================== Ende von FRST.txt ========================
21.11.2021, 20:00
Baum-Darstellung