Win10 - suspekte Vorgänge nach Warnung zip mit Troj + Malware, Mail von Freundin?

1. Freundin sendet mir eine Mail mit Links zu https://seafile.rlp.net/ - Universität Space.
Die Seite verpackt Downloads in ZIP (ein Prozess auf der Seite selbst) gibt aber auch einen Ordner mit WAV Audio Files...die downloads werden von FF gemeldet als Trojaner / Maleware (s.u.). Und die Audio Files konnte man auch so laden. Die anderen Files wurden nicht geladen von FF...denk ich.

2. Konnte ich nicht recht glauben, Also hab ich in einem Ordner von der Seite eine WAV Audio geladen, 53 MB (es gab 3 davon)...nach dem Download ließ diese sich nicht in VLC öffnen, keine Meldungen hier....vielleicht nur VLC Anwendungsfehler

3. Wollte dann in einem vorhandenen Linux Mint Dualboot (LUKS) die Files ziehen und prüfen, aber ich komme nicht rein, die Passphrase wäre falsch - das kann ich wohl wegwerfen und konnte es kaum glauben :heulen:

4. Weil unsicher, nochmal schnell neues Malwarbytes gesaugt und Virtual Box mit Mint XFCE -> diese Torrent in Brave gesaugt.

5. Es ploppen Meldungen in Malwarbytes auf auf von Brave vermutlich vom Torrent:
         

-Protokolldetails-
Datum des Schutzereignisses: 10.04.23
Uhrzeit des Schutzereignisses: 20:12
Protokolldatei: ****40167ea5eebf.json

-Softwaredaten-
Version: 4.5.26.259
Komponentenversion: 1.0.1976
Version des Aktualisierungspakets: 1.0.67829
Lizenz: Testversion

-Systemdaten-
Betriebssystem: Windows 10 (Build 19043.2364)
CPU: x64
Dateisystem: NTFS
Benutzer: System

-Einzelheiten zu blockierten Websites-
Bösartige Website: 1
, C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe, Blockiert, -1, -1, 0.0.0, , 

-Website-Daten-
Kategorie: Schadsoftware
Domäne: 
IP-Adresse: 45.142.215.91
Port: 16881
Typ: Ausgehend
Datei: C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
(end)
         

Malwarebytes

-Protokolldetails-
Datum des Schutzereignisses: 10.04.23
Uhrzeit des Schutzereignisses: 20:12
Protokolldatei: 34b2df56-d7cb-11ed-a05e-40167ea5eebf.json

-Softwaredaten-
Version: 4.5.26.259
Komponentenversion: 1.0.1976
Version des Aktualisierungspakets: 1.0.67829
Lizenz: Testversion

-Systemdaten-
Betriebssystem: Windows 10 (Build 19043.2364)
CPU: x64
Dateisystem: NTFS
Benutzer: System

-Einzelheiten zu blockierten Websites-
Bösartige Website: 1
, C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe, Blockiert, -1, -1, 0.0.0, , 

-Website-Daten-
Kategorie: Trojaner
Domäne: 
IP-Adresse: 213.136.79.7
Port: 51413
Typ: Ausgehend
Datei: C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
(end)
         

Malwarebytes

-Protokolldetails-
Datum des Schutzereignisses: 10.04.23
Uhrzeit des Schutzereignisses: 20:11
Protokolldatei: 268b5b7e-d7cb-11ed-a089-40167ea5eebf.json

-Softwaredaten-
Version: 4.5.26.259
Komponentenversion: 1.0.1976
Version des Aktualisierungspakets: 1.0.67829
Lizenz: Testversion

-Systemdaten-
Betriebssystem: Windows 10 (Build 19043.2364)
CPU: x64
Dateisystem: NTFS
Benutzer: System

-Einzelheiten zu blockierten Websites-
Bösartige Website: 1
, C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe, Blockiert, -1, -1, 0.0.0, , 

-Website-Daten-
Kategorie: kompromittiert
Domäne: 
IP-Adresse: 212.3.216.120
Port: 51413
Typ: Ausgehend
Datei: C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
(end)
         

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 10-04-2023
durchgeführt von bumbum (Administrator) auf DESKTOP-ABCD (ASUS All Series) (10-04-2023 21:11:24)
Gestartet von T:\Folder\Downloads
Geladene Profile: bumbum
Plattform: Microsoft Windows 10 Pro Version 21H1 19043.2364 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: FF
Start-Modus: Normal

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSoftware.exe
(C:\Program Files (x86)\GlassWire\GWCtlSrv.exe ->) (GlassWire -> SecureMix LLC) C:\Program Files (x86)\GlassWire\GWIdlMon.exe
(C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe ->) (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\amdow.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(C:\Program Files\Sandboxie\SbieSvc.exe ->) (Tonalio GmbH -> Sandboxie-Plus.com) C:\Program Files\Sandboxie\SbieCtrl.exe
(C:\Windows\runSW.exe ->) (Realtek Semiconductor Corp -> Realtek) C:\Windows\SwUSB.exe
(Discord Inc. -> Discord Inc.) C:\Users\bumbum\AppData\Local\Discord\app-1.0.9012\Discord.exe <6>
(DriverStore\FileRepository\u0364232.inf_amd64_gujt\B364161\atiesrxx.exe ->) (Advanced Micro Devices, Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0364232.inf_amd64_gujt\B364161\atieclxx.exe
(explorer.exe ->) (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe
(explorer.exe ->) (F.lux Software LLC -> f.lux Software LLC) C:\Users\bumbum\AppData\Local\FluxSoftware\Flux\flux.exe
(explorer.exe ->) (GlassWire -> SecureMix LLC) C:\Program Files (x86)\GlassWire\GlassWire.exe
(explorer.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
(explorer.exe ->) (Mark of the Unicorn, Inc -> ) C:\Program Files (x86)\MOTU\Audio\MFWAKeys.exe
(explorer.exe ->) (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe <4>
(explorer.exe ->) (Oracle Corporation -> Oracle and/or its affiliates) C:\Program Files\Oracle\VirtualBox\VirtualBox.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <21>
(services.exe ->) (Advanced Micro Devices, Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0364232.inf_amd64_gujt\B364161\atiesrxx.exe
(services.exe ->) (Apache Software Foundation) [Datei ist nicht signiert] D:\Wiki\Lex\apache2\bin\httpd.exe <2>
(services.exe ->) (Apple Inc. -> Apple Inc.) C:\Program Files (x86)\i-Funbox DevTeam\Mobile Device Support\AppleMobileDeviceService.exe
(services.exe ->) (Apple Inc. -> Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(services.exe ->) (Christian Hermann -> ) C:\Program Files\Simple DNSCrypt x64\dnscrypt-proxy\dnscrypt-proxy.exe
(services.exe ->) (Dropbox, Inc -> Dropbox, Inc.) C:\Windows\System32\DbxSvc.exe
(services.exe ->) (GlassWire -> SecureMix LLC) C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
(services.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Mark of the Unicorn, Inc -> MOTU Inc.) C:\Program Files (x86)\MOTU\motuDNSResponder.exe
(services.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Program Files\Microsoft Update Health Tools\uhssvc.exe
(services.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Advanced Micro Devices, Inc.) C:\Windows\System32\amdfendrsr.exe
(services.exe ->) (MiniTool Software Limited -> ) C:\Program Files (x86)\MiniTool ShadowMaker\AgentService.exe
(services.exe ->) (MiniTool Software Limited -> ) C:\Program Files (x86)\MiniTool ShadowMaker\SchedulerService.exe
(services.exe ->) (Native Instruments GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(services.exe ->) (Oracle Corporation -> Oracle and/or its affiliates) C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe
(services.exe ->) (PACE Anti-Piracy, Inc. -> PACE Anti-Piracy, Inc.) C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe
(services.exe ->) (Razer USA Ltd. -> Razer Inc) C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe
(services.exe ->) (Realtek Semiconductor Corp -> ) C:\Windows\runSW.exe
(services.exe ->) (Synology Inc. -> ) C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(services.exe ->) (Tonalio GmbH -> Sandboxie-Plus.com) C:\Program Files\Sandboxie\SbieSvc.exe
(services.exe ->) (voidtools -> voidtools) C:\Program Files\Everything\Everything.exe <2>
(svchost.exe ->) (Dropbox, Inc -> Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(svchost.exe ->) (Microsoft Corporation -> ) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_11.2210.0.0_x64__8wekyb3d8bbwe\CalculatorApp.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Oracle Corporation -> Oracle and/or its affiliates) C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe
(TechSmith Corporation -> TechSmith Corporation) C:\Users\bumbum\AppData\Local\RelayRecorder\app-2.0.11\RelayRecorder.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [Everything] => C:\Program Files\Everything\Everything.exe [2262176 2021-12-16] (voidtools -> voidtools)
HKLM\...\Run: [Eraser] => C:\Program Files\Eraser\Eraser.exe [1070664 2021-02-12] (Heidi Computers Ltd -> The Eraser Project)
HKLM\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [3246992 2023-02-08] (Open Source Developer, Dominik Reichl -> Dominik Reichl)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [11327200 2023-04-04] (Dropbox, Inc -> Dropbox, Inc.)
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-605212111-1861643219-2958236025-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [39159608 2023-03-07] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
HKU\S-1-5-21-605212111-1861643219-2958236025-1001\...\Run: [f.lux] => C:\Users\bumbum\AppData\Local\FluxSoftware\Flux\flux.exe [1515848 2021-06-18] (F.lux Software LLC -> f.lux Software LLC)
HKU\S-1-5-21-605212111-1861643219-2958236025-1001\...\Run: [AMDDVR] => C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe [2496576 2021-02-17] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
HKU\S-1-5-21-605212111-1861643219-2958236025-1001\...\Run: [GlassWire] => C:\Program Files (x86)\GlassWire\glasswire.exe [9620880 2022-09-02] (GlassWire -> SecureMix LLC)
HKU\S-1-5-21-605212111-1861643219-2958236025-1001\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [3397584 2023-04-07] (Tonalio GmbH -> Sandboxie-Plus.com)
HKLM\...\Print\Monitors\EPSON ET-2650 Series 64MonitorBE: C:\WINDOWS\system32\E_YLMBRUE.DLL [182784 2015-12-09] (SEIKO EPSON CORPORATION) [Datei ist nicht signiert]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\111.0.5563.147\Installer\chrmstp.exe [2023-03-30] (Google LLC -> Google LLC)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}] -> C:\Program Files\BraveSoftware\Brave-Browser\Application\112.1.50.114\Installer\chrmstp.exe [2023-04-05] (Brave Software, Inc. -> Brave Software, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\MOTU Pedal Service.lnk [2021-12-20]
ShortcutTarget: MOTU Pedal Service.lnk -> C:\Program Files (x86)\MOTU\Audio\MFWAKeys.exe (Mark of the Unicorn, Inc -> )
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WavesLocalServer.lnk [2022-07-26]
ShortcutTarget: WavesLocalServer.lnk -> C:\ProgramData\Waves Audio\WavesLocalServer\WavesLocalServer.bundle\Contents\Win64\WavesLocalServer.exe (Waves Inc -> Waves Audio Ltd.)
GroupPolicy: Beschränkung ? <==== ACHTUNG
Policies: C:\ProgramData\NTUSER.pol: Beschränkung <==== ACHTUNG

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {11625C0E-FA32-47B7-9390-D28DE4866F34} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [714256 2023-03-07] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
Task: {1690CBBA-84C7-4CCF-9FA1-EDD325420C08} - System32\Tasks\CCleanerCrashReporting => C:\Program Files\CCleaner\CCleanerBugReport.exe [4703544 2023-03-07] (PIRIFORM SOFTWARE LIMITED -> Piriform Software) -> --product 90 --send dumps|report --path "C:\Program Files\CCleaner\LOG" --programpath "C:\Program Files\CCleaner" --configpath "C:\Program Files\CCleaner\Setup" --guid "523d0d81-1795-4dc8-80e5-220f7fd62d40" --version "6.10.10347" --silent
Task: {23B0D771-AF52-4862-8CCE-9E283FE7283F} - System32\Tasks\AMDInstallLauncher => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709320 2021-02-17] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
Task: {376E952F-571B-435C-91EC-405847D4352F} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [130320 2021-11-11] (Dropbox, Inc -> Dropbox, Inc.)
Task: {7BD5A1AF-1DF4-4B6F-9564-97767C9BFDCE} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [635296 2023-03-15] (Mozilla Corporation -> Mozilla Corporation) -> --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {81875E98-7B16-4E6F-95BB-B127FD946E40} - System32\Tasks\BraveSoftwareUpdateTaskMachineUA{44F82029-F42C-4BC4-8FF6-32D90650D3D8} => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [174976 2022-09-14] (Brave Software, Inc. -> BraveSoftware Inc.)
Task: {9234F701-BB4B-4A65-95C9-B5F8CC0DD01E} - System32\Tasks\CCleanerSkipUAC - bumbum => C:\Program Files\CCleaner\CCleaner.exe [33038648 2023-03-07] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
Task: {9DDE0149-08CD-4643-B9A2-AD838E1A5F25} - System32\Tasks\npcapwatchdog => C:\Program Files\Npcap\CheckStatus.bat [1145 2021-04-21] () [Datei ist nicht signiert]
Task: {A9A3F28A-6B5B-42F5-A0AB-09784DAC528B} - System32\Tasks\StartDVR => C:\Program Files\AMD\CNext\CNext\RSServCmd.exe [68160 2021-02-17] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
Task: {AADB46F3-5224-4D77-8531-4E4C7F8E2C02} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [130320 2021-11-11] (Dropbox, Inc -> Dropbox, Inc.)
Task: {AC54DC45-1B69-4C5C-90AA-E96E3FD60523} - System32\Tasks\AMDLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe [1709320 2021-02-17] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
Task: {B53D005D-8ADD-4337-9C94-8AA876F3B721} - System32\Tasks\StartCN => C:\Program Files\AMD\CNext\CNext\cncmd.exe [60480 2021-02-17] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
Task: {E1ECED45-E1B6-499A-B213-5E02A6A08B0C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155592 2020-10-31] (Google LLC -> Google LLC)
Task: {F0B04502-F457-45FE-B870-C2731FAC1D87} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [767392 2023-03-15] (Mozilla Corporation -> Mozilla Foundation)
Task: {F5068E6F-F2B8-4834-80D2-630D0EEBE97A} - System32\Tasks\BraveSoftwareUpdateTaskMachineCore{7EE0986F-D870-4FE6-A559-EAD0ED0FFC16} => C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [174976 2022-09-14] (Brave Software, Inc. -> BraveSoftware Inc.)
Task: {F7388C3D-2720-41FA-B364-89F634F4D8D1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [155592 2020-10-31] (Google LLC -> Google LLC)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\CCleanerCrashReporting.job => C:\Program Files\CCleaner\CCleanerBugReport.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\..\Interfaces\{db209a1a-9968-41a7-***}: [DhcpNameServer] 192.168.178.1

Edge: (wird nicht benutzt nur mit CCleaner gesäubert)
=======
DownloadDir: C:\Users\bumbum\Downloads
Edge Extension: (Kein Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [nicht gefunden]
Edge Extension: (Kein Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [nicht gefunden]
Edge Extension: (Kein Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [nicht gefunden]
Edge Extension: (Kein Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [nicht gefunden]
Edge Profile: C:\Users\bumbum\AppData\Local\Microsoft\Edge\User Data\Default [2023-04-10]

FireFox:
========
FF DefaultProfile: aaa.firefox.bbb
FF ProfilePath: C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccqg6.Stream [2023-04-10]
FF Extension: (Simple Translate) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccqg6.Stream\Extensions\simple-translate@sienori.xpi [2022-09-29]
FF Extension: (uBlock Origin) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccqg6.Stream\Extensions\uBlock0@raymondhill.net.xpi [2022-10-28]
FF ProfilePath: C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccfbj0r.firefox-blackbox-x907412 [2023-04-10]
FF DownloadDir: T:\Folder\Downloads
FF Extension: (Cookie AutoDelete) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\CookieAutoDelete@kennydo.com.xpi [2022-12-12]
FF Extension: (HTTPS Everywhere) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\https-everywhere@eff.org.xpi [2021-07-14]
FF Extension: (Decentraleyes) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\jid1-BoFifL9Vbdl2zQ@jetpack.xpi [2022-02-01]
FF Extension: (Link Gopher) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\linkgopher@oooninja.com.xpi [2021-09-14]
FF Extension: (Open Multiple URLs) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\openmultipleurls@ustat.de.xpi [2022-05-25]
FF Extension: (Simple Translate) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\simple-translate@sienori.xpi [2023-02-25]
FF Extension: (Skip Redirect) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\skipredirect@sblask.xpi [2022-03-11]
FF Extension: (Snap Links) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\snaplinks@snaplinks.mozdev.org.xpi [2021-09-15]
FF Extension: (TinEye Reverse Image Search) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\tineye@ideeinc.com.xpi [2023-02-23]
FF Extension: (uBlock Origin) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\uBlock0@raymondhill.net.xpi [2023-04-06]
FF Extension: (Startpage.com — Datenschutz-Suchmaschine) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\{20fc2e06-e3e4-4b2b-812b-ab431220cada}.xpi [2021-03-26]
FF Extension: (ClearURLs) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\{74145f27-f039-47ce-a470-a662b129930a}.xpi [2023-02-04]
FF Extension: (Return YouTube Dislike) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\{762f9885-5a13-4abd-9c77-433dcd38b8fd}.xpi [2023-03-12]
FF Extension: (User-Agent Switcher and Manager) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\{a6c4a591-f1b2-4f03-b3ff-767e5bedf4e7}.xpi [2022-12-24]
FF Extension: (Video DownloadHelper) - C:\Users\bumbum\AppData\Roaming\Mozilla\Firefox\Profiles\cccbj0r.firefox-blackbox-x907412\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2022-12-09]
FF Plugin: @videolan.org/vlc,version=3.0.11 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.14 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.16 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.18 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2022-11-08] (VideoLAN -> VideoLAN)

Chrome: (wird nicht benutzt nur mit CCleaner gesäubert)
=======
CHR Profile: C:\Users\bumbum\AppData\Local\Google\Chrome\User Data\Default [2023-04-10]
CHR Extension: (uBlock Origin) - C:\Users\bumbum\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2022-07-31]
CHR Extension: (Cookie AutoDelete) - C:\Users\bumbum\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhcgjolkccmbidfldomjliifgaodjagh [2022-07-31]
CHR Extension: (Neat URL) - C:\Users\bumbum\AppData\Local\Google\Chrome\User Data\Default\Extensions\jchobbjgibcahbheicfocecmhocglkco [2022-07-31]
CHR Extension: (Decentraleyes) - C:\Users\bumbum\AppData\Local\Google\Chrome\User Data\Default\Extensions\ldpochfccmkkmhdbclfhpagapcfdljkj [2022-07-31]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\bumbum\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-08-05]
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]

Opera:  (wird nicht benutzt nur mit CCleaner gesäubert)
=======
OPR Profile: C:\Users\bumbum\AppData\Roaming\Opera Software\Opera Stable [2023-04-10]
OPR DefaultSuggestURL: Opera Stable -> hxxps://www.google.com/complete/search?client=opera&q={searchTerms}&ie={inputEncoding}&oe={outputEncoding}
OPR Extension: (Rich Hints Agent) - C:\Users\bumbum\AppData\Roaming\Opera Software\Opera Stable\Extensions\enegjkbbakeegngfapepobipndnebkdk [2021-05-02]

Brave: 
=======
BRA DefaultProfile: Profile 1
BRA Profile: C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default [2023-04-10]
BRA Extension: (uBlock Origin) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2023-04-08]
BRA Extension: (Void Theme - Black and Minimal) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Extensions\kioklelcojgbjoljlilalgdcppkiioge [2023-01-15]
BRA Profile: C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\Guest Profile [2023-04-10]
BRA Profile: C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\Profile 1 [2023-04-10]
BRA Profile: C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\System Profile [2023-04-10]
BRA Extension: (Brave Local Data Files Updater) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\afalakplffnnnlkncjhbmahjfjhmlkal [2023-04-08]
BRA Extension: (Brave NTP background images) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\aoojcmojmmcbpfgoecoadbdpnagfchel [2022-09-14]
BRA Extension: (Brave Ad Block Updater (Fanboy's Mobile Notifications List (plaintext))) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\bfpgedeaaibpoidldhjcknekahbikncb [2023-04-10]
BRA Extension: (Wallet Data Files Updater) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\BraveWallet [2023-04-08]
BRA Extension: (Brave Ad Block Updater (Default)) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\cffkpbalmllkdoenhmdmpbkajipdjfam [2022-12-01]
BRA Extension: (Brave Tor Client Updater (Windows)) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\cpoalefficncklhjfpglfiplenlpccdb [2023-03-03]
BRA Extension: (Brave Ad Block Updater (EasyList Germany)) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\faknfgalcghekhfggcdikddilkpjbonh [2022-12-01]
BRA Extension: (Brave Ad Block Updater (Regional Catalog)) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\gkboaolpopklhgplhaaiboijnklogmbc [2023-04-08]
BRA Extension: (Brave Ad Block Updater (Default (plaintext))) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\iodkpdagapdfkphljnddpjlldadblomo [2023-04-10]
BRA Extension: (Brave SpeedReader Updater) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\jicbkmdloagakknpihibphagfckhjdih [2022-09-14]
BRA Extension: (Brave Ad Block Updater (EasyList Germany (plaintext))) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\lfmefmifdjlfneapckmpkinmlofjehbp [2023-04-10]
BRA Extension: (Brave Ad Block Updater (Resources)) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\mfddibmblmbccpadfndgakiopmmhebop [2023-04-08]
BRA Extension: (Brave Ad Block Updater (Fanboy Social List (plaintext))) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\nbkknaieglghmocpollinelcggiehfco [2023-04-10]
BRA Extension: (Brave Ad Block Updater (CJX's Annoyance List (plaintext))) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\npcnkjiaolpnapjleimicclmdcccoeme [2023-04-08]
BRA Extension: (Brave NTP sponsored images) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\obbokncgfcbepeipkhpdepjjoncelefj [2023-04-10]
BRA Extension: (Brave Ad Block Updater (Fanboy Annoyances List (plaintext))) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\omoaeaghhgmiojkeaemjkpkmelmalbgo [2023-04-10]
BRA Extension: (Brave HTTPS Everywhere Updater) - C:\Users\bumbum\AppData\Local\BraveSoftware\Brave-Browser\User Data\oofiananboodjbbmdelgdommihjbkfag [2023-04-08]

==================== Dienste (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 Apple Mobile Device Service; C:\Program Files (x86)\i-Funbox DevTeam\Mobile Device Support\AppleMobileDeviceService.exe [96056 2021-04-19] (Apple Inc. -> Apple Inc.)
S2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.02.00\atkexComSvc.exe [936456 2015-05-14] (Microsoft Windows Hardware Compatibility Publisher -> )
S2 brave; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [174976 2022-09-14] (Brave Software, Inc. -> BraveSoftware Inc.)
S3 bravem; C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe [174976 2022-09-14] (Brave Software, Inc. -> BraveSoftware Inc.)
S3 BraveVpnService; C:\Program Files\BraveSoftware\Brave-Browser\Application\112.1.50.114\brave_vpn_helper.exe [3018032 2023-04-05] (Brave Software, Inc. -> Brave Software, Inc.)
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [130320 2021-11-11] (Dropbox, Inc -> Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [130320 2021-11-11] (Dropbox, Inc -> Dropbox, Inc.)
R2 DbxSvc; C:\WINDOWS\system32\DbxSvc.exe [46824 2023-04-04] (Dropbox, Inc -> Dropbox, Inc.)
R2 dnscrypt-proxy; C:\Program Files\Simple DNSCrypt x64\dnscrypt-proxy\dnscrypt-proxy.exe [8109728 2020-03-30] (Christian Hermann -> )
R2 dokuwikiApache; D:\Wiki\Lex\apache2\bin\httpd.exe [29696 2020-04-22] (Apache Software Foundation) [Datei ist nicht signiert]
R2 Everything; C:\Program Files\Everything\Everything.exe [2262176 2021-12-16] (voidtools -> voidtools)
R2 GlassWire; C:\Program Files (x86)\GlassWire\GWCtlSrv.exe [6900112 2022-09-02] (GlassWire -> SecureMix LLC)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [9098608 2023-04-10] (Malwarebytes Inc. -> Malwarebytes)
R2 MOTU_ZeroConf; C:\Program Files (x86)\MOTU\motuDNSResponder.exe [426712 2021-10-01] (Mark of the Unicorn, Inc -> MOTU Inc.)
R2 MTAgentService; C:\Program Files (x86)\MiniTool ShadowMaker\AgentService.exe [783728 2021-12-20] (MiniTool Software Limited -> )
R2 MTSchedulerService; C:\Program Files (x86)\MiniTool ShadowMaker\SchedulerService.exe [228208 2021-12-20] (MiniTool Software Limited -> )
R2 Razer Game Manager Service; C:\Program Files (x86)\Razer\Razer Services\GMS\GameManagerService.exe [253776 2019-12-12] (Razer USA Ltd. -> Razer Inc)
S2 Razer Synapse Service; C:\Program Files (x86)\Razer\Synapse3\Service\Razer Synapse Service.exe [287472 2019-12-30] (Razer USA Ltd. -> Razer Inc.)
S3 Rockstar Service; C:\Program Files\Rockstar Games\Launcher\RockstarService.exe [2447152 2022-02-11] (Rockstar Games, Inc. -> Rockstar Games) [Datei ist nicht signiert]
R2 RunSwUSB; C:\Windows\runSW.exe [48856 2015-09-25] (Realtek Semiconductor Corp -> )
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [371152 2023-04-07] (Tonalio GmbH -> Sandboxie-Plus.com)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [224184 2022-12-17] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [253584 2021-12-14] (Synology Inc. -> )
R3 VBoxSDS; C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe [805224 2023-01-11] (Oracle Corporation -> Oracle and/or its affiliates)
S3 vncserver; C:\Program Files\RealVNC\VNC Server\vncserver.exe [7508232 2022-03-24] (RealVNC Ltd -> RealVNC)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2302.7-0\NisSrv.exe [3224328 2023-03-28] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2302.7-0\MsMpEng.exe [133544 2023-03-28] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 BraveElevationService; "C:\Program Files\BraveSoftware\Brave-Browser\Application\112.1.50.114\elevation_service.exe" [X]
R2 PaceLicenseDServices; "C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe" -u hxxps://activation.paceap.com/InitiateActivation

===================== Treiber (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R3 AMDXE; C:\WINDOWS\System32\drivers\amdxe.sys [62056 2020-07-27] (Advanced Micro Devices, Inc. -> Advanced Micro Devices, Inc.)
S3 AppleKmdfFilter; C:\WINDOWS\System32\drivers\AppleKmdfFilter.sys [20032 2020-10-09] (WDKTestCert build,132303256403278908 -> Apple Inc.)
S3 AppleLowerFilter; C:\WINDOWS\System32\drivers\AppleLowerFilter.sys [35976 2020-10-09] (WDKTestCert build,132303256403278908 -> Apple Inc.)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [287232 2022-06-16] (Microsoft Corporation) [Datei ist nicht signiert]
S3 busenum; C:\WINDOWS\System32\drivers\busenum.sys [57824 2012-08-03] (Synology Inc. -> Windows (R) Win 7 DDK provider)
S3 CorsairGamingAudioService; C:\Windows\System32\drivers\CorsairGamingAudio64.sys [60312 2021-01-11] (Microsoft Windows Hardware Compatibility Publisher -> Corsair Memory, Inc.)
R1 dokan1; C:\WINDOWS\System32\DRIVERS\dokan1.sys [104312 2018-08-09] (D3L -> Dokan Project)
R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [158640 2023-04-10] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R1 gwdrv; C:\WINDOWS\system32\DRIVERS\gwdrv.sys [33152 2015-05-29] (GlassWire -> SecureMix LLC)
S3 KOBRAKAHN; C:\WINDOWS\System32\drivers\KOBRAKAHN.sys [3859376 2020-10-26] (Microsoft Windows Hardware Compatibility Publisher -> C-MEDIA Inc.)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [223176 2023-04-10] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [21480 2023-04-10] (Microsoft Windows Early Launch Anti-Malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\DRIVERS\farflt.sys [198584 2023-04-10] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\system32\DRIVERS\mbam.sys [77736 2023-04-10] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [239544 2023-04-10] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMWebProtection; C:\WINDOWS\system32\DRIVERS\mwac.sys [181816 2023-04-10] (Malwarebytes Inc. -> Malwarebytes)
R3 MFWAMIDI64; C:\WINDOWS\system32\drivers\MFWAMIDI64.sys [45184 2021-10-01] (Mark of the Unicorn, Inc -> Mark of the Unicorn)
R3 MFWAWAVE64; C:\WINDOWS\system32\drivers\MFWAWAVE64.sys [84752 2015-07-14] (Mark of the Unicorn -> Mark of the Unicorn)
S3 MOSUMAC; C:\WINDOWS\System32\drivers\MOSUMAC.sys [57208 2014-03-26] (WDKTestCert Alex,130389727012273971 -> ASIX Electronics Corp.)
R3 motubus; C:\WINDOWS\system32\drivers\MotuBus64.sys [42096 2021-10-01] (Mark of the Unicorn, Inc -> Mark of the Unicorn)
R3 MotuFWA64; C:\WINDOWS\system32\drivers\Motufwa64.sys [661096 2021-10-01] (Mark of the Unicorn, Inc -> Mark of the Unicorn)
S3 MYFAULT; C:\WINDOWS\system32\drivers\myfault.sys [27848 2022-07-17] (Microsoft Windows Hardware Compatibility Publisher -> Sysinternals)
R1 npcap; C:\WINDOWS\system32\DRIVERS\npcap.sys [74744 2021-04-21] (Insecure.Com LLC -> Insecure.Com LLC.)
S4 npcap_wifi; C:\WINDOWS\system32\DRIVERS\npcap.sys [74744 2021-04-21] (Insecure.Com LLC -> Insecure.Com LLC.)
U5 PROCMON24; C:\Windows\System32\Drivers\PROCMON24.sys [90168 2022-07-17] (Microsoft Windows Hardware Compatibility Publisher -> Sysinternals - www.sysinternals.com)
R0 pwdrvio; C:\WINDOWS\System32\pwdrvio.sys [37336 2021-03-09] (MiniTool Solution Ltd -> )
S3 pwdspio; C:\WINDOWS\system32\pwdspio.sys [12504 2019-11-08] (MiniTool Solution Ltd -> )
R3 RzCommon; C:\WINDOWS\System32\drivers\RzCommon.sys [50240 2019-09-19] (Razer USA Ltd. -> Razer Inc)
R3 RzDev_005c; C:\WINDOWS\System32\drivers\RzDev_005c.sys [51992 2019-10-10] (Razer USA Ltd. -> Razer Inc)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [236032 2023-04-07] (Microsoft Windows Hardware Compatibility Publisher -> Sandboxie-Plus.com)
S3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [39920 2022-03-14] (Microsoft Windows Hardware Compatibility Publisher -> The OpenVPN Project)
R3 teVirtualMIDI64; C:\WINDOWS\System32\drivers\teVirtualMIDI64.sys [53120 2019-12-07] (Tobias Erichsen -> Tobias Erichsen)
S3 usbscan; C:\WINDOWS\system32\DRIVERS\usbscan.sys [49152 2021-03-20] (Microsoft Corporation) [Datei ist nicht signiert]
R3 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [254616 2023-01-11] (Oracle Corporation -> Oracle and/or its affiliates)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [265488 2023-01-11] (Oracle Corporation -> Oracle and/or its affiliates)
R1 VBoxSup; C:\WINDOWS\system32\DRIVERS\VBoxSup.sys [1061392 2023-01-11] (Oracle Corporation -> Oracle and/or its affiliates)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [825176 2021-11-21] (IDRIX SARL -> IDRIX)
U5 vsock; C:\Windows\System32\Drivers\vsock.sys [105912 2020-08-11] (VMware, Inc. -> VMware, Inc.)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [49608 2023-03-28] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [495896 2023-03-28] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [99624 2023-03-28] (Microsoft Windows -> Microsoft Corporation)
S3 WIMMount; C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\DISM\wimmount.sys [39736 2019-12-06] (Microsoft Windows -> Microsoft Corporation)
S3 wintun; C:\WINDOWS\system32\DRIVERS\wintun.sys [29680 2022-06-18] (Microsoft Windows Hardware Compatibility Publisher -> WireGuard LLC)
S3 netr28ux; \SystemRoot\System32\drivers\netr28ux.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2023-04-10 21:10 - 2023-04-10 21:11 - 000000000 ____D C:\FRST
2023-04-10 20:10 - 2023-04-10 20:10 - 000181816 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2023-04-10 20:06 - 2023-04-10 20:06 - 000002038 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2023-04-10 20:06 - 2023-04-10 20:06 - 000002026 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2023-04-10 20:01 - 2023-04-10 20:01 - 000000000 ____D C:\ProgramData\Malwarebytes
2023-04-10 19:35 - 2023-04-10 19:35 - 000001154 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2023-04-10 19:35 - 2023-04-10 19:35 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2023-04-10 19:35 - 2023-01-11 09:46 - 001061392 _____ (Oracle and/or its affiliates) C:\WINDOWS\system32\Drivers\VBoxSup.sys
2023-04-10 19:35 - 2023-01-11 09:46 - 000204216 _____ (Oracle and/or its affiliates) C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys
2023-04-10 19:34 - 2023-04-10 19:34 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2023-04-10 19:31 - 2023-04-10 19:32 - 110456840 _____ (Oracle and/or its affiliates) C:\Users\bumbum\Downloads\VirtualBox-7.0.6-155176-Win.exe
2023-04-08 05:45 - 2023-04-08 05:45 - 000002506 _____ C:\Users\bumbum\Desktop\Profile 1 - Brave.lnk
2023-04-08 03:13 - 2023-04-08 03:13 - 001713104 _____ C:\Users\bumbum\Desktop\enus_plus_dede_bilingual_dictionary-1.xpi
2023-04-06 17:32 - 2023-04-06 17:32 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2023-04-05 22:41 - 2023-04-05 22:41 - 000000000 ____D C:\ProgramData\BraveSoftware
2023-04-04 12:51 - 2023-04-04 12:51 - 000046824 _____ (Dropbox, Inc.) C:\WINDOWS\system32\DbxSvc.exe
2023-03-30 10:38 - 2023-04-03 05:47 - 000000000 ____D C:\Program Files\Mozilla Thunderbird
2023-03-15 16:30 - 2023-03-16 09:54 - 000000000 ____D C:\Program Files\Mozilla Firefox

==================== Ein Monat (geänderte) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2023-04-10 21:11 - 2022-09-23 22:38 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2023-04-10 21:03 - 2020-03-12 12:12 - 000000000 ____D C:\Users\bumbum\AppData\LocalLow\Mozilla
2023-04-10 20:28 - 2020-03-12 11:28 - 000000000 ____D C:\Users\bumbum\AppData\Roaming\Everything
2023-04-10 20:26 - 2020-04-21 09:01 - 000000000 ____D C:\Program Files (x86)\Google
2023-04-10 20:25 - 2020-03-21 15:42 - 000000000 ____D C:\Users\bumbum\AppData\Roaming\discord
2023-04-10 20:25 - 2020-03-21 15:42 - 000000000 ____D C:\Users\bumbum\AppData\Local\Discord
2023-04-10 20:25 - 2020-03-13 20:47 - 000000000 ____D C:\Program Files\CCleaner
2023-04-10 20:16 - 2021-08-21 09:29 - 000000000 ____D C:\Users\bumbum\VirtualBox VMs
2023-04-10 20:15 - 2021-06-11 21:48 - 000000000 ____D C:\Users\bumbum\.VirtualBox
2023-04-10 20:06 - 2019-12-07 11:14 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2023-04-10 20:03 - 2019-12-07 11:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2023-04-10 20:01 - 2020-03-14 10:08 - 000000000 ____D C:\Program Files\Malwarebytes
2023-04-10 19:49 - 2020-09-24 15:06 - 000000000 ____D C:\ProgramData\VirtualBox
2023-04-10 19:46 - 2022-12-29 04:55 - 000000000 ____D C:\Users\bumbum\AppData\Roaming\Element
2023-04-10 19:35 - 2019-12-07 11:13 - 000000000 ____D C:\WINDOWS\INF
2023-04-10 19:34 - 2022-11-03 21:45 - 000001780 _____ C:\WINDOWS\Sandboxie.ini
2023-04-10 19:34 - 2022-11-03 21:45 - 000000000 ____D C:\Program Files\Sandboxie
2023-04-10 19:32 - 2021-03-20 16:18 - 001723372 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2023-04-10 19:32 - 2019-12-07 16:51 - 000743838 _____ C:\WINDOWS\system32\perfh007.dat
2023-04-10 19:32 - 2019-12-07 16:51 - 000150260 _____ C:\WINDOWS\system32\perfc007.dat
2023-04-10 19:29 - 2023-01-25 18:51 - 000000000 ____D C:\Users\bumbum\AppData\Roaming\vlc
2023-04-10 19:28 - 2020-03-12 11:52 - 000000000 ____D C:\Users\bumbum\AppData\Local\CrashDumps
2023-04-10 19:24 - 2021-05-16 08:16 - 000008192 ___SH C:\DumpStack.log.tmp
2023-04-10 19:24 - 2021-03-20 16:14 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2023-04-10 19:24 - 2020-03-12 20:10 - 000000000 ____D C:\ProgramData\PACE
2023-04-10 19:10 - 2020-03-10 20:17 - 000065536 _____ C:\WINDOWS\system32\spu_storage.bin
2023-04-10 19:10 - 2019-12-07 11:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2023-04-10 19:09 - 2021-12-06 11:57 - 000000000 ____D C:\Users\bumbum\AppData\Roaming\Signal
2023-04-10 09:53 - 2021-03-20 16:08 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2023-04-10 06:45 - 2020-03-12 19:51 - 000000000 ____D C:\Users\bumbum\AppData\Roaming\KeePass
2023-04-10 06:01 - 2022-06-24 19:36 - 000004170 _____ C:\WINDOWS\system32\Tasks\User_Feed_Synchronization-{CB1D74B0-16C7-4619-A73A-20B0B913B1DE}
2023-04-10 05:58 - 2020-11-11 19:31 - 000001481 _____ C:\Users\bumbum\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Waves Offload.lnk
2023-04-07 22:33 - 2020-03-12 23:17 - 000000000 ____D C:\Program Files\Common Files\VST3
2023-04-07 19:56 - 2020-03-10 20:17 - 000000000 ____D C:\Users\bumbum\AppData\Local\D3DSCache
2023-04-07 19:54 - 2020-03-12 17:51 - 000000000 ____D C:\ProgramData\boost_interprocess
2023-04-06 17:32 - 2020-06-12 22:31 - 000000000 ____D C:\Program Files (x86)\Dropbox
2023-04-06 16:34 - 2021-03-20 16:14 - 000004210 _____ C:\WINDOWS\system32\Tasks\CCleaner Update
2023-04-05 22:41 - 2022-09-14 13:35 - 000002361 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brave.lnk
2023-04-05 22:41 - 2022-09-14 13:35 - 000002320 _____ C:\Users\Public\Desktop\Brave.lnk
2023-04-04 10:02 - 2019-12-07 11:14 - 000000000 ___HD C:\Program Files\WindowsApps
2023-04-04 10:02 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2023-04-03 05:47 - 2020-03-12 11:14 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2023-03-30 22:32 - 2020-12-26 16:24 - 000000000 ____D C:\Users\bumbum\AppData\Local\AMD_Common
2023-03-30 21:52 - 2020-03-12 11:29 - 000001060 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Thunderbird.lnk
2023-03-30 10:01 - 2021-05-13 10:18 - 000002244 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2023-03-28 21:45 - 2021-09-18 05:26 - 000000428 _____ C:\Users\bumbum\Desktop\LAN-Adapter-ONOFF.lnk
2023-03-28 15:33 - 2020-03-10 19:50 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2023-03-27 16:06 - 2022-06-22 18:10 - 000000000 ____D C:\Users\bumbum\Mp3tag
2023-03-21 08:25 - 2022-09-30 15:42 - 000003474 _____ C:\WINDOWS\system32\Tasks\CCleanerCrashReporting
2023-03-17 18:21 - 2020-03-10 20:40 - 000000000 ____D C:\WINDOWS\system32\MRT
2023-03-16 22:17 - 2020-03-10 20:40 - 153620824 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2023-03-15 21:07 - 2022-09-23 22:38 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2023-03-15 21:07 - 2020-03-12 11:14 - 000001010 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========

2020-04-13 06:30 - 2022-07-29 01:56 - 000086318 _____ () C:\Program Files\unins000.dat
2022-07-29 01:55 - 2022-07-29 01:55 - 000719521 _____ () C:\Program Files\unins000.exe
2020-10-17 13:05 - 2020-10-17 13:06 - 000043472 _____ () C:\Program Files\unins001.dat
2020-10-17 13:05 - 2020-10-17 13:03 - 000725157 _____ () C:\Program Files\unins001.exe
2022-05-13 19:47 - 2022-05-13 19:47 - 000001417 _____ () C:\Program Files\Common Files\unins000.dat
2022-05-13 19:47 - 2022-05-13 19:46 - 003218493 _____ (                                                            ) C:\Program Files\Common Files\unins000.exe
2022-01-19 23:17 - 2022-01-19 23:17 - 000000008 _____ () C:\Users\bumbum\AppData\Roaming\16f1929937b5acabed6b693658ccb667
2022-01-19 23:17 - 2022-01-19 23:19 - 000000036 _____ () C:\Users\bumbum\AppData\Roaming\2fcb6bd93d09ccfe4e08b66393170543
2021-12-20 09:45 - 2021-12-30 14:20 - 000000056 _____ () C:\Users\bumbum\AppData\Roaming\MOTU FireWire SMPTE Prefs.prefs
2020-03-12 18:26 - 2022-12-26 02:02 - 001249792 _____ (hxxp://www.ruby-lang.org/) C:\Users\bumbum\AppData\Roaming\msvcr90-ruby191.dll
2021-04-18 07:48 - 2021-04-18 07:48 - 000000051 ___SH () C:\Users\bumbum\AppData\Local\3cf976315767f8122bb7d7.09207887
2020-11-20 06:06 - 2020-11-20 06:06 - 000000051 ___SH () C:\Users\bumbum\AppData\Local\62zte7ntuiouiixaz6s5ebl6hza7osi
2021-12-20 02:27 - 2021-12-20 02:27 - 000000051 ___SH () C:\Users\bumbum\AppData\Local\6eebc2b1598089f38a4759.67408981
2020-11-20 06:06 - 2020-11-21 05:14 - 000000051 ___SH () C:\Users\bumbum\AppData\Local\7368ee7c5a2e9307a4d700.36580646
2020-06-26 16:58 - 2020-06-26 16:59 - 000000051 ___SH () C:\Users\bumbum\AppData\Local\78a0e7c359f32e31311c98.97329581
2020-03-13 15:50 - 2020-10-05 16:54 - 000004608 _____ () C:\Users\bumbum\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2020-11-20 06:06 - 2020-11-20 06:06 - 000000051 ___SH () C:\Users\bumbum\AppData\Local\dh3drp3dex4qjdyvz3zwwjh5a7xtbdq
2020-11-20 06:06 - 2020-11-20 06:06 - 000000051 ___SH () C:\Users\bumbum\AppData\Local\fh2cdxostlubeje2g37wg75uzmqyw2a
2022-04-08 07:51 - 2022-04-08 07:51 - 000000039 _____ () C:\Users\bumbum\AppData\Local\kritadisplayrc
2021-07-10 05:44 - 2022-04-08 07:51 - 000016813 _____ () C:\Users\bumbum\AppData\Local\kritarc
2020-11-20 06:06 - 2020-11-20 06:06 - 000000051 ___SH () C:\Users\bumbum\AppData\Local\mcswbqyqxfkzawt75eckjerthfvicxi
2020-11-20 06:06 - 2020-11-20 06:06 - 000000051 ___SH () C:\Users\bumbum\AppData\Local\omooip4754nigh23mgkys2wsoylh7sq
2023-01-06 16:46 - 2023-01-06 16:46 - 000000218 _____ () C:\Users\bumbum\AppData\Local\recently-used.xbel
2020-03-11 09:41 - 2023-02-22 21:07 - 000007630 _____ () C:\Users\bumbum\AppData\Local\Resmon.ResmonCfg
2022-08-28 03:15 - 2023-04-10 05:58 - 000495222 _____ () C:\Users\bumbum\AppData\Local\wle.log
2022-08-29 15:46 - 2022-08-29 15:46 - 000000051 ___SH () C:\Users\bumbum\AppData\Local\yocye2jh5tjsb7d42tgipdibsjvqasq
2021-03-21 01:32 - 2021-03-21 01:32 - 000000000 _____ () C:\Users\bumbum\AppData\Local\{12F0F9DE-A7B0-41D8-90E6-457E24A5F51F}

==================== FCheck ================================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

FCheck: C:\WINDOWS\SysWOW64\LIBMTS.dll [2021-04-30] [simlink -> C:\Program Files (x86)\Common Files\MTS-ESP\LIBMTS.dll] [] <==== ACHTUNG
FCheck: C:\WINDOWS\system32\LIBMTS.dll [2021-04-30] [simlink -> C:\Program Files\Common Files\MTS-ESP\LIBMTS.dll] [] <==== ACHTUNG

==================== SigCheck ============================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

==================== Ende von FRST.txt ========================