Mail Account wurde gehackt + Drohmail mit korrektem Passowrt bekommen

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 21.07.2024
durchgeführt von do83h (Administrator) auf DESKTOP-V3T0UTA (MEDION E63007) (22-07-2024 17:45:27)
Gestartet von C:\Users\do83h\Downloads\FRST64.exe
Geladene Profile: do83h
Plattform: Microsoft Windows 10 Home Version 22H2 19045.4651 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: Chrome
Start-Modus: Normal

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe <2>
(Autodesk, Inc. -> Autodesk) C:\Users\do83h\AppData\Local\Programs\Autodesk\Genuine Service\GenuineService.exe
(Autodesk, Inc. -> Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe
(C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe ->) (Autodesk, Inc. -> Autodesk) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AcWebBrowser\AcWebBrowser.exe <3>
(C:\Program Files (x86)\Citrix\ICA Client\concentr.exe ->) (Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe
(C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe ->) (Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\SelfServicePlugin\SelfServicePlugin.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
(Cisco Systems, Inc. -> Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
(Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\AnalyticsSrv.exe
(Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
(DriverStore\FileRepository\cui_dch.inf_amd64_ba5b1813656e5c27\igfxCUIService.exe ->) (Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_ba5b1813656e5c27\igfxEM.exe
(explorer.exe ->) (477B7FBA-7EF8-4233-86D2-322330786803 -> ) C:\Program Files\WindowsApps\3138AweZip.AweZip_1.4.36.0_x64__ffd303wmbhcjt\ArchiveObserver\ArchiveObserver.exe
(explorer.exe ->) (Google LLC -> ) C:\Program Files\Google\Drive\googledrivesync.exe <2>
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <5>
(explorer.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(explorer.exe ->) (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe
(Hewlett-Packard Company -> Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Intel Corporation -> ) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\24.126.0623.0001\Microsoft.SharePoint.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MusNotifyIcon.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <20>
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(services.exe ->) (Autodesk, Inc. -> Autodesk Inc.) C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe
(services.exe ->) (Autodesk, Inc. -> Autodesk) C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\10.1.0.3194\AdskLicensingService\AdskLicensingService.exe
(services.exe ->) (Cisco Systems, Inc. -> Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(services.exe ->) (Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe
(services.exe ->) (Flexera Software LLC -> Flexera) C:\Program Files (x86)\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService.exe
(services.exe ->) (Geek Software GmbH -> geek software GmbH) C:\Program Files\PDF24\pdf24.exe <2>
(services.exe ->) (Hewlett-Packard Company -> HP) C:\Windows\System32\HPSIsvc.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe
(services.exe ->) (Intel Corporation -> ) C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe
(services.exe ->) (Intel Corporation -> ) C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_af50fdb80983f7bc\jhi_service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\lms.inf_amd64_a55aa2cd52a3429d\LMS.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe
(services.exe ->) (Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_ba5b1813656e5c27\igfxCUIService.exe
(services.exe ->) (Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_e8f9f51120464f93\IntelCpHDCPSvc.exe
(services.exe ->) (Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_e8f9f51120464f93\IntelCpHeciSvc.exe
(services.exe ->) (Intel(R) Rapid Storage Technology -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iastorac.inf_amd64_6ca78a08b838e305\RstMwService.exe
(services.exe ->) (Malwarebytes Inc. -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MpDefenderCoreService.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MsMpEng.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\NisSrv.exe
(services.exe ->) (Nuance Communications, Inc. -> Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe
(services.exe ->) (Nuance Communications, Inc. -> Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\loggerservice.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c60facea9c32a6cb\RtkAudUService64.exe <2>
(services.exe ->) (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG) C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe
(services.exe ->) (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG) C:\Program Files\CodeMeter\Runtime\bin\CmWebAdmin.exe
(svchost.exe ->) (24803D75-212C-471A-BC57-9EF86AB91435 -> ) C:\Program Files\WindowsApps\5319275A.WhatsAppDesktop_2.2424.6.0_x64__cv1g1gvanyjgm\WhatsApp.exe
(svchost.exe ->) (Citrix Systems, Inc. -> Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(svchost.exe ->) (Flexera Software LLC -> Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\agent.exe
(svchost.exe ->) (Flexera Software LLC -> Flexera Software LLC.) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(svchost.exe ->) (Intel Corporation -> Intel Corporation) C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <3>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe <2>

==================== Registry (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtkAudUService] => C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_c60facea9c32a6cb\RtkAudUService64.exe [3380320 2021-11-18] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch [3831808 2021-08-30] (Microsoft Windows Hardware Compatibility Publisher -> Logitech)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [PDF24] => C:\Program Files\PDF24\pdf24.exe [645976 2024-03-05] (Geek Software GmbH -> geek software GmbH)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard Company -> Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Autodesk Desktop App] => C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AutodeskDesktopApp.exe [665384 2019-12-05] (Autodesk, Inc. -> Autodesk, Inc.)
HKLM-x32\...\Run: [Autodesk Genuine Service ] => C:\Users\do83h\AppData\Local\Programs\Autodesk\Genuine Service\GenuineService.exe [1077864 2020-01-02] (Autodesk, Inc. -> Autodesk)
HKLM-x32\...\Run: [TeamsMachineInstaller] => C:\Program Files (x86)\Teams Installer\Teams.exe [109324536 2021-03-12] (Microsoft Corporation -> Microsoft Corporation)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [1713432 2021-09-17] (Cisco Systems, Inc. -> Cisco Systems, Inc.)
HKLM-x32\...\Run: [InstallHelper] => C:\Program Files (x86)\Citrix\Citrix Workspace 2405\InstallHelper.exe [675128 2024-07-08] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
HKLM-x32\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\isuspm.exe [2075480 2013-06-24] (Flexera Software LLC -> Flexera Software LLC.)
HKLM-x32\...\Run: [DNS7reminder] => C:\Program Files (x86)\Nuance\NaturallySpeaking13\Ereg\Ereg.exe [325960 2014-05-30] (Nuance Communications, Inc. -> Nuance Communications, Inc.)
HKLM-x32\...\Run: [AnalyticsSrv] => C:\Program Files (x86)\Citrix\ICA Client\Receiver\AnalyticsSrv.exe [2857328 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [3068544 2024-07-02] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [1040000 2024-07-02] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-19\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\94.0.1.0\GoogleDriveFS.exe [60982376 2024-07-19] (Google LLC -> Google, Inc.)
HKU\S-1-5-20\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\94.0.1.0\GoogleDriveFS.exe [60982376 2024-07-19] (Google LLC -> Google, Inc.)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [4407656 2024-07-17] (Valve Corp. -> Valve Corporation)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [EpicGamesLauncher] => C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe [33000928 2021-04-07] (Epic Games Inc. -> Epic Games, Inc.)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [49958368 2022-02-01] (Google LLC -> )
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [com.squirrel.Teams.Teams] => C:\Users\do83h\AppData\Local\Microsoft\Teams\Update.exe [2454184 2021-07-14] (Microsoft 3rd Party Application Component -> Microsoft Corporation)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\94.0.1.0\GoogleDriveFS.exe [60982376 2024-07-19] (Google LLC -> Google, Inc.)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [] => [X]
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [2075480 2013-06-24] (Flexera Software LLC -> Flexera Software LLC.)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Run: [MicrosoftEdgeAutoLaunch_87671BE690C6185EAE66EBDAEE7802D1] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [3883472 2024-07-18] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\Policies\Explorer: [] 
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\MountPoints2: {11ae930c-1cdb-11eb-a845-6c6a77606d86} - "H:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\MountPoints2: {2d9bfd5a-ab41-11eb-a86b-6c6a77606d86} - "H:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\MountPoints2: {2f109b79-53b8-11ec-a87f-6c6a77606d86} - "H:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\MountPoints2: {8e9c3683-068a-11ed-a89a-6c6a77606d86} - "H:\HiSuiteDownLoader.exe" 
HKU\S-1-5-21-584500284-1391629960-3397962802-1005\...\MountPoints2: {d00a6513-1e96-11ee-a8c0-6c6a77606d86} - "H:\HiSuiteDownLoader.exe" 
HKU\S-1-5-18\...\Run: [GoogleDriveFS] => C:\Program Files\Google\Drive File Stream\94.0.1.0\GoogleDriveFS.exe [60982376 2024-07-19] (Google LLC -> Google, Inc.)
HKU\S-1-5-18\...\Run: [] => [X]
HKLM\...\Windows x64\Print Processors\HPM11M13PrintProc: C:\Windows\System32\spool\prtprocs\x64\HPM11M13PP.DLL [74240 2016-02-25] (Microsoft Windows Hardware Compatibility Publisher -> )
HKLM\...\Print\Monitors\HP BC11 Status Monitor: C:\Windows\system32\hpinkstsBC11LM.dll [331664 2012-06-12] (Hewlett Packard -> Hewlett-Packard Co.)
HKLM\...\Print\Monitors\HP Discovery Port Monitor (HP Photosmart 7520 series): C:\Windows\system32\HPDiscoPMBC11.dll [741480 2012-10-17] (Hewlett Packard -> Hewlett-Packard Co.)
HKLM\...\Print\Monitors\HPM11M13LM: C:\Windows\system32\HPM11M13LM.DLL [288768 2016-02-25] (Microsoft Windows Hardware Compatibility Publisher -> )
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\126.0.6478.128\Installer\chrmstp.exe [2024-07-19] (Google LLC -> Google LLC)
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{60f15951-e7ef-11ea-b28e-c4b301b9ed33}] -> C:\Program Files (x86)\Citrix\ICA Client\CitrixEnterpriseBrowser\126.1.1.22\Installer\chrmstp.exe [2024-07-20] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
Startup: C:\Users\do83h\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 7520 series.lnk [2024-07-22]
ShortcutAndArgument: Tintenwarnungen überwachen - HP Photosmart 7520 series.lnk -> C:\Windows\system32\RunDll32.exe => "C:\Program Files\HP\HP Photosmart 7520 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=TH4A1710WP05YY;CONNECTION=USB;MONITOR=1;
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodeMeter Control Center.lnk [2021-11-01]
ShortcutTarget: CodeMeter Control Center.lnk -> C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeterCC.exe (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG)
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Beschränkung <==== ACHTUNG

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {262E641F-C96C-4BD1-AFB4-CE16CFF5D171} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1558984 2024-06-25] (Adobe Inc. -> Adobe Inc.)
Task: {7C6AAADD-6794-4CEC-842E-F176CA9317EC} - System32\Tasks\G2MUpdateTask-S-1-5-21-584500284-1391629960-3397962802-1005 => C:\Users\do83h\AppData\Local\GoToMeeting\19992\g2mupdate.exe [34872 2024-06-22] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {8ED46F6B-D868-45F9-A5DA-F936D7B2E679} - System32\Tasks\G2MUploadTask-S-1-5-21-584500284-1391629960-3397962802-1005 => C:\Users\do83h\AppData\Local\GoToMeeting\19992\g2mupload.exe [34872 2024-06-22] (LogMeIn, Inc. -> LogMeIn, Inc.)
Task: {40C3BD78-F59E-4D2F-AE22-905EE6793F9D} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem128.0.6597.0{93A54F35-F806-45F6-8563-F73C85EA83CF} => C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe [4889704 2024-07-15] (Google LLC -> Google LLC)
Task: {F59146C7-C25F-4DE3-99D4-7D64FB97AAD4} - System32\Tasks\HPCustParticipation HP Photosmart 7520 series => C:\Program Files\HP\HP Photosmart 7520 series\Bin\HPCustPartic.exe [4119656 2012-10-17] (Hewlett Packard -> Hewlett-Packard Co.)
Task: {8BC77DBC-D5D6-45D8-B1C0-099E91C2647D} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132 => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [4922296 2023-12-19] (Intel Corporation -> Intel Corporation)
Task: {964B9470-0064-4BA7-9FBA-4D49F23DA117} - System32\Tasks\IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132-Logon => C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe [4922296 2023-12-19] (Intel Corporation -> Intel Corporation)
Task: {A160F302-5259-4CC8-88D7-5327AE03EDBA} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe  --automatic (Keine Datei)
Task: {514A5D14-4EB0-4135-A4F7-B073E9143C98} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [28499640 2024-07-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {CAD81E66-1FF7-42F0-B65F-A45A8FC9B502} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [28499640 2024-07-04] (Microsoft Corporation -> Microsoft Corporation)
Task: {B8540C44-B70A-4B2A-B861-15AFF54DC5B0} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [221368 2024-07-14] (Microsoft Corporation -> Microsoft Corporation)
Task: {4EDC9E48-4E12-4EAC-A8F7-5CF3BC16A301} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files (x86)\Microsoft Office\root\Office16\sdxhelper.exe [221368 2024-07-14] (Microsoft Corporation -> Microsoft Corporation)
Task: {040310DD-CB77-43E4-8279-924E17C6B61B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_ERROR_HB => C:\Windows\System32\MRT.exe [194135240 2024-07-13] (Microsoft Windows -> Microsoft Corporation) -> C:\Windows\system32\/EHB /HeartbeatFailure "SubmitHeartbeatReportData" /HeartbeatError "0x80072ee7"
Task: {65787950-A35A-45A6-8EA6-179ADA2C1715} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MpCmdRun.exe [1678960 2024-07-17] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {52470519-AD44-4464-AD82-4AD5F1EB45CC} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MpCmdRun.exe [1678960 2024-07-17] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {9AAB925C-91A5-464B-BC8C-E64154D09F07} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MpCmdRun.exe [1678960 2024-07-17] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {F40F6C9B-E519-49EB-BD97-90C364DC2951} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MpCmdRun.exe [1678960 2024-07-17] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {AF02A63D-FDCC-4CFB-A094-48A4E4432387} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [677448 2024-07-10] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (Der Dateneintrag hat 6 weitere Zeichen).
Task: {F72F522F-EE4E-4F93-846D-F1AE2428B881} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-584500284-1391629960-3397962802-1005 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [677448 2024-07-10] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (Der Dateneintrag hat 6 weitere Zeichen).
Task: {4E2414B5-6AD7-467C-955C-DACCB1C91AE0} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [34376 2024-07-10] (Mozilla Corporation -> Mozilla Foundation)
Task: {2106D5FD-E7A5-4377-8AB3-9FA78F43F4CE} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4209056 2024-07-13] (Microsoft Corporation -> Microsoft Corporation)
Task: {E65BF73C-EB8F-452B-979A-36C9931D7E92} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-584500284-1391629960-3397962802-1005 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4209056 2024-07-13] (Microsoft Corporation -> Microsoft Corporation)
Task: {6C00A265-94E7-4865-B2EC-59EFABDAE67F} - System32\Tasks\Opera scheduled Autoupdate 1605363011 => C:\Users\do83h\AppData\Local\Programs\Opera\launcher.exe [1538584 2020-03-03] (Opera Software AS -> Opera Software)
Task: {675DE520-3CEC-43D1-B092-71526D2C28F9} - System32\Tasks\USER_ESRV_SVC_QUEENCREEK => C:\Windows\System32\Wscript.exe [196608 2024-07-13] (Microsoft Windows -> Microsoft Corporation) -> C:\Program Files\Intel\SUR\QUEENCREEK\x64\//B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs"

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-584500284-1391629960-3397962802-1005.job => C:\Users\do83h\AppData\Local\GoToMeeting\19992\g2mupdate.exe
Task: C:\Windows\Tasks\G2MUploadTask-S-1-5-21-584500284-1391629960-3397962802-1005.job => C:\Users\do83h\AppData\Local\GoToMeeting\19992\g2mupload.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{0894d97c-231f-418b-bd94-97d6dc7075e5}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{0894d97c-231f-418b-bd94-97d6dc7075e5}: [DhcpDomain] speedport.ip
Tcpip\..\Interfaces\{a88c09f9-bd5a-4696-92a9-0f25bebc004b}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{a88c09f9-bd5a-4696-92a9-0f25bebc004b}: [DhcpDomain] speedport.ip

Edge: 
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\do83h\AppData\Local\Microsoft\Edge\User Data\Default [2024-07-22]
Edge Extension: (Google Docs Offline) - C:\Users\do83h\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-07-13]
Edge Extension: (Edge relevant text changes) - C:\Users\do83h\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-01-24]
Edge HKLM-x32\...\Edge\Extension: [mielbhbkcliienpdicphhecpodcaeefg]

FireFox:
========
FF DefaultProfile: 3uauklfr.default
FF ProfilePath: C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\3uauklfr.default [nicht gefunden] <==== ACHTUNG
FF ProfilePath: C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\bxljijxg.dominik [2024-07-22]
FF Homepage: Mozilla\Firefox\Profiles\bxljijxg.dominik -> hxxps://www.google.com/
FF NewTab: Mozilla\Firefox\Profiles\bxljijxg.dominik -> hxxps://mynewtab.co?pId=IC150206&searchEngine=bing&iDate=110620
FF Notifications: Mozilla\Firefox\Profiles\bxljijxg.dominik -> hxxps://www.planetromeo.com; hxxps://www.jako.de; hxxps://www.romeo.com; hxxps://www.facebook.com
FF Extension: (Citavi Picker) - C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\bxljijxg.dominik\Extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}.xpi [2023-05-02]
FF SearchPlugin: C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\bxljijxg.dominik\searchplugins\Yahoo Search.xml [2022-06-17]
FF ProfilePath: C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\79tx312p.default-release [2023-04-24]
FF Homepage: Mozilla\Firefox\Profiles\79tx312p.default-release -> hxxps://mynewtab.co?pId=IC150206&searchEngine=bing&iDate=110620
FF NewTab: Mozilla\Firefox\Profiles\79tx312p.default-release -> hxxps://mynewtab.co?pId=IC150206&searchEngine=bing&iDate=110620
FF SearchPlugin: C:\Users\do83h\AppData\Roaming\Mozilla\Firefox\Profiles\79tx312p.default-release\searchplugins\Yahoo Search.xml [2022-06-17]
FF Extension: (Citavi Picker) - C:\Program Files\Mozilla Firefox\distribution\extensions\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}.xpi [2023-03-23]
FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: (SmartPrintButton) - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011-01-26] [] [ist nicht signiert]
FF Plugin: nuance.com/DgnRia2_x86_64 -> C:\Program Files (x86)\Nuance\NaturallySpeaking13\Program\x64\npDgnRia2_x64.dll [2018-09-24] (Nuance Communications, Inc. -> Nuance Communications, Inc.)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2024-05-19] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2024-05-19] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2024-06-27] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin-x32: nuance.com/DgnRia2 -> C:\Program Files (x86)\Nuance\NaturallySpeaking13\Program\npDgnRia2.dll [2018-09-24] (Nuance Communications, Inc. -> Nuance Communications, Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\do83h\AppData\Local\Google\Chrome\User Data\Default [2024-07-21]
CHR Notifications: Default -> hxxps://business.facebook.com; hxxps://www.fmscout.com
CHR Extension: (Google Docs Offline) - C:\Users\do83h\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2024-07-12]
CHR Extension: (Anwendungs-Launcher für Drive (von Google)) - C:\Users\do83h\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2023-08-23]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\do83h\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2021-01-29]
CHR Extension: (Citavi Picker) - C:\Users\do83h\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2023-07-13]
CHR HKU\S-1-5-21-584500284-1391629960-3397962802-1005\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn]

Opera: 
=======
OPR Profile: C:\Users\do83h\AppData\Roaming\Opera Software\Opera Stable [2020-11-14]

==================== Dienste (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Autodesk\Autodesk Desktop App\AdAppMgrSvc.exe [1047416 2019-12-05] (Autodesk, Inc. -> Autodesk Inc.)
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [172992 2024-06-25] (Adobe Inc. -> Adobe Inc.)
R2 AdskLicensingService; C:\Program Files (x86)\Common Files\Autodesk Shared\AdskLicensing\Current\AdskLicensingService\AdskLicensingService.exe [16930616 2019-12-18] (Autodesk, Inc. -> Autodesk)
S3 appprotectionsvc; C:\Program Files (x86)\Citrix\ICA Client\appprotection.exe [717896 2024-06-15] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [14012384 2024-07-04] (Microsoft Corporation -> Microsoft Corporation)
R2 CmWebAdmin.exe; C:\Program Files\CodeMeter\Runtime\bin\CmWebAdmin.exe [10759616 2021-09-29] (WIBU-SYSTEMS AG -> WIBU-SYSTEMS AG)
S3 CtxAdpPolicy; C:\Program Files (x86)\Citrix\AppDataProtection\CtxAdpPolicy.exe [330608 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S3 CtxPkm; C:\Program Files (x86)\Citrix\AppDataProtection\CtxPkm.exe [1242992 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
R2 CWAUpdaterService; C:\Program Files (x86)\Citrix\ICA Client\Receiver\UpdaterService.exe [1708344 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
R2 DragonLoggerService; C:\Program Files (x86)\Common Files\Nuance\loggerservice.exe [151560 2018-09-24] (Nuance Communications, Inc. -> Nuance Communications, Inc.)
R2 DSAService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe [44056 2024-06-20] (Intel Corporation -> Intel)
R3 DSAUpdateService; C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe [292888 2024-06-20] (Intel Corporation -> Intel)
S3 FileSyncHelper; C:\Program Files\Microsoft OneDrive\24.126.0623.0001\FileSyncHelper.exe [3519392 2024-07-13] (Microsoft Corporation -> Microsoft Corporation)
R2 HPPrintScanDoctorService; C:\Program Files\HPPrintScanDoctor\HPPrintScanDoctorService.exe [241104 2024-06-21] (HP Inc. -> HP Inc.)
R2 HPSIService; C:\Windows\system32\HPSIsvc.exe [128272 2016-03-30] (Hewlett-Packard Company -> HP)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [8901528 2024-07-18] (Malwarebytes Inc. -> Malwarebytes)
S3 MBVpnTunnelService; C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe [3073888 2024-05-27] (Malwarebytes Inc. -> Malwarebytes)
R2 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MpDefenderCoreService.exe [1377416 2024-07-17] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 OneDrive Updater Service; C:\Program Files\Microsoft OneDrive\24.126.0623.0001\OneDriveUpdaterService.exe [3860400 2024-07-13] (Microsoft Corporation -> Microsoft Corporation)
R2 PDF24; C:\Program Files\PDF24\pdf24.exe [645976 2024-03-05] (Geek Software GmbH -> geek software GmbH)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\NisSrv.exe [3236728 2024-07-17] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24060.7-0\MsMpEng.exe [133688 2024-07-17] (Microsoft Windows Publisher -> Microsoft Corporation)
S2 AvgWscReporter; "C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /runassvc /rpcserver [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 acsock; C:\Windows\system32\DRIVERS\acsock64.sys [300456 2021-09-17] (Microsoft Windows Hardware Compatibility Publisher -> Cisco Systems, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [209088 2022-07-19] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [199312 2022-07-19] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [46704 2022-07-19] (Avira Operations GmbH & Co. KG -> Avira Operations GmbH & Co. KG)
R2 BdDci; C:\Windows\system32\DRIVERS\bddci.sys [367096 2023-03-18] (Bitdefender SRL -> Bitdefender)
S3 CLVirtualBus01; C:\Windows\System32\drivers\CLVirtualBus01.sys [113888 2018-05-02] (CyberLink Corp. -> CyberLink)
S3 ctxapdriver; C:\Windows\system32\DRIVERS\ctxapdriver.sys [81560 2024-06-14] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S3 ctxapinject; C:\Windows\system32\DRIVERS\ctxapinject.sys [128664 2024-06-14] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S4 ctxapusbfilter; C:\Windows\system32\DRIVERS\ctxapusbfilter.sys [60472 2024-06-14] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S4 CtxDs2; C:\Windows\System32\drivers\CtxDs2.sys [186424 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S4 CtxDt2; C:\Windows\System32\drivers\CtxDt2.sys [228296 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S4 CtxIsolate; C:\Windows\System32\drivers\CtxIsolate.sys [336840 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S4 CtxSupport; C:\Windows\System32\drivers\CtxSupport.sys [107976 2024-07-05] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
R2 ctxusbm; C:\Windows\system32\DRIVERS\ctxusbmon.sys [160832 2024-07-02] (Citrix Systems, Inc. -> Citrix Systems, Inc.)
S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus2.sys [167440 2022-09-30] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
R2 googledrivefs31626; C:\Program Files\Google\Drive File Stream\Drivers\31626\googledrivefs31626.sys [384096 2024-07-17] (Microsoft Windows Hardware Compatibility Publisher -> Google, Inc.)
S3 iaLPSS2_GPIO2_ICL; C:\Windows\System32\DriverStore\FileRepository\ialpss2_gpio2_icl.inf_amd64_90beccc7e046abab\iaLPSS2_GPIO2_ICL.sys [132872 2020-04-27] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_I2C_ICL; C:\Windows\System32\DriverStore\FileRepository\ialpss2_i2c_icl.inf_amd64_c8c0638291b9b209\iaLPSS2_I2C_ICL.sys [200456 2020-04-27] (Intel Corporation -> Intel Corporation)
S3 iaLPSS2_SPI_ICL; C:\Windows\System32\DriverStore\FileRepository\ialpss2_spi_icl.inf_amd64_66a759065dfa6f64\iaLPSS2_SPI_ICL.sys [160024 2020-04-27] (Intel Corporation -> Intel Corporation)
R2 mbamchameleon; C:\Windows\System32\Drivers\MbamChameleon.sys [221264 2024-07-18] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\Windows\System32\DRIVERS\MbamElam.sys [21480 2023-05-17] (Microsoft Windows Early Launch Anti-Malware Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [239576 2024-02-12] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MpKslf95f0a5f; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9356963E-B9A0-44C4-9EB0-6C2556C8160B}\MpKslDrv.sys [271640 2024-07-22] (Microsoft Windows -> Microsoft Corporation)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [29192 2016-03-17] (Microsoft Windows Hardware Compatibility Publisher -> Marvell Semiconductor, Inc.)
S0 ProtectedELAM; C:\Windows\System32\drivers\protected_elam.sys [18912 2022-09-27] (Microsoft Windows Early Launch Anti-Malware Publisher -> TODO: <Company name>)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [174112 2022-09-30] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
S3 ss_conn_usb_driver2; C:\Windows\System32\Drivers\ss_conn_usb_driver2.sys [50720 2022-09-30] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
S3 Usbnet; C:\Windows\System32\drivers\usbnet.sys [46080 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
S3 vpnva; C:\Windows\System32\drivers\vpnva64-6.sys [74064 2021-09-17] (Cisco Systems, Inc. -> Cisco Systems, Inc.)
S0 WdBoot; C:\Windows\System32\drivers\wd\WdBoot.sys [21968 2024-07-17] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\wd\WdFilter.sys [602520 2024-07-17] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\drivers\wd\WdNisDrv.sys [105864 2024-07-17] (Microsoft Windows -> Microsoft Corporation)
U4 googledrivefs31357; \SystemRoot\System32\DriverStore\FileRepository\googledrivefs31357.inf_amd64_a8bf31a168cf7d00\googledrivefs31357.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2024-07-22 17:44 - 2024-07-22 17:44 - 002396672 _____ (Farbar) C:\Users\do83h\Downloads\FRST64.exe
2024-07-20 17:04 - 2024-07-20 17:04 - 000002588 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix Workspace.lnk
2024-07-20 17:04 - 2024-07-20 17:04 - 000000000 ____D C:\ProgramData\Citrix
2024-07-14 15:12 - 2024-07-14 15:12 - 000000004 ____H C:\ProgramData\cm-lock
2024-07-13 14:16 - 2024-07-13 14:16 - 000000000 ____D C:\Windows\system32\compatrel
2024-07-13 11:20 - 2024-07-13 11:20 - 000021724 _____ C:\Windows\SysWOW64\IntegratedServicesRegionPolicySet.json
2024-07-13 11:19 - 2024-07-13 11:19 - 000021724 _____ C:\Windows\system32\IntegratedServicesRegionPolicySet.json
2024-07-13 11:09 - 2024-07-13 11:09 - 000000000 ___HD C:\$WinREAgent
2024-07-10 20:42 - 2024-07-13 14:17 - 000000000 ____D C:\Program Files\Mozilla Firefox
2024-07-05 10:21 - 2024-07-05 10:21 - 000336840 _____ (Citrix Systems, Inc.) C:\Windows\system32\Drivers\CtxIsolate.sys
2024-07-05 10:21 - 2024-07-05 10:21 - 000228296 _____ (Citrix Systems, Inc.) C:\Windows\system32\Drivers\CtxDt2.sys
2024-07-05 10:21 - 2024-07-05 10:21 - 000186424 _____ (Citrix Systems, Inc.) C:\Windows\system32\Drivers\CtxDs2.sys
2024-07-05 10:21 - 2024-07-05 10:21 - 000107976 _____ (Citrix Systems, Inc.) C:\Windows\system32\Drivers\CtxSupport.sys
2024-07-02 01:17 - 2024-07-02 01:17 - 000160832 _____ (Citrix Systems, Inc.) C:\Windows\system32\Drivers\ctxusbmon.sys
2024-06-30 12:03 - 2024-06-30 12:03 - 000081376 _____ C:\Users\do83h\Downloads\Ausschreibung-4.pdf
2024-06-26 13:22 - 2024-06-26 13:22 - 000000000 ____D C:\Program Files (x86)\Intel
2024-06-23 13:37 - 2024-06-23 13:37 - 000265258 _____ C:\Users\do83h\OneDrive\Dokumente\Maya James Befreiung.pdf
2024-06-23 13:13 - 2024-06-23 13:13 - 000000000 _____ C:\Users\do83h\OneDrive\Bilder\Desktop\Maya James.pdf

==================== Ein Monat (geänderte) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2024-07-22 17:46 - 2023-05-19 17:17 - 000000000 ____D C:\Users\do83h\AppData\Local\Malwarebytes
2024-07-22 17:46 - 2023-04-23 12:32 - 000038337 _____ C:\Users\do83h\Downloads\FRST.txt
2024-07-22 17:46 - 2020-10-29 13:58 - 000000000 ____D C:\Users\do83h
2024-07-22 17:45 - 2023-04-23 12:32 - 000000000 ____D C:\FRST
2024-07-22 17:40 - 2020-10-29 14:03 - 000000000 __SHD C:\Users\do83h\IntelGraphicsProfiles
2024-07-21 17:10 - 2020-10-29 21:37 - 000000000 ____D C:\Users\do83h\AppData\Roaming\Microsoft\Excel
2024-07-21 17:10 - 2020-10-29 17:28 - 000000000 ____D C:\Users\do83h\OneDrive\Dokumente\eigene dateien
2024-07-21 17:09 - 2023-07-09 15:54 - 000306924 _____ C:\Users\do83h\OneDrive\Dokumente\FC Lisboa NEU.xlsx
2024-07-21 17:05 - 2019-12-07 11:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2024-07-21 16:57 - 2021-11-01 18:16 - 000000068 ___SH C:\Windows\system32\Drivers\WppRecorder.winsecurity
2024-07-21 16:49 - 2020-10-29 14:48 - 000000000 ____D C:\Program Files (x86)\Steam
2024-07-21 16:17 - 2021-11-01 18:16 - 000000068 ___SH C:\Windows\system32\Drivers\WdfLdr.winsecurity
2024-07-21 11:37 - 2020-10-29 15:00 - 000000000 ____D C:\Users\do83h\AppData\Local\D3DSCache
2024-07-21 11:29 - 2020-10-29 15:32 - 000000000 ____D C:\Users\do83h\Knuddels-Stapp
2024-07-20 17:04 - 2022-11-02 13:40 - 000000000 ____D C:\Program Files (x86)\Citrix
2024-07-20 17:04 - 2019-12-07 11:13 - 000000000 ____D C:\Windows\INF
2024-07-20 16:50 - 2021-12-19 00:44 - 000000000 ____D C:\Windows\SystemTemp
2024-07-20 12:15 - 2019-12-07 11:14 - 000000000 ___HD C:\Program Files\WindowsApps
2024-07-20 12:15 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\AppReadiness
2024-07-20 09:10 - 2020-07-02 09:15 - 000002440 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2024-07-19 20:32 - 2020-10-30 00:55 - 000000000 ____D C:\Users\do83h\AppData\Local\Steam
2024-07-19 20:26 - 2021-09-22 18:18 - 000002170 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive.lnk
2024-07-19 20:26 - 2020-12-16 00:32 - 000002060 _____ C:\Users\do83h\OneDrive\Bilder\Desktop\Google Drive.lnk
2024-07-19 15:46 - 2020-10-29 14:46 - 000002243 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2024-07-17 18:22 - 2020-06-15 08:59 - 000000000 ____D C:\Windows\system32\Drivers\wd
2024-07-14 20:35 - 2020-06-15 08:59 - 000000000 ____D C:\Windows\system32\SleepStudy
2024-07-14 17:02 - 2021-07-14 16:13 - 000029709 _____ C:\Users\do83h\AppData\Roaming\Durch Trennzeichen getrennte Werte.ADR
2024-07-14 16:28 - 2020-10-31 17:15 - 000000000 ____D C:\Users\do83h\AppData\Roaming\Microsoft\Word
2024-07-14 16:23 - 2023-05-01 23:04 - 000000000 ____D C:\Users\do83h\OneDrive\Dokumente\Citavi 6
2024-07-14 15:31 - 2020-10-30 16:23 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2024-07-14 15:23 - 2020-07-02 08:37 - 000747396 _____ C:\Windows\system32\perfh007.dat
2024-07-14 15:23 - 2020-07-02 08:37 - 000151262 _____ C:\Windows\system32\perfc007.dat
2024-07-14 15:23 - 2020-06-15 09:07 - 001731656 _____ C:\Windows\system32\PerfStringBackup.INI
2024-07-14 15:12 - 2020-06-15 08:59 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2024-07-13 14:19 - 2019-12-07 11:03 - 000786432 _____ C:\Windows\system32\config\BBI
2024-07-13 14:17 - 2021-08-26 13:18 - 000000000 ____D C:\Program Files\Microsoft OneDrive
2024-07-13 14:17 - 2021-02-18 14:56 - 000000666 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-584500284-1391629960-3397962802-1005.job
2024-07-13 14:17 - 2021-02-18 14:56 - 000000570 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-584500284-1391629960-3397962802-1005.job
2024-07-13 14:17 - 2020-10-29 15:01 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2024-07-13 14:17 - 2020-06-15 08:59 - 000571592 _____ C:\Windows\system32\FNTCACHE.DAT
2024-07-13 14:16 - 2023-12-16 00:56 - 000000000 ____D C:\Windows\InboxApps
2024-07-13 14:16 - 2021-07-10 00:47 - 000001426 _____ C:\Windows\system32\default_error_stack-000000-000000.txt
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ___RD C:\Windows\ImmersiveControlPanel
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\SysWOW64\Dism
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\SystemResources
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\WinBioPlugIns
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\setup
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\SecureBootUpdates
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\oobe
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\Dism
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\system32\appraiser
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\ShellExperiences
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\ShellComponents
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\PolicyDefinitions
2024-07-13 14:16 - 2019-12-07 11:14 - 000000000 ____D C:\Windows\bcastdvr
2024-07-13 11:24 - 2019-12-07 11:03 - 000000000 ____D C:\Windows\CbsTemp
2024-07-13 11:19 - 2020-06-15 09:01 - 003016192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PrintConfig.dll
2024-07-13 11:12 - 2022-01-06 16:39 - 000003592 _____ C:\Windows\system32\Tasks\OneDrive Reporting Task-S-1-5-21-584500284-1391629960-3397962802-1005
2024-07-13 11:12 - 2021-07-14 11:35 - 000003194 _____ C:\Windows\system32\Tasks\OneDrive Per-Machine Standalone Update Task
2024-07-13 11:12 - 2021-07-14 11:35 - 000002152 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2024-07-13 11:08 - 2020-10-29 14:59 - 000000000 ____D C:\ProgramData\Package Cache
2024-07-13 11:07 - 2023-10-18 19:00 - 000000000 ____D C:\Program Files (x86)\dotnet
2024-07-13 11:07 - 2020-11-01 17:21 - 000000000 ____D C:\Windows\system32\MRT
2024-07-13 11:04 - 2020-07-02 09:13 - 194135240 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2024-07-12 14:42 - 2020-07-02 09:15 - 000003754 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2024-07-12 14:42 - 2020-07-02 09:15 - 000003630 _____ C:\Windows\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2024-07-11 19:25 - 2022-01-19 15:56 - 000000000 ____D C:\Windows\system32\Tasks\Mozilla
2024-07-11 19:25 - 2020-10-29 15:01 - 000001009 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2024-07-04 19:09 - 2020-10-29 21:37 - 000000000 ____D C:\Users\do83h\AppData\Roaming\Microsoft\Office
2024-06-30 11:58 - 2022-10-11 16:18 - 000002140 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader.lnk
2024-06-30 11:51 - 2020-11-01 15:12 - 000004562 _____ C:\Windows\system32\Tasks\Adobe Acrobat Update Task
2024-06-26 17:05 - 2020-10-29 14:03 - 000000000 ____D C:\Users\do83h\AppData\Local\Packages
2024-06-26 13:23 - 2023-05-12 16:19 - 000001514 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel Driver & Support Assistant.lnk
2024-06-22 11:50 - 2021-02-18 14:56 - 000003834 _____ C:\Windows\system32\Tasks\G2MUploadTask-S-1-5-21-584500284-1391629960-3397962802-1005
2024-06-22 11:50 - 2021-02-18 14:56 - 000003738 _____ C:\Windows\system32\Tasks\G2MUpdateTask-S-1-5-21-584500284-1391629960-3397962802-1005
2024-06-22 11:50 - 2021-02-18 14:56 - 000000000 ____D C:\Users\do83h\AppData\Local\GoToMeeting

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========

2020-12-30 00:50 - 2020-12-30 00:50 - 000000457 _____ () C:\Program Files (x86)\INSTALL.LOG
2021-07-14 16:13 - 2024-07-14 17:02 - 000029709 _____ () C:\Users\do83h\AppData\Roaming\Durch Trennzeichen getrennte Werte.ADR
2020-10-30 15:19 - 2021-06-30 15:53 - 000022399 _____ () C:\Users\do83h\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2023-06-26 23:40 - 2023-06-30 21:25 - 000001435 _____ () C:\Users\do83h\AppData\Roaming\SAS7_000.DAT
2020-10-29 21:51 - 2021-01-06 19:19 - 000000081 _____ () C:\Users\do83h\AppData\Local\.bidstack.fault
2021-03-14 22:46 - 2021-03-14 22:46 - 000000950 _____ () C:\Users\do83h\AppData\Local\recently-used.xbel

==================== SigCheck ============================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

==================== Ende von FRST.txt ========================