Windows 10: Windows Defender meldet "PWS:WIN32/Zbot!ml" Bedrohung, Teil 1

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 30-01-2022
durchgeführt von Admin (Administrator) auf STUDIO (Dell Inc. PowerEdge T20) (30-01-2022 20:38:38)
Gestartet von C:\Users\Admin\Desktop
Geladene Profile: Thomas & Admin
Plattform: Microsoft Windows 10 Pro Version 21H1 19043.1466 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: FF
Start-Modus: Normal

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

() [Datei ist nicht signiert] C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DblClick.exe
() [Datei ist nicht signiert] D:\Programme\Capture2Text\Capture2Text.exe
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe <2>
(Adobe Inc. -> Adobe Systems Incorporated) C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe <5>
(Amazon.com Services LLC -> Amazon.com Inc.) C:\Users\Thomas\AppData\Local\Amazon Drive\AmazonPhotos.exe
(AVM Computersysteme Vertriebs GmbH -> AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(AVM Computersysteme Vertriebs GmbH -> AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(AVM Computersysteme Vertriebs GmbH -> AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(Cybereason) [Datei ist nicht signiert] C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFree.exe <2>
(Cybereason) [Datei ist nicht signiert] C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFreeServiceHost.exe
(Data Perceptions -> Data Perceptions / PowerProgrammer) C:\Windows\SysWOW64\WebUpdateSvc4.exe
(Elaborate Bytes AG -> Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe <2>
(Electronic Arts, Inc. -> Electronic Arts) F:\Program Files (x86)\Origin\OriginWebHelperService.exe
(Even Balance, Inc. -> ) C:\Windows\SysWOW64\PnkBstrA.exe
(EZVIZ Inc. -> ) C:\Program Files (x86)\hicloud\update_server\SPUpDateServer.exe
(EZVIZ Inc. -> ) C:\Program Files (x86)\hicloud\update_server\startUp.exe <2>
(FabulaTech, LLP -> ) C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe
(FabulaTech, LLP -> ) C:\Program Files\Common Files\VMware\ScannerRedirection\ftscanmgrhv.exe
(FabulaTech, LLP -> VMware) C:\Program Files\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe
(geek software GmbH -> geek software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe <3>
(Ghisler Software GmbH -> Ghisler Software GmbH) C:\Program Files (x86)\totalcmd\TCMDX64.EXE
(Ghisler Software GmbH -> Ghisler Software GmbH) C:\Program Files (x86)\totalcmd\TOTALCMD.EXE
(Irfan Skiljan -> Irfan Skiljan) C:\Program Files (x86)\IrfanView\i_view32.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <8>
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\Office16\OUTLOOK.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\Office16\WINWORD.EXE
(Microsoft Corporation -> Microsoft Corporation) C:\Users\Thomas\AppData\Local\Microsoft\Teams\current\Teams.exe <8>
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_3.2111.12605.0_x64__8wekyb3d8bbwe\Cortana.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.2103.8.0_x64__8wekyb3d8bbwe\Calculator.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\LogonUI.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\SecurityHealthHost.exe <2>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\MpCopyAccelerator.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\MsMpEng.exe
(Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\NisSrv.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe <31>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe <3>
(Paragon Software GmbH -> Paragon Software) C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe
(Paragon Software GmbH -> Paragon Software) C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\paragon_service.exe
(Paramount Software UK Ltd -> Paramount Software UK Ltd) C:\Program Files\Macrium\Common\MacriumService.exe
(Paramount Software UK Ltd -> Paramount Software UK Ltd) C:\Program Files\Macrium\Common\ReflectMonitor.exe <2>
(Paramount Software UK Ltd -> Paramount Software UK Ltd) C:\Program Files\Macrium\Common\ReflectUI.exe <2>
(Private Internet Access, Inc. -> ) C:\Program Files\Private Internet Access\pia-service.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor Corp.) C:\Program Files\Realtek\Audio\HDA\RtDCpl64.exe <2>
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor Corp. -> Realtek) C:\Program Files\Realtek\WifiAutoInstall\WifiAutoInstallSrv.exe
(Reiner Kartengeraete GmbH und Co.KG -> REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(Ruiware, LLC -> Ruiware) C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe
(Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung Magician\SamsungMagician.exe
(SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHSE.EXE
(Synology Inc. -> ) [Datei ist nicht signiert] C:\Program Files (x86)\Synology\CloudStation\bin\vss-service-x64.exe
(Synology Inc. -> Synology Inc.) [Datei ist nicht signiert] C:\Users\Thomas\AppData\Local\CloudStation\CloudStation.app\bin\cloud-drive-connect.exe
(Synology Inc. -> Synology Inc.) [Datei ist nicht signiert] C:\Users\Thomas\AppData\Local\CloudStation\CloudStation.app\bin\cloud-drive-daemon.exe
(Synology Inc. -> Synology Inc.) [Datei ist nicht signiert] C:\Users\Thomas\AppData\Local\CloudStation\CloudStation.app\bin\cloud-drive-ui.exe
(VMware, Inc. -> VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
(VMware, Inc. -> VMware, Inc.) C:\Program Files (x86)\VMware\VMware Horizon View Client\ClientService\horizon_client_service.exe
0 C:\Program Files\WindowsApps\51041SafeInCloud.PasswordManagerSafeInCloud_21.4.1.0_x86__wh7zearnzvtm6\SafeInCloud\SafeInCloud.exe
0 C:\Program Files\WindowsApps\AppleInc.iCloud_13.0.201.0_x86__nzyj5cx40ttqa\iCloud\APSDaemon.exe
0 C:\Program Files\WindowsApps\AppleInc.iCloud_13.0.201.0_x86__nzyj5cx40ttqa\iCloud\iCloudServices.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtDCpl64.exe [2917632 2015-05-27] (Realtek Semiconductor Corp -> Realtek Semiconductor Corp.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508240 2015-08-05] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM\...\Run: [Reflect UI] => C:\Program Files\Macrium\Common\ReflectUI.exe [7580488 2021-11-17] (Paramount Software UK Ltd -> Paramount Software UK Ltd)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG -> Elaborate Bytes AG)
HKLM-x32\...\Run: [SPUpDateServerrun] => C:\Program Files (x86)\hicloud\update_server\startUp.exe [14832 2015-09-10] (EZVIZ Inc. -> )
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [486464 2020-10-01] (geek software GmbH -> geek software GmbH)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHSE.EXE [241280 2017-01-17] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1000\...\Run: [WinPatrol] => C:\Program Files (x86)\Ruiware\WinPatrol\winpatrol.exe [1223560 2017-05-08] (Ruiware, LLC -> Ruiware)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1001\...\Run: [Google Update] => C:\Users\Thomas\AppData\Local\Google\Update\1.3.36.122\GoogleUpdateCore.exe [223816 2022-01-22] (Google LLC -> Google LLC)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1001\...\Run: [WinPatrol] => C:\Program Files (x86)\Ruiware\WinPatrol\winpatrol.exe [1223560 2017-05-08] (Ruiware, LLC -> Ruiware)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1001\...\Run: [com.squirrel.Teams.Teams] => C:\Users\Thomas\AppData\Local\Microsoft\Teams\Update.exe [2460864 2022-01-24] (Microsoft 3rd Party Application Component -> Microsoft Corporation)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1001\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHSE.EXE [241280 2017-01-17] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1001\...\Run: [Amazon Photos] => C:\Users\Thomas\AppData\Local\Amazon Drive\AmazonPhotos.exe [10327240 2022-01-21] (Amazon.com Services LLC -> Amazon.com Inc.)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1002\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHSE.EXE [241280 2017-01-17] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1002\...\Run: [WinPatrol] => C:\Program Files (x86)\Ruiware\WinPatrol\winpatrol.exe [1223560 2017-05-08] (Ruiware, LLC -> Ruiware)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1002\...\Run: [85DA4430189730440BCE994BB367FCDEF8410EC2._service_run] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=service /prefetch:8
HKU\S-1-5-21-3857314316-2058632593-2671935117-1004\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHSE.EXE [241280 2017-01-17] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1004\...\Run: [Zoom] => [X]
HKU\S-1-5-21-3857314316-2058632593-2671935117-1004\...\Run: [EpicGamesLauncher] => C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe [33337824 2021-09-25] (Epic Games Inc. -> Epic Games, Inc.)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1004\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Greta\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1004\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Greta\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1004\...\RunOnce: [Uninstall 21.245.1128.0002] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Greta\AppData\Local\Microsoft\OneDrive\21.245.1128.0002"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1005\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHSE.EXE [241280 2017-01-17] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1005\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Livia\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1005\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Livia\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1005\...\RunOnce: [Uninstall 21.230.1107.0004] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Livia\AppData\Local\Microsoft\OneDrive\21.230.1107.0004"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1005\...\MountPoints2: {292d91a0-366d-11e8-bae2-1866da388cd8} - "G:\SETUP.EXE" 
HKU\S-1-5-21-3857314316-2058632593-2671935117-1006\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1006\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1006\...\RunOnce: [Uninstall 21.129.0627.0002\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.129.0627.0002\amd64"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1006\...\RunOnce: [Uninstall 21.129.0627.0002] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.129.0627.0002"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1007\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHSE.EXE [241280 2017-01-17] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3857314316-2058632593-2671935117-1007\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Lena2\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1007\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Lena2\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1007\...\RunOnce: [Uninstall 19.192.0926.0012\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Lena2\AppData\Local\Microsoft\OneDrive\19.192.0926.0012\amd64"
HKU\S-1-5-21-3857314316-2058632593-2671935117-1007\...\RunOnce: [Uninstall 19.192.0926.0012] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Lena2\AppData\Local\Microsoft\OneDrive\19.192.0926.0012"
HKU\S-1-5-21-3857314316-2058632593-2671935117-500\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"
HKU\S-1-5-21-3857314316-2058632593-2671935117-500\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Administrator\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe"
HKU\S-1-5-18\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHSE.EXE [241280 2017-01-17] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKU\S-1-5-18\...\Run: [EPLTarget\P0000000000000001] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_YATIHSE.EXE [241280 2017-01-17] (SEIKO EPSON Corporation -> SEIKO EPSON CORPORATION)
HKLM\...\Print\Monitors\Brother QL-700 Monitor: C:\WINDOWS\system32\BSQ70L.DLL [68608 2011-10-13] (Microsoft Windows Hardware Compatibility Publisher -> Brother Industries, Ltd.)
HKLM\...\Print\Monitors\CUSTPDF Writer Monitor x86: C:\WINDOWS\system32\custmon64.dll [87040 2006-11-30] () [Datei ist nicht signiert]
HKLM\...\Print\Monitors\EPSON BX935FWD Series 64MonitorBE: C:\WINDOWS\system32\E_YLMHSE.DLL [120320 2017-01-17] (SEIKO EPSON CORPORATION -> SEIKO EPSON CORPORATION)
HKLM\...\Print\Monitors\FRITZ!fax Color Port Monitor: C:\WINDOWS\system32\FritzColorPort64.dll [20480 2006-02-23] () [Datei ist nicht signiert]
HKLM\...\Print\Monitors\FRITZ!fax Port Monitor: C:\WINDOWS\system32\FritzPort64.dll [20480 2006-02-22] () [Datei ist nicht signiert]
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\97.0.4692.99\Installer\chrmstp.exe [2022-01-20] (Google LLC -> Google LLC)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Capture2Text.exe.lnk [2019-12-29]
ShortcutTarget: Capture2Text.exe.lnk -> D:\Programme\Capture2Text\Capture2Text.exe () [Datei ist nicht signiert]
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DblClick.exe [2020-11-29] () [Datei ist nicht signiert]
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gigaset QuickSync.lnk [2020-09-28]
ShortcutTarget: Gigaset QuickSync.lnk -> C:\Program Files (x86)\Gigaset QuickSync\Gqs.UI.exe (Gigaset Communications GmbH) [Datei ist nicht signiert]
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Synology Cloud Station Drive.lnk [2022-01-30]
ShortcutTarget: Synology Cloud Station Drive.lnk -> C:\Program Files (x86)\Synology\CloudStation\bin\launcher.exe (Synology Inc. -> Synology Inc.) [Datei ist nicht signiert]
GroupPolicy: Beschränkung ? <==== ACHTUNG
GroupPolicyScripts\User: Beschränkung <==== ACHTUNG
Policies: C:\ProgramData\NTUSER.pol: Beschränkung <==== ACHTUNG

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {00C3499E-214F-464A-8F52-90A8EA8AA1AD} - System32\Tasks\Cybereason RansomFree Autostart => C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFree.exe [1065984 2017-11-20] (Cybereason) [Datei ist nicht signiert]
Task: {0FB19829-049C-4A4B-8214-9196B407CD8C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2017-06-13] (Google Inc -> Google Inc.)
Task: {13D75B0A-C019-47EB-A26C-6943287DA3B6} - System32\Tasks\Optimize Push Notification Data File-S-1-5-21-3857314316-2058632593-2671935117-1007 => {201600D8-6EFF-48CE-B842-E14D37A0682D} C:\WINDOWS\System32\wpninprc.dll [24064 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
Task: {1BDAF209-BD9A-4034-9209-A8374E04CC15} - System32\Tasks\AdobeAAMUpdater-1.0-DELL-POWEREDGE--Thomas => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508240 2015-08-05] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {22334A3B-EC15-4DFB-8C99-3B43614140D2} - System32\Tasks\SamsungMagician => C:\Program Files (x86)\Samsung\Samsung Magician\SamsungMagician.exe [2571704 2020-02-14] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
Task: {257C3BF6-876E-44EC-B3C1-629E24276F50} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\MpCmdRun.exe [901048 2021-12-16] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {34C039C0-FD9C-405D-80AC-E6F75EA5AD5A} - System32\Tasks\Mozilla\Firefox Background Update E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\firefox.exe --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla\updates\E7CF176E110C211B\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {4DA27C6D-35B6-46FE-9B0C-971D9FD48F93} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {5271614D-3E5B-4759-9134-1C688C4F610C} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe [316632 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {6869E44C-F510-4FD0-B703-98EE339F312B} - System32\Tasks\RDP Wrapper Autoupdate => cmd.exe /C "c:\Program Files\RDP Wrapper\autoupdate.bat" -log <==== ACHTUNG
Task: {6B697A22-496F-41F7-977E-64EFA8A7CE91} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\MpCmdRun.exe [901048 2021-12-16] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {74AE0B95-51B3-4B03-8B6A-646B63414624} - System32\Tasks\AdobeAAMUpdater-1.0-STUDIO-Greta => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508240 2015-08-05] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {7A834306-4272-4DA8-8861-5D1FD7B5AF1F} - System32\Tasks\AdobeAAMUpdater-1.0-STUDIO-Ute => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508240 2015-08-05] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {86F4D633-0626-4BE0-9C7D-C3EE04948184} - System32\Tasks\RtHDVBg_PushButton => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /IM (Keine Datei)
Task: {87696145-416E-4C1A-82EC-1BFECF1A999B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3857314316-2058632593-2671935117-1001UA => C:\Users\Thomas\AppData\Local\Google\Update\GoogleUpdate.exe [153168 2017-05-27] (Google Inc -> Google Inc.)
Task: {8A5A948B-1978-47B0-9FBB-479C4123E0CA} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3857314316-2058632593-2671935117-1001Core => C:\Users\Thomas\AppData\Local\Google\Update\GoogleUpdate.exe [153168 2017-05-27] (Google Inc -> Google Inc.)
Task: {95D9F136-CB89-48ED-BD78-CAF7A05626D0} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1564424 2021-11-17] (Adobe Inc. -> Adobe Inc.)
Task: {9601E047-5B64-4BCB-989A-1F908B718514} - System32\Tasks\AdobeAAMUpdater-1.0-DELL-POWEREDGE--Lena2 => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508240 2015-08-05] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {9FD2F2DD-1C0E-41A9-A424-F8A5FFB5CDDA} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\MpCmdRun.exe [901048 2021-12-16] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {A7BB5B90-B867-4DB6-9561-F17CA255D6E2} - System32\Tasks\LinuxFS Updater => C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Updater.exe [948416 2018-04-09] (Paragon Software GmbH -> Paragon Software)
Task: {A98A3005-CA5A-4B39-A6EE-BBAE8E2138F7} - System32\Tasks\LinuxFS GUI => C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\Linux File Systems for Windows by Paragon Software.exe [2108608 2018-04-09] (Paragon Software GmbH -> Paragon Software)
Task: {B1A5EB80-2705-4430-9037-194DBA973E24} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task => {3519154C-227E-47F3-9CC9-12C3F05817F1}
Task: {CB1A812D-A5F3-4C6C-BAE7-C07E8EE79E90} - System32\Tasks\Cybereason RansomFree Keepalive => C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFree.exe [1065984 2017-11-20] (Cybereason) [Datei ist nicht signiert]
Task: {D24B414D-AAF2-4769-B573-CFBD85BC9BF7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153168 2017-06-13] (Google Inc -> Google Inc.)
Task: {DDA39070-7FEE-4FF8-AEE0-FA3BB9D37150} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {E42936C8-318F-4F6E-AC4E-C40BC371B6B0} - System32\Tasks\AdobeAAMUpdater-1.0-DELL-POWEREDGE--Lena => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508240 2015-08-05] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
Task: {F078FE2A-BEFD-49F5-93DF-EB5DBC81F481} - System32\Tasks\PostponeDeviceSetupToast_S-1-5-21-3857314316-2058632593-2671935117-1006_1 => {5ded83ef-1e99-48cf-bf83-676d2a6db408} C:\Windows\System32\oobe\UserOOBE.dll [420864 2021-12-15] (Microsoft Windows -> Microsoft Corporation)
Task: {F2085965-6947-4C05-9FD2-63F8FDA840EC} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\MpCmdRun.exe [901048 2021-12-16] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {F85116AC-60E7-42A5-999A-744099B57EEA} - System32\Tasks\Mozilla\Firefox Default Browser Agent E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe do-task "E7CF176E110C211B"

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)


==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3: <==== ACHTUNG (Beschränkung - Zones)
Hosts: 127.0.0.1 view-localhost # view localhost server
Tcpip\Parameters: [DhcpNameServer] 192.168.198.1
Tcpip\..\Interfaces\{26dd1dd2-87d0-48a5-b27a-d0a505ad9cb0}: [DhcpNameServer] 192.168.198.1
Tcpip\..\Interfaces\{37cae581-cb72-4ff4-90fb-d59b0df46e85}: [DhcpNameServer] 192.168.209.122
Tcpip\..\Interfaces\{5bd0a52b-d29e-4f89-816d-ebfaad9033f6}: [DhcpNameServer] 192.168.55.9
Tcpip\..\Interfaces\{7a8472ff-0284-4cbb-abf0-f1cae0dea8a4}: [DhcpNameServer] 192.168.0.1

Edge: 
=======
Edge Profile: C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default [2021-07-28]
Edge Extension: (Kaspersky Protection) - C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ahkjpbeeocnddjkakilopmfdlnjdpcdm [2021-05-13]

FireFox:
========
FF DefaultProfile: 39b7uhaz.default
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\39b7uhaz.default [2022-01-30]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: Adobe Acrobat -> C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\nppdf32.dll [2021-12-24] (Adobe Inc. -> Adobe Systems Inc.)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-08-06] (Adobe Systems Incorporated -> Adobe Systems)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll [2011-11-03] (Electronic Sports Network i Sverige AB -> ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll [2013-09-16] (ESN Social Software AB) [Datei ist nicht signiert]
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2019-06-26] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\npctrl.dll [2018-10-23] (Microsoft Corporation ->  Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.2.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=3.0.7.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2019-06-11] (VideoLAN -> VideoLAN)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-08-06] (Adobe Systems Incorporated -> Adobe Systems)
FF Plugin HKU\S-1-5-21-3857314316-2058632593-2671935117-1004: @zoom.us/ZoomVideoPlugin -> C:\Users\Greta\AppData\Roaming\Zoom\bin\npzoomplugin.dll [2020-05-13] (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)

==================== Dienste (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 AdobeActiveFileMonitor12.0; C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [181152 2013-09-25] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
R2 AdobeARMservice; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [169728 2021-11-17] (Adobe Inc. -> Adobe Inc.)
S3 AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [344064 2009-04-08] (AVerMedia) [Datei ist nicht signiert]
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Computersysteme Vertriebs GmbH -> AVM Berlin)
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Computersysteme Vertriebs GmbH -> AVM Berlin)
R2 cjpcsc; C:\WINDOWS\SysWOW64\cjpcsc.exe [611336 2018-11-15] (Reiner Kartengeraete GmbH und Co.KG -> REINER SCT)
R2 client_service; C:\Program Files (x86)\VMware\VMware Horizon View Client\ClientService\horizon_client_service.exe [442840 2020-03-23] (VMware, Inc. -> VMware, Inc.)
R2 Cloud Station Drive VSS Service x64; C:\Program Files (x86)\Synology\CloudStation\bin\vss-service-x64.exe [287768 2018-08-13] (Synology Inc. -> ) [Datei ist nicht signiert]
R2 CybereasonRansomFree; C:\Program Files (x86)\Cybereason\RansomFree\CybereasonRansomFreeServiceHost.exe [13824 2017-11-20] (Cybereason) [Datei ist nicht signiert]
R2 ftnlsv3hv; C:\Program Files\Common Files\VMware\DeviceRedirectionCommon\ftnlsv.exe [280176 2020-02-25] (FabulaTech, LLP -> )
R2 ftscanmgrhv; C:\Program Files\Common Files\VMware\ScannerRedirection\ftscanmgrhv.exe [4369520 2020-02-27] (FabulaTech, LLP -> )
S3 LogiFacecamService; C:\Program Files\Logitech\LogiCapture\bin\Service\LogiFacecamService.exe [498576 2021-02-04] (Logitech Inc -> Logitech)
R2 MacriumService; C:\Program Files\Macrium\Common\MacriumService.exe [8929608 2021-11-17] (Paramount Software UK Ltd -> Paramount Software UK Ltd)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Computersysteme Vertriebs GmbH -> AVM Berlin)
S3 Origin Client Service; F:\Program Files (x86)\Origin\OriginClientService.exe [2562776 2022-01-18] (Electronic Arts, Inc. -> Electronic Arts)
R2 Origin Web Helper Service; F:\Program Files (x86)\Origin\OriginWebHelperService.exe [3481312 2022-01-18] (Electronic Arts, Inc. -> Electronic Arts)
R2 ParagonLinuxFSMounter; C:\Program Files (x86)\Paragon Software\LinuxFS for Windows\paragon_service.exe [2883264 2018-04-09] (Paragon Software GmbH -> Paragon Software)
R2 PDF24; C:\Program Files (x86)\PDF24\pdf24.exe [486464 2020-10-01] (geek software GmbH -> geek software GmbH)
R2 PnkBstrA; C:\WINDOWS\SysWOW64\PnkBstrA.exe [76888 2021-06-09] (Even Balance, Inc. -> )
R2 PrivateInternetAccessService; C:\Program Files\Private Internet Access\pia-service.exe [2223016 2021-05-03] (Private Internet Access, Inc. -> )
S3 PrivateInternetAccessWireguard; C:\Program Files\Private Internet Access\pia-wgservice.exe [4447520 2021-05-03] (Private Internet Access, Inc. -> )
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [6137040 2022-01-12] (Microsoft Windows Publisher -> Microsoft Corporation)
S2 SetupARService; C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe [10752 2017-05-14] () [Datei ist nicht signiert]
R2 TermService; C:\Program Files\RDP Wrapper\rdpwrap.dll [116736 2021-12-17] (Stas'M Corp.) [Datei ist nicht signiert] <==== ACHTUNG (kein ServiceDLL)
R2 vmwsprrdpwks; C:\Program Files\Common Files\VMware\SerialPortRedirection\Client\vmwsprrdpwks.exe [459888 2020-02-20] (FabulaTech, LLP -> VMware)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\NisSrv.exe [2876152 2021-12-16] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WebUpdate4; C:\WINDOWS\SysWOW64\WebUpdateSvc4.exe [262360 2008-09-15] (Data Perceptions -> Data Perceptions / PowerProgrammer)
R2 WifiAutoInstallSrv; C:\Program Files\Realtek\WifiAutoInstall\WifiAutoInstallSrv.exe [124864 2017-07-31] (Realtek Semiconductor Corp. -> Realtek)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\MsMpEng.exe [128360 2021-12-16] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R1 avm_nwim; C:\WINDOWS\system32\DRIVERS\avmnwim.sys [396088 2017-03-17] (WDKTestCert shuebner,130916460956458304 -> AVM)
S3 cjusb; C:\WINDOWS\System32\drivers\cjusb.sys [43224 2017-03-28] (REINER Kartengeraete GmbH & Co. KG -> REINER SCT)
R3 dcdbas; C:\WINDOWS\System32\drivers\dcdbas64.sys [39480 2014-02-19] (Dell Inc. -> Dell Inc.)
S3 DDDriver; C:\WINDOWS\System32\drivers\dddriver64Dcsa.sys [43400 2021-09-09] (Microsoft Windows Hardware Compatibility Publisher -> Dell Technologies)
R2 Dokan; C:\WINDOWS\System32\DRIVERS\dokan.sys [76608 2018-04-09] (Paragon Software GmbH -> Windows (R) Win 7 DDK provider)
S3 epmntdrv; C:\WINDOWS\system32\epmntdrv.sys [16776 2011-07-29] (CHENGDU YIWO Tech Development Co., Ltd. -> ) [Datei ist nicht signiert]
S3 EuGdiDrv; C:\WINDOWS\system32\EuGdiDrv.sys [9096 2011-07-29] (CHENGDU YIWO Tech Development Co., Ltd. -> ) [Datei ist nicht signiert]
R3 MagicianSataModeReader; C:\Program Files (x86)\Samsung\Samsung Magician\magdrvamd64.sys [16312 2020-02-14] (Samsung Electronics CO., LTD. -> Samsung India Software Operations (SISO))
R2 NPF; F:\Program Files (x86)\Ezviz Studio\npf64.sys [36600 2019-12-12] (Riverbed Technology, Inc. -> Riverbed Technology, Inc.)
R0 PxHlpa64; C:\WINDOWS\System32\drivers\PxHlpa64.sys [56336 2013-07-19] (Corel Corporation -> Corel Corporation)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
R3 tap-pia-0901; C:\WINDOWS\System32\drivers\tap-pia-0901.sys [39944 2020-12-09] (Microsoft Windows Hardware Compatibility Publisher -> The OpenVPN Project)
S3 vmulti; C:\WINDOWS\System32\drivers\vmulti.sys [19600 2018-11-19] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [48536 2021-12-16] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [435432 2021-12-16] (Microsoft Windows -> Microsoft Corporation)
S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [151184 2016-07-15] (NGO -> MBB)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [86248 2021-12-16] (Microsoft Windows -> Microsoft Corporation)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2022-01-30 20:38 - 2022-01-30 20:39 - 000036373 _____ C:\Users\Admin\Desktop\FRST.txt
2022-01-30 20:35 - 2022-01-30 20:35 - 000000000 ____D C:\Users\Admin\Documents\Benutzerdefinierte Office-Vorlagen
2022-01-30 20:12 - 2022-01-30 20:12 - 000000002 _____ C:\Users\Admin\Desktop\utatxhggardnf.txt
2022-01-30 20:12 - 2022-01-30 20:12 - 000000002 _____ C:\Users\Admin\Desktop\dbeonezsxyyhgopfo.txt
2022-01-30 20:11 - 2022-01-30 20:11 - 000000002 _____ C:\Users\Admin\Desktop\wssqylahht.txt
2022-01-30 20:11 - 2022-01-30 20:11 - 000000002 _____ C:\Users\Admin\Desktop\ghravyndyhub.txt
2022-01-30 19:41 - 2022-01-30 19:41 - 000000000 ____D C:\Users\Admin\AppData\Local\SolidDocuments
2022-01-30 19:41 - 2022-01-30 19:41 - 000000000 ____D C:\Users\Admin\AppData\Local\CEF
2022-01-30 19:34 - 2022-01-30 20:38 - 000000000 ____D C:\FRST
2022-01-30 19:33 - 2022-01-30 19:33 - 002311680 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2022-01-30 19:33 - 2022-01-30 19:33 - 002311680 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2022-01-30 19:30 - 2022-01-30 19:30 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-3857314316-2058632593-2671935117-1006
2022-01-30 19:29 - 2022-01-30 19:29 - 000004040 _____ C:\WINDOWS\system32\Tasks\PostponeDeviceSetupToast_S-1-5-21-3857314316-2058632593-2671935117-1006_1
2022-01-30 19:29 - 2022-01-30 19:29 - 000000000 __SHD C:\Users\Admin\Desktop\0K, this directory is for Ransomware detection (just leave it here)
2022-01-30 19:29 - 2022-01-30 19:29 - 000000000 ___HD C:\Users\Admin\Documents\Fimages207
2022-01-30 19:29 - 2022-01-30 19:29 - 000000000 ___HD C:\Users\Admin\Documents\Dcache9
2022-01-30 19:26 - 2022-01-30 19:26 - 002311680 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
2022-01-30 12:53 - 2022-01-30 12:53 - 000000000 __SHD C:\Users\Thomas\Desktop\0K, this directory is for Ransomware detection (just leave it here)
2022-01-30 12:53 - 2022-01-30 12:53 - 000000000 ___HD C:\Users\X65yi1
2022-01-30 12:53 - 2022-01-30 12:53 - 000000000 ___HD C:\Users\Aa8ailyl
2022-01-30 12:53 - 2022-01-30 12:53 - 000000000 ____D C:\Yversion156
2022-01-30 12:53 - 2022-01-30 12:53 - 000000000 ____D C:\anscans153
2022-01-30 12:09 - 2022-01-30 12:17 - 000000000 ____D C:\ProgramData\PCDr
2022-01-30 12:07 - 2022-01-30 12:07 - 000000000 ____D C:\ProgramData\Dell Inc
2022-01-28 12:43 - 2022-01-30 12:30 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2022-01-25 21:25 - 2022-01-25 21:25 - 000000017 _____ C:\Users\Ute\AppData\Local\resmon.resmoncfg
2022-01-25 21:07 - 2022-01-25 21:23 - 000000000 ____D C:\Users\Thomas\AppData\Local\Amazon Drive
2022-01-24 16:34 - 2022-01-24 16:34 - 000001961 _____ C:\Users\Ute\Desktop\Zoom.lnk
2022-01-23 18:07 - 2022-01-30 20:03 - 000001272 _____ C:\Users\Thomas\Desktop\Amazon Backup.lnk
2022-01-23 17:57 - 2022-01-25 21:07 - 000001262 _____ C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Photos.lnk
2022-01-23 17:57 - 2022-01-25 21:07 - 000000000 ____D C:\Users\Thomas\AppData\Roaming\Amazon Cloud Drive
2022-01-12 16:28 - 2022-01-18 16:34 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2022-01-12 15:13 - 2022-01-12 15:13 - 000523776 _____ (curl, hxxps://curl.se/) C:\WINDOWS\system32\curl.exe
2022-01-12 15:13 - 2022-01-12 15:13 - 000464384 _____ (curl, hxxps://curl.se/) C:\WINDOWS\SysWOW64\curl.exe
2022-01-12 15:12 - 2022-01-12 15:12 - 000011797 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2022-01-12 15:05 - 2022-01-12 15:05 - 000000000 ___HD C:\$WinREAgent
2022-01-02 19:22 - 2022-01-02 19:22 - 000001471 _____ C:\Users\Thomas\Desktop\MiPCSuite.lnk
2022-01-02 19:22 - 2022-01-02 19:22 - 000000000 ____D C:\Users\Public\Thunder Network
2022-01-02 19:22 - 2022-01-02 19:22 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Xiaomi
2022-01-02 19:22 - 2022-01-02 19:22 - 000000000 ____D C:\ProgramData\Thunder Network
2022-01-02 19:21 - 2022-01-02 19:21 - 000000000 ____D C:\Users\Thomas\AppData\Local\MiPhoneManager
2021-12-31 13:52 - 2021-12-31 13:52 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Macrium

==================== Ein Monat (geänderte) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2022-01-30 20:24 - 2020-08-15 14:56 - 000000000 ____D C:\Users\Thomas\AppData\Local\Deployment
2022-01-30 20:15 - 2017-06-13 12:49 - 000000000 ____D C:\Program Files (x86)\Google
2022-01-30 20:03 - 2020-02-29 14:40 - 000000000 ____D C:\ProgramData\Mozilla
2022-01-30 20:02 - 2020-08-15 14:38 - 000000000 ____D C:\Users\Thomas
2022-01-30 20:02 - 2019-10-19 13:53 - 000000000 ____D C:\Users\Thomas\AppData\Roaming\Capture2Text
2022-01-30 20:02 - 2018-11-23 16:48 - 000000000 ____D C:\Users\Thomas\AppData\Local\CloudStation
2022-01-30 20:02 - 2017-03-18 12:32 - 000000000 ____D C:\Users\Thomas\AppData\LocalLow\Mozilla
2022-01-30 20:01 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2022-01-30 20:01 - 2017-06-16 15:42 - 000000000 ____D C:\ProgramData\NVIDIA
2022-01-30 20:00 - 2019-12-07 10:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2022-01-30 19:41 - 2017-12-14 17:46 - 000000000 ____D C:\Users\Admin\AppData\Local\Adobe
2022-01-30 19:41 - 2017-08-09 17:18 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Adobe
2022-01-30 19:37 - 2019-12-07 10:13 - 000000000 ____D C:\WINDOWS\INF
2022-01-30 19:30 - 2020-08-15 14:54 - 000003362 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3857314316-2058632593-2671935117-1006
2022-01-30 19:30 - 2020-08-15 14:38 - 000002435 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2022-01-30 19:30 - 2019-12-07 10:14 - 000000000 ___HD C:\Program Files\WindowsApps
2022-01-30 19:30 - 2017-11-30 20:42 - 000000000 ____D C:\Users\Admin\AppData\Local\Packages
2022-01-30 19:29 - 2018-05-29 14:43 - 000000000 ____D C:\Users\Admin\AppData\LocalLow\Mozilla
2022-01-30 19:26 - 2020-08-15 14:54 - 000004156 _____ C:\WINDOWS\system32\Tasks\User_Feed_Synchronization-{6717A491-6C7C-4B2E-87BD-6676C39C4D5F}
2022-01-30 19:00 - 2020-08-15 14:38 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2022-01-30 13:15 - 2019-12-07 15:52 - 000000000 ____D C:\WINDOWS\system32\FxsTmp
2022-01-30 13:14 - 2017-05-14 17:18 - 000000000 ____D C:\Users\Thomas\AppData\Roaming\VMware
2022-01-30 13:00 - 2020-08-15 15:16 - 000783646 _____ C:\WINDOWS\system32\perfh00C.dat
2022-01-30 13:00 - 2020-08-15 15:16 - 000150252 _____ C:\WINDOWS\system32\perfc00C.dat
2022-01-30 13:00 - 2020-08-15 14:45 - 002665960 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2022-01-30 13:00 - 2019-12-07 15:51 - 000747390 _____ C:\WINDOWS\system32\perfh007.dat
2022-01-30 13:00 - 2019-12-07 15:51 - 000151256 _____ C:\WINDOWS\system32\perfc007.dat
2022-01-30 12:53 - 2020-12-20 19:37 - 000000000 _____ C:\WINDOWS\system32\NULL
2022-01-30 12:53 - 2020-08-15 14:54 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2022-01-30 12:53 - 2020-08-15 14:37 - 000001134 _____ C:\WINDOWS\system32\config\VSMIDK
2022-01-30 12:53 - 2018-04-27 12:10 - 000000447 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics
2022-01-30 12:50 - 2019-12-07 10:03 - 002097152 _____ C:\WINDOWS\system32\config\BBI
2022-01-30 12:30 - 2020-01-21 17:41 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2022-01-30 12:29 - 2021-03-13 13:30 - 000000000 ____D C:\Users\Thomas\AppData\Roaming\Signal
2022-01-30 12:29 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\AppLocker
2022-01-30 12:28 - 2021-10-13 19:04 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2022-01-30 12:28 - 2017-03-18 12:32 - 000001232 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2022-01-30 12:20 - 2017-12-10 14:11 - 000000000 ____D C:\Users\Livia\AppData\LocalLow\Mozilla
2022-01-30 12:20 - 2017-05-11 10:11 - 000000000 ____D C:\Users\Ute\AppData\LocalLow\Mozilla
2022-01-30 12:17 - 2020-08-15 14:38 - 000000000 ____D C:\Users\Greta
2022-01-30 12:10 - 2018-06-21 05:25 - 000000000 ____D C:\ProgramData\Packages
2022-01-30 12:10 - 2017-11-30 20:42 - 000000000 ____D C:\Users\Thomas\AppData\Local\Packages
2022-01-30 12:09 - 2017-05-14 11:17 - 000000000 ____D C:\ProgramData\Dell
2022-01-30 09:45 - 2018-01-28 15:34 - 000000000 ____D C:\Users\Greta\AppData\Local\Adobe
2022-01-30 09:45 - 2017-11-21 20:32 - 000000000 ____D C:\Users\Ute\AppData\Local\Adobe
2022-01-30 09:45 - 2017-05-14 11:07 - 000000000 ____D C:\Users\Thomas\AppData\Local\Adobe
2022-01-29 09:09 - 2020-07-11 13:48 - 000002436 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2022-01-29 09:09 - 2020-07-11 13:48 - 000002274 _____ C:\Users\Public\Desktop\Microsoft Edge.lnk
2022-01-28 08:59 - 2020-08-15 14:54 - 000003700 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2022-01-28 08:59 - 2020-08-15 14:54 - 000003576 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2022-01-27 11:48 - 2021-12-13 15:24 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-3857314316-2058632593-2671935117-1004
2022-01-27 11:48 - 2020-08-15 14:54 - 000003362 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3857314316-2058632593-2671935117-1004
2022-01-27 11:48 - 2020-08-15 14:38 - 000002435 _____ C:\Users\Greta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2022-01-26 19:19 - 2021-12-13 17:29 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-3857314316-2058632593-2671935117-1001
2022-01-26 19:19 - 2021-03-10 09:40 - 000003364 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3857314316-2058632593-2671935117-1001
2022-01-26 19:19 - 2020-08-15 14:38 - 000002438 _____ C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2022-01-26 15:40 - 2017-06-11 17:43 - 000000000 ____D C:\ProgramData\Origin
2022-01-26 15:36 - 2017-07-27 13:52 - 000000000 ____D C:\Users\Greta\AppData\Local\Origin
2022-01-25 16:39 - 2021-12-13 10:58 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-3857314316-2058632593-2671935117-1005
2022-01-25 16:39 - 2020-08-15 14:54 - 000003362 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3857314316-2058632593-2671935117-1005
2022-01-25 16:39 - 2020-08-15 14:38 - 000002435 _____ C:\Users\Livia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2022-01-24 21:13 - 2020-08-15 14:38 - 000000000 ____D C:\Users\Admin
2022-01-24 16:51 - 2018-11-16 13:28 - 000000000 ____D C:\Users\Livia\AppData\Local\Adobe
2022-01-24 16:38 - 2020-04-29 10:33 - 000000000 ____D C:\Users\Ute\AppData\Roaming\Zoom
2022-01-24 16:36 - 2018-11-09 08:21 - 000000000 ____D C:\Users\Ute\AppData\Local\D3DSCache
2022-01-24 16:29 - 2020-08-15 14:38 - 000000000 ____D C:\Users\Ute
2022-01-24 02:54 - 2020-04-06 14:38 - 000002409 _____ C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Teams.lnk
2022-01-24 02:54 - 2020-04-06 14:38 - 000002401 _____ C:\Users\Thomas\Desktop\Microsoft Teams.lnk
2022-01-24 02:23 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\ServiceState
2022-01-23 18:00 - 2018-05-30 20:48 - 000000000 ____D C:\Users\Thomas\AppData\Local\D3DSCache
2022-01-23 14:31 - 2017-05-31 12:42 - 000000000 ____D C:\Users\Greta\AppData\LocalLow\Mozilla
2022-01-22 12:08 - 2020-08-15 14:54 - 000003898 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskUserS-1-5-21-3857314316-2058632593-2671935117-1001UA
2022-01-22 12:08 - 2020-08-15 14:54 - 000003630 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskUserS-1-5-21-3857314316-2058632593-2671935117-1001Core
2022-01-21 12:10 - 2020-08-15 14:54 - 000003632 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
2022-01-21 12:10 - 2020-08-15 14:54 - 000003508 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
2022-01-20 13:24 - 2019-11-17 14:13 - 000002293 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2022-01-19 17:13 - 2021-12-11 14:22 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-3857314316-2058632593-2671935117-1002
2022-01-19 17:13 - 2020-08-15 14:54 - 000003358 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3857314316-2058632593-2671935117-1002
2022-01-19 17:13 - 2020-08-15 14:38 - 000002429 _____ C:\Users\Ute\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2022-01-13 17:11 - 2020-08-15 14:38 - 003624496 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2022-01-13 17:10 - 2020-08-15 15:13 - 000000000 ____D C:\Program Files\Hyper-V
2022-01-13 17:10 - 2019-12-07 15:54 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2022-01-13 17:10 - 2019-12-07 10:14 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2022-01-13 17:10 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2022-01-13 17:10 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\SystemResources
2022-01-13 17:10 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\setup
2022-01-13 17:10 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2022-01-13 17:10 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\system32\Dism
2022-01-13 17:10 - 2019-12-07 10:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2022-01-13 17:03 - 2021-11-21 19:39 - 000002073 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat DC.lnk
2022-01-13 17:03 - 2021-11-21 19:39 - 000002061 _____ C:\Users\Public\Desktop\Adobe Acrobat DC.lnk
2022-01-13 17:03 - 2020-08-15 14:54 - 000004562 _____ C:\WINDOWS\system32\Tasks\Adobe Acrobat Update Task
2022-01-12 15:15 - 2019-12-07 10:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2022-01-12 15:05 - 2017-01-19 20:47 - 000000000 ____D C:\WINDOWS\system32\MRT
2022-01-12 15:01 - 2017-01-19 20:47 - 145765912 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2022-01-09 17:16 - 2020-06-09 12:37 - 000071880 _____ C:\WINDOWS\system32\Drivers\SNAPSHOD0.sys
2022-01-09 14:44 - 2021-10-25 18:37 - 000000000 ____D C:\Users\Admin\AppData\Local\Buhl
2022-01-09 14:44 - 2020-09-20 15:53 - 000000000 ____D C:\Program Files (x86)\Steuer 2019
2022-01-08 16:37 - 2019-07-28 09:27 - 000002049 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Banking4.lnk
2022-01-08 14:16 - 2021-12-05 14:16 - 000000000 ____D C:\Users\Thomas\AppData\Roaming\Notion
2022-01-08 13:52 - 2019-07-24 21:39 - 000000000 ____D C:\Users\Thomas\AppData\Roaming\vlc
2022-01-08 10:10 - 2019-12-07 10:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2022-01-08 10:09 - 2020-11-27 17:26 - 000002328 _____ C:\Users\Lena2\Desktop\Google Chrome.lnk
2022-01-08 10:09 - 2018-04-11 19:08 - 000000000 ____D C:\Users\Lena2\AppData\Local\Packages
2022-01-05 13:46 - 2020-08-15 14:38 - 000000000 ____D C:\Users\Livia
2022-01-02 19:22 - 2020-02-23 16:22 - 000000000 ____D C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xiaomi
2021-12-31 13:52 - 2020-02-16 14:22 - 000002023 _____ C:\Users\Public\Desktop\Macrium Reflect.lnk
2021-12-31 13:52 - 2020-02-16 14:22 - 000000000 ____D C:\Program Files\Macrium

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========

2021-05-20 07:38 - 2021-12-19 14:35 - 000000205 _____ () C:\Users\Admin\AppData\Local\oobelibMkey.log

==================== SigCheck ============================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

==================== Ende von FRST.txt ========================