| |
| |||||||
Log-Analyse und Auswertung: Habe ich eac-0.99pb5.exe / TrojanClicker:Win32/Vabector!rln ausversehen ausgeführt?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
Gestern, 18:22
| #1 |
 |  Habe ich eac-0.99pb5.exe / TrojanClicker:Win32/Vabector!rln ausversehen ausgeführt? Liebes Forum, ich habe gestern ein sehr altes Backup übertragen wollen. Vor dem Kopieren auf einen neuen Datenträger führte ich eine Scann mit dem Windows-Defender, der dreimal die selbe Datei fand und sie als gefährlich auswies: eac-0.99pb5.exe / TrojanClicker:Win32/Vabector!rln Der Defender verschob die Datei direkt in die Quarantäne. Da ich sie nochmal von VirusTotal untersuchen lassen wollte, ließ ich sie wiederherstellen und kopierte sie auf einen USB-Stick. Dort wurde sie sofort wieder in Quarantäne verschoben. Beim zweiten Versuch gelang es mir den Stick rechtzeitig zu ziehen (ich habe die VirusTotal-Untersuchung dann später von Linux aus durchgeführt). Leider kann ich nicht ausschließen, dass ich beim zweiten Versuch womöglich ausversehen einen Doppelklick auf die entdeckte Datei gemacht habe. Daher bin ich jetzt unsicher, ob mein Rechner womöglich befallen ist und habe einen FRST-Scan mit Admin-Rechten durchgeführt. Leider funkte mir das Windows 11-Update auf 25H2 dazwischen und so wurde der Rechner upgedatet, bevor ich die Scans durchführen konnte. Hier sind jedenfalls die Logs: FRST Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-10-2025
Ran by win11-admin (administrator) on DESKTOP-I2R5D67 (ASUS System Product Name) (12-10-2025 19:02:27)
Running from C:\Users\win11-nutzer\Desktop\FRST64.exe
Loaded Profiles: win11-admin & win11-nutzer
Platform: Microsoft Windows 11 Home Version 25H2 26200.6725 (X64) Language: Deutsch (Deutschland) -> Deutsch (Deutschland)
Default browser: Edge
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(DriverStore\FileRepository\u0386350.inf_amd64_cf354da277d39d93\B386336\atiesrxx.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0386350.inf_amd64_cf354da277d39d93\B386336\atieclxx.exe
(explorer.exe ->) (IDRIX SARL -> AM Crypto) C:\Program Files\VeraCrypt\VeraCrypt.exe
(explorer.exe ->) (iPSMonitor) [File not signed] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\iPSMonitor.exe
(services.exe ->) () [File not signed] C:\Program Files (x86)\Brother\iPrint&Scan\UsbAppControl\USBAppControl.exe
(services.exe ->) () [File not signed] C:\Program Files (x86)\Brother\iPrint&Scan\WorkflowAppControl\WorkflowAppControl.exe
(services.exe ->) (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.) C:\Windows\System32\amdfendrsr.exe
(services.exe ->) (Advanced Micro Devices Inc. -> AMD) C:\Windows\System32\DriverStore\FileRepository\u0386350.inf_amd64_cf354da277d39d93\B386336\atiesrxx.exe
(services.exe ->) (ASUSTeK COMPUTER INC. -> ) C:\Windows\System32\AsusUpdateCheck.exe
(services.exe ->) (Brother Industries, Ltd.) [File not signed] C:\Program Files (x86)\Browny02\BrYNSvc.exe
(services.exe ->) (IDRIX SARL -> AM Crypto) C:\Windows\System32\VeraCrypt.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpDefenderCoreService.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\NisSrv.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.StartExperiencesApp_1.124.0.0_x64__8wekyb3d8bbwe\MicrosoftStartFeedProvider\MicrosoftStartFeedProvider.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Users\win11-nutzer\AppData\Local\Microsoft\OneDrive\25.179.0914.0003\FileCoAuth.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Users\win11-nutzer\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\NgcIso.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\UUS\amd64\MoUsoCoreWorker.exe
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\RunOnce: [TzSyncRunOnce] => C:\Windows\System32\tzsync.exe [244736 2025-10-01] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\RunOnce: [msedge_cleanup_{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}] => C:\Program Files (x86)\Microsoft\EdgeWebView\Application\140.0.3485.94\Installer\setup.exe [7631400 2025-09-29] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3113707754-1945858852-1597664037-1002\...\Run: [VeraCrypt] => C:\Program Files\VeraCrypt\VeraCrypt.exe [6151904 2025-05-29] (IDRIX SARL -> AM Crypto)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Brother iPSMonitor.lnk [2025-08-27]
ShortcutTarget: Brother iPSMonitor.lnk -> C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\iPSMonitor.exe (iPSMonitor) [File not signed]
==================== Scheduled Tasks (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File)
Task: {0BB36A32-0D9E-4297-AFD7-6BD7B5DB4C9B} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File)
Task: {33039E33-0516-45B4-B275-651AE94FE915} - System32\Tasks\Microsoft\Windows\UsageAndQualityInsights\UsageAndQualityInsights-MaintenanceTask => C:\Windows\System32\Microsoft.Data.UsageAndQualityInsights.MaintenanceTask.exe [86016 2025-10-01] (Microsoft Windows -> )
Task: {164ADDC3-DB71-4478-9A97-BB8429B7E96D} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe [1778248 2025-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {8ACAAC65-76A9-49FF-80CB-9190DC0B2EAE} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe [1778248 2025-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {7A6416BA-97D5-4DAC-8AFA-B46BC823F925} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe [1778248 2025-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {36E727BD-EACC-464B-B8C2-AD7C9C826357} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpCmdRun.exe [1778248 2025-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {86A8A6B4-3899-4422-A4A6-0E1F8F56F924} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-3113707754-1945858852-1597664037-1002 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [693376 2025-10-03] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (the data entry has 6 more characters).
Task: {3DB97B2B-322C-4AFA-87AD-D62435B8F618} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [34944 2025-10-03] (Mozilla Corporation -> Mozilla Foundation)
Task: {DC2A8600-A8BB-4737-8DBF-7B46119667E1} - System32\Tasks\OneDrive Startup Task-S-1-5-21-3113707754-1945858852-1597664037-1002 => C:\Users\win11-nutzer\AppData\Local\Microsoft\OneDrive\25.179.0914.0003\OneDriveLauncher.exe [725864 2025-10-12] (Microsoft Corporation -> Microsoft Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{03cbf990-32be-4ece-9aac-36efd508e25d}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{03cbf990-32be-4ece-9aac-36efd508e25d}: [DhcpDomain] fritz.box
Edge:
=======
Edge Profile: C:\Users\win11-admin\AppData\Local\Microsoft\Edge\User Data\Default [2025-07-06]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AsusUpdateCheck; C:\WINDOWS\System32\AsusUpdateCheck.exe [1207656 2025-10-12] (ASUSTeK COMPUTER INC. -> )
R2 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [504320 2025-08-08] (Brother Industries, Ltd.) [File not signed]
R2 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MpDefenderCoreService.exe [2009656 2025-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 midisrv; C:\WINDOWS\system32\midisrv.exe [593920 2025-10-01] (Microsoft Windows -> Microsoft Corporation)
R2 USBAppControl; C:\Program Files (x86)\Brother\iPrint&Scan\UsbAppControl\USBAppControl.exe [11776 2025-08-08] () [File not signed]
R2 VeraCryptSystemFavorites; C:\Windows\system32\VeraCrypt.exe [6151904 2025-05-29] (IDRIX SARL -> AM Crypto)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\NisSrv.exe [4414464 2025-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.25080.5-0\MsMpEng.exe [282480 2025-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WorkflowAppControl; C:\Program Files (x86)\Brother\iPrint&Scan\WorkflowAppControl\WorkflowAppControl.exe [20992 2025-08-08] () [File not signed]
S3 wuqisvc; C:\WINDOWS\System32\Microsoft.Data.UsageAndQualityInsights.dll [503808 2025-10-01] (Microsoft Windows -> Microsoft Corporation)
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 amdfendrmgr; C:\WINDOWS\System32\drivers\amdfendrmgr.sys [45936 2022-12-07] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
R3 amduw23g; C:\WINDOWS\System32\DriverStore\FileRepository\u0400644.inf_amd64_9691c8ee1bbfcbb7\B399690\amdkmdag.sys [100084632 2024-02-27] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
R3 amdwddmg; C:\WINDOWS\System32\DriverStore\FileRepository\u0386350.inf_amd64_cf354da277d39d93\B386336\amdkmdag.sys [100956608 2022-12-07] (Advanced Micro Devices Inc. -> Advanced Micro Devices, Inc.)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [602112 2025-07-20] (Microsoft Corporation) [File not signed]
S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [204800 2025-07-20] (Microsoft Corporation) [File not signed]
S3 BTHMODEM; C:\WINDOWS\System32\drivers\bthmodem.sys [110592 2025-07-20] (Microsoft Corporation) [File not signed]
R3 e2fexpress; C:\WINDOWS\System32\DriverStore\FileRepository\e2f.inf_amd64_b0343b02ae8bdfed\e2f.sys [530048 2023-12-10] (Intel Corporation -> Intel Corporation)
R3 KslD; C:\WINDOWS\System32\drivers\wd\KslD.sys [333216 2025-09-18] (Microsoft Windows -> Microsoft Corporation)
R0 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [640672 2025-05-29] (Microsoft Windows Hardware Compatibility Publisher -> AM Crypto)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [20880 2025-09-18] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [627104 2025-09-18] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [102816 2025-09-18] (Microsoft Windows -> Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2025-10-12 19:02 - 2025-10-12 19:02 - 000012127 _____ C:\Users\win11-nutzer\Desktop\FRST.txt
2025-10-12 19:01 - 2025-10-12 19:02 - 000000000 ____D C:\FRST
2025-10-12 18:59 - 2025-10-12 18:59 - 002442752 _____ (Farbar) C:\Users\win11-nutzer\Desktop\FRST64.exe
2025-10-12 18:57 - 2025-10-12 18:57 - 000000000 ____D C:\WINDOWS\CbsTemp
2025-10-12 13:43 - 2025-10-12 13:43 - 000707760 _____ C:\WINDOWS\system32\perfh007.dat
2025-10-12 13:43 - 2025-10-12 13:43 - 000150734 _____ C:\WINDOWS\system32\perfc007.dat
2025-10-12 09:53 - 2025-10-12 09:53 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2025-10-03 20:05 - 2025-10-11 20:20 - 000000000 ____D C:\Program Files\Mozilla Firefox
2025-10-02 22:53 - 2025-10-02 22:53 - 000000000 ____D C:\ProgramData\Whesvc
2025-10-01 12:17 - 2025-10-01 12:17 - 000035125 _____ C:\WINDOWS\SysWOW64\IntegratedServicesRegionPolicySet.json
2025-10-01 12:17 - 2025-10-01 12:17 - 000035125 _____ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json
2025-09-29 13:54 - 2025-09-29 13:54 - 000001031 _____ C:\Users\win11-nutzer\count_extBU2.txt
2025-09-25 13:51 - 2025-09-25 13:51 - 000000000 ____D C:\Users\win11-nutzer\Desktop\test
2025-09-25 13:49 - 2025-09-29 13:25 - 000000000 ____D C:\Users\win11-nutzer\Skripte
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2025-10-12 18:57 - 2025-07-20 15:10 - 000007446 _____ C:\WINDOWS\system32\5E37410B-D6F1-471D-AE27-563CEAC0D6B2
2025-10-12 18:57 - 2025-07-20 15:10 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2025-10-12 18:57 - 2025-07-06 11:19 - 001260336 _____ () C:\WINDOWS\system32\wpbbin.exe
2025-10-12 18:57 - 2025-07-06 11:19 - 001207656 _____ C:\WINDOWS\system32\AsusUpdateCheck.exe
2025-10-12 18:57 - 2025-07-06 11:19 - 000012288 ___SH C:\DumpStack.log.tmp
2025-10-12 18:57 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SystemTemp
2025-10-12 18:57 - 2024-04-01 09:26 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2025-10-12 18:57 - 2024-04-01 09:21 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2025-10-12 18:55 - 2025-07-06 11:19 - 000002436 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2025-10-12 18:51 - 2025-07-20 15:10 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-3113707754-1945858852-1597664037-1002
2025-10-12 18:51 - 2025-07-20 15:10 - 000003590 _____ C:\WINDOWS\system32\Tasks\OneDrive Startup Task-S-1-5-21-3113707754-1945858852-1597664037-1002
2025-10-12 18:51 - 2025-07-20 15:10 - 000003394 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-3113707754-1945858852-1597664037-1002
2025-10-12 18:51 - 2025-07-06 11:44 - 000002404 _____ C:\Users\win11-nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2025-10-12 18:51 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\AppReadiness
2025-10-12 13:43 - 2025-07-20 15:13 - 001637744 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2025-10-12 13:43 - 2024-04-01 09:24 - 000000000 ____D C:\WINDOWS\INF
2025-10-11 20:20 - 2025-07-06 12:12 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2025-10-11 19:27 - 2025-07-06 12:12 - 000001065 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2025-10-02 19:12 - 2025-07-20 15:08 - 000001623 _____ C:\WINDOWS\system32\config\VSMIDK
2025-10-01 18:10 - 2025-07-19 13:31 - 000026543 _____ C:\WINDOWS\BRRBCOM.INI
2025-10-01 12:43 - 2024-04-01 09:26 - 000000000 ___HD C:\Program Files\WindowsApps
2025-10-01 12:26 - 2025-07-20 15:08 - 000297064 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\UUS
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SystemResources
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\oobe
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\migwiz
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\HealthAttestationClient
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\Dism
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\appraiser
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\ShellExperiences
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\ShellComponents
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\Provisioning
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\BrowserCore
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\bcastdvr
2025-10-01 12:25 - 2024-04-01 09:26 - 000000000 ____D C:\ProgramData\USOPrivate
2025-10-01 12:25 - 2024-04-01 09:21 - 000000000 ____D C:\WINDOWS\servicing
2025-10-01 12:17 - 2025-07-20 15:09 - 003276800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2025-10-01 12:15 - 2025-07-06 11:29 - 000000000 ____D C:\Users\win11-nutzer\AppData\Local\D3DSCache
2025-09-29 13:54 - 2025-07-20 15:00 - 000000000 ____D C:\Users\win11-nutzer
2025-09-27 18:04 - 2025-07-06 11:27 - 000000000 ____D C:\Users\win11-nutzer\AppData\Local\Packages
2025-09-27 09:15 - 2025-07-20 15:08 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2025-09-18 20:05 - 2025-07-20 15:10 - 000003756 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2025-09-18 20:05 - 2025-07-20 15:10 - 000003630 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2025-09-18 20:05 - 2025-07-06 11:19 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-10-2025
Ran by win11-admin (12-10-2025 19:03:15)
Running from C:\Users\win11-nutzer\Desktop
Microsoft Windows 11 Home Version 25H2 26200.6725 (X64) (2025-07-20 13:10:54)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
(If an entry is included in the fixlist, it will be removed.)
Administrator (S-1-5-21-3113707754-1945858852-1597664037-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-3113707754-1945858852-1597664037-503 - Limited - Disabled)
Gast (S-1-5-21-3113707754-1945858852-1597664037-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-3113707754-1945858852-1597664037-504 - Limited - Disabled)
win11-admin (S-1-5-21-3113707754-1945858852-1597664037-1001 - Administrator - Enabled) => C:\Users\win11-admin
win11-nutzer (S-1-5-21-3113707754-1945858852-1597664037-1002 - Limited - Enabled) => C:\Users\win11-nutzer
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Brother iPrint&Scan (HKLM-x32\...\{4b829678-39db-4dca-92c4-99fcaa07a4ea}) (Version: 14.0.2.1 - Brother Industries, Ltd.)
Brother iPrint&Scan (HKLM-x32\...\{53573713-9365-4807-BD0A-4F66C2626723}) (Version: 14.0.2.1 - Brother Industries, Ltd.) Hidden
HttpToUsbBridge (HKLM-x32\...\{F7DF0BDA-B809-49B5-BE37-227098F717C1}) (Version: 2.6.121.1 - Brother Industries Ltd.)
Microsoft .NET 8.0.12 - Windows Server Hosting (HKLM-x32\...\{218673b6-7337-4d49-bc41-b4ccb7e34802}) (Version: 8.0.12.24603 - Microsoft Corporation)
Microsoft .NET Host - 8.0.12 (x64) (HKLM\...\{C4C6E39D-48AE-426C-960C-46ED3447DDEB}) (Version: 64.48.26165 - Microsoft Corporation) Hidden
Microsoft .NET Host - 8.0.12 (x86) (HKLM-x32\...\{874D52B8-B1F4-4D04-8249-8AC6E698CCF5}) (Version: 64.48.26165 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 8.0.12 (x64) (HKLM\...\{C9C872D5-3CA9-4E0E-AF90-1B85325F9243}) (Version: 64.48.26165 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 8.0.12 (x86) (HKLM-x32\...\{9EC250F3-BC02-4B35-8395-E03A02CD9255}) (Version: 64.48.26165 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 8.0.12 (x64) (HKLM\...\{1E606649-7E56-452F-8AC4-495C70D1E341}) (Version: 64.48.26165 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 8.0.12 (x86) (HKLM-x32\...\{272C9AEF-D02F-4955-8C11-D9F9198A58EC}) (Version: 64.48.26165 - Microsoft Corporation) Hidden
Microsoft ASP.NET Core 8.0.12 Hosting Bundle Options (HKLM-x32\...\{8C069910-4E69-349B-8840-56F774C92B87}) (Version: 8.0.12.24603 - Microsoft Corporation) Hidden
Microsoft ASP.NET Core 8.0.12 Shared Framework (x64) (HKLM\...\{2B76FF3A-309D-3050-9C41-C98FB593258D}) (Version: 8.0.12.24603 - Microsoft Corporation) Hidden
Microsoft ASP.NET Core 8.0.12 Shared Framework (x86) (HKLM-x32\...\{0770B9E3-CA2C-37B8-AD77-7336654A2466}) (Version: 8.0.12.24603 - Microsoft Corporation) Hidden
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 140.0.3485.94 - Microsoft Corporation)
Microsoft Edge WebView2-Laufzeit (HKLM-x32\...\Microsoft EdgeWebView) (Version: 140.0.3485.94 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKU\S-1-5-21-3113707754-1945858852-1597664037-1001\...\OneDriveSetup.exe) (Version: 22.012.0117.0003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3113707754-1945858852-1597664037-1002\...\OneDriveSetup.exe) (Version: 25.179.0914.0003 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 x86 Additional Runtime - 14.0.23026 (HKLM-x32\...\{BE960C1C-7BAD-3DE6-8B1A-2616FE532845}) (Version: 14.0.23026 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2015 x86 Minimum Runtime - 14.0.23026 (HKLM-x32\...\{A2563E55-3BEC-3828-8D67-E5E8B9E8B675}) (Version: 14.0.23026 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 8.0.12 (x86) (HKLM-x32\...\{71e8d0d2-fc5e-4344-b556-0110ef50b6b9}) (Version: 8.0.12.34404 - Microsoft Corporation)
Microsoft Windows Desktop Runtime - 8.0.12 (x86) (HKLM-x32\...\{CF203BF4-13DE-4A81-8BC8-31B3F4A2CB32}) (Version: 64.48.26178 - Microsoft Corporation) Hidden
Mozilla Firefox (x64 de) (HKLM\...\Mozilla Firefox 143.0.4 (x64 de)) (Version: 143.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 140.0.2 - Mozilla)
VeraCrypt 1.26.24 (HKLM\...\{9EBED8F8-BD2F-4561-B5A3-628A8815F51F}) (Version: 1.26.24 - AM Crypto)
==================== Custom CLSID (Whitelisted): ==============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-3113707754-1945858852-1597664037-1002_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\localserver32 -> C:\Users\win11-nutzer\AppData\Local\Microsoft\OneDrive\25.179.0914.0003\OneDrive.Sync.Service.exe (Microsoft Corporation -> Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3113707754-1945858852-1597664037-1002_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\localserver32 -> C:\Users\win11-nutzer\AppData\Local\Microsoft\OneDrive\25.179.0914.0003\OneDrive.Sync.Service.exe (Microsoft Corporation -> Microsoft Corporation)
==================== Codecs (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Drivers32: [MidisrvTransferComplete] => 0
==================== Shortcuts & WMI ========================
==================== Loaded Modules (Whitelisted) =============
2025-08-08 17:26 - 2025-08-08 17:26 - 000603648 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\ADKCore.dll
2025-08-08 17:26 - 2025-08-08 17:26 - 000006144 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\BfLogger.dll
2025-08-08 17:27 - 2025-08-08 17:27 - 000018432 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\BfPlatformLib.Windows.dll
2025-05-22 16:11 - 2025-05-22 16:11 - 000104448 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\BolService.dll
2025-08-08 17:26 - 2025-08-08 17:26 - 000024064 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\BRAppDevKitCommon.dll
2025-08-08 17:42 - 2025-08-08 17:42 - 000376320 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\BRAppDevKitQuery2.dll
2025-08-08 17:42 - 2025-08-08 17:42 - 000181760 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\de\Rodem.UI.Wpf.Resources.resources.dll
2015-02-22 14:00 - 2015-02-22 14:00 - 000323072 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Google.ProtocolBuffers.dll
2016-08-17 21:38 - 2016-08-17 21:38 - 000080896 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\MvvmCross.Core.dll
2016-08-17 21:38 - 2016-08-17 21:38 - 000080384 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\MvvmCross.Platform.dll
2025-06-10 19:07 - 2025-06-10 19:07 - 000030208 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\OfferingService.dll
2025-08-08 17:42 - 2025-08-08 17:42 - 000286208 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Rodem.ADK.WinDesktop.dll
2025-08-08 17:26 - 2025-08-08 17:26 - 000081920 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Rodem.Common.dll
2025-08-08 17:26 - 2025-08-08 17:26 - 000377344 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Rodem.Functions.dll
2025-08-08 17:26 - 2025-08-08 17:26 - 000135168 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Rodem.Libraries.Common.dll
2025-08-08 17:42 - 2025-08-08 17:42 - 000205312 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Rodem.Libraries.WinDesktop.dll
2025-08-08 17:42 - 2025-08-08 17:42 - 000150016 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Rodem.Libraries.Windows.dll
2025-08-08 17:26 - 2025-08-08 17:26 - 001518080 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Rodem.ProtocolBuffers.dll
2025-08-08 17:42 - 2025-08-08 17:42 - 001009664 _____ () [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Rodem.UI.Wpf.Resources.dll
2025-08-08 13:58 - 2025-08-08 13:58 - 000823296 _____ () [File not signed] C:\Program Files (x86)\Browny02\BrMonitor.dll
2024-06-10 13:09 - 2024-06-10 13:09 - 000021504 _____ () [File not signed] C:\Program Files (x86)\Browny02\OfferingService.dll
2025-08-08 17:42 - 2025-08-08 17:42 - 000028672 _____ (AppControl) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\AppControl.dll
2025-08-08 17:42 - 2025-08-08 17:42 - 001005568 _____ (Brother Industries, Ltd.) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\BRAdmin.Common.dll
2025-08-08 17:42 - 2025-08-08 17:42 - 001840640 _____ (Brother Industries, Ltd.) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\BRAdmin.PF.dll
2025-08-08 17:26 - 2025-08-08 17:26 - 000007680 _____ (Brother Industries, Ltd.) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\BrotherUpdateCheck.dll
2025-08-08 17:26 - 2025-08-08 17:26 - 000044032 _____ (Brother Industries, Ltd.) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\BrotherUpdateCheck.PCL.dll
2025-08-08 17:26 - 2025-08-08 17:26 - 001372672 _____ (Brother Industries, Ltd.) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Rodem.UI.Core.dll
2021-03-27 11:46 - 2021-03-27 11:46 - 000103424 _____ (hardcodet.net) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Hardcodet.NotifyIcon.Wpf.dll
2025-08-08 17:43 - 2025-08-08 17:43 - 000020480 _____ (iPSMonitor) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\de\iPSMonitor.resources.dll
2025-08-08 17:43 - 2025-08-08 17:43 - 000991232 _____ (iPSMonitor) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\iPSMonitor.dll
2015-10-05 09:37 - 2015-10-05 09:37 - 000135680 _____ (Microsoft Corporation) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Microsoft.Practices.Unity.dll
2022-11-10 23:30 - 2022-11-10 23:30 - 000135168 _____ (neuecc xin9le okazuki) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\ReactiveProperty.dll
2025-08-08 17:42 - 2025-08-08 17:42 - 000018432 _____ (Rodem.Notifier.Services) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Rodem.Notifier.Services.dll
2025-08-08 17:42 - 2025-08-08 17:42 - 000045568 _____ (Rodem.UI.Grpc) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Rodem.UI.Grpc.dll
2025-08-08 17:43 - 2025-08-08 17:43 - 000008704 _____ (Rodem.UI.Grpc.Server) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Rodem.UI.Grpc.Server.dll
2022-07-25 16:40 - 2022-07-25 16:40 - 000258048 _____ (The Apache Software Foundation) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\log4net.dll
2021-01-30 06:29 - 2021-01-30 06:29 - 000067584 _____ (Unity Open Source Project) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Unity.Abstractions.dll
2021-01-30 06:40 - 2021-01-30 06:40 - 000148480 _____ (Unity Open Source Project) [File not signed] [File is in use] C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\Unity.Container.dll
==================== Alternate Data Streams (Whitelisted) ========
==================== Safe Mode (Whitelisted) ==================
==================== Association (Whitelisted) =================
==================== Internet Explorer (Whitelisted) =============
==================== Hosts content: =========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2022-05-07 07:24 - 2022-05-07 07:22 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts
==================== Network ===========================
(Currently there is no automatic fix for this section.)
DNS Servers: 192.168.178.1
Windows Firewall is enabled.
Network Binding:
=============
Ethernet: Intel(R) Ethernet Controller (3) I225-V -> e2f.sys
==================== Other Areas ===========================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3113707754-1945858852-1597664037-1001\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
HKU\S-1-5-21-3113707754-1945858852-1597664037-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\win11-nutzer\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows Defender\Features => (TamperProtection: 1) (TamperProtectionSource: 5)
HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection => (DpaDisabled: 0)
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths|\\?\E:\backup\Backup 22.6.2011\Download Ordner\eac-0.99pb5.exe
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths|\\?\E:\backup\Backup 30.3.2010 eins\Downloads\eac-0.99pb5.exe
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths|\\?\E:\backup\Backup 30.3.2010\Downloads\eac-0.99pb5.exe
==================== MSCONFIG/TASK MANAGER disabled items ==
==================== FirewallRules (Whitelisted) ================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{AA3D7117-FEF2-4427-9137-25884F93B703}] => (Allow) c:\program files (x86)\pc-faxreceive\brengineprocess.exe => No File
FirewallRules: [{A2E58761-7DB2-4B78-A9D7-336DB67311A6}] => (Allow) c:\program files (x86)\pc-faxreceive\brengineprocess.exe => No File
FirewallRules: [{611840DD-BC17-4D0E-A089-ADA9D84076A7}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{7FF1BDF5-C560-4BBC-BED6-21A92FA291F5}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{11A1EF9F-0948-4D08-A1D1-EB1AE728BFEF}] => (Allow) LPort=54950
FirewallRules: [{096DE889-3A0D-4486-B7B8-95C0DF1D526F}] => (Allow) LPort=54955
FirewallRules: [{C337ADFB-E223-4192-B5EF-686FABDDC8E2}] => (Allow) C:\Program Files (x86)\Brother\iPrint&Scan\IPSMONITOR\iPSMonitor.exe (iPSMonitor) [File not signed]
==================== Restore Points =========================
12-10-2025 08:51:05 Geplanter Prüfpunkt
==================== Faulty Device Manager Devices ============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: PCI-Ver-/Entschlüsselungscontroller
Description: PCI-Ver-/Entschlüsselungscontroller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Generic Bluetooth Adapter
Description: Generic Bluetooth Adapter
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: GenericAdapter
Service: BTHUSB
Problem: : Windows has stopped this device because it has reported problems. (Code 43)
Resolution: One of the drivers controlling the device notified the operating system that the device failed in some manner. For more information about how to diagnose the problem, see the hardware documentation.
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: ========================
Application errors:
==================
Error: (10/12/2025 06:57:50 PM) (Source: WorkflowAppControl) (EventID: 32767) (User: )
Description: Wait Workflow Commands request from device.
Error: (10/12/2025 06:57:50 PM) (Source: WorkflowAppControl) (EventID: 32767) (User: )
Description: Start Broadcast Receiver Server...
Error: (10/12/2025 06:57:50 PM) (Source: WorkflowAppControl) (EventID: 32767) (User: )
Description: Start Server...
Error: (10/12/2025 06:57:50 PM) (Source: WorkflowAppControl) (EventID: 32767) (User: )
Description: AppControlNamedPipeServer pipeName...AppControlServicePipe
Error: (10/12/2025 06:57:50 PM) (Source: WorkflowAppControl) (EventID: 32767) (User: )
Description: Start Server...
Error: (10/12/2025 06:57:50 PM) (Source: WorkflowAppControl) (EventID: 32767) (User: )
Description: Host.AddressList[1]: 127.0.0.1
Error: (10/12/2025 06:57:50 PM) (Source: WorkflowAppControl) (EventID: 32767) (User: )
Description: Host.AddressList[0]: fe80::faf8:ce55:a875:525e%2
Error: (10/12/2025 06:57:50 PM) (Source: WorkflowAppControl) (EventID: 32767) (User: )
Description: Host.AddressList.Length: 2
System errors:
=============
Error: (10/12/2025 06:57:54 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
Error: (10/12/2025 06:56:52 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-I2R5D67)
Description: Der Server "{6FA05A24-B1DF-4155-909E-7B424F2D2BB5}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (10/12/2025 06:56:52 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-I2R5D67)
Description: Der Server "{6FA05A24-B1DF-4155-909E-7B424F2D2BB5}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (10/12/2025 06:55:16 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
Error: (10/12/2025 06:54:05 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-I2R5D67)
Description: Der Server "{740FE937-01F7-4482-AA62-C83F0AD3D6D0}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (10/12/2025 06:54:05 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-I2R5D67)
Description: Der Server "{6FA05A24-B1DF-4155-909E-7B424F2D2BB5}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (10/12/2025 06:54:05 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-I2R5D67)
Description: Der Server "{6FA05A24-B1DF-4155-909E-7B424F2D2BB5}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Error: (10/12/2025 06:54:05 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-I2R5D67)
Description: Der Server "{FD06603A-2BDF-4BB1-B7DF-5DC68F353601}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.
Windows Defender:
================
Date: 2025-10-12 08:48:46
Description:
Microsoft Defender Antivirus hat eine potenziell unerwünschte Anwendung (PUA) erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUA:Win32/Softonic&threatid=224051&enterprise=0
Name: PUA:Win32/Softonic
Schweregrad: Niedrig
Kategorie: Potenziell unerwünschte Software
Pfad: file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 22.6.2011\Download Ordner\SoftonicDownloader38341.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: Konkret
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-I2R5D67\win11-nutzer
Prozessname: Unknown
Sicherheitsversion: AV: 1.437.296.0, AS: 1.437.296.0, NIS: 1.437.296.0
Modulversion: AM: 1.1.25080.5, NIS: 1.1.25080.5
Date: 2025-10-12 08:48:46
Description:
Microsoft Defender Antivirus hat eine potenziell unerwünschte Anwendung (PUA) erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUA:Win32/AskToolbar&threatid=227072&enterprise=0
Name: PUA:Win32/AskToolbar
Schweregrad: Niedrig
Kategorie: Potenziell unerwünschte Software
Pfad: containerfile:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 22.6.2011\Download Ordner\PDFXVwer.zip; file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 22.6.2011\Download Ordner\FreeYouTubeToMp3Converter55.exe; file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 22.6.2011\Download Ordner\PDFXVwer temp\PDFXVwer.exe; file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 22.6.2011\Download Ordner\PDFXVwer.zip->PDFXVwer.exe; file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 30.3.2010 eins\Downloads\FreeYouTubeToMp3Converter55.exe; file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 30.3.2010\Downloads\FreeYouTubeToMp3Converter55.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: Konkret
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-I2R5D67\win11-nutzer
Prozessname: Unknown
Sicherheitsversion: AV: 1.437.296.0, AS: 1.437.296.0, NIS: 1.437.296.0
Modulversion: AM: 1.1.25080.5, NIS: 1.1.25080.5
Date: 2025-10-12 08:48:46
Description:
Microsoft Defender Antivirus hat eine potenziell unerwünschte Anwendung (PUA) erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUABundler:Win32/CandyOpen&threatid=311936&enterprise=0
Name: PUABundler:Win32/CandyOpen
Schweregrad: Niedrig
Kategorie: Potenziell unerwünschte Software
Pfad: containerfile:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 22.6.2011\Download Ordner\winamp5601_full_emusic-7plus_de-de.exe; file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 22.6.2011\Download Ordner\winamp5601_full_emusic-7plus_de-de.exe->(nsis-6-)#2
Erkennungsursprung: Lokaler Computer
Erkennungstype: Konkret
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-I2R5D67\win11-nutzer
Prozessname: Unknown
Sicherheitsversion: AV: 1.437.296.0, AS: 1.437.296.0, NIS: 1.437.296.0
Modulversion: AM: 1.1.25080.5, NIS: 1.1.25080.5
Date: 2025-10-12 08:41:32
Description:
Microsoft Defender Antivirus hat eine potenziell unerwünschte Anwendung (PUA) erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUA:Win32/AskToolbar&threatid=227072&enterprise=0
Name: PUA:Win32/AskToolbar
Schweregrad: Niedrig
Kategorie: Potenziell unerwünschte Software
Pfad: containerfile:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 22.6.2011\Download Ordner\PDFXVwer.zip; file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 22.6.2011\Download Ordner\FreeYouTubeToMp3Converter55.exe; file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 22.6.2011\Download Ordner\PDFXVwer temp\PDFXVwer.exe; file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 22.6.2011\Download Ordner\PDFXVwer.zip->PDFXVwer.exe; file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 30.3.2010 eins\Downloads\FreeYouTubeToMp3Converter55.exe; file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 30.3.2010\Downloads\FreeYouTubeToMp3Converter55.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: Konkret
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-I2R5D67\win11-nutzer
Prozessname: Unknown
Sicherheitsversion: AV: 1.437.296.0, AS: 1.437.296.0, NIS: 1.437.296.0
Modulversion: AM: 1.1.25080.5, NIS: 1.1.25080.5
Date: 2025-10-12 08:41:32
Description:
Microsoft Defender Antivirus hat eine potenziell unerwünschte Anwendung (PUA) erkannt.
Weitere Informationen:
https://go.microsoft.com/fwlink/?linkid=37020&name=PUA:Win32/Softonic&threatid=224051&enterprise=0
Name: PUA:Win32/Softonic
Schweregrad: Niedrig
Kategorie: Potenziell unerwünschte Software
Pfad: file:_D:\20251011_Backup_silberner_Vertikaldatenträger\backup\Backup 22.6.2011\Download Ordner\SoftonicDownloader38341.exe
Erkennungsursprung: Lokaler Computer
Erkennungstype: Konkret
Erkennungsquelle: Benutzer
Benutzer: DESKTOP-I2R5D67\win11-nutzer
Prozessname: Unknown
Sicherheitsversion: AV: 1.437.296.0, AS: 1.437.296.0, NIS: 1.437.296.0
Modulversion: AM: 1.1.25080.5, NIS: 1.1.25080.5
==================== Memory info ===========================
BIOS: American Megatrends Inc. 2616 04/29/2024
Motherboard: ASUSTeK COMPUTER INC. ROG STRIX B650E-F GAMING WIFI
Processor: AMD Ryzen 7 7800X3D 8-Core Processor
Percentage of memory in use: 16%
Total physical RAM: 31967.47 MB
Available physical RAM: 26721.96 MB
Total Virtual: 34015.47 MB
Available Virtual: 28198.61 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:3814.49 GB) (Free:3738.68 GB) (Model: Lexar SSD NM790 4TB) NTFS
Drive d: (WinLinEx) (Fixed) (Total:100 GB) (Free:99.72 GB) (Model: ST2000DM008-2UB102) exFAT
\\?\Volume{ab706cb6-653c-4ae8-a729-190491fa807a}\ () (Fixed) (Total:0.84 GB) (Free:0.22 GB) NTFS
\\?\Volume{53731dd7-90c6-45ad-8ba6-2ec71bf67bdc}\ () (Fixed) (Total:0.5 GB) (Free:0.49 GB) FAT32
\\?\Volume{3edbfea4-abb4-45c7-b4bc-43f57483645a}\ () (Fixed) (Total:0.09 GB) (Free:0.05 GB) FAT32
==================== MBR & Partition Table ====================
==========================================================
Disk: 0 (Protective MBR) (Size: 465.8 GB) (Disk ID: 00000000)
Partition: GPT.
==========================================================
Disk: 1 (Size: 1863 GB) (Disk ID: 644C4810)
Partition 1: (Not Active) - (Size=100 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=1763 GB) - (Type=83)
==========================================================
Disk: 2 (Protective MBR) (Size: 3815.4 GB) (Disk ID: 00000000)
Partition: GPT.
==================== End of Addition.txt =======================
Kann mir jemand helfen? Ist aus den Logs ersichtlich, ob die beschriebene Malware ausgeführt wurde und den Rechner befallen hat? Danke im Voraus! |
|
Gestern, 19:33
| #2 | |
| /// TB-Ausbilder   | Habe ich eac-0.99pb5.exe / TrojanClicker:Win32/Vabector!rln ausversehen ausgeführt? Dein System zeigt laut den Logs keine Anzeichen von aktiver Malware. Ich habe mir die von dir erwähnte Datei selbst beim Hersteller heruntergeladen und überprüft. Diese alte Installationsdatei "eac-0.99pb5.exe" hat unerwünschte Programme mit im Paket dabei, daher erkennt es der Windows Defender als "PUA:Win32/AskToolbar", zu recht. Ich schlage vor, du verwendest die aktuelle Version von EAC (1.8). Dabei meckert der Windows Defender nicht. Daneben befinden sich zahlreiche alte Installationsdateien in deinen Backup-Ordnern, die weitere unerwünschte Software enthalten: Zitat:
Generell gilt, dass nur private Daten (Dokumente (Word, Exel, PP), Bilder, Videos, etc.) regelmäßig gesichert werden sollen. Installationsdateien oder andere ausführbare Dateien sollte man aus Sicherheitsgründen und aufgrund mangelnder Aktualität niemals sichern. |
|
Heute, 18:12
| #3 |
| | Habe ich eac-0.99pb5.exe / TrojanClicker:Win32/Vabector!rln ausversehen ausgeführt? @M-K-D-B: Super, danke für die schnelle Hilfe. Deinen Tipp werde ich mir merken.
__________________Ich habe noch zwei Fragen: 1. Kann mir jemand sagen, wieso ich vom Windows Defender nicht auf diese anderen problematischen Dateien hingewiesen worden bin? 2. Ich bin noch auf diese sehr alte Forendiskussion... https://web.archive.org/web/20100628211541/hxxp://www.digital-inn.de/exact-audio-copy-english/39127-trojan-eac-0-99pb5-exe.html ...gestoßen. Auf Seite 3 meldet sich sogar der Entwickler der EAC-exe-Datei zu Wort und erklärt, wie es zur Warnung kam und weshalb die Datei seiner Ansicht nach überhaupt keine Malware ist. Könnt ihr euch da einen Reim drauf machen? War es am Ende doch falscher Alarm vom Windows Defender? |
|
Heute, 21:24
| #4 | ||
| /// TB-Ausbilder | Habe ich eac-0.99pb5.exe / TrojanClicker:Win32/Vabector!rln ausversehen ausgeführt? Servus, Zitat:
Malware, d. h. Schadsoftware ist wohl in diesem alten Installer nicht enthalten, ABER dieser alte Installer enthält im Paket unerwünschte Software (engl. PUP/PUA für Potentially Unwanted Program/Application) und das ist doch genau das, was der Windows Defender erkennt, nämlich "PUA:Win32/AskToolbar". Auch mehrere andere Firmen erkennen hier unerwünschte Software. Ich sage dir, was damals passiert ist: Der Entwickler von EAC hat von Firmen wie "ASK" Geld dafür angenommen, damit sein Tool zusammen mit lästigen Toolbars oder anderem "Müll" in einen Installer gepackt wurde. Aus meiner Sicht ist das eine Form der Bestechlichkeit. So etwas geht gar nicht. Ahnungslose Menschen bekamen so bei der Installation des Tools auch noch jede Menge Junkware / Adware / Müll mit auf das System. Zu der damaligen Zeit war das leider richtig "in Mode". Ab Version 1.0 hat er scheinbar damit aufgehört, vermutlich aufgrund des negativen Feedbacks, das er (zu Recht) dafür bekommen hat. Zitat:
Früher (vor 10-15 Jahren) war die Erkennung von PUP/PUA im Windows Defender noch nicht vorhanden bzw. sehr schlecht, mittlerweile ist der Defender aber auch in diesem Bereich gut aufgestellt. Geändert von M-K-D-B (Heute um 21:34 Uhr) |
|
| Themen zu Habe ich eac-0.99pb5.exe / TrojanClicker:Win32/Vabector!rln ausversehen ausgeführt? |
| administrator, adware, antivirus, asus, browser, computer, converter, failed, firefox, firewall, generic, home, internet, internet explorer, mozilla, opera, registry, scan, security, services.exe, software, svchost.exe, system, updates, virus |
Linear-Darstellung
