Windows 11 Kontrollscan

BeRealm · 16.02.2026, 22:35

Hallo,

der Jahresanfang bietet sich immer für einen Frühjahrsputz an, daher möchte ich euch bitten mal über die Logs zu schauen, ob euch Auffälligkeiten in Auge stechen.

Vielen Dank

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 16-02-2026
durchgeführt von nobody (Administrator) auf DESKTOP-GR51ROA (16-02-2026 22:04:25)
Gestartet von C:\Users\nobody\Downloads\FRST64.exe
Geladene Profile: nobody
Plattform: Microsoft Windows 11 Pro Version 24H2 26100.7840 (X64) Sprache: Deutsch (Deutschland)
Standard-Browser: FF
Start-Modus: Normal

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

() [Datei ist nicht signiert] C:\Users\nobody\AppData\Local\MicSwitch\app-1.0.253\MicSwitch.exe
() [Datei ist nicht signiert] C:\Users\nobody\SBZSwitcher_v1.9.6\SBZSwitcher.exe
(C:\Program Files\Logitech Gaming Software\LCore.exe ->) (Logitech Inc -> Logitech Inc.) C:\Program Files\Logitech Gaming Software\ArxApplets\Discord\logitechg_discord.exe
(C:\Program Files\Mozilla Firefox\firefox.exe ->) (Mozilla Corporation -> Mozilla Foundation) C:\Program Files\Mozilla Firefox\crashhelper.exe
(CANON ELECTRONICS INC -> Canon Electronics) C:\Program Files (x86)\Canon Electronics\ScanServer\ScanServer.exe
(Creative Technology Ltd) [Datei ist nicht signiert] C:\Program Files (x86)\Creative\Sound Blaster Z-Series\Sound Blaster Z-Series Control Panel\SBZ.exe
(explorer.exe ->) (Open Source Developer, Dominik Reichl -> Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
(File-New-Project -> File-New-Project) C:\ProgramData\chocolatey\lib\eartrumpet\tools\EarTrumpet\EarTrumpet.exe
(Logitech Inc -> Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Windows Firewall Control\wfcUI.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\SystemSettingsAdminFlows.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <13>
(Nextcloud GmbH -> Nextcloud GmbH) C:\Program Files\Nextcloud\nextcloud.exe
(services.exe ->) (CANON ELECTRONICS INC -> Canon Electronics Inc.) C:\Program Files (x86)\Canon Electronics\Shared Files\DriverNetworkMonitor.exe
(services.exe ->) (Creative Technology Ltd) [Datei ist nicht signiert] C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(services.exe ->) (Even Balance, Inc. -> ) C:\Windows\System32\PnkBstrA.exe
(services.exe ->) (FOXIT SOFTWARE INC. -> Foxit Software Inc.) C:\Program Files (x86)\Common Files\Foxit\Foxit PDF Editor\FoxitPDFEditorUpdateService.exe
(services.exe ->) (Logitech Inc -> Logitech Inc.) C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe
(services.exe ->) (Logitech Inc -> Logitech, Inc.) C:\Windows\System32\DriverStore\FileRepository\logi_lamparray_usb.inf_amd64_cdf3ca3c77d5f267\logi_lamparray_service.exe
(services.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Windows Firewall Control\wfcs.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Ltd) C:\Windows\SysWOW64\CtHdaSvc.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26010.5-0\MpDefenderCoreService.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26010.5-0\MsMpEng.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26010.5-0\NisSrv.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <3>
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_adc55ecfca814224\Display.NvContainer\NVDisplay.Container.exe <2>
(services.exe ->) (OpenVPN Inc. -> The OpenVPN Project) C:\Program Files\OpenVPN\bin\openvpnserv.exe
(svchost.exe ->) (By ZhongYang) [Datei ist nicht signiert] C:\Users\nobody\AppData\Local\TrafficMonitor\TrafficMonitor.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe

==================== Registry (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [Malwarebytes Windows Firewall Control] => C:\Program Files\Malwarebytes\Windows Firewall Control\wfcUI.exe [822824 2025-12-06] (Malwarebytes Inc -> Malwarebytes)
HKLM\...\Run: [CANON DR-M140 SVC] => rundll32.exe DRVCSVC.DLL,EntryPointUserMessage (Keine Datei)
HKLM\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [3255136 2025-11-02] (Open Source Developer, Dominik Reichl -> Dominik Reichl)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [18725336 2022-05-12] (Logitech Inc -> Logitech Inc.)
HKLM-x32\...\Run: [Sound Blaster Z-Series Control Panel] => C:\Program Files (x86)\Creative\Sound Blaster Z-Series\Sound Blaster Z-Series Control Panel\SBZ.exe [877056 2014-11-24] (Creative Technology Ltd) [Datei ist nicht signiert]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [752264 2025-12-18] (Oracle America, Inc. -> Oracle Corporation)
HKLM-x32\...\Run: [Canon imageFORMULA WebSDK] => C:\Program Files (x86)\Canon Electronics\ScanServer\launcher.exe [169984 2017-11-14] (CANON ELECTRONICS INC -> Canon Electronics)
HKLM-x32\...\Run: [CaptureOnTouch] => C:\Program Files (x86)\Canon Electronics\CaptureOnTouch\TouchDR.exe [3548464 2024-07-30] (CANON ELECTRONICS INC -> Canon Electronics Inc.)
HKLM\...\Policies\Explorer: [NoRecentDocsHistory] 1
HKLM\...\Policies\Explorer: [NoInstrumentation] 1
HKLM\...\Policies\Explorer: [NoAutorun] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\MRT: Beschränkung <==== ACHTUNG
HKLM\Software\Policies\...\system: [AllowBlockingAppsAtShutdown] 0
HKLM\Software\Policies\...\system: [EnableFontProviders] 0
HKLM\Software\Policies\...\system: [AllowClipboardHistory] 0
HKLM\Software\Policies\...\system: [AllowCrossDeviceClipboard] 0
HKLM\Software\Policies\...\system: [EnableActivityFeed] 0
HKLM\Software\Policies\...\system: [PublishUserActivities] 0
HKLM\Software\Policies\...\system: [UploadUserActivities] 0
HKLM\Software\Policies\...\system: [NoLocalPasswordResetQuestions] 1
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0 <==== ACHTUNG
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Run: [SBZSwitcher] => C:\Users\nobody\SBZSwitcher_v1.9.6\SBZSwitcher.exe [1125888 2015-09-10] () [Datei ist nicht signiert]
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Run: [Nextcloud] => C:\Program Files\Nextcloud\nextcloud.exe [9897280 2026-01-22] (Nextcloud GmbH -> Nextcloud GmbH)
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Run: [WingetUI] => C:\Program Files\UniGetUI\UniGetUI.exe [738928 2026-02-01] (Open Source Developer, Martí Climent López -> )
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Run: [EarTrumpet] => C:\ProgramData\chocolatey\lib\eartrumpet\tools\EarTrumpet\EarTrumpet.exe [1348928 2023-08-06] (File-New-Project -> File-New-Project)
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [NoSearchInternetInStartMenu] 1
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [HideSCAMeetNow] 1
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [NoAutorun] 1
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [HideSCAVolume] 0
HKLM\...\Windows x64\Print Processors\Canon MG5300 series Print Processor: C:\Windows\System32\spool\prtprocs\x64\CNMPDAT.DLL [30208 2012-03-14] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\...\Print\Monitors\Canon BJ Language Monitor MG5300 series: C:\Windows\system32\CNMLMAT.DLL [385024 2012-03-14] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\...\Print\Monitors\Canon BJNP Port: C:\Windows\system32\CNMN6PPM.DLL [359936 2012-06-14] (CANON INC.) [Datei ist nicht signiert]
HKLM\Software\Microsoft\Active Setup\Installed Components: [>OpenVPN_UserSetup] -> reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v OPENVPN-GUI /t REG_SZ /d "C:\Program Files\OpenVPN\bin\openvpn-gui.exe"
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] -> 
Startup: C:\Users\nobody\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2025-01-27]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2025-01-27]
GroupPolicy: Beschränkung - Chrome <==== ACHTUNG
GroupPolicy\User: Beschränkung - Edge <==== ACHTUNG
Policies: C:\ProgramData\NTUSER.pol: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Google: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Edge: Beschränkung <==== ACHTUNG

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {A44AB7BA-8AF8-4AFA-B889-1FFE1DCD4D3D} - System32\Tasks\Choco Upgrade => C:\Windows\System32\cmd.exe [339968 2025-12-09] (Microsoft Windows -> Microsoft Corporation) -> /k "choco upgrade -y all & timeout 7200 & exit "
Task: {559D9C83-C070-4C3F-B327-721FCF66FC22} - System32\Tasks\CreateExplorerShellUnelevatedTask => C:\Windows\explorer.exe [3257480 2026-02-11] (Microsoft Windows -> Microsoft Corporation)
Task: {0787BC3F-7920-4A17-8F03-D8F13AB76A6C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107912 2025-05-31] (Google Inc -> Google Inc.)
Task: {61C2A3AB-04FE-429A-85C9-4BBA63B0119B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107912 2025-05-31] (Google Inc -> Google Inc.)
Task: {9933C622-7974-4C7D-B172-61A4E6B829F2} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23572096 2025-11-30] (Microsoft Corporation -> Microsoft Corporation)
Task: {2C7BFB23-C225-45D7-A466-C4AD1B253876} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [23572096 2025-11-30] (Microsoft Corporation -> Microsoft Corporation)
Task: {491A7D27-55A2-4197-8C12-BA81F2EF56D1} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerLogon => C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2209864 2026-01-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {D72B9655-7A79-4BD2-8DBE-9667E51F3C7C} - System32\Tasks\Microsoft\Office\OfficeBackgroundTaskHandlerRegistration => C:\Program Files\Microsoft Office\root\Office16\officebackgroundtaskhandler.exe [2209864 2026-01-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {C4E61C90-8F69-4C09-9293-505D37CED12F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [3514912 2026-01-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {3DEE65B7-0DD6-4FB3-A58E-80CC586255B5} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [3514912 2026-01-05] (Microsoft Corporation -> Microsoft Corporation)
Task: {498A1287-5D0B-4DD3-83D8-31A0FE032018} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe  /RunOnAC RebootDialog (Keine Datei)
Task: {4C0D6898-60D2-4F6D-9CD4-5D3D9BB5268C} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe  /RunOnBattery RebootDialog (Keine Datei)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (Keine Datei)
Task: {3BDA4FAE-AAF8-4770-8128-2D9CBCCE8018} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26010.5-0\MpCmdRun.exe [1786528 2026-02-10] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {5AA5EFAA-BF32-4746-8466-250DF77A591A} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26010.5-0\MpCmdRun.exe [1786528 2026-02-10] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {E23EB27D-6E02-458C-8FCD-77DD5BDE1878} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26010.5-0\MpCmdRun.exe [1786528 2026-02-10] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {45530254-FCE6-488D-907E-5DCC6C9FE572} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26010.5-0\MpCmdRun.exe [1786528 2026-02-10] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {B3EC3E5C-02B1-4ADF-B36F-9D8B6A96F659} - System32\Tasks\MicSwitch => C:\Users\nobody\AppData\Local\MicSwitch\MicSwitch.exe [300544 2025-04-12] () [Datei ist nicht signiert] -> C:\Users\nobody\AppData\Local\MicSwitch\--autostart <==== ACHTUNG
Task: {23AEB753-70FE-4E66-9D25-78D6CCA43F55} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-2536556504-2545875602-4211533971-1001 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [680064 2026-02-16] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (Der Dateneintrag hat 6 weitere Zeichen).
Task: {BEC187B0-5A7F-4A33-8A96-C7460D69254D} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [34944 2026-02-16] (Mozilla Corporation -> Mozilla Foundation)
Task: {78A9AEC7-EA99-4132-A96C-39820C548090} - System32\Tasks\NVIDIA App SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA App\CEF\NVIDIA App.exe [3324528 2025-10-15] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {33A4ACF4-E2B7-4435-809E-A315381B52E5} - System32\Tasks\TrafficMonitor\Autorun for nobody => C:\Users\nobody\AppData\Local\TrafficMonitor\TrafficMonitor.exe [2021888 2025-02-10] (By ZhongYang) [Datei ist nicht signiert]
Task: {1521F00E-75BF-4CB4-9BDE-CB73615E6615} - System32\Tasks\ZoomUpdateTaskUser-S-1-5-21-2536556504-2545875602-4211533971-1001 => C:\Users\nobody\AppData\Roaming\Zoom\bin\Zoom.exe [462768 2025-11-01] (Zoom Video Communications, Inc. -> Zoom Communications, Inc.)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: 127.0.0.1 cryptomator-vault
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{5232b76a-d53e-4d30-bb6e-9f92615d29e2}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{5232b76a-d53e-4d30-bb6e-9f92615d29e2}: [DhcpDomain] fritz.box
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <==== ACHTUNG

FireFox:
========
FF TaskBarID: 308046B0AF4A39CB -> C:\Program Files\Mozilla Firefox
FF DefaultProfile: wizn94x8.default
FF DefaultProfile: 376w2oah.default-release -> 308046B0AF4A39CB
FF ProfilePath: C:\Users\nobody\AppData\Roaming\Zotero\Zotero\Profiles\wizn94x8.default [2026-01-17]
FF ProfilePath: C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\hcjlxebf.Clean-1755356951333 [2026-02-16]
FF user.js: detected! => C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\hcjlxebf.Clean-1755356951333\user.js [2024-05-01]
FF Notifications: Mozilla\Firefox\Profiles\hcjlxebf.Clean-1755356951333 -> hxxps://www.twitch.tv
FF Extension: (BetterTTV) - C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\hcjlxebf.Clean-1755356951333\Extensions\firefox@betterttv.net.xpi [2026-01-08]
FF Extension: (FrankerFaceZ) - C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\hcjlxebf.Clean-1755356951333\Extensions\frankerfacez@frankerfacez.com.xpi [2025-12-08]
FF Extension: (Tab Reloader (page auto refresh)) - C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\hcjlxebf.Clean-1755356951333\Extensions\jid0-bnmfwWw2w2w4e4edvcdDbnMhdVg@jetpack.xpi [2025-10-16]
FF Extension: (uBlock Origin) - C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\hcjlxebf.Clean-1755356951333\Extensions\uBlock0@raymondhill.net.xpi [2026-01-31]
FF Extension: (Auto Claim Twitch Channel Points) - C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\hcjlxebf.Clean-1755356951333\Extensions\{8e1ef2d7-d78f-47f9-9b69-c2806eb534fc}.xpi [2025-12-27]
FF ProfilePath: C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\0fv9e99q.default [2024-05-01]
FF ProfilePath: C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\376w2oah.default-release [2026-02-16]
FF user.js: detected! => C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\376w2oah.default-release\user.js [2025-11-03]
FF Homepage: Mozilla\Firefox\Profiles\376w2oah.default-release -> chrome://browser/content/blanktab.html
FF NetworkProxy: Mozilla\Firefox\Profiles\376w2oah.default-release -> socks_remote_dns", true
FF Notifications: Mozilla\Firefox\Profiles\376w2oah.default-release -> hxxps://192.168.178.54:10000; hxxps://element.nope.chat; hxxps://app.twizzit.com; hxxps://my.adminforge.de; hxxps://kundenbereich.check24.de
FF Extension: (Dark Reader) - C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\376w2oah.default-release\Extensions\addon@darkreader.org.xpi [2026-02-15]
FF Extension: (floccus bookmarks sync) - C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\376w2oah.default-release\Extensions\floccus@handmadeideas.org.xpi [2026-01-24]
FF Extension: (Remove Paywall) - C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\376w2oah.default-release\Extensions\remove-paywall@example.com.xpi [2025-06-15]
FF Extension: (Skip Redirect) - C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\376w2oah.default-release\Extensions\skipredirect@sblask.xpi [2024-08-24]
FF Extension: (uBlock Origin) - C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\376w2oah.default-release\Extensions\uBlock0@raymondhill.net.xpi [2026-01-30]
FF Extension: (TWP - Translate Web Pages) - C:\Users\nobody\AppData\Roaming\Mozilla\Firefox\Profiles\376w2oah.default-release\Extensions\{036a55b4-5e72-4d05-a06c-cba2dfcc134a}.xpi [2025-03-29]
FF HKLM\...\Firefox\Extensions: [FireFoxNew-WebExtensions@foxitsoftware.com] - C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\Creator\FirefoxAddin\FireFoxNew-WebExtensions@foxitsoftware.com.xpi
FF Extension: (Foxit PDF Creator) - C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\Creator\FirefoxAddin\FireFoxNew-WebExtensions@foxitsoftware.com.xpi [2025-06-25]
FF HKLM\...\Firefox\Extensions: [FFExtnHTML2PDF@foxitsoftware.com] - C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\Creator\FirefoxAddin\FFExtnHTML2PDF.xpi
FF Extension: (Foxit PDF Creator) - C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\Creator\FirefoxAddin\FFExtnHTML2PDF.xpi [2025-06-25] []
FF HKLM-x32\...\Firefox\Extensions: [FireFoxNew-WebExtensions@foxitsoftware.com] - C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\Creator\FirefoxAddin\FireFoxNew-WebExtensions@foxitsoftware.com.xpi
FF HKLM-x32\...\Firefox\Extensions: [FFExtnHTML2PDF@foxitsoftware.com] - C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\Creator\FirefoxAddin\FFExtnHTML2PDF.xpi
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [Keine Datei]
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [Keine Datei]
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [Keine Datei]
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [Keine Datei]
FF Plugin: @java.com/DTPlugin,version=11.481.0 -> C:\Program Files\Java\jre1.8.0_481\bin\dtplugin\npDeployJava1.dll [2025-12-18] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.481.0 -> C:\Program Files\Java\jre1.8.0_481\bin\plugin2\npjp2.dll [2025-12-18] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2026-01-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Keine Datei]
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Keine Datei]
FF Plugin: @videolan.org/vlc,version=3.0.10 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.11 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.12 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.14 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.15 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.16 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.17.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.18 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.19 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.20 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.21 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.23 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin: @videolan.org/vlc,version=3.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2025-12-31] (VideoLAN -> VideoLAN)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll [2011-11-03] (Electronic Sports Network i Sverige AB -> ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll [2013-09-16] (ESN Social Software AB) [Datei ist nicht signiert]
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [2025-12-11] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.cpdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [2025-12-11] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [2025-12-11] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [2025-12-11] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [2025-12-11] (FOXIT SOFTWARE INC. -> Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.481.0 -> C:\Program Files (x86)\Java\jre1.8.0_481\bin\dtplugin\npDeployJava1.dll [2025-12-18] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.481.0 -> C:\Program Files (x86)\Java\jre1.8.0_481\bin\plugin2\npjp2.dll [2025-12-18] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2026-01-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2026-01-05] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.4\npGoogleUpdate3.dll [2025-05-31] (Google Inc -> Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.4\npGoogleUpdate3.dll [2025-05-31] (Google Inc -> Google Inc.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [Keine Datei]
FF Plugin-x32: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x86.dll [Keine Datei]
FF Plugin-x32: @videolan.org/vlc,version=3.0.17.4 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2022-03-24] (VideoLAN -> VideoLAN)
FF Plugin HKU\S-1-5-21-2536556504-2545875602-4211533971-1001: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Keine Datei]
FF Plugin HKU\S-1-5-21-2536556504-2545875602-4211533971-1001: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Keine Datei]
FF Plugin HKU\S-1-5-21-2536556504-2545875602-4211533971-1001: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Keine Datei]

Edge: 
=======
Edge Profile: C:\Users\nobody\AppData\Local\Microsoft\Edge\User Data\Default [2026-01-25]
Edge Extension: (Google Docs Offline) - C:\Users\nobody\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2025-06-03]
Edge Extension: (Edge relevant text changes) - C:\Users\nobody\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2025-06-03]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [cifnddnffldieaamihfkhkdgnbhfmaci] - C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\Creator\ChromeAddin\ChromeAddin.crx [2025-06-25]
CHR HKLM-x32\...\Chrome\Extension: [cifnddnffldieaamihfkhkdgnbhfmaci] - C:\Program Files (x86)\Foxit Software\Foxit PDF Editor\plugins\Creator\ChromeAddin\ChromeAddin.crx [2025-06-25]

==================== Dienste (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [9499224 2025-11-30] (Microsoft Corporation -> Microsoft Corporation)
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [423424 2012-10-08] (Creative Technology Ltd) [Datei ist nicht signiert]
R2 CtHdaSvc; C:\WINDOWS\sysWow64\CtHdaSvc.exe [133080 2021-01-11] (Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Ltd)
R2 DriverNetworkMonitor; C:\Program Files (x86)\Canon Electronics\Shared Files\DriverNetworkMonitor.exe [380672 2019-08-06] (CANON ELECTRONICS INC -> Canon Electronics Inc.)
S3 EAAntiCheatService; C:\Program Files\EA\AC\eaanticheat.gameservice.exe [173741304 2026-01-30] (Electronic Arts, Inc. -> Electronic Arts)
S3 EABackgroundService; C:\Program Files\Electronic Arts\EA Desktop\EA Desktop\EABackgroundService.exe [19622048 2025-12-20] (Electronic Arts, Inc. -> Electronic Arts)
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [1136552 2024-05-10] (EasyAntiCheat Oy -> Epic Games, Inc)
S3 EasyAntiCheat_EOS; C:\Program Files (x86)\EasyAntiCheat_EOS\EasyAntiCheat_EOS.exe [959216 2026-01-31] (EasyAntiCheat Oy -> Epic Games, Inc.)
S3 EpicGamesUpdater; C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesUpdater.exe [3328976 2026-01-28] (Epic Games Inc. -> Epic Games, Inc.)
S3 EpicOnlineServices; C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe [1604512 2025-08-05] (Epic Games Inc. -> Epic Games, Inc.)
R2 FoxitPhantomPDFUpdateService; C:\Program Files (x86)\Common Files\Foxit\Foxit PDF Editor\FoxitPDFEditorUpdateService.exe [2514016 2025-12-11] (FOXIT SOFTWARE INC. -> Foxit Software Inc.)
S4 gupdate; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107912 2025-05-31] (Google Inc -> Google Inc.)
S4 gupdatem; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107912 2025-05-31] (Google Inc -> Google Inc.)
R2 LogiRegistryService; C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe [206808 2022-05-12] (Logitech Inc -> Logitech Inc.)
R2 logi_lamparray_service; C:\WINDOWS\System32\DriverStore\FileRepository\logi_lamparray_usb.inf_amd64_cdf3ca3c77d5f267\logi_lamparray_service.exe [9903656 2024-04-17] (Logitech Inc -> Logitech, Inc.)
R2 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26010.5-0\MpDefenderCoreService.exe [2067464 2026-02-10] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 mracsvc; C:\Windows\System32\mracsvc.exe [21753376 2021-03-26] (Mail.Ru LLC -> LLC Mail.Ru)
R2 NVDisplay.ContainerLocalSystem; C:\WINDOWS\System32\DriverStore\FileRepository\nv_dispi.inf_amd64_adc55ecfca814224\Display.NvContainer\NVDisplay.Container.exe [1275624 2026-01-22] (NVIDIA Corporation -> NVIDIA Corporation)
R2 OpenVPNServiceInteractive; C:\Program Files\OpenVPN\bin\openvpnserv.exe [65880 2025-11-17] (OpenVPN Inc. -> The OpenVPN Project)
S4 OverwolfUpdater; C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe [2641416 2023-10-03] (Overwolf Ltd -> Overwolf LTD)
R2 PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [76152 2021-02-28] (Even Balance, Inc. -> )
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [803088 2025-11-12] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 SmrtService; C:\ProgramData\SmartGuard\lineage2\smrt3d\release\Data\a539b0fa7cb7573c4c7935c724f32b281d942066\smrtsvc64.exe [14981896 2025-03-09] (LAB RIVAS SL -> )
S3 SunshineService; C:\Program Files\Sunshine\tools\sunshinesvc.exe [1159168 2025-09-24] () [Datei ist nicht signiert]
S3 VBoxSDS; C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe [767760 2026-01-15] (Oracle America, Inc. -> Oracle and/or its affiliates)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26010.5-0\NisSrv.exe [4435096 2026-02-10] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 wfcs; C:\Program Files\Malwarebytes\Windows Firewall Control\wfcs.exe [251040 2025-12-06] (Malwarebytes Inc -> Malwarebytes)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26010.5-0\MsMpEng.exe [290744 2026-02-10] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S1 aehd; C:\WINDOWS\system32\DRIVERS\aehd.sys [403080 2025-02-11] (Google LLC -> Google LLC)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [573440 2025-02-11] (Microsoft Corporation) [Datei ist nicht signiert]
S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [204800 2025-02-11] (Microsoft Corporation) [Datei ist nicht signiert]
S3 BTHMODEM; C:\WINDOWS\System32\drivers\bthmodem.sys [110592 2025-01-27] (Microsoft Corporation) [Datei ist nicht signiert]
R3 cthda; C:\WINDOWS\system32\drivers\cthda.sys [1090416 2021-01-11] (Creative Technology Ltd -> Creative Technology Ltd)
R3 cthdb; C:\WINDOWS\system32\DRIVERS\cthdb.sys [53616 2021-01-11] (Creative Technology Ltd -> Creative Technology Ltd)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus2.sys [167440 2022-09-30] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
R0 fse; C:\WINDOWS\System32\drivers\fse.sys [226688 2025-12-09] (Microsoft Windows -> Microsoft Corporation)
R3 GeneStor; C:\WINDOWS\system32\DRIVERS\GeneStor.sys [126168 2023-02-05] (Genesys Logic, Inc. -> GenesysLogic)
R2 inpoutx64; C:\WINDOWS\System32\Drivers\inpoutx64.sys [15008 2024-05-11] (Red Fox UK Limited -> Highresolution Enterprises [www.highrez.co.uk])
R3 KslD; C:\WINDOWS\System32\drivers\wd\KslD.sys [82352 2026-02-10] (Microsoft Windows -> Microsoft Corporation)
S2 l1vhlwf; C:\WINDOWS\System32\drivers\l1vhlwf.sys [144768 2026-02-11] (Microsoft Windows -> Microsoft Corporation)
R3 LGBusEnum; C:\WINDOWS\system32\drivers\LGBusEnum64.sys [46264 2022-05-12] (Logitech Inc -> Logitech Inc.)
R3 LGJoyXlCore; C:\WINDOWS\system32\drivers\LGJoyXlCore64.sys [76480 2022-05-12] (Logitech Inc -> Logitech Inc.)
R3 LGVirHid; C:\WINDOWS\system32\drivers\LGVirHid64.sys [34496 2022-05-12] (Logitech Inc -> Logitech Inc.)
R3 logi_lamparray; C:\WINDOWS\System32\DriverStore\FileRepository\logi_lamparray_usb.inf_amd64_cdf3ca3c77d5f267\logi_lamparray.sys [98864 2024-04-17] (Logitech Inc -> Logitech, Inc.)
R3 ovpn-dco; C:\WINDOWS\System32\drivers\ovpn-dco.sys [101008 2025-08-05] (WDKTestCert lev,133391533294737317 -> OpenVPN, Inc)
R3 R0TrafficMonitor; C:\Users\nobody\AppData\Local\TrafficMonitor\TrafficMonitor.sys [14544 2026-02-16] (Noriyuki MIYAZAKI -> OpenLibSys.org)
S3 RevoProcessDetector; C:\WINDOWS\System32\DRIVERS\RevoProcessDetector.sys [19504 2024-03-28] (Microsoft Windows Hardware Compatibility Publisher -> VS Revo Group)
S3 smrtkrnl64; C:\WINDOWS\System32\Drivers\smrtkrnl64.sys [1118912 2025-08-03] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [174112 2022-09-30] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
S3 ss_conn_usb_driver2; C:\WINDOWS\System32\Drivers\ss_conn_usb_driver2.sys [50720 2022-09-30] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
R3 SteamStreamingSpeakers; C:\WINDOWS\system32\drivers\SteamStreamingSpeakers.sys [40736 2020-06-01] (Valve Corp. -> )
R3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [41000 2024-03-24] (Microsoft Windows Hardware Compatibility Publisher -> The OpenVPN Project)
R3 VBAudioVACMME; C:\WINDOWS\System32\drivers\vbaudio_cable64_win7.sys [41192 2014-09-02] (Vincent Burel -> Windows (R) Win 7 DDK provider)
R3 VBoxNetAdp; C:\WINDOWS\System32\drivers\VBoxNetAdp6.sys [247840 2026-01-26] (Oracle America, Inc. -> Oracle and/or its affiliates)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [258664 2026-01-26] (Oracle America, Inc. -> Oracle and/or its affiliates)
R1 VBoxSup; C:\WINDOWS\system32\DRIVERS\VBoxSup.sys [1058192 2026-01-26] (Oracle America, Inc. -> Oracle and/or its affiliates)
R1 VBoxUSBMon; C:\WINDOWS\system32\DRIVERS\VBoxUSBMon.sys [196720 2026-01-26] (Oracle America, Inc. -> Oracle and/or its affiliates)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [640672 2025-05-29] (Microsoft Windows Hardware Compatibility Publisher -> AM Crypto)
R1 ViGEmBus; C:\WINDOWS\System32\drivers\ViGEmBus.sys [249400 2022-08-30] (Microsoft Windows Hardware Compatibility Publisher -> Nefarius Software Solutions e.U.)
S3 vmbusproxy; C:\WINDOWS\system32\drivers\vmbusproxy.sys [98304 2025-10-03] (Microsoft Windows -> Microsoft Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [21888 2026-02-10] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [635272 2026-02-10] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [102832 2026-02-10] (Microsoft Windows -> Microsoft Corporation)
R3 wintun; C:\WINDOWS\System32\drivers\wintun.sys [29592 2023-02-26] (Microsoft Windows Hardware Compatibility Publisher -> WireGuard LLC)
S3 WireGuard; C:\WINDOWS\System32\drivers\wireguard.sys [489368 2023-03-09] (Microsoft Windows Hardware Compatibility Publisher -> WireGuard LLC)
S3 WSDPrintDevice; C:\WINDOWS\System32\DriverStore\FileRepository\wsdprint.inf_amd64_1f9e32519098c0b6\WSDPrint.sys [57344 2024-09-06] (Microsoft Windows -> Microsoft Corporation)
S3 WSDScan; C:\WINDOWS\System32\DriverStore\FileRepository\sti.inf_amd64_a6dc64e436f22951\WSDScan.sys [61440 2025-09-12] (Microsoft Windows -> Microsoft Corporation)
S3 xhunter1; C:\WINDOWS\xhunter1.sys [194448 2025-04-21] (Wellbia.com Co., Ltd. -> Wellbia.com Co., Ltd.)
S3 ace-game-0; \SystemRoot\System32\drivers\ace-game-0.sys [X]
S3 ACE-SSC-DRV64; \??\C:\Program Files\AntiCheatExpert\SGuard\x64\plugins\ACE-SSC-DRV64.sys [X]
S1 azeuagoa; \??\C:\WINDOWS\system32\drivers\azeuagoa.sys [X]
U4 diagnosticshub.standardcollector.service; kein ImagePath
S3 EAAntiCheat; system32\drivers\eaanticheat.sys [X]
S1 gcxstffj; \??\C:\WINDOWS\system32\drivers\gcxstffj.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat (erstellte) (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)



==================== Ein Monat (geänderte) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2026-02-16 22:05 - 2020-01-30 15:48 - 000000000 ____D C:\Users\nobody\AppData\Roaming\KeePass
2026-02-16 21:58 - 2022-07-01 19:21 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2026-02-16 21:36 - 2026-01-16 23:03 - 000000000 ____D C:\Program Files\Mozilla Firefox
2026-02-16 21:36 - 2024-05-01 20:09 - 000001065 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2026-02-16 21:36 - 2020-01-29 20:10 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2026-02-16 21:35 - 2020-01-29 21:00 - 000000000 ____D C:\Program Files (x86)\Steam
2026-02-16 21:25 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SystemTemp
2026-02-16 20:30 - 2025-01-27 21:06 - 001729504 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2026-02-16 20:30 - 2024-04-01 08:24 - 000000000 ____D C:\WINDOWS\INF
2026-02-16 20:26 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\ServiceState
2026-02-16 20:21 - 2025-07-12 16:56 - 000000000 ____D C:\Users\nobody\AppData\Roaming\vesktop
2026-02-16 19:58 - 2020-04-06 22:10 - 000000000 ____D C:\Users\nobody\.VirtualBox
2026-02-16 19:55 - 2025-12-29 19:32 - 000000000 ____D C:\Users\nobody\AppData\Roaming\FreeTube
2026-02-16 19:15 - 2025-04-26 21:26 - 000003486 _____ C:\WINDOWS\system32\Tasks\MicSwitch
2026-02-16 19:15 - 2025-01-27 21:05 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2026-02-16 19:15 - 2025-01-27 21:03 - 000103514 _____ C:\WINDOWS\system32\5E37410B-D6F1-471D-AE27-563CEAC0D6B2
2026-02-16 19:15 - 2025-01-21 09:14 - 000000000 ____D C:\Users\nobody\AppData\Local\TrafficMonitor
2026-02-16 19:15 - 2024-04-01 08:26 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2026-02-16 19:15 - 2020-10-24 22:17 - 000000000 ____D C:\Users\nobody\AppData\Roaming\Nextcloud
2026-02-16 19:15 - 2020-08-23 15:17 - 000012288 ___SH C:\DumpStack.log.tmp
2026-02-16 19:15 - 2020-06-17 17:22 - 000000000 ____D C:\ProgramData\NVIDIA
2026-02-16 19:15 - 2020-01-29 21:55 - 000000000 ___SD C:\Users\nobody\Documents\Beruflich (Sync)
2026-02-16 18:10 - 2024-04-01 08:21 - 000131072 _____ C:\WINDOWS\system32\config\BBI
2026-02-16 16:20 - 2025-01-27 21:02 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2026-02-15 19:08 - 2022-05-20 19:04 - 000000000 ____D C:\Users\nobody\AppData\Local\Spotify
2026-02-15 19:07 - 2022-11-08 11:07 - 000001845 _____ C:\Users\nobody\Desktop\Spotify.lnk
2026-02-15 19:07 - 2022-11-08 11:07 - 000001831 _____ C:\Users\nobody\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2026-02-15 19:07 - 2022-05-20 19:04 - 000000000 ____D C:\Users\nobody\AppData\Roaming\Spotify
2026-02-15 11:01 - 2025-12-12 19:39 - 000001076 _____ C:\Users\nobody\Desktop\Reborn Launcher.lnk
2026-02-15 11:01 - 2025-12-12 19:39 - 000001076 _____ C:\Users\nobody\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Reborn Launcher.lnk
2026-02-15 09:58 - 2025-07-12 16:50 - 000000000 ____D C:\Users\nobody\AppData\Local\vesktop
2026-02-15 09:41 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\SecurityHealth
2026-02-15 09:32 - 2024-04-01 08:26 - 000000000 ___HD C:\Program Files\WindowsApps
2026-02-15 09:32 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\AppReadiness
2026-02-15 09:14 - 2020-01-29 21:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TreeSize Free
2026-02-15 09:13 - 2025-09-16 19:23 - 000000000 ____D C:\Users\nobody\AppData\Local\Package Cache
2026-02-15 09:12 - 2025-10-16 05:23 - 000000000 ____D C:\Python315
2026-02-15 09:12 - 2025-10-16 05:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Python 3.15
2026-02-15 09:11 - 2020-01-29 20:57 - 000000000 ____D C:\ProgramData\Package Cache
2026-02-15 08:58 - 2020-01-29 21:02 - 000001055 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Thunderbird.lnk
2026-02-15 08:56 - 2025-04-27 07:01 - 000003830 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA{60259E9E-49AD-403C-AFCD-BA33086DEBAE}
2026-02-15 08:56 - 2025-04-27 07:01 - 000003704 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore{977A9360-6411-4AD0-BBD1-8CB89E9FC75A}
2026-02-14 18:27 - 2021-10-31 10:14 - 000000000 ____D C:\Users\nobody\Documents\ShareX
2026-02-13 22:50 - 2020-01-30 06:12 - 000000000 ____D C:\Users\nobody\AppData\Roaming\vlc
2026-02-13 21:45 - 2020-01-30 17:14 - 000000128 _____ C:\Users\nobody\AppData\Local\PUTTY.RND
2026-02-12 21:16 - 2025-01-29 12:13 - 000001607 _____ C:\WINDOWS\system32\config\VSMIDK
2026-02-12 21:14 - 2025-01-27 21:02 - 000477936 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2026-02-12 21:13 - 2025-12-14 00:14 - 000000000 ____D C:\WINDOWS\system32\NarratorMCAT
2026-02-12 21:13 - 2024-04-01 17:37 - 000000000 ____D C:\WINDOWS\InboxApps
2026-02-12 21:13 - 2024-04-01 17:36 - 000000000 ____D C:\WINDOWS\system32\OpenSSH
2026-02-12 21:13 - 2024-04-01 17:36 - 000000000 ____D C:\WINDOWS\system32\Microsoft-Edge-WebView
2026-02-12 21:13 - 2024-04-01 17:33 - 000000000 ____D C:\WINDOWS\SysWOW64\de
2026-02-12 21:13 - 2024-04-01 17:33 - 000000000 ____D C:\WINDOWS\system32\de
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ___SD C:\WINDOWS\system32\F12
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\WUModels
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\UUS
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SystemResources
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\setup
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\oobe
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\migwiz
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\km-KH
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\Dism
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\DDFs
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\ShellExperiences
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\ShellComponents
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\Provisioning
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\BrowserCore
2026-02-12 21:13 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\bcastdvr
2026-02-12 21:13 - 2024-04-01 08:21 - 000000000 ____D C:\WINDOWS\servicing
2026-02-11 16:41 - 2020-01-29 19:57 - 000000000 ____D C:\WINDOWS\system32\MRT
2026-02-11 16:39 - 2020-01-29 19:57 - 221154392 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2026-02-11 16:13 - 2021-05-05 09:54 - 000000000 ____D C:\Program Files (x86)\dotnet
2026-02-11 16:13 - 2021-02-08 23:29 - 000000000 ____D C:\Program Files\dotnet
2026-02-11 06:40 - 2025-01-27 21:03 - 003276288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2026-02-10 08:20 - 2020-11-19 00:51 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2026-02-09 21:10 - 2020-01-29 22:09 - 000000000 ____D C:\Users\nobody\AppData\Local\CrashDumps
2026-02-09 18:52 - 2023-10-10 18:59 - 000000000 ____D C:\ProgramData\Packer
2026-02-09 16:26 - 2025-10-23 07:09 - 000000000 ____D C:\Program Files\Zotero
2026-02-09 16:26 - 2022-10-26 19:03 - 000000934 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Zotero.lnk
2026-02-08 20:35 - 2023-11-28 22:00 - 000000000 ____D C:\Users\nobody\AppData\Roaming\Awesomium
2026-02-08 19:37 - 2021-09-27 17:28 - 000000000 ____D C:\Users\nobody\AppData\Roaming\EasyAntiCheat
2026-02-07 23:17 - 2020-01-29 17:06 - 000000000 ____D C:\Users\nobody\KeePass2DB
2026-02-06 22:23 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2026-02-05 18:05 - 2025-05-19 20:01 - 000000000 ____D C:\Users\nobody\Documents\Scanner Canon DR-M140
2026-02-05 18:05 - 2025-05-19 19:29 - 000000181 _____ C:\WINDOWS\setscan.ini
2026-02-05 18:04 - 2024-05-01 20:09 - 000001053 _____ C:\Users\Public\Desktop\Firefox.lnk
2026-02-05 18:04 - 2020-01-29 21:03 - 000000000 ____D C:\Users\nobody\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2026-02-05 18:04 - 2020-01-29 21:03 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2026-02-05 18:04 - 2020-01-29 21:03 - 000000000 ____D C:\Program Files\WinRAR
2026-02-04 23:38 - 2020-01-29 19:46 - 000000000 ____D C:\Users\nobody\AppData\Local\Packages
2026-02-04 23:29 - 2020-03-29 01:51 - 000000000 ____D C:\Users\nobody\AppData\Roaming\Microsoft\Excel
2026-02-04 22:09 - 2025-09-16 19:23 - 000000000 ____D C:\Python314
2026-02-04 22:09 - 2025-09-16 19:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Python 3.14
2026-02-04 12:35 - 2025-11-01 09:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2026-02-03 19:56 - 2025-01-27 20:53 - 000000000 ____D C:\Users\nobody
2026-02-03 09:03 - 2020-11-19 00:54 - 000000000 ____D C:\ProgramData\Packages
2026-02-03 08:54 - 2025-06-18 07:39 - 000000444 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics
2026-02-03 00:16 - 2020-01-29 21:37 - 000000000 ____D C:\Users\nobody\AppData\Roaming\TS3Client
2026-02-02 07:39 - 2025-04-12 19:32 - 000000000 ____D C:\Users\nobody\UniGetUI Backup
2026-02-02 07:39 - 2025-04-12 19:26 - 000000859 _____ C:\ProgramData\Microsoft\Windows\Start Menu\UniGetUI.lnk
2026-02-02 07:39 - 2025-04-12 19:26 - 000000853 _____ C:\Users\Public\Desktop\UniGetUI.lnk
2026-02-02 07:39 - 2025-04-12 19:26 - 000000000 ____D C:\Program Files\UniGetUI
2026-02-01 20:29 - 2025-12-20 21:08 - 000000000 ____D C:\Users\nobody\Documents\Battlefield 6
2026-02-01 19:21 - 2023-10-05 18:18 - 000000000 ____D C:\Program Files\Shotcut
2026-02-01 19:21 - 2021-04-17 10:07 - 000000849 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shotcut.lnk
2026-02-01 12:47 - 2020-01-29 19:56 - 000000000 ____D C:\Users\nobody\AppData\Local\D3DSCache
2026-01-31 21:57 - 2020-01-29 21:43 - 000000000 ____D C:\Users\nobody\AppData\Local\NVIDIA
2026-01-31 21:55 - 2021-06-30 21:30 - 000000000 ____D C:\WINDOWS\system32\Drivers\NVIDIA Corporation
2026-01-31 21:50 - 2025-06-07 21:25 - 000003834 _____ C:\WINDOWS\system32\Tasks\NVIDIA App SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2026-01-31 21:50 - 2020-01-29 21:43 - 000000000 ____D C:\Users\nobody\AppData\Local\NVIDIA Corporation
2026-01-31 21:50 - 2020-01-29 21:38 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2026-01-31 21:49 - 2020-02-14 21:19 - 000000000 ____D C:\Users\nobody\AppData\Local\UnrealEngine
2026-01-31 21:47 - 2023-12-24 17:50 - 000000000 ____D C:\Program Files (x86)\EasyAntiCheat_EOS
2026-01-31 21:35 - 2025-12-13 20:08 - 000000000 ____D C:\Users\nobody\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2026-01-30 19:32 - 2025-04-01 18:25 - 000001448 _____ C:\Users\nobody\Desktop\Tor Browser.lnk
2026-01-29 08:50 - 2021-12-04 13:51 - 000000000 ____D C:\temp
2026-01-28 20:24 - 2021-10-31 10:14 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShareX
2026-01-28 20:24 - 2021-10-31 10:14 - 000000000 ____D C:\Program Files\ShareX
2026-01-27 06:07 - 2020-01-29 20:58 - 000000877 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++.lnk
2026-01-27 06:07 - 2020-01-29 20:58 - 000000000 ____D C:\Users\nobody\AppData\Roaming\Notepad++
2026-01-26 21:57 - 2025-01-21 06:13 - 001058192 _____ (Oracle and/or its affiliates) C:\WINDOWS\system32\Drivers\VBoxSup.sys
2026-01-26 21:57 - 2025-01-21 06:13 - 000196720 _____ (Oracle and/or its affiliates) C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys
2026-01-26 20:58 - 2025-04-29 04:41 - 000001924 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nextcloud.lnk
2026-01-26 20:58 - 2020-10-24 22:17 - 000000000 ____D C:\Program Files\Nextcloud
2026-01-24 10:49 - 2020-03-27 17:10 - 000000128 _____ C:\Users\nobody\AppData\Roaming\winscp.rnd
2026-01-24 10:02 - 2020-01-29 23:16 - 000000000 ____D C:\Users\nobody\AppData\Local\Steam
2026-01-23 06:08 - 2025-11-25 19:49 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Raspberry Pi
2026-01-23 06:08 - 2020-01-29 20:52 - 000001179 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Drive Snapshot.lnk
2026-01-22 20:59 - 2023-01-25 19:03 - 000000000 ____D C:\Users\nobody\AppData\Roaming\Vortex
2026-01-22 20:32 - 2022-06-14 22:45 - 000000000 ____D C:\Users\nobody\AppData\Local\Larian Studios
2026-01-20 19:52 - 2025-12-29 19:31 - 000002318 _____ C:\Users\nobody\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FreeTube.lnk
2026-01-20 19:52 - 2025-12-29 19:31 - 000002310 _____ C:\Users\nobody\Desktop\FreeTube.lnk
2026-01-18 21:22 - 2025-05-19 19:29 - 000000000 ____D C:\WINDOWS\Twain_64
2026-01-17 22:44 - 2020-01-30 06:13 - 000000000 ____D C:\Users\nobody\AppData\Local\YoloMouse
2026-01-17 18:59 - 2024-05-11 19:35 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games
2026-01-17 18:56 - 2024-05-11 19:46 - 000000001 _____ C:\WINDOWS\vgkbootstatus.dat
2026-01-17 17:44 - 2022-10-26 19:03 - 000000000 ____D C:\Users\nobody\Zotero

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ========

2023-06-16 10:57 - 2023-06-16 10:57 - 002443184 _____ () C:\Users\nobody\ConfigureDefender.exe
2025-12-24 19:36 - 2026-01-16 23:06 - 000000032 _____ () C:\Users\nobody\AppData\Roaming\.machineId
2023-12-24 17:50 - 2024-07-04 21:53 - 000000193 _____ () C:\Users\nobody\AppData\Roaming\BattleBitConfig.ini
2020-12-17 23:15 - 2025-07-30 20:16 - 000000016 _____ () C:\Users\nobody\AppData\Roaming\obs-virtualcam.txt
2020-03-27 17:10 - 2026-01-24 10:49 - 000000128 _____ () C:\Users\nobody\AppData\Roaming\winscp.rnd
2023-11-24 19:16 - 2023-11-24 19:18 - 000000042 _____ () C:\Users\nobody\AppData\Local\Autosofted License.txt
2020-05-21 14:16 - 2020-05-21 14:16 - 000003584 _____ () C:\Users\nobody\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2024-08-27 13:01 - 2024-08-27 13:05 - 000023020 _____ () C:\Users\nobody\AppData\Local\digikamrc
2024-08-27 13:01 - 2024-08-27 13:01 - 000000238 _____ () C:\Users\nobody\AppData\Local\digikam_systemrc
2020-01-30 17:14 - 2026-02-13 21:45 - 000000128 _____ () C:\Users\nobody\AppData\Local\PUTTY.RND
2024-06-22 19:19 - 2024-06-22 19:19 - 000003848 _____ () C:\Users\nobody\AppData\Local\recently-used.xbel
2020-01-29 19:56 - 2024-09-24 10:02 - 000007602 _____ () C:\Users\nobody\AppData\Local\Resmon.ResmonCfg

==================== SigCheck ============================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

==================== Ende von FRST.txt ========================

Leider ist die Addition.txt sehr groß, sodass ich den Dateiinhalt in einer Pastebin-Instanz hochgeladen habe: notebin

M-K-D-B · Gestern, 10:16

Mein Name ist Matthias und ich werde dir bei der Analyse und Bereinigung deines Systems helfen.

Ich analysiere dein System und melde mich später wieder.

M-K-D-B · Gestern, 10:51

Servus,

Baustellen auf deinem System:

Veraltete Firmware
Veraltete Windows 11 Version
Ungewöhnliche Einstellungen
Zahlreiche verwaiste Einträge
Beschädigungen von Systemdateien

Die Firmware und die Windows 11 Version würde ich zurückstellen und mit den Einstellungen beginnen.

Hast du selbst oder mit Hilfe von Software die folgenden Richtlinien gesetzt?
Ein Firmenrechner ist das aber nicht, oder? Nicht, dass die IT das System konfiguriert.

Zitat:

HKLM\...\Policies\Explorer: [NoRecentDocsHistory] 1
HKLM\...\Policies\Explorer: [NoInstrumentation] 1
HKLM\...\Policies\Explorer: [NoAutorun] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\MRT: Beschränkung <==== ACHTUNG
HKLM\Software\Policies\...\system: [AllowBlockingAppsAtShutdown] 0
HKLM\Software\Policies\...\system: [EnableFontProviders] 0
HKLM\Software\Policies\...\system: [AllowClipboardHistory] 0
HKLM\Software\Policies\...\system: [AllowCrossDeviceClipboard] 0
HKLM\Software\Policies\...\system: [EnableActivityFeed] 0
HKLM\Software\Policies\...\system: [PublishUserActivities] 0
HKLM\Software\Policies\...\system: [UploadUserActivities] 0
HKLM\Software\Policies\...\system: [NoLocalPasswordResetQuestions] 1
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0 <==== ACHTUNG

HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [NoSearchInternetInStartMenu] 1
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [HideSCAMeetNow] 1
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [NoAutorun] 1
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [HideSCAVolume] 0

GroupPolicy: Beschränkung - Chrome <==== ACHTUNG
GroupPolicy\User: Beschränkung - Edge <==== ACHTUNG
Policies: C:\ProgramData\NTUSER.pol: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Google: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Edge: Beschränkung <==== ACHTUNG

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <==== ACHTUNG

Teilweise handelt es sich hier um sicherheitsrelevante Einstellungen, die man sonst nur bei infizierten Rechnern findet.
War dein System vor ein paar Tagen / Wochen / Monaten mit Malware infiziert?

Ungewöhnlich sind z. B. auch die folgenden Einträge:

Zitat:

2026-02-15 09:12 - 2025-10-16 05:23 - 000000000 ____D C:\Python315
2026-02-04 22:09 - 2025-09-16 19:23 - 000000000 ____D C:\Python314
2026-01-29 08:50 - 2021-12-04 13:51 - 000000000 ____D C:\temp
2023-06-16 10:57 - 2023-06-16 10:57 - 002443184 _____ () C:\Users\nobody\ConfigureDefender.exe

Diese Einträge scheinen in deinem Fall zwar legitim zu sein, aber überlicherweise installiert man Software NICHT direkt auf das Laufwerk C: , sondern es wird unter Programfiles installiert. Und exe Dateien direkt im Profilordner macht sonst eigentlich nur Malware.

Es gibt noch diverse andere verwaiste und nicht-standard-Einträge, die ich entfernen würde.

Mein Vorschlag:
1. Ausführung mehrerer Tools, um das System auf Malware und PUP zu überprüfen
2. Bereinigung und Reparatur mit FRST
3. Überprüfung aller Programme auf Aktualität
4. Firmware-Upgrade + Windows 11 Upgrade

cosinus · Gestern, 12:20

Zitat:

Zitat von M-K-D-B

Windows 11 Upgrade

Ein kleiner Kommentar dazu von meiner Seite: Wenn man schon auf Build 26100 ist lässt sich mit einem wenige kB großen Enablement Package das System auf 26200 bringen siehe Deskmodder:
KB5054156 Funktionsupdate Windows 11 25H2 als Download (Enablement Package)

M-K-D-B · Gestern, 12:38

Servus cosinus,

das ist ein guter Hinweis, danke.

Aber lass uns erst einmal abwarten, was BeRealm antwortet.

BeRealm · Gestern, 20:09

Hallo MKDB & cosinus,

danke das ihr euch der Sache annehmt.
Der Rechner wird nur von mir privat genutzt und wird durch keine Firma oder IT supportet. In der Vergangenheit habe ich versucht Windows, das telefonieren nach Hause etwas zu unterbinden. Sollten dabei sicherheitsrelevante Punkte sein würde ich diese natürlich wieder aktivieren wollen.
Gerne würde ich auf Debian umsteigen aber ich bin durch Software und Spiele (Battlefield 6 läuft z.b. nicht unter Linux wegen des Anti-Cheat auf Kernelebene) an Windows gebunden, daher würde ich das bestehende System gerne wieder auf Vorderman bringen.
Infiziert war mein System nicht.

Hier die frischen Logs von Malwarebytes und AdwCleaner

Code:

ATTFilter

Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 17.02.2026
Scan-Zeit: 19:50
Protokolldatei: 93f22010-0c31-11f1-b7a4-04d9f5d423f6.json

-Softwaredaten-
Version: 5.4.8.232
Komponentenversion: 149.0.5487
Version des Aktualisierungspakets: 1.0.107385
Lizenz: Kostenlos

-Systemdaten-
Betriebssystem: Windows 11 (Build 26100.7840)
CPU: x64
Dateisystem: NTFS
Benutzer: DESKTOP-GR51ROA\nobody

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgeschlossen
Gescannte Objekte: 284905
Erkannte Bedrohungen: 7
In die Quarantäne verschobene Bedrohungen: 1
Abgelaufene Zeit: 1 Min., 37 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswert: 2
PUM.Optional.DisableMRT, HKLM\SOFTWARE\WOW6432NODE\POLICIES\MICROSOFT\MRT|DONTREPORTINFECTIONINFORMATION, Keine Aktion durch Benutzer, 3894, 676881, 1.0.107385, , ame, , , 
PUM.Optional.DisableMRT, HKLM\SOFTWARE\POLICIES\MICROSOFT\MRT|DONTREPORTINFECTIONINFORMATION, Keine Aktion durch Benutzer, 3894, 676881, 1.0.107385, , ame, , , 

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Datei: 5
PUM.Optional.FireFoxSecurityOverride, C:\USERS\nobody\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HCJLXEBF.CLEAN-1755356951333\USER.JS, Keine Aktion durch Benutzer, 1867, 303311, 1.0.107385, , ame, , E6560B3A607496718BBC8B407D5ABBF0, 6860B2528D566533ED59400722C5E431C754FA785400FE9ECD95BD5CB956C569
PUM.Optional.FireFoxSecurityOverride, C:\USERS\nobody\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HCJLXEBF.CLEAN-1755356951333\USER.JS, Keine Aktion durch Benutzer, 1867, 303312, 1.0.107385, , ame, , E6560B3A607496718BBC8B407D5ABBF0, 6860B2528D566533ED59400722C5E431C754FA785400FE9ECD95BD5CB956C569
PUM.Optional.FireFoxSecurityOverride, C:\USERS\nobody\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\376W2OAH.DEFAULT-RELEASE\USER.JS, Keine Aktion durch Benutzer, 1867, 303311, 1.0.107385, , ame, , 838EBEBF27D7EFED85E0721CA9CD82F3, 3FA8D96DCBB5DDE020C22A2529BEDBC0EFF0911BD98183970FCC4A2FEAC2B09D
PUM.Optional.FireFoxSecurityOverride, C:\USERS\nobody\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\376W2OAH.DEFAULT-RELEASE\USER.JS, Keine Aktion durch Benutzer, 1867, 303312, 1.0.107385, , ame, , 838EBEBF27D7EFED85E0721CA9CD82F3, 3FA8D96DCBB5DDE020C22A2529BEDBC0EFF0911BD98183970FCC4A2FEAC2B09D
MachineLearning/Anomalous.100%, C:\USERS\nobody\DOWNLOADS\W10PRIVACY.ZIP, In Quarantäne, 0, 392687, 1.0.107385, , shuriken, , 135D7C4A1283ED218E7D82B8293B11BE, 1D5046DF237B597A6DFDDB7239E33F948313067893DBF5F067636D14029D8150

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)

WMI: 0
(keine bösartigen Elemente erkannt)


(end)

Code:

ATTFilter

# -------------------------------
# Malwarebytes AdwCleaner 8.5.0.595
# -------------------------------
# Build:    03-05-2025
# Database: 2024-10-23.4 (Local)
# Support:  https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start:    02-17-2026
# Duration: 00:00:12
# OS:       Windows 11 (Build 26100.7840)
# Scanned:  32101
# Detected: 0


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

No malicious folders found.

***** [ Files ] *****

No malicious files found.

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

No malicious tasks found.

***** [ Registry ] *****

No malicious registry entries found.

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.

***** [ Hosts File Entries ] *****

No malicious hosts file entries found.

***** [ Preinstalled Software ] *****

No Preinstalled Software found.


AdwCleaner[S00].txt - [1754 octets] - [17/02/2026 19:18:55]
AdwCleaner[S01].txt - [1483 octets] - [17/02/2026 19:23:54]

M-K-D-B · Gestern, 22:12

Servus,

vielen Dank für die aktuellen Logs von AdwCleaner und MBAM.

Zitat:

Zitat von BeRealm

Infiziert war mein System nicht.

Ein paar Einträge deuten entweder auf Malware-Reste oder verkorkste Einstellungen hin, aber sei es wie es sei... jetzt starten wir den Frühjahrsputz.

Wir sollten mit einer FRST-Reparatur weiter machen.
Bitte lies dir die Anleitung erst vollständig durch, bevor du beginnst.

Bitte gedulde dich, sobald du die Reparatur gestartet hast. Je nach Art und Umfang der notwendigen Reparaturen kann dies einige Minuten dauern.
Eventuell erhältst du während der Reparatur auch die Information "keine Rückmeldung" von FRST. Das ist normal, du musst nichts weiter tun, nur abwarten.

Es werden verwaiste und auffällige Einträge entfernt sowie temporäre Speicher und der Papierkorb geleert.

Reparatur mit FRST

HINWEIS AN ALLE MITLESER:
Dieses FRST-Skript ist ausschließlich für diesen Nutzer gedacht und sollte niemals 1:1 für ein anderes System verwendet werden!

Speichere deine Arbeiten und schließe alle offenen Programme, damit keine Daten verloren gehen.

Markiere den gesamten Inhalt der folgenden Code-Box mit der Maus und kopiere ihn (gleichzeitiges Drücken der beiden Tasten "STRG" + "C"):

Code:

ATTFilter

Start::
CreateRestorePoint:
CloseProcesses:
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\nobody\AppData\Local\TrafficMonitor
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\nobody\AppData\Local\TrafficMonitor\TrafficMonitor.sys
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files\Black Tree Gaming Ltd\Vortex
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes|file: \??\c:\users\nobody\appdata\local\trafficmonitor\trafficmonitor.sys
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.3 - Google Inc.) Hidden
Launcher Prerequisites (x64) (HKLM-x32\...\{43a03b9c-4770-409c-a999-587b60700b63}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\nobody\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\nobody\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\nobody\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\localserver32 -> C:\Users\nobody\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\FileCoAuth.exe => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{b72e6f5e-f6e0-a9eb-461b-6118363bd15c}\localserver32 -> DeepL.exe => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32 ->  => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{EE73C1E2-DCBA-8B31-AEB2-238AB53135BD}\InprocServer32 -> C:\Program Files (x86)\Common Files\System\ole32.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{6BFA57C8-17BB-4D22-1D47-57C0F4C5F0C5}\InprocServer32 -> kein Dateipfad
ShellServiceObjects: Kein Name -> {C2796011-81BA-4148-8FCA-C6643245113F} => 
AlternateDataStreams: C:\WINDOWS\tracing:? [34]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer1.log:F107EE40EF [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer10.log:CCC93B07B0 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer11.log:72C8986B20 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer11.log_backup1:97A90964FA [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer12.log:C40F6B9209 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer12.log_backup1:7CC29836A6 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer13.log:AE3C879266 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer14.log:DE1448F4D7 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer14.log_backup1:D61270D3FD [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer15.log:16B67B15CB [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\H2testw.lnk:3B10871865 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\SumatraPDF.lnk:9A44C35B50 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Privater Modus.lnk:83A68E50E4 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SumatraPDF.lnk:51A9383A5F [3442]
AlternateDataStreams: C:\Users\nobody\Anwendungsdaten:a4f3a4460331e5db92483d18f7474c91 [394]
AlternateDataStreams: C:\Users\nobody\AppData\Roaming:a4f3a4460331e5db92483d18f7474c91 [394]
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\...\Run: [CANON DR-M140 SVC] => rundll32.exe DRVCSVC.DLL,EntryPointUserMessage (Keine Datei)
HKLM\...\Policies\Explorer: [NoRecentDocsHistory] 1
HKLM\...\Policies\Explorer: [NoInstrumentation] 1
HKLM\...\Policies\Explorer: [NoAutorun] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\MRT: Beschränkung <==== ACHTUNG
HKLM\Software\Policies\...\system: [AllowBlockingAppsAtShutdown] 0
HKLM\Software\Policies\...\system: [EnableFontProviders] 0
HKLM\Software\Policies\...\system: [AllowClipboardHistory] 0
HKLM\Software\Policies\...\system: [AllowCrossDeviceClipboard] 0
HKLM\Software\Policies\...\system: [EnableActivityFeed] 0
HKLM\Software\Policies\...\system: [PublishUserActivities] 0
HKLM\Software\Policies\...\system: [UploadUserActivities] 0
HKLM\Software\Policies\...\system: [NoLocalPasswordResetQuestions] 1
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0 <==== ACHTUNG
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [NoSearchInternetInStartMenu] 1
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [HideSCAMeetNow] 1
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [NoAutorun] 1
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [HideSCAVolume] 0
Startup: C:\Users\nobody\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2025-01-27]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2025-01-27]
GroupPolicy: Beschränkung - Chrome <==== ACHTUNG
GroupPolicy\User: Beschränkung - Edge <==== ACHTUNG
Policies: C:\ProgramData\NTUSER.pol: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Google: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Edge: Beschränkung <==== ACHTUNG
Task: {498A1287-5D0B-4DD3-83D8-31A0FE032018} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe  /RunOnAC RebootDialog (Keine Datei)
Task: {4C0D6898-60D2-4F6D-9CD4-5D3D9BB5268C} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe  /RunOnBattery RebootDialog (Keine Datei)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (Keine Datei)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <==== ACHTUNG
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [Keine Datei]
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [Keine Datei]
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [Keine Datei]
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [Keine Datei]
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Keine Datei]
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Keine Datei]
S3 ace-game-0; \SystemRoot\System32\drivers\ace-game-0.sys [X]
S3 ACE-SSC-DRV64; \??\C:\Program Files\AntiCheatExpert\SGuard\x64\plugins\ACE-SSC-DRV64.sys [X]
S1 azeuagoa; \??\C:\WINDOWS\system32\drivers\azeuagoa.sys [X]
U4 diagnosticshub.standardcollector.service; kein ImagePath
S3 EAAntiCheat; system32\drivers\eaanticheat.sys [X]
S1 gcxstffj; \??\C:\WINDOWS\system32\drivers\gcxstffj.sys [X]
C:\temp
C:\Users\nobody\AppData\Roaming\.machineId
C:\Users\nobody\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
StartPowershell:
Set-MpPreference -DisableAutoExclusions $true -Force
Set-MpPreference -Mapsreporting basic -Force
Set-MpPreference -DisableRealtimeMonitoring $false -Force
Set-MpPreference -DisablePrivacyMode $true -Force
Set-MpPreference -DisableIOAVProtection $false -Force
Set-MpPreference -UILockdown 0
Set-MpPreference -ScanPurgeItemsAfterDelay 1
Set-MpPreference -CheckForSignaturesBeforeRunningScan $true -Force
Set-MpPreference -PUAProtection enabled -Force
Update-MpSignature
Get-MpComputerStatus
Get-MpPreference
EndPowerShell:
CMD: cscript /nologo %systemroot%\System32\slmgr.vbs /dlv
CMD: netsh winsock reset
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh winhttp reset proxy
CMD: Bitsadmin /Reset /Allusers
CMD: Winmgmt /salvagerepository 
CMD: Winmgmt /verifyrepository
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: reg query "HKLM\System\CurrentControlSet\Control\Session Manager\Environment" /S
CMD: reg query "HKCU\Environment" /S
CMD: type "C:\USERS\nobody\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HCJLXEBF.CLEAN-1755356951333\USER.JS"
CMD: type "C:\USERS\nobody\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\376W2OAH.DEFAULT-RELEASE\USER.JS"
RemoveProxy:
EmptyEventLogs:
EmptyTemp:
End::

Starte nun FRST und klicke direkt auf den Button Reparieren.
Wichtig: Du brauchst den Inhalt der Code-Box nirgends einfügen, da sich FRST den Code aus der Zwischenablage holt!
Das Tool führt die gewünschten Schritte aus und erstellt die Datei fixlog.txt im selben Verzeichnis, in dem sich FRST befindet.
Zum Abschluss wird das System neu gestartet.
Poste mir den Inhalt der Datei fixlog.txt mit deiner nächsten Antwort.

BeRealm · Heute, 06:35

Hallo,

mir ist ein kleiner Fehler unterlaufen. "nobody" ist nicht der tatsächliche Username und ich habe vergessen dies in deinem Script anzupassen. Kann ich die Reparatur problemlos erneut ausführen mit angepasstem User?

Code:

ATTFilter

Entfernungsergebnis von Farbar Recovery Scan Tool (x64) Version: 16-02-2026
durchgeführt von nobody (18-02-2026 06:23:11) Run:1
Gestartet von C:\Users\nobody\Downloads
Geladene Profile: nobody
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
Start::
CreateRestorePoint:
CloseProcesses:
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\nobody\AppData\Local\TrafficMonitor
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\nobody\AppData\Local\TrafficMonitor\TrafficMonitor.sys
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files\Black Tree Gaming Ltd\Vortex
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes|file: \??\c:\users\nobody\appdata\local\trafficmonitor\trafficmonitor.sys
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.25.3 - Google Inc.) Hidden
Launcher Prerequisites (x64) (HKLM-x32\...\{43a03b9c-4770-409c-a999-587b60700b63}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\nobody\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\nobody\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\nobody\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\localserver32 -> C:\Users\nobody\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\FileCoAuth.exe => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{b72e6f5e-f6e0-a9eb-461b-6118363bd15c}\localserver32 -> DeepL.exe => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32 ->  => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{EE73C1E2-DCBA-8B31-AEB2-238AB53135BD}\InprocServer32 -> C:\Program Files (x86)\Common Files\System\ole32.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{6BFA57C8-17BB-4D22-1D47-57C0F4C5F0C5}\InprocServer32 -> kein Dateipfad
ShellServiceObjects: Kein Name -> {C2796011-81BA-4148-8FCA-C6643245113F} => 
AlternateDataStreams: C:\WINDOWS\tracing:? [34]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer1.log:F107EE40EF [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer10.log:CCC93B07B0 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer11.log:72C8986B20 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer11.log_backup1:97A90964FA [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer12.log:C40F6B9209 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer12.log_backup1:7CC29836A6 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer13.log:AE3C879266 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer14.log:DE1448F4D7 [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer14.log_backup1:D61270D3FD [3442]
AlternateDataStreams: C:\ProgramData\DisplaySessionContainer15.log:16B67B15CB [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\H2testw.lnk:3B10871865 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\SumatraPDF.lnk:9A44C35B50 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk:A1B76439FE [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk:B96E9B8455 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Privater Modus.lnk:83A68E50E4 [3442]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SumatraPDF.lnk:51A9383A5F [3442]
AlternateDataStreams: C:\Users\nobody\Anwendungsdaten:a4f3a4460331e5db92483d18f7474c91 [394]
AlternateDataStreams: C:\Users\nobody\AppData\Roaming:a4f3a4460331e5db92483d18f7474c91 [394]
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\...\Run: [CANON DR-M140 SVC] => rundll32.exe DRVCSVC.DLL,EntryPointUserMessage (Keine Datei)
HKLM\...\Policies\Explorer: [NoRecentDocsHistory] 1
HKLM\...\Policies\Explorer: [NoInstrumentation] 1
HKLM\...\Policies\Explorer: [NoAutorun] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\MRT: Beschränkung <==== ACHTUNG
HKLM\Software\Policies\...\system: [AllowBlockingAppsAtShutdown] 0
HKLM\Software\Policies\...\system: [EnableFontProviders] 0
HKLM\Software\Policies\...\system: [AllowClipboardHistory] 0
HKLM\Software\Policies\...\system: [AllowCrossDeviceClipboard] 0
HKLM\Software\Policies\...\system: [EnableActivityFeed] 0
HKLM\Software\Policies\...\system: [PublishUserActivities] 0
HKLM\Software\Policies\...\system: [UploadUserActivities] 0
HKLM\Software\Policies\...\system: [NoLocalPasswordResetQuestions] 1
HKLM\Software\Policies\...\system: [EnableSmartScreen] 0 <==== ACHTUNG
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [NoSearchInternetInStartMenu] 1
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [HideSCAMeetNow] 1
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [NoAutorun] 1
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\...\Policies\Explorer: [HideSCAVolume] 0
Startup: C:\Users\nobody\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2025-01-27]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2025-01-27]
GroupPolicy: Beschränkung - Chrome <==== ACHTUNG
GroupPolicy\User: Beschränkung - Edge <==== ACHTUNG
Policies: C:\ProgramData\NTUSER.pol: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Google: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Edge: Beschränkung <==== ACHTUNG
Task: {498A1287-5D0B-4DD3-83D8-31A0FE032018} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe  /RunOnAC RebootDialog (Keine Datei)
Task: {4C0D6898-60D2-4F6D-9CD4-5D3D9BB5268C} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe  /RunOnBattery RebootDialog (Keine Datei)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (Keine Datei)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <==== ACHTUNG
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [Keine Datei]
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [Keine Datei]
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp -> C:\Program Files\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [Keine Datei]
FF Plugin: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files\Foxit Software\Foxit PDF Editor\plugins\npFoxitPDFEditorPlugin.dll [Keine Datei]
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Keine Datei]
FF Plugin: @tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Tracker Software\PDF Editor\npPDFXEditPlugin.x64.dll [Keine Datei]
S3 ace-game-0; \SystemRoot\System32\drivers\ace-game-0.sys [X]
S3 ACE-SSC-DRV64; \??\C:\Program Files\AntiCheatExpert\SGuard\x64\plugins\ACE-SSC-DRV64.sys [X]
S1 azeuagoa; \??\C:\WINDOWS\system32\drivers\azeuagoa.sys [X]
U4 diagnosticshub.standardcollector.service; kein ImagePath
S3 EAAntiCheat; system32\drivers\eaanticheat.sys [X]
S1 gcxstffj; \??\C:\WINDOWS\system32\drivers\gcxstffj.sys [X]
C:\temp
C:\Users\nobody\AppData\Roaming\.machineId
C:\Users\nobody\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
StartPowershell:
Set-MpPreference -DisableAutoExclusions $true -Force
Set-MpPreference -Mapsreporting basic -Force
Set-MpPreference -DisableRealtimeMonitoring $false -Force
Set-MpPreference -DisablePrivacyMode $true -Force
Set-MpPreference -DisableIOAVProtection $false -Force
Set-MpPreference -UILockdown 0
Set-MpPreference -ScanPurgeItemsAfterDelay 1
Set-MpPreference -CheckForSignaturesBeforeRunningScan $true -Force
Set-MpPreference -PUAProtection enabled -Force
Update-MpSignature
Get-MpComputerStatus
Get-MpPreference
EndPowerShell:
CMD: cscript /nologo %systemroot%\System32\slmgr.vbs /dlv
CMD: netsh winsock reset
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh winhttp reset proxy
CMD: Bitsadmin /Reset /Allusers
CMD: Winmgmt /salvagerepository 
CMD: Winmgmt /verifyrepository
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: reg query "HKLM\System\CurrentControlSet\Control\Session Manager\Environment" /S
CMD: reg query "HKCU\Environment" /S
CMD: type "C:\USERS\nobody\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HCJLXEBF.CLEAN-1755356951333\USER.JS"
CMD: type "C:\USERS\nobody\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\376W2OAH.DEFAULT-RELEASE\USER.JS"
RemoveProxy:
EmptyEventLogs:
EmptyTemp:
End::
*****************

Wiederherstellungspunkt wurde erfolgreich erstellt.
Prozesse erfolgreich geschlossen.
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths => Fehler = 0x0000000000000350
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\nobody\AppData\Local\TrafficMonitor\TrafficMonitor.sys" => nicht gefunden
"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Program Files\Black Tree Gaming Ltd\Vortex" => erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes => Fehler = 0x0000000000000954
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}\\SystemComponent" => erfolgreich entfernt
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{43a03b9c-4770-409c-a999-587b60700b63}\\SystemComponent" => erfolgreich entfernt
"HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}\\SystemComponent" => erfolgreich entfernt
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E} => erfolgreich entfernt
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C} => erfolgreich entfernt
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E} => erfolgreich entfernt
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2} => erfolgreich entfernt
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{b72e6f5e-f6e0-a9eb-461b-6118363bd15c} => erfolgreich entfernt
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2} => erfolgreich entfernt
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{EE73C1E2-DCBA-8B31-AEB2-238AB53135BD} => erfolgreich entfernt
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{6BFA57C8-17BB-4D22-1D47-57C0F4C5F0C5} => erfolgreich entfernt
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{C2796011-81BA-4148-8FCA-C6643245113F} => erfolgreich entfernt
HKLM\Software\Classes\CLSID\{C2796011-81BA-4148-8FCA-C6643245113F} => nicht gefunden
C:\WINDOWS\tracing => ":?" ADS erfolgreich entfernt
C:\ProgramData\DisplaySessionContainer1.log => ":F107EE40EF" ADS erfolgreich entfernt
C:\ProgramData\DisplaySessionContainer10.log => ":CCC93B07B0" ADS erfolgreich entfernt
C:\ProgramData\DisplaySessionContainer11.log => ":72C8986B20" ADS erfolgreich entfernt
C:\ProgramData\DisplaySessionContainer11.log_backup1 => ":97A90964FA" ADS erfolgreich entfernt
C:\ProgramData\DisplaySessionContainer12.log => ":C40F6B9209" ADS erfolgreich entfernt
C:\ProgramData\DisplaySessionContainer12.log_backup1 => ":7CC29836A6" ADS erfolgreich entfernt
C:\ProgramData\DisplaySessionContainer13.log => ":AE3C879266" ADS erfolgreich entfernt
C:\ProgramData\DisplaySessionContainer14.log => ":DE1448F4D7" ADS erfolgreich entfernt
C:\ProgramData\DisplaySessionContainer14.log_backup1 => ":D61270D3FD" ADS erfolgreich entfernt
C:\ProgramData\DisplaySessionContainer15.log => ":16B67B15CB" ADS erfolgreich entfernt
C:\ProgramData\Microsoft\Windows\Start Menu\H2testw.lnk => ":3B10871865" ADS erfolgreich entfernt
C:\ProgramData\Microsoft\Windows\Start Menu\SumatraPDF.lnk => ":9A44C35B50" ADS erfolgreich entfernt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk => ":A1B76439FE" ADS erfolgreich entfernt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk => ":B96E9B8455" ADS erfolgreich entfernt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Privater Modus.lnk => ":83A68E50E4" ADS erfolgreich entfernt
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SumatraPDF.lnk => ":51A9383A5F" ADS erfolgreich entfernt
"C:\Users\nobody\Anwendungsdaten" => ":a4f3a4460331e5db92483d18f7474c91" ADS nicht gefunden.
"C:\Users\nobody\AppData\Roaming" => ":a4f3a4460331e5db92483d18f7474c91" ADS nicht gefunden.
HKLM\Software\\Microsoft\Internet Explorer\Main\\"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157" => Wert erfolgreich wiederhergestellt
"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\CANON DR-M140 SVC" => erfolgreich entfernt
"HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoRecentDocsHistory" => erfolgreich entfernt
"HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoInstrumentation" => erfolgreich entfernt
"HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoAutorun" => erfolgreich entfernt
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => erfolgreich entfernt
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate => erfolgreich entfernt
HKLM\SOFTWARE\Policies\Microsoft\MRT => erfolgreich entfernt
"HKLM\Software\Policies\Microsoft\Windows\System\\AllowBlockingAppsAtShutdown" => erfolgreich entfernt
"HKLM\Software\Policies\Microsoft\Windows\System\\EnableFontProviders" => erfolgreich entfernt
"HKLM\Software\Policies\Microsoft\Windows\System\\AllowClipboardHistory" => erfolgreich entfernt
"HKLM\Software\Policies\Microsoft\Windows\System\\AllowCrossDeviceClipboard" => erfolgreich entfernt
"HKLM\Software\Policies\Microsoft\Windows\System\\EnableActivityFeed" => erfolgreich entfernt
"HKLM\Software\Policies\Microsoft\Windows\System\\PublishUserActivities" => erfolgreich entfernt
"HKLM\Software\Policies\Microsoft\Windows\System\\UploadUserActivities" => erfolgreich entfernt
"HKLM\Software\Policies\Microsoft\Windows\System\\NoLocalPasswordResetQuestions" => erfolgreich entfernt
"HKLM\Software\Policies\Microsoft\Windows\System\\EnableSmartScreen" => erfolgreich entfernt
"HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoSearchInternetInStartMenu" => erfolgreich entfernt
"HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\HideSCAMeetNow" => erfolgreich entfernt
"HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoAutorun" => erfolgreich entfernt
"HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\HideSCAVolume" => erfolgreich entfernt
"C:\Users\nobody\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled" => nicht gefunden
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled => erfolgreich verschoben

"C:\WINDOWS\system32\GroupPolicy\Machine" Ordner verschieben:

C:\WINDOWS\system32\GroupPolicy\Machine => erfolgreich verschoben
C:\WINDOWS\system32\GroupPolicy\GPT.ini => erfolgreich verschoben
C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini => erfolgreich verschoben

"C:\WINDOWS\system32\GroupPolicy\User" Ordner verschieben:

C:\WINDOWS\system32\GroupPolicy\User => erfolgreich verschoben
C:\ProgramData\NTUSER.pol => erfolgreich verschoben
HKLM\SOFTWARE\Policies\Mozilla => erfolgreich entfernt
HKLM\SOFTWARE\Policies\Google => erfolgreich entfernt
HKLM\SOFTWARE\Policies\Microsoft\Edge => erfolgreich entfernt
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{498A1287-5D0B-4DD3-83D8-31A0FE032018}" => erfolgreich entfernt
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{498A1287-5D0B-4DD3-83D8-31A0FE032018}" => erfolgreich entfernt
C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => erfolgreich verschoben
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" => erfolgreich entfernt
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4C0D6898-60D2-4F6D-9CD4-5D3D9BB5268C}" => erfolgreich entfernt
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4C0D6898-60D2-4F6D-9CD4-5D3D9BB5268C}" => erfolgreich entfernt
C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => erfolgreich verschoben
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" => erfolgreich entfernt
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => erfolgreich entfernt
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => erfolgreich entfernt
C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => erfolgreich verschoben
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" => erfolgreich entfernt
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => erfolgreich entfernt
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\SOFTWARE\Policies\Microsoft\Internet Explorer => erfolgreich entfernt
HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf => erfolgreich entfernt
HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf => erfolgreich entfernt
HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xdp => erfolgreich entfernt
HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.xfdf => erfolgreich entfernt
HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.adobe.xfdf => erfolgreich entfernt
HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Editor Plugin,version=1.0,application/vnd.fdf => erfolgreich entfernt
HKLM\System\CurrentControlSet\Services\ace-game-0 => erfolgreich entfernt
ace-game-0 => Dienst erfolgreich entfernt
HKLM\System\CurrentControlSet\Services\ACE-SSC-DRV64 => erfolgreich entfernt
ACE-SSC-DRV64 => Dienst erfolgreich entfernt
HKLM\System\CurrentControlSet\Services\azeuagoa => erfolgreich entfernt
azeuagoa => Dienst erfolgreich entfernt
HKLM\System\CurrentControlSet\Services\diagnosticshub.standardcollector.service => erfolgreich entfernt
diagnosticshub.standardcollector.service => Dienst erfolgreich entfernt
HKLM\System\CurrentControlSet\Services\EAAntiCheat => erfolgreich entfernt
EAAntiCheat => Dienst erfolgreich entfernt
HKLM\System\CurrentControlSet\Services\gcxstffj => erfolgreich entfernt
gcxstffj => Dienst erfolgreich entfernt

"C:\temp" Ordner verschieben:

C:\temp => erfolgreich verschoben
"C:\Users\nobody\AppData\Roaming\.machineId" => nicht gefunden
"C:\Users\nobody\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini" => nicht gefunden

========= Powershell: =========



AMEngineVersion                  : 0.0.0.0
AMProductVersion                 : 4.18.26010.5
AMRunningMode                    : Not running
AMServiceEnabled                 : False
AMServiceVersion                 : 0.0.0.0
AntispywareEnabled               : False
AntispywareSignatureAge          : 0
AntispywareSignatureLastUpdated  : 
AntispywareSignatureVersion      : 
AntivirusEnabled                 : False
AntivirusSignatureAge            : 65535
AntivirusSignatureLastUpdated    : 
AntivirusSignatureVersion        : 
BehaviorMonitorEnabled           : False
ComputerID                       : FA437D00-D23B-4858-9B88-871556BF1210
ComputerState                    : 0
ControlledConfigurationState     : 0
DefenderSignaturesOutOfDate      : False
DeviceControlDefaultEnforcement  : Unknown
DeviceControlPoliciesLastUpdated : 01.01.1601 01:00:00
DeviceControlState               : Unknown
FullScanAge                      : 4294967295
FullScanEndTime                  : 
FullScanOverdue                  : False
FullScanRequired                 : False
FullScanSignatureVersion         : 
FullScanStartTime                : 
InitializationProgress           : ServiceStartedSuccessfully
IoavProtectionEnabled            : False
IsTamperProtected                : False
IsVirtualMachine                 : False
LastFullScanSource               : 0
LastQuickScanSource              : 0
NISEnabled                       : False
NISEngineVersion                 : 0.0.0.0
NISSignatureAge                  : 65535
NISSignatureLastUpdated          : 
NISSignatureVersion              : 
OnAccessProtectionEnabled        : False
ProductStatus                    : 1
QuickScanAge                     : 4294967295
QuickScanEndTime                 : 
QuickScanOverdue                 : False
QuickScanSignatureVersion        : 
QuickScanStartTime               : 
RealTimeProtectionEnabled        : False
RealTimeScanDirection            : 0
RebootRequired                   : False
SmartAppControlExpiration        : 
SmartAppControlState             : 
TamperProtectionSource           : UI
TroubleShootingDailyMaxQuota     : 
TroubleShootingDailyQuotaLeft    : 
TroubleShootingEndTime           : 
TroubleShootingExpirationLeft    : 
TroubleShootingMode              : 
TroubleShootingModeSource        : 
TroubleShootingQuotaResetTime    : 
TroubleShootingStartTime         : 
PSComputerName                   : 




========= Ende von Powershell: =========


========= cscript /nologo %systemroot%\System32\slmgr.vbs /dlv =========

Softwarelizenzierungsdienst-Version: 10.0.26100.7824

Name: Windows(R), Professional edition
Beschreibung: Windows(R) Operating System, VOLUME_MAK channel
Aktivierungs-ID: 49cd895b-53b2-4dc4-a5f7-b18aa019ad37
Anwendungs-ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Erweiterte PID: 03612-03312-035-000000-03-1031-26100.0000-0272025
Product Key-Kanal: Volume:MAK
Installations-ID: 446464549174765234516034232097109800060415354952218171465669201
Lizenz-URL verwenden: https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
URL fr die šberprfung: https://validation-v2.sls.microsoft.com/SLWGA/slwga.asmx
Teil-Product Key: G6PKM
Lizenzstatus: Lizenziert
Verbleibende Windows Rearm-Anzahl: 1001
Verbleibende SKU Rearm-Anzahl: 1001
Vertrauenswrdige Zeit: 18.02.2026 06:23:27




========= Ende von CMD: =========


========= netsh winsock reset =========


Der Winsock-Katalog wurde zurückgesetzt.
Sie müssen den Computer neu starten, um den Vorgang abzuschließen.



========= Ende von CMD: =========


========= netsh advfirewall reset =========

OK.



========= Ende von CMD: =========


========= netsh advfirewall set allprofiles state ON =========

OK.



========= Ende von CMD: =========


========= netsh winhttp reset proxy =========


Aktuelle WinHTTP-Proxyeinstellungen:

    DirectAccess (kein Proxyserver).



========= Ende von CMD: =========


========= Bitsadmin /Reset /Allusers =========


BITSADMIN version 3.0
BITS administration utility.
(C) Copyright Microsoft Corp.

{D0C2F774-1E1A-464F-B2D4-4507C03BA46B} canceled.
{384D7A07-5E28-4A4B-9A44-FAD85356BCD7} canceled.
{A4691097-8810-4165-BB52-23319D777D8C} canceled.
{D4606D33-979F-4D43-BE30-6D496A2CCA1E} canceled.
4 out of 4 jobs canceled.


========= Ende von CMD: =========


========= Winmgmt /salvagerepository =========

Das WMI-Repository ist konsistent.


========= Ende von CMD: =========


========= Winmgmt /verifyrepository =========

Das WMI-Repository ist konsistent.


========= Ende von CMD: =========


========= "%WINDIR%\SYSTEM32\lodctr.exe" /R =========


Info: Die Leistungsindikatoreinstellungen wurden erfolgreich aus dem Systemsicherungsspeicher neu erstellt.


========= Ende von CMD: =========


========= "%WINDIR%\SysWOW64\lodctr.exe" /R =========


Info: Die Leistungsindikatoreinstellungen wurden erfolgreich aus dem Systemsicherungsspeicher neu erstellt.


========= Ende von CMD: =========


========= "%WINDIR%\SYSTEM32\lodctr.exe" /R =========


Info: Die Leistungsindikatoreinstellungen wurden erfolgreich aus dem Systemsicherungsspeicher neu erstellt.


========= Ende von CMD: =========


========= "%WINDIR%\SysWOW64\lodctr.exe" /R =========


Info: Die Leistungsindikatoreinstellungen wurden erfolgreich aus dem Systemsicherungsspeicher neu erstellt.


========= Ende von CMD: =========


========= reg query "HKLM\System\CurrentControlSet\Control\Session Manager\Environment" /S =========


HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
    ComSpec    REG_EXPAND_SZ    %SystemRoot%\system32\cmd.exe
    DriverData    REG_SZ    C:\Windows\System32\Drivers\DriverData
    OS    REG_SZ    Windows_NT
    PATHEXT    REG_SZ    .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PY;.PYW
    PROCESSOR_ARCHITECTURE    REG_SZ    AMD64
    PSModulePath    REG_EXPAND_SZ    %ProgramFiles%\WindowsPowerShell\Modules;%SystemRoot%\system32\WindowsPowerShell\v1.0\Modules
    TEMP    REG_EXPAND_SZ    %SystemRoot%\TEMP
    TMP    REG_EXPAND_SZ    %SystemRoot%\TEMP
    USERNAME    REG_SZ    SYSTEM
    windir    REG_EXPAND_SZ    %SystemRoot%
    Path    REG_EXPAND_SZ    C:\Program Files (x86)\Common Files\Oracle\Java\java8path;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Python315\Scripts\;C:\Python315\;C:\Python314\Scripts\;C:\Python314\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\ProgramData\chocolatey\bin;C:\tools\BCURRAN3;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files\dotnet\;C:\Program Files (x86)\dotnet\;C:\Program Files\Mullvad VPN\resources;C:\Program Files\WireGuard\;C:\Users\nobody\AppData\Local\Microsoft\WindowsApps;C:\Program Files\Oracle\VirtualBox;C:\Users\nobody\AppData\Roaming\npm;C:\adb;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;%SYSTEMROOT%\System32\OpenSSH\;C:\Program Files\NVIDIA Corporation\NVIDIA app\NvDLISR;C:\Program Files\PowerToys\DSCModules\;C:\Program Files\Sunshine;C:\Program Files\Sunshine\tools;C:\Program Files\nodejs\
    COMMANDER_PATH    REG_SZ    C:\Program Files\totalcmd
    AMDRMPATH    REG_SZ    C:\Program Files\AMD\RyzenMaster\
    ESET_OPTIONS    REG_SZ                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
    NUMBER_OF_PROCESSORS    REG_SZ    24
    PROCESSOR_LEVEL    REG_SZ    23
    PROCESSOR_IDENTIFIER    REG_SZ    AMD64 Family 23 Model 113 Stepping 0, AuthenticAMD
    PROCESSOR_REVISION    REG_SZ    7100
    ChocolateyInstall    REG_SZ    C:\ProgramData\chocolatey
    VBOX_MSI_INSTALL_PATH    REG_SZ    C:\Program Files\Oracle\VirtualBox\



========= Ende von CMD: =========


========= reg query "HKCU\Environment" /S =========


HKEY_CURRENT_USER\Environment
    TEMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp
    TMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp
    Path    REG_EXPAND_SZ    C:\Users\nobody\AppData\Local\Microsoft\WindowsApps;C:\Program Files\Oracle\VirtualBox;%USERPROFILE%\AppData\Local\Microsoft\WindowsApps;C:\Users\nobody\AppData\Local\Programs\Ollama;C:\Users\nobody\AppData\Roaming\npm
    ChocolateyLastPathUpdate    REG_SZ    134092620756564020
    ChocolateyToolsLocation    REG_SZ    C:\tools
    JD2_HOME    REG_SZ    C:\Program Files\JDownloader
    DOTNET_CLI_TELEMETRY_OPTOUT    REG_SZ    1
    POWERSHELL_TELEMETRY_OPTOUT    REG_SZ    1



========= Ende von CMD: =========


========= type "C:\USERS\nobody\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HCJLXEBF.CLEAN-1755356951333\USER.JS" =========

Das System kann den angegebenen Pfad nicht finden.


========= Ende von CMD: =========


========= type "C:\USERS\nobody\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\376W2OAH.DEFAULT-RELEASE\USER.JS" =========

Das System kann den angegebenen Pfad nicht finden.


========= Ende von CMD: =========


========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => erfolgreich entfernt
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => erfolgreich entfernt
"HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => erfolgreich entfernt
"HKU\S-1-5-21-2536556504-2545875602-4211533971-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => erfolgreich entfernt


========= Ende von RemoveProxy: =========


=========== EmptyEventLogs: ==========

1286 Event logs cleared. 


================================

=========== EmptyTemp: ==========

FlushDNS => abgeschlossen
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 304020492 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 651700015 B
Windows/system/drivers => 30975836 B
Edge => 9270971 B
Firefox => 149311091 B
Opera => 0 B

Local\Temp, Local\*.tmp, LocalLow\Temp, Roaming\Temp, Roaming\*.tmp , IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 400 B
systemprofile32 => 0 B
LocalService => 7847790108 B
NetworkService => 266570 B
nobody => 2258889219 B

RecycleBin => 12415776 B
EmptyTemp: => 10.5 GB temporäre Dateien entfernt.

================================


Das System musste neu gestartet werden.

==== Ende von Fixlog 06:24:21 ====

M-K-D-B · Heute, 08:37

Servus,

ich habe das Skript angepasst, dieses Mal verwende ich einen globalen Platzhalter für die restlichen Einträge.
Du selber musst nichts anpssen.
Zudem überprüfen wir die Systemdateien auf Fehler. Sollten Fehler gefunden werden, wird das System versuchen, diese zu reparieren. Dies kann dann bis zu 60 Minuten dauern.

Eine Zweitmeinung mit ESET wäre ebenfalls nicht verkehrt.

Schritt 1 - Reparatur mit FRST

HINWEIS AN ALLE MITLESER:
Dieses FRST-Skript ist ausschließlich für diesen Nutzer gedacht und sollte niemals 1:1 für ein anderes System verwendet werden!

Speichere deine Arbeiten und schließe alle offenen Programme, damit keine Daten verloren gehen.

Markiere den gesamten Inhalt der folgenden Code-Box mit der Maus und kopiere ihn (gleichzeitiges Drücken der beiden Tasten "STRG" + "C"):

Code:

ATTFilter

Start::
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\AllUserName\AppData\Local\TrafficMonitor
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\AllUserName\AppData\Local\TrafficMonitor\TrafficMonitor.sys
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files\Black Tree Gaming Ltd\Vortex
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes|file: \??\c:\users\AllUserName\appdata\local\trafficmonitor\trafficmonitor.sys
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\AllUserName\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\AllUserName\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\AllUserName\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\localserver32 -> C:\Users\AllUserName\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\FileCoAuth.exe => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{b72e6f5e-f6e0-a9eb-461b-6118363bd15c}\localserver32 -> DeepL.exe => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32 ->  => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{EE73C1E2-DCBA-8B31-AEB2-238AB53135BD}\InprocServer32 -> C:\Program Files (x86)\Common Files\System\ole32.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{6BFA57C8-17BB-4D22-1D47-57C0F4C5F0C5}\InprocServer32 -> kein Dateipfad
AlternateDataStreams: C:\Users\AllUserName\Anwendungsdaten:a4f3a4460331e5db92483d18f7474c91 [394]
AlternateDataStreams: C:\Users\AllUserName\AppData\Roaming:a4f3a4460331e5db92483d18f7474c91 [394]
Startup: C:\Users\AllUserName\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2025-01-27]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2025-01-27]
C:\Users\AllUserName\AppData\Roaming\.machineId
C:\Users\AllUserName\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
CMD: type "C:\USERS\AllUserName\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HCJLXEBF.CLEAN-1755356951333\USER.JS"
CMD: type "C:\USERS\AllUserName\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\376W2OAH.DEFAULT-RELEASE\USER.JS"
CMD: dism /online /cleanup-image /restorehealth
CMD: sfc /scannow
Reboot:
End::

Starte nun FRST und klicke direkt auf den Button Reparieren.
Wichtig: Du brauchst den Inhalt der Code-Box nirgends einfügen, da sich FRST den Code aus der Zwischenablage holt!
Das Tool führt die gewünschten Schritte aus und erstellt die Datei fixlog.txt im selben Verzeichnis, in dem sich FRST befindet.
Zum Abschluss wird das System neu gestartet.
Poste mir den Inhalt der Datei fixlog.txt mit deiner nächsten Antwort.

Schritt 2 - ESET Online Scanner
Führe ESET Online Scanner (EOS) gemäß der bebilderten Anleitung aus und poste abschließend die Logdatei.

BeRealm · Heute, 21:54

Hallo,

hier die beiden Logs.

Code:

ATTFilter

18.02.2026 21:52:54
Geprüfte Dateien: 684922
Erkannte Dateien: 0
Gesäuberte Dateien: 0
Scandauer gesamt: 02:17:20
Scanstatus: Abgeschlossen

Code:

ATTFilter

Entfernungsergebnis von Farbar Recovery Scan Tool (x64) Version: 18-02-2026
durchgeführt von nobody (18-02-2026 17:14:00) Run:2
Gestartet von C:\Users\nobody\Downloads
Geladene Profile: nobody
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
Start::
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\AllUserName\AppData\Local\TrafficMonitor
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\AllUserName\AppData\Local\TrafficMonitor\TrafficMonitor.sys
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files\Black Tree Gaming Ltd\Vortex
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes|file: \??\c:\users\AllUserName\appdata\local\trafficmonitor\trafficmonitor.sys
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\AllUserName\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\AllUserName\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\AllUserName\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\amd64\FileSyncShell64.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\localserver32 -> C:\Users\AllUserName\AppData\Local\Microsoft\OneDrive\18.151.0729.0013_1\FileCoAuth.exe => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{b72e6f5e-f6e0-a9eb-461b-6118363bd15c}\localserver32 -> DeepL.exe => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32 ->  => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{EE73C1E2-DCBA-8B31-AEB2-238AB53135BD}\InprocServer32 -> C:\Program Files (x86)\Common Files\System\ole32.dll => Keine Datei
CustomCLSID: HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{6BFA57C8-17BB-4D22-1D47-57C0F4C5F0C5}\InprocServer32 -> kein Dateipfad
AlternateDataStreams: C:\Users\AllUserName\Anwendungsdaten:a4f3a4460331e5db92483d18f7474c91 [394]
AlternateDataStreams: C:\Users\AllUserName\AppData\Roaming:a4f3a4460331e5db92483d18f7474c91 [394]
Startup: C:\Users\AllUserName\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2025-01-27]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled [2025-01-27]
C:\Users\AllUserName\AppData\Roaming\.machineId
C:\Users\AllUserName\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
CMD: type "C:\USERS\AllUserName\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HCJLXEBF.CLEAN-1755356951333\USER.JS"
CMD: type "C:\USERS\AllUserName\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\376W2OAH.DEFAULT-RELEASE\USER.JS"
CMD: dism /online /cleanup-image /restorehealth
CMD: sfc /scannow
Reboot:
End::
*****************

HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\ProgramData\AppData\Local\TrafficMonitor => Fehler = Zugriff verweigert
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Default\AppData\Local\TrafficMonitor => Fehler = Zugriff verweigert
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\nobody\AppData\Local\TrafficMonitor => Fehler = Zugriff verweigert
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Public\AppData\Local\TrafficMonitor => Fehler = Zugriff verweigert
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\ProgramData\AppData\Local\TrafficMonitor\TrafficMonitor.sys => Fehler = Zugriff verweigert
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Default\AppData\Local\TrafficMonitor\TrafficMonitor.sys => Fehler = Zugriff verweigert
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\nobody\AppData\Local\TrafficMonitor\TrafficMonitor.sys => Fehler = Zugriff verweigert
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Users\Public\AppData\Local\TrafficMonitor\TrafficMonitor.sys => Fehler = Zugriff verweigert
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\\C:\Program Files\Black Tree Gaming Ltd\Vortex => Fehler = Zugriff verweigert
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\\file: \??\c:\users\ProgramData\appdata\local\trafficmonitor\trafficmonitor.sys => Fehler = Zugriff verweigert
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\\file: \??\c:\users\Default\appdata\local\trafficmonitor\trafficmonitor.sys => Fehler = Zugriff verweigert
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\\file: \??\c:\users\nobody\appdata\local\trafficmonitor\trafficmonitor.sys => Fehler = Zugriff verweigert
HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\\file: \??\c:\users\Public\appdata\local\trafficmonitor\trafficmonitor.sys => Fehler = Zugriff verweigert
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{b72e6f5e-f6e0-a9eb-461b-6118363bd15c} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{EE73C1E2-DCBA-8B31-AEB2-238AB53135BD} => nicht gefunden
HKU\S-1-5-21-2536556504-2545875602-4211533971-1001_Classes\CLSID\{6BFA57C8-17BB-4D22-1D47-57C0F4C5F0C5} => nicht gefunden
"C:\Users\ProgramData\Anwendungsdaten" => ":a4f3a4460331e5db92483d18f7474c91" ADS nicht gefunden.
"C:\Users\Default\Anwendungsdaten" => ":a4f3a4460331e5db92483d18f7474c91" ADS nicht gefunden.
C:\Users\nobody\Anwendungsdaten => ":a4f3a4460331e5db92483d18f7474c91" ADS erfolgreich entfernt
"C:\Users\Public\Anwendungsdaten" => ":a4f3a4460331e5db92483d18f7474c91" ADS nicht gefunden.
"C:\Users\ProgramData\AppData\Roaming" => ":a4f3a4460331e5db92483d18f7474c91" ADS nicht gefunden.
"C:\Users\Default\AppData\Roaming" => ":a4f3a4460331e5db92483d18f7474c91" ADS nicht gefunden.
"C:\Users\nobody\AppData\Roaming" => ":a4f3a4460331e5db92483d18f7474c91" ADS nicht gefunden.
"C:\Users\Public\AppData\Roaming" => ":a4f3a4460331e5db92483d18f7474c91" ADS nicht gefunden.
"C:\Users\ProgramData\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled" => nicht gefunden
"C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled" => nicht gefunden
C:\Users\nobody\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled => erfolgreich verschoben
"C:\Users\Public\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled" => nicht gefunden
Konnte nicht verschoben werden "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled" => ist geplant bei Neustart verschoben zu werden.
"C:\Users\ProgramData\AppData\Roaming\.machineId" => nicht gefunden
"C:\Users\Default\AppData\Roaming\.machineId" => nicht gefunden
C:\Users\nobody\AppData\Roaming\.machineId => erfolgreich verschoben
"C:\Users\Public\AppData\Roaming\.machineId" => nicht gefunden
"C:\Users\ProgramData\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini" => nicht gefunden
"C:\Users\Default\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini" => nicht gefunden
C:\Users\nobody\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => erfolgreich verschoben
"C:\Users\Public\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini" => nicht gefunden

========= type "C:\USERS\ProgramData\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HCJLXEBF.CLEAN-1755356951333\USER.JS" =========

Das System kann den angegebenen Pfad nicht finden.


========= Ende von CMD: =========


========= type "C:\USERS\Default\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HCJLXEBF.CLEAN-1755356951333\USER.JS" =========

Das System kann den angegebenen Pfad nicht finden.


========= Ende von CMD: =========


========= type "C:\USERS\nobody\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HCJLXEBF.CLEAN-1755356951333\USER.JS" =========

# Mozilla User Preferences
# Privacy-Handbuch, minimale user.js (vom 06.04.2024)
# Download: https://www.privacy-handbuch.de/handbuch_21u.htm


#####################
# Minimale Parameter
#####################

user_pref("app.normandy.enabled", false);
user_pref("app.shield.optoutstudies.enabled", false);
user_pref("browser.cache.disk.enable", false);
user_pref("browser.cache.disk_cache_ssl", false);
user_pref("browser.newtabpage.enabled", false);
user_pref("browser.messaging-system.whatsNewPanel.enabled", false);
user_pref("browser.newtabpage.activity-stream.feeds.snippets", false);
user_pref("browser.newtabpage.activity-stream.feeds.topsites", false);
user_pref("browser.newtabpage.activity-stream.feeds.system.topsites", false);
user_pref("browser.newtabpage.activity-stream.showSponsored", false);
user_pref("browser.newtabpage.activity-stream.showSponsoredTopSites", false);
user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false);
user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false);
user_pref("browser.newtabpage.activity-stream.section.highlights.includePocket", false);
user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry", false);
user_pref("browser.pagethumbnails.capturing_disabled", true);
user_pref("browser.ping-centre.telemetry", false);
user_pref("browser.region.update.enabled", false);
user_pref("browser.region.network.url", "");
user_pref("browser.search.update", false);
user_pref("browser.search.suggest.enabled", false);
user_pref("browser.sessionstore.privacy_level", 2);
user_pref("browser.startup.homepage_override.mstone", "ignore");
user_pref("browser.startup.page", 0);
user_pref("browser.tabs.crashReporting.sendReport", false);
user_pref("browser.tabs.firefox-view", false);
user_pref("browser.topsites.contile.enabled", false);
user_pref("browser.uitour.enabled", false);
user_pref("browser.uitour.url", "");
user_pref("browser.urlbar.trimURLs", false);
user_pref("browser.urlbar.groupLabels.enabled", false);
user_pref("browser.urlbar.suggest.openpage", false);
user_pref("browser.urlbar.suggest.searches", false);
user_pref("browser.urlbar.suggest.topsites", false);
user_pref("browser.urlbar.quicksuggest.enabled", false);
user_pref("browser.urlbar.quicksuggest.dataCollection.enabled", false);
user_pref("browser.urlbar.quicksuggest.showedOnboardingDialog", true);
user_pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false);
user_pref("browser.urlbar.suggest.quicksuggest.sponsored", false);
user_pref("browser.vpn_promo.enabled", false);
user_pref("datareporting.healthreport.uploadEnabled", false);
user_pref("datareporting.policy.dataSubmissionEnabled", false);
user_pref("dom.security.https_first", true);
user_pref("dom.vibrator.max_vibrate_ms", 0);
user_pref("extensions.getAddons.cache.enabled", false);
user_pref("extensions.htmlaboutaddons.recommendations.enabled", false);
user_pref("extensions.ui.lastCategory", "addons://list/extension");
user_pref("extensions.pocket.enabled", false);
user_pref("extensions.quarantinedDomains.enabled", false);
user_pref("extensions.systemAddon.update.enabled", false);
user_pref("extensions.webextensions.restrictedDomains", "");
user_pref("layout.css.font-visibility", 1);
user_pref("media.peerconnection.ice.default_address_only", true);
user_pref("media.peerconnection.ice.no_host", true);
user_pref("network.connectivity-service.enabled", false);
user_pref("network.http.referer.XOriginPolicy", 1);
user_pref("network.http.referer.XOriginTrimmingPolicy", 2);
user_pref("network.IDN_show_punycode", true);
user_pref("network.manage-offline-status", false);
user_pref("network.trr.default_provider_uri", "https://doh.ffmuc.net/dns-query");
user_pref("permissions.isolateBy.userContext", true);
user_pref("places.history.enabled", false);
user_pref("privacy.clearOnShutdown.offlineApps", true);
user_pref("privacy.cpd.offlineApps", true);
user_pref("privacy.cpd.passwords", true);
user_pref("privacy.fingerprintingProtection", true);
user_pref("privacy.history.custom", true);
user_pref("privacy.query_stripping.enabled", true);
user_pref("privacy.resistFingerprinting", false);
user_pref("privacy.sanitize.sanitizeOnShutdown", true);
user_pref("privacy.trackingprotection.enabled", false);
user_pref("privacy.userContext.enabled", true);
user_pref("privacy.userContext.ui.enabled", true);
user_pref("security.insecure_connection_text.enabled", true);
user_pref("security.insecure_connection_text.pbmode.enabled", true);
user_pref("security.mixed_content.upgrade_display_content", true);
user_pref("services.settings.server", "https://s.%.c.invalid/v1");
user_pref("signon.autofillForms", false);
user_pref("signon.formlessCapture.enabled", false);
user_pref("toolkit.coverage.endpoint.base", "");
user_pref("toolkit.coverage.opt-out", true);
user_pref("toolkit.telemetry.coverage.opt-out", true);
user_pref("ui.use_standins_for_native_colors", true);
user_pref("webgl.enable-debug-renderer-info", false);
user_pref("security.ssl.require_safe_negotiation", true);
user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true);

user_pref("_user.js.prhdb", "minimal_06042024");

#####################
# Moderate Parameter (hier deaktiviert)
#####################

// user_pref("browser.formfill.enable", false);
// user_pref("browser.safebrowsing.downloads.remote.url", " ");
// user_pref("browser.safebrowsing.downloads.enabled", false);
// user_pref("browser.safebrowsing.phishing.enabled", false);
// user_pref("browser.safebrowsing.malware.enabled", false);
// user_pref("browser.safebrowsing.downloads.remote.enabled", false);
// user_pref("browser.safebrowsing.downloads.remote.block_dangerous", false);
// user_pref("browser.safebrowsing.downloads.remote.block_dangerous_host", false);
// user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false);
// user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false);
// user_pref("browser.safebrowsing.blockedURIs.enabled", false);
// user_pref("browser.safebrowsing.provider.google.gethashURL", "");
// user_pref("browser.safebrowsing.provider.google.updateURL", "");
// user_pref("browser.safebrowsing.provider.google4.gethashURL", "");
// user_pref("browser.safebrowsing.provider.google4.updateURL", "");
// user_pref("browser.safebrowsing.provider.mozilla.gethashURL", "");
// user_pref("browser.safebrowsing.provider.mozilla.updateURL", "");
// user_pref("browser.urlbar.speculativeConnect.enabled", false);
// user_pref("dom.security.https_only_mode", true);
// user_pref("dom.security.https_only_mode_send_http_background_request", false);
// user_pref("extensions.blocklist.enabled", false);
// user_pref("extensions.formautofill.addresses.enabled", false);
// user_pref("extensions.formautofill.creditCards.enabled", false);
// user_pref("extensions.formautofill.heuristics.enabled", false);
// user_pref("extensions.screenshots.disabled", true);
// user_pref("font.blacklist.underline_offset", "");
// user_pref("network.captive-portal-service.enabled", false);
// user_pref("network.dns.disablePrefetch", true);
// user_pref("network.http.altsvc.enabled", false);
// user_pref("network.http.altsvc.oe", false);
// user_pref("security.cert_pinning.enforcement_level", 2);
// user_pref("security.certerrors.mitm.auto_enable_enterprise_roots", false);
// user_pref("ui.systemUsesDarkTheme", 0);
// user_pref("webgl.disable-fail-if-major-performance-caveat", true);


##########################
# Medium strenge Parameter (hier deaktiviert)
##########################

// user_pref("dom.push.enabled", false);
// user_pref("identity.fxaccounts.enabled", false);
// user_pref("javascript.options.baselinejit", false);
// user_pref("javascript.options.ion", false);
// user_pref("javascript.options.native_regexp", false);
// user_pref("media.autoplay.default", 5);
// user_pref("media.autoplay.blocking_policy", 2);
// user_pref("media.eme.enabled", false);
// user_pref("media.gmp-gmpopenh264.enabled", false);
// user_pref("media.gmp-gmpopenh264.autoupdate", false);
// user_pref("media.gmp-gmpopenh264.provider.enabled", false);
// user_pref("media.gmp-gmpopenh264.visible", false);
// user_pref("media.gmp-manager.url", "data:text/plain,");
// user_pref("media.gmp-manager.url.override", "data:text/plain,");
// user_pref("pdfjs.enableScripting", false);
// user_pref("signon.rememberSignons", false);

####################
# Strenge Parameter (hier deaktiviert)
####################

// user_pref("browser.chrome.site_icons", false);
// user_pref("browser.display.use_document_fonts", 0);
// user_pref("browser.eme.ui.enabled", false);
// user_pref("browser.sessionstore.max_tabs_undo", 0);
// user_pref("browser.sessionstore.max_windows_undo", 0);
// user_pref("dom.event.clipboardevents.enabled", false);
// user_pref("gfx.direct2d.disabled", true);
// user_pref("gfx.downloadable_fonts.enabled", false);
// user_pref("gfx.font_rendering.opentype_svg.enabled", false);
// user_pref("gfx.font_rendering.graphite.enabled", false);
// user_pref("layout.css.font-loading-api.enabled", false);
// user_pref("media.hardware-video-decoding.enabled", false);
// user_pref("pdfjs.disabled", true);
// user_pref("privacy.clearOnShutdown.siteSettings", true);
// user_pref("privacy.cpd.siteSettings", true);
// user_pref("svg.disabled", true);




========= Ende von CMD: =========


========= type "C:\USERS\Public\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\HCJLXEBF.CLEAN-1755356951333\USER.JS" =========

Das System kann den angegebenen Pfad nicht finden.


========= Ende von CMD: =========


========= type "C:\USERS\ProgramData\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\376W2OAH.DEFAULT-RELEASE\USER.JS" =========

Das System kann den angegebenen Pfad nicht finden.


========= Ende von CMD: =========


========= type "C:\USERS\Default\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\376W2OAH.DEFAULT-RELEASE\USER.JS" =========

Das System kann den angegebenen Pfad nicht finden.


========= Ende von CMD: =========


========= type "C:\USERS\nobody\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\376W2OAH.DEFAULT-RELEASE\USER.JS" =========

/******
*    name: arkenfox user.js
*    date: 4 November 2025
* version: 140
*    urls: https://github.com/arkenfox/user.js [repo]
*        : https://arkenfox.github.io/gui/ [interactive]
* license: MIT: https://github.com/arkenfox/user.js/blob/master/LICENSE.txt

* README:

  1. Consider using Tor Browser if it meets your needs or fits your threat model
       * https://2019.www.torproject.org/about/torusers.html
  2. Read the entire wiki
       * https://github.com/arkenfox/user.js/wiki
  3. If you skipped step 2, return to step 2
  4. Make changes in a user-overrides.js
       * There are often trade-offs and conflicts between security vs privacy vs anti-tracking
         and these need to be balanced against functionality & convenience & breakage
       * Some site breakage and unintended consequences will happen. Everyone's experience will differ
         e.g. some user data is erased on exit (section 2800), change this to suit your needs
       * While not 100% definitive, search for "[SETUP" tags
  5. Some tag info
       [SETUP-SECURITY] it's one item, read it
            [SETUP-WEB] can cause some websites to break
         [SETUP-CHROME] changes how Firefox itself behaves (i.e. not directly website related)
         [SETUP-HARDEN] prefs you may like to add to overrides
  6. Override Recipes: https://github.com/arkenfox/user.js/issues/1080

* RELEASES: https://github.com/arkenfox/user.js/releases

  * Use the arkenfox release that matches your Firefox version
    - DON'T wait for arkenfox to update Firefox, nothing major changes these days
  * Each release
    - run prefsCleaner to reset prefs made inactive, including deprecated (9999)
  * ESR (Extended Support Release)
    - It is recommended to not use the updater, or you will get a later version which may cause issues.
      So you should manually append your overrides (and keep a copy), and manually update when you
      change ESR releases (arkenfox is already past that release)
    - If you decide to keep updating, then the onus is on you - also see section 9999

* INDEX:

  0100: STARTUP
  0200: GEOLOCATION
  0300: QUIETER FOX
  0400: SAFE BROWSING
  0600: BLOCK IMPLICIT OUTBOUND
  0700: DNS / DoH / PROXY / SOCKS
  0800: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS
  0900: PASSWORDS
  1000: DISK AVOIDANCE
  1200: HTTPS (SSL/TLS / OCSP / CERTS / HPKP)
  1600: REFERERS
  1700: CONTAINERS
  2000: PLUGINS / MEDIA / WEBRTC
  2400: DOM (DOCUMENT OBJECT MODEL)
  2600: MISCELLANEOUS
  2700: ETP (ENHANCED TRACKING PROTECTION)
  2800: SHUTDOWN & SANITIZING
  4000: FPP (fingerprintingProtection)
  4500: OPTIONAL RFP (resistFingerprinting)
  5000: OPTIONAL OPSEC
  5500: OPTIONAL HARDENING
  6000: DON'T TOUCH
  7000: DON'T BOTHER
  8000: DON'T BOTHER: FINGERPRINTING
  8500: TELEMETRY
  9000: NON-PROJECT RELATED
  9999: DEPRECATED / RENAMED

******/

/* START: internal custom pref to test for syntax errors
 * [NOTE] Not all syntax errors cause parsing to abort i.e. reaching the last debug pref
 * no longer necessarily means that all prefs have been applied. Check the console right
 * after startup for any warnings/error messages related to non-applied prefs
 * [1] https://blog.mozilla.org/nnethercote/2018/03/09/a-new-preferences-parser-for-firefox/ ***/
user_pref("_user.js.parrot", "START: Oh yes, the Norwegian Blue... what's wrong with it?");

/* 0000: disable about:config warning ***/
user_pref("browser.aboutConfig.showWarning", false);

/*** [SECTION 0100]: STARTUP ***/
user_pref("_user.js.parrot", "0100 syntax error: the parrot's dead!");
/* 0102: set startup page [SETUP-CHROME]
 * 0=blank, 1=home, 2=last visited page, 3=resume previous session
 * [NOTE] Session Restore is cleared if history is also cleared (2811+), and not used in Private Browsing mode
 * [SETTING] General>Startup>Restore previous session ***/
user_pref("browser.startup.page", 0);
/* 0103: set HOME+NEWWINDOW page
 * about:home=Firefox Home (default, see 0105), custom URLs..., Blank Page
 * [SETTING] Home>New Windows and Tabs>Homepage and new windows ***/
user_pref("browser.startup.homepage", "chrome://browser/content/blanktab.html");
/* 0104: set NEWTAB page
 * true=Firefox Home (default, see 0105), false=blank page
 * [SETTING] Home>New Windows and Tabs>New tabs ***/
user_pref("browser.newtabpage.enabled", false);
/* 0105: disable sponsored content on Firefox Home (Activity Stream)
 * [SETTING] Home>Firefox Home Content ***/
user_pref("browser.newtabpage.activity-stream.showSponsored", false); // [FF58+] Sponsored stories
user_pref("browser.newtabpage.activity-stream.showSponsoredTopSites", false); // [FF83+] Sponsored shortcuts
user_pref("browser.newtabpage.activity-stream.showSponsoredCheckboxes", false); // [FF140+] Support Firefox
/* 0106: clear default topsites
 * [NOTE] This does not block you from adding your own ***/
user_pref("browser.newtabpage.activity-stream.default.sites", "");

/*** [SECTION 0200]: GEOLOCATION ***/
user_pref("_user.js.parrot", "0200 syntax error: the parrot's definitely deceased!");
/* 0202: disable using the OS's geolocation service ***/
user_pref("geo.provider.ms-windows-location", false); // [WINDOWS]
user_pref("geo.provider.use_corelocation", false); // [MAC]
user_pref("geo.provider.use_geoclue", false); // [FF102+] [LINUX]

/*** [SECTION 0300]: QUIETER FOX ***/
user_pref("_user.js.parrot", "0300 syntax error: the parrot's not pinin' for the fjords!");
/** RECOMMENDATIONS ***/
/* 0320: disable recommendation pane in about:addons (uses Google Analytics) ***/
user_pref("extensions.getAddons.showPane", false); // [HIDDEN PREF]
/* 0321: disable recommendations in about:addons' Extensions and Themes panes [FF68+] ***/
user_pref("extensions.htmlaboutaddons.recommendations.enabled", false);
/* 0322: disable personalized Extension Recommendations in about:addons and AMO [FF65+]
 * [NOTE] This pref has no effect when Health Reports (8501) are disabled
 * [SETTING] Privacy & Security>Firefox Data Collection and Use>Allow personalized extension recommendations
 * [1] https://support.mozilla.org/kb/personalized-extension-recommendations ***/
user_pref("browser.discovery.enabled", false);

/** ACTIVITY STREAM ***/
/* 0335: disable Firefox Home (Activity Stream) telemetry ***/
user_pref("browser.newtabpage.activity-stream.feeds.telemetry", false);
user_pref("browser.newtabpage.activity-stream.telemetry", false);

/** STUDIES ***/
/* 0340: disable Studies
 * [SETTING] Privacy & Security>Firefox Data Collection and Use>Install and run studies ***/
user_pref("app.shield.optoutstudies.enabled", false);
/* 0341: disable Normandy/Shield [FF60+]
 * Shield is a telemetry system that can push and test "recipes"
 * [1] https://mozilla.github.io/normandy/ ***/
user_pref("app.normandy.enabled", false);
user_pref("app.normandy.api_url", "");

/** CRASH REPORTS ***/
/* 0350: disable Crash Reports ***/
user_pref("breakpad.reportURL", "");
user_pref("browser.tabs.crashReporting.sendReport", false); // [FF44+]
   // user_pref("browser.crashReports.unsubmittedCheck.enabled", false); // [FF51+] [DEFAULT: false]
/* 0351: enforce no submission of backlogged Crash Reports [FF58+]
 * [SETTING] Privacy & Security>Firefox Data Collection and Use>Send backlogged crash reports  ***/
user_pref("browser.crashReports.unsubmittedCheck.autoSubmit2", false); // [DEFAULT: false]

/** OTHER ***/
/* 0360: disable Captive Portal detection
 * [1] https://www.eff.org/deeplinks/2017/08/how-captive-portals-interfere-wireless-security-and-privacy ***/
user_pref("captivedetect.canonicalURL", "");
user_pref("network.captive-portal-service.enabled", false); // [FF52+]
/* 0361: disable Network Connectivity checks [FF65+]
 * [1] https://bugzilla.mozilla.org/1460537 ***/
user_pref("network.connectivity-service.enabled", false);

/*** [SECTION 0400]: SAFE BROWSING (SB)
   SB has taken many steps to preserve privacy. If required, a full url is never sent
   to Google, only a part-hash of the prefix, hidden with noise of other real part-hashes.
   Firefox takes measures such as stripping out identifying parameters and since SBv4 (FF57+)
   doesn't even use cookies. (#Turn on browser.safebrowsing.debug to monitor this activity)

   [1] https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/
   [2] https://wiki.mozilla.org/Security/Safe_Browsing
   [3] https://support.mozilla.org/kb/how-does-phishing-and-malware-protection-work
   [4] https://educatedguesswork.org/posts/safe-browsing-privacy/
***/
user_pref("_user.js.parrot", "0400 syntax error: the parrot's passed on!");
/* 0401: disable SB (Safe Browsing)
 * [WARNING] Do this at your own risk! These are the master switches
 * [SETTING] Privacy & Security>Security>... Block dangerous and deceptive content ***/
   // user_pref("browser.safebrowsing.malware.enabled", false);
   // user_pref("browser.safebrowsing.phishing.enabled", false);
/* 0402: disable SB checks for downloads (both local lookups + remote)
 * This is the master switch for the safebrowsing.downloads* prefs (0403, 0404)
 * [SETTING] Privacy & Security>Security>... "Block dangerous downloads" ***/
   // user_pref("browser.safebrowsing.downloads.enabled", false);
/* 0403: disable SB checks for downloads (remote)
 * To verify the safety of certain executable files, Firefox may submit some information about the
 * file, including the name, origin, size and a cryptographic hash of the contents, to the Google
 * Safe Browsing service which helps Firefox determine whether or not the file should be blocked
 * [SETUP-SECURITY] If you do not understand this, or you want this protection, then override this ***/
user_pref("browser.safebrowsing.downloads.remote.enabled", false);
   // user_pref("browser.safebrowsing.downloads.remote.url", ""); // Defense-in-depth
/* 0404: disable SB checks for unwanted software
 * [SETTING] Privacy & Security>Security>... "Warn you about unwanted and uncommon software" ***/
   // user_pref("browser.safebrowsing.downloads.remote.block_potentially_unwanted", false);
   // user_pref("browser.safebrowsing.downloads.remote.block_uncommon", false);
/* 0405: disable "ignore this warning" on SB warnings [FF45+]
 * If clicked, it bypasses the block for that session. This is a means for admins to enforce SB
 * [TEST] see https://github.com/arkenfox/user.js/wiki/Appendix-A-Test-Sites#-mozilla
 * [1] https://bugzilla.mozilla.org/1226490 ***/
   // user_pref("browser.safebrowsing.allowOverride", false);

/*** [SECTION 0600]: BLOCK IMPLICIT OUTBOUND [not explicitly asked for - e.g. clicked on] ***/
user_pref("_user.js.parrot", "0600 syntax error: the parrot's no more!");
/* 0601: disable link prefetching
 * [1] https://developer.mozilla.org/docs/Web/HTTP/Link_prefetching_FAQ ***/
user_pref("network.prefetch-next", false);
/* 0602: disable DNS prefetching
 * [1] https://developer.mozilla.org/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control ***/
user_pref("network.dns.disablePrefetch", true);
user_pref("network.dns.disablePrefetchFromHTTPS", true);
/* 0603: disable predictor / prefetching ***/
user_pref("network.predictor.enabled", false);
user_pref("network.predictor.enable-prefetch", false); // [FF48+] [DEFAULT: false]
/* 0604: disable link-mouseover opening connection to linked server
 * [1] https://news.slashdot.org/story/15/08/14/2321202/how-to-quash-firefoxs-silent-requests ***/
user_pref("network.http.speculative-parallel-limit", 0);
/* 0605: disable mousedown speculative connections on bookmarks and history [FF98+] ***/
user_pref("browser.places.speculativeConnect.enabled", false);
/* 0610: enforce no "Hyperlink Auditing" (click tracking)
 * [1] https://www.bleepingcomputer.com/news/software/major-browsers-to-prevent-disabling-of-click-tracking-privacy-risk/ ***/
   // user_pref("browser.send_pings", false); // [DEFAULT: false]

/*** [SECTION 0700]: DNS / DoH / PROXY / SOCKS ***/
user_pref("_user.js.parrot", "0700 syntax error: the parrot's given up the ghost!");
/* 0702: set the proxy server to do any DNS lookups when using SOCKS
 * e.g. in Tor, this stops your local DNS server from knowing your Tor destination
 * as a remote Tor node will handle the DNS request
 * [1] https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/WebBrowsers ***/
user_pref("network.proxy.socks_remote_dns", true);
/* 0703: disable using UNC (Uniform Naming Convention) paths [FF61+]
 * [SETUP-CHROME] Can break extensions for profiles on network shares
 * [1] https://bugzilla.mozilla.org/1413868 ***/
user_pref("network.file.disable_unc_paths", true); // [HIDDEN PREF]
/* 0704: disable GIO as a potential proxy bypass vector
 * Gvfs/GIO has a set of supported protocols like obex, network, archive, computer,
 * dav, cdda, gphoto2, trash, etc. From FF87-117, by default only sftp was accepted
 * [1] https://bugzilla.mozilla.org/1433507
 * [2] https://en.wikipedia.org/wiki/GVfs
 * [3] https://en.wikipedia.org/wiki/GIO_(software) ***/
user_pref("network.gio.supported-protocols", ""); // [HIDDEN PREF] [DEFAULT: ""]
/* 0705: disable proxy direct failover for system requests [FF91+]
 * [WARNING] Default true is a security feature against malicious extensions [1]
 * [SETUP-CHROME] If you use a proxy and you trust your extensions
 * [1] https://blog.mozilla.org/security/2021/10/25/securing-the-proxy-api-for-firefox-add-ons/ ***/
   // user_pref("network.proxy.failover_direct", false);
/* 0706: disable proxy bypass for system request failures [FF95+]
 * RemoteSettings, UpdateService, Telemetry [1]
 * [WARNING] If false, this will break the fallback for some security features
 * [SETUP-CHROME] If you use a proxy and you understand the security impact
 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1732792,1733994,1733481 ***/
   // user_pref("network.proxy.allow_bypass", false);
/* 0710: enable DNS-over-HTTPS (DoH) [FF60+]
 * 0=default, 2=increased (TRR (Trusted Recursive Resolver) first), 3=max (TRR only), 5=off (no rollout)
 * see "doh-rollout.home-region": USA 2019, Canada 2021, Russia/Ukraine 2022 [3]
 * [SETTING] Privacy & Security>DNS over HTTPS
 * [1] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/
 * [2] https://wiki.mozilla.org/Security/DOH-resolver-policy
 * [3] https://support.mozilla.org/kb/firefox-dns-over-https
 * [4] https://www.eff.org/deeplinks/2020/12/dns-doh-and-odoh-oh-my-year-review-2020 ***/
   // user_pref("network.trr.mode", 3);
/* 0712: set DoH provider
 * The custom uri is the value shown when you "Choose provider>Custom>"
 * [NOTE] If you USE custom then "network.trr.uri" should be set the same
 * [SETTING] Privacy & Security>DNS over HTTPS>Increased/Max>Choose provider ***/
   // user_pref("network.trr.uri", "https://example.dns");
   // user_pref("network.trr.custom_uri", "https://example.dns");

/*** [SECTION 0800]: LOCATION BAR / SEARCH BAR / SUGGESTIONS / HISTORY / FORMS ***/
user_pref("_user.js.parrot", "0800 syntax error: the parrot's ceased to be!");
/* 0801: disable location bar making speculative connections [FF56+]
 * [1] https://bugzilla.mozilla.org/1348275 ***/
user_pref("browser.urlbar.speculativeConnect.enabled", false);
/* 0802: disable location bar contextual suggestions
 * [NOTE] The UI is controlled by the .enabled pref
 * [SETTING] Search>Address Bar>Suggestions from...
 * [1] https://blog.mozilla.org/data/2021/09/15/data-and-firefox-suggest/ ***/
user_pref("browser.urlbar.quicksuggest.enabled", false); // [FF92+]
user_pref("browser.urlbar.suggest.quicksuggest.nonsponsored", false); // [FF95+]
user_pref("browser.urlbar.suggest.quicksuggest.sponsored", false); // [FF92+]
/* 0803: disable live search suggestions
 * [NOTE] Both must be true for live search to work in the location bar
 * [SETUP-CHROME] Override these if you trust and use a privacy respecting search engine
 * [SETTING] Search>Show search suggestions | Show search suggestions in address bar results ***/
user_pref("browser.search.suggest.enabled", false);
user_pref("browser.urlbar.suggest.searches", false);
/* 0805: disable urlbar trending search suggestions [FF118+]
 * [SETTING] Search>Search Suggestions>Show trending search suggestions (FF119) ***/
user_pref("browser.urlbar.trending.featureGate", false);
/* 0806: disable urlbar suggestions ***/
user_pref("browser.urlbar.addons.featureGate", false); // [FF115+]
user_pref("browser.urlbar.amp.featureGate", false); // [FF141+] adMarketplace
user_pref("browser.urlbar.fakespot.featureGate", false); // [FF130+] [DEFAULT: false]
user_pref("browser.urlbar.mdn.featureGate", false); // [FF117+]
user_pref("browser.urlbar.weather.featureGate", false); // [FF108+]
user_pref("browser.urlbar.wikipedia.featureGate", false); // [FF141+]
user_pref("browser.urlbar.yelp.featureGate", false); // [FF124+]
/* 0807: disable urlbar clipboard suggestions [FF118+] ***/
   // user_pref("browser.urlbar.clipboard.featureGate", false);
/* 0808: disable recent searches [FF120+]
 * [NOTE] Recent searches are cleared if history is cleared (2811+)
 * [1] https://support.mozilla.org/kb/search-suggestions-firefox ***/
   // user_pref("browser.urlbar.recentsearches.featureGate", false);
/* 0810: disable search and form history
 * [NOTE] We also clear formdata on exit (2811+)
 * [SETUP-WEB] Be aware that autocomplete form data can be read by third parties [1][2]
 * [SETTING] Privacy & Security>History>Custom Settings>Remember search and form history
 * [1] https://blog.mindedsecurity.com/2011/10/autocompleteagain.html
 * [2] https://bugzilla.mozilla.org/381681 ***/
user_pref("browser.formfill.enable", false);
/* 0815: disable tab-to-search [FF85+]
 * Alternatively, you can exclude on a per-engine basis by unchecking them in Options>Search
 * [SETTING] Search>Address Bar>When using the address bar, suggest>Search engines ***/
   // user_pref("browser.urlbar.suggest.engines", false);
/* 0820: disable coloring of visited links
 * [SETUP-HARDEN] Bulk rapid history sniffing was mitigated in 2010 [1][2]. Slower and more expensive
 * redraw timing attacks were largely mitigated in FF77+ [3]. Using RFP (4501) further hampers timing
 * attacks. History can also be cleared on exit (2811+). However, social engineering [2#limits][4][5]
 * and advanced targeted timing attacks could still produce usable results
 * [1] https://developer.mozilla.org/docs/Web/CSS/Privacy_and_the_:visited_selector
 * [2] https://dbaron.org/mozilla/visited-privacy
 * [3] https://bugzilla.mozilla.org/1632765
 * [4] https://earthlng.github.io/testpages/visited_links.html (see github wiki APPENDIX A on how to use)
 * [5] https://lcamtuf.blogspot.com/2016/08/css-mix-blend-mode-is-bad-for-keeping.html ***/
   // user_pref("layout.css.visited_links_enabled", false);
/* 0830: enable separate default search engine in Private Windows and its UI setting
 * [SETTING] Search>Default Search Engine>Choose a different default search engine for Private Windows only ***/
user_pref("browser.search.separatePrivateDefault", true); // [FF70+]
user_pref("browser.search.separatePrivateDefault.ui.enabled", true); // [FF71+]

/*** [SECTION 0900]: PASSWORDS
   [1] https://support.mozilla.org/kb/use-primary-password-protect-stored-logins-and-pas
***/
user_pref("_user.js.parrot", "0900 syntax error: the parrot's expired!");
/* 0903: disable auto-filling username & password form fields
 * can leak in cross-site forms *and* be spoofed
 * [NOTE] Username & password is still available when you enter the field
 * [SETTING] Privacy & Security>Passwords>Autofill logins and passwords
 * [1] https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/
 * [2] https://homes.esat.kuleuven.be/~asenol/leaky-forms/ ***/
user_pref("signon.autofillForms", false);
/* 0904: disable formless login capture for Password Manager [FF51+] ***/
user_pref("signon.formlessCapture.enabled", false);
/* 0905: limit (or disable) HTTP authentication credentials dialogs triggered by sub-resources [FF41+]
 * hardens against potential credentials phishing
 * 0 = don't allow sub-resources to open HTTP authentication credentials dialogs
 * 1 = don't allow cross-origin sub-resources to open HTTP authentication credentials dialogs
 * 2 = allow sub-resources to open HTTP authentication credentials dialogs (default) ***/
user_pref("network.auth.subresource-http-auth-allow", 1);
/* 0906: enforce no automatic authentication on Microsoft sites [FF91+] [WINDOWS 10+]
 * [SETTING] Privacy & Security>Logins and Passwords>Allow Windows single sign-on for...
 * [1] https://support.mozilla.org/kb/windows-sso ***/
   // user_pref("network.http.windows-sso.enabled", false); // [DEFAULT: false]
/* 0907: enforce no automatic authentication on Microsoft sites [FF131+] [MAC]
 * On macOS, SSO only works on corporate devices ***/
   // user_pref("network.http.microsoft-entra-sso.enabled", false); // [DEFAULT: false]

/*** [SECTION 1000]: DISK AVOIDANCE ***/
user_pref("_user.js.parrot", "1000 syntax error: the parrot's gone to meet 'is maker!");
/* 1001: disable disk cache
 * [NOTE] We also clear cache on exit (2811+)
 * [SETUP-CHROME] If you think disk cache helps perf, then feel free to override this ***/
user_pref("browser.cache.disk.enable", false);
/* 1002: set media cache in Private Browsing to in-memory and increase its maximum size
 * [NOTE] MSE (Media Source Extensions) are already stored in-memory in PB ***/
user_pref("browser.privatebrowsing.forceMediaMemoryCache", true); // [FF75+]
user_pref("media.memory_cache_max_size", 65536);
/* 1003: disable storing extra session data [SETUP-CHROME]
 * define on which sites to save extra session data such as form content, cookies and POST data
 * 0=everywhere, 1=unencrypted sites, 2=nowhere ***/
user_pref("browser.sessionstore.privacy_level", 2);
/* 1005: disable automatic Firefox start and session restore after reboot [FF62+] [WINDOWS]
 * [1] https://bugzilla.mozilla.org/603903 ***/
user_pref("toolkit.winRegisterApplicationRestart", false);
/* 1006: disable favicons in shortcuts [WINDOWS]
 * URL shortcuts use a cached randomly named .ico file which is stored in your
 * profile/shortcutCache directory. The .ico remains after the shortcut is deleted
 * If set to false then the shortcuts use a generic Firefox icon ***/
user_pref("browser.shell.shortcutFavicons", false);

/*** [SECTION 1200]: HTTPS (SSL/TLS / OCSP / CERTS / HPKP)
   Your cipher and other settings can be used in server side fingerprinting
   [TEST] https://www.ssllabs.com/ssltest/viewMyClient.html
   [TEST] https://browserleaks.com/ssl
   [TEST] https://ja3er.com/
   [1] https://www.securityartwork.es/2017/02/02/tls-client-fingerprinting-with-bro/
***/
user_pref("_user.js.parrot", "1200 syntax error: the parrot's a stiff!");
/** SSL (Secure Sockets Layer) / TLS (Transport Layer Security) ***/
/* 1201: require safe negotiation
 * Blocks connections to servers that don't support RFC 5746 [2] as they're potentially vulnerable to a
 * MiTM attack [3]. A server without RFC 5746 can be safe from the attack if it disables renegotiations
 * but the problem is that the browser can't know that. Setting this pref to true is the only way for the
 * browser to ensure there will be no unsafe renegotiations on the channel between the browser and the server
 * [SETUP-WEB] SSL_ERROR_UNSAFE_NEGOTIATION: is it worth overriding this for that one site?
 * [STATS] SSL Labs (May 2024) reports over 99.7% of top sites have secure renegotiation [4]
 * [1] https://wiki.mozilla.org/Security:Renegotiation
 * [2] https://datatracker.ietf.org/doc/html/rfc5746
 * [3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
 * [4] https://www.ssllabs.com/ssl-pulse/ ***/
user_pref("security.ssl.require_safe_negotiation", true);
/* 1206: disable TLS1.3 0-RTT (round-trip time) [FF51+]
 * This data is not forward secret, as it is encrypted solely under keys derived using
 * the offered PSK. There are no guarantees of non-replay between connections
 * [1] https://github.com/tlswg/tls13-spec/issues/1001
 * [2] https://www.rfc-editor.org/rfc/rfc9001.html#name-replay-attacks-with-0-rtt
 * [3] https://blog.cloudflare.com/tls-1-3-overview-and-q-and-a/ ***/
user_pref("security.tls.enable_0rtt_data", false);

/** OCSP (Online Certificate Status Protocol)
   [1] https://scotthelme.co.uk/revocation-is-broken/
   [2] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
***/
/* 1211: enforce OCSP fetching to confirm current validity of certificates
 * 0=disabled, 1=enabled (default), 2=enabled for EV certificates only
 * OCSP (non-stapled) leaks information about the sites you visit to the CA (cert authority)
 * It's a trade-off between security (checking) and privacy (leaking info to the CA)
 * [NOTE] This pref only controls OCSP fetching and does not affect OCSP stapling
 * [SETTING] Privacy & Security>Security>Certificates>Query OCSP responder servers...
 * [1] https://en.wikipedia.org/wiki/Ocsp ***/
user_pref("security.OCSP.enabled", 1); // [DEFAULT: 1]
/* 1212: set OCSP fetch failures (non-stapled, see 1211) to hard-fail
 * [SETUP-WEB] SEC_ERROR_OCSP_SERVER_ERROR | SEC_ERROR_OCSP_UNAUTHORIZED_REQUEST
 * When a CA cannot be reached to validate a cert, Firefox just continues the connection (=soft-fail)
 * Setting this pref to true tells Firefox to instead terminate the connection (=hard-fail)
 * It is pointless to soft-fail when an OCSP fetch fails: you cannot confirm a cert is still valid (it
 * could have been revoked) and/or you could be under attack (e.g. malicious blocking of OCSP servers)
 * [1] https://blog.mozilla.org/security/2013/07/29/ocsp-stapling-in-firefox/
 * [2] https://www.imperialviolet.org/2014/04/19/revchecking.html
 * [3] https://letsencrypt.org/2024/12/05/ending-ocsp/ ***/
user_pref("security.OCSP.require", true);

/** CERTS / HPKP (HTTP Public Key Pinning) ***/
/* 1223: enable strict PKP (Public Key Pinning)
 * 0=disabled, 1=allow user MiTM (default; such as your antivirus), 2=strict
 * [SETUP-WEB] MOZILLA_PKIX_ERROR_KEY_PINNING_FAILURE ***/
user_pref("security.cert_pinning.enforcement_level", 2);
/* 1224: enable CRLite [FF73+]
 * 0 = disabled
 * 1 = consult CRLite but only collect telemetry
 * 2 = consult CRLite and enforce both "Revoked" and "Not Revoked" results
 * 3 = consult CRLite and enforce "Not Revoked" results, but defer to OCSP for "Revoked" (default)
 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1429800,1670985,1753071
 * [2] https://blog.mozilla.org/security/tag/crlite/ ***/
user_pref("security.remote_settings.crlite_filters.enabled", true); // [DEFAULT: true FF137+]
user_pref("security.pki.crlite_mode", 2);

/** MIXED CONTENT ***/
/* 1241: disable insecure passive content (such as images) on https pages ***/
   // user_pref("security.mixed_content.block_display_content", true); // Defense-in-depth (see 1244)
/* 1244: enable HTTPS-Only mode in all windows
 * When the top-level is HTTPS, insecure subresources are also upgraded (silent fail)
 * [SETTING] to add site exceptions: Padlock>HTTPS-Only mode>On (after "Continue to HTTP Site")
 * [SETTING] Privacy & Security>HTTPS-Only Mode (and manage exceptions)
 * [TEST] http://example.com [upgrade]
 * [TEST] http://httpforever.com/ | http://http.rip [no upgrade] ***/
user_pref("dom.security.https_only_mode", true); // [FF76+]
   // user_pref("dom.security.https_only_mode_pbm", true); // [FF80+]
/* 1245: enable HTTPS-Only mode for local resources [FF77+] ***/
   // user_pref("dom.security.https_only_mode.upgrade_local", true);
/* 1246: disable HTTP background requests [FF82+]
 * When attempting to upgrade, if the server doesn't respond within 3 seconds, Firefox sends
 * a top-level HTTP request without path in order to check if the server supports HTTPS or not
 * This is done to avoid waiting for a timeout which takes 90 seconds
 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1642387,1660945 ***/
user_pref("dom.security.https_only_mode_send_http_background_request", false);

/** UI (User Interface) ***/
/* 1270: display warning on the padlock for "broken security" (if 1201 is false)
 * Bug: warning padlock not indicated for subresources on a secure page! [2]
 * [1] https://wiki.mozilla.org/Security:Renegotiation
 * [2] https://bugzilla.mozilla.org/1353705 ***/
user_pref("security.ssl.treat_unsafe_negotiation_as_broken", true);
/* 1272: display advanced information on Insecure Connection warning pages
 * only works when it's possible to add an exception
 * i.e. it doesn't work for HSTS discrepancies (https://subdomain.preloaded-hsts.badssl.com/)
 * [TEST] https://expired.badssl.com/ ***/
user_pref("browser.xul.error_pages.expert_bad_cert", true);

/*** [SECTION 1600]: REFERERS
                  full URI: https://example.com:8888/foo/bar.html?id=1234
     scheme+host+port+path: https://example.com:8888/foo/bar.html
          scheme+host+port: https://example.com:8888
   [1] https://feeding.cloud.geek.nz/posts/tweaking-referrer-for-privacy-in-firefox/
***/
user_pref("_user.js.parrot", "1600 syntax error: the parrot rests in peace!");
/* 1602: control the amount of cross-origin information to send [FF52+]
 * 0=send full URI (default), 1=scheme+host+port+path, 2=scheme+host+port ***/
user_pref("network.http.referer.XOriginTrimmingPolicy", 2);

/*** [SECTION 1700]: CONTAINERS ***/
user_pref("_user.js.parrot", "1700 syntax error: the parrot's bit the dust!");
/* 1701: enable Container Tabs and its UI setting [FF50+]
 * [SETTING] General>Tabs>Enable Container Tabs
 * https://wiki.mozilla.org/Security/Contextual_Identity_Project/Containers ***/
user_pref("privacy.userContext.enabled", true);
user_pref("privacy.userContext.ui.enabled", true);
/* 1702: set behavior on "+ Tab" button to display container menu on left click [FF74+]
 * [NOTE] The menu is always shown on long press and right click
 * [SETTING] General>Tabs>Enable Container Tabs>Settings>Select a container for each new tab ***/
   // user_pref("privacy.userContext.newTabContainerOnLeftClick.enabled", true);
/* 1703: set external links to open in site-specific containers [FF123+]
 * [SETUP-WEB] Depending on your container extension(s) and their settings
 * true=Firefox will not choose a container (so your extension can)
 * false=Firefox will choose the container/no-container (default)
 * [1] https://bugzilla.mozilla.org/1874599 ***/
   // user_pref("browser.link.force_default_user_context_id_for_external_opens", true);

/*** [SECTION 2000]: PLUGINS / MEDIA / WEBRTC ***/
user_pref("_user.js.parrot", "2000 syntax error: the parrot's snuffed it!");
/* 2002: force WebRTC inside the proxy [FF70+] ***/
user_pref("media.peerconnection.ice.proxy_only_if_behind_proxy", true);
/* 2003: force a single network interface for ICE candidates generation [FF42+]
 * When using a system-wide proxy, it uses the proxy interface
 * [1] https://developer.mozilla.org/docs/Web/API/RTCIceCandidate
 * [2] https://wiki.mozilla.org/Media/WebRTC/Privacy ***/
user_pref("media.peerconnection.ice.default_address_only", true);
/* 2004: force exclusion of private IPs from ICE candidates [FF51+]
 * [SETUP-HARDEN] This will protect your private IP even in TRUSTED scenarios after you
 * grant device access, but often results in breakage on video-conferencing platforms ***/
   // user_pref("media.peerconnection.ice.no_host", true);
/* 2020: disable GMP (Gecko Media Plugins)
 * [1] https://wiki.mozilla.org/GeckoMediaPlugins ***/
   // user_pref("media.gmp-provider.enabled", false);

/*** [SECTION 2400]: DOM (DOCUMENT OBJECT MODEL) ***/
user_pref("_user.js.parrot", "2400 syntax error: the parrot's kicked the bucket!");
/* 2402: prevent scripts from moving and resizing open windows ***/
user_pref("dom.disable_window_move_resize", true);

/*** [SECTION 2600]: MISCELLANEOUS ***/
user_pref("_user.js.parrot", "2600 syntax error: the parrot's run down the curtain!");
/* 2603: remove temp files opened from non-PB windows with an external application
 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=302433,1738574 ***/
user_pref("browser.download.start_downloads_in_tmp_dir", true); // [FF102+]
user_pref("browser.helperApps.deleteTempFileOnExit", true);
/* 2606: disable UITour backend so there is no chance that a remote page can use it ***/
user_pref("browser.uitour.enabled", false);
   // user_pref("browser.uitour.url", ""); // Defense-in-depth
/* 2608: reset remote debugging to disabled
 * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/16222 ***/
user_pref("devtools.debugger.remote-enabled", false); // [DEFAULT: false]
/* 2615: disable websites overriding Firefox's keyboard shortcuts [FF58+]
 * 0 (default) or 1=allow, 2=block
 * [SETTING] to add site exceptions: Ctrl+I>Permissions>Override Keyboard Shortcuts ***/
   // user_pref("permissions.default.shortcuts", 2);
/* 2616: remove special permissions for certain mozilla domains [FF35+]
 * [1] resource://app/defaults/permissions ***/
user_pref("permissions.manager.defaultsUrl", "");
/* 2619: use Punycode in Internationalized Domain Names to eliminate possible spoofing
 * [SETUP-WEB] Might be undesirable for non-latin alphabet users since legitimate IDN's are also punycoded
 * [TEST] https://www.xn--80ak6aa92e.com/ (www.apple.com)
 * [1] https://wiki.mozilla.org/IDN_Display_Algorithm
 * [2] https://en.wikipedia.org/wiki/IDN_homograph_attack
 * [3] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=punycode+firefox
 * [4] https://www.xudongz.com/blog/2017/idn-phishing/ ***/
user_pref("network.IDN_show_punycode", true);
/* 2620: enforce PDFJS, disable PDFJS scripting
 * This setting controls if the option "Display in Firefox" is available in the setting below
 *   and by effect controls whether PDFs are handled in-browser or externally ("Ask" or "Open With")
 * [WHY] pdfjs is lightweight, open source, and secure: the last exploit was June 2015 [1]
 *   It doesn't break "state separation" of browser content (by not sharing with OS, independent apps).
 *   It maintains disk avoidance and application data isolation. It's convenient. You can still save to disk.
 * [NOTE] JS can still force a pdf to open in-browser by bundling its own code
 * [SETUP-CHROME] You may prefer a different pdf reader for security/workflow reasons
 * [SETTING] General>Applications>Portable Document Format (PDF)
 * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=pdf.js+firefox ***/
user_pref("pdfjs.disabled", false); // [DEFAULT: false]
user_pref("pdfjs.enableScripting", false); // [FF86+]
/* 2624: disable middle click on new tab button opening URLs or searches using clipboard [FF115+] ***/
user_pref("browser.tabs.searchclipboardfor.middleclick", false); // [DEFAULT: false NON-LINUX]
/* 2630: disable content analysis by DLP (Data Loss Prevention) agents
 * DLP agents are background processes on managed computers that allow enterprises to monitor locally running
 * applications for data exfiltration events, which they can allow/block based on customer defined DLP policies.
 * 0=Block all requests, 1=Warn on all requests (which lets the user decide), 2=Allow all requests
 * [1] https://github.com/chromium/content_analysis_sdk ***/
user_pref("browser.contentanalysis.enabled", false); // [FF121+] [DEFAULT: false]
user_pref("browser.contentanalysis.default_result", 0); // [FF127+] [DEFAULT: 0]
/* 2635: disable referrer and storage access for resources injected by content scripts [FF139+] ***/
   // user_pref("privacy.antitracking.isolateContentScriptResources", true);
/* 2640: disable CSP Level 2 Reporting [FF140+] ***/
user_pref("security.csp.reporting.enabled", false);

/** DOWNLOADS ***/
/* 2651: enable user interaction for security by always asking where to download
 * [SETUP-CHROME] On Android this blocks longtapping and saving images
 * [SETTING] General>Downloads>Always ask you where to save files ***/
user_pref("browser.download.useDownloadDir", false);
/* 2652: disable downloads panel opening on every download [FF96+] ***/
user_pref("browser.download.alwaysOpenPanel", false);
/* 2653: disable adding downloads to the system's "recent documents" list ***/
user_pref("browser.download.manager.addToRecentDocs", false);
/* 2654: enable user interaction for security by always asking how to handle new mimetypes [FF101+]
 * [SETTING] General>Files and Applications>What should Firefox do with other files ***/
user_pref("browser.download.always_ask_before_handling_new_types", true);

/** EXTENSIONS ***/
/* 2660: limit allowed extension directories
 * 1=profile, 2=user, 4=application, 8=system, 16=temporary, 31=all
 * The pref value represents the sum: e.g. 5 would be profile and application directories
 * [SETUP-CHROME] Breaks usage of files which are installed outside allowed directories
 * [1] https://archive.is/DYjAM ***/
user_pref("extensions.enabledScopes", 5); // [HIDDEN PREF]
   // user_pref("extensions.autoDisableScopes", 15); // [DEFAULT: 15]
/* 2661: disable bypassing 3rd party extension install prompts [FF82+]
 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1659530,1681331 ***/
user_pref("extensions.postDownloadThirdPartyPrompt", false);
/* 2662: disable webextension restrictions on certain mozilla domains (you also need 4503) [FF60+]
 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
   // user_pref("extensions.webextensions.restrictedDomains", "");

/*** [SECTION 2700]: ETP (ENHANCED TRACKING PROTECTION) ***/
user_pref("_user.js.parrot", "2700 syntax error: the parrot's joined the bleedin' choir invisible!");
/* 2701: enable ETP Strict Mode [FF86+]
 * ETP Strict Mode enables Total Cookie Protection (TCP)
 * [NOTE] Adding site exceptions disables all ETP protections for that site and increases the risk of
 * cross-site state tracking e.g. exceptions for SiteA and SiteB means PartyC on both sites is shared
 * [1] https://blog.mozilla.org/security/2021/02/23/total-cookie-protection/
 * [SETTING] to add site exceptions: Urlbar>ETP Shield
 * [SETTING] to manage site exceptions: Options>Privacy & Security>Enhanced Tracking Protection>Manage Exceptions ***/
user_pref("browser.contentblocking.category", "strict"); // [HIDDEN PREF]
/* 2702: disable ETP web compat features [FF93+]
 * [SETUP-HARDEN] Includes skip lists, heuristics (SmartBlock) and automatic grants
 * Opener and redirect heuristics are granted for 30 days, see [3]
 * [1] https://blog.mozilla.org/security/2021/07/13/smartblock-v2/
 * [2] https://hg.mozilla.org/mozilla-central/rev/e5483fd469ab#l4.12
 * [3] https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning#storage_access_heuristics ***/
   // user_pref("privacy.antitracking.enableWebcompat", false);

/*** [SECTION 2800]: SHUTDOWN & SANITIZING
   We enable sanitizeOnShutdown to help prevent 1st party website tracking across sessions.
   We consider history/downloads, which are not accessible to websites, as orthogonal and exempt these

   [SETUP-HARDEN] to clear all history/downloads on close, add the appropriate overrides from 2800's
***/
user_pref("_user.js.parrot", "2800 syntax error: the parrot's bleedin' demised!");
/* 2810: enable Firefox to clear items on shutdown
 * [NOTE] In FF129+ clearing "siteSettings" on shutdown (2811+), or manually via site data (2820+) and
 * via history (2830), will no longer remove sanitize on shutdown "cookie and site data" site exceptions (2815)
 * [SETTING] Privacy & Security>History>Custom Settings>Clear history when Firefox closes | Settings ***/
user_pref("privacy.sanitize.sanitizeOnShutdown", true);

/** SANITIZE ON SHUTDOWN: IGNORES "ALLOW" SITE EXCEPTIONS ***/
/* 2811: set/enforce clearOnShutdown items (if 2810 is true) [SETUP-CHROME] [FF128+] ***/
user_pref("privacy.clearOnShutdown_v2.cache", true); // [DEFAULT: true]
user_pref("privacy.clearOnShutdown_v2.historyFormDataAndDownloads", false); // [DEFAULT: true]
   // user_pref("privacy.clearOnShutdown_v2.siteSettings", false); // [DEFAULT: false]
/* 2812: set/enforce clearOnShutdown items [FF136+] ***/
user_pref("privacy.clearOnShutdown_v2.browsingHistoryAndDownloads", false); // [DEFAULT: true]
user_pref("privacy.clearOnShutdown_v2.downloads", false); // [HIDDEN]
user_pref("privacy.clearOnShutdown_v2.formdata", true);
/* 2813: set Session Restore to clear on shutdown (if 2810 is true) [FF34+]
 * [NOTE] Not needed if Session Restore is not used (0102) or it is already cleared with history (2811+)
 * [NOTE] If true, this prevents resuming from crashes (also see 5008) ***/
   // user_pref("privacy.clearOnShutdown.openWindows", true);

/** SANITIZE ON SHUTDOWN: RESPECTS "ALLOW" SITE EXCEPTIONS ***/
/* 2815: set "Cookies" and "Site Data" to clear on shutdown (if 2810 is true) [SETUP-CHROME] [FF128+]
 * [NOTE] Exceptions: For cross-domain logins, add exceptions for both sites
 * e.g. https://www.youtube.com (site) + https://accounts.google.com (single sign on)
 * [WARNING] Be selective with what sites you "Allow", as they also disable partitioning (1767271)
 * [SETTING] to add site exceptions: Ctrl+I>Permissions>Cookies>Allow (when on the website in question)
 * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/
user_pref("privacy.clearOnShutdown_v2.cookiesAndStorage", true);

/** SANITIZE SITE DATA: IGNORES "ALLOW" SITE EXCEPTIONS ***/
/* 2820: set manual "Clear Data" items [SETUP-CHROME] [FF128+]
 * Firefox remembers your last choices. This will reset them when you start Firefox
 * [SETTING] Privacy & Security>Browser Privacy>Cookies and Site Data>Clear Data ***/
user_pref("privacy.clearSiteData.cache", true);
user_pref("privacy.clearSiteData.cookiesAndStorage", false); // keep false until it respects "allow" site exceptions
user_pref("privacy.clearSiteData.historyFormDataAndDownloads", false);
   // user_pref("privacy.clearSiteData.siteSettings", false);
/* 2821: set manual "Clear Data" items [FF136+] ***/
user_pref("privacy.clearSiteData.browsingHistoryAndDownloads", false);
user_pref("privacy.clearSiteData.formdata", true);

/** SANITIZE HISTORY: IGNORES "ALLOW" SITE EXCEPTIONS ***/
/* 2830: set manual "Clear History" items, also via Ctrl-Shift-Del [SETUP-CHROME] [FF128+]
 * Firefox remembers your last choices. This will reset them when you start Firefox
 * [SETTING] Privacy & Security>History>Custom Settings>Clear History ***/
user_pref("privacy.clearHistory.cache", true); // [DEFAULT: true]
user_pref("privacy.clearHistory.cookiesAndStorage", false);
user_pref("privacy.clearHistory.historyFormDataAndDownloads", false); // [DEFAULT: true]
   // user_pref("privacy.clearHistory.siteSettings", false); // [DEFAULT: false]
/* 2831: set manual "Clear History" items [FF136+] ***/
user_pref("privacy.clearHistory.browsingHistoryAndDownloads", false); // [DEFAULT: true]
user_pref("privacy.clearHistory.formdata", true);

/** SANITIZE MANUAL: TIMERANGE ***/
/* 2840: set "Time range to clear" for "Clear Data" (2820+) and "Clear History" (2830+)
 * Firefox remembers your last choice. This will reset the value when you start Firefox
 * 0=everything, 1=last hour, 2=last two hours, 3=last four hours, 4=today
 * [NOTE] Values 5 (last 5 minutes) and 6 (last 24 hours) are not listed in the dropdown,
 * which will display a blank value, and are not guaranteed to work ***/
user_pref("privacy.sanitize.timeSpan", 0);

/*** [SECTION 4000]: FPP (fingerprintingProtection)
   RFP (4501) overrides FPP

   In FF118+ FPP is on by default in private windows (4001) and in FF119+ is controlled
   by ETP (2701). FPP will also use Remote Services in future to relax FPP protections
   on a per site basis for compatibility (4004).

   https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargetsDefault.inc

   [NOTE] RFPTargets + granular overrides are somewhat experimental and may produce unexpected results
   - e.g. FrameRate can only be controlled per process, not per origin

   1826408 - restrict to system fonts (kBaseFonts + kLangPackFonts) (Windows, Mac, some Linux) (FF119+)
      1928705: android (FF134+)
      https://searchfox.org/mozilla-central/search?path=StandardFonts*.inc
   1858181 - subtly randomize canvas per eTLD+1, per session and per window-mode (FF120+)
   1887682 - use fdlibm's sin, cos and tan in jsmath (FF134+)
   1954194 - available screen resolution: return a fixed offset height from screen per platform when not full screen (FF143+)
   1984333 - hardwareConcurrency: less than 8 return 4 else return 8 (FF143+)
   1977836 - maxTouchPoints: return multi-touch as 5 (FF143+)
   1917607 - subtly randomize WebGL's readPixels (FF145+)
***/
user_pref("_user.js.parrot", "4000 syntax error: the parrot's bereft of life!");
/* 4001: enable FPP in PB mode [FF114+]
 * [NOTE] In FF119+, FPP for all modes (7016) is enabled with ETP Strict (2701) ***/
   // user_pref("privacy.fingerprintingProtection.pbmode", true); // [DEFAULT: true]
/* 4002: set global FPP overrides [FF114+]
 * uses "RFPTargets" [1] which despite the name these are not used by RFP
 * e.g. "+AllTargets,-CSSPrefersColorScheme,-JSDateTimeUTC" = all targets but allow prefers-color-scheme and do not change timezone
 * e.g. "-AllTargets,+CanvasRandomization,+JSDateTimeUTC" = no targets but do use FPP canvas and change timezone
 * [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults
 * [1] https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargets.inc ***/
   // user_pref("privacy.fingerprintingProtection.overrides", "");
/* 4003: set granular FPP overrides
 * JSON format: e.g."[{\"firstPartyDomain\": \"netflix.com\", \"overrides\": \"-CanvasRandomization,-FrameRate,\"}]"
 * [NOTE] Not supported by arkenfox. Either use RFP or FPP at defaults ***/
   // user_pref("privacy.fingerprintingProtection.granularOverrides", "");
/* 4004: disable remote FPP overrides [FF127+] ***/
   // user_pref("privacy.fingerprintingProtection.remoteOverrides.enabled", false);

/*** [SECTION 4500]: OPTIONAL RFP (resistFingerprinting)
   RFP overrides FPP (4000)

   FF128+ Arkenfox by default uses FPP (automatically enabled with ETP Strict). For most people
   this is all you need. To use RFP instead, add RFP (4501) to your overrides, and optionally
   add letterboxing (4504), spoof_english (4506), and WebGL (4520).

   RFP is an all-or-nothing buy in: you cannot pick and choose what parts you want

   [WARNING] DO NOT USE extensions to alter RFP protected metrics

    418986 - limit window.screen & CSS media queries (FF41)
 FF56
   1333651 - spoof User Agent & Navigator API
      JS: spoofed as Windows 10, OS X 10.15, Android 10, or Linux
      HTTP Header: spoofed as Windows 10 or Android 10 until FF136 then matches JS spoof
   1369319 - disable device sensor API
   1369357 - disable site specific zoom
   1337161 - hide gamepads from content
   1372072 - spoof network information API as "unknown" when dom.netinfo.enabled = true
   1333641 - reduce fingerprinting in WebSpeech API
 FF57
   1369309 - spoof media statistics
   1382499 - reduce screen co-ordinate fingerprinting in Touch API
   1217290 & 1409677 - enable some fingerprinting resistance for WebGL
   1354633 - limit MediaError.message to a whitelist
 FF58+
   1372073 - spoof/block fingerprinting in MediaDevices API (FF59)
      Spoof: enumerate devices as one "Internal Camera" and one "Internal Microphone"
      Block: suppresses the ondevicechange event
   1039069 - warn when language prefs are not set to "en*" (FF59)
   1222285 & 1433592 - spoof keyboard events and suppress keyboard modifier events (FF59)
      Spoofing mimics the content language of the document. Currently it only supports en-US.
      Modifier events suppressed are SHIFT and both ALT keys. Chrome is not affected.
   1459089 - disable OS locale in HTTP Accept-Language headers (ANDROID) (FF62)
   1479239 - return "no-preference" with prefers-reduced-motion (FF63)
   1363508 & 1826051 & 1957658 - spoof/suppress Pointer Events, spoof maxTouchPoints (FF64, FF132, FF143, ESR140.2)
       FF64: maxTouchPoints: 0 = desktop
      FF132: maxTouchPoints: 0 = mac | 10 = windows, linux, mobile
      FF143/140.2: maxTouchPoints: 0 = mac, linux | 10 = windows | 5 = mobile
   1492766 - spoof pointerEvent.pointerid (FF65)
   1485266 - disable exposure of system colors to CSS or canvas (FF67)
   1494034 - return "light" with prefers-color-scheme (FF67)
   1564422 - spoof audioContext outputLatency (FF70)
   1595823 - return audioContext sampleRate as 44100 (FF72)
   1607316 - spoof pointer as coarse and hover as none (ANDROID) (FF74)
   1621433 - randomize canvas (previously FF58+ returned an all-white canvas) (FF78)
   1506364 - return "no-preference" with prefers-contrast (FF80)
   1653987 - limit font visibility to bundled and "Base Fonts" (Windows, Mac, some Linux) (FF80)
   1461454 - spoof smooth=true and powerEfficient=false for supported media in MediaCapabilities (FF82)
    531915 - use fdlibm's sin, cos and tan in jsmath (FF93, ESR91.1)
   1692609 - reduce JS timing precision to 16.67ms (previously FF55+ was 100ms) (FF102)
   1422237 - return "srgb" with color-gamut (FF110)
   1794628 - return "none" with inverted-colors (FF114)
   1787790 - normalize system fonts (FF128)
   1835987 - spoof timezone as Atlantic/Reykjavik (previously FF55+ was UTC) (FF128)
   1656377 - spoof pointerEvents azimuthAngle and altitudeAngle (FF131)
   1834307 - always use smooth scrolling (FF132)
   1918202 - spoof screen orientation based on spoofed screen size and platform (FF132)
      previously FF50+ it always returned landscape-primary and an angle of 0
   1390465 - load all subtitles in WebVTT (Video Text Tracks) (FF133)
   1873382 - make spoofed devicePixelRatio and CSS media queries match (FF133)
      previously FF41+ devicePixelRatio was hardcoded as 1 and FF127+ as 2
      previously FF41+ CSS media queries were spoofed as zoom level at a devicePixelRatio of 1
   1955425 - return 128 for WebGPU subgroupMaxSize (FF138)
   1966860 - spoof WebGL debug renderer info (FF140)
      previously FF60+ it was disabled
   1781277 - return 10GiB for storage estimate until persistent-storage granted (FF142, ESR140.1)
   1972600 - spoof network connection for HTMLMediaElement preload (FF142, ESR140.1)
   1975851 - return true for navigator.onLine (FF142, ESR140.1)
   1973265 - disable WebCodecs API (FF142)
   1984333 - spoof navigator.hardwareConcurrency as 4 except mac return 8 (FF143+)
       previously FF55+ it returned 2
***/
user_pref("_user.js.parrot", "4500 syntax error: the parrot's popped 'is clogs");
/* 4501: enable RFP
 * [NOTE] pbmode applies if true and the original pref is false
 * [SETUP-WEB] RFP can cause some website breakage: mainly canvas, use a canvas site exception via the urlbar.
 * RFP also has a few side effects: mainly that timezone is GMT, and websites will prefer light theme ***/
   // user_pref("privacy.resistFingerprinting", true); // [FF41+]
   // user_pref("privacy.resistFingerprinting.pbmode", true); // [FF114+]
/* 4502: set RFP new window size max rounded values [FF55+]
 * [SETUP-CHROME] sizes round down in hundreds: width to 200s and height to 100s, to fit your screen
 * [1] https://bugzilla.mozilla.org/1330882 ***/
user_pref("privacy.window.maxInnerWidth", 1600);
user_pref("privacy.window.maxInnerHeight", 900);
/* 4503: disable mozAddonManager Web API [FF57+]
 * [NOTE] To allow extensions to work on AMO, you also need 2662
 * [1] https://bugzilla.mozilla.org/buglist.cgi?bug_id=1384330,1406795,1415644,1453988 ***/
user_pref("privacy.resistFingerprinting.block_mozAddonManager", true);
/* 4504: enable letterboxing [FF67+]
 * Dynamically resizes the inner window by applying margins in stepped ranges [2]
 * If you use the dimension pref, then it will only apply those resolutions.
 * The format is "width1xheight1, width2xheight2, ..." (e.g. "800x600, 1000x1000")
 * [SETUP-WEB] This is independent of RFP (4501). If you're using RFP, but dislike the
 * margins, then don't enable this pref, keeping in mind that it is effectively fingerprintable
 * [WARNING] DO NOT USE: the dimension pref is only meant for testing
 * [1] https://bugzilla.mozilla.org/1407366
 * [2] https://hg.mozilla.org/mozilla-central/rev/7211cb4f58ff#l5.13 ***/
   // user_pref("privacy.resistFingerprinting.letterboxing", true); // [HIDDEN PREF]
   // user_pref("privacy.resistFingerprinting.letterboxing.dimensions", ""); // [HIDDEN PREF]
/* 4505: disable RFP by domain [FF91+]
 * [NOTE]: The pref takes comma separated values: e.g. "*domain1.tld, *domain2.tld"
 * Working domain examples: "arkenfox.github.io", "*github.io"
 * Non-working domain examples: "https://arkenfox.github.io", "github.io", "*arkenfox.github.io" ***/
   // user_pref("privacy.resistFingerprinting.exemptedDomains", "*.example.invalid");
/* 4506: disable RFP spoof english prompt [FF59+]
 * 0=prompt, 1=disabled, 2=enabled
 * [NOTE] When changing from value 2, preferred languages ('intl.accept_languages') is not reset.
 * [SETUP-WEB] when enabled, sets 'en-US, en' for displaying pages and 'en-US' as locale.
 * [SETTING] General>Language>Choose your preferred language for displaying pages>Choose>Request English... ***/
user_pref("privacy.spoof_english", 1);
/* 4507: skip browser.startup.blankWindow if RFP is used [FF136+] ***/
   // user_pref("privacy.resistFingerprinting.skipEarlyBlankFirstPaint", true); // [DEFAULT: true]
/* 4510: enforce Contrast Control off [FF138+]
 * 0=automatic, 1=off, 2=custom
 * [SETTING] General>Language and Appearance>Contrast Control ***/
   // user_pref("browser.display.document_color_use", 1); // [DEFAULT: 1 NON-WINDOWS]
/* 4511: disable using system accent colors ***/
user_pref("widget.non-native-theme.use-theme-accent", false); // [DEFAULT: false WINDOWS]
/* 4512: enforce links targeting new windows to open in a new tab instead
 * 1=most recent window or tab, 2=new window, 3=new tab
 * Stops malicious window sizes and some screen resolution leaks.
 * You can still right-click a link and open in a new window
 * [SETTING] General>Tabs>Open links in tabs instead of new windows
 * [1] https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/9881 ***/
user_pref("browser.link.open_newwindow", 3); // [DEFAULT: 3]
/* 4513: set all open window methods to abide by "browser.link.open_newwindow" (4512)
 * [1] https://searchfox.org/mozilla-central/source/dom/tests/browser/browser_test_new_window_from_content.js ***/
user_pref("browser.link.open_newwindow.restriction", 0);
/* 4520: disable WebGL (Web Graphics Library) ***/
   // user_pref("webgl.disabled", true);

/*** [SECTION 5000]: OPTIONAL OPSEC
   Disk avoidance, application data isolation, eyeballs...
***/
user_pref("_user.js.parrot", "5000 syntax error: the parrot's taken 'is last bow");
/* 5001: start Firefox in PB (Private Browsing) mode
 * [NOTE] In this mode all windows are "private windows" and the PB mode icon is not displayed
 * [NOTE] The P in PB mode can be misleading: it means no "persistent" disk state such as history,
 * caches, searches, cookies, localStorage, IndexedDB etc (which you can achieve in normal mode).
 * In fact, PB mode limits or removes the ability to control some of these, and you need to quit
 * Firefox to clear them. PB is best used as a one off window (Menu>New Private Window) to provide
 * a temporary self-contained new session. Close all private windows to clear the PB session.
 * [SETTING] Privacy & Security>History>Custom Settings>Always use private browsing mode
 * [1] https://wiki.mozilla.org/Private_Browsing
 * [2] https://support.mozilla.org/kb/common-myths-about-private-browsing ***/
   // user_pref("browser.privatebrowsing.autostart", true);
/* 5002: disable memory cache
 * capacity: -1=determine dynamically (default), 0=none, n=memory capacity in kibibytes ***/
   // user_pref("browser.cache.memory.enable", false);
   // user_pref("browser.cache.memory.capacity", 0);
/* 5003: disable saving passwords
 * [NOTE] This does not clear any passwords already saved
 * [SETTING] Privacy & Security>Logins and Passwords>Ask to save logins and passwords for websites ***/
   // user_pref("signon.rememberSignons", false);
/* 5004: disable permissions manager from writing to disk [FF41+] [RESTART]
 * [NOTE] This means any permission changes are session only
 * [1] https://bugzilla.mozilla.org/967812 ***/
   // user_pref("permissions.memory_only", true); // [HIDDEN PREF]
/* 5005: disable intermediate certificate caching [FF41+] [RESTART]
 * [NOTE] This affects login/cert/key dbs. The effect is all credentials are session-only.
 * Saved logins and passwords are not available. Reset the pref and restart to return them ***/
   // user_pref("security.nocertdb", true);
/* 5006: disable favicons in history and bookmarks
 * [NOTE] Stored as data blobs in favicons.sqlite, these don't reveal anything that your
 * actual history (and bookmarks) already do. Your history is more detailed, so
 * control that instead; e.g. disable history, clear history on exit, use PB mode
 * [NOTE] favicons.sqlite is sanitized on Firefox close ***/
   // user_pref("browser.chrome.site_icons", false);
/* 5007: exclude "Undo Closed Tabs" in Session Restore ***/
   // user_pref("browser.sessionstore.max_tabs_undo", 0);
/* 5008: disable resuming session from crash
 * [TEST] about:crashparent ***/
   // user_pref("browser.sessionstore.resume_from_crash", false);
/* 5009: disable "open with" in download dialog [FF50+]
 * Application data isolation [1]
 * [1] https://bugzilla.mozilla.org/1281959 ***/
   // user_pref("browser.download.forbid_open_with", true);
/* 5010: disable location bar suggestion types
 * [SETTING] Search>Address Bar>When using the address bar, suggest ***/
   // user_pref("browser.urlbar.suggest.history", false);
   // user_pref("browser.urlbar.suggest.bookmark", false);
   // user_pref("browser.urlbar.suggest.openpage", false);
   // user_pref("browser.urlbar.suggest.topsites", false); // [FF78+]
/* 5011: disable location bar dropdown
 * This value controls the total number of entries to appear in the location bar dropdown ***/
   // user_pref("browser.urlbar.maxRichResults", 0);
/* 5012: disable location bar autofill
 * [1] https://support.mozilla.org/kb/address-bar-autocomplete-firefox#w_url-autocomplete ***/
   // user_pref("browser.urlbar.autoFill", false);
/* 5013: disable browsing and download history
 * [NOTE] We also clear history and downloads on exit (2811+)
 * [SETTING] Privacy & Security>History>Custom Settings>Remember browsing and download history ***/
   // user_pref("places.history.enabled", false);
/* 5014: disable Windows jumplist [WINDOWS] ***/
   // user_pref("browser.taskbar.lists.enabled", false);
   // user_pref("browser.taskbar.lists.frequent.enabled", false);
   // user_pref("browser.taskbar.lists.recent.enabled", false);
   // user_pref("browser.taskbar.lists.tasks.enabled", false);
/* 5016: discourage downloading to desktop
 * 0=desktop, 1=downloads (default), 2=custom
 * [SETTING] To set your custom default "downloads": General>Downloads>Save files to ***/
   // user_pref("browser.download.folderList", 2);
/* 5017: disable Form Autofill
 * If .supportedCountries includes your region (browser.search.region) and .supported
 * is "detect" (default), then the UI will show. Stored data is not secure, uses JSON
 * [SETTING] Privacy & Security>Forms and Autofill>Autofill addresses
 * [1] https://wiki.mozilla.org/Firefox/Features/Form_Autofill ***/
   // user_pref("extensions.formautofill.addresses.enabled", false); // [FF55+]
   // user_pref("extensions.formautofill.creditCards.enabled", false); // [FF56+]
/* 5018: limit events that can cause a pop-up ***/
   // user_pref("dom.popup_allowed_events", "click dblclick mousedown pointerdown");
/* 5019: disable page thumbnail collection ***/
   // user_pref("browser.pagethumbnails.capturing_disabled", true); // [HIDDEN PREF]
/* 5020: disable Windows native notifications and use app notications instead [FF111+] [WINDOWS] ***/
   // user_pref("alerts.useSystemBackend.windows.notificationserver.enabled", false);
/* 5021: disable location bar using search
 * Don't leak URL typos to a search engine, give an error message instead
 * Examples: "secretplace,com", "secretplace/com", "secretplace com", "secret place.com"
 * [NOTE] This does not affect explicit user action such as using search buttons in the
 * dropdown, or using keyword search shortcuts you configure in options (e.g. "d" for DuckDuckGo) ***/
   // user_pref("keyword.enabled", false);

/*** [SECTION 5500]: OPTIONAL HARDENING
   Not recommended. Overriding these can cause breakage and performance issues,
   they are mostly fingerprintable, and the threat model is practically nonexistent
***/
user_pref("_user.js.parrot", "5500 syntax error: this is an ex-parrot!");
/* 5501: disable MathML (Mathematical Markup Language) [FF51+]
 * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=mathml ***/
   // user_pref("mathml.disabled", true); // 1173199
/* 5502: disable in-content SVG (Scalable Vector Graphics) [FF53+]
 * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+svg ***/
   // user_pref("svg.disabled", true); // 1216893
/* 5503: disable graphite
 * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+graphite
 * [2] https://en.wikipedia.org/wiki/Graphite_(SIL) ***/
   // user_pref("gfx.font_rendering.graphite.enabled", false);
/* 5504: disable asm.js [FF22+]
 * [1] http://asmjs.org/
 * [2] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=asm.js
 * [3] https://rh0dev.github.io/blog/2017/the-return-of-the-jit/ ***/
   // user_pref("javascript.options.asmjs", false);
/* 5505: disable Ion and baseline JIT to harden against JS exploits [RESTART]
 * [NOTE] When both Ion and JIT are disabled, and trustedprincipals
 * is enabled, then Ion can still be used by extensions (1599226)
 * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=firefox+jit
 * [2] https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ ***/
   // user_pref("javascript.options.ion", false);
   // user_pref("javascript.options.baselinejit", false);
   // user_pref("javascript.options.jit_trustedprincipals", true); // [FF75+] [HIDDEN PREF]
/* 5506: disable WebAssembly [FF52+]
 * Vulnerabilities [1] have increasingly been found, including those known and fixed
 * in native programs years ago [2]. WASM has powerful low-level access, making
 * certain attacks (brute-force) and vulnerabilities more possible
 * [STATS] ~0.2% of websites, about half of which are for cryptomining / malvertising [2][3]
 * [1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wasm
 * [2] https://spectrum.ieee.org/tech-talk/telecom/security/more-worries-over-the-security-of-web-assembly
 * [3] https://www.zdnet.com/article/half-of-the-websites-using-webassembly-use-it-for-malicious-purposes ***/
   // user_pref("javascript.options.wasm", false);
/* 5507: disable rendering of SVG OpenType fonts ***/
   // user_pref("gfx.font_rendering.opentype_svg.enabled", false);
/* 5508: disable all DRM (Digital Rights Management) content (EME: Encryption Media Extension)
 * Optionally hide the UI setting which also disables the DRM prompt
 * [SETTING] General>DRM Content>Play DRM-controlled content
 * [TEST] https://bitmovin.com/demos/drm
 * [1] https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next ***/
   // user_pref("media.eme.enabled", false);
   // user_pref("browser.eme.ui.enabled", false);
/* 5509: disable IPv6 if using a VPN
 * This is an application level fallback. Disabling IPv6 is best done at an OS/network
 * level, and/or configured properly in system wide VPN setups.
 * [NOTE] PHP defaults to IPv6 with "localhost". Use "php -S 127.0.0.1:PORT"
 * [SETUP-WEB] PR_CONNECT_RESET_ERROR
 * [TEST] https://ipleak.org/
 * [1] https://www.internetsociety.org/tag/ipv6-security/ (Myths 2,4,5,6) ***/
   // user_pref("network.dns.disableIPv6", true);
/* 5510: control when to send a cross-origin referer
 * 0=always (default), 1=only if base domains match, 2=only if hosts match
 * [NOTE] Will cause breakage: older modems/routers and some sites e.g banks, vimeo, icloud, instagram ***/
   // user_pref("network.http.referer.XOriginPolicy", 2);
/* 5511: set DoH bootstrap address [FF89+]
 * Firefox uses the system DNS to initially resolve the IP address of your DoH server.
 * When set to a valid, working value that matches your "network.trr.uri" (0712) Firefox
 * won't use the system DNS. If the IP doesn't match then DoH won't work ***/
   // user_pref("network.trr.bootstrapAddr", "10.0.0.1"); // [HIDDEN PREF]

/*** [SECTION 6000]: DON'T TOUCH ***/
user_pref("_user.js.parrot", "6000 syntax error: the parrot's 'istory!");
/* 6001: enforce Firefox blocklist
 * [WHY] It includes updates for "revoked certificates"
 * [1] https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/ ***/
user_pref("extensions.blocklist.enabled", true); // [DEFAULT: true]
/* 6002: enforce no referer spoofing
 * [WHY] Spoofing can affect CSRF (Cross-Site Request Forgery) protections ***/
user_pref("network.http.referer.spoofSource", false); // [DEFAULT: false]
/* 6004: enforce a security delay on some confirmation dialogs such as install, open/save
 * [1] https://www.squarefree.com/2004/07/01/race-conditions-in-security-dialogs/ ***/
user_pref("security.dialog_enable_delay", 1000); // [DEFAULT: 1000]
/* 6008: enforce no First Party Isolation [FF51+]
 * [WARNING] Replaced with network partitioning (FF85+) and TCP (2701), and enabling FPI
 * disables those. FPI is no longer maintained except at Tor Project for Tor Browser's config ***/
user_pref("privacy.firstparty.isolate", false); // [DEFAULT: false]
/* 6009: enforce SmartBlock shims (about:compat) [FF81+]
 * [1] https://blog.mozilla.org/security/2021/03/23/introducing-smartblock/ ***/
user_pref("extensions.webcompat.enable_shims", true); // [HIDDEN PREF] [DEFAULT: true]
/* 6010: enforce no TLS 1.0/1.1 downgrades
 * [TEST] https://tls-v1-1.badssl.com:1010/ ***/
user_pref("security.tls.version.enable-deprecated", false); // [DEFAULT: false]
/* 6011: enforce disabling of Web Compatibility Reporter [FF56+]
 * Web Compatibility Reporter adds a "Report Site Issue" button to send data to Mozilla
 * [WHY] To prevent wasting Mozilla's time with a custom setup ***/
user_pref("extensions.webcompat-reporter.enabled", false); // [DEFAULT: false]
/* 6012: enforce Quarantined Domains [FF115+]
 * [WHY] https://support.mozilla.org/kb/quarantined-domains ***/
user_pref("extensions.quarantinedDomains.enabled", true); // [DEFAULT: true]
/* 6050: prefsCleaner: reset previously active items removed from arkenfox FF128+ ***/
   // user_pref("privacy.clearOnShutdown.cache", "");
   // user_pref("privacy.clearOnShutdown.cookies", "");
   // user_pref("privacy.clearOnShutdown.downloads", "");
   // user_pref("privacy.clearOnShutdown.formdata", "");
   // user_pref("privacy.clearOnShutdown.history", "");
   // user_pref("privacy.clearOnShutdown.offlineApps", "");
   // user_pref("privacy.clearOnShutdown.sessions", "");
   // user_pref("privacy.cpd.cache", "");
   // user_pref("privacy.cpd.cookies", "");
   // user_pref("privacy.cpd.formdata", "");
   // user_pref("privacy.cpd.history", "");
   // user_pref("privacy.cpd.offlineApps", "");
   // user_pref("privacy.cpd.sessions", "");
/* 6051: prefsCleaner: reset previously active items removed from arkenfox FF140+ ***/
   // user_pref("browser.display.use_system_colors", "");

/*** [SECTION 7000]: DON'T BOTHER ***/
user_pref("_user.js.parrot", "7000 syntax error: the parrot's pushing up daisies!");
/* 7001: disable APIs
 * Location-Aware Browsing, Full Screen
 * [WHY] The API state is easily fingerprintable.
 * Geo is behind a prompt (7002). Full screen requires user interaction ***/
   // user_pref("geo.enabled", false);
   // user_pref("full-screen-api.enabled", false);
/* 7002: set default permissions
 * Location, Camera, Microphone, Notifications [FF58+] Virtual Reality [FF73+]
 * 0=always ask (default), 1=allow, 2=block
 * [WHY] These are fingerprintable via Permissions API, except VR. Just add site
 * exceptions as allow/block for frequently visited/annoying sites: i.e. not global
 * [SETTING] to add site exceptions: Ctrl+I>Permissions>
 * [SETTING] to manage site exceptions: Options>Privacy & Security>Permissions>Settings ***/
   // user_pref("permissions.default.geo", 0);
   // user_pref("permissions.default.camera", 0);
   // user_pref("permissions.default.microphone", 0);
   // user_pref("permissions.default.desktop-notification", 0);
   // user_pref("permissions.default.xr", 0); // Virtual Reality
/* 7003: disable non-modern cipher suites [1]
 * [WHY] Passive fingerprinting. Minimal/non-existent threat of downgrade attacks
 * [1] https://browserleaks.com/ssl ***/
   // user_pref("security.ssl3.ecdhe_ecdsa_aes_128_sha", false);
   // user_pref("security.ssl3.ecdhe_ecdsa_aes_256_sha", false);
   // user_pref("security.ssl3.ecdhe_rsa_aes_128_sha", false);
   // user_pref("security.ssl3.ecdhe_rsa_aes_256_sha", false);
   // user_pref("security.ssl3.rsa_aes_128_gcm_sha256", false); // no PFS
   // user_pref("security.ssl3.rsa_aes_256_gcm_sha384", false); // no PFS
   // user_pref("security.ssl3.rsa_aes_128_sha", false); // no PFS
   // user_pref("security.ssl3.rsa_aes_256_sha", false); // no PFS
/* 7004: control TLS versions
 * [WHY] Passive fingerprinting and security ***/
   // user_pref("security.tls.version.min", 3); // [DEFAULT: 3]
   // user_pref("security.tls.version.max", 4);
/* 7005: disable SSL session IDs [FF36+]
 * [WHY] Passive fingerprinting and perf costs. These are session-only
 * and isolated with network partitioning (FF85+) and/or containers ***/
   // user_pref("security.ssl.disable_session_identifiers", true);
/* 7007: referers
 * [WHY] Only cross-origin referers (1602, 5510) matter ***/
   // user_pref("network.http.sendRefererHeader", 2);
   // user_pref("network.http.referer.trimmingPolicy", 0);
/* 7008: set the default Referrer Policy [FF59+]
 * 0=no-referer, 1=same-origin, 2=strict-origin-when-cross-origin, 3=no-referrer-when-downgrade
 * [WHY] Defaults are fine. They can be overridden by a site-controlled Referrer Policy ***/
   // user_pref("network.http.referer.defaultPolicy", 2); // [DEFAULT: 2]
   // user_pref("network.http.referer.defaultPolicy.pbmode", 2); // [DEFAULT: 2]
/* 7010: disable HTTP Alternative Services [FF37+]
 * [WHY] Already isolated with network partitioning (FF85+) ***/
   // user_pref("network.http.altsvc.enabled", false);
/* 7011: disable website control over browser right-click context menu
 * [WHY] Just use Shift-Right-Click ***/
   // user_pref("dom.event.contextmenu.enabled", false);
/* 7012: disable icon fonts (glyphs) and local fallback rendering
 * [WHY] Breakage, font fallback is equivalency, also RFP
 * [1] https://bugzilla.mozilla.org/789788
 * [2] https://gitlab.torproject.org/legacy/trac/-/issues/8455 ***/
   // user_pref("gfx.downloadable_fonts.enabled", false); // [FF41+]
   // user_pref("gfx.downloadable_fonts.fallback_delay", -1);
/* 7013: disable Clipboard API
 * [WHY] Fingerprintable. Breakage. Cut/copy/paste require user
 * interaction, and paste is limited to focused editable fields ***/
   // user_pref("dom.event.clipboardevents.enabled", false);
/* 7014: disable System Add-on updates
 * [WHY] It can compromise security. System addons ship with prefs, use those ***/
   // user_pref("extensions.systemAddon.update.enabled", false); // [FF62+]
   // user_pref("extensions.systemAddon.update.url", ""); // [FF44+]
/* 7015: enable the DNT (Do Not Track) HTTP header
 * [WHY] DNT is enforced with Tracking Protection which is used in ETP Strict (2701) ***/
   // user_pref("privacy.donottrackheader.enabled", true);
/* 7016: customize ETP settings
 * [NOTE] FPP (fingerprintingProtection) is ignored when RFP (4501) is enabled
 * [WHY] Arkenfox only supports strict (2701) which sets these at runtime ***/
   // user_pref("network.cookie.cookieBehavior", 5); // [DEFAULT: 5]
   // user_pref("network.cookie.cookieBehavior.optInPartitioning", true); // [ETP FF132+]
   // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault", true);
   // user_pref("network.http.referer.disallowCrossSiteRelaxingDefault.top_navigation", true); // [FF100+]
   // user_pref("privacy.bounceTrackingProtection.mode", 1); // [FF131+] [ETP FF133+]
   // user_pref("privacy.fingerprintingProtection", true); // [FF114+] [ETP FF119+]
   // user_pref("privacy.partition.network_state.ocsp_cache", true); // [DEFAULT: true]
   // user_pref("privacy.query_stripping.enabled", true); // [FF101+]
   // user_pref("privacy.trackingprotection.enabled", true);
   // user_pref("privacy.trackingprotection.socialtracking.enabled", true);
   // user_pref("privacy.trackingprotection.cryptomining.enabled", true); // [DEFAULT: true]
   // user_pref("privacy.trackingprotection.fingerprinting.enabled", true); // [DEFAULT: true]
/* 7017: disable service workers
 * [WHY] Already isolated with TCP (2701) behind a pref ***/
   // user_pref("dom.serviceWorkers.enabled", false);
/* 7018: disable Web Notifications [FF22+]
 * [WHY] Web Notifications are behind a prompt (7002)
 * [1] https://blog.mozilla.org/en/products/firefox/block-notification-requests/ ***/
   // user_pref("dom.webnotifications.enabled", false);
/* 7019: disable Push Notifications [FF44+]
 * [WHY] Website "push" requires subscription, and the API is required for CRLite (1224)
 * [NOTE] To remove all subscriptions, reset "dom.push.userAgentID"
 * [1] https://support.mozilla.org/kb/push-notifications-firefox ***/
   // user_pref("dom.push.enabled", false);
/* 7020: disable WebRTC (Web Real-Time Communication)
 * [WHY] Firefox desktop uses mDNS hostname obfuscation and the private IP is never exposed until
 * required in TRUSTED scenarios; i.e. after you grant device (microphone or camera) access
 * [TEST] https://browserleaks.com/webrtc
 * [1] https://groups.google.com/g/discuss-webrtc/c/6stQXi72BEU/m/2FwZd24UAQAJ
 * [2] https://datatracker.ietf.org/doc/html/draft-ietf-mmusic-mdns-ice-candidates#section-3.1.1 ***/
   // user_pref("media.peerconnection.enabled", false);
/* 7021: enable GPC (Global Privacy Control) in non-PB windows
 * [WHY] Passive and active fingerprinting. Mostly redundant with Tracking Protection
 * in ETP Strict (2701) and sanitizing on close (2800s) ***/
   // user_pref("privacy.globalprivacycontrol.enabled", true);

/*** [SECTION 8000]: DON'T BOTHER: FINGERPRINTING
   [WHY] They are insufficient to help anti-fingerprinting and do more harm than good
   [WARNING] DO NOT USE with RFP. RFP already covers these and they can interfere
***/
user_pref("_user.js.parrot", "8000 syntax error: the parrot's crossed the Jordan");
/* 8001: prefsCleaner: reset items useless for anti-fingerprinting ***/
   // user_pref("browser.display.use_document_fonts", "");
   // user_pref("browser.zoom.siteSpecific", "");
   // user_pref("device.sensors.enabled", "");
   // user_pref("dom.enable_performance", "");
   // user_pref("dom.enable_resource_timing", "");
   // user_pref("dom.gamepad.enabled", "");
   // user_pref("dom.maxHardwareConcurrency", "");
   // user_pref("dom.w3c_touch_events.enabled", "");
   // user_pref("dom.webaudio.enabled", "");
   // user_pref("font.system.whitelist", "");
   // user_pref("general.appname.override", "");
   // user_pref("general.appversion.override", "");
   // user_pref("general.buildID.override", "");
   // user_pref("general.oscpu.override", "");
   // user_pref("general.platform.override", "");
   // user_pref("general.useragent.override", "");
   // user_pref("media.navigator.enabled", "");
   // user_pref("media.video_stats.enabled", "");
   // user_pref("media.webspeech.synth.enabled", "");
   // user_pref("ui.use_standins_for_native_colors", "");
   // user_pref("webgl.enable-debug-renderer-info", "");

/*** [SECTION 8500]: TELEMETRY
   Arkenfox does not consider Firefox telemetry to be a privacy or security concern - comments below.
   But since most arkenfox users prefer it disabled, we'll do that rather than cause overrides.

   Opt-out
   - Telemetry is essential: a browser engine is a _very_ large complex beast costing billions to maintain
   - Opt-in telemetry _does not_ work and results in data that is unrepresentative and may be misleading
   Choice
   - Every new profile on first use provides data collection/use policy and the abillty to opt-out
   - It can be disabled at any time (Settings>Privacy & Security>Data Collection and Use)
   Data
   - no PII (Personally Identifiable Information)
   - can be viewed in about:telemetry
   - uses Prio [1][2][3], Glean [4], Oblivious HTTP [5][6]

   [1] https://crypto.stanford.edu/prio/
   [2] https://hacks.mozilla.org/2018/10/testing-privacy-preserving-telemetry-with-prio/
   [3] https://blog.mozilla.org/security/2019/06/06/next-steps-in-privacy-preserving-telemetry-with-prio/
   [4] https://firefox-source-docs.mozilla.org/toolkit/components/glean/index.html
   [5] https://firefox-source-docs.mozilla.org/toolkit/components/glean/user/ohttp.html
   [6] https://blog.mozilla.org/en/tag/oblivious-http/
***/
user_pref("_user.js.parrot", "8500 syntax error: the parrot's off the twig!");
/* 8500: disable new data submission [FF41+]
 * If disabled, no policy is shown or upload takes place, ever
 * [1] https://bugzilla.mozilla.org/1195552 ***/
user_pref("datareporting.policy.dataSubmissionEnabled", false);
/* 8501: disable Health Reports
 * [SETTING] Privacy & Security>Firefox Data Collection and Use>Send technical... data ***/
user_pref("datareporting.healthreport.uploadEnabled", false);
/* 0802: disable telemetry
 * The "unified" pref affects the behavior of the "enabled" pref
 * - If "unified" is false then "enabled" controls the telemetry module
 * - If "unified" is true then "enabled" only controls whether to record extended data
 * [NOTE] "toolkit.telemetry.enabled" is now LOCKED to reflect prerelease (true) or release builds (false) [2]
 * [1] https://firefox-source-docs.mozilla.org/toolkit/components/telemetry/telemetry/internals/preferences.html
 * [2] https://medium.com/georg-fritzsche/data-preference-changes-in-firefox-58-2d5df9c428b5 ***/
user_pref("toolkit.telemetry.unified", false);
user_pref("toolkit.telemetry.enabled", false); // see [NOTE]
user_pref("toolkit.telemetry.server", "data:,");
user_pref("toolkit.telemetry.archive.enabled", false);
user_pref("toolkit.telemetry.newProfilePing.enabled", false); // [FF55+]
user_pref("toolkit.telemetry.shutdownPingSender.enabled", false); // [FF55+]
user_pref("toolkit.telemetry.updatePing.enabled", false); // [FF56+]
user_pref("toolkit.telemetry.bhrPing.enabled", false); // [FF57+] Background Hang Reporter
user_pref("toolkit.telemetry.firstShutdownPing.enabled", false); // [FF57+]
/* 8503: disable Telemetry Coverage
 * [1] https://blog.mozilla.org/data/2018/08/20/effectively-measuring-search-in-firefox/ ***/
user_pref("toolkit.telemetry.coverage.opt-out", true); // [HIDDEN PREF]
user_pref("toolkit.coverage.opt-out", true); // [FF64+] [HIDDEN PREF]
user_pref("toolkit.coverage.endpoint.base", "");

/*** [SECTION 9000]: NON-PROJECT RELATED ***/
user_pref("_user.js.parrot", "9000 syntax error: the parrot's cashed in 'is chips!");
/* 9001: disable welcome notices ***/
user_pref("browser.startup.homepage_override.mstone", "ignore"); // [HIDDEN PREF]
/* 9002: disable General>Browsing>Recommend extensions/features as you browse [FF67+] ***/
user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.addons", false);
user_pref("browser.newtabpage.activity-stream.asrouter.userprefs.cfr.features", false);
/* 9004: disable search terms [FF110+]
 * [SETTING] Search>Search Bar>Use the address bar for search and navigation>Show search terms instead of URL... ***/
user_pref("browser.urlbar.showSearchTerms.enabled", false);

/*** [SECTION 9999]: DEPRECATED / RENAMED ***/
user_pref("_user.js.parrot", "9999 syntax error: the parrot's shuffled off 'is mortal coil!");
/* ESR128.x still uses all the following prefs
// [NOTE] replace the * with a slash in the line above to re-enable active ones
// FF132
// 2617: remove webchannel whitelist
   // [-] https://bugzilla.mozilla.org/1275612
   // user_pref("webchannel.allowObject.urlWhitelist", "");
// FF140
// 0323: disable shopping experience [FF116+]
   // [-] https://bugzilla.mozilla.org/1964845
   // [1] https://bugzilla.mozilla.org/show_bug.cgi?id=1840156#c0
user_pref("browser.shopping.experience2023.enabled", false); // [DEFAULT: false]
// 0806: disable urlbar suggestions
   // [-] https://bugzilla.mozilla.org/1959497
user_pref("browser.urlbar.pocket.featureGate", false); // [FF116+] [DEFAULT: false]
// ***/

/* END: internal custom pref to test for syntax errors ***/
user_pref("_user.js.parrot", "SUCCESS: No no he's not dead, he's, he's restin'!");
user_pref("privacy.resistFingerprinting.letterboxing", false); // [HIDDEN PREF]
user_pref("browser.region.update.enabled", false);
user_pref("browser.region.network.url", "");
user_pref("extensions.pocket.enabled", false);
user_pref("identity.fxaccounts.enabled", false);
user_pref("extensions.webextensions.restrictedDomains", "");

========= Ende von CMD: =========


========= type "C:\USERS\Public\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\376W2OAH.DEFAULT-RELEASE\USER.JS" =========

Das System kann den angegebenen Pfad nicht finden.


========= Ende von CMD: =========


========= dism /online /cleanup-image /restorehealth =========


Fixing is terminated due to reaching maximum fixing time of 60 minutes. <==== ACHTUNG

M-K-D-B · Heute, 22:20

Servus,

vielen Dank für die Logdateien.
Die Tatsahe, dass DISM bei dir sehr lange gedauert hat und nicht fertig geworden ist, deutet auf größere Problem mit dem Systemabbild hin.

Wir probieren es nochmal anders.

Schritt 1 - Reparatur mit FRST

HINWEIS AN ALLE MITLESER:
Dieses FRST-Skript ist ausschließlich für diesen Nutzer gedacht und sollte niemals 1:1 für ein anderes System verwendet werden!

Speichere deine Arbeiten und schließe alle offenen Programme, damit keine Daten verloren gehen.

Markiere den gesamten Inhalt der folgenden Code-Box mit der Maus und kopiere ihn (gleichzeitiges Drücken der beiden Tasten "STRG" + "C"):

Code:

ATTFilter

Start::
CloseProcesses:
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\nobody\AppData\Local\TrafficMonitor
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Users\nobody\AppData\Local\TrafficMonitor\TrafficMonitor.sys
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths|C:\Program Files\Black Tree Gaming Ltd\Vortex
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes|file: \??\c:\users\nobody\appdata\local\trafficmonitor\trafficmonitor.sys
Reboot:
End::

Starte nun FRST und klicke direkt auf den Button Reparieren.
Wichtig: Du brauchst den Inhalt der Code-Box nirgends einfügen, da sich FRST den Code aus der Zwischenablage holt!
Das Tool führt die gewünschten Schritte aus und erstellt die Datei fixlog.txt im selben Verzeichnis, in dem sich FRST befindet.
Zum Abschluss wird das System neu gestartet.
Poste mir den Inhalt der Datei fixlog.txt mit deiner nächsten Antwort.

Schritt 2 - Reparatur über Kommandozeile

Gib in das Suchfeld auf der Taskleiste CMD ein.
Wähle bei der Eingabeaufforderung Als Administrator ausführen.
Kopiere den folgenden Befehl in die Kommandozeile ein und bestätige mit Enter:
Code:
ATTFilter
```
dism /online /cleanup-image /restorehealth
         
```
Die Reparatur kann einige Zeit in Anspruch nehmen. Berichte, welche Meldungen du erhalten hast.
Kopiere anschließend den folgenden Befehl in die Kommandozeile ein und bestätige mit Enter:
Code:
ATTFilter
```
sfc /scannow
         
```
Die Reparatur der Systemdateien dauert in der Regel ein paar Minuten. Berichte, welche Meldungen du erhalten hast.
Starte den Rechner zum Abschluss neu.

Gestern, 10:16	#2
M-K-D-B /// TB-Ausbilder	Windows 11 Kontrollscan Mein Name ist Matthias und ich werde dir bei der Analyse und Bereinigung deines Systems helfen. Ich analysiere dein System und melde mich später wieder. __________________

Gestern, 12:38	#5
M-K-D-B /// TB-Ausbilder	Windows 11 Kontrollscan Servus cosinus, das ist ein guter Hinweis, danke. Aber lass uns erst einmal abwarten, was BeRealm antwortet.

Windows 11 Kontrollscan

Log-Analyse und Auswertung: Windows 11 Kontrollscan