| |
| |||||||
Log-Analyse und Auswertung: Trojanerfundmeldung - Win11 findet keine Malware - Meldung erscheint immer wiederWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
Heute, 14:10
| #1 |
| |  Trojanerfundmeldung - Win11 findet keine Malware - Meldung erscheint immer wieder Hallo, auf dem WIn11 Rechner erscheint regelmäßig wiederkehrend eine Warnung, dass ein Trojaner gefunden wurde und möchte über ein PopUp Fenster einen Scan durchführen. Mit Alt+F4 oder ähnlichem konnte das Fenster wieder geschlossen werden, gelegentlich auch nicht (Neustart erforderlich). Es erscheint immer wieder in verschiedenem Layout mit ähnlichem Inhalt. Alle Browser wurden zurückgesetzt ohne Erfolg. Einen Screenshot der Trojanermeldung konnte ich nicht hier einfügen. Dem Rechner war bei der Erstinstallation die Muttersprache Niederländisch nicht abzugewöhnen. Ebenfalls wird der Rechner gewerblich genutzt. Es ist ein Kleinstunternehmen und hat hat keinerlei IT Support. ___________________________________________________________ Code:
ATTFilter Scanresultaten van Farbar Recovery Scan Tool (FRST) (x64) Versie: 25-09-2026
Gestart door xxxx (Beheerder) op DESKTOP-7UO7M50 (DEFAULT STRING DEFAULT STRING) (25-09-2026 14:18:31)
Gestart vanaf C:\Users\xxxx\Desktop\FRST64.exe
Geladen Profielen: xxxx
Platform: Microsoft Windows 11 Pro Versie 25H2 26200.9457 (X64) Taal: Niederländisch (Niederlande) -> Deutsch (Deutschland)
Standaardbrowser: Chrome
Boot Modus: Normal
==================== Processen (gefilterd) =================
(Als een item is opgenomen in de fixlist, zal het proces worden gesloten. Het bestand zal niet worden verplaatst.)
(C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\DefenderSessionHelper.exe
(DriverStore\FileRepository\cui_dch.inf_amd64_bdd49bbe6b990549\igfxCUIServiceN.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_bdd49bbe6b990549\igfxEMN.exe
(explorer.exe ->) (Ghisler Software GmbH -> Ghisler Software GmbH) C:\Program Files\totalcmd\TOTALCMD64.EXE
(explorer.exe ->) (Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\OneDrive.exe
(Google LLC -> Google LLC) C:\Program Files\Google\Chrome\Application\chrome.exe <9>
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\153.0.4234.48\msedgewebview2.exe <5>
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_bdd49bbe6b990549\igfxCUIServiceN.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_af50fdb80983f7bc\jhi_service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_5b51a286c5d2f192\OneApp.IGCC.WinService.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_65ac4d73bb85cb27\IntelCpHDCPSvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_d51901c26227fb29\WMIRegistrationService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncHelper.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpDefenderCoreService.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe
(services.exe ->) (Microsoft Windows Publisher -> Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\NisSrv.exe
(sihost.exe ->) (Microsoft Corporation -> ) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2609.44031.0_x64__8wekyb3d8bbwe\m365copilot_autostarter.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.StartExperiencesApp_1.380.2.0_x64__8wekyb3d8bbwe\MicrosoftStartFeedProvider\MicrosoftStartFeedProvider.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\NgcIso.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe
==================== Register (gefilterd) ===================
(Als een item is opgenomen in de fixlist, zal het registeritem worden teruggezet naar de standaardwaarden of verwijderd. Het bestand zal niet worden verplaatst.)
HKLM\...\Run: [KeePass 2 PreLoad] => C:\Program Files\KeePass Password Safe 2\KeePass.exe [3265880 2026-05-01] (Open Source Developer, Dominik Reichl -> Dominik Reichl)
HKU\S-1-5-21-720174342-3053994144-4245047485-1001\...\Run: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [4756840 2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-720174342-3053994144-4245047485-1002\...\Run: [OneDrive] => C:\Program Files\Microsoft OneDrive\OneDrive.exe [4756840 2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-720174342-3053994144-4245047485-1002\...\Run: [Microsoft.Lists] => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\OneDrive.Sync.Service.exe [967528 2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-720174342-3053994144-4245047485-1002\...\Run: [PulseBrowserUpdaterTaskUser135.0.7049.101] => C:\Users\Avi\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe [5576816 2026-07-03] (Alabama Technology USA, LLC -> Alabama Technology USA, LLC)
HKU\S-1-5-21-720174342-3053994144-4245047485-1002\...\Run: [MicrosoftEdgeAutoLaunch_E9668399593D9418202A6A14E62927B5] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5418312 2026-09-18] (Microsoft Corporation -> Microsoft Corporation)
HKLM\...\Windows x64\Print Processors\Canon TR4700 series Print Processor: C:\Windows\System32\spool\prtprocs\x64\CNMPDHL.DLL [543744 2021-07-11] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\...\Print\Monitors\Canon BJ FAX Language Monitor TR4700 series: C:\WINDOWS\system32\CNCALHL.DLL [266752 2021-03-24] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\...\Print\Monitors\Canon BJ Language Monitor TR4700 series: C:\WINDOWS\system32\CNMLMHL.DLL [989184 2021-07-11] (Microsoft Windows Hardware Compatibility Publisher -> CANON INC.)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{49210152-871f-4ffa-961d-a172abcbc09d}] -> C:\Program Files\Google\Chrome\Application\PlatformExperienceHelper\platform_experience_helper.exe [4924568 2026-08-11] (Google LLC -> Google LLC)
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\153.0.8010.54\Installer\chrmstp.exe [8030872 2026-09-24] (Google LLC -> Google LLC)
==================== Geplande Taken (gefilterd) =================
(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)
Task: {2170D3AB-C679-4D99-976C-D1D45D171745} - System32\Tasks\GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem152.0.7933.0{54CF2A32-741E-4DB4-B904-C6E21A1A8877} => C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe [7400088 2026-07-05] (Google LLC -> Google LLC)
Task: {DB9B7F29-C0F4-471A-B1F1-BCFA8F05454C} - System32\Tasks\Microsoft\Office\Office Actions Server => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ActionsServer\ActionsServer.exe [16470400 2026-09-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {A49B97C6-6FF2-4149-92FB-1612E0A16ED4} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [28440976 2026-09-15] (Microsoft Corporation -> Microsoft Corporation)
Task: {3074B11E-C6AC-44C2-A9D3-776CBF825715} - System32\Tasks\Microsoft\Office\Office Background Push Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16\opushutil.exe [69984 2026-09-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {05CD1DD8-E104-4E97-ACAB-FC62D4C491E6} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [28440976 2026-09-15] (Microsoft Corporation -> Microsoft Corporation)
Task: {FEEC8C07-4164-4C10-9F4F-569A1B1FE320} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [426352 2026-09-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {50D01334-1023-48F9-A745-229B25C2A917} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [426352 2026-09-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {089973E0-70BF-421C-B7BF-5BF193D7E1C1} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\operfmon.exe [1328920 2026-08-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {2003DE6A-DD7B-4940-968C-018A746C00DF} - System32\Tasks\Microsoft\Office\Office Startup Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ActionsServer\ActionsServer.exe [16470400 2026-09-21] (Microsoft Corporation -> Microsoft Corporation)
Task: {C885B7DB-DB6B-45F6-8EA1-F8B919E23D1C} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (Geen bestand)
Task: {FBDF7F36-4B6A-4FD6-B138-7A7010D82603} - System32\Tasks\Microsoft\Windows\PI\SecureBootEncodeUEFI => %WINDIR%\system32\SecureBootEncodeUEFI.exe (Geen bestand)
Task: {EEC49C91-BCB0-4E42-BEA6-CB620E01EB5F} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe (Geen bestand)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (Geen bestand)
Task: {8D1CA24F-2384-47B3-9D12-114ECEFEFBCC} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe [1902880 2026-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {641849F7-4FE6-46DC-9409-898C71F2792F} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe [1902880 2026-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {CB4EB528-A34E-465A-B942-B329373B42F6} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe [1902880 2026-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {299DB728-8F5C-42A4-9EEC-B858F2904DC9} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpCmdRun.exe [1902880 2026-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
Task: {6462339D-2DE6-45D0-BDC4-E85C09BA59D5} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-720174342-3053994144-4245047485-1001 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [1079424 2026-09-25] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (de data item heeft 6 meer tekens).
Task: {569EC90A-5499-4FFF-AB15-0B72EB8A2BF3} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-720174342-3053994144-4245047485-1002 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [1079424 2026-09-25] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (de data item heeft 6 meer tekens).
Task: {61437EE8-036C-4937-851E-09B3C38EE610} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [44160 2026-09-25] (Mozilla Corporation -> Mozilla Foundation)
Task: {F46095EA-F1F7-404B-82D8-09FDC0EFD29C} - System32\Tasks\OneBUpdate => C:\Users\Avi\AppData\Local\OB\OneBUpdate\OneBUpdateService.exe [4251144 2026-08-17] (Work Product Inc. -> Work Product Inc.)
Task: {BE898A6F-E989-42A2-8DC5-D42CE1BF448B} - System32\Tasks\OneDrive Per-Machine Standalone Update Task => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4409744 2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {039A580A-D7C3-41D8-8DD4-7B637584C717} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-720174342-3053994144-4245047485-1001 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4409744 2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {52A7F5B2-66FB-4F94-979E-99DAADA3C91D} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-720174342-3053994144-4245047485-1002 => C:\Program Files\Microsoft OneDrive\OneDriveStandaloneUpdater.exe [4409744 2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {09CAE655-FE75-4742-9376-AE36E9DD6787} - System32\Tasks\OneDrive Startup Task-S-1-5-21-720174342-3053994144-4245047485-1001 => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\OneDriveLauncher.exe [866192 2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {BF2D235B-27CE-4BC4-A2BB-875ED03C42FA} - System32\Tasks\OneDrive Startup Task-S-1-5-21-720174342-3053994144-4245047485-1002 => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\OneDriveLauncher.exe [866192 2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {1D1EA1DD-A1B7-46D4-88E5-A1952A48D68F} - System32\Tasks\PulseSoftware\PulseBrowserStartupS-1-5-21-720174342-3053994144-4245047485-1002 => C:\Users\Avi\AppData\Local\PulseSoftware\PulseBrowser\Application\pulsebrowser.exe [4059248 2026-06-23] (Alabama Technology USA, LLC -> Alabama Technology USA, LLC)
Task: {04D8A3B2-85F7-4031-B04F-0552A058A4C6} - System32\Tasks\PulseSoftware\PulseBrowserUpdater\PulseBrowserUpdaterTaskUser135.0.7049.101{90B905BE-9FD9-4876-9D26-7A1AA0351B97} => C:\Users\Avi\AppData\Local\PulseSoftware\PulseBrowserUpdater\135.0.7049.101\updater.exe [5576816 2026-07-03] (Alabama Technology USA, LLC -> Alabama Technology USA, LLC)
(Als een item is opgenomen in de fixlist, wordt de taak (job) bestand verplaatst. Het bestand dat wordt uitgevoerd door de taak zal niet worden verplaatst.)
==================== Internet (gefilterd) ====================
(Als een item is opgenomen in de fixlist en een registeritem is, wordt het verwijderd of hersteld naar de standaard.)
Tcpip\Parameters: [DhcpNameServer] 192.168.10.1
Tcpip\..\Interfaces\{7786a279-fc7f-4bd0-b9c6-12cee5554e3c}: [DhcpNameServer] 192.168.10.1
Tcpip\..\Interfaces\{7786a279-fc7f-4bd0-b9c6-12cee5554e3c}: [DhcpDomain] fritz.box
FireFox:
========
FF TaskBarID: 35565CD3A3E82193 -> C:\Users\xxxx\AppData\Local\Mozilla Firefox
FF TaskBarID: 308046B0AF4A39CB -> C:\Program Files\Mozilla Firefox
FF DefaultProfile: i5ay6gwk.default-release -> 308046B0AF4A39CB
FF ProfilePath: C:\Users\xxxx\AppData\Roaming\Mozilla\Firefox\Profiles\nrwbdzd9.default [2026-04-15]
FF ProfilePath: C:\Users\xxxx\AppData\Roaming\Mozilla\Firefox\Profiles\i5ay6gwk.default-release [2026-04-22]
FF Homepage: Mozilla\Firefox\Profiles\i5ay6gwk.default-release -> www.google.de
FF Extension: (New Tab) - C:\Users\xxxx\AppData\Roaming\Mozilla\Firefox\Profiles\i5ay6gwk.default-release\Extensions\newtab@mozilla.org.xpi [2026-04-15]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2026-08-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2026-08-23] (Microsoft Corporation -> Microsoft Corporation)
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\xxxx\AppData\Local\Microsoft\Edge\User Data\Default [2026-04-22]
Edge Extension: (Google Docs Offline) - C:\Users\xxxx\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-04-22]
Edge Extension: (Edge relevant text changes) - C:\Users\xxxx\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2026-04-22]
Edge Profile: C:\Users\xxxx\AppData\Local\Microsoft\Edge\User Data\Profile 1 [2026-04-22]
Edge Extension: (Google Docs Offline) - C:\Users\xxxx\AppData\Local\Microsoft\Edge\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-04-15]
Edge Extension: (Edge relevant text changes) - C:\Users\xxxx\AppData\Local\Microsoft\Edge\User Data\Profile 1\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2026-04-15]
Chrome:
=======
CHR Profile: C:\Users\xxxx\AppData\Local\Google\Chrome\User Data\Default [2026-09-25]
CHR DownloadDir: C:\Users\xxxx\Desktop
CHR Extension: (Google Docs Offline) - C:\Users\xxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-09-25]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\xxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2026-04-15]
==================== Services (gefilterd) ===================
(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [13372816 2026-09-15] (Microsoft Corporation -> Microsoft Corporation)
R3 FileSyncHelper; C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncHelper.exe [3800424 2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
R2 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpDefenderCoreService.exe [2307776 2026-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 OneDrive Updater Service; C:\Program Files\Microsoft OneDrive\26.168.0830.0006\OneDriveUpdaterService.exe [4098960 2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [914752 2026-09-09] (Microsoft Windows Publisher -> Microsoft Corporation)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\NisSrv.exe [5311776 2026-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe [291360 2026-09-18] (Microsoft Windows Publisher -> Microsoft Corporation)
===================== Drivers (gefilterd) ===================
(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)
S3 BthA2dp; C:\WINDOWS\System32\drivers\BthA2dp.sys [598016 2026-04-15] (Microsoft Corporation) [Bestand niet getekend]
S3 BthHFEnum; C:\WINDOWS\System32\drivers\bthhfenum.sys [212992 2026-04-15] (Microsoft Corporation) [Bestand niet getekend]
S3 BTHMODEM; C:\WINDOWS\System32\drivers\bthmodem.sys [114688 2026-04-15] (Microsoft Corporation) [Bestand niet getekend]
R3 KslD; C:\WINDOWS\System32\drivers\wd\KslD.sys [83008 2026-09-04] (Microsoft Windows -> Microsoft Corporation)
R3 rtcx21; C:\WINDOWS\System32\DriverStore\FileRepository\rtcx21x64.inf_amd64_feec7a9662e785f0\rtcx21x64.sys [539648 2024-03-28] (Microsoft Windows -> Realtek)
S4 WdAiNisDrv; C:\WINDOWS\System32\drivers\wd\WdAiNisDrv.sys [51264 2026-09-18] (Microsoft Windows -> Microsoft Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [21632 2026-09-18] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [664592 2026-09-18] (Microsoft Windows -> Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [137240 2026-09-18] (Microsoft Windows -> Microsoft Corporation)
R3 WSDPrintDevice; C:\WINDOWS\System32\DriverStore\FileRepository\wsdprint.inf_amd64_1f9e32519098c0b6\WSDPrint.sys [57344 2026-04-15] (Microsoft Windows -> Microsoft Corporation)
R3 WSDScan; C:\WINDOWS\System32\DriverStore\FileRepository\sti.inf_amd64_8ce330c68e1a560b\WSDScan.sys [61440 2026-09-09] (Microsoft Windows -> Microsoft Corporation)
==================== SvcHost (gefilterd) ===================
(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)
==================== Een maand (aangemaakt) (gefilterd) =========
(Als een item is opgenomen in de fixlist, wordt de map of het bestand verplaatst.)
2026-09-25 14:18 - 2026-09-25 14:19 - 000021348 _____ C:\Users\xxxx\Desktop\FRST.txt
2026-09-25 14:18 - 2026-09-25 14:19 - 000000000 ____D C:\FRST
2026-09-25 14:14 - 2026-09-25 14:15 - 002455552 _____ (Farbar) C:\Users\xxxx\Desktop\FRST64.exe
2026-09-25 14:11 - 2026-09-25 14:11 - 000004036 _____ C:\WINDOWS\system32\Tasks\PostponeDeviceSetupToast_S-1-5-21-720174342-3053994144-4245047485-1001_0
2026-09-25 14:10 - 2026-09-25 14:10 - 000000000 ____D C:\Users\xxxx\AppData\Local\WindowsOobeAppHost
2026-09-25 13:39 - 2026-09-25 13:39 - 000787094 _____ C:\WINDOWS\system32\perfh013.dat
2026-09-25 13:39 - 2026-09-25 13:39 - 000734214 _____ C:\WINDOWS\system32\perfh007.dat
2026-09-25 13:39 - 2026-09-25 13:39 - 000161738 _____ C:\WINDOWS\system32\perfc013.dat
2026-09-25 13:39 - 2026-09-25 13:39 - 000158294 _____ C:\WINDOWS\system32\perfc007.dat
2026-09-25 09:07 - 2026-09-25 09:07 - 000004706 _____ C:\Users\Avi\Downloads\invoice2026-09-25_09-07-11.pdf
2026-09-25 09:05 - 2026-09-25 09:05 - 000004699 _____ C:\Users\Avi\Downloads\invoice2026-09-25_09-05-53.pdf
2026-09-25 04:43 - 2026-09-25 12:55 - 000000000 ____D C:\Program Files\Mozilla Firefox
2026-09-23 16:35 - 2026-09-25 13:21 - 000000000 ____D C:\WINDOWS\CbsTemp
2026-09-23 09:24 - 2026-09-23 09:24 - 000004683 _____ C:\Users\Avi\Downloads\invoice2026-09-23_09-24-34.pdf
2026-09-23 09:23 - 2026-09-23 09:23 - 000004704 _____ C:\Users\Avi\Downloads\invoice2026-09-23_09-23-20.pdf
2026-09-22 15:01 - 2026-09-22 15:01 - 000838005 _____ C:\Users\Avi\Downloads\invoice2026-09-22_15-01-48.pdf
2026-09-21 22:36 - 2026-09-21 22:36 - 000005464 _____ C:\Users\Avi\Downloads\invoice2026-09-21_22-36-39.pdf
2026-09-20 19:19 - 2026-09-20 19:19 - 000004696 _____ C:\Users\Avi\Downloads\invoice2026-09-20_19-19-35.pdf
2026-09-20 19:19 - 2026-09-20 19:19 - 000004696 _____ C:\Users\Avi\Downloads\invoice2026-09-20_19-19-15.pdf
2026-09-18 20:51 - 2026-09-18 20:51 - 000838020 _____ C:\Users\Avi\Downloads\invoice2026-09-18_20-51-51.pdf
2026-09-16 12:45 - 2026-09-16 12:45 - 000004691 _____ C:\Users\Avi\Downloads\invoice2026-09-16_12-45-43.pdf
2026-09-15 14:06 - 2026-09-15 14:06 - 000004784 _____ C:\Users\Avi\Downloads\invoice2026-09-15_14-06-24.pdf
2026-09-15 13:45 - 2026-09-15 13:45 - 000004686 _____ C:\Users\Avi\Downloads\invoice2026-09-15_13-45-09.pdf
2026-09-14 22:37 - 2026-09-14 09:48 - 000019437 _____ C:\Users\Avi\Downloads\Appia Contract GmbH Rg.2026-103549 - Kopie.pdf
2026-09-14 22:37 - 2026-09-14 09:48 - 000019437 _____ C:\Users\Avi\Downloads\Appia Contract GmbH Rg.2026-103549 - Kopie (2).pdf
2026-09-14 22:37 - 2026-09-13 22:02 - 000838055 _____ C:\Users\Avi\Downloads\invoice2026-09-13_22-02-54 - Kopie.pdf
2026-09-14 22:37 - 2026-09-13 22:02 - 000838055 _____ C:\Users\Avi\Downloads\invoice2026-09-13_22-02-54 - Kopie (2).pdf
2026-09-14 22:37 - 2026-09-13 22:02 - 000838055 _____ C:\Users\Avi\Downloads\invoice2026-09-13_22-02-30 - Kopie.pdf
2026-09-14 22:37 - 2026-09-13 22:02 - 000838055 _____ C:\Users\Avi\Downloads\invoice2026-09-13_22-02-30 - Kopie (2).pdf
2026-09-14 22:37 - 2026-09-04 16:23 - 000004784 _____ C:\Users\Avi\Downloads\invoice2026-09-04_16-23-50 - Kopie.pdf
2026-09-14 22:37 - 2026-09-04 16:23 - 000004784 _____ C:\Users\Avi\Downloads\invoice2026-09-04_16-23-50 - Kopie (2).pdf
2026-09-14 22:37 - 2026-08-19 15:39 - 000196299 _____ C:\Users\Avi\Downloads\RECHNUNG Nr. 10353826 19.08.26 KABEL Sugar and Glory € 89,87 bez. 26.08.26.pdf
2026-09-14 22:37 - 2026-08-19 15:39 - 000196299 _____ C:\Users\Avi\Downloads\RECHNUNG Nr. 10353826 19.08.26 KABEL Sugar and Glory € 89,87 bez. 26.08.26 - Kopie.pdf
2026-09-14 22:37 - 2026-07-27 15:40 - 000198118 _____ C:\Users\Avi\Downloads\RECHNUNG Nr#10348626, 16.07.26 , KABEL SERAX, BE € 1194,00 bez. 27.07.26.pdf
2026-09-14 22:37 - 2026-07-27 15:40 - 000198118 _____ C:\Users\Avi\Downloads\RECHNUNG Nr#10348626, 16.07.26 , KABEL SERAX, BE € 1194,00 bez. 27.07.26 - Kopie.pdf
2026-09-14 09:48 - 2026-09-14 09:48 - 000019437 _____ C:\Users\Avi\Downloads\Appia Contract GmbH Rg.2026-103549.pdf
2026-09-13 22:02 - 2026-09-13 22:02 - 000838055 _____ C:\Users\Avi\Downloads\invoice2026-09-13_22-02-54.pdf
2026-09-13 22:02 - 2026-09-13 22:02 - 000838055 _____ C:\Users\Avi\Downloads\invoice2026-09-13_22-02-30.pdf
2026-09-12 18:24 - 2026-09-12 18:24 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2026-09-12 17:17 - 2026-09-25 01:32 - 000002239 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2026-09-12 17:17 - 2026-09-25 01:32 - 000002198 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2026-09-12 17:17 - 2026-09-12 17:17 - 000000000 ____D C:\WINDOWS\system32\Tasks\GoogleUserPEH
2026-09-12 17:16 - 2026-09-12 17:16 - 000000000 ____D C:\Program Files\Google
2026-09-12 17:15 - 2026-09-12 17:15 - 000000000 ____D C:\WINDOWS\system32\Tasks\GoogleSystem
2026-09-12 17:14 - 2026-09-12 17:14 - 012411832 _____ (Google LLC) C:\Users\Avi\Downloads\ChromeSetup.exe
2026-09-12 17:06 - 2026-09-12 17:06 - 000000000 ____D C:\Users\Avi\AppData\Local\WindowsOobeAppHost
2026-09-12 16:30 - 2026-09-22 11:25 - 000000000 ____D C:\Users\Avi\AppData\Roaming\KeePass
2026-09-12 16:27 - 2026-09-12 16:27 - 000000963 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass 2.lnk
2026-09-12 16:27 - 2026-09-12 16:27 - 000000000 ____D C:\Program Files\KeePass Password Safe 2
2026-09-11 20:25 - 2026-09-11 20:25 - 000073754 _____ C:\Users\Avi\Downloads\DOF-2609117EALZ9Y9MXQB-0054032971.pdf
2026-09-11 15:04 - 2026-09-11 15:04 - 000066342 _____ C:\Users\Avi\Downloads\DHL-Paketmarke_PAKCE64NKHMX_Craig_Walker____.pdf
2026-09-11 13:09 - 2026-09-11 13:09 - 000222837 _____ C:\Users\Avi\Downloads\Gescannt_20260911-1255 Wohnen 13.07.25-07.04.26.pdf
2026-09-11 11:34 - 2026-08-31 21:23 - 000838039 _____ C:\Users\Avi\Downloads\invoice2026-08-31_21-23-38.pdf
2026-09-11 11:34 - 2026-08-31 15:04 - 000004785 _____ C:\Users\Avi\Downloads\invoice2026-08-31_15-04-45.pdf
2026-09-11 11:34 - 2026-08-10 11:40 - 000004636 _____ C:\Users\Avi\Downloads\invoice2026-08-10_11-40-25.pdf
2026-09-11 11:34 - 2026-08-05 11:49 - 000004730 _____ C:\Users\Avi\Downloads\invoice2026-08-05_11-49-35.pdf
2026-09-11 11:34 - 2026-07-31 11:53 - 000005203 _____ C:\Users\Avi\Downloads\invoice2026-07-31_11-53-36.pdf
2026-09-11 11:34 - 2026-07-20 10:21 - 000004693 _____ C:\Users\Avi\Downloads\invoice2026-07-20_10-21-04.pdf
2026-09-11 11:31 - 2026-09-11 11:31 - 001097791 _____ C:\Users\Avi\Downloads\Nachrichten _ eBay.html
2026-09-11 11:31 - 2026-09-11 11:31 - 000000000 ____D C:\Users\Avi\Downloads\Nachrichten _ eBay_files
2026-09-10 11:48 - 2026-09-22 11:21 - 000001607 _____ C:\WINDOWS\system32\config\VSMIDK
2026-09-09 12:27 - 2026-09-09 12:27 - 000004646 _____ C:\WINDOWS\system32\ResPriUHMImageList
2026-09-09 12:27 - 2026-09-09 12:27 - 000004646 _____ C:\WINDOWS\system32\ResPriLMImageList
2026-09-09 12:27 - 2026-09-09 12:27 - 000004646 _____ C:\WINDOWS\system32\ResPriImageList
2026-09-09 12:27 - 2026-09-09 12:27 - 000004646 _____ C:\WINDOWS\system32\ResPriHMImageList
2026-09-09 12:27 - 2026-09-09 12:27 - 000004555 _____ C:\WINDOWS\system32\ResPriImageListLowCost
2026-09-09 12:27 - 2026-09-09 12:27 - 000004555 _____ C:\WINDOWS\system32\ResPriHMImageListLowCost
2026-09-09 12:26 - 2026-09-09 12:26 - 000039215 _____ C:\WINDOWS\SysWOW64\IntegratedServicesRegionPolicySet.json
2026-09-09 12:26 - 2026-09-09 12:26 - 000039215 _____ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json
2026-09-09 12:25 - 2026-09-09 12:25 - 000014689 _____ C:\WINDOWS\system32\ecoscore_config.json
2026-09-04 20:33 - 2026-09-04 20:33 - 000030655 _____ C:\Users\Avi\Downloads\2026-9-3-RG.pdf
2026-09-04 20:33 - 2026-09-04 20:33 - 000030655 _____ C:\Users\Avi\Downloads\2026-9-3-RG (1).pdf
2026-09-04 16:23 - 2026-09-04 16:23 - 000004784 _____ C:\Users\Avi\Downloads\invoice2026-09-04_16-23-50.pdf
2026-09-04 12:33 - 2026-09-04 12:52 - 2520774203 _____ C:\Users\Avi\Downloads\4_BEWEISVIDEO.MOV
2026-09-03 22:59 - 2026-09-03 22:59 - 000004022 _____ C:\Users\Avi\Downloads\packingslip2026-09-03_22-59-45.pdf
2026-09-03 22:57 - 2026-09-03 22:57 - 000004787 _____ C:\Users\Avi\Downloads\invoice2026-09-03_22-57-22.pdf
2026-09-03 21:58 - 2026-09-03 21:58 - 000002657 _____ C:\Users\Avi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pulse Browser.lnk
2026-09-03 21:57 - 2026-09-03 21:58 - 000000000 ____D C:\WINDOWS\system32\Tasks\PulseSoftware
2026-09-03 21:57 - 2026-09-03 21:58 - 000000000 ____D C:\Users\Avi\AppData\Local\PulseSoftware
2026-09-03 21:44 - 2026-09-03 21:44 - 005235880 _____ (BurdaForward GmbH) C:\Users\Avi\Downloads\VLC media player 3.0.22 RC2 Deutsch - CHIP Installer _eNoGT.exe
2026-09-03 20:46 - 2026-09-03 20:46 - 002443800 _____ C:\Users\Avi\Downloads\IMG_9335.pdf
2026-09-01 22:40 - 2026-09-01 22:40 - 000004429 _____ C:\Users\Avi\Downloads\packingslip2026-09-01_22-40-53.pdf
2026-09-01 22:22 - 2026-09-01 22:22 - 000005464 _____ C:\Users\Avi\Downloads\invoice2026-09-01_22-22-11.pdf
2026-09-01 12:28 - 2026-09-01 12:28 - 000003897 _____ C:\Users\Avi\Downloads\packingslip2026-09-01_12-28-35.pdf
2026-09-01 12:26 - 2026-09-01 12:26 - 000004692 _____ C:\Users\Avi\Downloads\invoice2026-09-01_12-26-50.pdf
2026-09-01 11:33 - 2026-09-01 11:33 - 000003954 _____ C:\Users\Avi\Downloads\packingslip2026-09-01_11-33-39.pdf
2026-09-01 11:31 - 2026-09-01 11:31 - 000004716 _____ C:\Users\Avi\Downloads\invoice2026-09-01_11-31-15.pdf
2026-08-31 21:27 - 2026-08-31 21:27 - 000837294 _____ C:\Users\Avi\Downloads\packingslip2026-08-31_21-27-17.pdf
2026-08-31 21:26 - 2026-08-31 21:26 - 000838039 _____ C:\Users\Avi\Downloads\invoice2026-08-31_21-26-42.pdf
2026-08-31 21:26 - 2026-08-31 21:26 - 000837294 _____ C:\Users\Avi\Downloads\packingslip2026-08-31_21-26-16.pdf
2026-08-31 12:56 - 2026-08-31 12:56 - 000000000 ____D C:\Users\Avi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView
2026-08-31 12:56 - 2026-08-31 12:56 - 000000000 ____D C:\Users\Avi\AppData\Roaming\IrfanView
2026-08-30 19:18 - 2026-08-30 19:18 - 000004716 _____ C:\Users\Avi\Downloads\invoice2026-08-30_19-18-28.pdf
2026-08-29 21:57 - 2026-08-29 21:57 - 000013175 _____ C:\Users\Avi\Downloads\loewinst_elster_29.08.2026_21.54.pfx
2026-08-28 13:05 - 2026-08-28 13:05 - 000154162 _____ C:\Users\Avi\Downloads\Verkaufsschild-VWTransporterT52ClangeVersion_-_10479630643258272470.pdf
2026-08-27 21:36 - 2026-09-05 20:44 - 000000000 ____D C:\Program Files\Mozilla Thunderbird
2026-08-27 21:30 - 2026-08-27 21:30 - 000000000 ____D C:\Users\Avi\Lampen_ab_21.04.26
2026-08-27 14:58 - 2026-08-27 14:58 - 000004930 _____ C:\Users\Avi\Downloads\packingslip2026-08-27_14-58-07.pdf
2026-08-27 14:13 - 2026-08-27 14:13 - 000006575 _____ C:\Users\Avi\Downloads\invoice2026-08-27_14-13-36.pdf
2026-08-26 15:31 - 2026-08-26 15:31 - 001808486 _____ C:\Users\Avi\Downloads\IMG_3526.jpeg
2026-08-26 15:30 - 2026-08-26 15:30 - 001845548 _____ C:\Users\Avi\Downloads\IMG_3538 (1).jpeg
2026-08-26 15:29 - 2026-08-26 15:29 - 001845548 _____ C:\Users\Avi\Downloads\IMG_3538.jpeg
2026-08-26 15:28 - 2026-08-26 15:28 - 001380003 _____ C:\Users\Avi\Downloads\IMG_3529.jpeg
2026-08-26 12:22 - 2026-09-25 12:55 - 000002125 _____ C:\Users\Avi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
==================== Een maand (gewijzigd) ==================
(Als een item is opgenomen in de fixlist, wordt de map of het bestand verplaatst.)
2026-09-25 14:19 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\AppReadiness
2026-09-25 14:13 - 2024-01-01 01:20 - 000000000 ____D C:\Users\xxxx\AppData\Local\Packages
2026-09-25 14:11 - 2024-04-01 09:26 - 000000000 ___HD C:\Program Files\WindowsApps
2026-09-25 14:10 - 2026-04-15 12:08 - 000000000 __SHD C:\Users\xxxx\IntelGraphicsProfiles
2026-09-25 14:10 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SystemTemp
2026-09-25 14:10 - 2024-04-01 09:26 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2026-09-25 14:03 - 2026-04-15 12:19 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2026-09-25 13:39 - 2026-04-15 16:04 - 002666788 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2026-09-25 13:39 - 2024-04-01 09:24 - 000000000 ____D C:\WINDOWS\INF
2026-09-25 13:38 - 2026-04-15 15:58 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2026-09-25 12:55 - 2026-04-15 12:19 - 000001065 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2026-09-25 12:55 - 2026-04-15 12:19 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2026-09-25 09:04 - 2026-04-21 20:39 - 000000000 ____D C:\Users\Avi\AppData\Roaming\Microsoft\Outlook
2026-09-24 16:21 - 2026-04-21 12:10 - 000000000 ____D C:\Users\Avi\AppData\Local\Packages
2026-09-24 14:38 - 2026-04-21 18:31 - 000000000 ____D C:\Users\Avi\AppData\Roaming\Microsoft\Excel
2026-09-23 16:20 - 2026-04-21 23:11 - 000000000 ____D C:\Program Files\Microsoft OneDrive
2026-09-23 16:20 - 2026-04-21 18:29 - 000003194 _____ C:\WINDOWS\system32\Tasks\OneDrive Per-Machine Standalone Update Task
2026-09-23 16:20 - 2026-04-21 18:29 - 000002039 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2026-09-23 16:20 - 2026-04-21 12:12 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-720174342-3053994144-4245047485-1002
2026-09-23 16:20 - 2026-04-21 12:12 - 000003546 _____ C:\WINDOWS\system32\Tasks\OneDrive Startup Task-S-1-5-21-720174342-3053994144-4245047485-1002
2026-09-23 16:20 - 2026-04-21 12:12 - 000000000 ___RD C:\Users\Avi\OneDrive
2026-09-23 16:20 - 2026-04-15 16:04 - 000003592 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-720174342-3053994144-4245047485-1001
2026-09-23 16:20 - 2026-04-15 16:04 - 000003546 _____ C:\WINDOWS\system32\Tasks\OneDrive Startup Task-S-1-5-21-720174342-3053994144-4245047485-1001
2026-09-22 11:21 - 2026-04-21 18:21 - 000000000 ____D C:\Program Files\Microsoft Office
2026-09-22 11:21 - 2026-04-21 12:10 - 000000000 __SHD C:\Users\Avi\IntelGraphicsProfiles
2026-09-22 11:21 - 2026-04-15 16:04 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2026-09-22 11:21 - 2026-04-15 16:03 - 000023506 _____ C:\WINDOWS\system32\5E37410B-D6F1-471D-AE27-563CEAC0D6B2
2026-09-22 11:21 - 2026-04-15 12:08 - 000000000 ____D C:\Intel
2026-09-22 11:21 - 2024-01-01 01:14 - 000012288 ___SH C:\DumpStack.log.tmp
2026-09-21 23:04 - 2024-04-01 09:21 - 000786432 _____ C:\WINDOWS\system32\config\BBI
2026-09-20 17:28 - 2026-04-21 12:11 - 000000000 ____D C:\Users\Avi\AppData\Local\D3DSCache
2026-09-20 15:14 - 2024-01-01 01:14 - 000002438 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2026-09-20 03:53 - 2026-04-15 16:04 - 000003534 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2026-09-20 03:53 - 2026-04-15 16:04 - 000003462 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2026-09-18 12:36 - 2024-01-01 01:14 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2026-09-16 23:03 - 2026-04-21 12:10 - 000000000 ____D C:\Users\Avi
2026-09-16 19:38 - 2026-07-16 12:21 - 000000000 ____D C:\WINDOWS\Minidump
2026-09-16 19:38 - 2024-01-01 01:14 - 002412959 ____N C:\WINDOWS\Minidump\091626-15671-01.dmp
2026-09-15 13:43 - 2026-04-15 16:04 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2026-09-14 21:41 - 2024-04-01 09:26 - 000000000 ____D C:\ProgramData\USOPrivate
2026-09-14 20:46 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\bcastdvr
2026-09-14 20:25 - 2026-04-15 16:01 - 003381760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2026-09-12 17:15 - 2026-04-15 12:22 - 000000000 ____D C:\Program Files (x86)\Google
2026-09-09 21:20 - 2026-04-15 15:58 - 000483528 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2026-09-09 21:19 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\UUS
2026-09-09 21:19 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2026-09-09 21:19 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2026-09-09 21:19 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2026-09-09 21:19 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz
2026-09-09 21:19 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\InstallShield
2026-09-09 21:18 - 2026-04-15 15:35 - 000000000 ____D C:\WINDOWS\system32\ruxim
2026-09-09 21:18 - 2026-04-15 15:35 - 000000000 ____D C:\WINDOWS\system32\NarratorMCAT
2026-09-09 21:18 - 2024-04-01 18:16 - 000000000 ____D C:\WINDOWS\InboxApps
2026-09-09 21:18 - 2024-04-01 18:16 - 000000000 ____D C:\Program Files\Windows Defender Advanced Threat Protection
2026-09-09 21:18 - 2024-04-01 18:15 - 000000000 ____D C:\WINDOWS\system32\OpenSSH
2026-09-09 21:18 - 2024-04-01 18:15 - 000000000 ____D C:\WINDOWS\system32\Microsoft-Edge-WebView
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ___SD C:\WINDOWS\system32\F12
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SystemResources
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\setup
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\oobe
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\migwiz
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\HealthAttestationClient
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\Dism
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\appraiser
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\ShellExperiences
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\ShellComponents
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\Provisioning
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\L2Schemas
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\BrowserCore
2026-09-09 21:18 - 2024-04-01 09:26 - 000000000 ____D C:\Program Files\Common Files\System
2026-09-09 21:18 - 2024-04-01 09:21 - 000000000 ____D C:\WINDOWS\servicing
2026-09-09 12:22 - 2026-04-15 12:42 - 000000000 ____D C:\WINDOWS\system32\MRT
2026-09-09 12:19 - 2026-04-15 12:42 - 230964456 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2026-09-08 15:46 - 2026-04-22 16:10 - 000000000 ____D C:\Users\Avi\AppData\Roaming\Microsoft\Word
2026-09-05 20:31 - 2026-04-21 12:42 - 000001055 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Thunderbird.lnk
2026-09-03 21:58 - 2026-04-21 12:12 - 000000000 ____D C:\Users\Avi\AppData\Local\PlaceholderTileLogoFolder
2026-08-31 21:34 - 2024-01-01 01:21 - 000000000 ____D C:\ProgramData\Packages
2026-08-31 10:45 - 2026-04-21 12:45 - 000000000 ____D C:\Users\Avi\AppData\Local\Comms
2026-08-27 11:00 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\appcompat
==================== SigCheck ============================
(Er is geen automatische fix voor bestanden die de verificatie niet doorkomen.)
==================== Einde van FRST.txt ========================
Code:
ATTFilter Extra scanresultaten van Farbar Recovery Scan Tool (x64) Versie: 25-09-2026
Gestart door xxxx (25-09-2026 14:22:14)
Gestart vanaf C:\Users\xxxx\Desktop
Microsoft Windows 11 Pro Versie 25H2 26200.9457 (X64) (2026-04-15 14:04:23)
Boot Modus: Normal
==========================================================
==================== Accounts: =============================
(Als een item is opgenomen in de fixlist, zal het worden verwijderd.)
Administrator (S-1-5-21-720174342-3053994144-4245047485-500 - Administrators - Disabled)
Avi (S-1-5-21-720174342-3053994144-4245047485-1002 - Limited - Enabled) => C:\Users\Avi
DefaultAccount (S-1-5-21-720174342-3053994144-4245047485-503 - Limited - Disabled)
Gast (S-1-5-21-720174342-3053994144-4245047485-501 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-720174342-3053994144-4245047485-504 - Limited - Disabled)
xxxx (DisplayName: A** ***w) (S-1-5-21-720174342-3053994144-4245047485-1001 - Administrators - Enabled) [MS Account] => C:\Users\xxxx
==================== Security Center ========================
(Als een item is opgenomen in de fixlist, zal het worden verwijderd.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Geïnstalleerde programma's ======================
(Alleen de adware-programma's met 'verborgen' vlag kunnen worden toegevoegd aan de fixlist om ze zichtbaar te maken. De adware-programma's moeten handmatig gedeïnstalleerd worden.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 153.0.8010.54 - Google LLC)
KeePass Password Safe 2.61.1 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.61.1 - Dominik Reichl)
Microsoft 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.20326.20158 - Microsoft Corporation)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 153.0.4234.48 - Microsoft Corporation)
Microsoft Edge WebView2-Laufzeit (HKLM-x32\...\Microsoft EdgeWebView) (Version: 153.0.4234.48 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKLM\...\OneDriveSetup.exe) (Version: 26.168.0830.0006 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{ACF2602E-BD31-4BE5-AC03-9C8FDB638ADA}) (Version: 4.75.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.50.35719 (HKLM\...\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.50.35719 (HKLM\...\{61B44572-8722-4DAF-8ACF-8E742D30BCC5}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.50.35719 (HKLM-x32\...\{773AD50D-AAE6-4BA1-AD01-B5A38874C840}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.50.35719 (HKLM-x32\...\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ v14 Redistributable (x64) - 14.50.35719 (HKLM-x32\...\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}) (Version: 14.50.35719.0 - Microsoft Corporation)
Microsoft Visual C++ v14 Redistributable (x86) - 14.50.35719 (HKLM-x32\...\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}) (Version: 14.50.35719.0 - Microsoft Corporation)
Microsoft Windows Application Compatibility Fix Database (HKLM\...\{22221111-1111-1111-1111-111111111111}.sdb) (Version: - )
Mozilla Firefox (x64 de) (HKLM\...\Mozilla Firefox) (Version: 156.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 149.0.2 - Mozilla)
Mozilla Thunderbird (x64 de) (HKLM\...\Mozilla Thunderbird 154.0 (x64 de)) (Version: 154.0 - Mozilla)
NimbusPDF (HKU\S-1-5-21-720174342-3053994144-4245047485-1002\...\NimbusPDF) (Version: 5.5.0.0 - NimbusPDF)
Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.20326.20072 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM\...\{90160000-008C-0407-1000-0000000FF1CE}) (Version: 16.0.20326.20100 - Microsoft Corporation) Hidden
OneBrowser (HKU\S-1-5-21-720174342-3053994144-4245047485-1002\...\OB) (Version: 137.0.7151.69 - OneBrowser) <==== AANDACHT
Pulse Browser (HKU\S-1-5-21-720174342-3053994144-4245047485-1002\...\PulseSoftware PulseBrowser) (Version: 149.0.7827.158 - Die Pulse Browser-Autoren)
Total Commander 64-bit (Remove or Repair) (HKLM\...\Totalcmd64) (Version: 11.56 - Ghisler Software GmbH)
Update for x64-based Windows Systems (KB5001716) (HKLM\...\{DA80A019-4C3B-4DAA-ACA1-6937D7CAAF9E}) (Version: 8.94.0.0 - Microsoft Corporation)
Chrome apps:
============
Google Photos (HKU\S-1-5-21-720174342-3053994144-4245047485-1002\...\0eb83426972b3851e5119c68f5715bbd) (Version: 1.0 - Google\Chrome)
Packages:
=========
Intel® Grafik-Kontrollraum -> C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt [2026-04-15] (INTEL CORP) [Startup Task]
Local AI Manager for Microsoft 365 -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16\AI [2026-09-25] ()
Microsoft Defender -> C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4_102.2504.16004.0_x64__8wekyb3d8bbwe [2026-04-28] (Microsoft Corporation) [Startup Task]
Microsoft.Office.ActionsServer -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16\ActionsServer [2026-09-25] ()
OfficePushNotificationsUtility -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16 [2026-09-25] ()
==================== Aangepaste CLSID (gefilterd): ==============
(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers1: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers4: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
ContextMenuHandlers5: [ FileSyncEx] -> {CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B} => C:\Program Files\Microsoft OneDrive\26.168.0830.0006\FileSyncShell64.dll [2026-09-23] (Microsoft Corporation -> Microsoft Corporation)
==================== Codecs (gefilterd) ====================
==================== Snelkoppelingen & WMI ========================
(De items kunnen worden opgenomen in de fixlist.txt om hersteld of verwijderd te worden.)
ShortcutWithArgument: C:\Users\xxxx\Desktop\Profiel 1 - Edge.lnk -> C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe (Microsoft Corporation) -> --profile-directory="Default"
==================== Geladen Modules (gefilterd) =============
==================== Alternate Data Streams (gefilterd) ========
==================== Veilige Modus (gefilterd) ==================
==================== Bestandskoppeling (gefilterd) =================
==================== Internet Explorer (gefilterd) =============
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2026-08-23] (Microsoft Corporation -> Microsoft Corporation)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-08-23] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-08-23] (Microsoft Corporation -> Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-08-23] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-08-23] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-08-23] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-08-23] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-08-23] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-08-23] (Microsoft Corporation -> Microsoft Corporation)
==================== Hosts inhoud: =========================
(Indien nodig kan Hosts:-opdracht worden opgenomen in de fixlist om Hosts te resetten.)
2021-06-05 14:08 - 2021-06-05 14:08 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts
==================== Network ===========================
(Momenteel is er geen automatische fix voor dit onderdeel.)
DNS Servers: 192.168.10.1
Windows Firewall is ingeschakeld.
Network Binding:
=============
Ethernet: Realtek PCIe GbE Family Controller -> rtcx21x64.sys
WLAN: Realtek 8822CE Wireless LAN 802.11ac PCI-E NIC -> rtwlane.sys
Bluetooth-Netzwerkverbindung: Bluetooth Device (Personal Area Network) -> bthpan.sys
==================== Andere gebieden ===========================
(Momenteel is er geen automatische fix voor dit onderdeel.)
HKU\S-1-5-21-720174342-3053994144-4245047485-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\xxxx\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\Microsoft\IrisService\1109274652617376384\134213187077679456.jpg
HKU\S-1-5-21-720174342-3053994144-4245047485-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Avi\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\Microsoft\IrisService\611387295679984388\134345744694638959.jpg
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows Defender\Features => (TamperProtection: 1) (TamperProtectionSource: 5)
HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection => (DpaDisabled: 0)
==================== MSCONFIG/TASK MANAGER Uitgeschakelde items ==
==================== Firewall regels (gefilterd) ================
(Als een item is opgenomen in de fixlist, wordt het uit het register verwijderd. Het bestand zal niet worden verplaatst tenzij apart vermeld.)
FirewallRules: [{D24F05E1-0EDE-41C1-9E28-013F4C1D6779}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{193B94B9-E5DD-4F88-8D72-BC11A32A013E}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{21B791F5-5022-45A1-8FDD-0B6A19393F1C}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [EdgeWebView2-MDNS-In-UDP] => (Allow) C:\WINDOWS\system32\Microsoft-Edge-WebView\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{550BDC5D-C713-4E6E-BA1E-8DACACC617CE}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2609.44031.0_x64__8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{2474D3E1-B362-4053-A66B-B5D17E477839}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2609.44031.0_x64__8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{F69DAE9C-F281-4585-ACE6-0CCFBCBC772C}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2609.44031.0_x64__8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{053B602D-3E90-4C98-A604-35B1E3C6A92A}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2609.44031.0_x64__8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{FBFD9987-0C01-4B02-B05A-4BA833568D56}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
==================== Herstelpunten =========================
18-09-2026 12:24:26 Windows Update
22-09-2026 11:22:27 Microsoft Visual C++ v14 Redistributable (x64) - 14.50.35719
==================== Defecte Apparaatbeheer Apparaten ============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: PCI-Datensammlungs- und Signalverarbeitungscontroller
Description: PCI-Datensammlungs- und Signalverarbeitungscontroller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: PCI-Gerät
Description: PCI-Gerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: PCI-Gerät
Description: PCI-Gerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: PCI-Gerät
Description: PCI-Gerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Basissystemgerät
Description: Basissystemgerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: PCI-Gerät
Description: PCI-Gerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: PCI-Gerät
Description: PCI-Gerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: PCI-Gerät
Description: PCI-Gerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: SM-Bus-Controller
Description: SM-Bus-Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: PCI-Gerät
Description: PCI-Gerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: PCI-Gerät
Description: PCI-Gerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: PCI-Kommunikationscontroller (einfach)
Description: PCI-Kommunikationscontroller (einfach)
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Eventlog fouten: ========================
Applicatiefouten:
==================
Error: (09/25/2026 12:55:16 PM) (Source: Firefox Default Browser Agent) (EventID: 5) (User: )
Description: Event-ID 5
Error: (09/25/2026 07:34:22 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - Fehler beim Initialisieren der Profilerstellungs-API-Anfügeinfrastruktur. Dieser Prozess ermöglicht einem Profiler das Anfügen nicht. HRESULT: 0x80004005. Prozess-ID (dezimal): 14184. Meldungs-ID: [0x2509].
Error: (09/25/2026 01:32:18 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - Fehler beim Initialisieren der Profilerstellungs-API-Anfügeinfrastruktur. Dieser Prozess ermöglicht einem Profiler das Anfügen nicht. HRESULT: 0x80004005. Prozess-ID (dezimal): 14264. Meldungs-ID: [0x2509].
Error: (09/24/2026 03:03:15 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - Fehler beim Initialisieren der Profilerstellungs-API-Anfügeinfrastruktur. Dieser Prozess ermöglicht einem Profiler das Anfügen nicht. HRESULT: 0x80004005. Prozess-ID (dezimal): 19680. Meldungs-ID: [0x2509].
Error: (09/24/2026 05:37:45 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - Fehler beim Initialisieren der Profilerstellungs-API-Anfügeinfrastruktur. Dieser Prozess ermöglicht einem Profiler das Anfügen nicht. HRESULT: 0x80004005. Prozess-ID (dezimal): 10932. Meldungs-ID: [0x2509].
Error: (09/23/2026 01:22:08 PM) (Source: Microsoft-Windows-Defrag) (EventID: 264) (User: )
Description: Die Speicheroptimierung konnte Defragmentierung auf (D:) nicht abschließen. Grund: Das Dirty Bit wird auf diesem Volume festgelegt. (0x89000015)
Error: (09/23/2026 04:30:11 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - Fehler beim Initialisieren der Profilerstellungs-API-Anfügeinfrastruktur. Dieser Prozess ermöglicht einem Profiler das Anfügen nicht. HRESULT: 0x80004005. Prozess-ID (dezimal): 4384. Meldungs-ID: [0x2509].
Error: (09/22/2026 12:25:14 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - Fehler beim Initialisieren der Profilerstellungs-API-Anfügeinfrastruktur. Dieser Prozess ermöglicht einem Profiler das Anfügen nicht. HRESULT: 0x80004005. Prozess-ID (dezimal): 16372. Meldungs-ID: [0x2509].
Systeemfouten:
=============
Error: (09/25/2026 09:40:50 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3502) (User: NT-AUTORITÄT)
Description: Fehler beim Aufheben der Gerätetrennung (Entkoppelung).
Error: (09/25/2026 09:40:48 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3502) (User: NT-AUTORITÄT)
Description: Fehler beim Aufheben der Gerätetrennung (Entkoppelung).
Error: (09/25/2026 09:39:57 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3502) (User: NT-AUTORITÄT)
Description: Fehler beim Aufheben der Gerätetrennung (Entkoppelung).
Error: (09/25/2026 09:39:56 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3502) (User: NT-AUTORITÄT)
Description: Fehler beim Aufheben der Gerätetrennung (Entkoppelung).
Error: (09/25/2026 09:16:55 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3502) (User: NT-AUTORITÄT)
Description: Fehler beim Aufheben der Gerätetrennung (Entkoppelung).
Error: (09/25/2026 09:16:54 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3502) (User: NT-AUTORITÄT)
Description: Fehler beim Aufheben der Gerätetrennung (Entkoppelung).
Error: (09/25/2026 09:11:30 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3502) (User: NT-AUTORITÄT)
Description: Fehler beim Aufheben der Gerätetrennung (Entkoppelung).
Error: (09/25/2026 09:11:29 AM) (Source: Microsoft-Windows-DeviceAssociationService) (EventID: 3502) (User: NT-AUTORITÄT)
Description: Fehler beim Aufheben der Gerätetrennung (Entkoppelung).
Error: (09/13/2026 06:33:39 PM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Error: (09/12/2026 09:39:39 PM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR4 gefunden.
Error: (09/12/2026 06:25:26 PM) (Source: disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
Windows Defender:
================
TimeCreated : 9/25/2026 12:59:38 PM
Message : Microsoft Defender Antivirus şςáи ђдš ьзέñ ŝтöρφėđ вęƒöřè ĉόмφℓέŧïòň.%ñ %τŞ¢аπ
ĨĐ:%ъ{7D427987-C8AD-41E6-A69F-9400BAB4C8D9}%и %тЅ¢âл Ţỳре:%ъAntimalware%ⁿ %ţŞçăл
Ραґämёťêřѕ:%ъSchnellüberprüfung%ⁿ %τŲśêя:%вNT-AUTORITÄT\SYSTEM%й %τЅťθр Ѓεăŝŏʼn:%вŜçђеðυłèð ŝĉąň ẅаş
ŝкìρрèđ ь℮ĉãùşë ŧĥ℮ ŀаѕт ѕû¢ĉ℮ѕšƒŭĺ ѕςáл щāš щīŧħіʼn ťћę ℓαŝτ 7 ðàÿş
TimeCreated : 9/24/2026 12:12:38 PM
Message : Microsoft Defender Antivirus şςáи ђдš ьзέñ ŝтöρφėđ вęƒöřè ĉόмφℓέŧïòň.%ñ %τŞ¢аπ
ĨĐ:%ъ{E14F956E-A965-4129-B7F5-71E4A3EB7370}%и %тЅ¢âл Ţỳре:%ъAntimalware%ⁿ %ţŞçăл
Ραґämёťêřѕ:%ъSchnellüberprüfung%ⁿ %τŲśêя:%вNT-AUTORITÄT\SYSTEM%й %τЅťθр Ѓεăŝŏʼn:%вŜçђеðυłèð ŝĉąň ẅаş
ŝкìρрèđ ь℮ĉãùşë ŧĥ℮ ŀаѕт ѕû¢ĉ℮ѕšƒŭĺ ѕςáл щāš щīŧħіʼn ťћę ℓαŝτ 7 ðàÿş
TimeCreated : 9/23/2026 12:47:09 PM
Message : Microsoft Defender Antivirus şςáи ђдš ьзέñ ŝтöρφėđ вęƒöřè ĉόмφℓέŧïòň.%ñ %τŞ¢аπ
ĨĐ:%ъ{90AE9231-F37D-4B82-AB5D-C35893ABC707}%и %тЅ¢âл Ţỳре:%ъAntimalware%ⁿ %ţŞçăл
Ραґämёťêřѕ:%ъSchnellüberprüfung%ⁿ %τŲśêя:%вNT-AUTORITÄT\SYSTEM%й %τЅťθр Ѓεăŝŏʼn:%вŜçђеðυłèð ŝĉąň ẅаş
ŝкìρрèđ ь℮ĉãùşë ŧĥ℮ ŀаѕт ѕû¢ĉ℮ѕšƒŭĺ ѕςáл щāš щīŧħіʼn ťћę ℓαŝτ 7 ðàÿş
TimeCreated : 9/22/2026 12:49:46 PM
Message : Microsoft Defender Antivirus şςáи ђдš ьзέñ ŝтöρφėđ вęƒöřè ĉόмφℓέŧïòň.%ñ %τŞ¢аπ
ĨĐ:%ъ{9FD57E14-6A8D-4490-94C0-0C927F228970}%и %тЅ¢âл Ţỳре:%ъAntimalware%ⁿ %ţŞçăл
Ραґämёťêřѕ:%ъSchnellüberprüfung%ⁿ %τŲśêя:%вNT-AUTORITÄT\SYSTEM%й %τЅťθр Ѓεăŝŏʼn:%вҐРĈ ĉоⁿŋёćťìθń гΰηďőωл
TimeCreated : 9/21/2026 12:25:49 PM
Message : Microsoft Defender Antivirus şςáи ђдš ьзέñ ŝтöρφėđ вęƒöřè ĉόмφℓέŧïòň.%ñ %τŞ¢аπ
ĨĐ:%ъ{C1D77AA7-A502-40C9-8DC8-A5441AA4826F}%и %тЅ¢âл Ţỳре:%ъAntimalware%ⁿ %ţŞçăл
Ραґämёťêřѕ:%ъSchnellüberprüfung%ⁿ %τŲśêя:%вNT-AUTORITÄT\SYSTEM%й %τЅťθр Ѓεăŝŏʼn:%вҐРĈ ĉоⁿŋёćťìθń гΰηďőωл
TimeCreated : 9/21/2026 12:16:05 PM
Message : Microsoft Defender Antivirus şςáи ђдš ьзέñ ŝтöρφėđ вęƒöřè ĉόмφℓέŧïòň.%ñ %τŞ¢аπ
ĨĐ:%ъ{01304154-4C09-4F48-87A6-B67A2DF1C59A}%и %тЅ¢âл Ţỳре:%ъAntimalware%ⁿ %ţŞçăл
Ραґämёťêřѕ:%ъSchnellüberprüfung%ⁿ %τŲśêя:%вNT-AUTORITÄT\SYSTEM%й %τЅťθр Ѓεăŝŏʼn:%вҐРĈ ĉоⁿŋёćťìθń гΰηďőωл
TimeCreated : 9/20/2026 12:22:12 PM
Message : Microsoft Defender Antivirus şςáи ђдš ьзέñ ŝтöρφėđ вęƒöřè ĉόмφℓέŧïòň.%ñ %τŞ¢аπ
ĨĐ:%ъ{CDCFAD25-D9E2-4A90-9CBA-0F7C72CDC71A}%и %тЅ¢âл Ţỳре:%ъAntimalware%ⁿ %ţŞçăл
Ραґämёťêřѕ:%ъSchnellüberprüfung%ⁿ %τŲśêя:%вNT-AUTORITÄT\SYSTEM%й %τЅťθр Ѓεăŝŏʼn:%вŜçђеðυłèð ŝĉąň ẅаş
ŝкìρрèđ ь℮ĉãùşë ŧĥ℮ ŀаѕт ѕû¢ĉ℮ѕšƒŭĺ ѕςáл щāš щīŧħіʼn ťћę ℓαŝτ 7 ðàÿş
TimeCreated : 9/14/2026 2:19:46 PM
Message : Microsoft Defender Antivirus şςáи ђдš ьзέñ ŝтöρφėđ вęƒöřè ĉόмφℓέŧïòň.%ñ %τŞ¢аπ
ĨĐ:%ъ{1FBC6152-572E-432C-B25B-8C76BAAACAE3}%и %тЅ¢âл Ţỳре:%ъAntimalware%ⁿ %ţŞçăл
Ραґämёťêřѕ:%ъSchnellüberprüfung%ⁿ %τŲśêя:%вNT-AUTORITÄT\SYSTEM%й %τЅťθр Ѓεăŝŏʼn:%вŜčђέđüľёď ş¢àń ẅаѕ
ѕкĭφρëð ъєċαџšέ ŧнë ĺáśţ šцċçëšѕƒųℓ śčάñ ŵãѕ ẃìŧĥϊй ťħё ℓαşт 7 ďάỳş
CodeIntegrity:
===============
Date: 2026-09-25 14:10:12
Description:
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\DefenderSessionHelper.exe because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
Geändert von cosinus (Heute um 18:53 Uhr) Grund: CODE-Tags |
|
Heute, 18:23
| #2 |
| /// TB-Ausbilder   | Trojanerfundmeldung - Win11 findet keine Malware - Meldung erscheint immer wieder Mein Name ist Matthias und ich werde dir bei der Analyse und Bereinigung deines Systems helfen. Dein System ist mit Adware / PUP infiziert. Schritt 1 Führe AdwCleaner gemäß der bebilderten Anleitung aus und poste abschließend die Logdatei. Schritt 2 Führe Malwarebytes' AntiMalware (MBAM) gemäß der bebilderten Anleitung aus und poste abschließend die Logdatei.
__________________ Geändert von M-K-D-B (Heute um 18:49 Uhr) |
|
| Themen zu Trojanerfundmeldung - Win11 findet keine Malware - Meldung erscheint immer wieder |
| antivirus, browser, fehler, firefox, google, homepage, installation, internet, internet explorer, malware, mozilla, performance, popup, prozess, realtek, scan, security, server, software, svchost.exe, system, trojaner, trojanerfund - worm - malware, updates, warnung, windows |
Linear-Darstellung
