| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-ProblemeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
23.10.2026, 14:26
| #1 |
| |  Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Hallo zusammen, ich befürchte, dass mein Laptop (HP ZBook Power G9, Windows 11) möglicherweise mit Malware infiziert ist, und würde mich über eure Hilfe freuen. Am 21.10. ist mir aufgefallen, dass ich sowohl aus meinem Google- als auch aus meinem Firefox-Konto ausgeloggt war. Außerdem waren plötzlich sämtliche Firefox-Erweiterungen (u. a. Bitwarden und uBlock Origin) deaktiviert. In meinem Google-Konto fand ich eine kritische Sicherheitswarnung über verdächtige Aktivitäten auf einem Windows-Gerät am 20.10. um 03:00 Uhr. Google hatte mich daraufhin offenbar automatisch abgemeldet. Was genau passiert ist, konnte ich leider nicht herausfinden. Daraufhin habe ich folgende Schritte unternommen: • Google-Passwort geändert, aktive Sitzungen und verbundene Apps überprüft. 2FA war bereits aktiviert. Keine weiteren Auffälligkeiten gefunden. • Microsoft Defender Offline-Scan durchgeführt. Dieser schien durchzulaufen, anschließend blieb Windows allerdings bei der Wiederherstellung hängen. Nach einem Neustart funktionierte wieder alles normal. Keine Funde. • Vollständigen Microsoft Defender-Scan Full-Scan durchgeführt: keine Funde. • Malwarebytes-Scan durchgeführt: ebenfalls keine Funde. • Nochmal ein weiteres Backup auf einer externen SSD gemacht (zusätzlich zu existierenden) Zusätzlich ist mir aufgefallen, dass Google auf dem Laptop wiederholt CAPTCHAs mit dem Hinweis auf ungewöhnlichen Netzwerkverkehr anzeigt. Auf meinem Smartphone tritt das im selben WLAN nicht auf. Einen VPN nutze ich nicht. Dieses Verhalten ist neu und hat in etwa zeitgleich mit den anderen beschriebenen Problemen bekommen. Ob die verschiedenen Auffälligkeiten zusammenhängen, kann ich nicht beurteilen. Insbesondere die Google-Sicherheitswarnung macht mir Sorgen. Vielen Dank schon einmal für eure Hilfe! LG Max FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-10-2026
Ran by Max (administrator) on DESKTOP-TSSNE97 (HP HP ZBook Power 15.6 inch G9 Mobile Workstation PC) (23-10-2026 14:42:33)
Running from C:\Users\Max\Downloads\FRST64.exe
Loaded Profiles: Max
Platform: Microsoft Windows 11 Pro Version 25H2 26200.9711 (X64) Language: German (Germany) -> English (United Kingdom)
Default browser: FF
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe
(C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe ->) (Adobe Inc. -> ) C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\CoreSync.exe
(C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe
(C:\Program Files (x86)\Steam\steam.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
(C:\Program Files\Common Files\Native Instruments\NTK\NTKDaemon.exe ->) (Native Instruments GmbH -> ) C:\Program Files\Common Files\Native Instruments\NTK\crashpad_handler.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
(C:\Program Files\Mozilla Firefox\firefox.exe ->) (Mozilla Corporation -> Mozilla Foundation) C:\Program Files\Mozilla Firefox\crashhelper.exe
(C:\Program Files\Mozilla Thunderbird\thunderbird.exe ->) (Mozilla Corporation -> Mozilla Foundation) C:\Program Files\Mozilla Thunderbird\crashhelper.exe
(C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.exe ->) (Intel Corporation -> Intel Corporation) C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.Graphics.exe
(C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.exe ->) (Intel Corporation -> Intel(R) Corporation) C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\PresentMonService.exe
(C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe ->) (Spotify AB -> ) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\crashpad_handler.exe
(C:\ProgramData\Ableton\Live 12 Suite\Program\Ableton Live 12 Suite.exe ->) (Ableton AG -> ) C:\ProgramData\Ableton\Live 12 Suite\Resources\Extensions\Index\Ableton Index.exe
(dllhost.exe ->) (HP Inc. -> HP) C:\Program Files (x86)\HP\HP Notifications\HPNotifications.exe
(DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\NetworkCap.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\BridgeCommunication.exe
(DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_uf.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_helper.exe
(DriverStore\FileRepository\snapo64.inf_amd64_33d62b688b005396\SNAPOSS64.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Sonitude Corporation) C:\Windows\System32\DriverStore\FileRepository\snapo64.inf_amd64_33d62b688b005396\SNAPOS64.exe
(Dynalist Inc -> Obsidian) C:\Users\Max\AppData\Local\Programs\Obsidian\Obsidian.exe <3>
(explorer.exe ->) (Dynalist Inc -> Obsidian) C:\Users\Max\AppData\Local\Programs\Obsidian\Obsidian.exe
(explorer.exe ->) (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering, Ltd.) C:\Program Files\Focusrite\Drivers\Focusrite Notifier.exe
(explorer.exe ->) (IDRIX SARL -> IDRIX) C:\Program Files\VeraCrypt\VeraCrypt.exe
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
(explorer.exe ->) (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe
(explorer.exe ->) (Native Instruments GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareAccessibilityHelper.exe
(explorer.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e80b0ba89d6747cf\RtkAudUService64.exe
(explorer.exe ->) (Samsung Electronics CO., LTD. -> ) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(explorer.exe ->) (Thesycon Software Solutions GmbH & Co. KG -> ) C:\Program Files\Ableton\USB Audio Driver\x64\AbletonAudioCpl.exe
(HP Inc. -> ) C:\Program Files\WindowsApps\AD2F1837.myHP_61.52637.14262.0_x64__v10z8vjag6ke6\win32\DesktopExtension.exe
(HP Inc. -> HP Inc) C:\Program Files\WindowsApps\AD2F1837.myHP_61.52637.14262.0_x64__v10z8vjag6ke6\win32\HP.ContextAware.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\155.0.4283.62\msedgewebview2.exe <5>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\UUS\amd64\MoNotificationUx.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <19>
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe <4>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <2>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\NVWMI\nvWmi64.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e80b0ba89d6747cf\RtkAudUService64.exe
(services.exe ->) () [File not signed] C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(services.exe ->) (Bromium UK Limited -> HP) C:\Program Files\HP\Security Update Service\4.4.34.927\SecurityUpdateService.exe
(services.exe ->) (ELAN MICROELECTRONICS CORPORATION -> ELAN Microelectronics Corp.) C:\Windows\System32\ELAN_MOC_Service.exe
(services.exe ->) (FOR TESTING ONLY - IPF_PreProd_Cert -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dtt_sw.inf_amd64_683097297aaa9bb4\ipfsvc.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Program Files\HPCommRecovery\HPCommRecovery.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_b532962506597d3d\x64\TouchpointAnalyticsClientService.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\AppHelperCap.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\DiagsCap.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\NetworkCap.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\SysInfoCap.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\HotKeyServiceUWP.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\HPAudioAnalytics.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\LanWlanWwanSwitchingServiceUWP.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpsfuservice.inf_amd64_03ebfd05b519032c\HpSfuService64.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpsvcsscancomp.inf_amd64_df5bc9f22dc3c742\x64\hpsvcsscan.exe
(services.exe ->) (HP Inc. -> HP) C:\Program Files (x86)\HP\Shared\hpqwmiex.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_b45f13a105037dbe\jhi_service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_6d3406ba86e014cf\IntelCpHDCPSvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_uf.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_92a56761ef7ba712\WMIRegistrationService.exe
(services.exe ->) (Intel Corporation -> Intel(R) Corporation) C:\Windows\SysWOW64\XtuService.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Windows\System32\DriverStore\FileRepository\intcoed.inf_amd64_a952167d9e98b004\AS\IAS\IntelAudioService.exe
(services.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MidiSrv.exe
(services.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Fortemedia) C:\Windows\System32\FMService64.exe
(services.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Sonitude Corporation) C:\Windows\System32\DriverStore\FileRepository\snapo64.inf_amd64_33d62b688b005396\SNAPOSS64.exe
(services.exe ->) (Native Instruments GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(services.exe ->) (Native Instruments GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHostIntegrationAgent.exe
(services.exe ->) (Native Instruments GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\NTK\NTKDaemon.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\Display.NvContainer\NVDisplay.Container.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\NVWMI\nvWmi64.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e80b0ba89d6747cf\RtkAudUService64.exe
(services.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\steamservice.exe
(sihost.exe ->) (Ableton AG -> Ableton) C:\ProgramData\Ableton\Live 12 Suite\Program\Ableton Live 12 Suite.exe
(sihost.exe ->) (Microsoft Corporation -> ) C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4_102.2608.18002.0_x64__8wekyb3d8bbwe\MicrosoftSecurityApp\MicrosoftSecurityApp.exe
(sihost.exe ->) (Musecy SM Ltd. -> Muse) C:\Program Files\WindowsApps\Muse.MuseHub_2.0.22.1414_x64__rb9pth70m6nz6\Muse.exe
(sihost.exe ->) (Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe
(Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe <8>
(svchost.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files\Common Files\Adobe\Adobe OS Extension\AdobeNotificationClient.exe
(svchost.exe ->) (HP Inc. -> HP Inc.) C:\Program Files\HP\HP Client Security Manager\HP.ClientSecurityManager.exe
(svchost.exe ->) (HP) [File not signed] C:\Program Files (x86)\HP\HP ICS\ICS.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.StartExperiencesApp_1.398.2.0_x64__8wekyb3d8bbwe\MicrosoftStartFeedProvider\MicrosoftStartFeedProvider.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Users\Max\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\FileCoAuth.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\NgcIso.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppActions.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SoftLandingTask\SoftLandingTask.exe
(Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe <6>
(Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\steam.exe
Failed to access process -> vmmemCmZygote
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e80b0ba89d6747cf\RtkAudUService64.exe [3495976 2026-08-03] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [464608 2014-09-08] (Samsung Electronics CO., LTD. -> )
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-10] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM\...\Run: [Focusrite Notifier] => C:\Program Files\Focusrite\Drivers\Focusrite Notifier.exe [906840 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering, Ltd.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch [3952720 2022-06-01] (Microsoft Windows Hardware Compatibility Publisher -> Logitech, Inc.)
HKLM\...\Run: [Logi Download Assistant] => C:\Program Files\LogiDownloadAssistant\bin\logi_download_assistant.exe [19199488 2026-05-19] (Logitech, Inc.) [File not signed]
HKLM-x32\...\Run: [HPNotifications] => C:\Program Files (x86)\HP\HP Notifications\HPNotifications.exe [1607816 2021-02-11] (HP Inc. -> HP)
HKLM-x32\...\Run: [Adobe CCXProcess] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe [133128 2025-12-21] (Adobe Inc. -> Adobe Inc.)
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [com.evernote.Evernote] => C:\Users\Max\AppData\Local\Programs\Evernote\Evernote.exe [186384464 2025-02-05] (Evernote Corporation -> Evernote Corporation)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [5823128 2026-10-13] (Valve Corp. -> Valve Corporation)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [electron.app.Notion] => C:\Users\Max\AppData\Local\Programs\Notion\Notion.exe --open-at-login (No File)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [MicrosoftEdgeAutoLaunch_0C0D5F59005A32876380EE3B976869A6] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5438320 2026-10-16] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [GoogleUpdaterTaskUser157.0.8089.0] => C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe [9958552 2026-10-06] (Google LLC -> Google LLC)
HKLM\...\Windows x64\Print Processors\us016PC: C:\Windows\System32\spool\prtprocs\x64\us016pc.dll [61736 2022-02-24] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Codename Longhorn DDK provider)
HKLM\...\Print\Monitors\us016 Langmon: C:\WINDOWS\system32\us016lm.dll [40744 2022-02-24] (Microsoft Windows Hardware Compatibility Publisher -> )
AppInit_DLLs: c:\PROGRA~1\HP\SURECL~1\servers\BemHook.dll => No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ableton USB Audio Control Panel Autostart.lnk [2024-10-20]
ShortcutTarget: Ableton USB Audio Control Panel Autostart.lnk -> C:\Program Files\Ableton\USB Audio Driver\x64\AbletonAudioCpl.exe (Thesycon Software Solutions GmbH & Co. KG -> )
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NIHardwareAccessibilityHelper.exe.lnk [2025-08-15]
ShortcutTarget: NIHardwareAccessibilityHelper.exe.lnk -> C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareAccessibilityHelper.exe (Native Instruments GmbH -> Native Instruments GmbH)
GroupPolicy: Restriction - Chrome <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
==================== Scheduled Tasks (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {4B664E1F-0135-4E8C-9111-9EC7D8564C9C} - System32\Tasks\Adobe Creative Cloud => C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2526688 2026-08-09] (Adobe Inc. -> Adobe Inc.)
Task: {FFCAC060-F32D-46D7-B285-75A677E275EB} - System32\Tasks\Adobe Uninstaller => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [446432 2026-08-09] (Adobe Inc. -> Adobe Inc.)
Task: {E0AE496B-3D72-4199-9443-AA18ED717B30} - System32\Tasks\GoogleUser\GoogleUpdater\GoogleUpdaterTaskUser157.0.8089.0{2BAF6901-F450-4A6E-83B9-B4857DD5C8CE} => C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe [9958552 2026-10-06] (Google LLC -> Google LLC)
Task: {D5C82890-1F3E-4CE3-88EC-1CBE58277897} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\HP\HP Support Framework\Resources\HPSFReport.exe [480264 2026-08-13] (HP Inc. -> HP Inc.)
Task: {462495A0-DED9-4816-85F8-53086EA08498} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\HP\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1178696 2026-08-13] (HP Inc. -> HP Inc.)
Task: {10A29C9A-C44B-4CC1-87BB-47304EE2AFF9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\HP\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1178696 2026-08-13] (HP Inc. -> HP Inc.)
Task: {982F0742-CE09-42A5-A638-2D439839B13D} - System32\Tasks\HP\Consent Manager Launcher => C:\WINDOWS\system32\sc.exe [102400 2025-07-08] (Microsoft Windows -> Microsoft Corporation) -> start hptouchpointanalyticsservice
Task: {481DC351-7E79-470E-8F69-49CEE9EB3AD9} - System32\Tasks\HP\HP ICS\ICS => C:\Program Files (x86)\HP\HP ICS\ICS.exe [76824576 2022-05-06] (HP) [File not signed]
Task: {0728873B-9E3C-47FE-ACD4-EC001FB2AC5A} - System32\Tasks\HP\HP Wolf Security\Launch Console => C:\Program Files\HP\HP Client Security Manager\HP.ClientSecurityManager.exe [263752 2026-07-13] (HP Inc. -> HP Inc.)
Task: {B597665C-A2F0-4D37-B866-534EF1D4A93D} - System32\Tasks\Launch Adobe CCXProcess => C:\Program Files\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe [194112 2026-08-09] (Adobe Inc. -> Adobe Inc.)
Task: {EB1E27A6-A0B4-4512-883C-70856E9626D8} - System32\Tasks\Microsoft\Office\Office Actions Server => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ActionsServer\ActionsServer.exe [16430896 2026-10-18] (Microsoft Corporation -> Microsoft Corporation)
Task: {C33E3793-E27A-4A7C-8F34-F13B5FA9DFD7} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [29735232 2026-10-13] (Microsoft Corporation -> Microsoft Corporation)
Task: {EA4C141F-914E-43BE-96CE-8F723C1407D9} - System32\Tasks\Microsoft\Office\Office Background Push Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\opushutil.exe [15108960 2026-10-18] (Microsoft Corporation -> Microsoft Corporation)
Task: {38D8F0CC-9241-41A1-A134-B5BEA0481EAE} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [29735232 2026-10-13] (Microsoft Corporation -> Microsoft Corporation)
Task: {4405FBC6-C246-47F9-B9E4-C96E565647AF} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [427296 2026-10-18] (Microsoft Corporation -> Microsoft Corporation)
Task: {0A61EB51-E6A2-4C4A-807D-5BB9C0A97618} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [427296 2026-10-18] (Microsoft Corporation -> Microsoft Corporation)
Task: {D144E639-5B99-4628-8ABA-D64107E5494C} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\operfmon.exe [1325424 2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {2AFF8E7F-F468-4793-81CF-16A535B7B63E} - System32\Tasks\Microsoft\Office\Office Startup Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ActionsServer\ActionsServer.exe [16430896 2026-10-18] (Microsoft Corporation -> Microsoft Corporation)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File)
Task: {4F377EA7-6024-40A9-84A9-A1DF64484192} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [1080448 2026-10-20] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (the data entry has 6 more characters).
Task: {8A3F38F1-4048-47A5-8B1B-4F6671471F78} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-571881649-101344733-3185888103-1002 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [1080448 2026-10-20] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (the data entry has 6 more characters).
Task: {4F57E2E1-C128-47CC-8556-8EF63354E9C9} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [44160 2026-10-20] (Mozilla Corporation -> Mozilla Foundation)
Task: {329CF4E3-0C77-4EE3-A6C5-E0747B2BC40C} - System32\Tasks\NVIDIA App SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA App\CEF\NVIDIA App.exe [3346544 2026-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {A120F86D-A9FB-4E16-B28C-9C62FCD0646E} - System32\Tasks\nWizard_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [1546280 2022-08-24] (Nvidia Corporation -> NVIDIA Corporation) -> C:\Program Files\NVIDIA Corporation\nview\/installquiet
Task: {7D9B41AC-F03F-4C24-A084-E62E7675F460} - System32\Tasks\SoftLanding\S-1-5-21-571881649-101344733-3185888103-1002\SoftLandingRefreshForExpirationTask-{bb81c0f5-21c5-4153-b8eb-e09718bd964b} => {F576B2F9-7850-4226-ADB0-E5993FED4F02}
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}\64259445A51224F6870264F6E60275C414E40273336303: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}\64259445A51224F6870264F6E60275C414E40273336303: [DhcpDomain] fritz.box
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}\84F6D656F56424: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}\84F6D656F56424: [DhcpDomain] fritz.box
FireFox:
========
FF TaskBarID: 6F114386CDBCE31 -> C:\Users\Max\AppData\Local\Mozilla Firefox
FF TaskBarID: 308046B0AF4A39CB -> C:\Program Files\Mozilla Firefox
FF DefaultProfile: 2yd52xta.default-release -> 308046B0AF4A39CB
FF DefaultProfile: 2yd52xta.default-release -> 641D10338ABA448D
FF ProfilePath: C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\9eh18pfb.default [2026-10-21]
FF ProfilePath: C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release [2026-10-23]
FF Homepage: Mozilla\Firefox\Profiles\2yd52xta.default-release -> hxxps://calendar.google.com/calendar/r
FF Notifications: Mozilla\Firefox\Profiles\2yd52xta.default-release -> hxxps://pomofocus.io; hxxps://mapio.net; hxxps://mail.proton.me; hxxps://app.zoom.us
FF Extension: (LeechBlock NG) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\leechblockng@proginosko.com.xpi [2026-09-29]
FF Extension: (Unhook - Remove YouTube Recommended & Shorts) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\myallychou@gmail.com.xpi [2026-04-10]
FF Extension: (uBlock Origin) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\uBlock0@raymondhill.net.xpi [2026-09-27]
FF Extension: (Bitwarden Password Manager) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\{446900e4-71c2-419f-a6a7-df9c091e268b}.xpi [2025-07-07]
FF Extension: (Stylebot) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\{52bda3fd-dc48-4b3d-a7b9-58af57879f1e}.xpi [2026-10-17]
FF Extension: (Video Download Helper) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2026-10-21]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2026-08-22] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2026-08-09] (Adobe Inc. -> Adobe Systems)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2026-08-22] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2026-08-09] (Adobe Inc. -> Adobe Systems)
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default [2026-08-21]
Edge StartupUrls: Default -> "hxxp://google.com/"
Edge Extension: (Google Docs Offline) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2025-12-21]
Edge Extension: (video downloader - CocoCut) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hcppimlenafppomfhfmlfckomalgmmga [2026-07-19]
Edge Extension: (LeechBlock NG) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hnncfhodpmpjchmmcnimoimkcojdmfhl [2026-03-22]
Edge Extension: (Edge relevant text changes) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-02-03]
Edge Extension: (uBlock Origin) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\odfafepnkmbhccpbejgmiehpchacaeak [2026-07-19]
Chrome:
=======
CHR Profile: C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default [2026-08-21]
CHR DefaultSearchURL: Default -> hxxps://search.brave.com/search?q={searchTerms}
CHR DefaultSearchKeyword: Default -> search.brave.com
CHR DefaultSuggestURL: Default -> hxxps://search.brave.com/api/suggest?q={searchTerms}
CHR Extension: (Adobe Acrobat: PDF edit, convert, sign tools) - C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2026-06-15]
CHR Extension: (Google Docs Offline) - C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-06-15]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2025-12-06]
CHR HKU\S-1-5-21-571881649-101344733-3185888103-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [944608 2026-08-09] (Adobe Inc. -> Adobe Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [12714304 2026-10-13] (Microsoft Corporation -> Microsoft Corporation)
R2 dptftcs; C:\WINDOWS\System32\DriverStore\FileRepository\dtt_sw.inf_amd64_683097297aaa9bb4\ipfsvc.exe [562040 2024-05-24] (FOR TESTING ONLY - IPF_PreProd_Cert -> Intel Corporation)
R2 ELAN_MOC_Service; C:\WINDOWS\System32\ELAN_MOC_Service.exe [249856 2026-06-12] (ELAN MICROELECTRONICS CORPORATION -> ELAN Microelectronics Corp.)
R2 FMAPOService; C:\WINDOWS\System32\FMService64.exe [1028024 2024-05-17] (Microsoft Windows Hardware Compatibility Publisher -> Fortemedia)
R2 Focusrite Control Server; C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe [1297920 2024-03-11] () [File not signed]
R2 HotKeyServiceUWP; C:\WINDOWS\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\HotKeyServiceUWP.exe [1487016 2026-03-13] (HP Inc. -> HP Inc.)
R2 HP Comm Recover; C:\Program Files\HPCommRecovery\HPCommRecovery.exe [893984 2022-08-15] (HP Inc. -> HP Inc.)
R2 HPAppHelperCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\AppHelperCap.exe [909464 2025-09-30] (HP Inc. -> HP Inc.)
R2 HPAudioAnalytics; C:\WINDOWS\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\HPAudioAnalytics.exe [496808 2026-03-13] (HP Inc. -> HP Inc.)
R2 HPDiagsCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\DiagsCap.exe [907936 2025-09-30] (HP Inc. -> HP Inc.)
R2 HPNetworkCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\NetworkCap.exe [903840 2025-09-30] (HP Inc. -> HP Inc.)
R3 hpqcaslwmiex; C:\Program Files (x86)\HP\Shared\hpqwmiex.exe [1149448 2020-07-23] (HP Inc. -> HP)
R2 hpsvcsscan; C:\WINDOWS\System32\DriverStore\FileRepository\hpsvcsscancomp.inf_amd64_df5bc9f22dc3c742\x64\hpsvcsscan.exe [7142248 2026-02-18] (HP Inc. -> HP Inc.)
R2 HPSysInfoCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\SysInfoCap.exe [909464 2025-09-30] (HP Inc. -> HP Inc.)
R2 HpTouchpointAnalyticsService; C:\WINDOWS\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_b532962506597d3d\x64\TouchpointAnalyticsClientService.exe [639776 2025-10-01] (HP Inc. -> HP Inc.)
S2 Intel(R) Platform License Manager Service; C:\WINDOWS\System32\DriverStore\FileRepository\iclsclient.inf_amd64_b4ad878dc01a7e41\lib\PlatformLicenseManagerService.exe [741600 2024-03-13] (Intel Corporation -> Intel(R) Corporation)
R2 IntelAudioService; C:\WINDOWS\System32\DriverStore\FileRepository\intcoed.inf_amd64_a952167d9e98b004\AS\IAS\IntelAudioService.exe [532960 2025-12-16] (Intel Corporation -> Intel)
R2 IntelGraphicsSoftwareService; C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.exe [324040 2026-10-14] (Intel Corporation -> Intel Corporation)
R2 ipfsvc; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_uf.exe [3084992 2024-05-23] (Intel Corporation -> Intel Corporation)
R2 LanWlanWwanSwitchingServiceUWP; C:\WINDOWS\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\LanWlanWwanSwitchingServiceUWP.exe [594600 2026-03-13] (HP Inc. -> HP Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [11667696 2026-10-21] (Malwarebytes Inc -> Malwarebytes)
S3 MBVpnTunnelService; C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe [4291576 2026-10-21] (Malwarebytes Inc -> Malwarebytes)
S3 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpDefenderCoreService.exe [2398680 2026-10-14] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 Muse Hub Updater Service; C:\Program Files\WindowsApps\Muse.MuseHub_2.0.22.1414_x64__rb9pth70m6nz6\Muse.Updater.exe [6213200 2024-11-01] (Musecy SM Ltd. -> Muse.Updater)
R2 NIHostIntegrationAgent; C:\Program Files\Common Files\Native Instruments\Hardware\NIHostIntegrationAgent.exe [27618648 2025-03-20] (Native Instruments GmbH -> Native Instruments GmbH)
R2 NTKDaemonService; C:\Program Files\Common Files\Native Instruments\NTK\NTKDaemon.exe [18193304 2025-10-09] (Native Instruments GmbH -> Native Instruments GmbH)
R2 NVDisplay.ContainerLocalSystem; C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\Display.NvContainer\NVDisplay.Container.exe [1702632 2026-03-18] (NVIDIA Corporation -> NVIDIA Corporation)
R2 NVWMI; C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\NVWMI\nvWmi64.exe [4568808 2026-03-18] (NVIDIA Corporation -> NVIDIA Corporation)
R2 SecurityUpdateService; C:\Program Files\HP\Security Update Service\4.4.34.927\SecurityUpdateService.exe [5314376 2026-10-01] (Bromium UK Limited -> HP)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [914752 2026-09-13] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SFUService; C:\WINDOWS\System32\DriverStore\FileRepository\hpsfuservice.inf_amd64_03ebfd05b519032c\HpSfuService64.exe [961192 2026-06-23] (HP Inc. -> HP Inc.)
R2 SNAPOService; C:\WINDOWS\System32\DriverStore\FileRepository\snapo64.inf_amd64_33d62b688b005396\SNAPOSS64.exe [830232 2025-12-17] (Microsoft Windows Hardware Compatibility Publisher -> Sonitude Corporation)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\NisSrv.exe [5555528 2026-10-14] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MsMpEng.exe [378168 2026-10-14] (Microsoft Windows Publisher -> Microsoft Corporation)
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 arturiausbmidi; C:\WINDOWS\System32\DriverStore\FileRepository\arturiausbmidi.inf_amd64_3b60ea58f3448d4a\arturiausbmidi.sys [434352 2024-11-28] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 arturiausbmidiks; C:\WINDOWS\System32\DriverStore\FileRepository\arturiausbmidiks.inf_amd64_82108088788d0cec\arturiausbmidiks.sys [55480 2024-11-28] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 atc; C:\WINDOWS\System32\DRIVERS\atc.sys [5579176 2023-06-01] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender S.R.L. Bucharest, ROMANIA)
R3 bomebus; C:\WINDOWS\System32\drivers\bomebus.sys [56376 2018-05-16] (Bome Software GmbH & Co.KG -> Bome Software GmbH & Co. KG)
S3 bomemidi; C:\WINDOWS\system32\drivers\bomemidi.sys [50744 2018-05-16] (Bome Software GmbH & Co.KG -> Bome Software GmbH & Co. KG)
S3 BTHMODEM; C:\WINDOWS\System32\drivers\bthmodem.sys [110592 2025-02-16] (Microsoft Corporation) [File not signed]
S3 Ccx01000; C:\WINDOWS\System32\drivers\Ccx01000.sys [692224 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus2.sys [176976 2026-04-21] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
R3 e1dexpress; C:\WINDOWS\System32\DriverStore\FileRepository\e1d.inf_amd64_f3c6513565231a23\e1d.sys [609456 2022-11-14] (Intel Corporation -> Intel Corporation)
R1 ESProtectionDriver; \??\C:\WINDOWS\system32\drivers\mbae.sys [159296 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> )
R3 FocusritePCIeSwRoot; C:\WINDOWS\System32\drivers\FocusritePCIeSwRoot.sys [106208 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsb; C:\WINDOWS\System32\drivers\FocusriteUsb.sys [170312 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbAudio; C:\WINDOWS\System32\drivers\FocusriteUsbAudio.sys [109896 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbMidi; C:\WINDOWS\System32\drivers\FocusriteUsbMidi.sys [53576 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbSwRoot; C:\WINDOWS\System32\drivers\FocusriteUsbSwRoot.sys [112968 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R0 fse; C:\WINDOWS\System32\drivers\fse.sys [240968 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
R1 Gemma; C:\WINDOWS\System32\DRIVERS\gemma.sys [1322912 2023-06-01] (Microsoft Windows Hardware Compatibility Publisher -> BitDefender S.R.L. Bucharest, ROMANIA)
R3 HPCustomCapDriver; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapdriver.inf_amd64_1421dec2010cc057\x64\hpcustomcapdriver.sys [18984 2024-05-07] (Microsoft Windows Hardware Compatibility Publisher -> HP Inc.)
R3 iaLPSS2_GPIO2_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_gpio2_adl.inf_amd64_302e75596cffa74a\iaLPSS2_GPIO2_ADL.sys [150616 2022-10-18] (Intel Corporation -> Intel Corporation)
R3 iaLPSS2_I2C_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_i2c_adl.inf_amd64_e736c048ca307ed2\iaLPSS2_I2C_ADL.sys [220224 2022-10-18] (Intel Corporation -> Intel Corporation)
R3 iaLPSS2_SPI_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_spi_adl.inf_amd64_334c460fea9b11a4\iaLPSS2_SPI_ADL.sys [171608 2022-10-18] (Intel Corporation -> Intel Corporation)
R3 iaLPSS2_UART2_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_uart2_adl.inf_amd64_43d5df63d19fde70\iaLPSS2_UART2_ADL.sys [329320 2022-10-18] (Intel Corporation -> Intel Corporation)
R3 IntcUSB; C:\WINDOWS\System32\DriverStore\FileRepository\intcusb.inf_amd64_7e96b5cfecffcac7\IntcUSB.sys [949216 2025-12-16] (Intel Corporation -> Intel(R) Corporation)
R3 IntelGNA; C:\WINDOWS\System32\DriverStore\FileRepository\gna.inf_amd64_04d4eecc5838a558\gna.sys [88760 2022-07-06] (Intel Corporation -> Intel Corporation)
R3 ipf_acpi; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_acpi.inf_amd64_d8fafa4e2f98ceba\ipf_acpi.sys [88768 2024-05-23] (Intel Corporation -> Intel Corporation)
R3 ipf_cpu; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_cpu.sys [88144 2024-05-23] (Intel Corporation -> Intel Corporation)
R3 ipf_lf; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_lf.sys [499392 2024-05-23] (Intel Corporation -> Intel Corporation)
S3 KslD; C:\WINDOWS\System32\drivers\wd\KslD.sys [82968 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
S2 l1vhlwf; C:\WINDOWS\System32\drivers\l1vhlwf.sys [155000 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
R2 mbamchameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [235624 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [22120 2026-10-21] (Microsoft Windows Early Launch Anti-Malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\Drivers\farflt11.sys [217704 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\System32\Drivers\mbam.sys [133224 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [245864 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMWebProtection; \??\C:\WINDOWS\system32\DRIVERS\mwac.sys [190096 2026-10-21] (Malwarebytes Inc -> )
S3 nimm3dfu; C:\WINDOWS\System32\drivers\nimm3dfu.sys [39824 2018-10-16] (Native Instruments GmbH -> Native Instruments GmbH)
R3 nvpcf; C:\WINDOWS\System32\drivers\nvpcf.sys [308456 2026-03-17] (NVIDIA Corporation -> NVIDIA Corporation)
R2 SSPORT; \??\C:\windows\system32\Drivers\SSPORT.sys [14224 2022-05-02] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [174416 2026-04-21] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
S3 USBMidi2; C:\WINDOWS\System32\DriverStore\FileRepository\usbmidi2.inf_amd64_b65e0d0af0d372e6\USBMidi2.sys [106496 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [817672 2023-04-14] (Microsoft Windows Hardware Compatibility Publisher -> IDRIX)
S3 vkrnlintvsc; C:\WINDOWS\System32\DriverStore\FileRepository\wvkrnlintvsc.inf_amd64_ae7c1fb85fc0224e\vkrnlintvsc.sys [79168 2025-02-16] (Microsoft Windows -> Microsoft Corporation)
R3 vkrnlintvsp; C:\WINDOWS\System32\DriverStore\FileRepository\wvkrnlintvsp.inf_amd64_249e734e16ab4232\vkrnlintvsp.sys [87504 2026-08-13] (Microsoft Windows -> Microsoft Corporation)
S3 vlflt; C:\WINDOWS\System32\DRIVERS\vlflt.sys [481184 2023-06-01] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender)
S3 vmbusproxy; C:\WINDOWS\system32\drivers\vmbusproxy.sys [98304 2025-06-11] (Microsoft Windows -> Microsoft Corporation)
S4 WdAiNisDrv; C:\WINDOWS\System32\drivers\wd\WdAiNisDrv.sys [51224 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [21632 2026-10-14] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [669712 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [138264 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
R3 WiManHu; C:\WINDOWS\System32\DriverStore\FileRepository\wiman.inf_amd64_1bb2c76cfbc82913\WiManHu\WiManHu.sys [218568 2026-02-11] (Intel Corporation -> Intel Corporation)
S3 WSDPrintDevice; C:\WINDOWS\System32\DriverStore\FileRepository\wsdprint.inf_amd64_1f9e32519098c0b6\WSDPrint.sys [57344 2025-02-16] (Microsoft Windows -> Microsoft Corporation)
==================== SvcHost (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2026-10-23 14:42 - 2026-10-23 14:44 - 000045981 _____ C:\Users\Max\Downloads\FRST.txt
2026-10-23 14:41 - 2026-10-23 14:43 - 000000000 ____D C:\FRST
2026-10-23 14:40 - 2026-10-23 14:41 - 002457088 _____ (Farbar) C:\Users\Max\Downloads\FRST64.exe
2026-10-21 21:50 - 2026-10-21 21:50 - 000190096 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2026-10-21 21:49 - 2026-10-22 21:57 - 000000000 ____D C:\Users\Max\AppData\Local\Malwarebytes
2026-10-21 21:49 - 2026-10-21 21:49 - 000002101 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2026-10-21 21:49 - 2026-10-21 21:49 - 000002089 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2026-10-21 21:49 - 2026-10-21 21:49 - 000000000 ____D C:\Users\Max\AppData\Local\Sentry
2026-10-21 21:48 - 2026-10-21 21:48 - 000000000 ____D C:\ProgramData\Malwarebytes
2026-10-21 21:47 - 2026-10-21 21:48 - 000000000 ____D C:\Program Files\Malwarebytes
2026-10-21 21:47 - 2026-10-21 21:47 - 002906704 _____ (Malwarebytes) C:\Users\Max\Downloads\MBSetup-7.7.exe
2026-10-21 15:52 - 2026-10-21 15:52 - 000698006 _____ C:\WINDOWS\system32\perfh007.dat
2026-10-21 15:52 - 2026-10-21 15:52 - 000150942 _____ C:\WINDOWS\system32\perfc007.dat
2026-10-21 14:51 - 2026-10-21 14:51 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2026-10-21 01:39 - 2026-10-22 23:24 - 000000000 ____D C:\WINDOWS\CbsTemp
2026-10-20 19:50 - 2026-10-21 13:06 - 000000000 ____D C:\Program Files\Mozilla Firefox
2026-10-15 23:35 - 2026-10-22 13:03 - 000000000 ____D C:\Program Files\Mozilla Thunderbird
2026-10-13 20:42 - 2026-10-13 20:42 - 000091797 _____ C:\WINDOWS\SysWOW64\ctac.json
2026-10-13 20:42 - 2026-10-13 20:42 - 000091797 _____ C:\WINDOWS\system32\ctac.json
2026-10-13 20:42 - 2026-10-13 20:42 - 000039736 _____ C:\WINDOWS\SysWOW64\IntegratedServicesRegionPolicySet.json
2026-10-13 20:42 - 2026-10-13 20:42 - 000039736 _____ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json
2026-10-13 20:42 - 2026-10-13 20:42 - 000004985 _____ C:\WINDOWS\system32\DeviceFeatureDDF.json
2026-10-08 22:21 - 2026-10-08 22:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logi Download Assistant
2026-10-03 20:15 - 2026-10-03 20:15 - 118715181 _____ C:\Users\Max\Downloads\Foundation Course-20261003T181528Z-1-001.zip
2026-10-02 08:29 - 2026-10-02 08:29 - 000000000 ____D C:\Program Files\Common Files\DESIGNER
2026-09-28 20:01 - 2026-10-04 18:53 - 000001311 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord.lnk
2026-09-28 06:54 - 2026-10-23 03:08 - 000016615 _____ C:\Users\Max\Desktop\Japan Expenses.xlsx
2026-09-28 06:54 - 2026-09-28 06:54 - 000000165 ____H C:\Users\Max\Desktop\~$Japan Expenses.xlsx
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2026-10-23 14:45 - 2024-07-14 14:19 - 000000000 ____D C:\Program Files (x86)\Steam
2026-10-23 14:42 - 2025-10-19 19:57 - 000000000 ____D C:\Users\WsiAccount
2026-10-23 14:16 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SystemTemp
2026-10-23 14:16 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2026-10-23 13:28 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\AppReadiness
2026-10-23 13:28 - 2024-04-01 09:26 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2026-10-23 12:25 - 2025-12-19 22:33 - 000000000 ____D C:\Users\Max\Desktop\Max's PKM
2026-10-23 12:06 - 2025-08-25 23:42 - 001806236 _____ C:\Users\Max\AppData\LocalLow\48ebf18c1401a68f92c3442631cd352566de8f82437b3b83c09d3cd5306c2405
2026-10-23 11:46 - 2025-08-25 23:42 - 000001138 _____ C:\Users\Max\AppData\LocalLow\286efa2f40f3ea9ae1d33a1f2ba97746c0d967f4f30197efe6f04cadeb0ccbab
2026-10-23 09:50 - 2025-02-16 22:55 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2026-10-23 03:14 - 2023-04-18 13:11 - 000000000 ____D C:\Users\Max\AppData\Roaming\Anki2
2026-10-23 03:14 - 2023-04-12 13:14 - 000000000 ____D C:\Users\Max\AppData\Roaming\Microsoft\Word
2026-10-23 03:14 - 2023-04-12 13:03 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2026-10-23 03:08 - 2023-04-14 12:52 - 000000000 ____D C:\Users\Max\AppData\Roaming\Microsoft\Excel
2026-10-23 01:37 - 2025-12-06 21:58 - 000002564 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2026-10-22 23:24 - 2025-12-19 22:30 - 000000000 ____D C:\Users\Max\AppData\Roaming\obsidian
2026-10-22 22:02 - 2025-08-28 01:02 - 000000130 _____ C:\Users\Max\AppData\LocalLow\981c0756294e2a37d655c063711bcd570123439c3bd0e71a07f5025540c89aaa
2026-10-22 21:24 - 2025-08-28 01:02 - 000038099 _____ C:\Users\Max\AppData\LocalLow\49798e1ee2c5c0ce6eda1c74ff925d13e6fdfec02e09593f177958860a4ad850
2026-10-22 19:40 - 2025-02-16 23:23 - 000003574 _____ C:\WINDOWS\system32\Tasks\Launch Adobe CCXProcess
2026-10-22 12:40 - 2025-12-28 20:10 - 000000000 ____D C:\Users\Max\AppData\Roaming\The Froosh Amp
2026-10-22 12:40 - 2023-04-12 11:36 - 000000000 ____D C:\Users\Max\AppData\Local\D3DSCache
2026-10-22 05:18 - 2024-04-01 09:26 - 000000000 ___HD C:\Program Files\WindowsApps
2026-10-21 22:25 - 2026-09-13 14:55 - 000267029 _____ C:\WINDOWS\system32\InstallMonitorLog.csv
2026-10-21 21:49 - 2024-04-01 09:26 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2026-10-21 21:49 - 2024-04-01 09:24 - 000000000 ____D C:\WINDOWS\INF
2026-10-21 21:49 - 2023-04-12 11:29 - 000000000 ____D C:\Users\Max\AppData\Local\Packages
2026-10-21 21:49 - 2022-06-02 22:21 - 000000000 ____D C:\ProgramData\Packages
2026-10-21 21:01 - 2023-04-13 19:27 - 000000000 ____D C:\Users\Max\AppData\Local\CrashDumps
2026-10-21 15:52 - 2025-02-16 23:22 - 001637736 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2026-10-21 15:49 - 2025-11-16 14:05 - 000000130 _____ C:\Users\Max\AppData\LocalLow\06e56d9ebcd506c23ac3cac74ddecd166d6f9406d3c9d85c69c6ee31400f2447
2026-10-21 15:14 - 2025-08-25 23:22 - 000013497 _____ C:\Users\Max\AppData\LocalLow\19cba8bb7c48fdfb12bda34b03712a9057f03d374edd105673e20ce6a008ee41
2026-10-21 15:14 - 2025-08-15 14:58 - 000000000 ____D C:\ProgramData\boost_interprocess
2026-10-21 15:12 - 2025-02-16 23:23 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2026-10-21 15:12 - 2025-02-16 23:16 - 000018834 _____ C:\WINDOWS\system32\5E37410B-D6F1-471D-AE27-563CEAC0D6B2
2026-10-21 15:12 - 2024-11-05 00:57 - 000000000 ____D C:\Users\Max\AppData\Local\MuseSampler
2026-10-21 15:12 - 2024-11-05 00:57 - 000000000 ____D C:\Users\Max\AppData\Local\Muse Hub
2026-10-21 15:12 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\ServiceState
2026-10-21 15:12 - 2023-04-12 11:38 - 000000000 ___RD C:\Users\Max\OneDrive
2026-10-21 15:12 - 2023-03-02 13:18 - 000000000 ____D C:\ProgramData\NVIDIA
2026-10-21 15:11 - 2022-06-02 22:20 - 000012288 ___SH C:\DumpStack.log.tmp
2026-10-21 13:44 - 2024-04-01 09:21 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2026-10-21 13:06 - 2025-02-16 22:55 - 000001623 _____ C:\WINDOWS\system32\config\VSMIDK
2026-10-21 13:06 - 2023-04-12 13:03 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2026-10-21 13:05 - 2025-02-16 23:14 - 000000000 ____D C:\Users\Max
2026-10-21 12:36 - 2026-08-22 10:29 - 000002133 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2026-10-21 12:36 - 2025-02-16 23:23 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2026-10-21 12:36 - 2023-04-12 13:03 - 000001073 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2026-10-21 09:33 - 2025-05-24 11:28 - 000000000 ____D C:\WINDOWS\Minidump
2026-10-21 09:33 - 2023-04-12 09:53 - 009670162 ____N C:\WINDOWS\Minidump\102126-27765-01.dmp
2026-10-20 21:12 - 2024-12-20 23:55 - 000000000 ____D C:\Users\Max\OneDrive\Documents\12 Guitar practice routine
2026-10-20 07:51 - 2025-02-16 23:23 - 000003536 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2026-10-20 07:51 - 2025-02-16 23:23 - 000003464 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2026-10-19 09:16 - 2026-03-15 19:23 - 000001063 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Thunderbird.lnk
2026-10-18 23:33 - 2023-03-02 13:14 - 000000000 ____D C:\Program Files\Microsoft Office
2026-10-18 10:16 - 2022-06-02 22:20 - 000002446 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2026-10-15 15:09 - 2025-02-16 23:23 - 000003584 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-571881649-101344733-3185888103-1002
2026-10-15 15:09 - 2025-02-16 23:23 - 000003560 _____ C:\WINDOWS\system32\Tasks\OneDrive Startup Task-S-1-5-21-571881649-101344733-3185888103-1002
2026-10-15 15:09 - 2025-02-16 23:23 - 000003372 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-571881649-101344733-3185888103-1002
2026-10-15 15:09 - 2023-04-12 11:38 - 000002381 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2026-10-14 08:15 - 2022-06-02 22:20 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2026-10-14 07:43 - 2024-04-01 09:26 - 000000000 ____D C:\ProgramData\USOPrivate
2026-10-14 04:25 - 2025-02-16 22:55 - 000630016 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2026-10-14 04:24 - 2025-12-10 05:18 - 000000000 ____D C:\WINDOWS\system32\NarratorMCAT
2026-10-14 04:24 - 2025-07-14 02:47 - 000000000 ____D C:\WINDOWS\system32\ruxim
2026-10-14 04:24 - 2024-04-01 18:36 - 000000000 ____D C:\WINDOWS\system32\OpenSSH
2026-10-14 04:24 - 2024-04-01 18:36 - 000000000 ____D C:\WINDOWS\system32\Microsoft-Edge-WebView
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\UUS
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\InstallShield
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SystemResources
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\setup
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\oobe
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\migwiz
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\HealthAttestationClient
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\Dism
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\DDFs
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\appraiser
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\ShellExperiences
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\ShellComponents
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\Provisioning
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\BrowserCore
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\bcastdvr
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\Program Files\Common Files\System
2026-10-14 04:24 - 2024-04-01 09:21 - 000000000 ____D C:\WINDOWS\servicing
2026-10-14 04:23 - 2025-06-23 19:55 - 000000000 ____D C:\Users\Max\AppData\Roaming\discord
2026-10-13 20:42 - 2025-02-16 22:57 - 003387392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2026-10-13 20:03 - 2023-04-12 11:53 - 000000000 ____D C:\WINDOWS\system32\MRT
2026-10-13 19:56 - 2023-04-12 11:53 - 230303336 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2026-10-13 10:34 - 2022-09-17 23:43 - 000000000 ____D C:\Program Files\HP
2026-10-08 22:21 - 2026-06-15 21:22 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logi
2026-10-08 22:21 - 2026-06-15 21:22 - 000000000 ____D C:\ProgramData\Logi
2026-10-08 22:21 - 2026-06-15 21:22 - 000000000 ____D C:\Program Files\LogiDownloadAssistant
2026-10-04 18:53 - 2025-06-23 19:55 - 000000000 ____D C:\Users\Max\AppData\Local\Discord
2026-10-01 07:21 - 2023-04-12 09:53 - 009718741 ____N C:\WINDOWS\Minidump\100126-22250-01.dmp
2026-09-28 07:54 - 2023-04-14 17:26 - 000000000 ____D C:\Users\Max\AppData\Roaming\Evernote
==================== Files in the root of some directories ========
2023-06-07 11:59 - 2023-06-07 11:59 - 000001456 _____ () C:\Users\Max\AppData\Local\Adobe Save for Web 13.0 Prefs
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
--- --- --- Weiteres Logfile passt nicht mehr in den Post. Ich reiche das nach! Geändert von Maxi92 (23.10.2026 um 14:33 Uhr) |
|
23.10.2026, 14:38
| #2 |
| | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Hier noch die addition.txt
__________________Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2026
Ran by Max (23-10-2026 14:47:49)
Running from C:\Users\Max\Downloads
Microsoft Windows 11 Pro Version 25H2 26200.9711 (X64) (2025-02-16 21:23:44)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
(If an entry is included in the fixlist, it will be removed.)
Administrator (S-1-5-21-571881649-101344733-3185888103-500 - Administrators - Disabled)
DefaultAccount (S-1-5-21-571881649-101344733-3185888103-503 - Limited - Disabled)
Guest (S-1-5-21-571881649-101344733-3185888103-501 - Limited - Disabled)
Max (DisplayName: M** *ö**r) (S-1-5-21-571881649-101344733-3185888103-1002 - Administrators - Enabled) [MS Account] => C:\Users\Max
WDAGUtilityAccount (S-1-5-21-571881649-101344733-3185888103-504 - Limited - Disabled)
WsiAccount (S-1-5-21-571881649-101344733-3185888103-1003 - Limited - Disabled) => C:\Users\WsiAccount
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Malwarebytes (Enabled - Up to date) {A537353A-1D6A-F6B5-9153-CE1CF80FBE66}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Ableton Live 12 Suite (HKLM\...\{0380CF5F-9EF2-4ABA-BF87-EA4826A1B89B}) (Version: 12.0.0.0 - Ableton) Hidden
Ableton Live 12 Suite (HKLM-x32\...\{9FE4C915-316D-4C18-B4C4-BF627B8504DD}) (Version: 12.0.0.0 - Ableton)
Ableton USB Audio Driver v5.68.0 (HKLM\...\{A823612A-AA91-4911-886A-7C589452C65C}) (Version: 5.68.0 - Ableton)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 6.9.1.1.3 - Adobe Inc.)
Adobe Media Encoder 2024 (HKLM-x32\...\AME_24_6_5) (Version: 24.6.5 - Adobe Inc.)
Adobe Media Encoder 2025 (HKLM-x32\...\AME_25_6_6) (Version: 25.6.6 - Adobe Inc.)
Adobe Media Encoder 2026 (HKLM-x32\...\AME_26_5) (Version: 26.5 - Adobe Inc.)
Amazon Kindle (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Amazon Kindle) (Version: 2.9.1.71006 - Amazon)
Anaconda3 2023.03-1 (Python 3.10.9 64-bit) (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Anaconda3 2023.03-1 (Python 3.10.9 64-bit)) (Version: 2023.03-1 - Anaconda, Inc.)
Analog Lab V 5.10.7 (HKLM-x32\...\Analog Lab V_is1) (Version: 5.10.7 - Arturia)
Anki Launcher (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Anki) (Version: 25.09 - )
Arturia Software Center 2.9.1 (HKLM-x32\...\Arturia Software Center_is1) (Version: 2.9.1 - Arturia)
Arturia USB MIDI Driver v1.6.0 (HKLM\...\{C2E707D7-4B3C-4A35-A877-756E8F49D7EF}) (Version: 1.6.0 - Arturia)
Bome Virtual MIDI 2.1.0.44 (HKLM\...\BMIDI_Driver1.0.0.11_is1) (Version: - Bome Software GmbH & Co. KG)
Common Desktop Agent (HKLM\...\{031A0E14-0413-4C97-9772-2639B782F46F}) (Version: 1.62.0 - OEM) Hidden
Discord (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Discord) (Version: 1.0.9260 - Discord Inc.)
EarMaster 7.7 (HKLM\...\EarMaster 7_is1) (Version: 7.7 - EarMaster ApS)
Evernote 10.125.5 (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\e4251011-875e-51f3-a464-121adaff5aaa) (Version: 10.125.5 - Evernote Corporation)
Focusrite Audio Drivers 4.119.13.33 (HKLM\...\Focusrite Audio Drivers_is1) (Version: 4.119.13.33 - Focusrite Audio Engineering, Ltd.)
Focusrite Control 3.18.0.204 (HKLM\...\Focusrite Control_is1) (Version: 3.18.0.204 - Focusrite Audio Engineering Ltd.)
GameRanger (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\GameRanger) (Version: - GameRanger Technologies)
Google Chrome (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Google Chrome) (Version: 156.0.8078.47 - Google LLC)
HandBrake 1.6.1 (HKLM-x32\...\HandBrake) (Version: 1.6.1 - )
HP Connection Optimizer (HKLM-x32\...\{6468C4A5-E47E-405F-B675-A70A70983EA6}) (Version: 2.0.19.0 - HP Inc)
HP Documentation (HKLM\...\HP_Documentation) (Version: 1.0.0.1 - HP Inc.)
HP Notifications (HKLM-x32\...\{84937F28-9CB4-49E7-A2CF-E32D97E6DAE6}) (Version: 1.1.28.1 - HP)
HP Security Update Service (HKLM\...\{8C2C90BB-9650-443D-A4ED-958D39B3C9EA}) (Version: 4.4.34.927 - HP Inc.)
HP Sure Recover (HKLM\...\{EE6377DD-C166-40D9-ACFF-AEB827623329}) (Version: 10.1.34.334 - HP Inc.)
HP Sure Run Module (HKLM\...\{EB7671C4-861D-4C1F-BA26-C8ED6B8EF933}) (Version: 5.0.5.118 - HP Inc.)
HP System Default Settings (HKLM-x32\...\{D530265D-C486-4A7F-8FC0-79CE82BB5F6B}) (Version: 1.5.9.1 - HP Inc.) Hidden
HP Wolf Security - Console (HKLM\...\{627D40D8-9926-42C1-BA7F-6AA7A5DFFE9A}) (Version: 11.1.8.1209 - HP Inc.)
ICS (HKLM-x32\...\{9881592F-ADE0-430D-8E1E-31F363C1BA28}) (Version: 3.0.17.0 - HP Inc.)
Logi Download Assistant (HKLM-x32\...\LogiDownloadAssistant) (Version: 2.0.1020 - Logitech)
Malwarebytes version 5.7.3.376 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 5.7.3.376 - Malwarebytes)
Microsoft .NET Host - 6.0.21 (x64) (HKLM\...\{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}) (Version: 48.87.64667 - Microsoft Corporation) Hidden
Microsoft .NET Host - 8.0.8 (x64) (HKLM\...\{3BA242F8-BDB5-4096-9FBC-333CD663BBAD}) (Version: 64.32.18380 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 6.0.21 (x64) (HKLM\...\{D937EF87-F11D-4778-973C-B71E178F95D0}) (Version: 48.87.64667 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 8.0.8 (x64) (HKLM\...\{7FE24458-0796-4428-99C2-9A0F8DAB93CC}) (Version: 64.32.18380 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 6.0.21 (x64) (HKLM\...\{8D2EC92E-5903-4B25-9406-182B8EFA834F}) (Version: 48.87.64667 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 8.0.8 (x64) (HKLM\...\{9ACB23DB-4D32-49ED-A5E3-F4E2F8D9D2AA}) (Version: 64.32.18380 - Microsoft Corporation) Hidden
Microsoft 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.20430.20182 - Microsoft Corporation)
Microsoft 365 - en-gb (HKLM\...\O365HomePremRetail - en-gb) (Version: 16.0.20430.20182 - Microsoft Corporation)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 155.0.4283.62 - Microsoft Corporation)
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 155.0.4283.62 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\OneDriveSetup.exe) (Version: 26.183.0920.0005 - Microsoft Corporation)
Microsoft OneNote - de-de (HKLM\...\OneNoteFreeRetail - de-de) (Version: 16.0.20430.20182 - Microsoft Corporation)
Microsoft OneNote - en-gb (HKLM\...\OneNoteFreeRetail - en-gb) (Version: 16.0.20430.20182 - Microsoft Corporation)
Microsoft Teams Meeting Add-in for Microsoft Office (HKLM\...\{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}) (Version: 1.24.31301 - Microsoft)
Microsoft Update Health Tools (HKLM\...\{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (HKLM\...\{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (HKLM\...\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM-x32\...\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM-x32\...\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40664 (HKLM-x32\...\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}) (Version: 12.0.40664.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40664 (HKLM-x32\...\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}) (Version: 12.0.40664.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664 (HKLM\...\{010792BA-551A-3AC0-A7EF-0FAB4156C382}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664 (HKLM\...\{53CF6934-A98D-3D84-9146-FC4EDF3D5641}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40664 (HKLM-x32\...\{D401961D-3A20-3AC7-943B-6139D5BD490A}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40664 (HKLM-x32\...\{8122DAB1-ED4D-3676-BB0A-CA368196543E}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.50.35719 (HKLM\...\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.50.35719 (HKLM\...\{61B44572-8722-4DAF-8ACF-8E742D30BCC5}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.50.35719 (HKLM-x32\...\{773AD50D-AAE6-4BA1-AD01-B5A38874C840}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.50.35719 (HKLM-x32\...\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ v14 Redistributable (x64) - 14.50.35719 (HKLM-x32\...\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}) (Version: 14.50.35719.0 - Microsoft Corporation)
Microsoft Visual C++ v14 Redistributable (x86) - 14.50.35719 (HKLM-x32\...\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}) (Version: 14.50.35719.0 - Microsoft Corporation)
Microsoft Windows Application Compatibility Fix Database (HKLM\...\{22221111-1111-1111-1111-111111111111}.sdb) (Version: - )
Microsoft Windows Desktop Runtime - 6.0.21 (x64) (HKLM\...\{AF6BF7DD-2B12-40C5-919C-2EC99054BBE1}) (Version: 48.87.64723 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 6.0.21 (x64) (HKLM-x32\...\{0f39db03-9030-48f3-82ef-5384bed81d85}) (Version: 6.0.21.32717 - Microsoft Corporation)
Microsoft Windows Desktop Runtime - 8.0.8 (x64) (HKLM\...\{663E7053-3B36-4AE5-8223-234867FAEAE6}) (Version: 64.32.18376 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 8.0.8 (x64) (HKLM-x32\...\{33832ff3-5583-4b81-b270-d9fd42760e1a}) (Version: 8.0.8.33916 - Microsoft Corporation)
MIDI Control Center 1.21.1 (HKLM\...\MIDI Control Center_is1) (Version: 1.21.1 - Arturia)
Mozilla Firefox (x64 en-US) (HKLM\...\Mozilla Firefox) (Version: 158.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 148.0.1 - Mozilla)
Mozilla Thunderbird (x64 en-US) (HKLM\...\Mozilla Thunderbird 158.0 (x64 en-US)) (Version: 158.0 - Mozilla)
MuseScore 4 (HKLM\...\{200A530C-A4F7-48BB-8A37-F5454DBCEE95}) (Version: 4.2.0.233521124 - MuseScore BVBA and Others)
Native Access 3.21.1 (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\c410b7d2-8fce-53b3-8332-e98b6e89a16a) (Version: 3.21.1 - Native Instruments)
Native Instruments Controller Editor (HKLM-x32\...\Native Instruments Controller Editor) (Version: 2.8.2.0 - Native Instruments)
Native Instruments Komplete Kontrol MK2 Driver (HKLM-x32\...\Native Instruments Komplete Kontrol MK2 Driver) (Version: - Native Instruments)
Native Instruments Maschine 3 (HKLM-x32\...\Native Instruments Maschine 3) (Version: 3.3.1.0 - Native Instruments)
Native Instruments Maschine Jam Driver (HKLM-x32\...\Native Instruments Maschine Jam Driver) (Version: - Native Instruments)
Native Instruments Maschine MK3 Driver (HKLM-x32\...\Native Instruments Maschine MK3 Driver) (Version: - Native Instruments)
Native Instruments Maschine Studio Driver (HKLM-x32\...\Native Instruments Maschine Studio Driver) (Version: - Native Instruments)
Native Instruments NIHostIntegrationAgent (HKLM-x32\...\Native Instruments NIHostIntegrationAgent) (Version: 1.17.1.5 - Native Instruments)
Native Instruments NTKDaemon (HKLM-x32\...\Native Instruments NTKDaemon) (Version: 1.26.0.0 - Native Instruments)
NVIDIA App 11.0.7.237 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NvApp) (Version: 11.0.7.237 - NVIDIA Corporation)
NVIDIA FrameView SDK 1.7.12227.37421622 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_FrameViewSdk) (Version: 1.7.12227.37421622 - NVIDIA Corporation)
NVIDIA Graphics Driver 595.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 595.97 - NVIDIA Corporation)
NVIDIA RTX Desktop Manager 203.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 203.20 - NVIDIA Corporation)
Obsidian (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\bd400747-f0c1-5638-a859-982036102edf) (Version: 1.10.6 - Obsidian)
Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.20430.20092 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM\...\{90160000-008C-0407-1000-0000000FF1CE}) (Version: 16.0.20430.20182 - Microsoft Corporation) Hidden
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 2.00.01.35 - HP Inc.)
Samsung Scan Process Machine (HKLM-x32\...\Samsung Scan Process Machine) (Version: 1.03.05.28 - Samsung Electronics Co., Ltd.) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Uninstall Samsung Printer Software (HKLM-x32\...\TotalUninstaller) (Version: 4.0.0.93 - Samsung Electronics CO., LTD.)
VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.25.9 - IDRIX)
YubiKey Manager (HKLM-x32\...\yubikey-manager) (Version: 1.2.5 - Yubico AB)
Zoom (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\ZoomUMX) (Version: 5.15.3 (18551) - Zoom Video Communications, Inc.)
Packages:
=========
@{MicrosoftWindows.55182690.Taskbar_1000.26100.3775.0_x64__cw5n1h2txyewy?ms-resource://MicrosoftWindows.55182690.Taskbar/Resources/ProductPkgDisplayName} -> C:\WINDOWS\SystemApps\SxS\MicrosoftWindows.55182690.Taskbar_cw5n1h2txyewy [2025-06-20] ()
Adobe Native Client -> C:\Program Files\Common Files\Adobe\Adobe OS Extension [2025-12-21] ()
Amazon Kindle: Reading App -> C:\Program Files\WindowsApps\AMZNKindle.AmazonKindleReadingApp_1.1.4132.0_x64__m1sc522ngdk36 [2026-10-21] (AMZN Kindle)
AppUp.IntelGraphicsExperience -> C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt [2024-11-09] (INTEL CORP) [Startup Task]
HP -> C:\Program Files\WindowsApps\AD2F1837.myHP_61.52637.14262.0_x64__v10z8vjag6ke6 [2026-10-04] (HP Inc.) [Startup Task]
HP Audio Control -> C:\Program Files\WindowsApps\RealtekSemiconductorCorp.HPAudioControl_2.54.396.0_x64__dt26b99r8h8gj [2026-10-02] (Realtek Semiconductor Corp)
HP PC Hardware Diagnostics Windows -> C:\Program Files\WindowsApps\AD2F1837.HPPCHardwareDiagnosticsWindows_3.3.2.0_x64__v10z8vjag6ke6 [2026-10-04] (HP Inc.) [Startup Task]
HP PC Privacy Settings -> C:\Program Files\WindowsApps\AD2F1837.HPPrivacySettings_1.6.4.0_x64__v10z8vjag6ke6 [2026-10-04] (HP Inc.)
HP Power Manager -> C:\Program Files\WindowsApps\AD2F1837.HPPowerManager_3.0.18.0_x64__v10z8vjag6ke6 [2023-04-12] (HP Inc.)
HP QuickDrop -> C:\Program Files\WindowsApps\AD2F1837.HPQuickDrop_2.5.10921.0_x64__v10z8vjag6ke6 [2023-06-14] (HP Inc.)
HP Support Assistant -> C:\Program Files\WindowsApps\AD2F1837.HPSupportAssistant_9.55.10.0_x64__v10z8vjag6ke6 [2026-08-21] (HP Inc.)
HP System Information -> C:\Program Files\WindowsApps\AD2F1837.HPSystemInformation_8.10.53.0_x64__v10z8vjag6ke6 [2026-09-27] (HP Inc.)
Intel(R) Management and Security Status -> C:\Program Files\WindowsApps\AppUp.IntelManagementandSecurityStatus_2537.8.7.0_x64__8j3eq9eme6ctt [2026-02-27] (INTEL CORP) [Startup Task]
Intel® Graphics Software -> C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt [2026-10-14] (INTEL CORP) [Startup Task]
Local AI Manager for Microsoft 365 -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16\AI [2026-10-18] ()
Malwarebytes Anti-Malware -> C:\Program Files\Malwarebytes\Anti-Malware [2026-10-22] ()
Microsoft Defender -> C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4_102.2608.18002.0_x64__8wekyb3d8bbwe [2026-09-27] (Microsoft Corporation) [Startup Task]
Microsoft Whiteboard -> C:\Program Files\WindowsApps\Microsoft.Whiteboard_56.20201.588.0_x64__8wekyb3d8bbwe [2026-02-18] (Microsoft Corporation)
Microsoft.HEVCVideoExtensions -> C:\Program Files\WindowsApps\Microsoft.HEVCVideoExtensions_2.4.110.0_x64__8wekyb3d8bbwe [2026-08-29] (Microsoft Corporation)
Microsoft.Office.ActionsServer -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16\ActionsServer [2026-10-18] ()
Muse Hub -> C:\Program Files\WindowsApps\Muse.MuseHub_2.0.22.1414_x64__rb9pth70m6nz6 [2024-11-04] (Muse) [Startup Task]
NVIDIA Control Panel -> C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_8.1.969.0_x64__56jybvy8sckqj [2025-11-07] (NVIDIA Corp.)
OfficePushNotificationsUtility -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16 [2026-10-18] ()
Samsung Printer Experience -> C:\Program Files\WindowsApps\SAMSUNGELECTRONICSCO.LTD.SamsungPrinterExperience_1.3.15.0_x64__3c1yjt4zspk6g [2023-04-20] (Samsung Electronics Co. Ltd.)
Speech Pack - English (United Kingdom) -> C:\Program Files\WindowsApps\MicrosoftWindows.Speech.en-GB.1_1.0.19.0_x64__cw5n1h2txyewy [2026-09-27] (Microsoft Windows)
SpotifyAB.SpotifyMusic -> C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0 [2026-10-21] (Spotify AB) [Startup Task]
==================== Custom CLSID (Whitelisted): ==============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{13357088-9834-0409-1600-134951500000}\localserver32 -> "C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{19CEDD27-D972-4CC0-ABAC-C58CD08C46DB}\localserver32 -> C:\Users\Max\AppData\Local\Discord\app-1.0.9260\Discord.exe (Discord Inc. -> Discord Inc.)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{1a46400f-4c81-802a-c2c1-1e9a687a9340}\localserver32 -> C:\Program Files\HandBrake\HandBrake.exe (HandBrake Team) [File not signed]
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4}\localserver32 -> C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Adobe Inc. -> Adobe Inc.)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{38142727-3008-9161-1521-349515000000}\localserver32 -> "C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{547E9AEF-8043-5D26-879F-01E7664192DC}\localserver32 -> C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{65574321-d3fb-e7db-e83e-38fe55a80c4a}\localserver32 -> C:\Program Files\HP\HP Client Security Manager\HP.ClientSecurityManager.exe (HP Inc. -> HP Inc.)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{6DDCE70D-A4AE-4E97-908C-BE7B2DB750AD}\localserver32 -> C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{6E1E5C99-BC66-5838-926C-B47FC5A1B44A}\localserver32 -> C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{6FED547A-D1E3-45A6-BF0D-A2B75E8341A1}\InprocServer32 -> C:\Program Files\Mozilla Thunderbird\notificationserver.dll (Mozilla Corporation -> Mozilla Foundation)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\localserver32 -> C:\Users\Max\AppData\Local\Google\Chrome\Application\156.0.8078.47\notification_helper.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Inc. -> Adobe Systems)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2026-10-21] (Malwarebytes Inc -> Malwarebytes)
ContextMenuHandlers5: [NvAppDesktopContext] -> {F2E8B4A1-9C7D-4F6E-B3A5-8D2C1F4E9B7A} => C:\Program Files\NVIDIA Corporation\NVIDIA App\NvCpl\nvui.dll [2026-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\nvshext.dll [2026-03-18] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers5: [NvQuadroView] -> {1E9B04FB-F9E5-4718-997B-B8DA88302A48} => C:\Program Files\NVIDIA Corporation\nview\nvshell.dll [2022-08-24] (Nvidia Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2026-10-21] (Malwarebytes Inc -> Malwarebytes)
==================== Codecs (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Drivers32-x32: [vidc.VP60] => C:\WINDOWS\system32\vp6vfw.dll
HKLM\...\Drivers32-x32: [vidc.VP61] => C:\WINDOWS\system32\vp6vfw.dll
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
ShortcutWithArgument: C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anaconda3 (64-bit)\Anaconda Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> "/K" C:\Users\Max\anaconda3\Scripts\activate.bat C:\Users\Max\anaconda3
==================== Loaded Modules (Whitelisted) =============
2022-05-06 12:05 - 2022-05-06 12:05 - 000182784 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\_cffi_backend.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000012288 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\_win32sysloader.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000031232 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\bcrypt\_bcrypt.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000116224 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\kiwisolver.pyd
2022-05-06 12:21 - 2022-05-06 12:21 - 034413408 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\libopenblas.GK7GX5KEQ4F6UYO3P26ULGBQYHGQO7J4.gfortran-win_amd64.dll
2022-05-06 12:05 - 2022-05-06 12:05 - 000012288 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\_c_internal_utils.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000189952 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\_image.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000159744 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\_path.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000231424 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\backends\_backend_agg.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000012800 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\backends\_tkagg.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000605696 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\ft2font.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000110592 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\core\_multiarray_tests.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 002818048 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\core\_multiarray_umath.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000112640 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\fft\_pocketfft_internal.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000155648 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\linalg\_umath_linalg.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000022016 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\linalg\lapack_lite.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000239616 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_bounded_integers.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000181760 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_common.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000666112 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_generator.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000079360 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_mt19937.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000065536 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_pcg64.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000072704 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_philox.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000053248 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_sfc64.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000152576 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\bit_generator.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000564224 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\mtrand.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 002672128 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\PIL\_imaging.pyd
2022-05-06 12:22 - 2022-05-06 12:22 - 000140800 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\pywintypes39.dll
2022-05-06 12:05 - 2022-05-06 12:05 - 000134144 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\win32api.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000155648 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\win32file.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000026624 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\win32pipe.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000141312 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\win32security.pyd
2025-12-10 13:16 - 2025-12-10 13:28 - 000163840 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Program\libusb-1.0.dll
2025-12-10 13:16 - 2025-12-10 13:28 - 000321024 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Program\soxr.dll
2025-12-10 13:16 - 2024-09-26 22:54 - 000325120 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Program\USFLIB.dll
2025-12-10 13:17 - 2025-08-27 21:53 - 000816640 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Devices\Pc\Analog_64.dll
2025-12-10 13:20 - 2025-06-23 00:03 - 004908544 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\packages\RNBO\extensions\rnbopatcher.mxe64
2025-12-10 13:27 - 2025-12-10 13:29 - 000642560 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\MaxLua.dll
2025-12-10 13:27 - 2024-07-08 18:05 - 002400768 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\mozjs185-1.0.dll
2023-03-02 13:15 - 2023-03-02 13:15 - 000000000 ____L () [symlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppvIsvSubsystems64.dll] C:\Program Files\Microsoft Office\root\Office16\AppVIsvSubsystems64.dll
2023-03-02 13:15 - 2023-03-02 13:15 - 000000000 ____L () [symlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2R64.dll] C:\Program Files\Microsoft Office\root\Office16\c2r64.dll
2026-04-17 18:50 - 2026-04-17 18:50 - 000000000 ____L () [symlink -> C:\Program Files\NVIDIA Corporation\NVIDIA App\MessageBus\NvMessageBusBroadcast.dll] C:\Program Files\NVIDIA Corporation\NvContainer\plugins\LocalSystem\NvMessageBusBroadcast.dll
2025-12-10 13:17 - 2025-12-10 13:29 - 001708032 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\jitter\gl2.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000878080 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\jitter\sketch.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000296448 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\m4l\live.guilib.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000046592 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\autohelp.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000023552 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\debugwindow.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 001550336 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\genpatcher.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000017920 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\jsrepl.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 069547008 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\maxclang.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000675328 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\maxurl.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 033185280 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\maxxslt.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 003175424 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\maxzlib.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000025600 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\objectview.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000047104 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\palblocks.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000039424 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\paramview.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000060416 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\pianoroll.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000034304 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\querylib.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000040448 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\setplugpath.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 001368576 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\sqlite.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000236544 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\synophrys.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 020189696 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\v8.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000265728 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\yaml.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000029184 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\zoomer.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000014336 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\msp\cefaudio.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000066048 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\msp\max~.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000051712 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\msp\polybuffer.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000022528 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\msp\probe.history~.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000019456 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\msp\probe.meter~.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000028160 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\msp\probe.scope~.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000048128 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\externals\max\comment.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000180224 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\externals\max\js.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000040448 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\jitter\jsjitter.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000041984 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\m4l\jsliveapi.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000022016 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsfolder.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000029696 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsmaxobjlistener.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000028672 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsparaminfoprovider.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000029696 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsparamlistener.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000020480 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsrequire.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000023040 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsrx256.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000024064 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jssnapshotapi.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000017920 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jssqlite.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000016896 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jssqlresult.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000027136 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jstrigger.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000024064 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsxmlhttprequest.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000020480 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\msp\jsbuffer.mxe64
2025-12-10 13:18 - 2025-12-10 13:29 - 001992192 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\packages\Jitter Tools\extensions\gl3.mxe64
2025-12-10 13:27 - 2025-12-10 13:29 - 001224192 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\jitlib.dll
2025-12-10 13:27 - 2025-12-10 13:29 - 000258048 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\MaxAPI.dll
2025-12-10 13:27 - 2025-12-10 13:29 - 000677888 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\MaxAudio.dll
2025-12-10 13:27 - 2024-07-08 18:05 - 000604672 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\MAXCRT.dll
2025-12-10 13:27 - 2025-12-10 13:29 - 032441344 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\MaxPlug.DLL
2025-12-10 13:27 - 2025-12-10 13:29 - 000216576 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\patcher.dll
2025-08-15 20:29 - 2025-08-15 20:28 - 011872256 _____ (MANDA AUDIO) [File not signed] C:\Program Files\Common Files\VST3\MT-PowerDrumKit.vst3
2025-12-10 13:16 - 2024-09-26 22:54 - 000856576 _____ (Propellerhead Software AB) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Program\REX Shared Library.dll
2022-05-02 09:22 - 2022-05-02 09:22 - 000123904 _____ (Samsung Electronics Co., Ltd.) [File not signed] C:\Program Files (x86)\Samsung\Easy Printer Manager\SmartScreenPrint\CDAKEYMonitor64.dll
==================== Alternate Data Streams (Whitelisted) ========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Max\Downloads\FRST64.exe:MBAM.Zone.Identifier [225]
==================== Safe Mode (Whitelisted) ==================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) =================
==================== Internet Explorer (Whitelisted) =============
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\HP\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2026-08-13] (HP Inc. -> HP Inc.)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\HP\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2026-08-13] (HP Inc. -> HP Inc.)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
==================== Hosts content: =========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2022-05-07 07:24 - 2022-05-07 07:22 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts
==================== Network ===========================
(Currently there is no automatic fix for this section.)
DNS Servers: 192.168.1.1
Windows Firewall is enabled.
Network Binding:
=============
WiFi: Intel(R) Wi-Fi 6E AX211 160MHz -> Netwtw14.sys
Ethernet: Intel(R) Ethernet Connection (16) I219-V -> e1d.sys
Bluetooth Network Connection: Bluetooth Device (Personal Area Network) -> bthpan.sys
vms_vsf: Hyper-V Virtual Switch Extension Filter
ms_l1vhlwf: Nested Network Virtualization
vms_vsp: Hyper-V Virtual Switch Extension Protocol
==================== Other Areas ===========================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\Control Panel\Desktop\\Wallpaper ->
HKU\S-1-5-21-571881649-101344733-3185888103-1003\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows Defender\Features => (TamperProtection: 5) (TamperProtectionSource: 2)
HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection => (DpaDisabled: 0)
==================== MSCONFIG/TASK MANAGER disabled items ==
(If an entry is included in the fixlist, it will be removed.)
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_0C0D5F59005A32876380EE3B976869A6"
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\StartupApproved\Run: => "com.evernote.Evernote"
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\StartupApproved\Run: => "electron.app.Notion"
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\StartupApproved\Run: => "Steam"
==================== FirewallRules (Whitelisted) ================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{DCDA7D5F-BAD3-4AC3-887A-1FF0CE918EDF}] => (Allow) C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe () [File not signed]
FirewallRules: [{C456FF6A-B402-47DC-973F-E0B60C7AEE40}] => (Allow) C:\Program Files\WindowsApps\Muse.MuseHub_2.0.22.1414_x64__rb9pth70m6nz6\Muse.exe (Musecy SM Ltd. -> Muse)
FirewallRules: [UDP Query User{C9D105A9-EFE9-4E55-A059-F2E6473FF292}C:\programdata\ableton\live 12 suite\program\ableton live 12 suite.exe] => (Block) C:\programdata\ableton\live 12 suite\program\ableton live 12 suite.exe (Ableton AG -> Ableton)
FirewallRules: [TCP Query User{C37E346A-AC58-4B29-A57A-497BB09F015C}C:\programdata\ableton\live 12 suite\program\ableton live 12 suite.exe] => (Block) C:\programdata\ableton\live 12 suite\program\ableton live 12 suite.exe (Ableton AG -> Ableton)
FirewallRules: [UDP Query User{438C1372-E898-4F07-9CAF-395B1C8E92CC}C:\program files (x86)\steam\steamapps\common\don't starve together\bin64\dontstarve_dedicated_server_nullrenderer_x64.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\don't starve together\bin64\dontstarve_dedicated_server_nullrenderer_x64.exe () [File not signed]
FirewallRules: [TCP Query User{93E3829C-321F-4F9F-B221-74B5FE63F672}C:\program files (x86)\steam\steamapps\common\don't starve together\bin64\dontstarve_dedicated_server_nullrenderer_x64.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\don't starve together\bin64\dontstarve_dedicated_server_nullrenderer_x64.exe () [File not signed]
FirewallRules: [{44C4C157-1090-4345-83C8-D472535FF0CE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe () [File not signed]
FirewallRules: [{5C3D1552-AF24-47E0-83FE-D20061D60CDA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe () [File not signed]
FirewallRules: [{56DD408E-A84B-48E1-8045-9720A3353B4A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin64\dontstarve_steam_x64.exe () [File not signed]
FirewallRules: [{EFEBFE4F-CFCB-42EB-8951-96464B032CA8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin64\dontstarve_steam_x64.exe () [File not signed]
FirewallRules: [{53D1731A-EE15-49F8-8A69-551D1864A670}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{C1E50A99-A437-46C6-8C15-F7D16BB81013}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{3A5B3175-44C1-4267-BC48-0DA39AA95664}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{AFF7F283-881A-41D0-A874-CA21CA4A4533}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [UDP Query User{9E97D50A-3296-4495-9868-89FC5FA86BAD}C:\users\max\appdata\local\programs\evernote\evernote.exe] => (Block) C:\users\max\appdata\local\programs\evernote\evernote.exe (Evernote Corporation -> Evernote Corporation)
FirewallRules: [TCP Query User{4C362C89-3309-4A5D-A550-23E95E9C4D53}C:\users\max\appdata\local\programs\evernote\evernote.exe] => (Block) C:\users\max\appdata\local\programs\evernote\evernote.exe (Evernote Corporation -> Evernote Corporation)
FirewallRules: [{2FF4D468-A4EA-4D04-A7CA-8DF4EC1A27E7}] => (Allow) C:\Users\Max\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{08618770-2935-44E6-8315-D319617ABB22}] => (Allow) C:\Users\Max\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{DF545393-3BCA-4F78-8B0A-13DE0A079C39}] => (Allow) C:\Users\Max\AppData\Roaming\Zoom\bin\Zoom.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)
FirewallRules: [UDP Query User{6C4AF77D-41F2-421C-875E-5B177081E658}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [TCP Query User{14BEA45F-D8F3-4C56-BE24-6C6E7C22D77C}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{639592F9-5607-414D-A656-42E6D30DBD44}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe (Samsung Electronics CO., LTD. -> )
FirewallRules: [{0E3A3005-30B0-49E8-A100-568D6930B6B6}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\EPM2Migrator.exe (HP Development Company, L.P.) [File not signed]
FirewallRules: [{6D9EA4BC-E5DE-4F03-8438-D3573C123DCF}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\EPM2AlertList.exe (HP Development Company, L.P.) [File not signed]
FirewallRules: [{1AE1BCFE-D98C-4068-B735-CDD6E8E0BC94}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\OrderSupplies.exe (HP Development Company, L.P.) [File not signed]
FirewallRules: [{ECB8DE01-B612-4FAC-89B1-9685A0139A98}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\EasyPrinterManagerV2.exe (HP Development Company, L.P.) [File not signed]
FirewallRules: [{266A8C72-6070-4759-9AD6-548B2E241114}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe (Samsung Electronics CO., LTD. -> )
FirewallRules: [{DC9DFE56-61F8-40DA-ABC5-2077595FA143}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe (Samsung Electronics CO., LTD. -> )
FirewallRules: [{D9C8E11E-196C-41E1-9B62-DFDE3FB5DF4D}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{0A23E61A-2478-43B6-AC3E-516F15A80940}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{274F5EB6-1F4C-4496-A7F9-0B4662B3AFA2}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_22133.500.1346.3200_x64__8wekyb3d8bbwe\msteams.exe => No File
FirewallRules: [{63DE7D38-F718-4AEF-8B14-41D70A905EDE}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_22133.500.1346.3200_x64__8wekyb3d8bbwe\msteams.exe => No File
FirewallRules: [{CD338D2A-D95C-419F-9511-3838A2730791}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_22133.500.1346.3200_x64__8wekyb3d8bbwe\msteams.exe => No File
FirewallRules: [{39C19BA6-DEA5-4807-89C8-0BCDA2107CD4}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_22133.500.1346.3200_x64__8wekyb3d8bbwe\msteams.exe => No File
FirewallRules: [{2BEB9C96-4962-49E8-8ACC-84F10D8D68F4}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_22082.402.1279.2578_x64__8wekyb3d8bbwe\msteams.exe => No File
FirewallRules: [{53397B33-82F4-4FC3-AFB7-83C540C9FC19}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_22082.402.1279.2578_x64__8wekyb3d8bbwe\msteams.exe => No File
FirewallRules: [{4BDB05A1-0D6F-4B95-ADAE-A18F228A6833}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Sims 2 Legacy Collection\EP9\TSBin\Sims2EP9.exe (Electronic Arts, Inc. -> Maxis, a division of Electronic Arts Inc.)
FirewallRules: [{FF5E3240-76AC-4BC0-BA9B-D34AFE02E8F4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Sims 2 Legacy Collection\EP9\TSBin\Sims2EP9.exe (Electronic Arts, Inc. -> Maxis, a division of Electronic Arts Inc.)
FirewallRules: [{4D39D26D-EECD-42B3-BDD0-CAC34A0FEAF0}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_25240.1703.3968.1284_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{D0F2B35B-102A-44A1-916A-EBF44579639B}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_25240.1703.3968.1284_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{F3D1F410-71D2-44B5-BFF9-00AFFC1E9313}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{E4466015-CA89-4C01-A585-5F69F7478765}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{0D58AFDD-DEC2-48E6-862D-1C6C5C66F524}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{05A52DD4-C0F3-4D3D-8808-9162AEE63837}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Stronghold\Stronghold.exe () [File not signed]
FirewallRules: [{ADA928EA-4B20-4BFC-8795-F57DE1CCCE0C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Stronghold\Stronghold.exe () [File not signed]
FirewallRules: [{7AD9ABAD-3C32-47BF-B4F6-6D56C5F5AA3E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Stronghold Crusader Extreme\Stronghold Crusader.exe () [File not signed]
FirewallRules: [{D432DA8A-C4A3-4372-8165-246D0227CA8C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Stronghold Crusader Extreme\Stronghold Crusader.exe () [File not signed]
FirewallRules: [EdgeWebView2-MDNS-In-UDP] => (Allow) C:\WINDOWS\system32\Microsoft-Edge-WebView\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{052867AC-CFA8-4EAB-9467-BCFA6321CC39}C:\users\max\appdata\local\google\chrome\application\chrome.exe] => (Block) C:\users\max\appdata\local\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [UDP Query User{14C102CE-4E18-4C92-BA86-8B5309B58232}C:\users\max\appdata\local\google\chrome\application\chrome.exe] => (Block) C:\users\max\appdata\local\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{0783D6FD-00B2-4518-82A2-0B5A03D0B551}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2610.35011.0_x64__8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{245B80A7-E3E8-4594-B42C-DDC29EB0D0AE}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2610.35011.0_x64__8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{8ABFDD5E-F1D4-4B0D-865E-EE150FE7F424}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2610.35011.0_x64__8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{B5729036-530F-4755-AF36-0B42BF0C3BCE}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2610.35011.0_x64__8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{9AAA5021-7580-404E-8A75-0712130003FC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Rollercoaster Tycoon 2\RCT2.EXE () [File not signed]
FirewallRules: [{86E73FFF-7B1D-40ED-8B27-12B509F975AA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Rollercoaster Tycoon 2\RCT2.EXE () [File not signed]
FirewallRules: [{551106B0-6F77-42B3-9591-F3A36ED5C268}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{C1E9E4D0-A6B1-4A43-AA4C-03900EE7BF11}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{CEB94A9A-8DE5-4335-ADCB-CE259EADD355}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{90F84CEB-4309-4F0E-A7F7-15B70DD75BB7}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{2BE3D22B-63F8-41AA-9634-E0440475FB39}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{757CA99F-C035-44DC-B03A-549199C38922}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{3EA5BBDF-A7E0-412D-A732-47D2CA954168}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{B4BF860A-DB94-4133-BE08-BDD06E5EAA91}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{71311F89-98EC-49F1-8115-B1B5B4560B41}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{0D2D6740-1EE1-4F04-85D4-224C24E00F36}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{78D38DDB-769A-4F6F-9089-FE40E938D4E5}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{3DCA92A1-E26B-4EFD-ADE5-DF1C0A6E8C7A}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{39019EB4-FCFD-4E2C-82B1-56E976388273}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe (Spotify AB -> Spotify Ltd)
==================== Restore Points =========================
==================== Faulty Device Manager Devices ============
==================== Event log errors: ========================
Application errors:
==================
Error: (10/23/2026 03:14:51 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 24892. Message ID: [0x2509].
Error: (10/21/2026 09:00:42 PM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-TSSNE97)
Description: Faulting application name: rct2.exe, version: 0.0.0.0, time stamp: 0x3e4c073e
Faulting module name: DDRAW.dll, version: 10.0.26100.8115, time stamp: 0x05d3234b
Exception code: 0xc0000005
Fault offset: 0x0003b717
Faulting process id: 0x3e6c
Faulting application start time: 0x1dd6184ca72e532
Faulting application path: C:\Program Files (x86)\Steam\steamapps\common\Rollercoaster Tycoon 2\rct2.exe
Faulting module path: C:\WINDOWS\SYSTEM32\DDRAW.dll
Report Id: 0b308fea-7898-4680-98ca-eed8c084ad18
Faulting package full name:
Faulting package-relative application ID:
Error: (10/21/2026 03:12:07 PM) (Source: Service1) (EventID: 0) (User: )
Description: Failed to process session change. System.NullReferenceException: Object reference not set to an instance of an object.
at HP.Watcher.WatcherEngine.FireEnrollmentCheckIfPresent()
at hptpsmarthealthservice.hptpsmarthealthservice.OnSessionChange(SessionChangeDescription changeDescription)
at System.ServiceProcess.ServiceBase.DeferredSessionChange(Int32 eventType, Int32 sessionId)
Error: (10/21/2026 01:40:09 PM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-TSSNE97)
Description: Faulting application name: node.exe, version: 24.13.0.0, time stamp: 0x6965436d
Faulting module name: growthsdk.node, version: 0.0.0.0, time stamp: 0x6983f035
Exception code: 0xc0000409
Fault offset: 0x000000000004b9a9
Faulting process id: 0x5bf0
Faulting application start time: 0x1dd614c88e8d53d
Faulting application path: C:\Program Files\Adobe\Adobe Creative Cloud Experience\libs\node.exe
Faulting module path: \\?\C:\Program Files\Adobe\Adobe Creative Cloud Experience\js\node_modules\@growthsdk\growthsdk\public\binaries\win.x64\Release\growthsdk.node
Report Id: f5698502-bcd8-45c2-a202-a7c0dd3ac006
Faulting package full name:
Faulting package-relative application ID:
Error: (10/21/2026 12:35:40 PM) (Source: Service1) (EventID: 0) (User: )
Description: Failed to process session change. System.NullReferenceException: Object reference not set to an instance of an object.
at HP.Watcher.WatcherEngine.FireEnrollmentCheckIfPresent()
at hptpsmarthealthservice.hptpsmarthealthservice.OnSessionChange(SessionChangeDescription changeDescription)
at System.ServiceProcess.ServiceBase.DeferredSessionChange(Int32 eventType, Int32 sessionId)
Error: (10/21/2026 09:35:33 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 7544. Message ID: [0x2509].
Error: (10/21/2026 01:29:26 AM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-TSSNE97)
Description: Faulting application name: rct2.exe, version: 0.0.0.0, time stamp: 0x3e4c073e
Faulting module name: DDRAW.dll, version: 10.0.26100.8115, time stamp: 0x05d3234b
Exception code: 0xc000041d
Fault offset: 0x0001604e
Faulting process id: 0x677c
Faulting application start time: 0x1dd60d54ad7e2dd
Faulting application path: C:\Program Files (x86)\Steam\steamapps\common\Rollercoaster Tycoon 2\rct2.exe
Faulting module path: C:\WINDOWS\SYSTEM32\DDRAW.dll
Report Id: 60873242-28da-4381-8031-5e2896f5efc4
Faulting package full name:
Faulting package-relative application ID:
Error: (10/21/2026 01:29:19 AM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-TSSNE97)
Description: Faulting application name: rct2.exe, version: 0.0.0.0, time stamp: 0x3e4c073e
Faulting module name: DDRAW.dll, version: 10.0.26100.8115, time stamp: 0x05d3234b
Exception code: 0xc0000005
Fault offset: 0x0001604e
Faulting process id: 0x677c
Faulting application start time: 0x1dd60d54ad7e2dd
Faulting application path: C:\Program Files (x86)\Steam\steamapps\common\Rollercoaster Tycoon 2\rct2.exe
Faulting module path: C:\WINDOWS\SYSTEM32\DDRAW.dll
Report Id: 956711fd-4af4-4c38-be93-3686a2d2d420
Faulting package full name:
Faulting package-relative application ID:
System errors:
=============
Error: (10/23/2026 09:26:01 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-TSSNE97)
Description: The server {B8C1DCAE-5020-4F5D-BA2A-85292744E334} did not register with DCOM within the required timeout.
Error: (10/23/2026 09:25:33 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {338B40F9-9D68-4B53-A793-6B9AA0C5F63B} did not register with DCOM within the required timeout.
Error: (10/23/2026 09:24:08 AM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY)
Description: The Secure Boot update failed to update SBAT with error -1878589247. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931
Error: (10/22/2026 11:24:49 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1042) (User: DESKTOP-TSSNE97)
Description: You cannot uninstall language de-DE because the language is the system installed UI language.
Error: (10/22/2026 03:17:06 PM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY)
Description: The Secure Boot update failed to update SBAT with error -1878589247. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931
Error: (10/22/2026 05:20:01 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-TSSNE97)
Description: The server {F4DF18B4-A2CF-4B0A-8D62-954CD6AD2E33} did not register with DCOM within the required timeout.
Error: (10/22/2026 05:18:06 AM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY)
Description: The Secure Boot update failed to update SBAT with error -1878589247. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931
Error: (10/21/2026 11:38:32 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1042) (User: DESKTOP-TSSNE97)
Description: You cannot uninstall language de-DE because the language is the system installed UI language.
Error: (10/14/2026 04:30:42 AM) (Source: Microsoft-Windows-FilterManager) (EventID: 3) (User: NT AUTHORITY)
Description: Filter Manager failed to attach to volume '\Device\Harddisk1\DR1'. This volume will be unavailable for filtering until a reboot. The final status was 0xc03a001c.
Windows Defender:
================
TimeCreated : 10/21/2026 9:28:34 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {072CA2F9-2321-4B6F-BD6E-FA36FAE32B3A}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/21/2026 9:06:06 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {30E165D6-75C4-48E8-8300-399B8BB92F15}
Scan Type: Antimalware
Scan Parameters: Full Scan
User: DESKTOP-TSSNE97\Max
Stop Reason: Unknown
TimeCreated : 10/21/2026 7:30:43 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {C53AE4C9-1B82-4B11-A292-41CD5C11BE63}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: RPC connection rundown
TimeCreated : 10/20/2026 8:08:05 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {0E3A951D-F3CD-46EE-B17E-5711A1FD6140}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/18/2026 11:29:55 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {109E7722-F85A-469C-9536-5ECC0F3DD690}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/18/2026 12:59:42 AM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {25345172-C5D5-4F81-8692-64030B2E1A6E}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/16/2026 4:45:41 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {52EF3B45-DE3D-4D7F-A9E7-7ACB25BD2D6D}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/15/2026 5:06:23 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {6EA414F5-4339-42A8-80BB-37EA431A569F}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
CodeIntegrity:
===============
Date: 2026-10-23 12:23:09
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\SecurityHealthService.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dll that did not meet the Windows signing level requirements.
==================== Memory info ===========================
BIOS: HP U97 Ver. 01.19.00 06/11/2026
Motherboard: HP 89C0
Processor: 12th Gen Intel(R) Core(TM) i7-12700H
Percentage of memory in use: 64%
Total physical RAM: 32400.46 MB
Available physical RAM: 11380.68 MB
Total Virtual: 34448.46 MB
Available Virtual: 7247.69 MB
==================== Drives ================================
Disk 0 - Drive c: (Windows ) (Fixed) (Total:952.47 GB) (Free:106.15 GB) (Model: KXG80ZNV1T02 KIOXIA) (Protected) NTFS
Disk 0 - \\?\Volume{75b6a490-21e4-4310-92f3-a52379ddf552}\ () (Fixed) (Total:1.13 GB) (Free:115.14 MB) NTFS
Disk 0 - \\?\Volume{ebc844c4-453a-41b9-984a-abf74f8ce0ad}\ (SYSTEM) (Fixed) (Total:256 MB) (Free:148.17 MB) FAT32
\\?\Volume{c92f4444-f408-11ee-83eb-00a55491e5f5}\ () () (Total:0 bytes) (Free:0 bytes)
==================== MBR & Partition Table ====================
============================================================
Disk: 0 (Size: 953.87 GB) (Disk ID: 2057CB08)
Partitions:
===========
Partition Style : GPT
Partition Count : 4
Disk ID : {8F6E2246-04D5-4C38-80A1-BE5EBD02F3B2}
Usable Offset : 0.02 MB
Usable Length : 953.87 GB
Max Partitions : 128
Partition 1
Type : EFI System Partition
Size : 260 MB
Offset : 1 MB
Type GUID : {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}
Partition GUID : {EBC844C4-453A-41B9-984A-ABF74F8CE0AD}
GPT Name : EFI system partition
Attributes : 0x0000000000000000
Attribute Flags : None
Hidden : Yes
Platform Required: No
------------------------------------------------------------
Partition 2
Type : Microsoft Reserved (MSR)
Size : 16 MB
Offset : 261 MB
Type GUID : {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}
Partition GUID : {0996B926-9638-4D99-B012-130299591DB2}
GPT Name : Microsoft reserved partition
Attributes : 0x0000000000000000
Attribute Flags : None
Hidden : Yes
Platform Required: No
------------------------------------------------------------
Partition 3
Type : Basic Data Partition
Size : 952.47 GB
Offset : 277 MB
Type GUID : {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}
Partition GUID : {8A2DC34A-71B5-4F7B-9D34-05659B50FA83}
GPT Name : Basic data partition
Attributes : 0x0000000000000000
Attribute Flags : None
Hidden : No
Platform Required: No
------------------------------------------------------------
Partition 4
Type : Windows Recovery
Size : 1.13 GB
Offset : 975604 MB
Type GUID : {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}
Partition GUID : {75B6A490-21E4-4310-92F3-A52379DDF552}
Attributes : 0x8000000000000001
Attribute Flags : Platform Required, No Default Drive Letter
Hidden : Yes
Platform Required: Yes
------------------------------------------------------------
============================================================
==================== End of Addition.txt =======================
Und hier Malwarebytes: Code:
ATTFilter Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 10/21/2026
Scan Time: 9:53 PM
Log File: 13f88f56-cd89-11f1-88e9-7c4d8fa5f158.json
-Software Information-
Version: 5.7.3.376
Components Version: 167.0.5780
Update Package Version: 1.0.116015
License: Trial
-System Information-
OS: Windows 11 (Build 26200.9711)
CPU: x64
File System: NTFS
User: DESKTOP-TSSNE97\Max
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 281,429
Threats Detected: 0
Threats Quarantined: 0
Scan Duration: 6 min, 44 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
File system: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 0
(No malicious items detected)
Registry Value: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
File: 0
(No malicious items detected)
Physical Sector: 0
(No malicious items detected)
WMI: 0
(No malicious items detected)
(end)
Geändert von Maxi92 (23.10.2026 um 14:52 Uhr) |
|
23.10.2026, 18:58
| #3 |
| /// TB-Ausbilder   | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Mein Name ist Matthias und ich werde dir bei der Analyse und Bereinigung deines Systems helfen. Es gibt Infostealer, die sich nach dem Ausspähen der Daten selbst löschen und dann nichts mehr auf dem System zu finden ist. In den Logs gibt es ein paar ungewöhnliche / auffällige Einträge, um die wir uns kümmern sollten. Aktive Malware sehe ich aber nicht (mehr). Wir starten mit einem FRST-Fix und einem Scan mit ESET. Vorab wichtige Hinweise: Wir führen eine Reparatur mit FRST durch. Dabei werden schädliche und verwaiste Einträge entfernt sowie temporären Dateien und der Papierkorb geleert. Außerdem werden die Systemdateien auf Fehler überprüft. Bitte gedulde dich, sobald du die Reparatur gestartet hast. Je nach Art und Umfang der notwendigen Reparaturen kann dies einige Minuten dauern. Eventuell erhältst du während der Reparatur auch die Information "keine Rückmeldung" von FRST. Das ist normal, du musst nichts weiter tun, nur abwarten... ggf. mit etwas anderem beschäftigen.  Schritt 1 - Reparatur mit FRST HINWEIS AN ALLE MITLESER: Dieses FRST-Skript ist ausschließlich für diesen Nutzer gedacht und sollte niemals 1:1 für ein anderes System verwendet werden!
Schritt 2 - Scan mit EOS Führe ESET Online Scanner (EOS) gemäß der bebilderten Anleitung aus und poste abschließend die Logdatei.
__________________ |
|
24.10.2026, 10:32
| #4 |
| | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Hallo Matthias, vielen Lieben Dank, dass du mir hilfst! Einmal der Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (x64) Version: 22-10-2026
Ran by Max (23-10-2026 22:39:24) Run:1
Running from C:\Users\Max\Downloads
Loaded Profiles: Max & WsiAccount
Boot Mode: Normal
==============================================
fixlist content:
*****************
Start::
SystemRestore: ON
CreateRestorePoint:
CloseProcesses:
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [electron.app.Notion] => C:\Users\Max\AppData\Local\Programs\Notion\Notion.exe --open-at-login (No File)
AppInit_DLLs: c:\PROGRA~1\HP\SURECL~1\servers\BemHook.dll => No File
GroupPolicy: Restriction - Chrome <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File)
FF Notifications: Mozilla\Firefox\Profiles\2yd52xta.default-release -> hxxps://pomofocus.io; hxxps://mapio.net; hxxps://mail.proton.me; hxxps://app.zoom.us
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{13357088-9834-0409-1600-134951500000}\localserver32 -> "C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{38142727-3008-9161-1521-349515000000}\localserver32 -> "C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe" -ToastActivated => No File
AlternateDataStreams: C:\Users\Max\Downloads\FRST64.exe:MBAM.Zone.Identifier [225]
CMD: cscript /nologo %systemroot%\System32\slmgr.vbs /dlv
CMD: netsh winsock reset
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh winhttp reset proxy
RemoveProxy:
CMD: Winmgmt /salvagerepository
CMD: Winmgmt /verifyrepository
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: Winmgmt /resyncperf
CMD: sfc /scannow
Hosts:
EmptyTemp:
End::
*****************
SystemRestore: ON => completed
Restore point was successfully created.
Processes closed successfully.
HKLM\SOFTWARE\Microsoft\Windows Defender\\"DisableAntiSpyware"="0" => value restored successfully
HKLM\SOFTWARE\Microsoft\Windows Defender\\"DisableAntiVirus"="0" => value restored successfully
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => removed successfully
"HKU\S-1-5-21-571881649-101344733-3185888103-1002\Software\Microsoft\Windows\CurrentVersion\Run\\electron.app.Notion" => removed successfully
"c:\PROGRA~1\HP\SURECL~1\servers\BemHook.dll" => Value data removed successfully
"C:\WINDOWS\system32\GroupPolicy\Machine" Folder move:
C:\WINDOWS\system32\GroupPolicy\Machine\Registry.pol => moved successfully
C:\WINDOWS\system32\GroupPolicy\Machine => moved successfully
C:\WINDOWS\system32\GroupPolicy\GPT.ini => moved successfully
C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini => moved successfully
"C:\WINDOWS\system32\GroupPolicy\User" Folder move:
C:\WINDOWS\system32\GroupPolicy\User\Registry.pol => moved successfully
C:\WINDOWS\system32\GroupPolicy\User => moved successfully
C:\ProgramData\NTUSER.pol => moved successfully
HKLM\SOFTWARE\Policies\Mozilla => removed successfully
HKLM\SOFTWARE\Policies\Google => removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Edge => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{077BA067-7C15-40F0-B22E-C9DC2A54B4A2}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{077BA067-7C15-40F0-B22E-C9DC2A54B4A2}" => removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\Location\Notifications => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Location\Notifications" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => removed successfully
C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" => removed successfully
"FF Notifications:" => removed successfully
HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{13357088-9834-0409-1600-134951500000} => removed successfully
HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{38142727-3008-9161-1521-349515000000} => removed successfully
C:\Users\Max\Downloads\FRST64.exe => ":MBAM.Zone.Identifier" ADS removed successfully
========= cscript /nologo %systemroot%\System32\slmgr.vbs /dlv =========
Software licensing service version: 10.0.26100.9711
Name: Windows(R), Professional edition
Description: Windows(R) Operating System, OEM_DM channel
Activation ID: fe74f55b-0338-41d6-b267-4a201abe7285
Application ID: 55c92734-d682-4d71-983e-d6ec3f16059f
Extended PID: 03612-03556-087-602884-02-2057-26100.0000-0472025
Product Key Channel: OEM:DM
Installation ID: 124867398213746884980314724585323416486983392961020218242842402
Use License URL: https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=DM
Validation URL: https://validation-v2.sls.microsoft.com/SLWGA/slwga.asmx
Partial Product Key: WQK86
License Status: Licensed
Remaining Windows rearm count: 1001
Remaining SKU rearm count: 1001
Trusted time: 23/10/2026 22:39:54
========= End of CMD: =========
========= netsh winsock reset =========
Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.
========= End of CMD: =========
========= netsh advfirewall reset =========
Ok.
========= End of CMD: =========
========= netsh advfirewall set allprofiles state ON =========
Ok.
========= End of CMD: =========
========= netsh winhttp reset proxy =========
Current WinHTTP proxy settings:
Direct access (no proxy server).
========= End of CMD: =========
========= RemoveProxy: =========
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-571881649-101344733-3185888103-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-571881649-101344733-3185888103-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-571881649-101344733-3185888103-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-571881649-101344733-3185888103-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
========= End of RemoveProxy: =========
========= Winmgmt /salvagerepository =========
WMI repository is consistent
========= End of CMD: =========
========= Winmgmt /verifyrepository =========
WMI repository is consistent
========= End of CMD: =========
========= "%WINDIR%\SYSTEM32\lodctr.exe" /R =========
Info: Successfully rebuilt performance counter settings from system backup store.
========= End of CMD: =========
========= "%WINDIR%\SysWOW64\lodctr.exe" /R =========
Info: Successfully rebuilt performance counter settings from system backup store.
========= End of CMD: =========
========= "%WINDIR%\SYSTEM32\lodctr.exe" /R =========
Info: Successfully rebuilt performance counter settings from system backup store.
========= End of CMD: =========
========= "%WINDIR%\SysWOW64\lodctr.exe" /R =========
Info: Successfully rebuilt performance counter settings from system backup store.
========= End of CMD: =========
========= Winmgmt /resyncperf =========
0
========= End of CMD: =========
========= sfc /scannow =========
Beginning system scan. This process will take some time.
Beginning verification phase of system scan.
Verification 0% complete.
Verification 0% complete.
Verification 1% complete.
Verification 1% complete.
Verification 2% complete.
Verification 2% complete.
Verification 3% complete.
Verification 3% complete.
Verification 3% complete.
Verification 4% complete.
Verification 4% complete.
Verification 5% complete.
Verification 5% complete.
Verification 6% complete.
Verification 6% complete.
Verification 6% complete.
Verification 7% complete.
Verification 7% complete.
Verification 8% complete.
Verification 8% complete.
Verification 9% complete.
Verification 9% complete.
Verification 9% complete.
Verification 10% complete.
Verification 10% complete.
Verification 11% complete.
Verification 11% complete.
Verification 12% complete.
Verification 12% complete.
Verification 12% complete.
Verification 13% complete.
Verification 13% complete.
Verification 14% complete.
Verification 14% complete.
Verification 15% complete.
Verification 15% complete.
Verification 15% complete.
Verification 16% complete.
Verification 16% complete.
Verification 17% complete.
Verification 17% complete.
Verification 18% complete.
Verification 18% complete.
Verification 19% complete.
Verification 19% complete.
Verification 19% complete.
Verification 20% complete.
Verification 20% complete.
Verification 21% complete.
Verification 21% complete.
Verification 22% complete.
Verification 22% complete.
Verification 22% complete.
Verification 23% complete.
Verification 23% complete.
Verification 24% complete.
Verification 24% complete.
Verification 25% complete.
Verification 25% complete.
Verification 25% complete.
Verification 26% complete.
Verification 26% complete.
Verification 27% complete.
Verification 27% complete.
Verification 28% complete.
Verification 28% complete.
Verification 28% complete.
Verification 29% complete.
Verification 29% complete.
Verification 30% complete.
Verification 30% complete.
Verification 31% complete.
Verification 31% complete.
Verification 31% complete.
Verification 32% complete.
Verification 32% complete.
Verification 33% complete.
Verification 33% complete.
Verification 34% complete.
Verification 34% complete.
Verification 34% complete.
Verification 35% complete.
Verification 35% complete.
Verification 36% complete.
Verification 36% complete.
Verification 37% complete.
Verification 37% complete.
Verification 38% complete.
Verification 38% complete.
Verification 38% complete.
Verification 39% complete.
Verification 39% complete.
Verification 40% complete.
Verification 40% complete.
Verification 41% complete.
Verification 41% complete.
Verification 41% complete.
Verification 42% complete.
Verification 42% complete.
Verification 43% complete.
Verification 43% complete.
Verification 44% complete.
Verification 44% complete.
Verification 44% complete.
Verification 45% complete.
Verification 45% complete.
Verification 46% complete.
Verification 46% complete.
Verification 47% complete.
Verification 47% complete.
Verification 47% complete.
Verification 48% complete.
Verification 48% complete.
Verification 49% complete.
Verification 49% complete.
Verification 50% complete.
Verification 50% complete.
Verification 50% complete.
Verification 51% complete.
Verification 51% complete.
Verification 52% complete.
Verification 52% complete.
Verification 53% complete.
Verification 53% complete.
Verification 54% complete.
Verification 54% complete.
Verification 54% complete.
Verification 55% complete.
Verification 55% complete.
Verification 56% complete.
Verification 56% complete.
Verification 57% complete.
Verification 57% complete.
Verification 57% complete.
Verification 58% complete.
Verification 58% complete.
Verification 59% complete.
Verification 59% complete.
Verification 60% complete.
Verification 60% complete.
Verification 60% complete.
Verification 61% complete.
Verification 61% complete.
Verification 62% complete.
Verification 62% complete.
Verification 63% complete.
Verification 63% complete.
Verification 63% complete.
Verification 64% complete.
Verification 64% complete.
Verification 65% complete.
Verification 65% complete.
Verification 66% complete.
Verification 66% complete.
Verification 66% complete.
Verification 67% complete.
Verification 67% complete.
Verification 68% complete.
Verification 68% complete.
Verification 69% complete.
Verification 69% complete.
Verification 69% complete.
Verification 70% complete.
Verification 70% complete.
Verification 71% complete.
Verification 71% complete.
Verification 72% complete.
Verification 72% complete.
Verification 73% complete.
Verification 73% complete.
Verification 73% complete.
Verification 74% complete.
Verification 74% complete.
Verification 75% complete.
Verification 75% complete.
Verification 76% complete.
Verification 76% complete.
Verification 76% complete.
Verification 77% complete.
Verification 77% complete.
Verification 78% complete.
Verification 78% complete.
Verification 79% complete.
Verification 79% complete.
Verification 79% complete.
Verification 80% complete.
Verification 80% complete.
Verification 81% complete.
Verification 81% complete.
Verification 82% complete.
Verification 82% complete.
Verification 82% complete.
Verification 83% complete.
Verification 83% complete.
Verification 84% complete.
Verification 84% complete.
Verification 85% complete.
Verification 85% complete.
Verification 85% complete.
Verification 86% complete.
Verification 86% complete.
Verification 87% complete.
Verification 87% complete.
Verification 88% complete.
Verification 88% complete.
Verification 89% complete.
Verification 89% complete.
Verification 89% complete.
Verification 90% complete.
Verification 90% complete.
Verification 91% complete.
Verification 91% complete.
Verification 92% complete.
Verification 92% complete.
Verification 92% complete.
Verification 93% complete.
Verification 93% complete.
Verification 94% complete.
Verification 94% complete.
Verification 95% complete.
Verification 95% complete.
Verification 95% complete.
Verification 96% complete.
Verification 96% complete.
Verification 97% complete.
Verification 97% complete.
Verification 98% complete.
Verification 98% complete.
Verification 98% complete.
Verification 99% complete.
Verification 99% complete.
Verification 100% complete.
Windows Resource Protection found corrupt files and successfully repaired them.
For online repairs, details are included in the CBS log file located at
windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
repairs, details are included in the log file provided by the /OFFLOGFILE flag.
========= End of CMD: =========
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
=========== EmptyTemp: ==========
FlushDNS => completed
BITS transfer queue => 1572864 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 12661689 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 230056594 B
Windows/system/drivers => 44001113 B
Edge => 350972287 B
Chrome => 532963873 B
Firefox => 512690459 B
Opera => 0 B
Local\Temp, Local\*.tmp, LocalLow\Temp, Roaming\Temp, Roaming\*.tmp , Caches, history, cookies, recent:
Default => 5 B
ProgramData => 989185 B
Public => 0 B
systemprofile => 476669 B
systemprofile32 => 0 B
LocalService => 1421121 B
NetworkService => 491241 B
Max => 869172071 B
WsiAccount => 2613029 B
RecycleBin => 43338919234 B
EmptyTemp: => 42.75 GB temporary data Removed.
================================
The system needed a reboot.
==== End of Fixlog 22:46:36 ====
Hier der ESET Report: Code:
ATTFilter Scan report
2026-10-24 11:20:37
Files scanned: 2199303
Detected files: 0
Cleaned files: 0
Total scan time: 02:36:45
Scan status: Finished
Ist es ein realistisches Risiko dass jemand Zugriff auf meinen Bitwarden Vault hatte? Ich verwende ein langes einzigartiges Masterpasswort + Yubikey zur Sicherung. Anscheinend hat aber ja auch jemand Zugriff zu Google bekommen (ebenfalls mit starkem PW und TOTP). Zumindest sofern bei Google kein False-Positive Vorlag. LG, Max EDIT: Ich bekommen auch immernoch bei nahezu jeder Google-Anfrage ein CAPTCHA und das weiterhin nur auf diesem Laptop. Alle anderen Geräte im WIFI haben das nicht. Kann man das irgendwie beheben? Ich bin es langsam leid Google jedesmal zu zeigen dass ich weiß wie Brücken oder Fahrräder aussehen Geändert von Maxi92 (24.10.2026 um 10:37 Uhr) |
|
24.10.2026, 12:37
| #5 |
| /// TB-Ausbilder | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Servus, gut gemacht. Die Reparatur ist vollständig durchgelaufen.  Wir führen bitte einen neuen Suchlauf mit FRST durch. Wenn die Logs dann davon passen, dann schauen wir uns das Problem mit der Google-Warnung an. Aber an Malware liegt es nicht.  Wegen der Warnung... tritt diese mit JEDEM Browser auf (FF , EDG , CHR) oder nur bei FF? FRST-Scan
__________________ --- Malware Removal Helper since 2012 --- TrojanerBoard | BleepingComputer | Malwarebytes |
|
25.10.2026, 11:51
| #6 |
| | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Danke!! Hier einmal die logs: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-10-2026
Ran by Max (administrator) on DESKTOP-TSSNE97 (HP HP ZBook Power 15.6 inch G9 Mobile Workstation PC) (25-10-2026 11:29:02)
Running from C:\Users\Max\Downloads\FRST64.exe
Loaded Profiles: Max
Platform: Microsoft Windows 11 Pro Version 25H2 26200.9711 (X64) Language: German (Germany) -> English (United Kingdom)
Default browser: FF
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe
(C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe ->) (Adobe Inc. -> ) C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\CoreSync.exe
(C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe
(C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
(C:\Program Files\Mozilla Firefox\firefox.exe ->) (Mozilla Corporation -> Mozilla Foundation) C:\Program Files\Mozilla Firefox\crashhelper.exe
(C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.exe ->) (Intel Corporation -> Intel Corporation) C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.Graphics.exe
(C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.exe ->) (Intel Corporation -> Intel(R) Corporation) C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\PresentMonService.exe
(C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe ->) (Spotify AB -> ) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\crashpad_handler.exe
(DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\NetworkCap.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\BridgeCommunication.exe
(DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_uf.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_helper.exe
(DriverStore\FileRepository\snapo64.inf_amd64_33d62b688b005396\SNAPOSS64.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Sonitude Corporation) C:\Windows\System32\DriverStore\FileRepository\snapo64.inf_amd64_33d62b688b005396\SNAPOS64.exe
(explorer.exe ->) (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering, Ltd.) C:\Program Files\Focusrite\Drivers\Focusrite Notifier.exe
(explorer.exe ->) (Native Instruments GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareAccessibilityHelper.exe
(explorer.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e80b0ba89d6747cf\RtkAudUService64.exe
(explorer.exe ->) (Samsung Electronics CO., LTD. -> ) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(explorer.exe ->) (Thesycon Software Solutions GmbH & Co. KG -> ) C:\Program Files\Ableton\USB Audio Driver\x64\AbletonAudioCpl.exe
(HP Inc. -> ) C:\Program Files\WindowsApps\AD2F1837.myHP_61.52637.14262.0_x64__v10z8vjag6ke6\win32\DesktopExtension.exe
(HP Inc. -> HP Inc) C:\Program Files\WindowsApps\AD2F1837.myHP_61.52637.14262.0_x64__v10z8vjag6ke6\win32\HP.ContextAware.exe
(HP Inc. -> HP) C:\Program Files (x86)\HP\HP Notifications\HPNotifications.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe <8>
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\155.0.4283.62\msedgewebview2.exe <5>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\UUS\amd64\MoNotificationUx.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <17>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <2>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\NVWMI\nvWmi64.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e80b0ba89d6747cf\RtkAudUService64.exe
(services.exe ->) () [File not signed] C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(services.exe ->) (Bromium UK Limited -> HP) C:\Program Files\HP\Security Update Service\4.4.34.927\SecurityUpdateService.exe
(services.exe ->) (ELAN MICROELECTRONICS CORPORATION -> ELAN Microelectronics Corp.) C:\Windows\System32\ELAN_MOC_Service.exe
(services.exe ->) (FOR TESTING ONLY - IPF_PreProd_Cert -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dtt_sw.inf_amd64_683097297aaa9bb4\ipfsvc.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Program Files\HPCommRecovery\HPCommRecovery.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_b532962506597d3d\x64\TouchpointAnalyticsClientService.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\AppHelperCap.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\DiagsCap.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\NetworkCap.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\SysInfoCap.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\HotKeyServiceUWP.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\HPAudioAnalytics.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\LanWlanWwanSwitchingServiceUWP.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpsfuservice.inf_amd64_03ebfd05b519032c\HpSfuService64.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpsvcsscancomp.inf_amd64_df5bc9f22dc3c742\x64\hpsvcsscan.exe
(services.exe ->) (HP Inc. -> HP) C:\Program Files (x86)\HP\Shared\hpqwmiex.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_b45f13a105037dbe\jhi_service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_6d3406ba86e014cf\IntelCpHDCPSvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_uf.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_92a56761ef7ba712\WMIRegistrationService.exe
(services.exe ->) (Intel Corporation -> Intel(R) Corporation) C:\Windows\SysWOW64\XtuService.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Windows\System32\DriverStore\FileRepository\intcoed.inf_amd64_a952167d9e98b004\AS\IAS\IntelAudioService.exe
(services.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MidiSrv.exe
(services.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Fortemedia) C:\Windows\System32\FMService64.exe
(services.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Sonitude Corporation) C:\Windows\System32\DriverStore\FileRepository\snapo64.inf_amd64_33d62b688b005396\SNAPOSS64.exe
(services.exe ->) (Native Instruments GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(services.exe ->) (Native Instruments GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHostIntegrationAgent.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\Display.NvContainer\NVDisplay.Container.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\NVWMI\nvWmi64.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e80b0ba89d6747cf\RtkAudUService64.exe
(sihost.exe ->) (Microsoft Corporation -> ) C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4_102.2608.18002.0_x64__8wekyb3d8bbwe\MicrosoftSecurityApp\MicrosoftSecurityApp.exe
(sihost.exe ->) (Musecy SM Ltd. -> Muse) C:\Program Files\WindowsApps\Muse.MuseHub_2.0.22.1414_x64__rb9pth70m6nz6\Muse.exe
(sihost.exe ->) (Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe
(svchost.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files\Common Files\Adobe\Adobe OS Extension\AdobeNotificationClient.exe
(svchost.exe ->) (HP Inc. -> HP Inc.) C:\Program Files\HP\HP Client Security Manager\HP.ClientSecurityManager.exe
(svchost.exe ->) (HP) [File not signed] C:\Program Files (x86)\HP\HP ICS\ICS.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.StartExperiencesApp_1.398.2.0_x64__8wekyb3d8bbwe\MicrosoftStartFeedProvider\MicrosoftStartFeedProvider.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\DataExchangeHost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\NgcIso.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppActions.exe
Failed to access process -> vmmemCmZygote
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e80b0ba89d6747cf\RtkAudUService64.exe [3495976 2026-08-03] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [464608 2014-09-08] (Samsung Electronics CO., LTD. -> )
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-10] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM\...\Run: [Focusrite Notifier] => C:\Program Files\Focusrite\Drivers\Focusrite Notifier.exe [906840 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering, Ltd.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch [3952720 2022-06-01] (Microsoft Windows Hardware Compatibility Publisher -> Logitech, Inc.)
HKLM\...\Run: [Logi Download Assistant] => C:\Program Files\LogiDownloadAssistant\bin\logi_download_assistant.exe [19199488 2026-05-19] (Logitech, Inc.) [File not signed]
HKLM-x32\...\Run: [HPNotifications] => C:\Program Files (x86)\HP\HP Notifications\HPNotifications.exe [1607816 2021-02-11] (HP Inc. -> HP)
HKLM-x32\...\Run: [Adobe CCXProcess] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe [133128 2025-12-21] (Adobe Inc. -> Adobe Inc.)
HKLM\...\RunOnce: [msedge_cleanup_{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}] => C:\Program Files (x86)\Microsoft\Edge\Application\156.0.4314.42\Installer\setup.exe [6604616 2026-10-24] (Microsoft Corporation -> Microsoft Corporation)
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [com.evernote.Evernote] => C:\Users\Max\AppData\Local\Programs\Evernote\Evernote.exe [186384464 2025-02-05] (Evernote Corporation -> Evernote Corporation)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [5823128 2026-10-13] (Valve Corp. -> Valve Corporation)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [GoogleUpdaterTaskUser157.0.8089.0] => C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe [9958552 2026-10-06] (Google LLC -> Google LLC)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [MicrosoftEdgeAutoLaunch_0C0D5F59005A32876380EE3B976869A6] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5452616 2026-10-22] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Max\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" [134649192 2026-10-24] (Microsoft Corporation -> Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\Max\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File) <==== ATTENTION
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\RunOnce: [Uninstall 26.183.0920.0005] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Max\AppData\Local\Microsoft\OneDrive\26.183.0920.0005" [339968 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
HKLM\...\Windows x64\Print Processors\us016PC: C:\Windows\System32\spool\prtprocs\x64\us016pc.dll [61736 2022-02-24] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Codename Longhorn DDK provider)
HKLM\...\Print\Monitors\us016 Langmon: C:\WINDOWS\system32\us016lm.dll [40744 2022-02-24] (Microsoft Windows Hardware Compatibility Publisher -> )
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ableton USB Audio Control Panel Autostart.lnk [2024-10-20]
ShortcutTarget: Ableton USB Audio Control Panel Autostart.lnk -> C:\Program Files\Ableton\USB Audio Driver\x64\AbletonAudioCpl.exe (Thesycon Software Solutions GmbH & Co. KG -> )
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NIHardwareAccessibilityHelper.exe.lnk [2025-08-15]
ShortcutTarget: NIHardwareAccessibilityHelper.exe.lnk -> C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareAccessibilityHelper.exe (Native Instruments GmbH -> Native Instruments GmbH)
==================== Scheduled Tasks (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {4B664E1F-0135-4E8C-9111-9EC7D8564C9C} - System32\Tasks\Adobe Creative Cloud => C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2526688 2026-08-09] (Adobe Inc. -> Adobe Inc.)
Task: {FFCAC060-F32D-46D7-B285-75A677E275EB} - System32\Tasks\Adobe Uninstaller => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [446432 2026-08-09] (Adobe Inc. -> Adobe Inc.)
Task: {1796EA6D-448C-4FEB-94F7-D59D0013DA6B} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\Max\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner_nt64.exe [16359344 2026-10-23] (ESET, spol. s r.o. -> ESET)
Task: {5A4E1A96-2670-41FB-9029-159E4627C38B} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\Max\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner_nt64.exe [16359344 2026-10-23] (ESET, spol. s r.o. -> ESET)
Task: {E0AE496B-3D72-4199-9443-AA18ED717B30} - System32\Tasks\GoogleUser\GoogleUpdater\GoogleUpdaterTaskUser157.0.8089.0{2BAF6901-F450-4A6E-83B9-B4857DD5C8CE} => C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe [9958552 2026-10-06] (Google LLC -> Google LLC)
Task: {D5C82890-1F3E-4CE3-88EC-1CBE58277897} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\HP\HP Support Framework\Resources\HPSFReport.exe [480264 2026-08-13] (HP Inc. -> HP Inc.)
Task: {462495A0-DED9-4816-85F8-53086EA08498} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\HP\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1178696 2026-08-13] (HP Inc. -> HP Inc.)
Task: {10A29C9A-C44B-4CC1-87BB-47304EE2AFF9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\HP\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1178696 2026-08-13] (HP Inc. -> HP Inc.)
Task: {982F0742-CE09-42A5-A638-2D439839B13D} - System32\Tasks\HP\Consent Manager Launcher => C:\WINDOWS\system32\sc.exe [102400 2025-07-08] (Microsoft Windows -> Microsoft Corporation) -> start hptouchpointanalyticsservice
Task: {481DC351-7E79-470E-8F69-49CEE9EB3AD9} - System32\Tasks\HP\HP ICS\ICS => C:\Program Files (x86)\HP\HP ICS\ICS.exe [76824576 2022-05-06] (HP) [File not signed]
Task: {0728873B-9E3C-47FE-ACD4-EC001FB2AC5A} - System32\Tasks\HP\HP Wolf Security\Launch Console => C:\Program Files\HP\HP Client Security Manager\HP.ClientSecurityManager.exe [263752 2026-07-13] (HP Inc. -> HP Inc.)
Task: {B597665C-A2F0-4D37-B866-534EF1D4A93D} - System32\Tasks\Launch Adobe CCXProcess => C:\Program Files\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe [194112 2026-08-09] (Adobe Inc. -> Adobe Inc.)
Task: {E48E4801-66AA-40E0-85FE-D2B9B348C328} - System32\Tasks\Microsoft\Office\Office Actions Server => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ActionsServer\ActionsServer.exe [17065848 2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {1D9D8B2F-103E-4DDD-9E3C-C9E05D3A0335} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [31544720 2026-10-20] (Microsoft Corporation -> Microsoft Corporation)
Task: {60A35D2F-272A-4781-87C8-6331A1490C90} - System32\Tasks\Microsoft\Office\Office Background Push Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\opushutil.exe [15911344 2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {4518768A-4250-46F8-8671-3F4300FFC6FA} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [31544720 2026-10-20] (Microsoft Corporation -> Microsoft Corporation)
Task: {02F89182-1436-4134-B500-C0D9EF03E75A} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [427376 2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {166A5FAD-C150-4449-B2B7-F40D0203C8D8} - System32\Tasks\Microsoft\Office\Office Feature Updates C2R Client => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [31544720 2026-10-20] (Microsoft Corporation -> Microsoft Corporation)
Task: {CF8D834E-9318-468D-AD26-BAA1F35D7F35} - System32\Tasks\Microsoft\Office\Office Feature Updates C2R Client Logon => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [31544720 2026-10-20] (Microsoft Corporation -> Microsoft Corporation)
Task: {764C1ACD-4EB3-4A1A-9F84-6C5AC0691710} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [427376 2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {BA0B57C3-7BE7-4D3B-969B-5F92693DA0FE} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\operfmon.exe [1550184 2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {B527EFA2-4BE0-4DE6-B89B-96D6EA58060C} - System32\Tasks\Microsoft\Office\Office Startup Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ActionsServer\ActionsServer.exe [17065848 2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Task: {4F377EA7-6024-40A9-84A9-A1DF64484192} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [1080448 2026-10-20] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (the data entry has 6 more characters).
Task: {8A3F38F1-4048-47A5-8B1B-4F6671471F78} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-571881649-101344733-3185888103-1002 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [1080448 2026-10-20] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (the data entry has 6 more characters).
Task: {4F57E2E1-C128-47CC-8556-8EF63354E9C9} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [44160 2026-10-20] (Mozilla Corporation -> Mozilla Foundation)
Task: {329CF4E3-0C77-4EE3-A6C5-E0747B2BC40C} - System32\Tasks\NVIDIA App SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA App\CEF\NVIDIA App.exe [3346544 2026-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {A120F86D-A9FB-4E16-B28C-9C62FCD0646E} - System32\Tasks\nWizard_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [1546280 2022-08-24] (Nvidia Corporation -> NVIDIA Corporation) -> C:\Program Files\NVIDIA Corporation\nview\/installquiet
Task: {43A2A619-C3B7-43DD-A253-D8B11FF655F0} - System32\Tasks\SoftLanding\S-1-5-21-571881649-101344733-3185888103-1002\SoftLandingRefreshForExpirationTask-{86db12d0-a48c-434c-9879-abfa6c222376} => {F576B2F9-7850-4226-ADB0-E5993FED4F02}
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}\64259445A51224F6870264F6E60275C414E40273336303: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}\64259445A51224F6870264F6E60275C414E40273336303: [DhcpDomain] fritz.box
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}\84F6D656F56424: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}\84F6D656F56424: [DhcpDomain] fritz.box
FireFox:
========
FF TaskBarID: 6F114386CDBCE31 -> C:\Users\Max\AppData\Local\Mozilla Firefox
FF TaskBarID: 308046B0AF4A39CB -> C:\Program Files\Mozilla Firefox
FF DefaultProfile: 2yd52xta.default-release -> 308046B0AF4A39CB
FF DefaultProfile: 2yd52xta.default-release -> 641D10338ABA448D
FF ProfilePath: C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\9eh18pfb.default [2026-10-23]
FF ProfilePath: C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release [2026-10-25]
FF Homepage: Mozilla\Firefox\Profiles\2yd52xta.default-release -> hxxps://calendar.google.com/calendar/r
FF Extension: (LeechBlock NG) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\leechblockng@proginosko.com.xpi [2026-09-29]
FF Extension: (Unhook - Remove YouTube Recommended & Shorts) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\myallychou@gmail.com.xpi [2026-04-10]
FF Extension: (uBlock Origin) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\uBlock0@raymondhill.net.xpi [2026-09-27]
FF Extension: (Bitwarden Password Manager) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\{446900e4-71c2-419f-a6a7-df9c091e268b}.xpi [2025-07-07]
FF Extension: (Stylebot) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\{52bda3fd-dc48-4b3d-a7b9-58af57879f1e}.xpi [2026-10-17]
FF Extension: (Video Download Helper) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2026-10-21]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2026-08-09] (Adobe Inc. -> Adobe Systems)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2026-08-09] (Adobe Inc. -> Adobe Systems)
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default [2026-10-25]
Edge StartupUrls: Default -> "hxxp://google.com/"
Edge Extension: (Google Docs Offline) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-10-24]
Edge Extension: (video downloader - CocoCut) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hcppimlenafppomfhfmlfckomalgmmga [2026-10-24]
Edge Extension: (LeechBlock NG) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hnncfhodpmpjchmmcnimoimkcojdmfhl [2026-10-24]
Edge Extension: (Edge relevant text changes) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-02-03]
Edge Extension: (uBlock Origin) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\odfafepnkmbhccpbejgmiehpchacaeak [2026-10-24]
Chrome:
=======
CHR Profile: C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default [2026-10-23]
CHR DefaultSearchURL: Default -> hxxps://search.brave.com/search?q={searchTerms}
CHR DefaultSearchKeyword: Default -> search.brave.com
CHR DefaultSuggestURL: Default -> hxxps://search.brave.com/api/suggest?q={searchTerms}
CHR Extension: (Adobe Acrobat: PDF edit, convert, sign tools) - C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2026-06-15]
CHR Extension: (Google Docs Offline) - C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-06-15]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2025-12-06]
CHR HKU\S-1-5-21-571881649-101344733-3185888103-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [944608 2026-08-09] (Adobe Inc. -> Adobe Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [12773776 2026-10-20] (Microsoft Corporation -> Microsoft Corporation)
R2 dptftcs; C:\WINDOWS\System32\DriverStore\FileRepository\dtt_sw.inf_amd64_683097297aaa9bb4\ipfsvc.exe [562040 2024-05-24] (FOR TESTING ONLY - IPF_PreProd_Cert -> Intel Corporation)
R2 ELAN_MOC_Service; C:\WINDOWS\System32\ELAN_MOC_Service.exe [249856 2026-06-12] (ELAN MICROELECTRONICS CORPORATION -> ELAN Microelectronics Corp.)
R2 FMAPOService; C:\WINDOWS\System32\FMService64.exe [1028024 2024-05-17] (Microsoft Windows Hardware Compatibility Publisher -> Fortemedia)
R2 Focusrite Control Server; C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe [1297920 2024-03-11] () [File not signed]
R2 HotKeyServiceUWP; C:\WINDOWS\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\HotKeyServiceUWP.exe [1487016 2026-03-13] (HP Inc. -> HP Inc.)
R2 HP Comm Recover; C:\Program Files\HPCommRecovery\HPCommRecovery.exe [893984 2022-08-15] (HP Inc. -> HP Inc.)
R2 HPAppHelperCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\AppHelperCap.exe [909464 2025-09-30] (HP Inc. -> HP Inc.)
R2 HPAudioAnalytics; C:\WINDOWS\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\HPAudioAnalytics.exe [496808 2026-03-13] (HP Inc. -> HP Inc.)
R2 HPDiagsCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\DiagsCap.exe [907936 2025-09-30] (HP Inc. -> HP Inc.)
R2 HPNetworkCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\NetworkCap.exe [903840 2025-09-30] (HP Inc. -> HP Inc.)
R3 hpqcaslwmiex; C:\Program Files (x86)\HP\Shared\hpqwmiex.exe [1149448 2020-07-23] (HP Inc. -> HP)
R2 hpsvcsscan; C:\WINDOWS\System32\DriverStore\FileRepository\hpsvcsscancomp.inf_amd64_df5bc9f22dc3c742\x64\hpsvcsscan.exe [7142248 2026-02-18] (HP Inc. -> HP Inc.)
R2 HPSysInfoCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\SysInfoCap.exe [909464 2025-09-30] (HP Inc. -> HP Inc.)
R2 HpTouchpointAnalyticsService; C:\WINDOWS\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_b532962506597d3d\x64\TouchpointAnalyticsClientService.exe [639776 2025-10-01] (HP Inc. -> HP Inc.)
S2 Intel(R) Platform License Manager Service; C:\WINDOWS\System32\DriverStore\FileRepository\iclsclient.inf_amd64_b4ad878dc01a7e41\lib\PlatformLicenseManagerService.exe [741600 2024-03-13] (Intel Corporation -> Intel(R) Corporation)
R2 IntelAudioService; C:\WINDOWS\System32\DriverStore\FileRepository\intcoed.inf_amd64_a952167d9e98b004\AS\IAS\IntelAudioService.exe [532960 2025-12-16] (Intel Corporation -> Intel)
R2 IntelGraphicsSoftwareService; C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.exe [324040 2026-10-14] (Intel Corporation -> Intel Corporation)
R2 ipfsvc; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_uf.exe [3084992 2024-05-23] (Intel Corporation -> Intel Corporation)
R2 LanWlanWwanSwitchingServiceUWP; C:\WINDOWS\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\LanWlanWwanSwitchingServiceUWP.exe [594600 2026-03-13] (HP Inc. -> HP Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [11667696 2026-10-21] (Malwarebytes Inc -> Malwarebytes)
S3 MBVpnTunnelService; C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe [4291576 2026-10-21] (Malwarebytes Inc -> Malwarebytes)
S3 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpDefenderCoreService.exe [2398680 2026-10-14] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 Muse Hub Updater Service; C:\Program Files\WindowsApps\Muse.MuseHub_2.0.22.1414_x64__rb9pth70m6nz6\Muse.Updater.exe [6213200 2024-11-01] (Musecy SM Ltd. -> Muse.Updater)
R2 NIHostIntegrationAgent; C:\Program Files\Common Files\Native Instruments\Hardware\NIHostIntegrationAgent.exe [27618648 2025-03-20] (Native Instruments GmbH -> Native Instruments GmbH)
S2 NTKDaemonService; C:\Program Files\Common Files\Native Instruments\NTK\NTKDaemon.exe [18193304 2025-10-09] (Native Instruments GmbH -> Native Instruments GmbH)
R2 NVDisplay.ContainerLocalSystem; C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\Display.NvContainer\NVDisplay.Container.exe [1702632 2026-03-18] (NVIDIA Corporation -> NVIDIA Corporation)
R2 NVWMI; C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\NVWMI\nvWmi64.exe [4568808 2026-03-18] (NVIDIA Corporation -> NVIDIA Corporation)
R2 SecurityUpdateService; C:\Program Files\HP\Security Update Service\4.4.34.927\SecurityUpdateService.exe [5314376 2026-10-01] (Bromium UK Limited -> HP)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [914752 2026-09-13] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SFUService; C:\WINDOWS\System32\DriverStore\FileRepository\hpsfuservice.inf_amd64_03ebfd05b519032c\HpSfuService64.exe [961192 2026-06-23] (HP Inc. -> HP Inc.)
R2 SNAPOService; C:\WINDOWS\System32\DriverStore\FileRepository\snapo64.inf_amd64_33d62b688b005396\SNAPOSS64.exe [830232 2025-12-17] (Microsoft Windows Hardware Compatibility Publisher -> Sonitude Corporation)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\NisSrv.exe [5555528 2026-10-14] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MsMpEng.exe [378168 2026-10-14] (Microsoft Windows Publisher -> Microsoft Corporation)
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 arturiausbmidi; C:\WINDOWS\System32\DriverStore\FileRepository\arturiausbmidi.inf_amd64_3b60ea58f3448d4a\arturiausbmidi.sys [434352 2024-11-28] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 arturiausbmidiks; C:\WINDOWS\System32\DriverStore\FileRepository\arturiausbmidiks.inf_amd64_82108088788d0cec\arturiausbmidiks.sys [55480 2024-11-28] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 atc; C:\WINDOWS\System32\DRIVERS\atc.sys [5579176 2023-06-01] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender S.R.L. Bucharest, ROMANIA)
R3 bomebus; C:\WINDOWS\System32\drivers\bomebus.sys [56376 2018-05-16] (Bome Software GmbH & Co.KG -> Bome Software GmbH & Co. KG)
S3 bomemidi; C:\WINDOWS\system32\drivers\bomemidi.sys [50744 2018-05-16] (Bome Software GmbH & Co.KG -> Bome Software GmbH & Co. KG)
S3 Ccx01000; C:\WINDOWS\System32\drivers\Ccx01000.sys [692224 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus2.sys [176976 2026-04-21] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
R3 e1dexpress; C:\WINDOWS\System32\DriverStore\FileRepository\e1d.inf_amd64_f3c6513565231a23\e1d.sys [609456 2022-11-14] (Intel Corporation -> Intel Corporation)
R1 ESProtectionDriver; \??\C:\WINDOWS\system32\drivers\mbae.sys [159296 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> )
R3 FocusritePCIeSwRoot; C:\WINDOWS\System32\drivers\FocusritePCIeSwRoot.sys [106208 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsb; C:\WINDOWS\System32\drivers\FocusriteUsb.sys [170312 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbAudio; C:\WINDOWS\System32\drivers\FocusriteUsbAudio.sys [109896 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbMidi; C:\WINDOWS\System32\drivers\FocusriteUsbMidi.sys [53576 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbSwRoot; C:\WINDOWS\System32\drivers\FocusriteUsbSwRoot.sys [112968 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R0 fse; C:\WINDOWS\System32\drivers\fse.sys [240968 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
R1 Gemma; C:\WINDOWS\System32\DRIVERS\gemma.sys [1322912 2023-06-01] (Microsoft Windows Hardware Compatibility Publisher -> BitDefender S.R.L. Bucharest, ROMANIA)
R3 HPCustomCapDriver; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapdriver.inf_amd64_1421dec2010cc057\x64\hpcustomcapdriver.sys [18984 2024-05-07] (Microsoft Windows Hardware Compatibility Publisher -> HP Inc.)
R3 iaLPSS2_GPIO2_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_gpio2_adl.inf_amd64_302e75596cffa74a\iaLPSS2_GPIO2_ADL.sys [150616 2022-10-18] (Intel Corporation -> Intel Corporation)
R3 iaLPSS2_I2C_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_i2c_adl.inf_amd64_e736c048ca307ed2\iaLPSS2_I2C_ADL.sys [220224 2022-10-18] (Intel Corporation -> Intel Corporation)
R3 iaLPSS2_SPI_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_spi_adl.inf_amd64_334c460fea9b11a4\iaLPSS2_SPI_ADL.sys [171608 2022-10-18] (Intel Corporation -> Intel Corporation)
R3 iaLPSS2_UART2_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_uart2_adl.inf_amd64_43d5df63d19fde70\iaLPSS2_UART2_ADL.sys [329320 2022-10-18] (Intel Corporation -> Intel Corporation)
R3 IntcUSB; C:\WINDOWS\System32\DriverStore\FileRepository\intcusb.inf_amd64_7e96b5cfecffcac7\IntcUSB.sys [949216 2025-12-16] (Intel Corporation -> Intel(R) Corporation)
R3 IntelGNA; C:\WINDOWS\System32\DriverStore\FileRepository\gna.inf_amd64_04d4eecc5838a558\gna.sys [88760 2022-07-06] (Intel Corporation -> Intel Corporation)
R3 ipf_acpi; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_acpi.inf_amd64_d8fafa4e2f98ceba\ipf_acpi.sys [88768 2024-05-23] (Intel Corporation -> Intel Corporation)
R3 ipf_cpu; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_cpu.sys [88144 2024-05-23] (Intel Corporation -> Intel Corporation)
R3 ipf_lf; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_lf.sys [499392 2024-05-23] (Intel Corporation -> Intel Corporation)
S3 KslD; C:\WINDOWS\System32\drivers\wd\KslD.sys [82968 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
S2 l1vhlwf; C:\WINDOWS\System32\drivers\l1vhlwf.sys [155000 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
R2 mbamchameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [235624 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [22120 2026-10-21] (Microsoft Windows Early Launch Anti-Malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\Drivers\farflt11.sys [217704 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\System32\Drivers\mbam.sys [133224 2026-10-23] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [245864 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMWebProtection; \??\C:\WINDOWS\system32\DRIVERS\mwac.sys [190096 2026-10-23] (Malwarebytes Inc -> )
S3 nimm3dfu; C:\WINDOWS\System32\drivers\nimm3dfu.sys [39824 2018-10-16] (Native Instruments GmbH -> Native Instruments GmbH)
R3 nvpcf; C:\WINDOWS\System32\drivers\nvpcf.sys [308456 2026-03-17] (NVIDIA Corporation -> NVIDIA Corporation)
R2 SSPORT; \??\C:\windows\system32\Drivers\SSPORT.sys [14224 2022-05-02] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [174416 2026-04-21] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
S3 USBMidi2; C:\WINDOWS\System32\DriverStore\FileRepository\usbmidi2.inf_amd64_b65e0d0af0d372e6\USBMidi2.sys [106496 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [817672 2023-04-14] (Microsoft Windows Hardware Compatibility Publisher -> IDRIX)
S3 vkrnlintvsc; C:\WINDOWS\System32\DriverStore\FileRepository\wvkrnlintvsc.inf_amd64_ae7c1fb85fc0224e\vkrnlintvsc.sys [79168 2025-02-16] (Microsoft Windows -> Microsoft Corporation)
R3 vkrnlintvsp; C:\WINDOWS\System32\DriverStore\FileRepository\wvkrnlintvsp.inf_amd64_249e734e16ab4232\vkrnlintvsp.sys [87504 2026-08-13] (Microsoft Windows -> Microsoft Corporation)
S3 vlflt; C:\WINDOWS\System32\DRIVERS\vlflt.sys [481184 2023-06-01] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender)
S3 vmbusproxy; C:\WINDOWS\system32\drivers\vmbusproxy.sys [98304 2025-06-11] (Microsoft Windows -> Microsoft Corporation)
S4 WdAiNisDrv; C:\WINDOWS\System32\drivers\wd\WdAiNisDrv.sys [51224 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [21632 2026-10-14] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [669712 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [138264 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
R3 WiManHu; C:\WINDOWS\System32\DriverStore\FileRepository\wiman.inf_amd64_1bb2c76cfbc82913\WiManHu\WiManHu.sys [218568 2026-02-11] (Intel Corporation -> Intel Corporation)
S3 WSDPrintDevice; C:\WINDOWS\System32\DriverStore\FileRepository\wsdprint.inf_amd64_1f9e32519098c0b6\WSDPrint.sys [57344 2025-02-16] (Microsoft Windows -> Microsoft Corporation)
==================== SvcHost (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2026-10-24 10:19 - 2026-10-24 10:19 - 000003860 _____ C:\WINDOWS\system32\Tasks\EOSv3 Scheduler onLogOn
2026-10-24 10:19 - 2026-10-24 10:19 - 000003418 _____ C:\WINDOWS\system32\Tasks\EOSv3 Scheduler onTime
2026-10-23 22:42 - 2026-10-23 22:42 - 000000000 ____D C:\Program Files\Common Files\DESIGNER
2026-10-23 22:28 - 2026-10-24 10:23 - 000001425 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk
2026-10-23 22:28 - 2026-10-24 10:23 - 000001319 _____ C:\Users\Max\Desktop\ESET Online Scanner.lnk
2026-10-23 22:28 - 2026-10-23 22:28 - 008423856 _____ (ESET) C:\Users\Max\Downloads\esetonlinescanner.exe
2026-10-23 22:28 - 2026-10-23 22:28 - 000000000 ____D C:\Users\Max\AppData\Local\ESET
2026-10-23 22:27 - 2026-10-23 22:27 - 000000000 ____D C:\Users\Max\AppData\LocalLow\Temp
2026-10-23 22:08 - 2026-10-23 22:08 - 000696894 _____ C:\WINDOWS\system32\perfh007.dat
2026-10-23 22:08 - 2026-10-23 22:08 - 000149830 _____ C:\WINDOWS\system32\perfc007.dat
2026-10-23 22:04 - 2026-10-25 11:27 - 000000000 ____D C:\WINDOWS\SystemTemp
2026-10-23 22:02 - 2026-10-23 22:02 - 000190096 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2026-10-23 22:02 - 2026-10-23 22:02 - 000000008 _____ C:\ProgramData\ntuser.pol
2026-10-23 21:39 - 2026-10-23 21:46 - 000016863 _____ C:\Users\Max\Downloads\Fixlog.txt
2026-10-23 13:47 - 2026-10-23 13:55 - 000071820 _____ C:\Users\Max\Downloads\Addition.txt
2026-10-23 13:42 - 2026-10-25 11:29 - 000044531 _____ C:\Users\Max\Downloads\FRST.txt
2026-10-23 13:41 - 2026-10-25 11:29 - 000000000 ____D C:\FRST
2026-10-23 13:40 - 2026-10-23 13:41 - 002457088 _____ (Farbar) C:\Users\Max\Downloads\FRST64.exe
2026-10-22 12:03 - 2026-10-24 10:25 - 000000000 ____D C:\Program Files\Mozilla Thunderbird
2026-10-21 20:49 - 2026-10-24 21:06 - 000000000 ____D C:\Users\Max\AppData\Local\Malwarebytes
2026-10-21 20:49 - 2026-10-21 20:49 - 000002101 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2026-10-21 20:49 - 2026-10-21 20:49 - 000002089 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2026-10-21 20:49 - 2026-10-21 20:49 - 000000000 ____D C:\Users\Max\AppData\Local\Sentry
2026-10-21 20:48 - 2026-10-21 20:48 - 000000000 ____D C:\ProgramData\Malwarebytes
2026-10-21 20:47 - 2026-10-21 20:48 - 000000000 ____D C:\Program Files\Malwarebytes
2026-10-21 20:47 - 2026-10-21 20:47 - 002906704 _____ (Malwarebytes) C:\Users\Max\Downloads\MBSetup-7.7.exe
2026-10-21 13:51 - 2026-10-21 13:51 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2026-10-21 00:39 - 2026-10-25 11:02 - 000000000 ____D C:\WINDOWS\CbsTemp
2026-10-20 18:50 - 2026-10-21 12:06 - 000000000 ____D C:\Program Files\Mozilla Firefox
2026-10-13 19:42 - 2026-10-13 19:42 - 000091797 _____ C:\WINDOWS\SysWOW64\ctac.json
2026-10-13 19:42 - 2026-10-13 19:42 - 000091797 _____ C:\WINDOWS\system32\ctac.json
2026-10-13 19:42 - 2026-10-13 19:42 - 000039736 _____ C:\WINDOWS\SysWOW64\IntegratedServicesRegionPolicySet.json
2026-10-13 19:42 - 2026-10-13 19:42 - 000039736 _____ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json
2026-10-13 19:42 - 2026-10-13 19:42 - 000004985 _____ C:\WINDOWS\system32\DeviceFeatureDDF.json
2026-10-08 21:21 - 2026-10-08 21:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logi Download Assistant
2026-10-03 19:15 - 2026-10-03 19:15 - 118715181 _____ C:\Users\Max\Downloads\Foundation Course-20261003T181528Z-1-001.zip
2026-09-28 19:01 - 2026-10-04 17:53 - 000001311 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord.lnk
2026-09-28 05:54 - 2026-10-23 21:12 - 000016615 _____ C:\Users\Max\Desktop\Japan Expenses.xlsx
2026-09-28 05:54 - 2026-09-28 05:54 - 000000165 ____H C:\Users\Max\Desktop\~$Japan Expenses.xlsx
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2026-10-25 11:29 - 2024-04-01 08:26 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2026-10-25 11:28 - 2025-12-19 21:30 - 000000000 ____D C:\Users\Max\AppData\Roaming\obsidian
2026-10-25 11:28 - 2025-11-16 13:05 - 000000130 _____ C:\Users\Max\AppData\LocalLow\06e56d9ebcd506c23ac3cac74ddecd166d6f9406d3c9d85c69c6ee31400f2447
2026-10-25 11:27 - 2025-02-16 21:55 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2026-10-25 11:27 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2026-10-25 10:30 - 2025-02-16 22:23 - 000003534 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2026-10-25 10:30 - 2025-02-16 22:23 - 000003462 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2026-10-24 19:55 - 2025-08-25 22:42 - 001885536 _____ C:\Users\Max\AppData\LocalLow\48ebf18c1401a68f92c3442631cd352566de8f82437b3b83c09d3cd5306c2405
2026-10-24 15:01 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\AppReadiness
2026-10-24 14:58 - 2022-06-02 21:20 - 000002522 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2026-10-24 14:43 - 2025-02-16 22:23 - 000003574 _____ C:\WINDOWS\system32\Tasks\Launch Adobe CCXProcess
2026-10-24 14:22 - 2025-08-25 22:42 - 000001138 _____ C:\Users\Max\AppData\LocalLow\286efa2f40f3ea9ae1d33a1f2ba97746c0d967f4f30197efe6f04cadeb0ccbab
2026-10-24 11:12 - 2025-08-28 00:02 - 000000130 _____ C:\Users\Max\AppData\LocalLow\981c0756294e2a37d655c063711bcd570123439c3bd0e71a07f5025540c89aaa
2026-10-24 10:51 - 2023-04-12 12:03 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2026-10-24 10:25 - 2026-03-15 18:23 - 000001063 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Thunderbird.lnk
2026-10-24 10:25 - 2023-04-12 12:03 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2026-10-24 10:21 - 2023-04-12 12:14 - 000000000 ____D C:\Users\Max\AppData\Roaming\Microsoft\Word
2026-10-24 08:01 - 2025-02-16 22:23 - 000003584 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-571881649-101344733-3185888103-1002
2026-10-24 08:01 - 2025-02-16 22:23 - 000003560 _____ C:\WINDOWS\system32\Tasks\OneDrive Startup Task-S-1-5-21-571881649-101344733-3185888103-1002
2026-10-24 08:01 - 2025-02-16 22:23 - 000003372 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-571881649-101344733-3185888103-1002
2026-10-24 08:01 - 2024-04-01 08:26 - 000000000 ___HD C:\Program Files\WindowsApps
2026-10-24 08:01 - 2023-04-12 10:38 - 000002381 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2026-10-24 08:01 - 2023-04-12 10:38 - 000000000 ___RD C:\Users\Max\OneDrive
2026-10-23 23:27 - 2025-12-19 21:33 - 000000000 ____D C:\Users\Max\Desktop\Max's PKM
2026-10-23 22:41 - 2023-03-02 12:14 - 000000000 ____D C:\Program Files\Microsoft Office
2026-10-23 22:39 - 2025-12-28 19:10 - 000000000 ____D C:\Users\Max\AppData\Roaming\The Froosh Amp
2026-10-23 22:27 - 2025-02-16 22:16 - 000018980 _____ C:\WINDOWS\system32\5E37410B-D6F1-471D-AE27-563CEAC0D6B2
2026-10-23 22:27 - 2024-11-04 23:57 - 000000000 ____D C:\Users\Max\AppData\Local\MuseSampler
2026-10-23 22:27 - 2024-11-04 23:57 - 000000000 ____D C:\Users\Max\AppData\Local\Muse Hub
2026-10-23 22:26 - 2025-02-16 22:14 - 000000000 ____D C:\Users\Max\AppData\Roaming\Microsoft\Windows
2026-10-23 22:08 - 2025-02-16 22:22 - 001633252 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2026-10-23 22:08 - 2024-04-01 08:24 - 000000000 ____D C:\WINDOWS\INF
2026-10-23 22:02 - 2025-02-16 22:23 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2026-10-23 22:02 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\ServiceState
2026-10-23 22:02 - 2023-03-02 12:18 - 000000000 ____D C:\ProgramData\NVIDIA
2026-10-23 22:02 - 2022-06-02 21:20 - 000012288 ___SH C:\DumpStack.log.tmp
2026-10-23 22:01 - 2025-02-16 21:55 - 000001623 _____ C:\WINDOWS\system32\config\VSMIDK
2026-10-23 22:01 - 2024-04-01 08:21 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2026-10-23 21:46 - 2025-10-19 18:57 - 000000000 ____D C:\Users\WsiAccount\AppData\Roaming\Microsoft\Windows
2026-10-23 21:43 - 2024-04-01 08:26 - 000000000 ____D C:\Users\Default\AppData\Roaming\Microsoft\Windows
2026-10-23 21:42 - 2025-06-23 18:55 - 000000000 ____D C:\Users\Max\AppData\Roaming\discord
2026-10-23 21:42 - 2024-07-14 13:20 - 000000000 ____D C:\Users\Max\AppData\Local\Steam
2026-10-23 21:39 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2026-10-23 21:39 - 2022-05-07 06:24 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2026-10-23 21:37 - 2024-07-14 13:19 - 000000000 ____D C:\Program Files (x86)\Steam
2026-10-23 14:25 - 2023-04-13 18:27 - 000000000 ____D C:\Users\Max\AppData\Local\CrashDumps
2026-10-23 14:09 - 2025-11-16 13:05 - 000147719 _____ C:\Users\Max\AppData\LocalLow\d9bbdb34d449011c3e179c564afe3153fc5f39f588eb5040c4c0cbc72196697e
2026-10-23 13:42 - 2025-10-19 18:57 - 000000000 ____D C:\Users\WsiAccount
2026-10-23 02:14 - 2023-04-18 12:11 - 000000000 ____D C:\Users\Max\AppData\Roaming\Anki2
2026-10-23 02:08 - 2023-04-14 11:52 - 000000000 ____D C:\Users\Max\AppData\Roaming\Microsoft\Excel
2026-10-23 00:37 - 2025-12-06 20:58 - 000002564 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2026-10-22 20:24 - 2025-08-28 00:02 - 000038099 _____ C:\Users\Max\AppData\LocalLow\49798e1ee2c5c0ce6eda1c74ff925d13e6fdfec02e09593f177958860a4ad850
2026-10-22 11:40 - 2023-04-12 10:36 - 000000000 ____D C:\Users\Max\AppData\Local\D3DSCache
2026-10-21 21:25 - 2026-09-13 13:55 - 000267029 _____ C:\WINDOWS\system32\InstallMonitorLog.csv
2026-10-21 20:49 - 2024-04-01 08:26 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2026-10-21 20:49 - 2023-04-12 10:29 - 000000000 ____D C:\Users\Max\AppData\Local\Packages
2026-10-21 20:49 - 2022-06-02 21:21 - 000000000 ____D C:\ProgramData\Packages
2026-10-21 14:14 - 2025-08-25 22:22 - 000013497 _____ C:\Users\Max\AppData\LocalLow\19cba8bb7c48fdfb12bda34b03712a9057f03d374edd105673e20ce6a008ee41
2026-10-21 14:14 - 2025-08-15 13:58 - 000000000 ____D C:\ProgramData\boost_interprocess
2026-10-21 12:05 - 2025-02-16 22:14 - 000000000 ____D C:\Users\Max
2026-10-21 11:36 - 2026-08-22 09:29 - 000002133 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2026-10-21 11:36 - 2025-02-16 22:23 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2026-10-21 11:36 - 2023-04-12 12:03 - 000001073 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2026-10-21 08:33 - 2025-05-24 10:28 - 000000000 ____D C:\WINDOWS\Minidump
2026-10-21 08:33 - 2023-04-12 08:53 - 009670162 ____N C:\WINDOWS\Minidump\102126-27765-01.dmp
2026-10-20 20:12 - 2024-12-20 22:55 - 000000000 ____D C:\Users\Max\OneDrive\Documents\12 Guitar practice routine
2026-10-14 07:15 - 2022-06-02 21:20 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2026-10-14 06:43 - 2024-04-01 08:26 - 000000000 ____D C:\ProgramData\USOPrivate
2026-10-14 03:25 - 2025-02-16 21:55 - 000630016 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2026-10-14 03:24 - 2025-12-10 04:18 - 000000000 ____D C:\WINDOWS\system32\NarratorMCAT
2026-10-14 03:24 - 2025-07-14 01:47 - 000000000 ____D C:\WINDOWS\system32\ruxim
2026-10-14 03:24 - 2024-04-01 17:36 - 000000000 ____D C:\WINDOWS\system32\OpenSSH
2026-10-14 03:24 - 2024-04-01 17:36 - 000000000 ____D C:\WINDOWS\system32\Microsoft-Edge-WebView
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\UUS
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SysWOW64\InstallShield
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\SystemResources
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\setup
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\oobe
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\migwiz
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\HealthAttestationClient
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\Dism
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\DDFs
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\appraiser
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\ShellExperiences
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\ShellComponents
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\Provisioning
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\BrowserCore
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\WINDOWS\bcastdvr
2026-10-14 03:24 - 2024-04-01 08:26 - 000000000 ____D C:\Program Files\Common Files\System
2026-10-14 03:24 - 2024-04-01 08:21 - 000000000 ____D C:\WINDOWS\servicing
2026-10-13 19:42 - 2025-02-16 21:57 - 003387392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2026-10-13 19:03 - 2023-04-12 10:53 - 000000000 ____D C:\WINDOWS\system32\MRT
2026-10-13 18:56 - 2023-04-12 10:53 - 230303336 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2026-10-13 09:34 - 2022-09-17 22:43 - 000000000 ____D C:\Program Files\HP
2026-10-08 21:21 - 2026-06-15 20:22 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logi
2026-10-08 21:21 - 2026-06-15 20:22 - 000000000 ____D C:\ProgramData\Logi
2026-10-08 21:21 - 2026-06-15 20:22 - 000000000 ____D C:\Program Files\LogiDownloadAssistant
2026-10-04 17:53 - 2025-06-23 18:55 - 000000000 ____D C:\Users\Max\AppData\Local\Discord
2026-10-01 06:21 - 2023-04-12 08:53 - 009718741 ____N C:\WINDOWS\Minidump\100126-22250-01.dmp
2026-09-28 06:54 - 2023-04-14 16:26 - 000000000 ____D C:\Users\Max\AppData\Roaming\Evernote
==================== Files in the root of some directories ========
2023-06-07 10:59 - 2023-06-07 10:59 - 000001456 _____ () C:\Users\Max\AppData\Local\Adobe Save for Web 13.0 Prefs
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
[CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2026
Ran by Max (25-10-2026 11:30:36)
Running from C:\Users\Max\Downloads
Microsoft Windows 11 Pro Version 25H2 26200.9711 (X64) (2025-02-16 21:23:44)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
(If an entry is included in the fixlist, it will be removed.)
Administrator (S-1-5-21-571881649-101344733-3185888103-500 - Administrators - Disabled)
DefaultAccount (S-1-5-21-571881649-101344733-3185888103-503 - Limited - Disabled)
Guest (S-1-5-21-571881649-101344733-3185888103-501 - Limited - Disabled)
Max (DisplayName: M** *ö**r) (S-1-5-21-571881649-101344733-3185888103-1002 - Administrators - Enabled) [MS Account] => C:\Users\Max
WDAGUtilityAccount (S-1-5-21-571881649-101344733-3185888103-504 - Limited - Disabled)
WsiAccount (S-1-5-21-571881649-101344733-3185888103-1003 - Limited - Disabled) => C:\Users\WsiAccount
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Malwarebytes (Enabled - Up to date) {A537353A-1D6A-F6B5-9153-CE1CF80FBE66}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Ableton Live 12 Suite (HKLM\...\{0380CF5F-9EF2-4ABA-BF87-EA4826A1B89B}) (Version: 12.0.0.0 - Ableton) Hidden
Ableton Live 12 Suite (HKLM-x32\...\{9FE4C915-316D-4C18-B4C4-BF627B8504DD}) (Version: 12.0.0.0 - Ableton)
Ableton USB Audio Driver v5.68.0 (HKLM\...\{A823612A-AA91-4911-886A-7C589452C65C}) (Version: 5.68.0 - Ableton)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 6.9.1.1.3 - Adobe Inc.)
Adobe Media Encoder 2024 (HKLM-x32\...\AME_24_6_5) (Version: 24.6.5 - Adobe Inc.)
Adobe Media Encoder 2025 (HKLM-x32\...\AME_25_6_6) (Version: 25.6.6 - Adobe Inc.)
Adobe Media Encoder 2026 (HKLM-x32\...\AME_26_5) (Version: 26.5 - Adobe Inc.)
Amazon Kindle (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Amazon Kindle) (Version: 2.9.1.71006 - Amazon)
Anaconda3 2023.03-1 (Python 3.10.9 64-bit) (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Anaconda3 2023.03-1 (Python 3.10.9 64-bit)) (Version: 2023.03-1 - Anaconda, Inc.)
Analog Lab V 5.10.7 (HKLM-x32\...\Analog Lab V_is1) (Version: 5.10.7 - Arturia)
Anki Launcher (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Anki) (Version: 25.09 - )
Arturia Software Center 2.9.1 (HKLM-x32\...\Arturia Software Center_is1) (Version: 2.9.1 - Arturia)
Arturia USB MIDI Driver v1.6.0 (HKLM\...\{C2E707D7-4B3C-4A35-A877-756E8F49D7EF}) (Version: 1.6.0 - Arturia)
Bome Virtual MIDI 2.1.0.44 (HKLM\...\BMIDI_Driver1.0.0.11_is1) (Version: - Bome Software GmbH & Co. KG)
Common Desktop Agent (HKLM\...\{031A0E14-0413-4C97-9772-2639B782F46F}) (Version: 1.62.0 - OEM) Hidden
Discord (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Discord) (Version: 1.0.9260 - Discord Inc.)
EarMaster 7.7 (HKLM\...\EarMaster 7_is1) (Version: 7.7 - EarMaster ApS)
Evernote 10.125.5 (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\e4251011-875e-51f3-a464-121adaff5aaa) (Version: 10.125.5 - Evernote Corporation)
Focusrite Audio Drivers 4.119.13.33 (HKLM\...\Focusrite Audio Drivers_is1) (Version: 4.119.13.33 - Focusrite Audio Engineering, Ltd.)
Focusrite Control 3.18.0.204 (HKLM\...\Focusrite Control_is1) (Version: 3.18.0.204 - Focusrite Audio Engineering Ltd.)
GameRanger (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\GameRanger) (Version: - GameRanger Technologies)
Google Chrome (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Google Chrome) (Version: 156.0.8078.47 - Google LLC)
HandBrake 1.6.1 (HKLM-x32\...\HandBrake) (Version: 1.6.1 - )
HP Connection Optimizer (HKLM-x32\...\{6468C4A5-E47E-405F-B675-A70A70983EA6}) (Version: 2.0.19.0 - HP Inc)
HP Documentation (HKLM\...\HP_Documentation) (Version: 1.0.0.1 - HP Inc.)
HP Notifications (HKLM-x32\...\{84937F28-9CB4-49E7-A2CF-E32D97E6DAE6}) (Version: 1.1.28.1 - HP)
HP Security Update Service (HKLM\...\{8C2C90BB-9650-443D-A4ED-958D39B3C9EA}) (Version: 4.4.34.927 - HP Inc.)
HP Sure Recover (HKLM\...\{EE6377DD-C166-40D9-ACFF-AEB827623329}) (Version: 10.1.34.334 - HP Inc.)
HP Sure Run Module (HKLM\...\{EB7671C4-861D-4C1F-BA26-C8ED6B8EF933}) (Version: 5.0.5.118 - HP Inc.)
HP System Default Settings (HKLM-x32\...\{D530265D-C486-4A7F-8FC0-79CE82BB5F6B}) (Version: 1.5.9.1 - HP Inc.) Hidden
HP Wolf Security - Console (HKLM\...\{627D40D8-9926-42C1-BA7F-6AA7A5DFFE9A}) (Version: 11.1.8.1209 - HP Inc.)
ICS (HKLM-x32\...\{9881592F-ADE0-430D-8E1E-31F363C1BA28}) (Version: 3.0.17.0 - HP Inc.)
Logi Download Assistant (HKLM-x32\...\LogiDownloadAssistant) (Version: 2.0.1020 - Logitech)
Malwarebytes version 5.7.3.376 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 5.7.3.376 - Malwarebytes)
Microsoft .NET Host - 6.0.21 (x64) (HKLM\...\{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}) (Version: 48.87.64667 - Microsoft Corporation) Hidden
Microsoft .NET Host - 8.0.8 (x64) (HKLM\...\{3BA242F8-BDB5-4096-9FBC-333CD663BBAD}) (Version: 64.32.18380 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 6.0.21 (x64) (HKLM\...\{D937EF87-F11D-4778-973C-B71E178F95D0}) (Version: 48.87.64667 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 8.0.8 (x64) (HKLM\...\{7FE24458-0796-4428-99C2-9A0F8DAB93CC}) (Version: 64.32.18380 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 6.0.21 (x64) (HKLM\...\{8D2EC92E-5903-4B25-9406-182B8EFA834F}) (Version: 48.87.64667 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 8.0.8 (x64) (HKLM\...\{9ACB23DB-4D32-49ED-A5E3-F4E2F8D9D2AA}) (Version: 64.32.18380 - Microsoft Corporation) Hidden
Microsoft 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.20527.20088 - Microsoft Corporation)
Microsoft 365 - en-gb (HKLM\...\O365HomePremRetail - en-gb) (Version: 16.0.20527.20088 - Microsoft Corporation)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 156.0.4314.42 - Microsoft Corporation)
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 155.0.4283.62 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\OneDriveSetup.exe) (Version: 26.189.0928.0009 - Microsoft Corporation)
Microsoft OneNote - de-de (HKLM\...\OneNoteFreeRetail - de-de) (Version: 16.0.20527.20088 - Microsoft Corporation)
Microsoft OneNote - en-gb (HKLM\...\OneNoteFreeRetail - en-gb) (Version: 16.0.20527.20088 - Microsoft Corporation)
Microsoft Teams Meeting Add-in for Microsoft Office (HKLM\...\{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}) (Version: 1.24.31301 - Microsoft)
Microsoft Update Health Tools (HKLM\...\{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (HKLM\...\{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (HKLM\...\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM-x32\...\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM-x32\...\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40664 (HKLM-x32\...\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}) (Version: 12.0.40664.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40664 (HKLM-x32\...\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}) (Version: 12.0.40664.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664 (HKLM\...\{010792BA-551A-3AC0-A7EF-0FAB4156C382}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664 (HKLM\...\{53CF6934-A98D-3D84-9146-FC4EDF3D5641}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40664 (HKLM-x32\...\{D401961D-3A20-3AC7-943B-6139D5BD490A}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40664 (HKLM-x32\...\{8122DAB1-ED4D-3676-BB0A-CA368196543E}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.50.35719 (HKLM\...\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.50.35719 (HKLM\...\{61B44572-8722-4DAF-8ACF-8E742D30BCC5}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.50.35719 (HKLM-x32\...\{773AD50D-AAE6-4BA1-AD01-B5A38874C840}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.50.35719 (HKLM-x32\...\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ v14 Redistributable (x64) - 14.50.35719 (HKLM-x32\...\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}) (Version: 14.50.35719.0 - Microsoft Corporation)
Microsoft Visual C++ v14 Redistributable (x86) - 14.50.35719 (HKLM-x32\...\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}) (Version: 14.50.35719.0 - Microsoft Corporation)
Microsoft Windows Application Compatibility Fix Database (HKLM\...\{22221111-1111-1111-1111-111111111111}.sdb) (Version: - )
Microsoft Windows Desktop Runtime - 6.0.21 (x64) (HKLM\...\{AF6BF7DD-2B12-40C5-919C-2EC99054BBE1}) (Version: 48.87.64723 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 6.0.21 (x64) (HKLM-x32\...\{0f39db03-9030-48f3-82ef-5384bed81d85}) (Version: 6.0.21.32717 - Microsoft Corporation)
Microsoft Windows Desktop Runtime - 8.0.8 (x64) (HKLM\...\{663E7053-3B36-4AE5-8223-234867FAEAE6}) (Version: 64.32.18376 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 8.0.8 (x64) (HKLM-x32\...\{33832ff3-5583-4b81-b270-d9fd42760e1a}) (Version: 8.0.8.33916 - Microsoft Corporation)
MIDI Control Center 1.21.1 (HKLM\...\MIDI Control Center_is1) (Version: 1.21.1 - Arturia)
Mozilla Firefox (x64 en-US) (HKLM\...\Mozilla Firefox) (Version: 158.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 148.0.1 - Mozilla)
Mozilla Thunderbird (x64 en-US) (HKLM\...\Mozilla Thunderbird 158.0.1 (x64 en-US)) (Version: 158.0.1 - Mozilla)
MuseScore 4 (HKLM\...\{200A530C-A4F7-48BB-8A37-F5454DBCEE95}) (Version: 4.2.0.233521124 - MuseScore BVBA and Others)
Native Access 3.21.1 (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\c410b7d2-8fce-53b3-8332-e98b6e89a16a) (Version: 3.21.1 - Native Instruments)
Native Instruments Controller Editor (HKLM-x32\...\Native Instruments Controller Editor) (Version: 2.8.2.0 - Native Instruments)
Native Instruments Komplete Kontrol MK2 Driver (HKLM-x32\...\Native Instruments Komplete Kontrol MK2 Driver) (Version: - Native Instruments)
Native Instruments Maschine 3 (HKLM-x32\...\Native Instruments Maschine 3) (Version: 3.3.1.0 - Native Instruments)
Native Instruments Maschine Jam Driver (HKLM-x32\...\Native Instruments Maschine Jam Driver) (Version: - Native Instruments)
Native Instruments Maschine MK3 Driver (HKLM-x32\...\Native Instruments Maschine MK3 Driver) (Version: - Native Instruments)
Native Instruments Maschine Studio Driver (HKLM-x32\...\Native Instruments Maschine Studio Driver) (Version: - Native Instruments)
Native Instruments NIHostIntegrationAgent (HKLM-x32\...\Native Instruments NIHostIntegrationAgent) (Version: 1.17.1.5 - Native Instruments)
Native Instruments NTKDaemon (HKLM-x32\...\Native Instruments NTKDaemon) (Version: 1.26.0.0 - Native Instruments)
NVIDIA App 11.0.7.237 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NvApp) (Version: 11.0.7.237 - NVIDIA Corporation)
NVIDIA FrameView SDK 1.7.12227.37421622 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_FrameViewSdk) (Version: 1.7.12227.37421622 - NVIDIA Corporation)
NVIDIA Graphics Driver 595.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 595.97 - NVIDIA Corporation)
NVIDIA RTX Desktop Manager 203.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 203.20 - NVIDIA Corporation)
Obsidian (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\bd400747-f0c1-5638-a859-982036102edf) (Version: 1.10.6 - Obsidian)
Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.20527.20016 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM\...\{90160000-008C-0407-1000-0000000FF1CE}) (Version: 16.0.20527.20016 - Microsoft Corporation) Hidden
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 2.00.01.35 - HP Inc.)
Samsung Scan Process Machine (HKLM-x32\...\Samsung Scan Process Machine) (Version: 1.03.05.28 - Samsung Electronics Co., Ltd.) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Uninstall Samsung Printer Software (HKLM-x32\...\TotalUninstaller) (Version: 4.0.0.93 - Samsung Electronics CO., LTD.)
VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.25.9 - IDRIX)
YubiKey Manager (HKLM-x32\...\yubikey-manager) (Version: 1.2.5 - Yubico AB)
Zoom (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\ZoomUMX) (Version: 5.15.3 (18551) - Zoom Video Communications, Inc.)
Packages:
=========
@{MicrosoftWindows.55182690.Taskbar_1000.26100.3775.0_x64__cw5n1h2txyewy?ms-resource://MicrosoftWindows.55182690.Taskbar/Resources/ProductPkgDisplayName} -> C:\WINDOWS\SystemApps\SxS\MicrosoftWindows.55182690.Taskbar_cw5n1h2txyewy [2025-06-20] ()
Adobe Native Client -> C:\Program Files\Common Files\Adobe\Adobe OS Extension [2025-12-21] ()
Amazon Kindle: Reading App -> C:\Program Files\WindowsApps\AMZNKindle.AmazonKindleReadingApp_1.1.4132.0_x64__m1sc522ngdk36 [2026-10-21] (AMZN Kindle)
AppUp.IntelGraphicsExperience -> C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt [2024-11-09] (INTEL CORP) [Startup Task]
HP -> C:\Program Files\WindowsApps\AD2F1837.myHP_61.52637.14262.0_x64__v10z8vjag6ke6 [2026-10-04] (HP Inc.) [Startup Task]
HP Audio Control -> C:\Program Files\WindowsApps\RealtekSemiconductorCorp.HPAudioControl_2.54.396.0_x64__dt26b99r8h8gj [2026-10-02] (Realtek Semiconductor Corp)
HP PC Hardware Diagnostics Windows -> C:\Program Files\WindowsApps\AD2F1837.HPPCHardwareDiagnosticsWindows_3.3.2.0_x64__v10z8vjag6ke6 [2026-10-04] (HP Inc.) [Startup Task]
HP PC Privacy Settings -> C:\Program Files\WindowsApps\AD2F1837.HPPrivacySettings_1.6.4.0_x64__v10z8vjag6ke6 [2026-10-04] (HP Inc.)
HP Power Manager -> C:\Program Files\WindowsApps\AD2F1837.HPPowerManager_3.0.18.0_x64__v10z8vjag6ke6 [2023-04-12] (HP Inc.)
HP QuickDrop -> C:\Program Files\WindowsApps\AD2F1837.HPQuickDrop_2.5.10921.0_x64__v10z8vjag6ke6 [2023-06-14] (HP Inc.)
HP Support Assistant -> C:\Program Files\WindowsApps\AD2F1837.HPSupportAssistant_9.55.10.0_x64__v10z8vjag6ke6 [2026-08-21] (HP Inc.)
HP System Information -> C:\Program Files\WindowsApps\AD2F1837.HPSystemInformation_8.10.53.0_x64__v10z8vjag6ke6 [2026-09-27] (HP Inc.)
Intel(R) Management and Security Status -> C:\Program Files\WindowsApps\AppUp.IntelManagementandSecurityStatus_2537.8.7.0_x64__8j3eq9eme6ctt [2026-02-27] (INTEL CORP) [Startup Task]
Intel® Graphics Software -> C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt [2026-10-14] (INTEL CORP) [Startup Task]
Local AI Manager for Microsoft 365 -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16\AI [2026-10-23] ()
Malwarebytes Anti-Malware -> C:\Program Files\Malwarebytes\Anti-Malware [2026-10-22] ()
Microsoft Defender -> C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4_102.2608.18002.0_x64__8wekyb3d8bbwe [2026-09-27] (Microsoft Corporation) [Startup Task]
Microsoft Whiteboard -> C:\Program Files\WindowsApps\Microsoft.Whiteboard_56.20201.588.0_x64__8wekyb3d8bbwe [2026-02-18] (Microsoft Corporation)
Microsoft.HEVCVideoExtensions -> C:\Program Files\WindowsApps\Microsoft.HEVCVideoExtensions_2.4.110.0_x64__8wekyb3d8bbwe [2026-08-29] (Microsoft Corporation)
Microsoft.Office.ActionsServer -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16\ActionsServer [2026-10-23] ()
Muse Hub -> C:\Program Files\WindowsApps\Muse.MuseHub_2.0.22.1414_x64__rb9pth70m6nz6 [2024-11-04] (Muse) [Startup Task]
NVIDIA Control Panel -> C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_8.1.969.0_x64__56jybvy8sckqj [2025-11-07] (NVIDIA Corp.)
OfficePushNotificationsUtility -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16 [2026-10-23] ()
Samsung Printer Experience -> C:\Program Files\WindowsApps\SAMSUNGELECTRONICSCO.LTD.SamsungPrinterExperience_1.3.15.0_x64__3c1yjt4zspk6g [2023-04-20] (Samsung Electronics Co. Ltd.)
Speech Pack - English (United Kingdom) -> C:\Program Files\WindowsApps\MicrosoftWindows.Speech.en-GB.1_1.0.19.0_x64__cw5n1h2txyewy [2026-09-27] (Microsoft Windows)
SpotifyAB.SpotifyMusic -> C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0 [2026-10-21] (Spotify AB) [Startup Task]
==================== Custom CLSID (Whitelisted): ==============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{19CEDD27-D972-4CC0-ABAC-C58CD08C46DB}\localserver32 -> C:\Users\Max\AppData\Local\Discord\app-1.0.9260\Discord.exe (Discord Inc. -> Discord Inc.)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{1a46400f-4c81-802a-c2c1-1e9a687a9340}\localserver32 -> C:\Program Files\HandBrake\HandBrake.exe (HandBrake Team) [File not signed]
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{23A5B06E-20BB-4E7E-A0AC-6982ED6A6041}\localserver32 -> C:\Users\Max\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner_nt64.exe (ESET, spol. s r.o. -> ESET)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4}\localserver32 -> C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Adobe Inc. -> Adobe Inc.)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{547E9AEF-8043-5D26-879F-01E7664192DC}\localserver32 -> C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{65574321-d3fb-e7db-e83e-38fe55a80c4a}\localserver32 -> C:\Program Files\HP\HP Client Security Manager\HP.ClientSecurityManager.exe (HP Inc. -> HP Inc.)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{6DDCE70D-A4AE-4E97-908C-BE7B2DB750AD}\localserver32 -> C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{6E1E5C99-BC66-5838-926C-B47FC5A1B44A}\localserver32 -> C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{6FED547A-D1E3-45A6-BF0D-A2B75E8341A1}\InprocServer32 -> C:\Program Files\Mozilla Thunderbird\notificationserver.dll (Mozilla Corporation -> Mozilla Foundation)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\localserver32 -> C:\Users\Max\AppData\Local\Google\Chrome\Application\156.0.8078.47\notification_helper.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Inc. -> Adobe Systems)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2026-10-21] (Malwarebytes Inc -> Malwarebytes)
ContextMenuHandlers5: [NvAppDesktopContext] -> {F2E8B4A1-9C7D-4F6E-B3A5-8D2C1F4E9B7A} => C:\Program Files\NVIDIA Corporation\NVIDIA App\NvCpl\nvui.dll [2026-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\nvshext.dll [2026-03-18] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers5: [NvQuadroView] -> {1E9B04FB-F9E5-4718-997B-B8DA88302A48} => C:\Program Files\NVIDIA Corporation\nview\nvshell.dll [2022-08-24] (Nvidia Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2026-10-21] (Malwarebytes Inc -> Malwarebytes)
==================== Codecs (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Drivers32-x32: [vidc.VP60] => C:\WINDOWS\system32\vp6vfw.dll
HKLM\...\Drivers32-x32: [vidc.VP61] => C:\WINDOWS\system32\vp6vfw.dll
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
ShortcutWithArgument: C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anaconda3 (64-bit)\Anaconda Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> "/K" C:\Users\Max\anaconda3\Scripts\activate.bat C:\Users\Max\anaconda3
==================== Loaded Modules (Whitelisted) =============
2022-05-06 11:05 - 2022-05-06 11:05 - 000182784 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\_cffi_backend.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000012288 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\_win32sysloader.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000031232 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\bcrypt\_bcrypt.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000116224 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\kiwisolver.pyd
2022-05-06 11:21 - 2022-05-06 11:21 - 034413408 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\libopenblas.GK7GX5KEQ4F6UYO3P26ULGBQYHGQO7J4.gfortran-win_amd64.dll
2022-05-06 11:05 - 2022-05-06 11:05 - 000012288 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\_c_internal_utils.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000189952 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\_image.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000159744 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\_path.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000231424 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\backends\_backend_agg.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000012800 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\backends\_tkagg.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000605696 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\ft2font.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000110592 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\core\_multiarray_tests.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 002818048 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\core\_multiarray_umath.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000112640 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\fft\_pocketfft_internal.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000155648 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\linalg\_umath_linalg.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000022016 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\linalg\lapack_lite.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000239616 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_bounded_integers.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000181760 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_common.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000666112 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_generator.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000079360 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_mt19937.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000065536 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_pcg64.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000072704 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_philox.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000053248 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_sfc64.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000152576 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\bit_generator.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000564224 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\mtrand.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 002672128 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\PIL\_imaging.pyd
2022-05-06 11:22 - 2022-05-06 11:22 - 000140800 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\pywintypes39.dll
2022-05-06 11:05 - 2022-05-06 11:05 - 000134144 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\win32api.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000155648 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\win32file.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000026624 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\win32pipe.pyd
2022-05-06 11:05 - 2022-05-06 11:05 - 000141312 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\win32security.pyd
2014-09-08 12:38 - 2014-09-08 12:38 - 000051200 _____ () [File not signed] C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2023-03-02 12:15 - 2023-03-02 12:15 - 000000000 ____L () [symlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppvIsvSubsystems64.dll] C:\Program Files\Microsoft Office\root\Office16\AppvIsvSubsystems64.dll
2023-03-02 12:15 - 2023-03-02 12:15 - 000000000 ____L () [symlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2R64.dll] C:\Program Files\Microsoft Office\root\Office16\c2r64.dll
2026-04-17 17:50 - 2026-04-17 17:50 - 000000000 ____L () [symlink -> C:\Program Files\NVIDIA Corporation\NVIDIA App\MessageBus\NvMessageBusBroadcast.dll] C:\Program Files\NVIDIA Corporation\NvContainer\plugins\LocalSystem\NvMessageBusBroadcast.dll
2022-05-02 08:22 - 2022-05-02 08:22 - 000123904 _____ (Samsung Electronics Co., Ltd.) [File not signed] C:\Program Files (x86)\Samsung\Easy Printer Manager\SmartScreenPrint\CDAKEYMonitor64.dll
==================== Alternate Data Streams (Whitelisted) ========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Max\Downloads\esetonlinescanner.exe:MBAM.Zone.Identifier [120]
==================== Safe Mode (Whitelisted) ==================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) =================
==================== Internet Explorer (Whitelisted) =============
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\HP\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2026-08-13] (HP Inc. -> HP Inc.)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\HP\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2026-08-13] (HP Inc. -> HP Inc.)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-10-23] (Microsoft Corporation -> Microsoft Corporation)
==================== Hosts content: =========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2022-05-07 06:24 - 2026-10-23 21:42 - 000000027 _____ C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1 localhost
==================== Network ===========================
(Currently there is no automatic fix for this section.)
DNS Servers: 192.168.1.1
Windows Firewall is enabled.
Network Binding:
=============
WiFi: Intel(R) Wi-Fi 6E AX211 160MHz -> Netwtw14.sys
Ethernet: Intel(R) Ethernet Connection (16) I219-V -> e1d.sys
Bluetooth Network Connection: Bluetooth Device (Personal Area Network) -> bthpan.sys
vms_vsf: Hyper-V Virtual Switch Extension Filter
ms_l1vhlwf: Nested Network Virtualization
vms_vsp: Hyper-V Virtual Switch Extension Protocol
==================== Other Areas ===========================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\Control Panel\Desktop\\Wallpaper ->
HKU\S-1-5-21-571881649-101344733-3185888103-1003\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows Defender\Features => (TamperProtection: 5) (TamperProtectionSource: 2)
HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection => (DpaDisabled: 0)
==================== MSCONFIG/TASK MANAGER disabled items ==
(If an entry is included in the fixlist, it will be removed.)
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_0C0D5F59005A32876380EE3B976869A6"
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\StartupApproved\Run: => "com.evernote.Evernote"
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\StartupApproved\Run: => "electron.app.Notion"
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\StartupApproved\Run: => "Steam"
==================== FirewallRules (Whitelisted) ================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [EdgeWebView2-MDNS-In-UDP] => (Allow) C:\WINDOWS\system32\Microsoft-Edge-WebView\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{39735AE7-5BAD-4860-9FC3-F3694BB161DC}C:\program files\windowsapps\spotifyab.spotifymusic_1.306.1921.0_x64__zpdnekdrzrea0\spotifylauncher.exe] => (Allow) C:\program files\windowsapps\spotifyab.spotifymusic_1.306.1921.0_x64__zpdnekdrzrea0\spotifylauncher.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [UDP Query User{BF1A643B-953F-49E2-AD5A-D219D906157F}C:\program files\windowsapps\spotifyab.spotifymusic_1.306.1921.0_x64__zpdnekdrzrea0\spotifylauncher.exe] => (Allow) C:\program files\windowsapps\spotifyab.spotifymusic_1.306.1921.0_x64__zpdnekdrzrea0\spotifylauncher.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [TCP Query User{3FE7A187-C988-41F7-82FE-FD2190559405}C:\program files\windowsapps\spotifyab.spotifymusic_1.306.1921.0_x64__zpdnekdrzrea0\spotify.exe] => (Allow) C:\program files\windowsapps\spotifyab.spotifymusic_1.306.1921.0_x64__zpdnekdrzrea0\spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [UDP Query User{84B43D07-82F3-4EBC-9369-F9AF748AFCBB}C:\program files\windowsapps\spotifyab.spotifymusic_1.306.1921.0_x64__zpdnekdrzrea0\spotify.exe] => (Allow) C:\program files\windowsapps\spotifyab.spotifymusic_1.306.1921.0_x64__zpdnekdrzrea0\spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [TCP Query User{30D1C170-63EB-465F-8440-CC8A88BDD3F8}C:\programdata\ableton\live 12 suite\program\ableton live 12 suite.exe] => (Allow) C:\programdata\ableton\live 12 suite\program\ableton live 12 suite.exe (Ableton AG -> Ableton)
FirewallRules: [UDP Query User{D0C486C1-4817-4106-86F2-862C3E16D518}C:\programdata\ableton\live 12 suite\program\ableton live 12 suite.exe] => (Allow) C:\programdata\ableton\live 12 suite\program\ableton live 12 suite.exe (Ableton AG -> Ableton)
FirewallRules: [{F65E88D2-E3C2-4917-992D-3D3A5458E4CC}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation)
==================== Restore Points =========================
23-10-2026 21:39:26 Restore Point Created by FRST
==================== Faulty Device Manager Devices ============
==================== Event log errors: ========================
Application errors:
==================
Error: (10/24/2026 10:20:17 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 22912. Message ID: [0x2509].
Error: (10/23/2026 10:26:57 PM) (Source: Service1) (EventID: 0) (User: )
Description: Failed to process session change. System.NullReferenceException: Object reference not set to an instance of an object.
at HP.Watcher.WatcherEngine.FireEnrollmentCheckIfPresent()
at hptpsmarthealthservice.hptpsmarthealthservice.OnSessionChange(SessionChangeDescription changeDescription)
at System.ServiceProcess.ServiceBase.DeferredSessionChange(Int32 eventType, Int32 sessionId)
Error: (10/23/2026 10:02:13 PM) (Source: WMIRegistrationService) (EventID: 3) (User: )
Description: Intel(R) WMI Registration Service has failed WMI Registration.
Error: (10/23/2026 09:39:55 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 25740. Message ID: [0x2509].
Error: (10/23/2026 02:25:08 PM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-TSSNE97)
Description: Faulting application name: ctfmon.exe, version: 10.0.26100.9549, time stamp: 0xd2ed3757
Faulting module name: InputService.dll, version: 10.0.26100.9711, time stamp: 0xffe7bf06
Exception code: 0x00000675
Fault offset: 0x0000000000011fa6
Faulting process id: 0x44d4
Faulting application start time: 0x1dd615dc9fdec9b
Faulting application path: C:\WINDOWS\system32\ctfmon.exe
Faulting module path: C:\WINDOWS\system32\InputService.dll
Report Id: ff69f2b1-f1b4-4522-87e6-2d87399fee51
Faulting package full name:
Faulting package-relative application ID:
Error: (10/23/2026 02:22:43 PM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 27208. Message ID: [0x2509].
Error: (10/23/2026 02:14:51 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 24892. Message ID: [0x2509].
Error: (10/21/2026 08:00:42 PM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-TSSNE97)
Description: Faulting application name: rct2.exe, version: 0.0.0.0, time stamp: 0x3e4c073e
Faulting module name: DDRAW.dll, version: 10.0.26100.8115, time stamp: 0x05d3234b
Exception code: 0xc0000005
Fault offset: 0x0003b717
Faulting process id: 0x3e6c
Faulting application start time: 0x1dd6184ca72e532
Faulting application path: C:\Program Files (x86)\Steam\steamapps\common\Rollercoaster Tycoon 2\rct2.exe
Faulting module path: C:\WINDOWS\SYSTEM32\DDRAW.dll
Report Id: 0b308fea-7898-4680-98ca-eed8c084ad18
Faulting package full name:
Faulting package-relative application ID:
System errors:
=============
Error: (10/25/2026 11:02:33 AM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY)
Description: The Secure Boot update failed to update SBAT with error -1878589247. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931
Error: (10/25/2026 10:04:21 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-TSSNE97)
Description: The server {F4DF18B4-A2CF-4B0A-8D62-954CD6AD2E33} did not register with DCOM within the required timeout.
Error: (10/25/2026 10:04:20 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-TSSNE97)
Description: The server {B8C1DCAE-5020-4F5D-BA2A-85292744E334} did not register with DCOM within the required timeout.
Error: (10/25/2026 10:03:50 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-TSSNE97)
Description: The server {5250E46F-BB09-D602-5891-F476DC89B700} did not register with DCOM within the required timeout.
Error: (10/25/2026 03:23:21 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-TSSNE97)
Description: The server {544C4C52-DE0B-4D14-9510-21745381D5CA} did not register with DCOM within the required timeout.
Error: (10/25/2026 03:22:51 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {338B40F9-9D68-4B53-A793-6B9AA0C5F63B} did not register with DCOM within the required timeout.
Error: (10/24/2026 11:07:13 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1042) (User: DESKTOP-TSSNE97)
Description: You cannot uninstall language de-DE because the language is the system installed UI language.
Error: (10/24/2026 11:06:46 PM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY)
Description: The Secure Boot update failed to update SBAT with error -1878589247. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931
Error: (10/14/2026 03:30:42 AM) (Source: Microsoft-Windows-FilterManager) (EventID: 3) (User: NT AUTHORITY)
Description: Filter Manager failed to attach to volume '\Device\Harddisk1\DR1'. This volume will be unavailable for filtering until a reboot. The final status was 0xc03a001c.
Windows Defender:
================
TimeCreated : 10/23/2026 11:01:27 PM
Message : Microsoft Defender Antivirus has encountered an error trying to update security intelligence and will
attempt to revert to a previous version.
Security intelligence Attempted: Current
Error Code: 0x80501102
Error description: An unexpected problem occurred. Install any available updates, then try to start
the program again. For information on installing updates, see Help and Support.
Security intelligence Version: 1.461.135.0;1.461.135.0
Engine Version: 1.1.26090.9
TimeCreated : 10/21/2026 9:28:34 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {072CA2F9-2321-4B6F-BD6E-FA36FAE32B3A}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/21/2026 9:06:06 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {30E165D6-75C4-48E8-8300-399B8BB92F15}
Scan Type: Antimalware
Scan Parameters: Full Scan
User: DESKTOP-TSSNE97\Max
Stop Reason: Unknown
TimeCreated : 10/21/2026 7:30:43 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {C53AE4C9-1B82-4B11-A292-41CD5C11BE63}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: RPC connection rundown
TimeCreated : 10/20/2026 8:08:05 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {0E3A951D-F3CD-46EE-B17E-5711A1FD6140}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/18/2026 11:29:55 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {109E7722-F85A-469C-9536-5ECC0F3DD690}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/18/2026 12:59:42 AM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {25345172-C5D5-4F81-8692-64030B2E1A6E}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/16/2026 4:45:41 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {52EF3B45-DE3D-4D7F-A9E7-7ACB25BD2D6D}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
CodeIntegrity:
===============
Date: 2026-10-25 10:19:00
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dll that did not meet the Windows signing level requirements.
Date: 2026-10-25 10:05:21
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\SIHClient.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dll that did not meet the Windows signing level requirements.
==================== Memory info ===========================
BIOS: HP U97 Ver. 01.19.00 06/11/2026
Motherboard: HP 89C0
Processor: 12th Gen Intel(R) Core(TM) i7-12700H
Percentage of memory in use: 56%
Total physical RAM: 32400.46 MB
Available physical RAM: 14012.82 MB
Total Virtual: 34448.46 MB
Available Virtual: 13138.67 MB
==================== Drives ================================
Disk 0 - Drive c: (Windows ) (Fixed) (Total:952.47 GB) (Free:145.98 GB) (Model: KXG80ZNV1T02 KIOXIA) (Protected) NTFS
Disk 0 - \\?\Volume{75b6a490-21e4-4310-92f3-a52379ddf552}\ () (Fixed) (Total:1.13 GB) (Free:115.14 MB) NTFS
Disk 0 - \\?\Volume{ebc844c4-453a-41b9-984a-abf74f8ce0ad}\ (SYSTEM) (Fixed) (Total:256 MB) (Free:148.17 MB) FAT32
==================== MBR & Partition Table ====================
============================================================
Disk: 0 (Size: 953.87 GB) (Disk ID: 2057CB08)
Partitions:
===========
Partition Style : GPT
Partition Count : 4
Disk ID : {8F6E2246-04D5-4C38-80A1-BE5EBD02F3B2}
Usable Offset : 0.02 MB
Usable Length : 953.87 GB
Max Partitions : 128
Partition 1
Type : EFI System Partition
Size : 260 MB
Offset : 1 MB
Type GUID : {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}
Partition GUID : {EBC844C4-453A-41B9-984A-ABF74F8CE0AD}
GPT Name : EFI system partition
Attributes : 0x0000000000000000
Attribute Flags : None
Hidden : Yes
Platform Required: No
------------------------------------------------------------
Partition 2
Type : Microsoft Reserved (MSR)
Size : 16 MB
Offset : 261 MB
Type GUID : {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}
Partition GUID : {0996B926-9638-4D99-B012-130299591DB2}
GPT Name : Microsoft reserved partition
Attributes : 0x0000000000000000
Attribute Flags : None
Hidden : Yes
Platform Required: No
------------------------------------------------------------
Partition 3
Type : Basic Data Partition
Size : 952.47 GB
Offset : 277 MB
Type GUID : {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}
Partition GUID : {8A2DC34A-71B5-4F7B-9D34-05659B50FA83}
GPT Name : Basic data partition
Attributes : 0x0000000000000000
Attribute Flags : None
Hidden : No
Platform Required: No
------------------------------------------------------------
Partition 4
Type : Windows Recovery
Size : 1.13 GB
Offset : 975604 MB
Type GUID : {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}
Partition GUID : {75B6A490-21E4-4310-92F3-A52379DDF552}
Attributes : 0x8000000000000001
Attribute Flags : Platform Required, No Default Drive Letter
Hidden : Yes
Platform Required: Yes
------------------------------------------------------------
============================================================
==================== End of Addition.txt =======================
Die CAPTCHAs treten scheinbar nur bei Firefox auf. Ich habe gestern mal eine Weile Edge benutzt und da ist das Problem kein einziges mal aufgetreten. LG, Max |
|
25.10.2026, 13:20
| #7 |
| /// TB-Ausbilder | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Vielen Dank für die Logs und die Rückmeldung. Ich vermute, das "Problem" liegt irgendwo in den Firefox-Browserdaten. Deaktiviere temporär nacheinander eine Erweiterung nach der anderen. Beginne bei "Unhook" und "Stylebot" und beobachte/überprüfe, ob du dann immer noch diese captcha Meldungen bekommst oder ob sie bei der Deaktivierung einer bestimmten Erweiterung ausbleiben.
__________________ --- Malware Removal Helper since 2012 --- TrojanerBoard | BleepingComputer | Malwarebytes Geändert von M-K-D-B (25.10.2026 um 13:32 Uhr) |
|
26.10.2026, 18:13
| #8 |
| | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Hi Matthias, etwa zeitgleich mit der Sicherheitswarnung von Google wurden ja auch alle extensions disabled und mein Mozilla-Konto ausgeloggt. Ich katte bis auf Bitwarden und UBlock noch nichts wieder enabled. Ich habe dann jetzt auch mal Bitwarden und UBlock disabled. Leider kommen die CAPTCHAs immernoch. Ich muss außerdem noch eine Korrektur vornehmen. Ich hatte zuvor gesagt, dass das Problem nur auf meinem Laptop besteht. Das stimmt aber anscheinend nicht (mehr). Meine Freundin hatte vorhin das gleiche auf ihrem MacBook. Sieht so aus als läge es am Internetzugang und nicht an meinem Gerät? Komisch trotzdem, dass es in etwa zweitgleich mit der Google Sicherheitsmeldung und der deaktivierung meiner extensions in Firefox das erste Mal aufgetreten ist. Liebe Grüße und vielen Dank für deine Hilfe! Max Edit: Ich hatte zusätzlich jetzt auch mehrfach auf diversen anderen Seiten von ein Cloudflare popup aufkommen: "Verify you are human". Ich vermute das hängt mit den Google CAPTCHAs zusammen? Geändert von Maxi92 (26.10.2026 um 18:25 Uhr) |
|
26.10.2026, 21:34
| #9 |
| /// TB-Ausbilder | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Servus, das wirft nun ein völlig neues Licht auf die Situation. Ich habe mir deine FRST-Logs ganz genau angeschaut und kann absolut keine Malware erkennen. Theoretisch könnte auch Malware auf einem anderen Gerät im Netzwerk sein. Das eigentliche CAPTCHA-Problem kommt aber von außen. Das liegt definitiv an eurer öffentlichen IP-Adresse (also eurem Internetanschluss) und nicht an deinem Laptop oder Firefox. Sowohl Google als auch Cloudflare führen globale Blacklists. Wenn von einer IP-Adresse plötzlich automatisierte Anfragen oder verdächtiger Datenverkehr ausgehen, wird diese IP-Adresse temporär auf eine "Graue Liste" gesetzt. Jedes Gerät, das ab diesem Zeitpunkt über deinen Router ins Internet geht, wird mit CAPTCHAs bombardiert. Dafür gibt es zwei typische Gründe: 1. Das Nachbarschafts-Problem: Viele Internetanbieter nutzen sogenanntes "DS-Lite". Dabei teilen sich hunderte Haushalte dieselbe öffentliche IPv4-Adresse. Wenn nur ein einziger deiner Nachbarn Schadsoftware auf dem PC hat oder Spam versendet, wird die IP gesperrt – und du badest das mit aus. 2. Ein Gerät im eigenen WLAN läuft Amok: Ein Gerät bei dir zu Hause (das muss nicht der Laptop sein, es kann auch ein Smart-TV, eine IP-Kamera oder ein infiziertes Handy sein) sendet unbemerkt im Hintergrund Traffic und hat deine IP belastet. Dass dein Laptop es zuerst gemerkt hat, liegt oft an einem "Reputations-Fass": Das andere Gerät hat das Fass tagelang unbemerkt gefüllt, und bei deinen normalen Google-Anfragen lief es dann über. Meine Empfehlung Den Router bitte zwingend für 10 Minuten vom Strom trennen. Du musst deinen Router (FRITZ!Box, Vodafone-Station etc.) zwingen, sich eine neue IP-Adresse vom Anbieter zu holen. Wichtig sind wirklich die 10 Minuten, da dir der Anbieter bei einem zu kurzen Neustart oft dieselbe "befleckte" IP wieder zuteilt. Anschließend beobachten. Logg dich in Firefox einfach wieder in dein Mozilla-Konto ein und aktiviere uBlock und Bitwarden wieder. Wenn die CAPTCHAs nach dem Router-Neustart weg sind, ist alles überstanden!
__________________ --- Malware Removal Helper since 2012 --- TrojanerBoard | BleepingComputer | Malwarebytes |
|
28.10.2026, 08:07
| #10 |
| | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Servus, danke für die ausführliche Antwort. Das hilft mich die Sache einzuordnen. Ich habe jetzt mal wie empfohlen den Router neugestartet und uBlock und Bitwarden reaktiviert. Auf den ersten Blick ist das Problem erstmal verschwunden. Ich hatte gestern keine CAPTCHAs mehr. Hoffen wir das es weg bleibt. Sollte ich sonst noch etwas tun? LG, Max Geändert von Maxi92 (28.10.2026 um 08:21 Uhr) |
|
28.10.2026, 21:46
| #11 |
| /// TB-Ausbilder | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Beobachte weiter. Zur Kontrolle noch bitte SC ausführen. Führe SecurityCheck (SC) gemäß der bebilderten Anleitung aus und füge die Logdatei als Anhang hinzu.
__________________ --- Malware Removal Helper since 2012 --- TrojanerBoard | BleepingComputer | Malwarebytes |
|
29.10.2026, 07:37
| #12 |
| | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Hi Matthias, hier die Logdtei: Code:
ATTFilter SecurityCheck by glax24 & Severnyj v.1.4.0.58 [15.08.24]
WebSite: www.safezone.cc
DateLog: 29.10.2026 07:32:41
Path starting: C:\Users\Max\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
Log directory: C:\SecurityCheck\
IsAdmin: True
User: Max
VersionXML: 17.09is-28.10.2026
___________________________________________________________________________
Windows 11 Professional (x64) Release: 25H2 (10.0.26200.9711) Lang: German(0407)
Installation date OS: 16.02.2025 21:23:44
LicenseStatus: Office 16, Office16OneNoteFreeR_Bypass edition The machine is permanently activated.
LicenseStatus: Office 16, Office16O365HomePremR_Grace edition Windows is in Notification mode
LicenseStatus: Windows(R), Professional edition The machine is permanently activated.
Boot Mode: Normal
Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
SystemDrive: C: FS: [NTFS] Capacity: [952.5 Gb] Used: [815.4 Gb] Free: [137.1 Gb]
------------------------------- [ Windows ] -------------------------------
User Account Control enabled (Level 3)
Security Center (wscsvc) - The service is running
Remote Registry (RemoteRegistry) - The service has stopped
SSDP Discovery (SSDPSRV) - The service is running
Remote Desktop Services (TermService) - The service has stopped
Windows Remote Management (WS-Management) (WinRM) - The service has stopped
Background Intelligent Transfer Service (BITS) - The service has stopped
Delivery Optimization (DoSvc) - The service is running
Windows Security Service (SecurityHealthService) - The service is running
Update Orchestrator Service (UsoSvc) - The service is running
WaaSMedicSvc (WaaSMedicSvc) - The service has stopped
Windows Update (wuauserv) - The service is running
---------------------------- [ Antivirus_WMI ] ----------------------------
Malwarebytes (enabled and up to date)
Windows Defender (disabled and up to date)
--------------------------- [ FirewallWindows ] ---------------------------
Windows Defender Firewall (mpssvc) - The service is running
---------------------- [ AntiVirusFirewallInstall ] -----------------------
Malwarebytes version 5.7.3.376 v.5.7.3.376
-------------------------- [ SecurityUtilities ] --------------------------
VeraCrypt v.1.25.9 Warning! Download Update
--------------------------- [ OtherUtilities ] ----------------------------
Microsoft 365 - de-de v.16.0.20527.20088 [+]
Microsoft 365 - en-gb v.16.0.20527.20088 [+]
NVIDIA App 11.0.7.237 v.11.0.7.237 Warning! Download Update
Obsidian v.1.10.6 Warning! Download Update
Evernote 10.125.5 v.10.125.5 Warning! Download Update
Microsoft Edge WebView2 Runtime v.156.0.4314.50
Steam v.2.10.91.91
Microsoft Visual C++ v14 Redistributable (x86) - 14.50.35719 v.14.50.35719.0 Warning! Download Update
Microsoft Visual C++ v14 Redistributable (x64) - 14.50.35719 v.14.50.35719.0 Warning! Download Update
------------------------------- [ Backup ] --------------------------------
Microsoft OneDrive v.26.189.0928.0009
-------------------------- [ IMAndCollaborate ] ---------------------------
Discord v.1.0.9260 Warning! Download Update
Zoom v.5.15.3 (18551) Warning! Download Update
-------------------------------- [ Media ] --------------------------------
HandBrake 1.6.1 v.1.6.1 Warning! Download Update
--------------------------- [ AdobeProduction ] ---------------------------
Adobe Creative Cloud v.6.9.1.1.3 Warning! Download Update
Adobe Media Encoder 2024 v.24.6.5 Warning! This software is no longer supported by Adobe. Please uninstall it. If you need a current Adobe product, install the latest version via the Creative Cloud desktop app or from the Adobe download page.
------------------------------- [ Browser ] -------------------------------
Mozilla Firefox (x64 en-US) v.158.0.1 Warning! Download Update
Google Chrome v.156.0.8078.48 Warning! Download Update
Microsoft Edge v.156.0.4314.50
----------------------------- [ EmailClient ] -----------------------------
Mozilla Thunderbird (x64 en-US) v.158.0.1 Warning! Download Update
------------------ [ AntivirusFirewallProcessServices ] -------------------
Malwarebytes Service (MBAMService) - The service is running
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe v.3.2.0.1565
Microsoft Defender Core Service (MDCoreSvc) - The service has stopped
Microsoft Defender Antivirus Service (WinDefend) - The service has stopped
Microsoft Defender Antivirus Network Inspection Service (WdNisSvc) - The service has stopped
----------------------------- [ End of Log ] ------------------------------
LG, Max |
|
29.10.2026, 19:10
| #13 |
| /// TB-Ausbilder | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Die von SecurityCheck bemängelten Programme solltest du aktualisieren (falls noch benötigt) oder deinstallieren (falls nicht mehr benötigt). Die Downloadlinks dazu findest du in der Logdatei von SecurityCheck. Entfernung der verwendeten Tools Führe KpRm gemäß der bebilderten Anleitung aus. Die Logdatei benötigen wir nicht. Dann wären wir durch! Wenn du keine Probleme mehr mit Malware hast, dann sind wir hier fertig. Deine Logdateien sind sauber.  Wenn Du möchtest, kannst Du hier sagen, ob du mit uns und unserer Hilfe zufrieden warst...  Vielleicht möchtest du das Forum mit einer kleinen Spende  unterstützen.  Zum Schluss bitte unbedingt die Sicherheitsmaßnahmen lesen und umsetzen: Hinweis: Bitte gib mir eine kurze Rückmeldung, sobald du die oben verlinkten Informationen gelesen hast, alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.
__________________ --- Malware Removal Helper since 2012 --- TrojanerBoard | BleepingComputer | Malwarebytes |
|
29.10.2026, 21:05
| #14 |
| | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Ich würde mich an dieser Stelle einmal gerne herzlich bedanken!  Es bestehen keine weiteren Fragen mehr. LG, Max Code:
ATTFilter ======================================================
# KpRm v3.3.1 — Report — 20261029210245
# https://github.com/KernelPan1k/KpRm
User : Max
Computer : DESKTOP-TSSNE97
System : Windows 11 Pro (64-bit) - build 26200.9711
Run count : 0
======================================================
Summary
------------------------------------------------------
Removed : 11
Programs launched : 0
Scheduled for removal on reboot : 0
Kept (quarantine) : 0
Removal scheduled (7 days) : 0
Found (scan only) : 0
Failed : 0
ESET Online Scanner
------------------------------------------------------
[OK] C:\Users\Max\Desktop\ESET Online Scanner.lnk (desktop)
[OK] C:\Users\Max\Downloads\esetonlinescanner.exe (download)
[OK] C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ESET Online Scanner.lnk (user_start_menu)
[OK] C:\Users\Max\AppData\Local\ESET\ESETOnlineScanner (folder)
[OK] HKLM64\SOFTWARE\ESET\ESET Online Scanner (registry_key)
FRST
------------------------------------------------------
[OK] C:\Users\Max\Downloads\Addition.txt (download)
[OK] C:\Users\Max\Downloads\Fixlog.txt (download)
[OK] C:\Users\Max\Downloads\FRST.txt (download)
[OK] C:\Users\Max\Downloads\FRST64.exe (download)
[OK] C:\FRST (home_drive)
SecurityCheck
------------------------------------------------------
[OK] C:\SecurityCheck (home_drive)
======================================================
End of report.
|
|
29.10.2026, 21:09
| #15 |
| /// TB-Ausbilder | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Gern geschehen. Wir sind froh, dass wir helfen konnten Dieses Thema scheint erledigt und wird aus unseren Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke uns bitte eine Erinnerung inklusive Link zum Thema. Jeder andere bitte hier klicken und ein eigenes Thema erstellen.
__________________ --- Malware Removal Helper since 2012 --- TrojanerBoard | BleepingComputer | Malwarebytes |
|
| Themen zu Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme |
| administrator, adobe, browser, defender, downloader, homepage, infiziert, internet, malware, mozilla, neustart, nvidia, pdf, performance, realtek, registry, rundll, security, server, services.exe, svchost.exe, system, usb, windows, wlan |
Lesestoff:
Linear-Darstellung
