| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-ProblemeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
Gestern, 14:26
| #1 |
| |  Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Hallo zusammen, ich befürchte, dass mein Laptop (HP ZBook Power G9, Windows 11) möglicherweise mit Malware infiziert ist, und würde mich über eure Hilfe freuen. Am 21.10. ist mir aufgefallen, dass ich sowohl aus meinem Google- als auch aus meinem Firefox-Konto ausgeloggt war. Außerdem waren plötzlich sämtliche Firefox-Erweiterungen (u. a. Bitwarden und uBlock Origin) deaktiviert. In meinem Google-Konto fand ich eine kritische Sicherheitswarnung über verdächtige Aktivitäten auf einem Windows-Gerät am 20.10. um 03:00 Uhr. Google hatte mich daraufhin offenbar automatisch abgemeldet. Was genau passiert ist, konnte ich leider nicht herausfinden. Daraufhin habe ich folgende Schritte unternommen: • Google-Passwort geändert, aktive Sitzungen und verbundene Apps überprüft. 2FA war bereits aktiviert. Keine weiteren Auffälligkeiten gefunden. • Microsoft Defender Offline-Scan durchgeführt. Dieser schien durchzulaufen, anschließend blieb Windows allerdings bei der Wiederherstellung hängen. Nach einem Neustart funktionierte wieder alles normal. Keine Funde. • Vollständigen Microsoft Defender-Scan Full-Scan durchgeführt: keine Funde. • Malwarebytes-Scan durchgeführt: ebenfalls keine Funde. • Nochmal ein weiteres Backup auf einer externen SSD gemacht (zusätzlich zu existierenden) Zusätzlich ist mir aufgefallen, dass Google auf dem Laptop wiederholt CAPTCHAs mit dem Hinweis auf ungewöhnlichen Netzwerkverkehr anzeigt. Auf meinem Smartphone tritt das im selben WLAN nicht auf. Einen VPN nutze ich nicht. Dieses Verhalten ist neu und hat in etwa zeitgleich mit den anderen beschriebenen Problemen bekommen. Ob die verschiedenen Auffälligkeiten zusammenhängen, kann ich nicht beurteilen. Insbesondere die Google-Sicherheitswarnung macht mir Sorgen. Vielen Dank schon einmal für eure Hilfe! LG Max FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-10-2026
Ran by Max (administrator) on DESKTOP-TSSNE97 (HP HP ZBook Power 15.6 inch G9 Mobile Workstation PC) (23-10-2026 14:42:33)
Running from C:\Users\Max\Downloads\FRST64.exe
Loaded Profiles: Max
Platform: Microsoft Windows 11 Pro Version 25H2 26200.9711 (X64) Language: German (Germany) -> English (United Kingdom)
Default browser: FF
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe
(Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\IPCBox\AdobeIPCBroker.exe
(C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe ->) (Adobe Inc. -> ) C:\Program Files (x86)\Adobe\Adobe Sync\CoreSync\CoreSync.exe
(C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud Helper.exe
(C:\Program Files (x86)\Steam\steam.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
(C:\Program Files\Common Files\Native Instruments\NTK\NTKDaemon.exe ->) (Native Instruments GmbH -> ) C:\Program Files\Common Files\Native Instruments\NTK\crashpad_handler.exe
(C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
(C:\Program Files\Mozilla Firefox\firefox.exe ->) (Mozilla Corporation -> Mozilla Foundation) C:\Program Files\Mozilla Firefox\crashhelper.exe
(C:\Program Files\Mozilla Thunderbird\thunderbird.exe ->) (Mozilla Corporation -> Mozilla Foundation) C:\Program Files\Mozilla Thunderbird\crashhelper.exe
(C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.exe ->) (Intel Corporation -> Intel Corporation) C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.Graphics.exe
(C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.exe ->) (Intel Corporation -> Intel(R) Corporation) C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\PresentMonService.exe
(C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe ->) (Spotify AB -> ) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\crashpad_handler.exe
(C:\ProgramData\Ableton\Live 12 Suite\Program\Ableton Live 12 Suite.exe ->) (Ableton AG -> ) C:\ProgramData\Ableton\Live 12 Suite\Resources\Extensions\Index\Ableton Index.exe
(dllhost.exe ->) (HP Inc. -> HP) C:\Program Files (x86)\HP\HP Notifications\HPNotifications.exe
(DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\NetworkCap.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\BridgeCommunication.exe
(DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_uf.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_helper.exe
(DriverStore\FileRepository\snapo64.inf_amd64_33d62b688b005396\SNAPOSS64.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Sonitude Corporation) C:\Windows\System32\DriverStore\FileRepository\snapo64.inf_amd64_33d62b688b005396\SNAPOS64.exe
(Dynalist Inc -> Obsidian) C:\Users\Max\AppData\Local\Programs\Obsidian\Obsidian.exe <3>
(explorer.exe ->) (Dynalist Inc -> Obsidian) C:\Users\Max\AppData\Local\Programs\Obsidian\Obsidian.exe
(explorer.exe ->) (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering, Ltd.) C:\Program Files\Focusrite\Drivers\Focusrite Notifier.exe
(explorer.exe ->) (IDRIX SARL -> IDRIX) C:\Program Files\VeraCrypt\VeraCrypt.exe
(explorer.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
(explorer.exe ->) (Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe
(explorer.exe ->) (Native Instruments GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareAccessibilityHelper.exe
(explorer.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e80b0ba89d6747cf\RtkAudUService64.exe
(explorer.exe ->) (Samsung Electronics CO., LTD. -> ) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(explorer.exe ->) (Thesycon Software Solutions GmbH & Co. KG -> ) C:\Program Files\Ableton\USB Audio Driver\x64\AbletonAudioCpl.exe
(HP Inc. -> ) C:\Program Files\WindowsApps\AD2F1837.myHP_61.52637.14262.0_x64__v10z8vjag6ke6\win32\DesktopExtension.exe
(HP Inc. -> HP Inc) C:\Program Files\WindowsApps\AD2F1837.myHP_61.52637.14262.0_x64__v10z8vjag6ke6\win32\HP.ContextAware.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Program Files (x86)\Microsoft\EdgeWebView\Application\155.0.4283.62\msedgewebview2.exe <5>
(Microsoft Windows -> Microsoft Corporation) C:\Windows\UUS\amd64\MoNotificationUx.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe <19>
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe <4>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <2>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\NVWMI\nvWmi64.exe
(Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e80b0ba89d6747cf\RtkAudUService64.exe
(services.exe ->) () [File not signed] C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe
(services.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe
(services.exe ->) (Bromium UK Limited -> HP) C:\Program Files\HP\Security Update Service\4.4.34.927\SecurityUpdateService.exe
(services.exe ->) (ELAN MICROELECTRONICS CORPORATION -> ELAN Microelectronics Corp.) C:\Windows\System32\ELAN_MOC_Service.exe
(services.exe ->) (FOR TESTING ONLY - IPF_PreProd_Cert -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dtt_sw.inf_amd64_683097297aaa9bb4\ipfsvc.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Program Files\HPCommRecovery\HPCommRecovery.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_b532962506597d3d\x64\TouchpointAnalyticsClientService.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\AppHelperCap.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\DiagsCap.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\NetworkCap.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\SysInfoCap.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\HotKeyServiceUWP.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\HPAudioAnalytics.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\LanWlanWwanSwitchingServiceUWP.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpsfuservice.inf_amd64_03ebfd05b519032c\HpSfuService64.exe
(services.exe ->) (HP Inc. -> HP Inc.) C:\Windows\System32\DriverStore\FileRepository\hpsvcsscancomp.inf_amd64_df5bc9f22dc3c742\x64\hpsvcsscan.exe
(services.exe ->) (HP Inc. -> HP) C:\Program Files (x86)\HP\Shared\hpqwmiex.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_b45f13a105037dbe\jhi_service.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_6d3406ba86e014cf\IntelCpHDCPSvc.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_uf.exe
(services.exe ->) (Intel Corporation -> Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\mewmiprov.inf_amd64_92a56761ef7ba712\WMIRegistrationService.exe
(services.exe ->) (Intel Corporation -> Intel(R) Corporation) C:\Windows\SysWOW64\XtuService.exe
(services.exe ->) (Intel Corporation -> Intel) C:\Windows\System32\DriverStore\FileRepository\intcoed.inf_amd64_a952167d9e98b004\AS\IAS\IntelAudioService.exe
(services.exe ->) (Malwarebytes Inc -> Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(services.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(services.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MidiSrv.exe
(services.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Fortemedia) C:\Windows\System32\FMService64.exe
(services.exe ->) (Microsoft Windows Hardware Compatibility Publisher -> Sonitude Corporation) C:\Windows\System32\DriverStore\FileRepository\snapo64.inf_amd64_33d62b688b005396\SNAPOSS64.exe
(services.exe ->) (Native Instruments GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
(services.exe ->) (Native Instruments GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\Hardware\NIHostIntegrationAgent.exe
(services.exe ->) (Native Instruments GmbH -> Native Instruments GmbH) C:\Program Files\Common Files\Native Instruments\NTK\NTKDaemon.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\Display.NvContainer\NVDisplay.Container.exe
(services.exe ->) (NVIDIA Corporation -> NVIDIA Corporation) C:\Windows\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\NVWMI\nvWmi64.exe
(services.exe ->) (Realtek Semiconductor Corp. -> Realtek Semiconductor) C:\Windows\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e80b0ba89d6747cf\RtkAudUService64.exe
(services.exe ->) (Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\steamservice.exe
(sihost.exe ->) (Ableton AG -> Ableton) C:\ProgramData\Ableton\Live 12 Suite\Program\Ableton Live 12 Suite.exe
(sihost.exe ->) (Microsoft Corporation -> ) C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4_102.2608.18002.0_x64__8wekyb3d8bbwe\MicrosoftSecurityApp\MicrosoftSecurityApp.exe
(sihost.exe ->) (Musecy SM Ltd. -> Muse) C:\Program Files\WindowsApps\Muse.MuseHub_2.0.22.1414_x64__rb9pth70m6nz6\Muse.exe
(sihost.exe ->) (Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe
(Spotify AB -> Spotify Ltd) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe <8>
(svchost.exe ->) (Adobe Inc. -> Adobe Inc.) C:\Program Files\Common Files\Adobe\Adobe OS Extension\AdobeNotificationClient.exe
(svchost.exe ->) (HP Inc. -> HP Inc.) C:\Program Files\HP\HP Client Security Manager\HP.ClientSecurityManager.exe
(svchost.exe ->) (HP) [File not signed] C:\Program Files (x86)\HP\HP ICS\ICS.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.StartExperiencesApp_1.398.2.0_x64__8wekyb3d8bbwe\MicrosoftStartFeedProvider\MicrosoftStartFeedProvider.exe
(svchost.exe ->) (Microsoft Corporation -> Microsoft Corporation) C:\Users\Max\AppData\Local\Microsoft\OneDrive\26.183.0920.0005\FileCoAuth.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe <2>
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\NgcIso.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppActions.exe
(svchost.exe ->) (Microsoft Windows -> Microsoft Corporation) C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SoftLandingTask\SoftLandingTask.exe
(Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe <6>
(Valve Corp. -> Valve Corporation) C:\Program Files (x86)\Steam\steam.exe
Failed to access process -> vmmemCmZygote
==================== Registry (Whitelisted) ===================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtkAudUService] => C:\WINDOWS\System32\DriverStore\FileRepository\realtekservice.inf_amd64_e80b0ba89d6747cf\RtkAudUService64.exe [3495976 2026-08-03] (Realtek Semiconductor Corp. -> Realtek Semiconductor)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [464608 2014-09-08] (Samsung Electronics CO., LTD. -> )
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [509936 2018-04-10] (Adobe Systems Incorporated -> Adobe Systems Incorporated)
HKLM\...\Run: [Focusrite Notifier] => C:\Program Files\Focusrite\Drivers\Focusrite Notifier.exe [906840 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering, Ltd.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch [3952720 2022-06-01] (Microsoft Windows Hardware Compatibility Publisher -> Logitech, Inc.)
HKLM\...\Run: [Logi Download Assistant] => C:\Program Files\LogiDownloadAssistant\bin\logi_download_assistant.exe [19199488 2026-05-19] (Logitech, Inc.) [File not signed]
HKLM-x32\...\Run: [HPNotifications] => C:\Program Files (x86)\HP\HP Notifications\HPNotifications.exe [1607816 2021-02-11] (HP Inc. -> HP)
HKLM-x32\...\Run: [Adobe CCXProcess] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe [133128 2025-12-21] (Adobe Inc. -> Adobe Inc.)
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [com.evernote.Evernote] => C:\Users\Max\AppData\Local\Programs\Evernote\Evernote.exe [186384464 2025-02-05] (Evernote Corporation -> Evernote Corporation)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [5823128 2026-10-13] (Valve Corp. -> Valve Corporation)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [electron.app.Notion] => C:\Users\Max\AppData\Local\Programs\Notion\Notion.exe --open-at-login (No File)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [MicrosoftEdgeAutoLaunch_0C0D5F59005A32876380EE3B976869A6] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start [5438320 2026-10-16] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Run: [GoogleUpdaterTaskUser157.0.8089.0] => C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe [9958552 2026-10-06] (Google LLC -> Google LLC)
HKLM\...\Windows x64\Print Processors\us016PC: C:\Windows\System32\spool\prtprocs\x64\us016pc.dll [61736 2022-02-24] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Codename Longhorn DDK provider)
HKLM\...\Print\Monitors\us016 Langmon: C:\WINDOWS\system32\us016lm.dll [40744 2022-02-24] (Microsoft Windows Hardware Compatibility Publisher -> )
AppInit_DLLs: c:\PROGRA~1\HP\SURECL~1\servers\BemHook.dll => No File
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ableton USB Audio Control Panel Autostart.lnk [2024-10-20]
ShortcutTarget: Ableton USB Audio Control Panel Autostart.lnk -> C:\Program Files\Ableton\USB Audio Driver\x64\AbletonAudioCpl.exe (Thesycon Software Solutions GmbH & Co. KG -> )
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NIHardwareAccessibilityHelper.exe.lnk [2025-08-15]
ShortcutTarget: NIHardwareAccessibilityHelper.exe.lnk -> C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareAccessibilityHelper.exe (Native Instruments GmbH -> Native Instruments GmbH)
GroupPolicy: Restriction - Chrome <==== ATTENTION
GroupPolicy\User: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Google: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
==================== Scheduled Tasks (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {4B664E1F-0135-4E8C-9111-9EC7D8564C9C} - System32\Tasks\Adobe Creative Cloud => C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2526688 2026-08-09] (Adobe Inc. -> Adobe Inc.)
Task: {FFCAC060-F32D-46D7-B285-75A677E275EB} - System32\Tasks\Adobe Uninstaller => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [446432 2026-08-09] (Adobe Inc. -> Adobe Inc.)
Task: {E0AE496B-3D72-4199-9443-AA18ED717B30} - System32\Tasks\GoogleUser\GoogleUpdater\GoogleUpdaterTaskUser157.0.8089.0{2BAF6901-F450-4A6E-83B9-B4857DD5C8CE} => C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe [9958552 2026-10-06] (Google LLC -> Google LLC)
Task: {D5C82890-1F3E-4CE3-88EC-1CBE58277897} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report => C:\Program Files (x86)\HP\HP Support Framework\Resources\HPSFReport.exe [480264 2026-08-13] (HP Inc. -> HP Inc.)
Task: {462495A0-DED9-4816-85F8-53086EA08498} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\HP\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1178696 2026-08-13] (HP Inc. -> HP Inc.)
Task: {10A29C9A-C44B-4CC1-87BB-47304EE2AFF9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\HP\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [1178696 2026-08-13] (HP Inc. -> HP Inc.)
Task: {982F0742-CE09-42A5-A638-2D439839B13D} - System32\Tasks\HP\Consent Manager Launcher => C:\WINDOWS\system32\sc.exe [102400 2025-07-08] (Microsoft Windows -> Microsoft Corporation) -> start hptouchpointanalyticsservice
Task: {481DC351-7E79-470E-8F69-49CEE9EB3AD9} - System32\Tasks\HP\HP ICS\ICS => C:\Program Files (x86)\HP\HP ICS\ICS.exe [76824576 2022-05-06] (HP) [File not signed]
Task: {0728873B-9E3C-47FE-ACD4-EC001FB2AC5A} - System32\Tasks\HP\HP Wolf Security\Launch Console => C:\Program Files\HP\HP Client Security Manager\HP.ClientSecurityManager.exe [263752 2026-07-13] (HP Inc. -> HP Inc.)
Task: {B597665C-A2F0-4D37-B866-534EF1D4A93D} - System32\Tasks\Launch Adobe CCXProcess => C:\Program Files\Adobe\Adobe Creative Cloud Experience\CCXProcess.exe [194112 2026-08-09] (Adobe Inc. -> Adobe Inc.)
Task: {EB1E27A6-A0B4-4512-883C-70856E9626D8} - System32\Tasks\Microsoft\Office\Office Actions Server => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ActionsServer\ActionsServer.exe [16430896 2026-10-18] (Microsoft Corporation -> Microsoft Corporation)
Task: {C33E3793-E27A-4A7C-8F34-F13B5FA9DFD7} - System32\Tasks\Microsoft\Office\Office Automatic Updates 2.0 => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [29735232 2026-10-13] (Microsoft Corporation -> Microsoft Corporation)
Task: {EA4C141F-914E-43BE-96CE-8F723C1407D9} - System32\Tasks\Microsoft\Office\Office Background Push Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\OFFICE16\opushutil.exe [15108960 2026-10-18] (Microsoft Corporation -> Microsoft Corporation)
Task: {38D8F0CC-9241-41A1-A134-B5BEA0481EAE} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [29735232 2026-10-13] (Microsoft Corporation -> Microsoft Corporation)
Task: {4405FBC6-C246-47F9-B9E4-C96E565647AF} - System32\Tasks\Microsoft\Office\Office Feature Updates => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [427296 2026-10-18] (Microsoft Corporation -> Microsoft Corporation)
Task: {0A61EB51-E6A2-4C4A-807D-5BB9C0A97618} - System32\Tasks\Microsoft\Office\Office Feature Updates Logon => C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe [427296 2026-10-18] (Microsoft Corporation -> Microsoft Corporation)
Task: {D144E639-5B99-4628-8ABA-D64107E5494C} - System32\Tasks\Microsoft\Office\Office Performance Monitor => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\operfmon.exe [1325424 2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Task: {2AFF8E7F-F468-4793-81CF-16A535B7B63E} - System32\Tasks\Microsoft\Office\Office Startup Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ActionsServer\ActionsServer.exe [16430896 2026-10-18] (Microsoft Corporation -> Microsoft Corporation)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File)
Task: {4F377EA7-6024-40A9-84A9-A1DF64484192} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [1080448 2026-10-20] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (the data entry has 6 more characters).
Task: {8A3F38F1-4048-47A5-8B1B-4F6671471F78} - System32\Tasks\Mozilla\Firefox Background Update S-1-5-21-571881649-101344733-3185888103-1002 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [1080448 2026-10-20] (Mozilla Corporation -> Mozilla Corporation) -> C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\--MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask background (the data entry has 6 more characters).
Task: {4F57E2E1-C128-47CC-8556-8EF63354E9C9} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [44160 2026-10-20] (Mozilla Corporation -> Mozilla Foundation)
Task: {329CF4E3-0C77-4EE3-A6C5-E0747B2BC40C} - System32\Tasks\NVIDIA App SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA App\CEF\NVIDIA App.exe [3346544 2026-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {A120F86D-A9FB-4E16-B28C-9C62FCD0646E} - System32\Tasks\nWizard_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\nview\nwiz.exe [1546280 2022-08-24] (Nvidia Corporation -> NVIDIA Corporation) -> C:\Program Files\NVIDIA Corporation\nview\/installquiet
Task: {7D9B41AC-F03F-4C24-A084-E62E7675F460} - System32\Tasks\SoftLanding\S-1-5-21-571881649-101344733-3185888103-1002\SoftLandingRefreshForExpirationTask-{bb81c0f5-21c5-4153-b8eb-e09718bd964b} => {F576B2F9-7850-4226-ADB0-E5993FED4F02}
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}\64259445A51224F6870264F6E60275C414E40273336303: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}\64259445A51224F6870264F6E60275C414E40273336303: [DhcpDomain] fritz.box
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}\84F6D656F56424: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{d379a33b-12ae-40fa-bceb-fb75225dce83}\84F6D656F56424: [DhcpDomain] fritz.box
FireFox:
========
FF TaskBarID: 6F114386CDBCE31 -> C:\Users\Max\AppData\Local\Mozilla Firefox
FF TaskBarID: 308046B0AF4A39CB -> C:\Program Files\Mozilla Firefox
FF DefaultProfile: 2yd52xta.default-release -> 308046B0AF4A39CB
FF DefaultProfile: 2yd52xta.default-release -> 641D10338ABA448D
FF ProfilePath: C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\9eh18pfb.default [2026-10-21]
FF ProfilePath: C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release [2026-10-23]
FF Homepage: Mozilla\Firefox\Profiles\2yd52xta.default-release -> hxxps://calendar.google.com/calendar/r
FF Notifications: Mozilla\Firefox\Profiles\2yd52xta.default-release -> hxxps://pomofocus.io; hxxps://mapio.net; hxxps://mail.proton.me; hxxps://app.zoom.us
FF Extension: (LeechBlock NG) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\leechblockng@proginosko.com.xpi [2026-09-29]
FF Extension: (Unhook - Remove YouTube Recommended & Shorts) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\myallychou@gmail.com.xpi [2026-04-10]
FF Extension: (uBlock Origin) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\uBlock0@raymondhill.net.xpi [2026-09-27]
FF Extension: (Bitwarden Password Manager) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\{446900e4-71c2-419f-a6a7-df9c091e268b}.xpi [2025-07-07]
FF Extension: (Stylebot) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\{52bda3fd-dc48-4b3d-a7b9-58af57879f1e}.xpi [2026-10-17]
FF Extension: (Video Download Helper) - C:\Users\Max\AppData\Roaming\Mozilla\Firefox\Profiles\2yd52xta.default-release\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2026-10-21]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2026-08-22] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2026-08-09] (Adobe Inc. -> Adobe Systems)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2026-08-22] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2026-08-09] (Adobe Inc. -> Adobe Systems)
Edge:
=======
Edge DefaultProfile: Default
Edge Profile: C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default [2026-08-21]
Edge StartupUrls: Default -> "hxxp://google.com/"
Edge Extension: (Google Docs Offline) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2025-12-21]
Edge Extension: (video downloader - CocoCut) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hcppimlenafppomfhfmlfckomalgmmga [2026-07-19]
Edge Extension: (LeechBlock NG) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\hnncfhodpmpjchmmcnimoimkcojdmfhl [2026-03-22]
Edge Extension: (Edge relevant text changes) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha [2024-02-03]
Edge Extension: (uBlock Origin) - C:\Users\Max\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\odfafepnkmbhccpbejgmiehpchacaeak [2026-07-19]
Chrome:
=======
CHR Profile: C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default [2026-08-21]
CHR DefaultSearchURL: Default -> hxxps://search.brave.com/search?q={searchTerms}
CHR DefaultSearchKeyword: Default -> search.brave.com
CHR DefaultSuggestURL: Default -> hxxps://search.brave.com/api/suggest?q={searchTerms}
CHR Extension: (Adobe Acrobat: PDF edit, convert, sign tools) - C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2026-06-15]
CHR Extension: (Google Docs Offline) - C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2026-06-15]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Max\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2025-12-06]
CHR HKU\S-1-5-21-571881649-101344733-3185888103-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
==================== Services (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [944608 2026-08-09] (Adobe Inc. -> Adobe Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [12714304 2026-10-13] (Microsoft Corporation -> Microsoft Corporation)
R2 dptftcs; C:\WINDOWS\System32\DriverStore\FileRepository\dtt_sw.inf_amd64_683097297aaa9bb4\ipfsvc.exe [562040 2024-05-24] (FOR TESTING ONLY - IPF_PreProd_Cert -> Intel Corporation)
R2 ELAN_MOC_Service; C:\WINDOWS\System32\ELAN_MOC_Service.exe [249856 2026-06-12] (ELAN MICROELECTRONICS CORPORATION -> ELAN Microelectronics Corp.)
R2 FMAPOService; C:\WINDOWS\System32\FMService64.exe [1028024 2024-05-17] (Microsoft Windows Hardware Compatibility Publisher -> Fortemedia)
R2 Focusrite Control Server; C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe [1297920 2024-03-11] () [File not signed]
R2 HotKeyServiceUWP; C:\WINDOWS\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\HotKeyServiceUWP.exe [1487016 2026-03-13] (HP Inc. -> HP Inc.)
R2 HP Comm Recover; C:\Program Files\HPCommRecovery\HPCommRecovery.exe [893984 2022-08-15] (HP Inc. -> HP Inc.)
R2 HPAppHelperCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\AppHelperCap.exe [909464 2025-09-30] (HP Inc. -> HP Inc.)
R2 HPAudioAnalytics; C:\WINDOWS\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\HPAudioAnalytics.exe [496808 2026-03-13] (HP Inc. -> HP Inc.)
R2 HPDiagsCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\DiagsCap.exe [907936 2025-09-30] (HP Inc. -> HP Inc.)
R2 HPNetworkCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\NetworkCap.exe [903840 2025-09-30] (HP Inc. -> HP Inc.)
R3 hpqcaslwmiex; C:\Program Files (x86)\HP\Shared\hpqwmiex.exe [1149448 2020-07-23] (HP Inc. -> HP)
R2 hpsvcsscan; C:\WINDOWS\System32\DriverStore\FileRepository\hpsvcsscancomp.inf_amd64_df5bc9f22dc3c742\x64\hpsvcsscan.exe [7142248 2026-02-18] (HP Inc. -> HP Inc.)
R2 HPSysInfoCap; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapcomp.inf_amd64_bac3c2b2a2c0d811\x64\SysInfoCap.exe [909464 2025-09-30] (HP Inc. -> HP Inc.)
R2 HpTouchpointAnalyticsService; C:\WINDOWS\System32\DriverStore\FileRepository\hpanalyticscomp.inf_amd64_b532962506597d3d\x64\TouchpointAnalyticsClientService.exe [639776 2025-10-01] (HP Inc. -> HP Inc.)
S2 Intel(R) Platform License Manager Service; C:\WINDOWS\System32\DriverStore\FileRepository\iclsclient.inf_amd64_b4ad878dc01a7e41\lib\PlatformLicenseManagerService.exe [741600 2024-03-13] (Intel Corporation -> Intel(R) Corporation)
R2 IntelAudioService; C:\WINDOWS\System32\DriverStore\FileRepository\intcoed.inf_amd64_a952167d9e98b004\AS\IAS\IntelAudioService.exe [532960 2025-12-16] (Intel Corporation -> Intel)
R2 IntelGraphicsSoftwareService; C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt\VFS\ProgramFilesX64\Intel\Intel Graphics Software\IntelGraphicsSoftware.Service.exe [324040 2026-10-14] (Intel Corporation -> Intel Corporation)
R2 ipfsvc; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_uf.exe [3084992 2024-05-23] (Intel Corporation -> Intel Corporation)
R2 LanWlanWwanSwitchingServiceUWP; C:\WINDOWS\System32\DriverStore\FileRepository\hpqkbsoftwarecompnent.inf_amd64_0d182501a33019e2\LanWlanWwanSwitchingServiceUWP.exe [594600 2026-03-13] (HP Inc. -> HP Inc.)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe [11667696 2026-10-21] (Malwarebytes Inc -> Malwarebytes)
S3 MBVpnTunnelService; C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe [4291576 2026-10-21] (Malwarebytes Inc -> Malwarebytes)
S3 MDCoreSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpDefenderCoreService.exe [2398680 2026-10-14] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 Muse Hub Updater Service; C:\Program Files\WindowsApps\Muse.MuseHub_2.0.22.1414_x64__rb9pth70m6nz6\Muse.Updater.exe [6213200 2024-11-01] (Musecy SM Ltd. -> Muse.Updater)
R2 NIHostIntegrationAgent; C:\Program Files\Common Files\Native Instruments\Hardware\NIHostIntegrationAgent.exe [27618648 2025-03-20] (Native Instruments GmbH -> Native Instruments GmbH)
R2 NTKDaemonService; C:\Program Files\Common Files\Native Instruments\NTK\NTKDaemon.exe [18193304 2025-10-09] (Native Instruments GmbH -> Native Instruments GmbH)
R2 NVDisplay.ContainerLocalSystem; C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\Display.NvContainer\NVDisplay.Container.exe [1702632 2026-03-18] (NVIDIA Corporation -> NVIDIA Corporation)
R2 NVWMI; C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\NVWMI\nvWmi64.exe [4568808 2026-03-18] (NVIDIA Corporation -> NVIDIA Corporation)
R2 SecurityUpdateService; C:\Program Files\HP\Security Update Service\4.4.34.927\SecurityUpdateService.exe [5314376 2026-10-01] (Bromium UK Limited -> HP)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [914752 2026-09-13] (Microsoft Windows Publisher -> Microsoft Corporation)
R2 SFUService; C:\WINDOWS\System32\DriverStore\FileRepository\hpsfuservice.inf_amd64_03ebfd05b519032c\HpSfuService64.exe [961192 2026-06-23] (HP Inc. -> HP Inc.)
R2 SNAPOService; C:\WINDOWS\System32\DriverStore\FileRepository\snapo64.inf_amd64_33d62b688b005396\SNAPOSS64.exe [830232 2025-12-17] (Microsoft Windows Hardware Compatibility Publisher -> Sonitude Corporation)
S3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\NisSrv.exe [5555528 2026-10-14] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MsMpEng.exe [378168 2026-10-14] (Microsoft Windows Publisher -> Microsoft Corporation)
===================== Drivers (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 arturiausbmidi; C:\WINDOWS\System32\DriverStore\FileRepository\arturiausbmidi.inf_amd64_3b60ea58f3448d4a\arturiausbmidi.sys [434352 2024-11-28] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 arturiausbmidiks; C:\WINDOWS\System32\DriverStore\FileRepository\arturiausbmidiks.inf_amd64_82108088788d0cec\arturiausbmidiks.sys [55480 2024-11-28] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 atc; C:\WINDOWS\System32\DRIVERS\atc.sys [5579176 2023-06-01] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender S.R.L. Bucharest, ROMANIA)
R3 bomebus; C:\WINDOWS\System32\drivers\bomebus.sys [56376 2018-05-16] (Bome Software GmbH & Co.KG -> Bome Software GmbH & Co. KG)
S3 bomemidi; C:\WINDOWS\system32\drivers\bomemidi.sys [50744 2018-05-16] (Bome Software GmbH & Co.KG -> Bome Software GmbH & Co. KG)
S3 BTHMODEM; C:\WINDOWS\System32\drivers\bthmodem.sys [110592 2025-02-16] (Microsoft Corporation) [File not signed]
S3 Ccx01000; C:\WINDOWS\System32\drivers\Ccx01000.sys [692224 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus2.sys [176976 2026-04-21] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
R3 e1dexpress; C:\WINDOWS\System32\DriverStore\FileRepository\e1d.inf_amd64_f3c6513565231a23\e1d.sys [609456 2022-11-14] (Intel Corporation -> Intel Corporation)
R1 ESProtectionDriver; \??\C:\WINDOWS\system32\drivers\mbae.sys [159296 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> )
R3 FocusritePCIeSwRoot; C:\WINDOWS\System32\drivers\FocusritePCIeSwRoot.sys [106208 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsb; C:\WINDOWS\System32\drivers\FocusriteUsb.sys [170312 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbAudio; C:\WINDOWS\System32\drivers\FocusriteUsbAudio.sys [109896 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbMidi; C:\WINDOWS\System32\drivers\FocusriteUsbMidi.sys [53576 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R3 FocusriteUsbSwRoot; C:\WINDOWS\System32\drivers\FocusriteUsbSwRoot.sys [112968 2023-11-27] (Focusrite Audio Engineering Ltd -> Focusrite Audio Engineering Ltd.)
R0 fse; C:\WINDOWS\System32\drivers\fse.sys [240968 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
R1 Gemma; C:\WINDOWS\System32\DRIVERS\gemma.sys [1322912 2023-06-01] (Microsoft Windows Hardware Compatibility Publisher -> BitDefender S.R.L. Bucharest, ROMANIA)
R3 HPCustomCapDriver; C:\WINDOWS\System32\DriverStore\FileRepository\hpcustomcapdriver.inf_amd64_1421dec2010cc057\x64\hpcustomcapdriver.sys [18984 2024-05-07] (Microsoft Windows Hardware Compatibility Publisher -> HP Inc.)
R3 iaLPSS2_GPIO2_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_gpio2_adl.inf_amd64_302e75596cffa74a\iaLPSS2_GPIO2_ADL.sys [150616 2022-10-18] (Intel Corporation -> Intel Corporation)
R3 iaLPSS2_I2C_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_i2c_adl.inf_amd64_e736c048ca307ed2\iaLPSS2_I2C_ADL.sys [220224 2022-10-18] (Intel Corporation -> Intel Corporation)
R3 iaLPSS2_SPI_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_spi_adl.inf_amd64_334c460fea9b11a4\iaLPSS2_SPI_ADL.sys [171608 2022-10-18] (Intel Corporation -> Intel Corporation)
R3 iaLPSS2_UART2_ADL; C:\WINDOWS\System32\DriverStore\FileRepository\ialpss2_uart2_adl.inf_amd64_43d5df63d19fde70\iaLPSS2_UART2_ADL.sys [329320 2022-10-18] (Intel Corporation -> Intel Corporation)
R3 IntcUSB; C:\WINDOWS\System32\DriverStore\FileRepository\intcusb.inf_amd64_7e96b5cfecffcac7\IntcUSB.sys [949216 2025-12-16] (Intel Corporation -> Intel(R) Corporation)
R3 IntelGNA; C:\WINDOWS\System32\DriverStore\FileRepository\gna.inf_amd64_04d4eecc5838a558\gna.sys [88760 2022-07-06] (Intel Corporation -> Intel Corporation)
R3 ipf_acpi; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_acpi.inf_amd64_d8fafa4e2f98ceba\ipf_acpi.sys [88768 2024-05-23] (Intel Corporation -> Intel Corporation)
R3 ipf_cpu; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_cpu.sys [88144 2024-05-23] (Intel Corporation -> Intel Corporation)
R3 ipf_lf; C:\WINDOWS\System32\DriverStore\FileRepository\ipf_cpu.inf_amd64_a50addc1f126c381\ipf_lf.sys [499392 2024-05-23] (Intel Corporation -> Intel Corporation)
S3 KslD; C:\WINDOWS\System32\drivers\wd\KslD.sys [82968 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
S2 l1vhlwf; C:\WINDOWS\System32\drivers\l1vhlwf.sys [155000 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
R2 mbamchameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [235624 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [22120 2026-10-21] (Microsoft Windows Early Launch Anti-Malware Publisher -> Malwarebytes)
R3 MBAMFarflt; C:\WINDOWS\System32\Drivers\farflt11.sys [217704 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMProtection; C:\WINDOWS\System32\Drivers\mbam.sys [133224 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [245864 2026-10-21] (Microsoft Windows Hardware Compatibility Publisher -> Malwarebytes)
R3 MBAMWebProtection; \??\C:\WINDOWS\system32\DRIVERS\mwac.sys [190096 2026-10-21] (Malwarebytes Inc -> )
S3 nimm3dfu; C:\WINDOWS\System32\drivers\nimm3dfu.sys [39824 2018-10-16] (Native Instruments GmbH -> Native Instruments GmbH)
R3 nvpcf; C:\WINDOWS\System32\drivers\nvpcf.sys [308456 2026-03-17] (NVIDIA Corporation -> NVIDIA Corporation)
R2 SSPORT; \??\C:\windows\system32\Drivers\SSPORT.sys [14224 2022-05-02] (Microsoft Windows Hardware Compatibility Publisher -> )
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [174416 2026-04-21] (Samsung Electronics CO., LTD. -> Samsung Electronics Co., Ltd.)
S3 USBMidi2; C:\WINDOWS\System32\DriverStore\FileRepository\usbmidi2.inf_amd64_b65e0d0af0d372e6\USBMidi2.sys [106496 2026-10-13] (Microsoft Windows -> Microsoft Corporation)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [817672 2023-04-14] (Microsoft Windows Hardware Compatibility Publisher -> IDRIX)
S3 vkrnlintvsc; C:\WINDOWS\System32\DriverStore\FileRepository\wvkrnlintvsc.inf_amd64_ae7c1fb85fc0224e\vkrnlintvsc.sys [79168 2025-02-16] (Microsoft Windows -> Microsoft Corporation)
R3 vkrnlintvsp; C:\WINDOWS\System32\DriverStore\FileRepository\wvkrnlintvsp.inf_amd64_249e734e16ab4232\vkrnlintvsp.sys [87504 2026-08-13] (Microsoft Windows -> Microsoft Corporation)
S3 vlflt; C:\WINDOWS\System32\DRIVERS\vlflt.sys [481184 2023-06-01] (Microsoft Windows Hardware Compatibility Publisher -> Bitdefender)
S3 vmbusproxy; C:\WINDOWS\system32\drivers\vmbusproxy.sys [98304 2025-06-11] (Microsoft Windows -> Microsoft Corporation)
S4 WdAiNisDrv; C:\WINDOWS\System32\drivers\wd\WdAiNisDrv.sys [51224 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\wd\WdBoot.sys [21632 2026-10-14] (Microsoft Windows Early Launch Anti-Malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\wd\WdFilter.sys [669712 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [138264 2026-10-14] (Microsoft Windows -> Microsoft Corporation)
R3 WiManHu; C:\WINDOWS\System32\DriverStore\FileRepository\wiman.inf_amd64_1bb2c76cfbc82913\WiManHu\WiManHu.sys [218568 2026-02-11] (Intel Corporation -> Intel Corporation)
S3 WSDPrintDevice; C:\WINDOWS\System32\DriverStore\FileRepository\wsdprint.inf_amd64_1f9e32519098c0b6\WSDPrint.sys [57344 2025-02-16] (Microsoft Windows -> Microsoft Corporation)
==================== SvcHost (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One month (created) (Whitelisted) =========
(If an entry is included in the fixlist, the file/folder will be moved.)
2026-10-23 14:42 - 2026-10-23 14:44 - 000045981 _____ C:\Users\Max\Downloads\FRST.txt
2026-10-23 14:41 - 2026-10-23 14:43 - 000000000 ____D C:\FRST
2026-10-23 14:40 - 2026-10-23 14:41 - 002457088 _____ (Farbar) C:\Users\Max\Downloads\FRST64.exe
2026-10-21 21:50 - 2026-10-21 21:50 - 000190096 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mwac.sys
2026-10-21 21:49 - 2026-10-22 21:57 - 000000000 ____D C:\Users\Max\AppData\Local\Malwarebytes
2026-10-21 21:49 - 2026-10-21 21:49 - 000002101 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2026-10-21 21:49 - 2026-10-21 21:49 - 000002089 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2026-10-21 21:49 - 2026-10-21 21:49 - 000000000 ____D C:\Users\Max\AppData\Local\Sentry
2026-10-21 21:48 - 2026-10-21 21:48 - 000000000 ____D C:\ProgramData\Malwarebytes
2026-10-21 21:47 - 2026-10-21 21:48 - 000000000 ____D C:\Program Files\Malwarebytes
2026-10-21 21:47 - 2026-10-21 21:47 - 002906704 _____ (Malwarebytes) C:\Users\Max\Downloads\MBSetup-7.7.exe
2026-10-21 15:52 - 2026-10-21 15:52 - 000698006 _____ C:\WINDOWS\system32\perfh007.dat
2026-10-21 15:52 - 2026-10-21 15:52 - 000150942 _____ C:\WINDOWS\system32\perfc007.dat
2026-10-21 14:51 - 2026-10-21 14:51 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2026-10-21 01:39 - 2026-10-22 23:24 - 000000000 ____D C:\WINDOWS\CbsTemp
2026-10-20 19:50 - 2026-10-21 13:06 - 000000000 ____D C:\Program Files\Mozilla Firefox
2026-10-15 23:35 - 2026-10-22 13:03 - 000000000 ____D C:\Program Files\Mozilla Thunderbird
2026-10-13 20:42 - 2026-10-13 20:42 - 000091797 _____ C:\WINDOWS\SysWOW64\ctac.json
2026-10-13 20:42 - 2026-10-13 20:42 - 000091797 _____ C:\WINDOWS\system32\ctac.json
2026-10-13 20:42 - 2026-10-13 20:42 - 000039736 _____ C:\WINDOWS\SysWOW64\IntegratedServicesRegionPolicySet.json
2026-10-13 20:42 - 2026-10-13 20:42 - 000039736 _____ C:\WINDOWS\system32\IntegratedServicesRegionPolicySet.json
2026-10-13 20:42 - 2026-10-13 20:42 - 000004985 _____ C:\WINDOWS\system32\DeviceFeatureDDF.json
2026-10-08 22:21 - 2026-10-08 22:21 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logi Download Assistant
2026-10-03 20:15 - 2026-10-03 20:15 - 118715181 _____ C:\Users\Max\Downloads\Foundation Course-20261003T181528Z-1-001.zip
2026-10-02 08:29 - 2026-10-02 08:29 - 000000000 ____D C:\Program Files\Common Files\DESIGNER
2026-09-28 20:01 - 2026-10-04 18:53 - 000001311 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord.lnk
2026-09-28 06:54 - 2026-10-23 03:08 - 000016615 _____ C:\Users\Max\Desktop\Japan Expenses.xlsx
2026-09-28 06:54 - 2026-09-28 06:54 - 000000165 ____H C:\Users\Max\Desktop\~$Japan Expenses.xlsx
==================== One month (modified) ==================
(If an entry is included in the fixlist, the file/folder will be moved.)
2026-10-23 14:45 - 2024-07-14 14:19 - 000000000 ____D C:\Program Files (x86)\Steam
2026-10-23 14:42 - 2025-10-19 19:57 - 000000000 ____D C:\Users\WsiAccount
2026-10-23 14:16 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SystemTemp
2026-10-23 14:16 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\WinBioDatabase
2026-10-23 13:28 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\AppReadiness
2026-10-23 13:28 - 2024-04-01 09:26 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2026-10-23 12:25 - 2025-12-19 22:33 - 000000000 ____D C:\Users\Max\Desktop\Max's PKM
2026-10-23 12:06 - 2025-08-25 23:42 - 001806236 _____ C:\Users\Max\AppData\LocalLow\48ebf18c1401a68f92c3442631cd352566de8f82437b3b83c09d3cd5306c2405
2026-10-23 11:46 - 2025-08-25 23:42 - 000001138 _____ C:\Users\Max\AppData\LocalLow\286efa2f40f3ea9ae1d33a1f2ba97746c0d967f4f30197efe6f04cadeb0ccbab
2026-10-23 09:50 - 2025-02-16 22:55 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2026-10-23 03:14 - 2023-04-18 13:11 - 000000000 ____D C:\Users\Max\AppData\Roaming\Anki2
2026-10-23 03:14 - 2023-04-12 13:14 - 000000000 ____D C:\Users\Max\AppData\Roaming\Microsoft\Word
2026-10-23 03:14 - 2023-04-12 13:03 - 000000000 ____D C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38
2026-10-23 03:08 - 2023-04-14 12:52 - 000000000 ____D C:\Users\Max\AppData\Roaming\Microsoft\Excel
2026-10-23 01:37 - 2025-12-06 21:58 - 000002564 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2026-10-22 23:24 - 2025-12-19 22:30 - 000000000 ____D C:\Users\Max\AppData\Roaming\obsidian
2026-10-22 22:02 - 2025-08-28 01:02 - 000000130 _____ C:\Users\Max\AppData\LocalLow\981c0756294e2a37d655c063711bcd570123439c3bd0e71a07f5025540c89aaa
2026-10-22 21:24 - 2025-08-28 01:02 - 000038099 _____ C:\Users\Max\AppData\LocalLow\49798e1ee2c5c0ce6eda1c74ff925d13e6fdfec02e09593f177958860a4ad850
2026-10-22 19:40 - 2025-02-16 23:23 - 000003574 _____ C:\WINDOWS\system32\Tasks\Launch Adobe CCXProcess
2026-10-22 12:40 - 2025-12-28 20:10 - 000000000 ____D C:\Users\Max\AppData\Roaming\The Froosh Amp
2026-10-22 12:40 - 2023-04-12 11:36 - 000000000 ____D C:\Users\Max\AppData\Local\D3DSCache
2026-10-22 05:18 - 2024-04-01 09:26 - 000000000 ___HD C:\Program Files\WindowsApps
2026-10-21 22:25 - 2026-09-13 14:55 - 000267029 _____ C:\WINDOWS\system32\InstallMonitorLog.csv
2026-10-21 21:49 - 2024-04-01 09:26 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2026-10-21 21:49 - 2024-04-01 09:24 - 000000000 ____D C:\WINDOWS\INF
2026-10-21 21:49 - 2023-04-12 11:29 - 000000000 ____D C:\Users\Max\AppData\Local\Packages
2026-10-21 21:49 - 2022-06-02 22:21 - 000000000 ____D C:\ProgramData\Packages
2026-10-21 21:01 - 2023-04-13 19:27 - 000000000 ____D C:\Users\Max\AppData\Local\CrashDumps
2026-10-21 15:52 - 2025-02-16 23:22 - 001637736 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2026-10-21 15:49 - 2025-11-16 14:05 - 000000130 _____ C:\Users\Max\AppData\LocalLow\06e56d9ebcd506c23ac3cac74ddecd166d6f9406d3c9d85c69c6ee31400f2447
2026-10-21 15:14 - 2025-08-25 23:22 - 000013497 _____ C:\Users\Max\AppData\LocalLow\19cba8bb7c48fdfb12bda34b03712a9057f03d374edd105673e20ce6a008ee41
2026-10-21 15:14 - 2025-08-15 14:58 - 000000000 ____D C:\ProgramData\boost_interprocess
2026-10-21 15:12 - 2025-02-16 23:23 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2026-10-21 15:12 - 2025-02-16 23:16 - 000018834 _____ C:\WINDOWS\system32\5E37410B-D6F1-471D-AE27-563CEAC0D6B2
2026-10-21 15:12 - 2024-11-05 00:57 - 000000000 ____D C:\Users\Max\AppData\Local\MuseSampler
2026-10-21 15:12 - 2024-11-05 00:57 - 000000000 ____D C:\Users\Max\AppData\Local\Muse Hub
2026-10-21 15:12 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\ServiceState
2026-10-21 15:12 - 2023-04-12 11:38 - 000000000 ___RD C:\Users\Max\OneDrive
2026-10-21 15:12 - 2023-03-02 13:18 - 000000000 ____D C:\ProgramData\NVIDIA
2026-10-21 15:11 - 2022-06-02 22:20 - 000012288 ___SH C:\DumpStack.log.tmp
2026-10-21 13:44 - 2024-04-01 09:21 - 001048576 _____ C:\WINDOWS\system32\config\BBI
2026-10-21 13:06 - 2025-02-16 22:55 - 000001623 _____ C:\WINDOWS\system32\config\VSMIDK
2026-10-21 13:06 - 2023-04-12 13:03 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2026-10-21 13:05 - 2025-02-16 23:14 - 000000000 ____D C:\Users\Max
2026-10-21 12:36 - 2026-08-22 10:29 - 000002133 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2026-10-21 12:36 - 2025-02-16 23:23 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2026-10-21 12:36 - 2023-04-12 13:03 - 000001073 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2026-10-21 09:33 - 2025-05-24 11:28 - 000000000 ____D C:\WINDOWS\Minidump
2026-10-21 09:33 - 2023-04-12 09:53 - 009670162 ____N C:\WINDOWS\Minidump\102126-27765-01.dmp
2026-10-20 21:12 - 2024-12-20 23:55 - 000000000 ____D C:\Users\Max\OneDrive\Documents\12 Guitar practice routine
2026-10-20 07:51 - 2025-02-16 23:23 - 000003536 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2026-10-20 07:51 - 2025-02-16 23:23 - 000003464 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2026-10-19 09:16 - 2026-03-15 19:23 - 000001063 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Thunderbird.lnk
2026-10-18 23:33 - 2023-03-02 13:14 - 000000000 ____D C:\Program Files\Microsoft Office
2026-10-18 10:16 - 2022-06-02 22:20 - 000002446 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2026-10-15 15:09 - 2025-02-16 23:23 - 000003584 _____ C:\WINDOWS\system32\Tasks\OneDrive Reporting Task-S-1-5-21-571881649-101344733-3185888103-1002
2026-10-15 15:09 - 2025-02-16 23:23 - 000003560 _____ C:\WINDOWS\system32\Tasks\OneDrive Startup Task-S-1-5-21-571881649-101344733-3185888103-1002
2026-10-15 15:09 - 2025-02-16 23:23 - 000003372 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-571881649-101344733-3185888103-1002
2026-10-15 15:09 - 2023-04-12 11:38 - 000002381 _____ C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2026-10-14 08:15 - 2022-06-02 22:20 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2026-10-14 07:43 - 2024-04-01 09:26 - 000000000 ____D C:\ProgramData\USOPrivate
2026-10-14 04:25 - 2025-02-16 22:55 - 000630016 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2026-10-14 04:24 - 2025-12-10 05:18 - 000000000 ____D C:\WINDOWS\system32\NarratorMCAT
2026-10-14 04:24 - 2025-07-14 02:47 - 000000000 ____D C:\WINDOWS\system32\ruxim
2026-10-14 04:24 - 2024-04-01 18:36 - 000000000 ____D C:\WINDOWS\system32\OpenSSH
2026-10-14 04:24 - 2024-04-01 18:36 - 000000000 ____D C:\WINDOWS\system32\Microsoft-Edge-WebView
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\UUS
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\WinMetadata
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\setup
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\oobe
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\migwiz
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\InstallShield
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\Dism
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SysWOW64\AdvancedInstallers
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\SystemResources
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\WinMetadata
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\Sysprep
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\setup
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\SecureBootUpdates
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\PerceptionSimulation
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\oobe
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\migwiz
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\HealthAttestationClient
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\Dism
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\DDFs
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\appraiser
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\system32\AdvancedInstallers
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\ShellExperiences
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\ShellComponents
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\Provisioning
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\BrowserCore
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\WINDOWS\bcastdvr
2026-10-14 04:24 - 2024-04-01 09:26 - 000000000 ____D C:\Program Files\Common Files\System
2026-10-14 04:24 - 2024-04-01 09:21 - 000000000 ____D C:\WINDOWS\servicing
2026-10-14 04:23 - 2025-06-23 19:55 - 000000000 ____D C:\Users\Max\AppData\Roaming\discord
2026-10-13 20:42 - 2025-02-16 22:57 - 003387392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2026-10-13 20:03 - 2023-04-12 11:53 - 000000000 ____D C:\WINDOWS\system32\MRT
2026-10-13 19:56 - 2023-04-12 11:53 - 230303336 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2026-10-13 10:34 - 2022-09-17 23:43 - 000000000 ____D C:\Program Files\HP
2026-10-08 22:21 - 2026-06-15 21:22 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logi
2026-10-08 22:21 - 2026-06-15 21:22 - 000000000 ____D C:\ProgramData\Logi
2026-10-08 22:21 - 2026-06-15 21:22 - 000000000 ____D C:\Program Files\LogiDownloadAssistant
2026-10-04 18:53 - 2025-06-23 19:55 - 000000000 ____D C:\Users\Max\AppData\Local\Discord
2026-10-01 07:21 - 2023-04-12 09:53 - 009718741 ____N C:\WINDOWS\Minidump\100126-22250-01.dmp
2026-09-28 07:54 - 2023-04-14 17:26 - 000000000 ____D C:\Users\Max\AppData\Roaming\Evernote
==================== Files in the root of some directories ========
2023-06-07 11:59 - 2023-06-07 11:59 - 000001456 _____ () C:\Users\Max\AppData\Local\Adobe Save for Web 13.0 Prefs
==================== SigCheck ============================
(There is no automatic fix for files that do not pass verification.)
==================== End of FRST.txt ========================
--- --- --- Weiteres Logfile passt nicht mehr in den Post. Ich reiche das nach! Geändert von Maxi92 (Gestern um 14:33 Uhr) |
|
Gestern, 14:38
| #2 |
| | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Hier noch die addition.txt
__________________Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2026
Ran by Max (23-10-2026 14:47:49)
Running from C:\Users\Max\Downloads
Microsoft Windows 11 Pro Version 25H2 26200.9711 (X64) (2025-02-16 21:23:44)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
(If an entry is included in the fixlist, it will be removed.)
Administrator (S-1-5-21-571881649-101344733-3185888103-500 - Administrators - Disabled)
DefaultAccount (S-1-5-21-571881649-101344733-3185888103-503 - Limited - Disabled)
Guest (S-1-5-21-571881649-101344733-3185888103-501 - Limited - Disabled)
Max (DisplayName: M** *ö**r) (S-1-5-21-571881649-101344733-3185888103-1002 - Administrators - Enabled) [MS Account] => C:\Users\Max
WDAGUtilityAccount (S-1-5-21-571881649-101344733-3185888103-504 - Limited - Disabled)
WsiAccount (S-1-5-21-571881649-101344733-3185888103-1003 - Limited - Disabled) => C:\Users\WsiAccount
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Malwarebytes (Enabled - Up to date) {A537353A-1D6A-F6B5-9153-CE1CF80FBE66}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Ableton Live 12 Suite (HKLM\...\{0380CF5F-9EF2-4ABA-BF87-EA4826A1B89B}) (Version: 12.0.0.0 - Ableton) Hidden
Ableton Live 12 Suite (HKLM-x32\...\{9FE4C915-316D-4C18-B4C4-BF627B8504DD}) (Version: 12.0.0.0 - Ableton)
Ableton USB Audio Driver v5.68.0 (HKLM\...\{A823612A-AA91-4911-886A-7C589452C65C}) (Version: 5.68.0 - Ableton)
Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 6.9.1.1.3 - Adobe Inc.)
Adobe Media Encoder 2024 (HKLM-x32\...\AME_24_6_5) (Version: 24.6.5 - Adobe Inc.)
Adobe Media Encoder 2025 (HKLM-x32\...\AME_25_6_6) (Version: 25.6.6 - Adobe Inc.)
Adobe Media Encoder 2026 (HKLM-x32\...\AME_26_5) (Version: 26.5 - Adobe Inc.)
Amazon Kindle (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Amazon Kindle) (Version: 2.9.1.71006 - Amazon)
Anaconda3 2023.03-1 (Python 3.10.9 64-bit) (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Anaconda3 2023.03-1 (Python 3.10.9 64-bit)) (Version: 2023.03-1 - Anaconda, Inc.)
Analog Lab V 5.10.7 (HKLM-x32\...\Analog Lab V_is1) (Version: 5.10.7 - Arturia)
Anki Launcher (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Anki) (Version: 25.09 - )
Arturia Software Center 2.9.1 (HKLM-x32\...\Arturia Software Center_is1) (Version: 2.9.1 - Arturia)
Arturia USB MIDI Driver v1.6.0 (HKLM\...\{C2E707D7-4B3C-4A35-A877-756E8F49D7EF}) (Version: 1.6.0 - Arturia)
Bome Virtual MIDI 2.1.0.44 (HKLM\...\BMIDI_Driver1.0.0.11_is1) (Version: - Bome Software GmbH & Co. KG)
Common Desktop Agent (HKLM\...\{031A0E14-0413-4C97-9772-2639B782F46F}) (Version: 1.62.0 - OEM) Hidden
Discord (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Discord) (Version: 1.0.9260 - Discord Inc.)
EarMaster 7.7 (HKLM\...\EarMaster 7_is1) (Version: 7.7 - EarMaster ApS)
Evernote 10.125.5 (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\e4251011-875e-51f3-a464-121adaff5aaa) (Version: 10.125.5 - Evernote Corporation)
Focusrite Audio Drivers 4.119.13.33 (HKLM\...\Focusrite Audio Drivers_is1) (Version: 4.119.13.33 - Focusrite Audio Engineering, Ltd.)
Focusrite Control 3.18.0.204 (HKLM\...\Focusrite Control_is1) (Version: 3.18.0.204 - Focusrite Audio Engineering Ltd.)
GameRanger (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\GameRanger) (Version: - GameRanger Technologies)
Google Chrome (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\Google Chrome) (Version: 156.0.8078.47 - Google LLC)
HandBrake 1.6.1 (HKLM-x32\...\HandBrake) (Version: 1.6.1 - )
HP Connection Optimizer (HKLM-x32\...\{6468C4A5-E47E-405F-B675-A70A70983EA6}) (Version: 2.0.19.0 - HP Inc)
HP Documentation (HKLM\...\HP_Documentation) (Version: 1.0.0.1 - HP Inc.)
HP Notifications (HKLM-x32\...\{84937F28-9CB4-49E7-A2CF-E32D97E6DAE6}) (Version: 1.1.28.1 - HP)
HP Security Update Service (HKLM\...\{8C2C90BB-9650-443D-A4ED-958D39B3C9EA}) (Version: 4.4.34.927 - HP Inc.)
HP Sure Recover (HKLM\...\{EE6377DD-C166-40D9-ACFF-AEB827623329}) (Version: 10.1.34.334 - HP Inc.)
HP Sure Run Module (HKLM\...\{EB7671C4-861D-4C1F-BA26-C8ED6B8EF933}) (Version: 5.0.5.118 - HP Inc.)
HP System Default Settings (HKLM-x32\...\{D530265D-C486-4A7F-8FC0-79CE82BB5F6B}) (Version: 1.5.9.1 - HP Inc.) Hidden
HP Wolf Security - Console (HKLM\...\{627D40D8-9926-42C1-BA7F-6AA7A5DFFE9A}) (Version: 11.1.8.1209 - HP Inc.)
ICS (HKLM-x32\...\{9881592F-ADE0-430D-8E1E-31F363C1BA28}) (Version: 3.0.17.0 - HP Inc.)
Logi Download Assistant (HKLM-x32\...\LogiDownloadAssistant) (Version: 2.0.1020 - Logitech)
Malwarebytes version 5.7.3.376 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 5.7.3.376 - Malwarebytes)
Microsoft .NET Host - 6.0.21 (x64) (HKLM\...\{26FF35F7-ADBB-4C9F-97DA-79120DB80EC6}) (Version: 48.87.64667 - Microsoft Corporation) Hidden
Microsoft .NET Host - 8.0.8 (x64) (HKLM\...\{3BA242F8-BDB5-4096-9FBC-333CD663BBAD}) (Version: 64.32.18380 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 6.0.21 (x64) (HKLM\...\{D937EF87-F11D-4778-973C-B71E178F95D0}) (Version: 48.87.64667 - Microsoft Corporation) Hidden
Microsoft .NET Host FX Resolver - 8.0.8 (x64) (HKLM\...\{7FE24458-0796-4428-99C2-9A0F8DAB93CC}) (Version: 64.32.18380 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 6.0.21 (x64) (HKLM\...\{8D2EC92E-5903-4B25-9406-182B8EFA834F}) (Version: 48.87.64667 - Microsoft Corporation) Hidden
Microsoft .NET Runtime - 8.0.8 (x64) (HKLM\...\{9ACB23DB-4D32-49ED-A5E3-F4E2F8D9D2AA}) (Version: 64.32.18380 - Microsoft Corporation) Hidden
Microsoft 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 16.0.20430.20182 - Microsoft Corporation)
Microsoft 365 - en-gb (HKLM\...\O365HomePremRetail - en-gb) (Version: 16.0.20430.20182 - Microsoft Corporation)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 155.0.4283.62 - Microsoft Corporation)
Microsoft Edge WebView2 Runtime (HKLM-x32\...\Microsoft EdgeWebView) (Version: 155.0.4283.62 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\OneDriveSetup.exe) (Version: 26.183.0920.0005 - Microsoft Corporation)
Microsoft OneNote - de-de (HKLM\...\OneNoteFreeRetail - de-de) (Version: 16.0.20430.20182 - Microsoft Corporation)
Microsoft OneNote - en-gb (HKLM\...\OneNoteFreeRetail - en-gb) (Version: 16.0.20430.20182 - Microsoft Corporation)
Microsoft Teams Meeting Add-in for Microsoft Office (HKLM\...\{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}) (Version: 1.24.31301 - Microsoft)
Microsoft Update Health Tools (HKLM\...\{C6FD611E-7EFE-488C-A0E0-974C09EF6473}) (Version: 5.72.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030 (HKLM\...\{37B8F9C7-03FB-3253-8781-2517C99D7C00}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030 (HKLM\...\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (HKLM-x32\...\{B175520C-86A2-35A7-8619-86DC379688B9}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (HKLM-x32\...\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}) (Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40664 (HKLM-x32\...\{042d26ef-3dbe-4c25-95d3-4c1b11b235a7}) (Version: 12.0.40664.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40664 (HKLM-x32\...\{9dff3540-fc85-4ed5-ac84-9e3c7fd8bece}) (Version: 12.0.40664.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.40664 (HKLM\...\{010792BA-551A-3AC0-A7EF-0FAB4156C382}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.40664 (HKLM\...\{53CF6934-A98D-3D84-9146-FC4EDF3D5641}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.40664 (HKLM-x32\...\{D401961D-3A20-3AC7-943B-6139D5BD490A}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.40664 (HKLM-x32\...\{8122DAB1-ED4D-3676-BB0A-CA368196543E}) (Version: 12.0.40664 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.50.35719 (HKLM\...\{AECD4ED0-8A3B-41E9-92D1-6BEE0374CCAF}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.50.35719 (HKLM\...\{61B44572-8722-4DAF-8ACF-8E742D30BCC5}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.50.35719 (HKLM-x32\...\{773AD50D-AAE6-4BA1-AD01-B5A38874C840}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.50.35719 (HKLM-x32\...\{5A0DFA55-3851-45BC-8B20-95EA4BF5812D}) (Version: 14.50.35719 - Microsoft Corporation) Hidden
Microsoft Visual C++ v14 Redistributable (x64) - 14.50.35719 (HKLM-x32\...\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}) (Version: 14.50.35719.0 - Microsoft Corporation)
Microsoft Visual C++ v14 Redistributable (x86) - 14.50.35719 (HKLM-x32\...\{0e4ccf1b-d073-4cfe-8a24-e86185719b56}) (Version: 14.50.35719.0 - Microsoft Corporation)
Microsoft Windows Application Compatibility Fix Database (HKLM\...\{22221111-1111-1111-1111-111111111111}.sdb) (Version: - )
Microsoft Windows Desktop Runtime - 6.0.21 (x64) (HKLM\...\{AF6BF7DD-2B12-40C5-919C-2EC99054BBE1}) (Version: 48.87.64723 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 6.0.21 (x64) (HKLM-x32\...\{0f39db03-9030-48f3-82ef-5384bed81d85}) (Version: 6.0.21.32717 - Microsoft Corporation)
Microsoft Windows Desktop Runtime - 8.0.8 (x64) (HKLM\...\{663E7053-3B36-4AE5-8223-234867FAEAE6}) (Version: 64.32.18376 - Microsoft Corporation) Hidden
Microsoft Windows Desktop Runtime - 8.0.8 (x64) (HKLM-x32\...\{33832ff3-5583-4b81-b270-d9fd42760e1a}) (Version: 8.0.8.33916 - Microsoft Corporation)
MIDI Control Center 1.21.1 (HKLM\...\MIDI Control Center_is1) (Version: 1.21.1 - Arturia)
Mozilla Firefox (x64 en-US) (HKLM\...\Mozilla Firefox) (Version: 158.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 148.0.1 - Mozilla)
Mozilla Thunderbird (x64 en-US) (HKLM\...\Mozilla Thunderbird 158.0 (x64 en-US)) (Version: 158.0 - Mozilla)
MuseScore 4 (HKLM\...\{200A530C-A4F7-48BB-8A37-F5454DBCEE95}) (Version: 4.2.0.233521124 - MuseScore BVBA and Others)
Native Access 3.21.1 (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\c410b7d2-8fce-53b3-8332-e98b6e89a16a) (Version: 3.21.1 - Native Instruments)
Native Instruments Controller Editor (HKLM-x32\...\Native Instruments Controller Editor) (Version: 2.8.2.0 - Native Instruments)
Native Instruments Komplete Kontrol MK2 Driver (HKLM-x32\...\Native Instruments Komplete Kontrol MK2 Driver) (Version: - Native Instruments)
Native Instruments Maschine 3 (HKLM-x32\...\Native Instruments Maschine 3) (Version: 3.3.1.0 - Native Instruments)
Native Instruments Maschine Jam Driver (HKLM-x32\...\Native Instruments Maschine Jam Driver) (Version: - Native Instruments)
Native Instruments Maschine MK3 Driver (HKLM-x32\...\Native Instruments Maschine MK3 Driver) (Version: - Native Instruments)
Native Instruments Maschine Studio Driver (HKLM-x32\...\Native Instruments Maschine Studio Driver) (Version: - Native Instruments)
Native Instruments NIHostIntegrationAgent (HKLM-x32\...\Native Instruments NIHostIntegrationAgent) (Version: 1.17.1.5 - Native Instruments)
Native Instruments NTKDaemon (HKLM-x32\...\Native Instruments NTKDaemon) (Version: 1.26.0.0 - Native Instruments)
NVIDIA App 11.0.7.237 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NvApp) (Version: 11.0.7.237 - NVIDIA Corporation)
NVIDIA FrameView SDK 1.7.12227.37421622 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_FrameViewSdk) (Version: 1.7.12227.37421622 - NVIDIA Corporation)
NVIDIA Graphics Driver 595.97 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 595.97 - NVIDIA Corporation)
NVIDIA RTX Desktop Manager 203.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView) (Version: 203.20 - NVIDIA Corporation)
Obsidian (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\bd400747-f0c1-5638-a859-982036102edf) (Version: 1.10.6 - Obsidian)
Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.20430.20092 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM\...\{90160000-008C-0407-1000-0000000FF1CE}) (Version: 16.0.20430.20182 - Microsoft Corporation) Hidden
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 2.00.01.35 - HP Inc.)
Samsung Scan Process Machine (HKLM-x32\...\Samsung Scan Process Machine) (Version: 1.03.05.28 - Samsung Electronics Co., Ltd.) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Uninstall Samsung Printer Software (HKLM-x32\...\TotalUninstaller) (Version: 4.0.0.93 - Samsung Electronics CO., LTD.)
VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.25.9 - IDRIX)
YubiKey Manager (HKLM-x32\...\yubikey-manager) (Version: 1.2.5 - Yubico AB)
Zoom (HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\ZoomUMX) (Version: 5.15.3 (18551) - Zoom Video Communications, Inc.)
Packages:
=========
@{MicrosoftWindows.55182690.Taskbar_1000.26100.3775.0_x64__cw5n1h2txyewy?ms-resource://MicrosoftWindows.55182690.Taskbar/Resources/ProductPkgDisplayName} -> C:\WINDOWS\SystemApps\SxS\MicrosoftWindows.55182690.Taskbar_cw5n1h2txyewy [2025-06-20] ()
Adobe Native Client -> C:\Program Files\Common Files\Adobe\Adobe OS Extension [2025-12-21] ()
Amazon Kindle: Reading App -> C:\Program Files\WindowsApps\AMZNKindle.AmazonKindleReadingApp_1.1.4132.0_x64__m1sc522ngdk36 [2026-10-21] (AMZN Kindle)
AppUp.IntelGraphicsExperience -> C:\Program Files\WindowsApps\AppUp.IntelGraphicsExperience_1.100.5688.0_x64__8j3eq9eme6ctt [2024-11-09] (INTEL CORP) [Startup Task]
HP -> C:\Program Files\WindowsApps\AD2F1837.myHP_61.52637.14262.0_x64__v10z8vjag6ke6 [2026-10-04] (HP Inc.) [Startup Task]
HP Audio Control -> C:\Program Files\WindowsApps\RealtekSemiconductorCorp.HPAudioControl_2.54.396.0_x64__dt26b99r8h8gj [2026-10-02] (Realtek Semiconductor Corp)
HP PC Hardware Diagnostics Windows -> C:\Program Files\WindowsApps\AD2F1837.HPPCHardwareDiagnosticsWindows_3.3.2.0_x64__v10z8vjag6ke6 [2026-10-04] (HP Inc.) [Startup Task]
HP PC Privacy Settings -> C:\Program Files\WindowsApps\AD2F1837.HPPrivacySettings_1.6.4.0_x64__v10z8vjag6ke6 [2026-10-04] (HP Inc.)
HP Power Manager -> C:\Program Files\WindowsApps\AD2F1837.HPPowerManager_3.0.18.0_x64__v10z8vjag6ke6 [2023-04-12] (HP Inc.)
HP QuickDrop -> C:\Program Files\WindowsApps\AD2F1837.HPQuickDrop_2.5.10921.0_x64__v10z8vjag6ke6 [2023-06-14] (HP Inc.)
HP Support Assistant -> C:\Program Files\WindowsApps\AD2F1837.HPSupportAssistant_9.55.10.0_x64__v10z8vjag6ke6 [2026-08-21] (HP Inc.)
HP System Information -> C:\Program Files\WindowsApps\AD2F1837.HPSystemInformation_8.10.53.0_x64__v10z8vjag6ke6 [2026-09-27] (HP Inc.)
Intel(R) Management and Security Status -> C:\Program Files\WindowsApps\AppUp.IntelManagementandSecurityStatus_2537.8.7.0_x64__8j3eq9eme6ctt [2026-02-27] (INTEL CORP) [Startup Task]
Intel® Graphics Software -> C:\Program Files\WindowsApps\AppUp.IntelArcSoftware_26.36.2702.0_x64__8j3eq9eme6ctt [2026-10-14] (INTEL CORP) [Startup Task]
Local AI Manager for Microsoft 365 -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16\AI [2026-10-18] ()
Malwarebytes Anti-Malware -> C:\Program Files\Malwarebytes\Anti-Malware [2026-10-22] ()
Microsoft Defender -> C:\Program Files\WindowsApps\Microsoft.6365217CE6EB4_102.2608.18002.0_x64__8wekyb3d8bbwe [2026-09-27] (Microsoft Corporation) [Startup Task]
Microsoft Whiteboard -> C:\Program Files\WindowsApps\Microsoft.Whiteboard_56.20201.588.0_x64__8wekyb3d8bbwe [2026-02-18] (Microsoft Corporation)
Microsoft.HEVCVideoExtensions -> C:\Program Files\WindowsApps\Microsoft.HEVCVideoExtensions_2.4.110.0_x64__8wekyb3d8bbwe [2026-08-29] (Microsoft Corporation)
Microsoft.Office.ActionsServer -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16\ActionsServer [2026-10-18] ()
Muse Hub -> C:\Program Files\WindowsApps\Muse.MuseHub_2.0.22.1414_x64__rb9pth70m6nz6 [2024-11-04] (Muse) [Startup Task]
NVIDIA Control Panel -> C:\Program Files\WindowsApps\NVIDIACorp.NVIDIAControlPanel_8.1.969.0_x64__56jybvy8sckqj [2025-11-07] (NVIDIA Corp.)
OfficePushNotificationsUtility -> C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx64\Microsoft Shared\Office16 [2026-10-18] ()
Samsung Printer Experience -> C:\Program Files\WindowsApps\SAMSUNGELECTRONICSCO.LTD.SamsungPrinterExperience_1.3.15.0_x64__3c1yjt4zspk6g [2023-04-20] (Samsung Electronics Co. Ltd.)
Speech Pack - English (United Kingdom) -> C:\Program Files\WindowsApps\MicrosoftWindows.Speech.en-GB.1_1.0.19.0_x64__cw5n1h2txyewy [2026-09-27] (Microsoft Windows)
SpotifyAB.SpotifyMusic -> C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0 [2026-10-21] (Spotify AB) [Startup Task]
==================== Custom CLSID (Whitelisted): ==============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{13357088-9834-0409-1600-134951500000}\localserver32 -> "C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{19CEDD27-D972-4CC0-ABAC-C58CD08C46DB}\localserver32 -> C:\Users\Max\AppData\Local\Discord\app-1.0.9260\Discord.exe (Discord Inc. -> Discord Inc.)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{1a46400f-4c81-802a-c2c1-1e9a687a9340}\localserver32 -> C:\Program Files\HandBrake\HandBrake.exe (HandBrake Team) [File not signed]
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}\localserver32 -> C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{2F81B25E-7507-4844-BFF2-77D2CC24CED4}\localserver32 -> C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Adobe Inc. -> Adobe Inc.)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{38142727-3008-9161-1521-349515000000}\localserver32 -> "C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe" -ToastActivated => No File
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{547E9AEF-8043-5D26-879F-01E7664192DC}\localserver32 -> C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{65574321-d3fb-e7db-e83e-38fe55a80c4a}\localserver32 -> C:\Program Files\HP\HP Client Security Manager\HP.ClientSecurityManager.exe (HP Inc. -> HP Inc.)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{6DDCE70D-A4AE-4E97-908C-BE7B2DB750AD}\localserver32 -> C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{6E1E5C99-BC66-5838-926C-B47FC5A1B44A}\localserver32 -> C:\Users\Max\AppData\Local\Google\GoogleUpdater\157.0.8089.0\updater.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{6FED547A-D1E3-45A6-BF0D-A2B75E8341A1}\InprocServer32 -> C:\Program Files\Mozilla Thunderbird\notificationserver.dll (Mozilla Corporation -> Mozilla Foundation)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{A2C6CB58-C076-425C-ACB7-6D19D64428CD}\localserver32 -> C:\Users\Max\AppData\Local\Google\Chrome\Application\156.0.8078.47\notification_helper.exe (Google LLC -> Google LLC)
CustomCLSID: HKU\S-1-5-21-571881649-101344733-3185888103-1002_Classes\CLSID\{e8c77137-e224-5791-b6e9-ff0305797a13}\InprocServer32 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll (Adobe Inc. -> Adobe Systems)
ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ContextMenuHandlers1: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2026-10-21] (Malwarebytes Inc -> Malwarebytes)
ContextMenuHandlers5: [NvAppDesktopContext] -> {F2E8B4A1-9C7D-4F6E-B3A5-8D2C1F4E9B7A} => C:\Program Files\NVIDIA Corporation\NVIDIA App\NvCpl\nvui.dll [2026-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\System32\DriverStore\FileRepository\nvblwi.inf_amd64_ec9e93908147d7d7\nvshext.dll [2026-03-18] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers5: [NvQuadroView] -> {1E9B04FB-F9E5-4718-997B-B8DA88302A48} => C:\Program Files\NVIDIA Corporation\nview\nvshell.dll [2022-08-24] (Nvidia Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [AccExt] -> {2A118EB5-5797-4F5E-8B3D-F4ECBA3C98E4} => C:\Program Files (x86)\Common Files\Adobe\CoreSyncExtension\CoreSync_x64.dll [2025-12-21] (Adobe Inc. -> )
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll [2026-10-21] (Malwarebytes Inc -> Malwarebytes)
==================== Codecs (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Drivers32-x32: [vidc.VP60] => C:\WINDOWS\system32\vp6vfw.dll
HKLM\...\Drivers32-x32: [vidc.VP61] => C:\WINDOWS\system32\vp6vfw.dll
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
ShortcutWithArgument: C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anaconda3 (64-bit)\Anaconda Prompt.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> "/K" C:\Users\Max\anaconda3\Scripts\activate.bat C:\Users\Max\anaconda3
==================== Loaded Modules (Whitelisted) =============
2022-05-06 12:05 - 2022-05-06 12:05 - 000182784 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\_cffi_backend.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000012288 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\_win32sysloader.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000031232 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\bcrypt\_bcrypt.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000116224 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\kiwisolver.pyd
2022-05-06 12:21 - 2022-05-06 12:21 - 034413408 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\libopenblas.GK7GX5KEQ4F6UYO3P26ULGBQYHGQO7J4.gfortran-win_amd64.dll
2022-05-06 12:05 - 2022-05-06 12:05 - 000012288 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\_c_internal_utils.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000189952 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\_image.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000159744 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\_path.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000231424 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\backends\_backend_agg.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000012800 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\backends\_tkagg.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000605696 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\matplotlib\ft2font.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000110592 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\core\_multiarray_tests.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 002818048 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\core\_multiarray_umath.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000112640 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\fft\_pocketfft_internal.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000155648 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\linalg\_umath_linalg.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000022016 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\linalg\lapack_lite.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000239616 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_bounded_integers.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000181760 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_common.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000666112 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_generator.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000079360 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_mt19937.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000065536 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_pcg64.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000072704 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_philox.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000053248 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\_sfc64.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000152576 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\bit_generator.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000564224 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\numpy\random\mtrand.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 002672128 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\PIL\_imaging.pyd
2022-05-06 12:22 - 2022-05-06 12:22 - 000140800 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\pywintypes39.dll
2022-05-06 12:05 - 2022-05-06 12:05 - 000134144 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\win32api.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000155648 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\win32file.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000026624 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\win32pipe.pyd
2022-05-06 12:05 - 2022-05-06 12:05 - 000141312 _____ () [File not signed] C:\Program Files (x86)\HP\HP ICS\win32security.pyd
2025-12-10 13:16 - 2025-12-10 13:28 - 000163840 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Program\libusb-1.0.dll
2025-12-10 13:16 - 2025-12-10 13:28 - 000321024 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Program\soxr.dll
2025-12-10 13:16 - 2024-09-26 22:54 - 000325120 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Program\USFLIB.dll
2025-12-10 13:17 - 2025-08-27 21:53 - 000816640 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Devices\Pc\Analog_64.dll
2025-12-10 13:20 - 2025-06-23 00:03 - 004908544 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\packages\RNBO\extensions\rnbopatcher.mxe64
2025-12-10 13:27 - 2025-12-10 13:29 - 000642560 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\MaxLua.dll
2025-12-10 13:27 - 2024-07-08 18:05 - 002400768 _____ () [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\mozjs185-1.0.dll
2023-03-02 13:15 - 2023-03-02 13:15 - 000000000 ____L () [symlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\AppvIsvSubsystems64.dll] C:\Program Files\Microsoft Office\root\Office16\AppVIsvSubsystems64.dll
2023-03-02 13:15 - 2023-03-02 13:15 - 000000000 ____L () [symlink -> C:\Program Files\Common Files\Microsoft Shared\ClickToRun\C2R64.dll] C:\Program Files\Microsoft Office\root\Office16\c2r64.dll
2026-04-17 18:50 - 2026-04-17 18:50 - 000000000 ____L () [symlink -> C:\Program Files\NVIDIA Corporation\NVIDIA App\MessageBus\NvMessageBusBroadcast.dll] C:\Program Files\NVIDIA Corporation\NvContainer\plugins\LocalSystem\NvMessageBusBroadcast.dll
2025-12-10 13:17 - 2025-12-10 13:29 - 001708032 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\jitter\gl2.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000878080 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\jitter\sketch.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000296448 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\m4l\live.guilib.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000046592 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\autohelp.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000023552 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\debugwindow.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 001550336 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\genpatcher.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000017920 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\jsrepl.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 069547008 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\maxclang.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000675328 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\maxurl.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 033185280 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\maxxslt.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 003175424 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\maxzlib.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000025600 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\objectview.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000047104 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\palblocks.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000039424 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\paramview.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000060416 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\pianoroll.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000034304 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\querylib.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000040448 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\setplugpath.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 001368576 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\sqlite.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000236544 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\synophrys.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 020189696 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\v8.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000265728 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\yaml.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000029184 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\max\zoomer.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000014336 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\msp\cefaudio.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000066048 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\msp\max~.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000051712 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\msp\polybuffer.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000022528 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\msp\probe.history~.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000019456 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\msp\probe.meter~.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000028160 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\extensions\msp\probe.scope~.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000048128 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\externals\max\comment.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000180224 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\externals\max\js.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000040448 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\jitter\jsjitter.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000041984 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\m4l\jsliveapi.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000022016 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsfolder.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000029696 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsmaxobjlistener.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000028672 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsparaminfoprovider.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000029696 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsparamlistener.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000020480 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsrequire.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000023040 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsrx256.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000024064 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jssnapshotapi.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000017920 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jssqlite.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000016896 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jssqlresult.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000027136 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jstrigger.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000024064 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\max\jsxmlhttprequest.mxe64
2025-12-10 13:17 - 2025-12-10 13:29 - 000020480 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\jsextensions\msp\jsbuffer.mxe64
2025-12-10 13:18 - 2025-12-10 13:29 - 001992192 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\packages\Jitter Tools\extensions\gl3.mxe64
2025-12-10 13:27 - 2025-12-10 13:29 - 001224192 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\jitlib.dll
2025-12-10 13:27 - 2025-12-10 13:29 - 000258048 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\MaxAPI.dll
2025-12-10 13:27 - 2025-12-10 13:29 - 000677888 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\MaxAudio.dll
2025-12-10 13:27 - 2024-07-08 18:05 - 000604672 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\MAXCRT.dll
2025-12-10 13:27 - 2025-12-10 13:29 - 032441344 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\MaxPlug.DLL
2025-12-10 13:27 - 2025-12-10 13:29 - 000216576 _____ (Cycling '74) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Resources\Max\resources\support\patcher.dll
2025-08-15 20:29 - 2025-08-15 20:28 - 011872256 _____ (MANDA AUDIO) [File not signed] C:\Program Files\Common Files\VST3\MT-PowerDrumKit.vst3
2025-12-10 13:16 - 2024-09-26 22:54 - 000856576 _____ (Propellerhead Software AB) [File not signed] C:\ProgramData\Ableton\Live 12 Suite\Program\REX Shared Library.dll
2022-05-02 09:22 - 2022-05-02 09:22 - 000123904 _____ (Samsung Electronics Co., Ltd.) [File not signed] C:\Program Files (x86)\Samsung\Easy Printer Manager\SmartScreenPrint\CDAKEYMonitor64.dll
==================== Alternate Data Streams (Whitelisted) ========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Max\Downloads\FRST64.exe:MBAM.Zone.Identifier [225]
==================== Safe Mode (Whitelisted) ==================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"
==================== Association (Whitelisted) =================
==================== Internet Explorer (Whitelisted) =============
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\HP\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2026-08-13] (HP Inc. -> HP Inc.)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\HP\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2026-08-13] (HP Inc. -> HP Inc.)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2026-10-02] (Microsoft Corporation -> Microsoft Corporation)
==================== Hosts content: =========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2022-05-07 07:24 - 2022-05-07 07:22 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts
==================== Network ===========================
(Currently there is no automatic fix for this section.)
DNS Servers: 192.168.1.1
Windows Firewall is enabled.
Network Binding:
=============
WiFi: Intel(R) Wi-Fi 6E AX211 160MHz -> Netwtw14.sys
Ethernet: Intel(R) Ethernet Connection (16) I219-V -> e1d.sys
Bluetooth Network Connection: Bluetooth Device (Personal Area Network) -> bthpan.sys
vms_vsf: Hyper-V Virtual Switch Extension Filter
ms_l1vhlwf: Nested Network Virtualization
vms_vsp: Hyper-V Virtual Switch Extension Protocol
==================== Other Areas ===========================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-571881649-101344733-3185888103-1002\Control Panel\Desktop\\Wallpaper ->
HKU\S-1-5-21-571881649-101344733-3185888103-1003\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows Defender\Features => (TamperProtection: 5) (TamperProtectionSource: 2)
HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection => (DpaDisabled: 0)
==================== MSCONFIG/TASK MANAGER disabled items ==
(If an entry is included in the fixlist, it will be removed.)
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_0C0D5F59005A32876380EE3B976869A6"
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\StartupApproved\Run: => "com.evernote.Evernote"
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\StartupApproved\Run: => "electron.app.Notion"
HKU\S-1-5-21-571881649-101344733-3185888103-1002\...\StartupApproved\Run: => "Steam"
==================== FirewallRules (Whitelisted) ================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{DCDA7D5F-BAD3-4AC3-887A-1FF0CE918EDF}] => (Allow) C:\Program Files\Focusrite\Focusrite Control\Server\ControlServer.exe () [File not signed]
FirewallRules: [{C456FF6A-B402-47DC-973F-E0B60C7AEE40}] => (Allow) C:\Program Files\WindowsApps\Muse.MuseHub_2.0.22.1414_x64__rb9pth70m6nz6\Muse.exe (Musecy SM Ltd. -> Muse)
FirewallRules: [UDP Query User{C9D105A9-EFE9-4E55-A059-F2E6473FF292}C:\programdata\ableton\live 12 suite\program\ableton live 12 suite.exe] => (Block) C:\programdata\ableton\live 12 suite\program\ableton live 12 suite.exe (Ableton AG -> Ableton)
FirewallRules: [TCP Query User{C37E346A-AC58-4B29-A57A-497BB09F015C}C:\programdata\ableton\live 12 suite\program\ableton live 12 suite.exe] => (Block) C:\programdata\ableton\live 12 suite\program\ableton live 12 suite.exe (Ableton AG -> Ableton)
FirewallRules: [UDP Query User{438C1372-E898-4F07-9CAF-395B1C8E92CC}C:\program files (x86)\steam\steamapps\common\don't starve together\bin64\dontstarve_dedicated_server_nullrenderer_x64.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\don't starve together\bin64\dontstarve_dedicated_server_nullrenderer_x64.exe () [File not signed]
FirewallRules: [TCP Query User{93E3829C-321F-4F9F-B221-74B5FE63F672}C:\program files (x86)\steam\steamapps\common\don't starve together\bin64\dontstarve_dedicated_server_nullrenderer_x64.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\don't starve together\bin64\dontstarve_dedicated_server_nullrenderer_x64.exe () [File not signed]
FirewallRules: [{44C4C157-1090-4345-83C8-D472535FF0CE}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe () [File not signed]
FirewallRules: [{5C3D1552-AF24-47E0-83FE-D20061D60CDA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin\dontstarve_steam.exe () [File not signed]
FirewallRules: [{56DD408E-A84B-48E1-8045-9720A3353B4A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin64\dontstarve_steam_x64.exe () [File not signed]
FirewallRules: [{EFEBFE4F-CFCB-42EB-8951-96464B032CA8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Don't Starve Together\bin64\dontstarve_steam_x64.exe () [File not signed]
FirewallRules: [{53D1731A-EE15-49F8-8A69-551D1864A670}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{C1E50A99-A437-46C6-8C15-F7D16BB81013}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{3A5B3175-44C1-4267-BC48-0DA39AA95664}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{AFF7F283-881A-41D0-A874-CA21CA4A4533}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [UDP Query User{9E97D50A-3296-4495-9868-89FC5FA86BAD}C:\users\max\appdata\local\programs\evernote\evernote.exe] => (Block) C:\users\max\appdata\local\programs\evernote\evernote.exe (Evernote Corporation -> Evernote Corporation)
FirewallRules: [TCP Query User{4C362C89-3309-4A5D-A550-23E95E9C4D53}C:\users\max\appdata\local\programs\evernote\evernote.exe] => (Block) C:\users\max\appdata\local\programs\evernote\evernote.exe (Evernote Corporation -> Evernote Corporation)
FirewallRules: [{2FF4D468-A4EA-4D04-A7CA-8DF4EC1A27E7}] => (Allow) C:\Users\Max\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{08618770-2935-44E6-8315-D319617ABB22}] => (Allow) C:\Users\Max\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{DF545393-3BCA-4F78-8B0A-13DE0A079C39}] => (Allow) C:\Users\Max\AppData\Roaming\Zoom\bin\Zoom.exe (Zoom Video Communications, Inc. -> Zoom Video Communications, Inc.)
FirewallRules: [UDP Query User{6C4AF77D-41F2-421C-875E-5B177081E658}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [TCP Query User{14BEA45F-D8F3-4C56-BE24-6C6E7C22D77C}C:\program files\mozilla firefox\firefox.exe] => (Block) C:\program files\mozilla firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{639592F9-5607-414D-A656-42E6D30DBD44}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe (Samsung Electronics CO., LTD. -> )
FirewallRules: [{0E3A3005-30B0-49E8-A100-568D6930B6B6}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\EPM2Migrator.exe (HP Development Company, L.P.) [File not signed]
FirewallRules: [{6D9EA4BC-E5DE-4F03-8438-D3573C123DCF}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\EPM2AlertList.exe (HP Development Company, L.P.) [File not signed]
FirewallRules: [{1AE1BCFE-D98C-4068-B735-CDD6E8E0BC94}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\OrderSupplies.exe (HP Development Company, L.P.) [File not signed]
FirewallRules: [{ECB8DE01-B612-4FAC-89B1-9685A0139A98}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\EasyPrinterManagerV2.exe (HP Development Company, L.P.) [File not signed]
FirewallRules: [{266A8C72-6070-4759-9AD6-548B2E241114}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe (Samsung Electronics CO., LTD. -> )
FirewallRules: [{DC9DFE56-61F8-40DA-ABC5-2077595FA143}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe (Samsung Electronics CO., LTD. -> )
FirewallRules: [{D9C8E11E-196C-41E1-9B62-DFDE3FB5DF4D}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{0A23E61A-2478-43B6-AC3E-516F15A80940}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{274F5EB6-1F4C-4496-A7F9-0B4662B3AFA2}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_22133.500.1346.3200_x64__8wekyb3d8bbwe\msteams.exe => No File
FirewallRules: [{63DE7D38-F718-4AEF-8B14-41D70A905EDE}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_22133.500.1346.3200_x64__8wekyb3d8bbwe\msteams.exe => No File
FirewallRules: [{CD338D2A-D95C-419F-9511-3838A2730791}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_22133.500.1346.3200_x64__8wekyb3d8bbwe\msteams.exe => No File
FirewallRules: [{39C19BA6-DEA5-4807-89C8-0BCDA2107CD4}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_22133.500.1346.3200_x64__8wekyb3d8bbwe\msteams.exe => No File
FirewallRules: [{2BEB9C96-4962-49E8-8ACC-84F10D8D68F4}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_22082.402.1279.2578_x64__8wekyb3d8bbwe\msteams.exe => No File
FirewallRules: [{53397B33-82F4-4FC3-AFB7-83C540C9FC19}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_22082.402.1279.2578_x64__8wekyb3d8bbwe\msteams.exe => No File
FirewallRules: [{4BDB05A1-0D6F-4B95-ADAE-A18F228A6833}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Sims 2 Legacy Collection\EP9\TSBin\Sims2EP9.exe (Electronic Arts, Inc. -> Maxis, a division of Electronic Arts Inc.)
FirewallRules: [{FF5E3240-76AC-4BC0-BA9B-D34AFE02E8F4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Sims 2 Legacy Collection\EP9\TSBin\Sims2EP9.exe (Electronic Arts, Inc. -> Maxis, a division of Electronic Arts Inc.)
FirewallRules: [{4D39D26D-EECD-42B3-BDD0-CAC34A0FEAF0}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_25240.1703.3968.1284_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{D0F2B35B-102A-44A1-916A-EBF44579639B}] => (Allow) C:\Program Files\WindowsApps\MicrosoftTeams_25240.1703.3968.1284_x64__8wekyb3d8bbwe\msteams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{F3D1F410-71D2-44B5-BFF9-00AFFC1E9313}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{E4466015-CA89-4C01-A585-5F69F7478765}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{0D58AFDD-DEC2-48E6-862D-1C6C5C66F524}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe (Valve Corp. -> Valve Corporation)
FirewallRules: [{05A52DD4-C0F3-4D3D-8808-9162AEE63837}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Stronghold\Stronghold.exe () [File not signed]
FirewallRules: [{ADA928EA-4B20-4BFC-8795-F57DE1CCCE0C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Stronghold\Stronghold.exe () [File not signed]
FirewallRules: [{7AD9ABAD-3C32-47BF-B4F6-6D56C5F5AA3E}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Stronghold Crusader Extreme\Stronghold Crusader.exe () [File not signed]
FirewallRules: [{D432DA8A-C4A3-4372-8165-246D0227CA8C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Stronghold Crusader Extreme\Stronghold Crusader.exe () [File not signed]
FirewallRules: [EdgeWebView2-MDNS-In-UDP] => (Allow) C:\WINDOWS\system32\Microsoft-Edge-WebView\msedgewebview2.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [TCP Query User{052867AC-CFA8-4EAB-9467-BCFA6321CC39}C:\users\max\appdata\local\google\chrome\application\chrome.exe] => (Block) C:\users\max\appdata\local\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [UDP Query User{14C102CE-4E18-4C92-BA86-8B5309B58232}C:\users\max\appdata\local\google\chrome\application\chrome.exe] => (Block) C:\users\max\appdata\local\google\chrome\application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{0783D6FD-00B2-4518-82A2-0B5A03D0B551}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2610.35011.0_x64__8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{245B80A7-E3E8-4594-B42C-DDC29EB0D0AE}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2610.35011.0_x64__8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{8ABFDD5E-F1D4-4B0D-865E-EE150FE7F424}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2610.35011.0_x64__8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{B5729036-530F-4755-AF36-0B42BF0C3BCE}] => (Allow) C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_19.2610.35011.0_x64__8wekyb3d8bbwe\M365Copilot.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{9AAA5021-7580-404E-8A75-0712130003FC}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Rollercoaster Tycoon 2\RCT2.EXE () [File not signed]
FirewallRules: [{86E73FFF-7B1D-40ED-8B27-12B509F975AA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Rollercoaster Tycoon 2\RCT2.EXE () [File not signed]
FirewallRules: [{551106B0-6F77-42B3-9591-F3A36ED5C268}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{C1E9E4D0-A6B1-4A43-AA4C-03900EE7BF11}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{CEB94A9A-8DE5-4335-ADCB-CE259EADD355}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{90F84CEB-4309-4F0E-A7F7-15B70DD75BB7}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{2BE3D22B-63F8-41AA-9634-E0440475FB39}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{757CA99F-C035-44DC-B03A-549199C38922}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{3EA5BBDF-A7E0-412D-A732-47D2CA954168}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{B4BF860A-DB94-4133-BE08-BDD06E5EAA91}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{71311F89-98EC-49F1-8115-B1B5B4560B41}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{0D2D6740-1EE1-4F04-85D4-224C24E00F36}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\Spotify.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{78D38DDB-769A-4F6F-9089-FE40E938D4E5}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{3DCA92A1-E26B-4EFD-ADE5-DF1C0A6E8C7A}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe (Spotify AB -> Spotify Ltd)
FirewallRules: [{39019EB4-FCFD-4E2C-82B1-56E976388273}] => (Allow) C:\Program Files\WindowsApps\SpotifyAB.SpotifyMusic_1.306.1921.0_x64__zpdnekdrzrea0\SpotifyLauncher.exe (Spotify AB -> Spotify Ltd)
==================== Restore Points =========================
==================== Faulty Device Manager Devices ============
==================== Event log errors: ========================
Application errors:
==================
Error: (10/23/2026 03:14:51 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 24892. Message ID: [0x2509].
Error: (10/21/2026 09:00:42 PM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-TSSNE97)
Description: Faulting application name: rct2.exe, version: 0.0.0.0, time stamp: 0x3e4c073e
Faulting module name: DDRAW.dll, version: 10.0.26100.8115, time stamp: 0x05d3234b
Exception code: 0xc0000005
Fault offset: 0x0003b717
Faulting process id: 0x3e6c
Faulting application start time: 0x1dd6184ca72e532
Faulting application path: C:\Program Files (x86)\Steam\steamapps\common\Rollercoaster Tycoon 2\rct2.exe
Faulting module path: C:\WINDOWS\SYSTEM32\DDRAW.dll
Report Id: 0b308fea-7898-4680-98ca-eed8c084ad18
Faulting package full name:
Faulting package-relative application ID:
Error: (10/21/2026 03:12:07 PM) (Source: Service1) (EventID: 0) (User: )
Description: Failed to process session change. System.NullReferenceException: Object reference not set to an instance of an object.
at HP.Watcher.WatcherEngine.FireEnrollmentCheckIfPresent()
at hptpsmarthealthservice.hptpsmarthealthservice.OnSessionChange(SessionChangeDescription changeDescription)
at System.ServiceProcess.ServiceBase.DeferredSessionChange(Int32 eventType, Int32 sessionId)
Error: (10/21/2026 01:40:09 PM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-TSSNE97)
Description: Faulting application name: node.exe, version: 24.13.0.0, time stamp: 0x6965436d
Faulting module name: growthsdk.node, version: 0.0.0.0, time stamp: 0x6983f035
Exception code: 0xc0000409
Fault offset: 0x000000000004b9a9
Faulting process id: 0x5bf0
Faulting application start time: 0x1dd614c88e8d53d
Faulting application path: C:\Program Files\Adobe\Adobe Creative Cloud Experience\libs\node.exe
Faulting module path: \\?\C:\Program Files\Adobe\Adobe Creative Cloud Experience\js\node_modules\@growthsdk\growthsdk\public\binaries\win.x64\Release\growthsdk.node
Report Id: f5698502-bcd8-45c2-a202-a7c0dd3ac006
Faulting package full name:
Faulting package-relative application ID:
Error: (10/21/2026 12:35:40 PM) (Source: Service1) (EventID: 0) (User: )
Description: Failed to process session change. System.NullReferenceException: Object reference not set to an instance of an object.
at HP.Watcher.WatcherEngine.FireEnrollmentCheckIfPresent()
at hptpsmarthealthservice.hptpsmarthealthservice.OnSessionChange(SessionChangeDescription changeDescription)
at System.ServiceProcess.ServiceBase.DeferredSessionChange(Int32 eventType, Int32 sessionId)
Error: (10/21/2026 09:35:33 AM) (Source: .NET Runtime) (EventID: 1022) (User: )
Description: .NET Runtime version 4.0.30319.0 - There was a failure initializing profiling API attach infrastructure. This process will not allow a profiler to attach. HRESULT: 0x80004005. Process ID (decimal): 7544. Message ID: [0x2509].
Error: (10/21/2026 01:29:26 AM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-TSSNE97)
Description: Faulting application name: rct2.exe, version: 0.0.0.0, time stamp: 0x3e4c073e
Faulting module name: DDRAW.dll, version: 10.0.26100.8115, time stamp: 0x05d3234b
Exception code: 0xc000041d
Fault offset: 0x0001604e
Faulting process id: 0x677c
Faulting application start time: 0x1dd60d54ad7e2dd
Faulting application path: C:\Program Files (x86)\Steam\steamapps\common\Rollercoaster Tycoon 2\rct2.exe
Faulting module path: C:\WINDOWS\SYSTEM32\DDRAW.dll
Report Id: 60873242-28da-4381-8031-5e2896f5efc4
Faulting package full name:
Faulting package-relative application ID:
Error: (10/21/2026 01:29:19 AM) (Source: Application Error) (EventID: 1000) (User: DESKTOP-TSSNE97)
Description: Faulting application name: rct2.exe, version: 0.0.0.0, time stamp: 0x3e4c073e
Faulting module name: DDRAW.dll, version: 10.0.26100.8115, time stamp: 0x05d3234b
Exception code: 0xc0000005
Fault offset: 0x0001604e
Faulting process id: 0x677c
Faulting application start time: 0x1dd60d54ad7e2dd
Faulting application path: C:\Program Files (x86)\Steam\steamapps\common\Rollercoaster Tycoon 2\rct2.exe
Faulting module path: C:\WINDOWS\SYSTEM32\DDRAW.dll
Report Id: 956711fd-4af4-4c38-be93-3686a2d2d420
Faulting package full name:
Faulting package-relative application ID:
System errors:
=============
Error: (10/23/2026 09:26:01 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-TSSNE97)
Description: The server {B8C1DCAE-5020-4F5D-BA2A-85292744E334} did not register with DCOM within the required timeout.
Error: (10/23/2026 09:25:33 AM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: The server {338B40F9-9D68-4B53-A793-6B9AA0C5F63B} did not register with DCOM within the required timeout.
Error: (10/23/2026 09:24:08 AM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY)
Description: The Secure Boot update failed to update SBAT with error -1878589247. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931
Error: (10/22/2026 11:24:49 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1042) (User: DESKTOP-TSSNE97)
Description: You cannot uninstall language de-DE because the language is the system installed UI language.
Error: (10/22/2026 03:17:06 PM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY)
Description: The Secure Boot update failed to update SBAT with error -1878589247. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931
Error: (10/22/2026 05:20:01 AM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-TSSNE97)
Description: The server {F4DF18B4-A2CF-4B0A-8D62-954CD6AD2E33} did not register with DCOM within the required timeout.
Error: (10/22/2026 05:18:06 AM) (Source: Microsoft-Windows-TPM-WMI) (EventID: 1796) (User: NT AUTHORITY)
Description: The Secure Boot update failed to update SBAT with error -1878589247. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931
Error: (10/21/2026 11:38:32 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1042) (User: DESKTOP-TSSNE97)
Description: You cannot uninstall language de-DE because the language is the system installed UI language.
Error: (10/14/2026 04:30:42 AM) (Source: Microsoft-Windows-FilterManager) (EventID: 3) (User: NT AUTHORITY)
Description: Filter Manager failed to attach to volume '\Device\Harddisk1\DR1'. This volume will be unavailable for filtering until a reboot. The final status was 0xc03a001c.
Windows Defender:
================
TimeCreated : 10/21/2026 9:28:34 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {072CA2F9-2321-4B6F-BD6E-FA36FAE32B3A}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/21/2026 9:06:06 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {30E165D6-75C4-48E8-8300-399B8BB92F15}
Scan Type: Antimalware
Scan Parameters: Full Scan
User: DESKTOP-TSSNE97\Max
Stop Reason: Unknown
TimeCreated : 10/21/2026 7:30:43 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {C53AE4C9-1B82-4B11-A292-41CD5C11BE63}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: RPC connection rundown
TimeCreated : 10/20/2026 8:08:05 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {0E3A951D-F3CD-46EE-B17E-5711A1FD6140}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/18/2026 11:29:55 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {109E7722-F85A-469C-9536-5ECC0F3DD690}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/18/2026 12:59:42 AM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {25345172-C5D5-4F81-8692-64030B2E1A6E}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/16/2026 4:45:41 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {52EF3B45-DE3D-4D7F-A9E7-7ACB25BD2D6D}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
TimeCreated : 10/15/2026 5:06:23 PM
Message : Microsoft Defender Antivirus scan has been stopped before completion.
Scan ID: {6EA414F5-4339-42A8-80BB-37EA431A569F}
Scan Type: Antimalware
Scan Parameters: Quick Scan
User: NT AUTHORITY\SYSTEM
Stop Reason: Scheduled scan was skipped because the last successful scan was within the last 7 days
CodeIntegrity:
===============
Date: 2026-10-23 12:23:09
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\System32\SecurityHealthService.exe) attempted to load \Device\HarddiskVolume3\Program Files\Malwarebytes\Anti-Malware\mbamsi64.dll that did not meet the Windows signing level requirements.
==================== Memory info ===========================
BIOS: HP U97 Ver. 01.19.00 06/11/2026
Motherboard: HP 89C0
Processor: 12th Gen Intel(R) Core(TM) i7-12700H
Percentage of memory in use: 64%
Total physical RAM: 32400.46 MB
Available physical RAM: 11380.68 MB
Total Virtual: 34448.46 MB
Available Virtual: 7247.69 MB
==================== Drives ================================
Disk 0 - Drive c: (Windows ) (Fixed) (Total:952.47 GB) (Free:106.15 GB) (Model: KXG80ZNV1T02 KIOXIA) (Protected) NTFS
Disk 0 - \\?\Volume{75b6a490-21e4-4310-92f3-a52379ddf552}\ () (Fixed) (Total:1.13 GB) (Free:115.14 MB) NTFS
Disk 0 - \\?\Volume{ebc844c4-453a-41b9-984a-abf74f8ce0ad}\ (SYSTEM) (Fixed) (Total:256 MB) (Free:148.17 MB) FAT32
\\?\Volume{c92f4444-f408-11ee-83eb-00a55491e5f5}\ () () (Total:0 bytes) (Free:0 bytes)
==================== MBR & Partition Table ====================
============================================================
Disk: 0 (Size: 953.87 GB) (Disk ID: 2057CB08)
Partitions:
===========
Partition Style : GPT
Partition Count : 4
Disk ID : {8F6E2246-04D5-4C38-80A1-BE5EBD02F3B2}
Usable Offset : 0.02 MB
Usable Length : 953.87 GB
Max Partitions : 128
Partition 1
Type : EFI System Partition
Size : 260 MB
Offset : 1 MB
Type GUID : {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}
Partition GUID : {EBC844C4-453A-41B9-984A-ABF74F8CE0AD}
GPT Name : EFI system partition
Attributes : 0x0000000000000000
Attribute Flags : None
Hidden : Yes
Platform Required: No
------------------------------------------------------------
Partition 2
Type : Microsoft Reserved (MSR)
Size : 16 MB
Offset : 261 MB
Type GUID : {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}
Partition GUID : {0996B926-9638-4D99-B012-130299591DB2}
GPT Name : Microsoft reserved partition
Attributes : 0x0000000000000000
Attribute Flags : None
Hidden : Yes
Platform Required: No
------------------------------------------------------------
Partition 3
Type : Basic Data Partition
Size : 952.47 GB
Offset : 277 MB
Type GUID : {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}
Partition GUID : {8A2DC34A-71B5-4F7B-9D34-05659B50FA83}
GPT Name : Basic data partition
Attributes : 0x0000000000000000
Attribute Flags : None
Hidden : No
Platform Required: No
------------------------------------------------------------
Partition 4
Type : Windows Recovery
Size : 1.13 GB
Offset : 975604 MB
Type GUID : {DE94BBA4-06D1-4D40-A16A-BFD50179D6AC}
Partition GUID : {75B6A490-21E4-4310-92F3-A52379DDF552}
Attributes : 0x8000000000000001
Attribute Flags : Platform Required, No Default Drive Letter
Hidden : Yes
Platform Required: Yes
------------------------------------------------------------
============================================================
==================== End of Addition.txt =======================
Und hier Malwarebytes: Code:
ATTFilter Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 10/21/2026
Scan Time: 9:53 PM
Log File: 13f88f56-cd89-11f1-88e9-7c4d8fa5f158.json
-Software Information-
Version: 5.7.3.376
Components Version: 167.0.5780
Update Package Version: 1.0.116015
License: Trial
-System Information-
OS: Windows 11 (Build 26200.9711)
CPU: x64
File System: NTFS
User: DESKTOP-TSSNE97\Max
-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 281,429
Threats Detected: 0
Threats Quarantined: 0
Scan Duration: 6 min, 44 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
File system: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 0
(No malicious items detected)
Registry Value: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
File: 0
(No malicious items detected)
Physical Sector: 0
(No malicious items detected)
WMI: 0
(No malicious items detected)
(end)
Geändert von Maxi92 (Gestern um 14:52 Uhr) |
|
Gestern, 18:58
| #3 |
| /// TB-Ausbilder   | Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme Mein Name ist Matthias und ich werde dir bei der Analyse und Bereinigung deines Systems helfen. Es gibt Infostealer, die sich nach dem Ausspähen der Daten selbst löschen und dann nichts mehr auf dem System zu finden ist. In den Logs gibt es ein paar ungewöhnliche / auffällige Einträge, um die wir uns kümmern sollten. Aktive Malware sehe ich aber nicht (mehr). Wir starten mit einem FRST-Fix und einem Scan mit ESET. Vorab wichtige Hinweise: Wir führen eine Reparatur mit FRST durch. Dabei werden schädliche und verwaiste Einträge entfernt sowie temporären Dateien und der Papierkorb geleert. Außerdem werden die Systemdateien auf Fehler überprüft. Bitte gedulde dich, sobald du die Reparatur gestartet hast. Je nach Art und Umfang der notwendigen Reparaturen kann dies einige Minuten dauern. Eventuell erhältst du während der Reparatur auch die Information "keine Rückmeldung" von FRST. Das ist normal, du musst nichts weiter tun, nur abwarten... ggf. mit etwas anderem beschäftigen.  Schritt 1 - Reparatur mit FRST HINWEIS AN ALLE MITLESER: Dieses FRST-Skript ist ausschließlich für diesen Nutzer gedacht und sollte niemals 1:1 für ein anderes System verwendet werden!
Schritt 2 - Scan mit EOS Führe ESET Online Scanner (EOS) gemäß der bebilderten Anleitung aus und poste abschließend die Logdatei.
__________________ |
|
| Themen zu Verdacht auf Malware trotz unauffälliger Scans – Google-Sicherheitswarnung und Firefox-Probleme |
| administrator, adobe, browser, defender, downloader, homepage, infiziert, internet, malware, mozilla, neustart, nvidia, pdf, performance, realtek, registry, rundll, security, server, services.exe, svchost.exe, system, usb, windows, wlan |
Linear-Darstellung
