TR/AD.FireHooker.BU

Start::
C:\Users\torst\AppData\Roaming\23023
HKU\S-1-5-21-4033890031-1030331758-904151539-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com/?pc=COS2&ptag=D061720-AB5E7204335A1488EBDF&form=CONMHP&conlogo=CT3331977
SearchScopes: HKU\S-1-5-21-4033890031-1030331758-904151539-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COS2&ptag=D061720-N0700AB5E7204335A1488EBDF&form=CONBDF&conlogo=CT3331977&q={searchTerms}
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-4033890031-1030331758-904151539-1001\...\webcompanion.com -> hxxp://webcompanion.com
C:\WINDOWS\Installer\{276A8E0F-7CB7-4E6B-BCFF-85F1F4D432CB}
Task: {0EC8FB9A-90EE-42A8-92CD-83BDA43F6AC8} - System32\Tasks\ApplicationCompatibilityauf => C:\Program Files (x86)\nodejs\node.exe -> C:\WINDOWS\Installer\{276A8E0F-7CB7-4E6B-BCFF-85F1F4D432CB}\{4DE91BE9-BB56-469C-AFBF-70D5615531E8} <==== ACHTUNG
HKU\S-1-5-21-4033890031-1030331758-904151539-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize 
C:\Program Files (x86)\Lavasoft
GroupPolicy: Beschränkung - Chrome <==== ACHTUNG
HKLM\SOFTWARE\Policies\Google: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Edge: Beschränkung <==== ACHTUNG
FF user.js: detected! => C:\Users\torst\AppData\Roaming\Mozilla\Firefox\Profiles\okjd3vff.default\user.js [2020-06-17]
FF NewTab: Mozilla\Firefox\Profiles\okjd3vff.default -> hxxps://defaultsearch.co/homepage?hp=1&pId=AC191101&iDate=2020-06-17 04:45:52&bName=&bitmask=0600
FF Extension: (Avira Browserschutz) - C:\Users\torst\AppData\Roaming\Mozilla\Firefox\Profiles\okjd3vff.default\Extensions\abs@avira.com.xpi [2020-05-28]
FF user.js: detected! => C:\Users\torst\AppData\Roaming\Mozilla\Firefox\Profiles\1g9bnzyi.default-release\user.js [2020-11-01]
FF Extension: (Avira Browserschutz) - C:\Users\torst\AppData\Roaming\Mozilla\Firefox\Profiles\1g9bnzyi.default-release\Extensions\abs@avira.com.xpi [2020-10-25]
FF HKLM\...\Firefox\Extensions: [{697CC154-77AB-4BF2-9EA1-7623569D7468}] - C:\WINDOWS\Installer\{86D41F81-8E10-4A29-B0CC-0B3803CFE4DC}\{697CC154-77AB-4BF2-9EA1-7623569D7468}.xpi
FF Extension: ( ) - C:\WINDOWS\Installer\{86D41F81-8E10-4A29-B0CC-0B3803CFE4DC}\{697CC154-77AB-4BF2-9EA1-7623569D7468}.xpi [2020-11-01]
FF HKLM-x32\...\Firefox\Extensions: [{697CC154-77AB-4BF2-9EA1-7623569D7468}] - C:\WINDOWS\Installer\{86D41F81-8E10-4A29-B0CC-0B3803CFE4DC}\{697CC154-77AB-4BF2-9EA1-7623569D7468}.xpi
C:\WINDOWS\Installer\{86D41F81-8E10-4A29-B0CC-0B3803CFE4DC}
S4 edgeupdate; "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc [X]
S4 edgeupdatem; "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /medsvc [X]
C:\WINDOWS\system32\Tasks\Avira
C:\ProgramData\ntuser.pol
C:\Program Files (x86)\Avira
C:\ProgramData\Avira
C:\Users\AllUserName\AppData\Local\Google\Chrome
DeleteKey: HKLM\SOFTWARE\Google\Chrome
DeleteKey: HKLM\SOFTWARE\WOW6432Node\Google\Chrome
DeleteKey: HKCU\SOFTWARE\Google\Chrome
StartBatch:
FOR /D %%a IN ("%WINDIR%\Installer\{????????-????-????-????-????????????}") DO ( IF EXIST "%%a\{????????-????-????-????-????????????}.xpi" RD /S /Q "%%a" )

FOR /D %%a IN ("%WINDIR%\Installer\{????????-????-????-????-????????????}") DO ( IF EXIST "%%a\c????????????????????????????????rx" RD /S /Q "%%a" )

FOR /D %%a IN ("%WINDIR%\Installer\{????????-????-????-????-????????????}") DO ( IF EXIST "%%a\x????????????????????????????????ml" RD /S /Q "%%a" )

FOR /D %%a IN ("%WINDIR%\Installer\{????????-????-????-????-????????????}") DO ( IF EXIST "%%a\{????????-????-????-????-????????????}" echo "%%a" )

FOR /D %%a IN ("%ProgramData%\Package Cache\{????????-????-????-????-????????????}") DO ( IF EXIST "%%a\{????????-????-????-????-????????????}" echo "%%a" )
EndBatch: 
powershell: Set-MpPreference -PUAProtection Enabled
Reboot:
End::