Windows10: Mögliche Infektion mit Gootkit 3

Entfernungsergebnis von Farbar Recovery Scan Tool (x64) Version: 28-02-2021
durchgeführt von Denise (12-03-2021 11:57:29) Run:1
Gestartet von E:\Users\Denise\Downloads
Geladene Profile: Denise
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
CloseProcesses:
AV: ZoneAlarm Extreme Security Antivirus (Disabled - Up to date) {1947BAEA-75D2-7D68-8F78-84241FBC7C90}
AV: ZoneAlarm Extreme Security Antivirus (Disabled - Up to date) {0683CCA9-024E-F5E0-0687-81040471DC5A}
AS: ZoneAlarm Extreme Security Anti-Spyware (Enabled - Up to date) {BDE22D4D-2474-FA6E-3C37-BA767FF696E7}
FW: ZoneAlarm Extreme Security Firewall (Disabled) {217C3BCF-3FBD-7C30-A427-2D11E16F3BEB}
FW: ZoneAlarm Extreme Security Firewall (Disabled) {3EB84D8C-4821-F4B8-2DD8-2831FAA29B21}
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Google: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Edge: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Beschränkung <==== ACHTUNG
HKLM-x32\...\Run: [ZaAntiRansomware] => "C:\Program Files (x86)\CheckPoint\Endpoint Security\TPCommon\Cipolla\ZAAR.exe"
C:\Program Files (x86)\CheckPoint
cmd: reg query "HKCU\Environment"
cmd: reg query "HKCU\Software"
cmd: netsh advfirewall reset
emptytemp:

*****************

Prozesse erfolgreich geschlossen.
"AV: ZoneAlarm Extreme Security Antivirus (Disabled - Up to date) {1947BAEA-75D2-7D68-8F78-84241FBC7C90}" => erfolgreich entfernt
"AV: ZoneAlarm Extreme Security Antivirus (Disabled - Up to date) {0683CCA9-024E-F5E0-0687-81040471DC5A}" => erfolgreich entfernt
"AS: ZoneAlarm Extreme Security Anti-Spyware (Enabled - Up to date) {BDE22D4D-2474-FA6E-3C37-BA767FF696E7}" => erfolgreich entfernt
"FW: ZoneAlarm Extreme Security Firewall (Disabled) {217C3BCF-3FBD-7C30-A427-2D11E16F3BEB}" => erfolgreich entfernt
"FW: ZoneAlarm Extreme Security Firewall (Disabled) {3EB84D8C-4821-F4B8-2DD8-2831FAA29B21}" => erfolgreich entfernt
HKLM\SOFTWARE\Policies\Mozilla => erfolgreich entfernt
HKLM\SOFTWARE\Policies\Google => erfolgreich entfernt
HKLM\SOFTWARE\Policies\Microsoft\Edge => erfolgreich entfernt
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer => erfolgreich entfernt
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ZaAntiRansomware" => erfolgreich entfernt
"C:\Program Files (x86)\CheckPoint" => nicht gefunden

========= reg query "HKCU\Environment" =========


HKEY_CURRENT_USER\Environment
    Path    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Microsoft\WindowsApps;
    TEMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp
    TMP    REG_EXPAND_SZ    %USERPROFILE%\AppData\Local\Temp
    OneDrive    REG_EXPAND_SZ    C:\Users\Denise\OneDrive
    MOZ_PLUGIN_PATH    REG_SZ    D:\Utilities\PDFXChangeViewer\PDF Viewer\Win32
    OneDriveConsumer    REG_EXPAND_SZ    C:\Users\Denise\OneDrive


========= Ende von CMD: =========


========= reg query "HKCU\Software" =========


HKEY_CURRENT_USER\Software\AppDataLow
HKEY_CURRENT_USER\Software\AvastAdSDK
HKEY_CURRENT_USER\Software\CheckPoint
HKEY_CURRENT_USER\Software\Chromium
HKEY_CURRENT_USER\Software\Clients
HKEY_CURRENT_USER\Software\Fortinet
HKEY_CURRENT_USER\Software\Google
HKEY_CURRENT_USER\Software\Hewlett-Packard
HKEY_CURRENT_USER\Software\HP
HKEY_CURRENT_USER\Software\IM Providers
HKEY_CURRENT_USER\Software\Intel
HKEY_CURRENT_USER\Software\JavaSoft
HKEY_CURRENT_USER\Software\LogiShrd
HKEY_CURRENT_USER\Software\Macromedia
HKEY_CURRENT_USER\Software\Malwarebytes
HKEY_CURRENT_USER\Software\Microsoft
HKEY_CURRENT_USER\Software\Mozilla
HKEY_CURRENT_USER\Software\MozillaPlugins
HKEY_CURRENT_USER\Software\Netscape
HKEY_CURRENT_USER\Software\NVIDIA Corporation
HKEY_CURRENT_USER\Software\OCS
HKEY_CURRENT_USER\Software\ODBC
HKEY_CURRENT_USER\Software\OpenVPN-GUI
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software\QtProject
HKEY_CURRENT_USER\Software\RegisteredApplications
HKEY_CURRENT_USER\Software\SMART Technologies
HKEY_CURRENT_USER\Software\SMART Technologies Inc.
HKEY_CURRENT_USER\Software\Swiss Academic Software
HKEY_CURRENT_USER\Software\Synaptics
HKEY_CURRENT_USER\Software\SyncEngines
HKEY_CURRENT_USER\Software\Tracker Software
HKEY_CURRENT_USER\Software\Wow6432Node
HKEY_CURRENT_USER\Software\ZoomUMX
HKEY_CURRENT_USER\Software\Classes

========= Ende von CMD: =========


========= netsh advfirewall reset =========

OK.


========= Ende von CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 10510336 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 63588052 B
Java, Flash, Steam htmlcache => 1174 B
Windows/system/drivers => 32320830 B
Edge => 0 B
Chrome => 197940310 B
Firefox => 928980198 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 5552 B
systemprofile32 => 5552 B
LocalService => 189166 B
NetworkService => 202460 B
Denise => 449704111 B

RecycleBin => 0 B
EmptyTemp: => 1.6 GB temporäre Dateien entfernt.

================================


Das System musste neu gestartet werden.

==== Ende von Fixlog 11:59:01 ====