craccoon.exe die Zweite ;)

s-m-n

Hi. Nachdem ich gebeten wurde, ein neues Thema zu eröffnen, mache ich das hiermit

Nochmal kurz der Link zum alten Thread, falls die alten Logfiles nochmal eingesehen werden sollen:

https://www.trojaner-board.de/201587-craccoon-exe-reicht-deinstallieren-systemsteuerung.html

Jetzt hab ich wie damals verordnet die Tools laufen lassen und die Logfiles hier:

MBAM:

Malwarebytes
www.malwarebytes.com

-Protokolldetails-
Scan-Datum: 09.10.21
Scan-Zeit: 14:28
Protokolldatei: 66fa8da8-28fc-11ec-8d86-bcaec5aba78c.json

-Softwaredaten-
Version: 4.4.8.137
Komponentenversion: 1.0.1474
Version des Aktualisierungspakets: 1.0.45688
Lizenz: Testversion

-Systemdaten-
Betriebssystem: Windows 10 (Build 19042.1237)
CPU: x64
Dateisystem: NTFS
Benutzer: DESKTOP-2EDVOIV\Alois

-Scan-Übersicht-
Scan-Typ: Bedrohungs-Scan
Scan gestartet von: Manuell
Ergebnis: Abgeschlossen
Gescannte Objekte: 382693
Erkannte Bedrohungen: 22
In die Quarantäne verschobene Bedrohungen: 22
Abgelaufene Zeit: 9 Min., 56 Sek.

-Scan-Optionen-
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Erkennung
PUM: Erkennung

-Scan-Details-
Prozess: 0
(keine bösartigen Elemente erkannt)

Modul: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 4
PUP.Optional.Conduit, HKU\S-1-5-21-3759013183-129454559-1519138159-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, In Quarantäne, 193, 236865, , , , , ,
PUP.Optional.Conduit, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, In Quarantäne, 193, 236865, , , , , ,
PUP.Optional.Conduit, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, In Quarantäne, 193, 236865, , , , , ,
PUP.Optional.Conduit, HKU\S-1-5-21-3759013183-129454559-1519138159-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}, In Quarantäne, 193, 236865, 1.0.45688, , ame, , ,

Registrierungswert: 2
PUP.Optional.Conduit, HKU\S-1-5-21-3759013183-129454559-1519138159-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, In Quarantäne, 193, 236865, 1.0.45688, , ame, , ,
PUP.Optional.Conduit, HKU\S-1-5-21-3759013183-129454559-1519138159-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|TOPRESULTURL, In Quarantäne, 193, 236865, 1.0.45688, , ame, , ,

Registrierungsdaten: 1
PUP.Optional.Conduit, HKU\S-1-5-21-3759013183-129454559-1519138159-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Ersetzt, 193, 293058, 1.0.45688, , ame, , ,

Daten-Stream: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Datei: 15
PUP.Optional.Conduit, C:\USERS\ALOIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\N4S34K3J.DEFAULT-RELEASE\PREFS.JS, Ersetzt, 193, 301520, 1.0.45688, , ame, , 44334343D012D92D995CC1CCEBEA3509, F474FB78736D32D7590EA24DA3F847FD99ECA9B41DF829650D5EAFF2D9518411
PUP.Optional.Conduit, C:\USERS\ALOIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZCH9GUHR.DEFAULT\PREFS.JS, Ersetzt, 193, 301520, 1.0.45688, , ame, , 254C9407551F94DABBD724047EF4C648, EDE28A1CE88C0065CF912B811C64C3EA8E900F0327D15D019FF7D2C24E342443
Adware.Downloader, J:\USERS\ALOIS\DOWNLOADS\EMPC_SETUP_CB-DL-MANAGER.EXE, In Quarantäne, 525, 494758, 1.0.45688, , ame, , 8D40871C72325B3F1E4AD0CBF8D5C6FF, F70490E8711093506CF92242820DA307740E11974A8F5F333D69738876491D12
PUP.Optional.DownloadGuide, J:\USERS\ALOIS\DOWNLOADS\FREEAUDIOCONVERTER_CB-DL-MANAGER.EXE, In Quarantäne, 2242, 100902, 1.0.45688, , ame, , B694D200BF4003BD56C402D6997299C1, 8A7D711AA4653F05003BCB889C53396325A7A921FD8A59F0EAC29DFDF8D94306
Malware.AI.4055822758, J:\USERS\ALOIS\DOWNLOADS\FREEMP4VIDEOCONVERTER.EXE, In Quarantäne, 1000000, 0, 1.0.45688, B8E3827953134872F1BEF1A6, dds, 01457944, 4498BBA125A200EC53D387443F0715F9, 19015F5044572195E3D96B551BFFF064D5DBE9CC5C27544641E56448ECB1C00A
PUP.Optional.ChipDe, J:\USERS\ALOIS\DOWNLOADS\FREE MUSIC VIDEO DOWNLOADER - CHIP-INSTALLER.EXE, In Quarantäne, 636, 562568, 1.0.45688, , ame, , 30E1494B71D15AA7DC74F444A2987062, 7CF743FFAB841DDA255716BB6A6EA23B07C2E1B3C956097044089D0E3A1D6A10
PUP.Optional.ChipDe, J:\USERS\ALOIS\DOWNLOADS\REAPER DEUTSCHE SPRACHDATEI - CHIP-INSTALLER.EXE, In Quarantäne, 636, 562568, 1.0.45688, , ame, , 27CAAF411B32354CF9B02B78E3A1891F, 96B6E67BB66662EA4EEECA3C4C1B52B6325061BDCEAC0023D82AE8837CEF46E2
PUP.Optional.AdvancedSystemRepair, J:\USERS\ALOIS\DOWNLOADS\ASR_BLUE_INSTALLER_M7_DE.EXE, In Quarantäne, 561, 708572, 1.0.45688, , ame, , 0E6F530CB858F367A95A5B2124EF74B8, 309CAE924EA70140DA44C284358565864660882FF8B09433571D666C41ECD595
PUP.Optional.ChipDe, J:\USERS\ALOIS\DOWNLOADS\HAMSTER FREE AUDIO CONVERTER - CHIP-INSTALLER.EXE, In Quarantäne, 636, 562568, 1.0.45688, , ame, , 6D2BBCB0055A14BF8F2541EF061A88E7, 6424D900629E5C89F4EF25361CEC6AB5EDB30DFBA870C68D601DC548536A978B
PUP.Optional.ChipDe, J:\USERS\ALOIS\DOWNLOADS\AUDACITY - CHIP-INSTALLER(1).EXE, In Quarantäne, 636, 562568, 1.0.45688, , ame, , 031B9B22178311022D867C479A755F75, E8A7AABE2258289211F17953E3A1BAA7DA8AED94207436BD73619356137E3499
PUP.Optional.ChipDe, J:\USERS\ALOIS\DOWNLOADS\MAGIX VIDEO DELUXE 2020 - CHIP-INSTALLER.EXE, In Quarantäne, 636, 562568, 1.0.45688, , ame, , 5F715ED2AA1BD6E2D7CEE9015415A888, 4F102EF346EA7ADFB08D6DB00DBB013B978991356F21FAD9B43A8AD6C0E51375
PUP.Optional.DownloadGuide, J:\USERS\ALOIS\DOWNLOADS\VEREIN_CB-DL-MANAGER.EXE, In Quarantäne, 2242, 100902, 1.0.45688, , ame, , 7E0226ABE829E11EA5DC3568CA4A9738, 0E5103F100AA712C2773D2AFF4B4635639647400F24E8E91621620CBE70F8747
PUP.Optional.ChipDe, J:\USERS\ALOIS\DOWNLOADS\PICASA - CHIP-INSTALLER.EXE, In Quarantäne, 636, 562568, 1.0.45688, , ame, , D6B0A9A94C906AAD7B06C370C61DEC51, 9F7C3F95AC54872DB59F1B10495AFC4C4880F6A573AD57D079901829D867633A
PUP.Optional.ChipDe, J:\USERS\ALOIS\DOWNLOADS\AUDACITY - CHIP-INSTALLER.EXE, In Quarantäne, 636, 621518, 1.0.45688, , ame, , 9BA333F83BFDC62D9C6BC59DFF6975D9, 615BDEC5BF192669778D09C2F3A9B629740A9EFF0E9996E90594E457FADE8C22
PUP.Optional.ChipDe, J:\USERS\ALOIS\DOWNLOADS\ACDSEE - CHIP-INSTALLER.EXE, In Quarantäne, 636, 562568, 1.0.45688, , ame, , D58C8F390574E120120907593C129052, E1912C4A1B0751DCFF4A507DEF5979019086DBBBE88771C80EA0F38030C99F52

Physischer Sektor: 0
(keine bösartigen Elemente erkannt)

WMI: 0
(keine bösartigen Elemente erkannt)


(end)

AdwCleaner:

# -------------------------------
# Malwarebytes AdwCleaner 8.3.0.0
# -------------------------------
# Build: 06-29-2021
# Database: 2021-10-08.3 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 10-09-2021
# Duration: 00:00:01
# OS: Windows 10 Home
# Cleaned: 17
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted C:\ProgramData\Application Data\Lavasoft\Web Companion

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKCU\SOFTWARE\Mozilla\NativeMessagingHosts\com.webcompanion.native
Deleted HKCU\Software\Lavasoft\Web Companion
Deleted HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com
Deleted HKLM\Software\Classes\TypeLib\{A520B992-6390-4231-9C89-F06B3587AB80}
Deleted HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\craccoon.ch
Deleted HKLM\Software\Wow6432Node\Lavasoft\Web Companion
Deleted HKLM\Software\Wow6432Node\\Classes\CLSID\{8BF0126F-A5B7-4720-ABB2-2414A0AF5474}
Deleted HKLM\Software\Wow6432Node\\Classes\TypeLib\{A520B992-6390-4231-9C89-F06B3587AB80}
Deleted HKLM\Software\Wow6432Node\\Microsoft\Windows\CurrentVersion\Uninstall\craccoon.ch
Deleted HKU\.DEFAULT\Software\Mozilla\NativeMessagingHosts\com.webcompanion.native
Deleted HKU\S-1-5-18\SOFTWARE\Mozilla\NativeMessagingHosts\com.webcompanion.native
Deleted HKU\S-1-5-21-3759013183-129454559-1519138159-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\reviversoft.com
Deleted HKU\S-1-5-21-3759013183-129454559-1519138159-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.reviversoft.com
Deleted HKU\S-1-5-21-3759013183-129454559-1519138159-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\reviversoft.com
Deleted HKU\S-1-5-21-3759013183-129454559-1519138159-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.reviversoft.com
Deleted HKU\S-1-5-21-3759013183-129454559-1519138159-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\webcompanion.com

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [3860 octets] - [09/10/2021 14:47:34]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########


FRST Search.txt:

Farbar Recovery Scan Tool (x64) Version: 09-10-2021
durchgeführt von Alois (09-10-2021 14:49:58)
Gestartet von D:\Alois
Start-Modus: Normal

================== Datei-Suche: "SearchAll: craccoon" =============

Datei:
========

Ordner:
========

Registry:
========


====== Ende von Suche ======


Es sind wohl etliche Chip-Installer und ähnliche Rotze ausgeführt worden, dass man das nicht machen soll werde ich meinem Onkel noch erzählen

Danke schonmal für die Hilfe!

MfG