Programm versucht automatisch Chrome Extension zu installieren (web safety)

Start::
SystemRestore: On 
CreateRestorePoint:
CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Beschränkung <==== ACHTUNG
HKU\S-1-5-21-3349990796-3301203750-1932007998-1001\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\appyt\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" (Keine Datei)
HKU\S-1-5-21-3349990796-3301203750-1932007998-1001\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\appyt\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (Keine Datei)
HKU\S-1-5-21-3349990796-3301203750-1932007998-1001\...\RunOnce: [Uninstall 22.217.1016.0002] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\appyt\AppData\Local\Microsoft\OneDrive\22.217.1016.0002" (Keine Datei)
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] -> 
Policies: C:\ProgramData\NTUSER.pol: Beschränkung <==== ACHTUNG
HKLM\SOFTWARE\Policies\Microsoft\Edge: Beschränkung <==== ACHTUNG
CHR HKLM-x32\...\Chrome\Extension: [mfhcmdonhekjhfbjmeacdjbhlfgpjabp]
S3 WinRing0_1_2_0; \??\C:\Users\appyt\AppData\Local\Temp\tmpC372.tmp [X] <==== ACHTUNG
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]

C:\Program Files (x86)\Lavasoft
C:\ProgramData\Application Data\Lavasoft
C:\ProgramData\Lavasoft
C:\Users\AllUserName\AppData\Local\Lavasoft
C:\Users\AllUserName\AppData\Roaming\Lavasoft
DeleteKey: HKCU\Software\Lavasoft
DeleteKey: HKLM\Software\Wow6432Node\Lavasoft

C:\ProgramData\ntuser.pol
C:\WINDOWS\system32\GroupPolicy\Machine
C:\WINDOWS\system32\GroupPolicy\GPT.ini
C:\WINDOWS\SysWOW64\GroupPolicy\Machine
C:\WINDOWS\SysWOW64\GroupPolicy\GPT.ini
DeleteKey: HKLM\SOFTWARE\Policies\Google
DeleteKey: HKLM\SOFTWARE\Policies\Mozilla
DeleteKey: HKLM\SOFTWARE\Policies\Microsoft\Edge
DeleteKey: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender
C:\Users\AllUserName\AppData\Roaming\npm
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js
C:\Program Files (x86)\nodejs
DeleteKey: HKLM\SOFTWARE\Node.js
DeleteKey: HKLM\SOFTWARE\WOW6432Node\Node.js
DeleteKey: HKLM\SOFTWARE\Classes\Installer\Products\4D45993E1218CF443A3DFD6652D48B19
DeleteKey: HKLM\SOFTWARE\Classes\Installer\Products\27AC50E0DD8DF2342ACC8800434A5877
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4D45993E1218CF443A3DFD6652D48B19
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\27AC50E0DD8DF2342ACC8800434A5877
DeleteKey: HKU\.DEFAULT\Software\Node.js
DeleteKey: HKCU\SOFTWARE\Node.js
DeleteKey: HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E39954D4-8121-44FC-A3D3-DF66254DB891}
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{77754e9b-264b-4d8d-b981-e4135c1ecb0c}
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\_V2Providers\{793c9b44-3d6b-4f57-b5d7-4ff80adcf9a2}
DeleteKey: HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Perflib\_V2Providers\{793c9b44-3d6b-4f57-b5d7-4ff80adcf9a2}
CMD: dir "%windir%\installer\*.xpi" /S
CMD: dir "%windir%\installer\c*rx" /S
CMD: dir "%windir%\installer\x*ml" /S
CMD: dir "%windir%\installer\{*-*-*-*-*}" /S
CMD: dir "%ProgramData%\Package Cache\{*-*-*-*-*}" /S

startpowershell:
Function Remove-all-windefend-excludes {
$Paths=(Get-MpPreference).ExclusionPath
$Extensions=(Get-MpPreference).ExclusionExtension
$Processes=(Get-MpPreference).ExclusionProcess
foreach ($Path in $Paths) { Remove-MpPreference -ExclusionPath $Path -force}
foreach ($Extension in $Extensions) { Remove-MpPreference -ExclusionExtension $Extension -force}
foreach ($Process in $Processes) { Remove-MpPreference -ExclusionProcess $Process -force}
}
Set-MpPreference -DisableAutoExclusions $true -Force
Remove-all-windefend-excludes
endpowershell:
CMD: netsh winsock reset
CMD: netsh int ip reset
CMD: ipconfig /flushdns
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: netsh winhttp reset proxy
CMD: Bitsadmin /Reset /Allusers
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: "%WINDIR%\SYSTEM32\lodctr.exe" /R
CMD: "%WINDIR%\SysWOW64\lodctr.exe" /R
CMD: slmgr /dli
Hosts:
RemoveProxy:
EmptyTemp:
End::