| |
| |||||||
Log-Analyse und Auswertung: Virenbefall - IExplorer öffnet viele FensterWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
16.12.2013, 10:47
| #1 |
 |  Virenbefall - IExplorer öffnet viele Fenster Hilfe! Irgendein bösartiges Virus hat meinen Rechner zerschossen. Erste Symptome: der Internet Explorer hat rund 30 Fenster auf einmal geöffnet (alle leer). Computer neu gestartet, Virenscan im abgesicherten Modus (nichts gefunden), seitdem fährt er nicht mehr normal hoch, sondern immer automatisch in den abgesicherten Modus, auch wenn man "Computer normal starten" wählt Malewarebytes hat zuerst nichts gefunden (beim dritten Scan 8 Fehler), Norton NPE auch nicht, das eigene Virenprogramm (McAffee) ist inaktiv aus ungeklärten Gründen. Mit "Computer reparieren" passiert nichts, er meldet, es gäbe kein Problem. PC auf früheren Zeitpunkt zurückgesetzt, hilft auch nicht. Was kann man da nur tun? Betriebssystem ist Windows 7 Hier sind die Logfiles: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-12-2013 02
Ran by Jo (administrator) on JO-PC on 16-12-2013 09:14:31
Running from C:\Users\Jo\Downloads\Neuer Ordner (4)
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Safe Mode (with Networking)
==================== Processes (Whitelisted) =================
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2894640 2012-03-14] (ELAN Microelectronics Corp.)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\quickset.exe [5729648 2012-02-07] (Dell Inc.)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SA3\SACpl.exe [1654400 2012-02-21] (Conexant Systems, Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()
HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKCU\...\Run: [CAHeadless] - C:\Program Files (x86)\Adobe\Elements 11 Organizer\CAHeadless\ElementsAutoAnalyzer.exe [840784 2012-09-23] (Adobe Systems Incorporated)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_8_800_168_Plugin.exe -update plugin [815496 2013-09-22] (Adobe Systems Incorporated)
MountPoints2: E - E:\AutoRun.exe
MountPoints2: {37222be9-2c23-11e2-9ea0-c01885bf04c2} - E:\AutoRun.exe
MountPoints2: {37222bfb-2c23-11e2-9ea0-c01885bf04c2} - E:\AutoRun.exe
MountPoints2: {45f4149a-2dc4-11e2-b4cd-001e101f8ed0} - E:\AutoRun.exe
MountPoints2: {f05a6bfa-2f6b-11e2-8c45-001e101f8ed0} - G:\AutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-03-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-26] (Dell, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35768 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\mcafee.com\agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.)
HKLM-x32\...\Run: [ROC_roc_ssl_v12] - "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe [3477640 2012-09-23] (Adobe Systems Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
Lsa: [Notification Packages] scecli c:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jo\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 1000 J110 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 1000 J110 series.lnk -> C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=32A0C01885BF04C1&affID=119657&tt=280813_dt&tsp=4988
SearchScopes: HKCU - {56088F36-6E1A-4F1B-AD54-BC7F1B8402F4} URL = hxxp://www.bing.com/search?q={searchTerms}&r=111
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\mcafee\systemcore\ScriptSn.20121109001455.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\mcafee\SystemCore\ScriptSn.20121109001456.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 217.68.161.141 217.68.161.171
Tcpip\..\Interfaces\{7C4FCED6-3348-4FD6-8308-7F34A883E75A}: [NameServer]193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{E7A70ECF-B651-4A33-80EC-977D3078D1A4}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{FD2796C3-BD5C-4DCF-8824-DD57864E1757}: [NameServer]193.189.244.206 193.189.244.225
FireFox:
========
FF ProfilePath: C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default
FF user.js: detected! => C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\ich@maltegoetz.de
FF Extension: Zotero Word for Windows Integration - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\zoteroWinWordIntegration@zotero.org
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
FF Extension: IE Tab - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
FF Extension: DownloadHelper - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: zotero - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\zotero@chnm.gmu.edu.xpi
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: No Name - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK
==================== Services (Whitelisted) =================
S2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-23] (Adobe Systems Incorporated)
S2 CxUtilSvc; C:\Program Files\Conexant\SA3\CxUtilSvc.exe [109184 2012-05-18] (Conexant Systems, Inc.)
S2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [229376 2010-08-19] ()
S3 McAWFwk; C:\Program Files\mcafee\msc\McAWFwk.exe [224704 2011-03-08] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 SystemStoreService; C:\Program Files (x86)\SoftwareUpdater\SystemStore.exe [296448 2013-06-03] ()
S2 0321031381771398mcinstcleanup; C:\Windows\TEMP\032103~1.EXE -cleanup -nolog [x]
==================== Drivers (Whitelisted) ====================
R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31872 2012-02-01] (Advanced Micro Devices, Inc.)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-03-22] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-03-22] (RapidSolution Software AG)
S3 YMIDUSBW; C:\Windows\System32\drivers\ymidusbx64.sys [51016 2011-11-01] (Yamaha Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-16 09:14 - 2013-12-16 09:14 - 00000000 ____D C:\FRST
2013-12-16 09:08 - 2013-12-16 09:08 - 00000000 _____ C:\Users\Jo\defogger_reenable
2013-12-15 23:02 - 2013-12-15 23:02 - 00003288 ____N C:\bootsqm.dat
2013-12-15 16:28 - 2013-12-15 21:33 - 00000000 ____D C:\ProgramData\Norton
2013-12-15 16:28 - 2013-12-15 21:25 - 00000000 ____D C:\Users\Jo\AppData\Local\NPE
2013-12-12 20:02 - 2013-12-12 20:02 - 00032575 _____ C:\Users\Jo\Downloads\measurement.jar
2013-12-06 13:16 - 2013-12-06 13:17 - 30694824 _____ (Oracle Corporation) C:\Users\Jo\Downloads\jre-7u45-windows-x64.exe
2013-12-03 17:04 - 2013-12-16 09:14 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (4)
2013-12-03 17:04 - 2013-12-15 21:33 - 00000000 ____D C:\Users\Jo\Downloads\H2O
2013-11-28 22:06 - 2013-11-28 22:06 - 00000000 ____D C:\Users\Jo\AppData\Local\{C38BF032-CAA7-4652-86A6-32B649DFC0E3}
2013-11-28 21:59 - 2013-11-28 21:59 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (3)
2013-11-21 12:49 - 2013-11-21 13:05 - 00000000 ____D C:\Users\Jo\Downloads\Adobe Acrobat XI Pro
2013-11-21 12:46 - 2013-11-21 12:46 - 00003647 _____ C:\Users\Jo\AppData\Local\recently-used.xbel
2013-11-21 12:43 - 2013-12-15 20:48 - 00000000 ____D C:\Users\Jo\AppData\Roaming\inkscape
2013-11-21 12:38 - 2013-12-15 23:46 - 00000000 ____D C:\Program Files (x86)\Inkscape
2013-11-20 14:42 - 2013-11-20 14:45 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Canon
2013-11-20 14:42 - 2013-11-20 14:42 - 00000000 _____ C:\Users\Jo\Sti_Trace.log
2013-11-20 14:39 - 2013-12-15 23:44 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst6411011ade
2013-11-20 14:39 - 2013-11-20 14:39 - 00000000 ___HD C:\CanoScan
2013-11-20 14:27 - 2013-11-20 14:27 - 00000000 ____D C:\Program Files (x86)\Canon
2013-11-20 14:26 - 2013-11-20 14:26 - 00000000 ____D C:\Users\Jo\Downloads\Canon
2013-11-20 14:25 - 2013-12-15 23:44 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst11012de
2013-11-17 11:17 - 2013-12-13 12:23 - 00000000 ____D C:\Users\Jo\Desktop\GW
==================== One Month Modified Files and Folders =======
2013-12-16 09:14 - 2013-12-16 09:14 - 00000000 ____D C:\FRST
2013-12-16 09:14 - 2013-12-03 17:04 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (4)
2013-12-16 09:08 - 2013-12-16 09:08 - 00000000 _____ C:\Users\Jo\defogger_reenable
2013-12-16 09:08 - 2012-11-08 14:28 - 00000000 ____D C:\Users\Jo
2013-12-16 07:36 - 2010-11-21 07:50 - 00696824 _____ C:\Windows\system32\perfh007.dat
2013-12-16 07:36 - 2010-11-21 07:50 - 00148088 _____ C:\Windows\system32\perfc007.dat
2013-12-16 07:36 - 2009-07-14 06:13 - 01612288 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-15 23:49 - 2010-11-21 08:00 - 00000000 ____D C:\Program Files\Windows Journal
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 __RSD C:\Windows\Media
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Cursors
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Services
2013-12-15 23:48 - 2013-09-23 18:38 - 00000000 ____D C:\Users\Jo\Desktop\gmic_gimp_win64
2013-12-15 23:48 - 2013-09-22 19:06 - 00000000 ____D C:\ProgramData\Ashampoo
2013-12-15 23:48 - 2013-08-23 20:55 - 00000000 ____D C:\Users\Jo\AppData\Local\com.zipeg
2013-12-15 23:48 - 2013-07-27 17:19 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-12-15 23:48 - 2013-06-25 09:23 - 00000000 ____D C:\Users\Jo\Downloads\CEP
2013-12-15 23:48 - 2013-06-03 21:53 - 00000000 ____D C:\Users\Jo\AppData\Local\DownloadGuide
2013-12-15 23:48 - 2013-05-27 18:13 - 00000000 ____D C:\Users\Jo\AppData\Roaming\vlc
2013-12-15 23:48 - 2013-04-06 23:59 - 00000000 ____D C:\Users\Jo\Documents\StreamTransport
2013-12-15 23:48 - 2013-04-06 22:05 - 00000000 ____D C:\ProgramData\RapidSolution
2013-12-15 23:48 - 2013-02-09 17:06 - 00000000 ____D C:\Users\Jo\Downloads\Max5_48561
2013-12-15 23:48 - 2013-01-16 11:31 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Thunderbird
2013-12-15 23:48 - 2012-12-18 20:17 - 00000000 ____D C:\Windows\pss
2013-12-15 23:48 - 2012-12-18 17:32 - 00000000 ___RD C:\Users\Jo\Dropbox
2013-12-15 23:48 - 2012-11-11 18:17 - 00000000 ____D C:\ProgramData\DatacardService
2013-12-15 23:48 - 2012-11-09 12:16 - 00000000 ____D C:\Users\Jo\.rednotebook
2013-12-15 23:48 - 2012-11-08 21:45 - 00000000 ____D C:\Users\Jo\AppData\Roaming\MusicBee
2013-12-15 23:48 - 2012-11-08 14:45 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2013-12-15 23:48 - 2012-11-08 14:43 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-15 23:48 - 2012-11-08 14:35 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-15 23:48 - 2012-11-08 14:35 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-15 23:48 - 2012-11-08 14:28 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:48 - 2012-11-08 14:28 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:48 - 2012-08-24 16:03 - 00000000 ____D C:\ProgramData\McAfee
2013-12-15 23:48 - 2012-08-24 16:00 - 00000000 ____D C:\Windows\de
2013-12-15 23:48 - 2012-08-24 15:41 - 00000000 ____D C:\ProgramData\WildTangent
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-12-15 23:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help
2013-12-15 23:47 - 2013-10-02 14:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-15 23:47 - 2013-09-22 18:31 - 00000000 ____D C:\Program Files\Luminance HDR
2013-12-15 23:47 - 2013-09-18 15:08 - 00000000 ____D C:\Program Files (x86)\Zotero Standalone
2013-12-15 23:47 - 2013-09-01 21:14 - 00000000 ____D C:\Program Files (x86)\Calibre2
2013-12-15 23:47 - 2013-08-17 16:32 - 00000000 ____D C:\Program Files\CCleaner
2013-12-15 23:47 - 2013-08-17 09:55 - 00000000 ____D C:\Program Files (x86)\Scrivener
2013-12-15 23:47 - 2013-07-27 17:19 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-12-15 23:47 - 2013-06-03 21:57 - 00000000 ____D C:\Program Files (x86)\SoftwareUpdater
2013-12-15 23:47 - 2013-04-30 21:11 - 00000000 ____D C:\Program Files (x86)\Audacity
2013-12-15 23:47 - 2013-04-30 21:06 - 00000000 ____D C:\Program Files (x86)\MIDI to WAV Converter
2013-12-15 23:47 - 2013-04-06 23:57 - 00000000 ____D C:\Program Files (x86)\StreamTransport
2013-12-15 23:47 - 2013-03-27 23:20 - 00000000 ____D C:\Program Files\GIMP 2
2013-12-15 23:47 - 2013-03-02 02:24 - 00000000 ____D C:\Program Files (x86)\MusikLabor
2013-12-15 23:47 - 2013-02-19 14:13 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-12-15 23:47 - 2013-02-09 19:23 - 00000000 ____D C:\Program Files (x86)\Direct MIDI to MP3 Converter
2013-12-15 23:47 - 2013-02-08 23:01 - 00000000 ____D C:\Program Files (x86)\Tinypic
2013-12-15 23:47 - 2013-01-16 11:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-12-15 23:47 - 2012-12-02 03:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-15 23:47 - 2012-11-20 14:06 - 00000000 ____D C:\Program Files (x86)\EasyGPS
2013-12-15 23:47 - 2012-11-14 20:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-15 23:47 - 2012-11-11 18:18 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-12-15 23:47 - 2012-11-09 12:20 - 00000000 ____D C:\Program Files (x86)\Celtx
2013-12-15 23:47 - 2012-11-09 12:16 - 00000000 ____D C:\Program Files (x86)\RedNotebook
2013-12-15 23:47 - 2012-11-09 11:43 - 00000000 ____D C:\Program Files (x86)\Q10
2013-12-15 23:47 - 2012-11-08 22:02 - 00000000 ____D C:\Program Files (x86)\Free M4a to MP3 Converter
2013-12-15 23:47 - 2012-11-08 21:45 - 00000000 ____D C:\Program Files (x86)\MusicBee
2013-12-15 23:47 - 2012-08-24 17:02 - 00000000 ____D C:\Program Files\Elantech
2013-12-15 23:47 - 2012-08-24 16:05 - 00000000 ____D C:\Program Files (x86)\Zinio Reader 4
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files\mcafee
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files\Common Files\mcafee
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files (x86)\mcafee.com
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-12-15 23:47 - 2012-08-24 16:01 - 00000000 ____D C:\Program Files\Dell Support Center
2013-12-15 23:47 - 2012-08-24 15:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-12-15 23:47 - 2012-08-24 15:51 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-12-15 23:47 - 2012-08-24 15:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-15 23:47 - 2012-08-24 15:45 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-12-15 23:46 - 2013-11-21 12:38 - 00000000 ____D C:\Program Files (x86)\Inkscape
2013-12-15 23:46 - 2012-11-08 15:47 - 00000000 ____D C:\Program Files (x86)\Adobe Download Assistant
2013-12-15 23:46 - 2011-02-11 18:12 - 00000000 ____D C:\dell
2013-12-15 23:45 - 2013-10-22 22:21 - 00000000 ____D C:\Program Files (x86)\Notepad++
2013-12-15 23:44 - 2013-11-20 14:39 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst6411011ade
2013-12-15 23:44 - 2013-11-20 14:25 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst11012de
2013-12-15 23:44 - 2013-10-20 21:40 - 00000000 ____D C:\Users\Jo\Desktop\MediathekView_3.3.0
2013-12-15 23:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-15 23:32 - 2012-11-08 18:38 - 00000000 ____D C:\Users\Jo\Jo
2013-12-15 23:30 - 2013-08-23 20:55 - 00000000 ____D C:\Users\Jo\AppData\Local\Zipeg
2013-12-15 23:30 - 2012-12-18 17:30 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Dropbox
2013-12-15 23:30 - 2012-11-08 14:31 - 00000000 ____D C:\Users\Jo\AppData\Local\VirtualStore
2013-12-15 23:20 - 2012-11-20 16:18 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-15 23:20 - 2012-08-24 15:30 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-15 23:12 - 2012-11-08 14:42 - 00000000 __RHD C:\MSOCache
2013-12-15 23:02 - 2013-12-15 23:02 - 00003288 ____N C:\bootsqm.dat
2013-12-15 21:33 - 2013-12-15 16:28 - 00000000 ____D C:\ProgramData\Norton
2013-12-15 21:33 - 2013-12-03 17:04 - 00000000 ____D C:\Users\Jo\Downloads\H2O
2013-12-15 21:33 - 2010-11-21 08:00 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-12-15 21:25 - 2013-12-15 16:28 - 00000000 ____D C:\Users\Jo\AppData\Local\NPE
2013-12-15 20:48 - 2013-11-21 12:43 - 00000000 ____D C:\Users\Jo\AppData\Roaming\inkscape
2013-12-15 20:48 - 2013-02-19 14:13 - 00000000 ____D C:\Users\Jo\AppData\Roaming\FileZilla
2013-12-15 15:42 - 2012-08-24 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-12-15 15:42 - 2012-08-24 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-12-15 02:00 - 2012-11-08 15:46 - 00000000 ____D C:\Users\Jo\AppData\Local\Adobe
2013-12-15 01:14 - 2013-10-20 22:01 - 00000000 ____D C:\Users\Jo\MediathekView
2013-12-13 12:23 - 2013-11-17 11:17 - 00000000 ____D C:\Users\Jo\Desktop\GW
2013-12-12 20:02 - 2013-12-12 20:02 - 00032575 _____ C:\Users\Jo\Downloads\measurement.jar
2013-12-06 13:17 - 2013-12-06 13:16 - 30694824 _____ (Oracle Corporation) C:\Users\Jo\Downloads\jre-7u45-windows-x64.exe
2013-12-03 11:16 - 2013-01-16 11:31 - 00000000 ____D C:\Users\Jo\AppData\Local\Thunderbird
2013-11-28 22:15 - 2013-06-25 09:23 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (2)
2013-11-28 22:06 - 2013-11-28 22:06 - 00000000 ____D C:\Users\Jo\AppData\Local\{C38BF032-CAA7-4652-86A6-32B649DFC0E3}
2013-11-28 21:59 - 2013-11-28 21:59 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (3)
2013-11-21 13:05 - 2013-11-21 12:49 - 00000000 ____D C:\Users\Jo\Downloads\Adobe Acrobat XI Pro
2013-11-21 12:46 - 2013-11-21 12:46 - 00003647 _____ C:\Users\Jo\AppData\Local\recently-used.xbel
2013-11-21 12:46 - 2013-03-27 23:39 - 00000000 ____D C:\Users\Jo\.gimp-2.8
2013-11-20 14:45 - 2013-11-20 14:42 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Canon
2013-11-20 14:42 - 2013-11-20 14:42 - 00000000 _____ C:\Users\Jo\Sti_Trace.log
2013-11-20 14:39 - 2013-11-20 14:39 - 00000000 ___HD C:\CanoScan
2013-11-20 14:27 - 2013-11-20 14:27 - 00000000 ____D C:\Program Files (x86)\Canon
2013-11-20 14:26 - 2013-11-20 14:26 - 00000000 ____D C:\Users\Jo\Downloads\Canon
2013-11-17 00:50 - 2012-11-08 16:04 - 00000000 ____D C:\Users\Jo\Documents\OneNote-Notizbücher
Some content of TEMP:
====================
C:\Users\Jo\AppData\Local\Temp\uninst1.exe
C:\Users\Jo\AppData\Local\Temp\vcredist_x86.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
safeboot: ==> The system is configured to boot to Safe Mode <===== ATTENTION!
LastRegBack: 2013-12-12 17:36
==================== End Of Log ============================
--- --- --- FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-12-2013 02
Ran by Jo (administrator) on JO-PC on 16-12-2013 09:14:31
Running from C:\Users\Jo\Downloads\Neuer Ordner (4)
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Safe Mode (with Networking)
==================== Processes (Whitelisted) =================
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2894640 2012-03-14] (ELAN Microelectronics Corp.)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\quickset.exe [5729648 2012-02-07] (Dell Inc.)
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SA3\SACpl.exe [1654400 2012-02-21] (Conexant Systems, Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()
HKLM\...\Run: [Stage Remote] - C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2022976 2011-06-28] ()
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKCU\...\Run: [CAHeadless] - C:\Program Files (x86)\Adobe\Elements 11 Organizer\CAHeadless\ElementsAutoAnalyzer.exe [840784 2012-09-23] (Adobe Systems Incorporated)
HKCU\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_8_800_168_Plugin.exe -update plugin [815496 2013-09-22] (Adobe Systems Incorporated)
MountPoints2: E - E:\AutoRun.exe
MountPoints2: {37222be9-2c23-11e2-9ea0-c01885bf04c2} - E:\AutoRun.exe
MountPoints2: {37222bfb-2c23-11e2-9ea0-c01885bf04c2} - E:\AutoRun.exe
MountPoints2: {45f4149a-2dc4-11e2-b4cd-001e101f8ed0} - E:\AutoRun.exe
MountPoints2: {f05a6bfa-2f6b-11e2-8c45-001e101f8ed0} - G:\AutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-03-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-26] (Dell, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe [35768 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\mcafee.com\agent\mcagent.exe [1532992 2013-03-13] (McAfee, Inc.)
HKLM-x32\...\Run: [ROC_roc_ssl_v12] - "C:\Program Files (x86)\AVG Secure Search\ROC_roc_ssl_v12.exe" / /PROMPT /CMPID=roc_ssl_v12
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\acrotray.exe [3477640 2012-09-23] (Adobe Systems Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [49208 2011-10-28] (Hewlett-Packard)
Lsa: [Notification Packages] scecli c:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jo\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 1000 J110 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 1000 J110 series.lnk -> C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=32A0C01885BF04C1&affID=119657&tt=280813_dt&tsp=4988
SearchScopes: HKCU - {56088F36-6E1A-4F1B-AD54-BC7F1B8402F4} URL = hxxp://www.bing.com/search?q={searchTerms}&r=111
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\mcafee\systemcore\ScriptSn.20121109001455.dll (McAfee, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\mcafee\SystemCore\ScriptSn.20121109001456.dll (McAfee, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 217.68.161.141 217.68.161.171
Tcpip\..\Interfaces\{7C4FCED6-3348-4FD6-8308-7F34A883E75A}: [NameServer]193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{E7A70ECF-B651-4A33-80EC-977D3078D1A4}: [NameServer]193.189.244.225 193.189.244.206
Tcpip\..\Interfaces\{FD2796C3-BD5C-4DCF-8824-DD57864E1757}: [NameServer]193.189.244.206 193.189.244.225
FireFox:
========
FF ProfilePath: C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default
FF user.js: detected! => C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101753.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Gesperrte YouTube Videos entsperren - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\ich@maltegoetz.de
FF Extension: Zotero Word for Windows Integration - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\zoteroWinWordIntegration@zotero.org
FF Extension: IE Tab 2 (FF 3.6+) - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
FF Extension: IE Tab - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
FF Extension: DownloadHelper - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: zotero - C:\Users\Jo\AppData\Roaming\Mozilla\Firefox\Profiles\00w20ajh.default\Extensions\zotero@chnm.gmu.edu.xpi
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: No Name - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK
==================== Services (Whitelisted) =================
S2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-23] (Adobe Systems Incorporated)
S2 CxUtilSvc; C:\Program Files\Conexant\SA3\CxUtilSvc.exe [109184 2012-05-18] (Conexant Systems, Inc.)
S2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [229376 2010-08-19] ()
S3 McAWFwk; C:\Program Files\mcafee\msc\McAWFwk.exe [224704 2011-03-08] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 SystemStoreService; C:\Program Files (x86)\SoftwareUpdater\SystemStore.exe [296448 2013-06-03] ()
S2 0321031381771398mcinstcleanup; C:\Windows\TEMP\032103~1.EXE -cleanup -nolog [x]
==================== Drivers (Whitelisted) ====================
R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31872 2012-02-01] (Advanced Micro Devices, Inc.)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [134696 2012-02-02] (Broadcom Corporation.)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-03-22] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-03-22] (RapidSolution Software AG)
S3 YMIDUSBW; C:\Windows\System32\drivers\ymidusbx64.sys [51016 2011-11-01] (Yamaha Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-12-16 09:14 - 2013-12-16 09:14 - 00000000 ____D C:\FRST
2013-12-16 09:08 - 2013-12-16 09:08 - 00000000 _____ C:\Users\Jo\defogger_reenable
2013-12-15 23:02 - 2013-12-15 23:02 - 00003288 ____N C:\bootsqm.dat
2013-12-15 16:28 - 2013-12-15 21:33 - 00000000 ____D C:\ProgramData\Norton
2013-12-15 16:28 - 2013-12-15 21:25 - 00000000 ____D C:\Users\Jo\AppData\Local\NPE
2013-12-12 20:02 - 2013-12-12 20:02 - 00032575 _____ C:\Users\Jo\Downloads\measurement.jar
2013-12-06 13:16 - 2013-12-06 13:17 - 30694824 _____ (Oracle Corporation) C:\Users\Jo\Downloads\jre-7u45-windows-x64.exe
2013-12-03 17:04 - 2013-12-16 09:14 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (4)
2013-12-03 17:04 - 2013-12-15 21:33 - 00000000 ____D C:\Users\Jo\Downloads\H2O
2013-11-28 22:06 - 2013-11-28 22:06 - 00000000 ____D C:\Users\Jo\AppData\Local\{C38BF032-CAA7-4652-86A6-32B649DFC0E3}
2013-11-28 21:59 - 2013-11-28 21:59 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (3)
2013-11-21 12:49 - 2013-11-21 13:05 - 00000000 ____D C:\Users\Jo\Downloads\Adobe Acrobat XI Pro
2013-11-21 12:46 - 2013-11-21 12:46 - 00003647 _____ C:\Users\Jo\AppData\Local\recently-used.xbel
2013-11-21 12:43 - 2013-12-15 20:48 - 00000000 ____D C:\Users\Jo\AppData\Roaming\inkscape
2013-11-21 12:38 - 2013-12-15 23:46 - 00000000 ____D C:\Program Files (x86)\Inkscape
2013-11-20 14:42 - 2013-11-20 14:45 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Canon
2013-11-20 14:42 - 2013-11-20 14:42 - 00000000 _____ C:\Users\Jo\Sti_Trace.log
2013-11-20 14:39 - 2013-12-15 23:44 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst6411011ade
2013-11-20 14:39 - 2013-11-20 14:39 - 00000000 ___HD C:\CanoScan
2013-11-20 14:27 - 2013-11-20 14:27 - 00000000 ____D C:\Program Files (x86)\Canon
2013-11-20 14:26 - 2013-11-20 14:26 - 00000000 ____D C:\Users\Jo\Downloads\Canon
2013-11-20 14:25 - 2013-12-15 23:44 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst11012de
2013-11-17 11:17 - 2013-12-13 12:23 - 00000000 ____D C:\Users\Jo\Desktop\GW
==================== One Month Modified Files and Folders =======
2013-12-16 09:14 - 2013-12-16 09:14 - 00000000 ____D C:\FRST
2013-12-16 09:14 - 2013-12-03 17:04 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (4)
2013-12-16 09:08 - 2013-12-16 09:08 - 00000000 _____ C:\Users\Jo\defogger_reenable
2013-12-16 09:08 - 2012-11-08 14:28 - 00000000 ____D C:\Users\Jo
2013-12-16 07:36 - 2010-11-21 07:50 - 00696824 _____ C:\Windows\system32\perfh007.dat
2013-12-16 07:36 - 2010-11-21 07:50 - 00148088 _____ C:\Windows\system32\perfc007.dat
2013-12-16 07:36 - 2009-07-14 06:13 - 01612288 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-15 23:49 - 2010-11-21 08:00 - 00000000 ____D C:\Program Files\Windows Journal
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2013-12-15 23:49 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 __RSD C:\Windows\Media
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Cursors
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-12-15 23:49 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Services
2013-12-15 23:48 - 2013-09-23 18:38 - 00000000 ____D C:\Users\Jo\Desktop\gmic_gimp_win64
2013-12-15 23:48 - 2013-09-22 19:06 - 00000000 ____D C:\ProgramData\Ashampoo
2013-12-15 23:48 - 2013-08-23 20:55 - 00000000 ____D C:\Users\Jo\AppData\Local\com.zipeg
2013-12-15 23:48 - 2013-07-27 17:19 - 00000000 ____D C:\ProgramData\HP Photo Creations
2013-12-15 23:48 - 2013-06-25 09:23 - 00000000 ____D C:\Users\Jo\Downloads\CEP
2013-12-15 23:48 - 2013-06-03 21:53 - 00000000 ____D C:\Users\Jo\AppData\Local\DownloadGuide
2013-12-15 23:48 - 2013-05-27 18:13 - 00000000 ____D C:\Users\Jo\AppData\Roaming\vlc
2013-12-15 23:48 - 2013-04-06 23:59 - 00000000 ____D C:\Users\Jo\Documents\StreamTransport
2013-12-15 23:48 - 2013-04-06 22:05 - 00000000 ____D C:\ProgramData\RapidSolution
2013-12-15 23:48 - 2013-02-09 17:06 - 00000000 ____D C:\Users\Jo\Downloads\Max5_48561
2013-12-15 23:48 - 2013-01-16 11:31 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Thunderbird
2013-12-15 23:48 - 2012-12-18 20:17 - 00000000 ____D C:\Windows\pss
2013-12-15 23:48 - 2012-12-18 17:32 - 00000000 ___RD C:\Users\Jo\Dropbox
2013-12-15 23:48 - 2012-11-11 18:17 - 00000000 ____D C:\ProgramData\DatacardService
2013-12-15 23:48 - 2012-11-09 12:16 - 00000000 ____D C:\Users\Jo\.rednotebook
2013-12-15 23:48 - 2012-11-08 21:45 - 00000000 ____D C:\Users\Jo\AppData\Roaming\MusicBee
2013-12-15 23:48 - 2012-11-08 14:45 - 00000000 ____D C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform
2013-12-15 23:48 - 2012-11-08 14:43 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-15 23:48 - 2012-11-08 14:35 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-12-15 23:48 - 2012-11-08 14:35 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-12-15 23:48 - 2012-11-08 14:28 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-12-15 23:48 - 2012-11-08 14:28 - 00000000 ___RD C:\Users\Jo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-12-15 23:48 - 2012-08-24 16:03 - 00000000 ____D C:\ProgramData\McAfee
2013-12-15 23:48 - 2012-08-24 16:00 - 00000000 ____D C:\Windows\de
2013-12-15 23:48 - 2012-08-24 15:41 - 00000000 ____D C:\ProgramData\WildTangent
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-12-15 23:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-12-15 23:48 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME
2013-12-15 23:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help
2013-12-15 23:47 - 2013-10-02 14:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-15 23:47 - 2013-09-22 18:31 - 00000000 ____D C:\Program Files\Luminance HDR
2013-12-15 23:47 - 2013-09-18 15:08 - 00000000 ____D C:\Program Files (x86)\Zotero Standalone
2013-12-15 23:47 - 2013-09-01 21:14 - 00000000 ____D C:\Program Files (x86)\Calibre2
2013-12-15 23:47 - 2013-08-17 16:32 - 00000000 ____D C:\Program Files\CCleaner
2013-12-15 23:47 - 2013-08-17 09:55 - 00000000 ____D C:\Program Files (x86)\Scrivener
2013-12-15 23:47 - 2013-07-27 17:19 - 00000000 ____D C:\Program Files (x86)\HP Photo Creations
2013-12-15 23:47 - 2013-06-03 21:57 - 00000000 ____D C:\Program Files (x86)\SoftwareUpdater
2013-12-15 23:47 - 2013-04-30 21:11 - 00000000 ____D C:\Program Files (x86)\Audacity
2013-12-15 23:47 - 2013-04-30 21:06 - 00000000 ____D C:\Program Files (x86)\MIDI to WAV Converter
2013-12-15 23:47 - 2013-04-06 23:57 - 00000000 ____D C:\Program Files (x86)\StreamTransport
2013-12-15 23:47 - 2013-03-27 23:20 - 00000000 ____D C:\Program Files\GIMP 2
2013-12-15 23:47 - 2013-03-02 02:24 - 00000000 ____D C:\Program Files (x86)\MusikLabor
2013-12-15 23:47 - 2013-02-19 14:13 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-12-15 23:47 - 2013-02-09 19:23 - 00000000 ____D C:\Program Files (x86)\Direct MIDI to MP3 Converter
2013-12-15 23:47 - 2013-02-08 23:01 - 00000000 ____D C:\Program Files (x86)\Tinypic
2013-12-15 23:47 - 2013-01-16 11:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-12-15 23:47 - 2012-12-02 03:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-15 23:47 - 2012-11-20 14:06 - 00000000 ____D C:\Program Files (x86)\EasyGPS
2013-12-15 23:47 - 2012-11-14 20:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-12-15 23:47 - 2012-11-11 18:18 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-12-15 23:47 - 2012-11-09 12:20 - 00000000 ____D C:\Program Files (x86)\Celtx
2013-12-15 23:47 - 2012-11-09 12:16 - 00000000 ____D C:\Program Files (x86)\RedNotebook
2013-12-15 23:47 - 2012-11-09 11:43 - 00000000 ____D C:\Program Files (x86)\Q10
2013-12-15 23:47 - 2012-11-08 22:02 - 00000000 ____D C:\Program Files (x86)\Free M4a to MP3 Converter
2013-12-15 23:47 - 2012-11-08 21:45 - 00000000 ____D C:\Program Files (x86)\MusicBee
2013-12-15 23:47 - 2012-08-24 17:02 - 00000000 ____D C:\Program Files\Elantech
2013-12-15 23:47 - 2012-08-24 16:05 - 00000000 ____D C:\Program Files (x86)\Zinio Reader 4
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files\mcafee
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files\Common Files\mcafee
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files (x86)\mcafee.com
2013-12-15 23:47 - 2012-08-24 16:03 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-12-15 23:47 - 2012-08-24 16:01 - 00000000 ____D C:\Program Files\Dell Support Center
2013-12-15 23:47 - 2012-08-24 15:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-12-15 23:47 - 2012-08-24 15:51 - 00000000 ____D C:\Program Files (x86)\Dell Digital Delivery
2013-12-15 23:47 - 2012-08-24 15:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-15 23:47 - 2012-08-24 15:45 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-12-15 23:46 - 2013-11-21 12:38 - 00000000 ____D C:\Program Files (x86)\Inkscape
2013-12-15 23:46 - 2012-11-08 15:47 - 00000000 ____D C:\Program Files (x86)\Adobe Download Assistant
2013-12-15 23:46 - 2011-02-11 18:12 - 00000000 ____D C:\dell
2013-12-15 23:45 - 2013-10-22 22:21 - 00000000 ____D C:\Program Files (x86)\Notepad++
2013-12-15 23:44 - 2013-11-20 14:39 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst6411011ade
2013-12-15 23:44 - 2013-11-20 14:25 - 00000000 ____D C:\Users\Jo\Downloads\lide25vst11012de
2013-12-15 23:44 - 2013-10-20 21:40 - 00000000 ____D C:\Users\Jo\Desktop\MediathekView_3.3.0
2013-12-15 23:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2013-12-15 23:32 - 2012-11-08 18:38 - 00000000 ____D C:\Users\Jo\Jo
2013-12-15 23:30 - 2013-08-23 20:55 - 00000000 ____D C:\Users\Jo\AppData\Local\Zipeg
2013-12-15 23:30 - 2012-12-18 17:30 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Dropbox
2013-12-15 23:30 - 2012-11-08 14:31 - 00000000 ____D C:\Users\Jo\AppData\Local\VirtualStore
2013-12-15 23:20 - 2012-11-20 16:18 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-15 23:20 - 2012-08-24 15:30 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-15 23:12 - 2012-11-08 14:42 - 00000000 __RHD C:\MSOCache
2013-12-15 23:02 - 2013-12-15 23:02 - 00003288 ____N C:\bootsqm.dat
2013-12-15 21:33 - 2013-12-15 16:28 - 00000000 ____D C:\ProgramData\Norton
2013-12-15 21:33 - 2013-12-03 17:04 - 00000000 ____D C:\Users\Jo\Downloads\H2O
2013-12-15 21:33 - 2010-11-21 08:00 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-12-15 21:25 - 2013-12-15 16:28 - 00000000 ____D C:\Users\Jo\AppData\Local\NPE
2013-12-15 20:48 - 2013-11-21 12:43 - 00000000 ____D C:\Users\Jo\AppData\Roaming\inkscape
2013-12-15 20:48 - 2013-02-19 14:13 - 00000000 ____D C:\Users\Jo\AppData\Roaming\FileZilla
2013-12-15 15:42 - 2012-08-24 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-12-15 15:42 - 2012-08-24 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-12-15 02:00 - 2012-11-08 15:46 - 00000000 ____D C:\Users\Jo\AppData\Local\Adobe
2013-12-15 01:14 - 2013-10-20 22:01 - 00000000 ____D C:\Users\Jo\MediathekView
2013-12-13 12:23 - 2013-11-17 11:17 - 00000000 ____D C:\Users\Jo\Desktop\GW
2013-12-12 20:02 - 2013-12-12 20:02 - 00032575 _____ C:\Users\Jo\Downloads\measurement.jar
2013-12-06 13:17 - 2013-12-06 13:16 - 30694824 _____ (Oracle Corporation) C:\Users\Jo\Downloads\jre-7u45-windows-x64.exe
2013-12-03 11:16 - 2013-01-16 11:31 - 00000000 ____D C:\Users\Jo\AppData\Local\Thunderbird
2013-11-28 22:15 - 2013-06-25 09:23 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (2)
2013-11-28 22:06 - 2013-11-28 22:06 - 00000000 ____D C:\Users\Jo\AppData\Local\{C38BF032-CAA7-4652-86A6-32B649DFC0E3}
2013-11-28 21:59 - 2013-11-28 21:59 - 00000000 ____D C:\Users\Jo\Downloads\Neuer Ordner (3)
2013-11-21 13:05 - 2013-11-21 12:49 - 00000000 ____D C:\Users\Jo\Downloads\Adobe Acrobat XI Pro
2013-11-21 12:46 - 2013-11-21 12:46 - 00003647 _____ C:\Users\Jo\AppData\Local\recently-used.xbel
2013-11-21 12:46 - 2013-03-27 23:39 - 00000000 ____D C:\Users\Jo\.gimp-2.8
2013-11-20 14:45 - 2013-11-20 14:42 - 00000000 ____D C:\Users\Jo\AppData\Roaming\Canon
2013-11-20 14:42 - 2013-11-20 14:42 - 00000000 _____ C:\Users\Jo\Sti_Trace.log
2013-11-20 14:39 - 2013-11-20 14:39 - 00000000 ___HD C:\CanoScan
2013-11-20 14:27 - 2013-11-20 14:27 - 00000000 ____D C:\Program Files (x86)\Canon
2013-11-20 14:26 - 2013-11-20 14:26 - 00000000 ____D C:\Users\Jo\Downloads\Canon
2013-11-17 00:50 - 2012-11-08 16:04 - 00000000 ____D C:\Users\Jo\Documents\OneNote-Notizbücher
Some content of TEMP:
====================
C:\Users\Jo\AppData\Local\Temp\uninst1.exe
C:\Users\Jo\AppData\Local\Temp\vcredist_x86.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
safeboot: ==> The system is configured to boot to Safe Mode <===== ATTENTION!
LastRegBack: 2013-12-12 17:36
==================== End Of Log ============================
--- --- --- GMER: GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - GMER - Rootkit Detector and Remover
Rootkit scan 2013-12-16 09:28:08
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST1000LM rev.2AR2 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Jo\AppData\Local\Temp\pxldypoc.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c01885bf04c2
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c01885bf04c2 (not active ControlSet)
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3452E92A-952E-66F9-38D0-65DE1388D65E}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3452E92A-952E-66F9-38D0-65DE1388D65E}@ialachfhdkajdklegp 0x6B 0x61 0x69 0x6A ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3452E92A-952E-66F9-38D0-65DE1388D65E}@habbmanckkgomoba 0x6B 0x61 0x66 0x6B ...
---- EOF - GMER 2.1 ----
Malewarebytes: Malwarebytes Anti-Malware 1.75.0.1300 Malwarebytes : Free Anti-Malware download Datenbank Version: v2013.12.16.04 Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 9.0.8112.16421 Jo :: JO-PC [limitiert] 16.12.2013 09:30:35 MBAM-log-2013-12-16 (09-38-55).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 208173 Laufzeit: 3 Minute(n), 29 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 2 C:\Users\Jo\AppData\Local\DownloadGuide (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt. C:\Users\Jo\AppData\Local\DownloadGuide\Offers (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt. Infizierte Dateien: 6 C:\Users\Jo\AppData\Local\DownloadGuide\amazon.ico (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt. C:\Users\Jo\AppData\Local\DownloadGuide\TubeBoxSetup.exe (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt. C:\Users\Jo\AppData\Local\DownloadGuide\Offers\addlyrics.exe (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt. C:\Users\Jo\AppData\Local\DownloadGuide\Offers\foxydeal.exe (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt. C:\Users\Jo\AppData\Local\DownloadGuide\Offers\onlinecasino.exe (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt. C:\Users\Jo\AppData\Local\DownloadGuide\Offers\pinphotozoom.exe (PUP.Optional.DownloadGuide.A) -> Keine Aktion durchgeführt. (Ende) |
| Themen zu Virenbefall - IExplorer öffnet viele Fenster |
| abgesicherten, aktiv, automatisch, befall, browser ruft eigentständig internetseiten auf, explorer, fehler, iexplorer, internet, internet explorer, leer, mehrere fenster, modus, msn deutschland, neu, nicht mehr, nichts, norton, plug-in, programm, rechner, reparieren, scan, secure search, starten, vcredist, virenscan, virus, windows, windows 7, öffnet |
Baum-Darstellung