CryptoApp.exe - .encrypted Files auf Desktop und persönlichen Ordner

oriepl · 12.11.2014, 21:01

Anscheinend hat wer über VNC zu meinem Rechner zugange erhalten und ist auf meinen rechner mit WIN8 gekommen und mir wichtige Files dekodiert. Vor allem die Fotos meiner Verstorbenen Frau sind da viele drauf, wenn ich die nicht mehr bekomme bin ich erledigt :-(

Alle Dokument Files PDF JPG DOC etc. haben eine .encrypted Endung und lassen sich nicht mehr öffnen.

Erpressungs Meldung mit Key schicken usw. ist auf dem Schirm gewesn.

Habe mit Kapersky und Sophos anscheinend mal den Virus "cryptoapp.exe" von der Platte weg bekommen, da dieser nach dem start immer wieder neu gekommen ist.

Während ich hier arbeite hat sich dann nochmals einer versucht per VNC zu verbinden, den habe ich jetzt dann gleich mal rausgeschmissen und die Firewall neu eingestellt.

Gibt es zu diesem Trojaner schon eine möglichkeit, ich bin leider wie sicher viele andere auch verzweifelt, vor allem die Fotos meiner Frau wären mir wichtig, da auch auf der backup Platte alles verschlüsselt ist, kann ich diese nicht wieder herstellen.

Danke für Eure Hilfe
Oliver

Bootsektor · 12.11.2014, 21:55

Hallo,

den Sperrbildschrim hast du nicht zufälligerweise noch?

Hast du Logs von Kaspersky und Sophos?

Mach bitte einen Scan mit FRST
Schritt 1
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

oriepl · 12.11.2014, 21:59

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2014
Ran by Oliver (administrator) on OLIVERPC_WIN8 on 12-11-2014 21:57:32
Running from C:\Users\Oliver\Downloads
Loaded Profile: Oliver (Available profiles: Oliver & SiteKiosk)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Razer, Inc.) C:\Program Files (x86)\Razer\Core\64bit\RzOvlMon.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDRSS.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDClock.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDPOP3.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\Applets\LCDCountdown.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(hxxp://www.SteveMiller.net) C:\Users\Oliver\AppData\Local\Temp\Rar$EXa0.819\PureText.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Avid Technology, Inc.) C:\Windows\SysWOW64\MAFWTray.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office15\OUTLOOK.EXE
(Microsoft Corporation) C:\Windows\FileManager\FileManager.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office15\MSOSYNC.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [7406392 2012-11-29] (Logitech Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-02-05] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [M-Audio Taskbar Icon] => C:\Windows\SysWOW64\MAFWTray.exe [252424 2009-07-29] (Avid Technology, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Sweetpacks Communicator] => C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [585536 2014-10-24] (Razer Inc.)
HKLM-x32\...\Run: [Aimersoft Helper Compact.exe] => C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe
HKLM-x32\...\Run: [BrowserPlugInHelper] => C:\Program Files (x86)\Aimersoft\Video Converter Ultimate\BrowserPlugInHelper.exe
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [37232 2008-06-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [640376 2008-06-11] (Adobe Systems Inc.)
HKLM-x32\...\Run: [MyCyberCafe] => C:\Program Files (x86)\My CyberCafe\MyCyberCafe.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKU\S-1-5-21-794392239-4017259344-355818948-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-794392239-4017259344-355818948-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-794392239-4017259344-355818948-1001\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [759496 2013-10-16] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-794392239-4017259344-355818948-1001\...\Run: [SkyDrive] => C:\Users\Oliver\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [277672 2014-09-25] (Microsoft Corporation)
HKU\S-1-5-21-794392239-4017259344-355818948-1001\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1080104 2014-08-04] (Apple Inc.)
HKU\S-1-5-21-794392239-4017259344-355818948-1001\...\Run: [Adobe Reader Synchronizer] => C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AdobeCollabSync.exe [759712 2014-09-12] (Adobe Systems Incorporated)
HKU\S-1-5-21-794392239-4017259344-355818948-1001\...\Run: [PureText] => C:\Users\Oliver\AppData\Local\Temp\Rar$EXa0.819\PureText.exe [33792 2013-01-04] (hxxp://www.SteveMiller.net) <===== ATTENTION
HKU\S-1-5-21-794392239-4017259344-355818948-1001\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-10-20] (Apple Inc.)
AppInit_DLLs: C:\PROGRA~2\NVIDIA~1\3DVISI~1\NVSTIN~1.DLL => C:\PROGRA~2\NVIDIA~1\3DVISI~1\NVSTIN~1.DLL File Not Found
AppInit_DLLs:  acaptuser64.dll => C:\WINDOWS\system32\acaptuser64.dll [119160 2008-06-11] (Adobe Systems, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.golfballs.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8692AEBB6AF2CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-LU,de;q=0.5
BHO: No Name -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} ->  No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-794392239-4017259344-355818948-1001 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
Toolbar: HKU\S-1-5-21-794392239-4017259344-355818948-1001 -> No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{7BF10577-3309-4455-900B-A402079F73FC}: [NameServer] 195.202.138.3,195.202.128.3

FireFox:
========
FF ProfilePath: C:\Users\Oliver\AppData\Roaming\Mozilla\Firefox\Profiles\t07um4cv.default
FF Keyword.URL: hxxp://search.sweetim.com/search.asp?src=2&crg=3.1010000.10025&q=
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.2\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Oliver\AppData\Roaming\Mozilla\Firefox\Profiles\t07um4cv.default\searchplugins\sweetim.xml.encrypted
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Firefox Old Version Update Hotfix - C:\Users\Oliver\AppData\Roaming\Mozilla\Firefox\Profiles\t07um4cv.default\Extensions\firefox-hotfix@mozilla.org.xpi [2014-10-08]
FF Extension: SweetPacks Toolbar for Firefox - C:\Users\Oliver\AppData\Roaming\Mozilla\Firefox\Profiles\t07um4cv.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi [2012-12-23]

Chrome: 
=======
CHR HomePage: Default -> hxxp://search.conduit.com/?ctid=CT3324790&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP98A922D2-6296-4A87-9487-1DF1C0EDC6B7&SSPV=
CHR StartupUrls: Default -> ""
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-12]
CHR Extension: (Google Docs) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-12]
CHR Extension: (Google Drive) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-12-15]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-17]
CHR Extension: (YouTube) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-12-15]
CHR Extension: (Google-Suche) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-15]
CHR Extension: (CleverReach) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbadlmeappiakggijlcgjapjaoledehg [2014-11-12]
CHR Extension: (WGT Golf Challenge) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcilimldmomiaihcfkmaldanopfejefg [2014-11-12]
CHR Extension: (Google Tabellen) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-12]
CHR Extension: (PageSpeed Insights (by Google)) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\gplegfbjlmmehdoakndmohflojccocli [2014-11-12]
CHR Extension: (jsFiddle) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\hiigmadmngbpbmacbkfngpkjfmmpagfk [2014-11-12]
CHR Extension: (SEO & Website Analysen) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlngmmdolgbdnnimbmblfhhndibdipaf [2014-11-12]
CHR Extension: (VNC® Viewer for Google Chrome™) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\iabmpiboiopbgfabjmgeedhcmjenhbla [2014-11-12]
CHR Extension: (Knok | Family Travel) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\iehdddmijbgofffjjmhkodckmnombhmf [2014-11-12]
CHR Extension: (Google Wallet) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-27]
CHR Extension: (Google Mail) - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-12-15]
CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx [2012-12-23]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2013-04-16] (Macrovision Europe Ltd.) [File not signed]
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-02-05] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16941856 2014-02-05] (NVIDIA Corporation)
R2 RzOvlMon; C:\Program Files (x86)\Razer\Core\64bit\rzovlmon.exe [32960 2014-04-18] (Razer, Inc.)
S3 Samsung UPD Service2; C:\WINDOWS\System32\SUPDSvc2.exe [158208 2012-04-06] (Samsung Electronics)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [186056 2013-10-16] (Sandboxie Holdings, LLC)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [1050904 2013-12-11] () [File not signed]
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AU8168; C:\Windows\system32\DRIVERS\au630x64.sys [792648 2013-09-23] (Realtek                                            )
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [53816 2009-03-02] (Samsung Electronics Co., Ltd.)
R3 MAFW; C:\Windows\system32\DRIVERS\mafw.sys [231944 2009-07-29] (Avid Technology, Inc.)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)
R3 RzDxgk; C:\WINDOWS\system32\drivers\RzDxgk.sys [129472 2014-04-18] (Razer, Inc.)
R1 RzFilter; C:\WINDOWS\system32\drivers\RzFilter.sys [74432 2014-04-18] (Razer, Inc.)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [200552 2013-10-16] (Sandboxie Holdings, LLC)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
S3 ndistc; \SystemRoot\system32\DRIVERS\ndistc.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-12 21:57 - 2014-11-12 21:57 - 02116096 _____ (Farbar) C:\Users\Oliver\Downloads\FRST64.exe
2014-11-12 21:57 - 2014-11-12 21:57 - 00022271 _____ () C:\Users\Oliver\Downloads\FRST.txt
2014-11-12 21:57 - 2014-11-12 21:57 - 00000000 ____D () C:\FRST
2014-11-12 21:51 - 2014-11-12 21:52 - 00000000 ____D () C:\Users\Oliver\Desktop\encrypted FILES
2014-11-12 21:42 - 2014-11-12 21:42 - 00000000 ____D () C:\Users\Oliver\AppData\Roaming\IsolatedStorage
2014-11-12 21:42 - 2014-11-12 21:42 - 00000000 ____D () C:\Users\Oliver\AppData\Local\FileViewPro
2014-11-12 21:42 - 2014-11-12 21:42 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2014-11-12 21:41 - 2014-11-12 21:41 - 02388400 _____ () C:\Users\Oliver\Downloads\FileViewPro_2014.exe
2014-11-12 21:17 - 2014-11-12 21:17 - 00620232 _____ (Kaspersky Lab ZAO) C:\Users\Oliver\Downloads\xoristdecryptor.exe
2014-11-12 21:17 - 2014-11-12 21:17 - 00620232 _____ (Kaspersky Lab ZAO) C:\Users\Oliver\Downloads\xoristdecryptor (1).exe
2014-11-12 21:12 - 2014-11-12 21:12 - 00447176 _____ (Kaspersky Lab ZAO) C:\Users\Oliver\Downloads\rannohdecryptor.exe
2014-11-12 21:07 - 2014-11-12 21:07 - 00000000 _____ () C:\autoexec.bat
2014-11-12 21:06 - 2014-11-12 21:33 - 00000000 ____D () C:\WINDOWS\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-11-12 21:06 - 2014-11-12 21:06 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-11-12 20:52 - 2014-11-12 20:52 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Oliver\Downloads\SpyHunter-installer.exe
2014-11-12 20:42 - 2014-11-12 20:43 - 104828048 _____ (Sophos Limited) C:\Users\Oliver\Downloads\Sophos Virus Removal Tool.exe
2014-11-12 20:41 - 2014-11-12 20:54 - 00000000 ____D () C:\ProgramData\Sophos
2014-11-12 20:40 - 2014-11-12 20:40 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_RzFilter_01009.Wdf
2014-11-12 20:40 - 2014-11-12 20:40 - 00000000 ____D () C:\WINDOWS\Razer Core
2014-11-12 20:40 - 2014-04-18 17:02 - 00129472 _____ (Razer, Inc.) C:\WINDOWS\system32\Drivers\RzDxgk.sys
2014-11-12 20:40 - 2014-04-18 17:02 - 00074432 _____ (Razer, Inc.) C:\WINDOWS\system32\Drivers\RzFilter.sys
2014-11-12 20:38 - 2014-11-12 20:38 - 91060632 _____ (Sophos Limited) C:\Users\Oliver\Downloads\Sophos_Virus_Removal_Tool_2.5.exe
2014-11-12 20:27 - 2014-11-12 20:27 - 00751688 _____ (Emsisoft GmbH) C:\Users\Oliver\Downloads\decrypt_mblblock.exe
2014-11-12 20:24 - 2014-11-12 20:24 - 00062065 _____ () C:\Users\Oliver\Downloads\ransom_file_unlocker.zip
2014-11-12 20:07 - 2014-11-12 21:05 - 00009909 _____ () C:\Users\Oliver\Downloads\PandaRamsonwareDecrypt.log
2014-11-12 20:07 - 2014-11-12 20:07 - 02760672 _____ () C:\Users\Oliver\Downloads\pandaunransom.exe
2014-11-12 20:05 - 2014-11-12 20:05 - 00000992 _____ () C:\ProgramData\SMRResults430.dat
2014-11-12 20:04 - 2014-11-12 20:04 - 00000000 ____D () C:\Users\Oliver\AppData\Local\Symantec Power Eraser
2014-11-12 20:00 - 2014-11-12 20:00 - 07219880 _____ (Symantec Corporation) C:\Users\Oliver\Downloads\SymHelp.exe
2014-11-12 13:17 - 2014-11-12 13:17 - 64235206 _____ () C:\Users\Oliver\Downloads\adidas Catalogue APPAREL SS2015-1.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 58452233 _____ () C:\Users\Oliver\Downloads\graphicriver-7249808-golf-event-complete-template-bundle.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 48151612 _____ () C:\Users\Oliver\Downloads\adidas Footwear & Accessories catalogue SS2015-1.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 36848572 _____ () C:\Users\Oliver\Downloads\collection (7).zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 23813900 _____ () C:\Users\Oliver\Downloads\CORP.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 23650925 _____ () C:\Users\Oliver\Downloads\jtl-shop319.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 23650925 _____ () C:\Users\Oliver\Downloads\jtl-shop319 (1).zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 23191048 _____ () C:\Users\Oliver\Downloads\jtl-shop318.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 20584876 _____ () C:\Users\Oliver\Downloads\jtl-shop317.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 17704579 _____ () C:\Users\Oliver\Downloads\pages.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 13402282 _____ () C:\Users\Oliver\Downloads\CBRA1030-WHT.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 07737598 _____ () C:\Users\Oliver\Downloads\idezender_v34.rar.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 07668925 _____ () C:\Users\Oliver\Downloads\GolfBall.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 06774313 _____ () C:\Users\Oliver\Downloads\wordpress-3.9.1-de_DE.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 06514188 _____ () C:\Users\Oliver\Downloads\wordpress_36-de.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 06477682 _____ () C:\Users\Oliver\Downloads\Cobra Puma Golf 2013.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 06084443 _____ () C:\Users\Oliver\Downloads\PGA TOUR CATALOGUE.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 05669140 _____ () C:\Users\Oliver\Downloads\Flat.File.Sports.de.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 05480056 _____ () C:\Users\Oliver\Downloads\wordpress-3.7.1-de.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 05262438 _____ () C:\Users\Oliver\Downloads\TAY_10532 TaylorMade Accessories Catalogue 2014 LOW RES.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 05262438 _____ () C:\Users\Oliver\Downloads\TAY_10532 TaylorMade Accessories Catalogue 2014 LOW RES (2).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 05262438 _____ () C:\Users\Oliver\Downloads\TAY_10532 TaylorMade Accessories Catalogue 2014 LOW RES (1).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 05206292 _____ () C:\Users\Oliver\Downloads\Flat.File.Home.de.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 05196057 _____ () C:\Users\Oliver\Downloads\k001249_6_test.csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 05004366 _____ () C:\Users\Oliver\Downloads\TAY_8784 TM CATALOGUE 2013 - SINGLE PAGES - GERMAN_FOR PRINT NEW.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 04990740 _____ () C:\Users\Oliver\Downloads\Flat.File.Sports.uk.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 04505876 _____ () C:\Users\Oliver\Downloads\Flat.File.PriceInventory._TTH_.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 04505876 _____ () C:\Users\Oliver\Downloads\Flat.File.PriceInventory._TTH_ (1).xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 04260116 _____ () C:\Users\Oliver\Downloads\Flat.File.InventoryLoader.de.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 04184573 _____ () C:\Users\Oliver\Downloads\adicross gripmore_Q47007_profile.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 04176222 _____ () C:\Users\Oliver\Downloads\CBRA1030-BLK-CLUB.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 03903185 _____ () C:\Users\Oliver\Downloads\adicross gripmore_Q47005_profile.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 03723515 _____ () C:\Users\Oliver\Downloads\adicross gripmore_Q47006_profile.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 03358438 _____ () C:\Users\Oliver\Downloads\KMSpico Install.rar.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 03211540 _____ () C:\Users\Oliver\Downloads\Nikon_Coolshot.doc.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 02951704 _____ () C:\Users\Oliver\Downloads\GolfBuddy Voice strap.JPG.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 02739057 _____ () C:\Users\Oliver\Downloads\Nikon_COOLSHOT.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 02693574 _____ () C:\Users\Oliver\Downloads\RIFE-selected.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 02404565 _____ () C:\Users\Oliver\Downloads\UploadSettings (1).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 02404385 _____ () C:\Users\Oliver\Downloads\UploadSettings.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 02358721 _____ () C:\Users\Oliver\Downloads\MRP274Setup.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 02358721 _____ () C:\Users\Oliver\Downloads\MRP274Setup (1).zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 02239008 _____ () C:\Users\Oliver\Downloads\Extreme.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 02116389 _____ () C:\Users\Oliver\Downloads\codecanyon-4761186-pure-css3-dropdown-megamenu.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01839380 _____ () C:\Users\Oliver\Downloads\Nikon_Coolshot_AS.doc.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01759627 _____ () C:\Users\Oliver\Downloads\collection (6).zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01749700 _____ () C:\Users\Oliver\Downloads\collection (5).zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01740611 _____ () C:\Users\Oliver\Downloads\3061595_1008 BM Bedienmodul WRS Montage- und Bedienungsanleitung.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01722146 _____ () C:\Users\Oliver\Downloads\Travelcover-Extreme-Standard.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01694014 _____ () C:\Users\Oliver\Downloads\ControlPanelDlls.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01576339 _____ () C:\Users\Oliver\Downloads\flm-golf-booking.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01537826 _____ () C:\Users\Oliver\Downloads\Wolf-BM-Montageanleitung.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01491732 _____ () C:\Users\Oliver\Downloads\de_sports_browse_tree_guide._TTH_ (3).xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01461660 _____ () C:\Users\Oliver\Downloads\82029401103_2014001.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01378124 _____ () C:\Users\Oliver\Downloads\Nikon_LRF_COOLSHOT_AS_73.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01269299 _____ () C:\Users\Oliver\Downloads\Travelcover_Xtreme_Supermax_pocket.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01257973 _____ () C:\Users\Oliver\Downloads\codecanyon-2675936-booking-system-pro-wordpress-plugin.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01121044 _____ () C:\Users\Oliver\Downloads\Flat.File.Sports.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01121044 _____ () C:\Users\Oliver\Downloads\Flat.File.Sports (1).xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01101274 _____ () C:\Users\Oliver\Downloads\R1_Driver_Hero_2.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01075921 _____ () C:\Users\Oliver\Downloads\LEK-DOP B-037-01-CPR-20130701 ISOVER TDPS 55.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01057959 _____ () C:\Users\Oliver\Downloads\Schirmhalter OS2 Kopie.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 01026089 _____ () C:\Users\Oliver\Downloads\Rainstar-GT32-Detail Kopie.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00954318 _____ () C:\Users\Oliver\Downloads\82029401103_2014002.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00819988 _____ () C:\Users\Oliver\Downloads\de_sports_browse_tree_guide._TTH_.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00819988 _____ () C:\Users\Oliver\Downloads\de_sports_browse_tree_guide._TTH_ (2).xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00819988 _____ () C:\Users\Oliver\Downloads\de_sports_browse_tree_guide._TTH_ (1).xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00709137 _____ () C:\Users\Oliver\Downloads\codecanyon-2675936-booking-system-pro-wordpress-plugin (1).zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00610068 _____ () C:\Users\Oliver\Downloads\taxonomy.de-DE.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00557844 _____ () C:\Users\Oliver\Downloads\Max_NANO.doc.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00557335 _____ () C:\Users\Oliver\Downloads\72003_GG_deluxe.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00544314 _____ () C:\Users\Oliver\Downloads\N2324301_PerfTravelCvr_72_dpi.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00537265 _____ () C:\Users\Oliver\Downloads\N2373301 Catalina Blk Wht.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00504043 _____ () C:\Users\Oliver\Downloads\UserPie-master.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00502618 _____ () C:\Users\Oliver\Downloads\N2373501 Catalina Blk Wht Red.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00478996 _____ () C:\Users\Oliver\Downloads\Thumbs.db.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00467115 _____ () C:\Users\Oliver\Downloads\GSAControlPanel.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00459426 _____ () C:\Users\Oliver\Downloads\BoardingPassPLATZERDANIEL.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00458834 _____ () C:\Users\Oliver\Downloads\adicross gripmore_Q47007_sole.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00455351 _____ () C:\Users\Oliver\Downloads\Rainstar-GI090 Kopie.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00449300 _____ () C:\Users\Oliver\Downloads\RIFE Titan Putter.doc.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00428416 _____ () C:\Users\Oliver\Downloads\golf_course-wallpaper-1400x1050.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00396564 _____ () C:\Users\Oliver\Downloads\Max_Easy Remote Hybrid.doc.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00392645 _____ () C:\Users\Oliver\Downloads\shop3-systemcheck-1c933d6e13656141b01a271d96d890021bcbb0b6.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00385157 _____ () C:\Users\Oliver\Downloads\golf_figure_silhouettes_vector.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00356178 _____ () C:\Users\Oliver\Downloads\Travelcover_Xtreme_Supermax_hold.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00346437 _____ () C:\Users\Oliver\Downloads\augusta13-244151.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00333369 _____ () C:\Users\Oliver\Downloads\xv_cleverreach_105.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00320872 _____ () C:\Users\Oliver\Downloads\dropdown-menu-widget.1.9.1.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00301708 _____ () C:\Users\Oliver\Downloads\82029401102_2014001.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00271033 _____ () C:\Users\Oliver\Downloads\kualalumpur13-242794.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00267042 _____ () C:\Users\Oliver\Downloads\cromwell13-249842.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00256262 _____ () C:\Users\Oliver\Downloads\wentworth13-248043.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00256075 _____ () C:\Users\Oliver\Downloads\irving§3-246625.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00244219 _____ () C:\Users\Oliver\Downloads\kualalumpur13-242787.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00233202 _____ () C:\Users\Oliver\Downloads\phoenix13-242763.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00227884 _____ () C:\Users\Oliver\Downloads\muirfield13-252350.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00226755 _____ () C:\Users\Oliver\Downloads\merion13-249284.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00222448 _____ () C:\Users\Oliver\Downloads\address_book.csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00222448 _____ () C:\Users\Oliver\Downloads\address_book (6).csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00222448 _____ () C:\Users\Oliver\Downloads\address_book (5).csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00222448 _____ () C:\Users\Oliver\Downloads\address_book (4).csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00222273 _____ () C:\Users\Oliver\Downloads\address_book (3).csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00221947 _____ () C:\Users\Oliver\Downloads\address_book (1).csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00221615 _____ () C:\Users\Oliver\Downloads\jersey13-254458.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00219865 _____ () C:\Users\Oliver\Downloads\pittsford13-249027.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00214991 _____ () C:\Users\Oliver\Downloads\augusta13-244236.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00214991 _____ () C:\Users\Oliver\Downloads\augusta13-244236 (1).jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00211697 _____ () C:\Users\Oliver\Downloads\Droid-Sans.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00211580 _____ () C:\Users\Oliver\Downloads\orlando13-242992.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00210256 _____ () C:\Users\Oliver\Downloads\munchen13-249837.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00210206 _____ () C:\Users\Oliver\Downloads\wentworth13-247039.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00206223 _____ () C:\Users\Oliver\Downloads\humble13-243406.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00204905 _____ () C:\Users\Oliver\Downloads\munchen13-249834.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00199589 _____ () C:\Users\Oliver\Downloads\googlebase.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00198096 _____ () C:\Users\Oliver\Downloads\bethesda13-250225.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00197887 _____ () C:\Users\Oliver\Downloads\Antragsformular Teaching Pro.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00197146 _____ () C:\Users\Oliver\Downloads\orlando13-242989.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00195672 _____ () C:\Users\Oliver\Downloads\address_book (2).csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00190377 _____ () C:\Users\Oliver\Downloads\x-hot-fwy-sole-a-2013-5x7.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00188244 _____ () C:\Users\Oliver\Downloads\merion13-249328.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00183416 _____ () C:\Users\Oliver\Downloads\RBZ Stage 2_Fairway_Address.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00175489 _____ () C:\Users\Oliver\Downloads\wentworth13-246805.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00175355 _____ () C:\Users\Oliver\Downloads\palmharbor13-242741.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00170985 _____ () C:\Users\Oliver\Downloads\winsen13-245990.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00170330 _____ () C:\Users\Oliver\Downloads\merion13-249271.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00169404 _____ () C:\Users\Oliver\Downloads\Angebot-secupayTrio-s.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00164912 _____ () C:\Users\Oliver\Downloads\valencia13-244599.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00161220 _____ () C:\Users\Oliver\Downloads\Rechnungsmuster.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00159800 _____ () C:\Users\Oliver\Downloads\33216797144.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00159800 _____ () C:\Users\Oliver\Downloads\33216797144 (1).txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00155326 _____ () C:\Users\Oliver\Downloads\miami13-242336.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00154127 _____ () C:\Users\Oliver\Downloads\C956E457C4A78709_544990XXXXXX5319_1.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00149613 _____ () C:\Users\Oliver\Downloads\C956E457C4A78709_544990XXXXXX5319_2.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00148969 _____ () C:\Users\Oliver\Downloads\valencia13-244753.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00133266 _____ () C:\Users\Oliver\Downloads\merry_xmas_2-wallpaper-960x600.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00130836 _____ () C:\Users\Oliver\Downloads\290526_HANKOOK  Winter 1-2013.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00128873 _____ () C:\Users\Oliver\Downloads\kk_mega_menu_109.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00124569 _____ () C:\Users\Oliver\Downloads\8937189562.xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00119968 _____ () C:\Users\Oliver\Downloads\droid-serif.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00119572 _____ () C:\Users\Oliver\Downloads\Flat.File.FulfillmentOrderRequest._V201899730_.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00118588 _____ () C:\Users\Oliver\Downloads\8937212006.xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00115948 _____ () C:\Users\Oliver\Downloads\merry_xmas_2-wallpaper-800x600.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00106688 _____ () C:\Users\Oliver\Downloads\random_products.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00105622 _____ () C:\Users\Oliver\Downloads\uploadts-1407597824-sec_googleshopping.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00097556 _____ () C:\Users\Oliver\Downloads\Flat.File.RemovalOrderRequest._V385397052_.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00097556 _____ () C:\Users\Oliver\Downloads\Flat.File.RemovalOrderRequest._V385397052_ (1).xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00092788 _____ () C:\Users\Oliver\Downloads\Auftrag-10001-12002.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00092602 _____ () C:\Users\Oliver\Downloads\Rechnung-NBM201300008-16003.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00090315 _____ () C:\Users\Oliver\Downloads\golem.xml.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00090315 _____ () C:\Users\Oliver\Downloads\golem (1).xml.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00089529 _____ () C:\Users\Oliver\Downloads\Fall09_RangeBalls_SS.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00079022 _____ () C:\Users\Oliver\Downloads\gratisartikel_sp1.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00075696 _____ () C:\Users\Oliver\Downloads\EAN-13_9120060410074.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00071175 _____ () C:\Users\Oliver\Downloads\33179707764.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00066498 _____ () C:\Users\Oliver\Downloads\collection (2).zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00063264 _____ () C:\Users\Oliver\Downloads\36447375384.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00060535 _____ () C:\Users\Oliver\Downloads\collection (4).zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00057620 _____ () C:\Users\Oliver\Downloads\FBABookingForm_DE-4._TTH_.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00057579 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (5).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00057189 _____ () C:\Users\Oliver\Downloads\33179356004.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00057189 _____ () C:\Users\Oliver\Downloads\33179356004 (1).txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00055881 _____ () C:\Users\Oliver\Downloads\82029401103_20140101_20140630.csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00055572 _____ () C:\Users\Oliver\Downloads\290517_BARUM Winter 1-2013.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00055332 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (9).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00055311 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (15).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00054620 _____ () C:\Users\Oliver\Downloads\8188835122.xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00052566 _____ () C:\Users\Oliver\Downloads\collection.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00052566 _____ () C:\Users\Oliver\Downloads\collection (1).zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00051916 _____ () C:\Users\Oliver\Downloads\Folder.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00050809 _____ () C:\Users\Oliver\Downloads\GB-Voice-Cap.JPG.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00050287 _____ () C:\Users\Oliver\Downloads\Hitting Projection Screen.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00049401 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (16).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00046780 _____ () C:\Users\Oliver\Downloads\Price list AW13 APP_ACC_FTW_05.03.2013.xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00044274 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (3).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00043531 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (2).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00043092 _____ () C:\Users\Oliver\Downloads\irving10-184857.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00041236 _____ () C:\Users\Oliver\Downloads\INFOUrsprungserklaerung.doc.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00039659 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (7).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00038824 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (1).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00038645 _____ () C:\Users\Oliver\Downloads\COBRA Clubs Katalog Übersetzungen Deutsch 2013.docx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00037869 _____ () C:\Users\Oliver\Downloads\COBRA ACC Katalog Übersetzungen Deutsch 2013.docx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00037031 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (6).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00036749 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (11).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00036720 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (10).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00033529 _____ () C:\Users\Oliver\Downloads\PUMA Golf Preisliste_FINAL KATALOG Q1_SS13_23.11.2012 laura_.xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00033346 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral.xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00033187 _____ () C:\Users\Oliver\Downloads\bignoodle_titling.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00032531 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (8).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00030060 _____ () C:\Users\Oliver\Downloads\Rechnungsmuster_AT_Reverse_Charge.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00030030 _____ () C:\Users\Oliver\Downloads\Rechnungsmuster_AT_innergemeinschaftliche_Lieferung.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00029590 _____ () C:\Users\Oliver\Downloads\jst_geringster_staffelpreis.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00029309 _____ () C:\Users\Oliver\Downloads\SSCPM-423_MSDS_Exemption_DE._V368682320_.docx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00029309 _____ () C:\Users\Oliver\Downloads\SSCPM-423_MSDS_Exemption_DE._V368682320_ (1).docx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00028948 _____ () C:\Users\Oliver\Downloads\Auftragsimport_DPD.xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00028948 _____ () C:\Users\Oliver\Downloads\Auftragsimport_DPD (1).xls.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00028187 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (4).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00027993 _____ () C:\Users\Oliver\Downloads\wienerneustadt10-191360.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00026551 _____ () C:\Users\Oliver\Downloads\collection (3).zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00024145 _____ () C:\Users\Oliver\Downloads\jst_facebook_conversion.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00022292 _____ () C:\Users\Oliver\Downloads\Composite - X2 Hot Pro  (Approved).doc.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00021268 _____ () C:\Users\Oliver\Downloads\Composite - Versa Jailbird.doc.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00020756 _____ () C:\Users\Oliver\Downloads\Composite - SR 1 Golf Balls.doc.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00019580 _____ () C:\Users\Oliver\Downloads\xv_googleremarketing_100.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00018892 _____ () C:\Users\Oliver\Downloads\jtl_url_migration2.csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00015113 _____ () C:\Users\Oliver\Downloads\puretext_3.0_64-bit.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00015084 _____ () C:\Users\Oliver\Downloads\form_DNC_business.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00013458 _____ () C:\Users\Oliver\Downloads\82029401103_20140101_20140228.csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00011033 _____ () C:\Users\Oliver\Downloads\excel-upload-sheet-for-Adwords-Editor1.xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00009806 _____ () C:\Users\Oliver\Downloads\GA_bulk_import_template1.ods.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00009538 _____ () C:\Users\Oliver\Downloads\Herunterladen (2).csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00009232 _____ () C:\Users\Oliver\Downloads\AlbumArtSmall.jpg.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00008355 _____ () C:\Users\Oliver\Downloads\C956E457C4A78709_20140101_20140228.csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00007256 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (14).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00007200 _____ () C:\Users\Oliver\Downloads\bitsumishi.zip.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00006843 _____ () C:\Users\Oliver\Downloads\package (19).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00006663 _____ () C:\Users\Oliver\Downloads\Herunterladen (1).csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00006593 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (13).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00006590 _____ () C:\Users\Oliver\Downloads\40352453124.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00006590 _____ () C:\Users\Oliver\Downloads\40352453124 (1).txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00006506 _____ () C:\Users\Oliver\Downloads\package (24).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00006458 _____ () C:\Users\Oliver\Downloads\40411779824.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00006290 _____ () C:\Users\Oliver\Downloads\print.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00006123 _____ () C:\Users\Oliver\Downloads\DFPQueryToolGeneral (12).xlsx.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00005343 _____ () C:\Users\Oliver\Downloads\alleUmsaetzeKTO3100026555_20140325.csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00004602 _____ () C:\Users\Oliver\Downloads\package (23).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00004240 _____ () C:\Users\Oliver\Downloads\umappe[04-08-2014].pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00004207 _____ () C:\Users\Oliver\Downloads\products (3).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00004029 _____ () C:\Users\Oliver\Downloads\package (3).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00003461 _____ () C:\Users\Oliver\Downloads\package (1).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00003450 _____ () C:\Users\Oliver\Downloads\package (5).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00003446 _____ () C:\Users\Oliver\Downloads\package.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00003441 _____ () C:\Users\Oliver\Downloads\package (7).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00003400 _____ () C:\Users\Oliver\Downloads\Scorecards_20140714.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00003251 _____ () C:\Users\Oliver\Downloads\33847932464.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002907 _____ () C:\Users\Oliver\Downloads\package (12).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002886 _____ () C:\Users\Oliver\Downloads\package (2).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002875 _____ () C:\Users\Oliver\Downloads\package (17).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002875 _____ () C:\Users\Oliver\Downloads\package (16).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002875 _____ () C:\Users\Oliver\Downloads\package (15).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002873 _____ () C:\Users\Oliver\Downloads\package (4).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002873 _____ () C:\Users\Oliver\Downloads\package (14).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002871 _____ () C:\Users\Oliver\Downloads\package (8).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002870 _____ () C:\Users\Oliver\Downloads\package (22).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002870 _____ () C:\Users\Oliver\Downloads\package (11).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002869 _____ () C:\Users\Oliver\Downloads\package (26).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002869 _____ () C:\Users\Oliver\Downloads\package (25).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002868 _____ () C:\Users\Oliver\Downloads\package (6).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002868 _____ () C:\Users\Oliver\Downloads\package (21).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002868 _____ () C:\Users\Oliver\Downloads\package (20).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002856 _____ () C:\Users\Oliver\Downloads\package (18).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002838 _____ () C:\Users\Oliver\Downloads\package (9).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002838 _____ () C:\Users\Oliver\Downloads\package (10).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002837 _____ () C:\Users\Oliver\Downloads\package (13).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002548 _____ () C:\Users\Oliver\Downloads\Scorecards_Compact20140714.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002544 _____ () C:\Users\Oliver\Downloads\products.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002544 _____ () C:\Users\Oliver\Downloads\products (1).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002502 _____ () C:\Users\Oliver\Downloads\products (2).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002497 _____ () C:\Users\Oliver\Downloads\products (4).pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002391 _____ () C:\Users\Oliver\Downloads\Herunterladen.csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00002307 _____ () C:\Users\Oliver\Downloads\36604614824.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00001949 _____ () C:\Users\Oliver\Downloads\Cart_Signs_20140714.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00001501 _____ () C:\Users\Oliver\Downloads\Stickers_20140714.pdf.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00001431 _____ () C:\Users\Oliver\Downloads\82029401102_20140101_20140228.csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00001125 _____ () C:\Users\Oliver\Downloads\booking-system-pro-wordpress-plugin-license.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000844 _____ () C:\Users\Oliver\Downloads\28028976204.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000844 _____ () C:\Users\Oliver\Downloads\28002962964.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000797 _____ () C:\Users\Oliver\Downloads\28002588804.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000797 _____ () C:\Users\Oliver\Downloads\28002588804 (1).txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000747 _____ () C:\Users\Oliver\Downloads\33179061064.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000726 _____ () C:\Users\Oliver\Downloads\detail.csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000691 _____ () C:\Users\Oliver\Downloads\28002685264.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000676 _____ () C:\Users\Oliver\Downloads\umappe[04-08-2014].csv.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000589 _____ () C:\Users\Oliver\Downloads\28029222544.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000557 _____ () C:\Users\Oliver\Downloads\40353801604.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000557 _____ () C:\Users\Oliver\Downloads\40353042844.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000557 _____ () C:\Users\Oliver\Downloads\40352753324.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000557 _____ () C:\Users\Oliver\Downloads\36603758344.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000557 _____ () C:\Users\Oliver\Downloads\36602731184.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000384 _____ () C:\Users\Oliver\Downloads\kundenstamm.193.txt.encrypted
2014-11-12 13:17 - 2014-11-12 13:17 - 00000329 _____ () C:\Users\Oliver\Downloads\google0b2854052fe2c207.html.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 41246520 _____ () C:\Users\Oliver\Downloads\23-Aug-2014_21_09_08.zip.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 35419993 _____ () C:\Users\Oliver\Downloads\123456_setup_Paketomat_8.3.33.zip.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 28174516 _____ () C:\Users\Oliver\Downloads\2008x475-Big-Bertha-V-Series.psd.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 04158511 _____ () C:\Users\Oliver\Downloads\2013_finale Preisliste Katalog.pdf.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 04158511 _____ () C:\Users\Oliver\Downloads\2013_finale Preisliste Katalog (2).pdf.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 04158511 _____ () C:\Users\Oliver\Downloads\2013_finale Preisliste Katalog (1).pdf.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 01286932 _____ () C:\Users\Oliver\Downloads\2013_Golf_Ball_Price_SECOND CHANCE List_-_Euro.xls.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00936609 _____ () C:\Users\Oliver\Downloads\2012 01 GB VOICE WHITE.jpg.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00086331 _____ () C:\Users\Oliver\Downloads\000274ef.pdf.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00057361 _____ () C:\Users\Oliver\Downloads\106482 (3).txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00053273 _____ () C:\Users\Oliver\Downloads\2012 01 GB VOICE WHITE + Schallwellen.jpg.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00051244 _____ () C:\Users\Oliver\Downloads\106482 (2).txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00038746 _____ () C:\Users\Oliver\Downloads\106482 (1).txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00021575 _____ () C:\Users\Oliver\Downloads\106482.txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00004132 _____ () C:\Users\Oliver\Downloads\106482 (4).txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00002061 _____ () C:\Users\Oliver\Downloads\1395817358.txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00001740 _____ () C:\Users\Oliver\Downloads\1394700756.txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00001584 _____ () C:\Users\Oliver\Downloads\1395741032.txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00001055 _____ () C:\Users\Oliver\Downloads\1394700826.txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00000736 _____ () C:\Users\Oliver\Downloads\1381295339.txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00000736 _____ () C:\Users\Oliver\Downloads\1381295129.txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00000726 _____ () C:\Users\Oliver\Downloads\1382986285.txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00000724 _____ () C:\Users\Oliver\Downloads\1384856156.txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00000717 _____ () C:\Users\Oliver\Downloads\1381295324.txt.encrypted
2014-11-12 13:16 - 2014-11-12 13:16 - 00000717 _____ () C:\Users\Oliver\Downloads\1381295318.txt.encrypted
2014-11-12 13:15 - 2014-11-12 13:15 - 47767828 _____ () C:\Users\Oliver\Documents\MEDIADATEN newbreeze Media 2013 - komplett.indd.encrypted
2014-11-12 13:15 - 2014-11-12 13:15 - 44572948 _____ () C:\Users\Oliver\Documents\MEDIADATEN newbreeze Media 2014 - komplett.indd.encrypted
2014-11-12 13:15 - 2014-11-12 13:15 - 42754324 _____ () C:\Users\Oliver\Documents\Pocket Golf Ausgabe 3 _ oliver Worksheet.indd.encrypted
2014-11-12 13:15 - 2014-11-12 13:15 - 01417721 _____ () C:\Users\Oliver\Documents\inventurliste.pdf.encrypted
2014-11-12 13:15 - 2014-11-12 13:15 - 00229747 _____ () C:\Users\Oliver\Documents\Dropship Glawar Rechnung_2013-06-19_20131433.pdf.encrypted
2014-11-12 13:01 - 2014-11-12 13:01 - 00123159 _____ () C:\Users\Oliver\AppData\Local\IconCache.db.encrypted
2014-11-12 13:00 - 2014-11-12 13:00 - 00009396 _____ () C:\Users\Oliver\AppData\Local\CleanupUninstall.txt.encrypted
2014-11-12 11:39 - 2014-10-07 07:28 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2014-11-12 11:39 - 2014-10-07 07:27 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2014-11-12 11:39 - 2014-10-07 07:27 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2014-11-12 11:39 - 2014-10-07 07:27 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2014-11-12 11:39 - 2014-10-07 07:27 - 00108432 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2014-11-12 11:39 - 2014-10-07 04:34 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2014-11-12 11:39 - 2014-10-07 04:34 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2014-11-12 11:39 - 2014-10-07 04:33 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2014-11-12 11:39 - 2014-10-07 02:54 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2014-11-12 11:39 - 2014-10-07 02:46 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2014-11-12 11:39 - 2014-09-10 07:25 - 00474432 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2014-11-12 11:39 - 2014-09-08 04:07 - 02497344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-11-12 11:39 - 2014-09-08 04:07 - 00428864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2014-11-12 11:39 - 2014-09-07 23:08 - 00389176 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2014-11-12 11:39 - 2014-09-04 23:30 - 00822272 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2014-11-12 11:39 - 2014-09-04 23:21 - 01053184 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2014-11-12 11:39 - 2014-09-04 04:15 - 00561416 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2014-11-12 11:39 - 2014-09-04 04:14 - 00177472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2014-11-12 11:39 - 2014-09-04 04:05 - 00836176 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2014-11-12 11:39 - 2014-09-04 03:22 - 00670384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2014-11-12 11:39 - 2014-09-04 02:19 - 00436224 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2014-11-12 11:39 - 2014-09-04 02:01 - 00448512 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2014-11-12 11:39 - 2014-09-04 01:45 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2014-11-12 11:39 - 2014-09-04 01:41 - 01420288 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2014-11-12 11:39 - 2014-09-04 01:36 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2014-11-12 11:39 - 2014-09-04 01:32 - 00334336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2014-11-12 11:39 - 2014-09-04 01:15 - 00342528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2014-11-12 11:39 - 2014-08-31 01:17 - 00148800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBSTOR.SYS
2014-11-12 11:39 - 2014-08-31 01:15 - 21197152 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-11-12 11:39 - 2014-08-30 23:59 - 18723112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-11-12 11:39 - 2014-08-30 23:05 - 00615424 _____ (Microsoft Corporation) C:\WINDOWS\system32\FXSCOMEX.dll
2014-11-12 11:39 - 2014-08-30 22:58 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\FXSAPI.dll
2014-11-12 11:39 - 2014-08-30 22:04 - 00941568 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2014-11-12 11:39 - 2014-08-30 21:53 - 00239104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FXSAPI.dll
2014-11-12 11:39 - 2014-08-30 21:17 - 00799744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2014-11-12 11:39 - 2014-08-28 03:55 - 07484224 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2014-11-12 11:39 - 2014-08-28 01:21 - 02480128 _____ (Microsoft Corporation) C:\WINDOWS\system32\WsmSvc.dll
2014-11-12 11:39 - 2014-08-28 01:06 - 02030592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WsmSvc.dll
2014-11-12 11:39 - 2014-08-23 06:14 - 13424128 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-11-12 11:39 - 2014-08-23 06:04 - 11820544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-11-12 11:39 - 2014-08-23 05:50 - 02714112 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2014-11-12 11:39 - 2014-08-02 01:51 - 00545792 _____ (Microsoft Corporation) C:\WINDOWS\system32\untfs.dll
2014-11-12 11:39 - 2014-08-02 01:35 - 00485376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\untfs.dll
2014-11-12 04:01 - 2014-11-12 04:01 - 00000000 _____ () C:\Users\Public\Documents\f3d4ac9de95e261ff9828980b4d4fc97.encrypted.decrypted
2014-11-12 03:59 - 2014-11-12 03:59 - 00896000 _____ () C:\Users\Oliver\Downloads\uk_sports_browse_tree_guide._TTH_.xls.encrypted.decrypted
2014-11-11 23:02 - 2014-11-11 23:02 - 00000276 _____ () C:\Users\Public\Documents\f3d4ac9de95e261ff9828980b4d4fc97.encrypted
2014-11-11 22:58 - 2014-11-11 22:58 - 00896276 _____ () C:\Users\Oliver\Downloads\uk_sports_browse_tree_guide._TTH_.xls.encrypted
2014-11-11 07:36 - 2014-11-11 07:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2014-11-03 08:41 - 2014-11-03 08:41 - 06126536 _____ (Tim Kosse) C:\Users\Oliver\Downloads\FileZilla_3.9.0.6_win32-setup.exe
2014-10-18 20:12 - 2014-11-12 19:50 - 00000000 ___RD () C:\Users\Oliver\iCloudDrive
2014-10-18 20:12 - 2014-10-18 20:12 - 00000000 ____D () C:\Users\Oliver\AppData\Local\Apple Inc
2014-10-17 20:25 - 2014-10-17 20:25 - 00031240 _____ () C:\Users\Oliver\Downloads\redirect.tif
2014-10-15 01:17 - 2014-09-27 23:25 - 04183040 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-10-15 01:17 - 2014-09-04 01:10 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\winbici.dll
2014-10-15 01:17 - 2014-09-04 00:57 - 00921600 _____ (Microsoft Corporation) C:\WINDOWS\system32\MrmCoreR.dll
2014-10-15 01:17 - 2014-09-04 00:49 - 00626688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MrmCoreR.dll
2014-10-15 01:16 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-10-15 01:16 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-10-15 01:16 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-10-15 01:16 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-10-15 01:16 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-10-15 01:16 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-10-15 01:16 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-10-15 01:16 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-10-15 01:16 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-10-15 01:16 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-10-15 01:16 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-10-15 01:16 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-10-15 01:16 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-10-15 01:16 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-10-15 01:16 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-10-15 01:16 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-10-15 01:16 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-10-15 01:16 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-10-15 01:16 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-10-15 01:16 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-10-15 01:16 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-10-15 01:16 - 2014-09-19 01:42 - 00363008 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-10-15 01:16 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-10-15 01:16 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-10-15 01:16 - 2014-09-19 01:20 - 00315904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-10-15 01:16 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-10-15 01:16 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-10-15 01:16 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-10-15 01:16 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-10-15 01:16 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-10-15 01:15 - 2014-09-08 04:15 - 00054752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2014-10-15 01:15 - 2014-09-08 02:46 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2014-10-15 01:15 - 2014-09-08 02:46 - 00050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2014-10-15 01:15 - 2014-09-08 01:08 - 00035328 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2014-10-15 01:15 - 2014-09-08 01:07 - 00137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2014-10-15 01:15 - 2014-09-08 01:05 - 03448320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2014-10-15 01:15 - 2014-09-08 01:04 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2014-10-15 01:15 - 2014-09-08 01:04 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2014-10-15 01:15 - 2014-09-08 01:03 - 01702400 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2014-10-15 01:15 - 2014-09-08 01:03 - 00839680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2014-10-15 01:15 - 2014-09-08 00:59 - 00123904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2014-10-15 01:15 - 2014-09-08 00:59 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2014-10-15 01:15 - 2014-09-08 00:56 - 00672256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2014-10-15 01:15 - 2014-09-08 00:56 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2014-10-15 01:14 - 2014-09-13 07:29 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\system32\packager.dll
2014-10-15 01:14 - 2014-09-13 07:02 - 02779648 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll
2014-10-15 01:14 - 2014-09-13 06:49 - 00068608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\packager.dll
2014-10-15 01:14 - 2014-09-13 06:30 - 03117568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll
2014-10-15 01:14 - 2014-09-04 01:12 - 00590336 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastls.dll
2014-10-15 01:14 - 2014-09-04 01:01 - 00514048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastls.dll
2014-10-15 01:14 - 2014-08-29 02:58 - 00109568 _____ (Microsoft Corporation) C:\WINDOWS\system32\appinfo.dll
2014-10-15 01:14 - 2014-08-29 00:56 - 02646016 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-10-15 01:14 - 2014-08-29 00:47 - 02321920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-10-15 01:14 - 2014-08-16 05:08 - 01507648 _____ (Microsoft Corporation) C:\WINDOWS\system32\propsys.dll
2014-10-15 01:14 - 2014-08-16 05:01 - 01710184 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-10-15 01:14 - 2014-08-16 04:58 - 01112512 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2014-10-15 01:14 - 2014-08-16 04:16 - 01205976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\propsys.dll
2014-10-15 01:14 - 2014-08-16 04:03 - 01467384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-10-15 01:14 - 2014-08-16 02:31 - 00838144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2014-10-15 01:14 - 2014-08-16 02:04 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Wldap32.dll
2014-10-15 01:14 - 2014-08-16 01:58 - 00287744 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemEventsBrokerServer.dll
2014-10-15 01:14 - 2014-08-16 01:53 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll
2014-10-15 01:14 - 2014-08-16 01:46 - 00290816 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProximityService.dll
2014-10-15 01:14 - 2014-08-16 01:45 - 00267776 _____ (Microsoft Corporation) C:\WINDOWS\system32\bisrv.dll
2014-10-15 01:14 - 2014-08-16 01:43 - 00321024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Wldap32.dll
2014-10-15 01:14 - 2014-08-16 01:43 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll
2014-10-15 01:14 - 2014-08-16 01:31 - 00914432 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2014-10-15 01:14 - 2014-08-16 01:31 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcsvDevice.dll
2014-10-15 01:14 - 2014-08-16 01:29 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 01:14 - 2014-08-16 01:23 - 01106432 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2014-10-15 01:14 - 2014-08-16 01:22 - 00717824 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveTelemetry.dll
2014-10-15 01:14 - 2014-08-16 01:22 - 00286208 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDriveShell.dll
2014-10-15 01:14 - 2014-08-16 01:19 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 01:14 - 2014-08-16 01:18 - 04758528 _____ (Microsoft Corporation) C:\WINDOWS\system32\SyncEngine.dll
2014-10-15 01:14 - 2014-08-16 01:17 - 08757760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2014-10-15 01:14 - 2014-08-16 01:14 - 00265216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SkyDriveShell.dll
2014-10-15 01:14 - 2014-08-16 01:13 - 06649344 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-10-15 01:14 - 2014-08-16 01:13 - 05902848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2014-10-15 01:14 - 2014-08-16 01:13 - 00840192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchFolder.dll
2014-10-15 01:14 - 2014-08-16 01:11 - 00920064 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-10-15 01:14 - 2014-08-16 01:10 - 01120768 _____ (Microsoft Corporation) C:\WINDOWS\system32\SkyDrive.exe
2014-10-15 01:14 - 2014-08-16 01:08 - 05777408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-10-15 01:14 - 2014-08-16 01:07 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-12 21:55 - 2012-12-19 09:04 - 00005156 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for OLIVERPC_WIN8-Oliver oliverPC_win8
2014-11-12 21:55 - 2012-12-15 21:41 - 00000000 ___DO () C:\Users\Oliver\SkyDrive
2014-11-12 21:49 - 2014-01-02 19:52 - 00000000 ____D () C:\Users\Oliver\AppData\Local\FD6FAF5C-B41B-46CD-9022-CDFC91F07259.aplzod
2014-11-12 21:47 - 2012-12-15 17:17 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-794392239-4017259344-355818948-1001
2014-11-12 21:42 - 2013-09-30 05:14 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-11-12 21:42 - 2013-09-30 04:56 - 00764340 _____ () C:\WINDOWS\system32\perfh007.dat
2014-11-12 21:42 - 2013-09-30 04:56 - 00159160 _____ () C:\WINDOWS\system32\perfc007.dat
2014-11-12 21:42 - 2013-01-08 15:19 - 00000000 ____D () C:\Users\Oliver\Desktop\golfballs.at
2014-11-12 21:37 - 2013-12-28 10:48 - 00000000 ____D () C:\Program Files\KMSpico
2014-11-12 21:36 - 2013-11-24 11:35 - 01464066 _____ () C:\WINDOWS\WindowsUpdate.log
2014-11-12 21:36 - 2013-11-24 11:35 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-11-12 21:36 - 2013-09-29 20:04 - 00016126 _____ () C:\WINDOWS\PFRO.log
2014-11-12 21:36 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-11-12 21:36 - 2013-08-22 15:44 - 10682848 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-11-12 21:36 - 2012-12-15 17:16 - 00001142 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-12 21:35 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-11-12 21:34 - 2013-08-28 20:46 - 00000000 ____D () C:\Program Files (x86)\GSA Golf Demo
2014-11-12 21:30 - 2013-01-20 18:06 - 00000000 ____D () C:\temp
2014-11-12 21:30 - 2013-01-20 18:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealVNC
2014-11-12 21:30 - 2013-01-20 18:06 - 00000000 ____D () C:\Program Files\RealVNC
2014-11-12 21:20 - 2012-12-18 23:24 - 00000000 ____D () C:\Users\Oliver\AppData\Roaming\FileZilla
2014-11-12 21:16 - 2012-12-15 17:16 - 00001146 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-12 21:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-11-12 20:44 - 2013-01-20 11:49 - 00000000 ____D () C:\Program Files (x86)\Runtime Software
2014-11-12 20:41 - 2012-12-16 15:54 - 00222210 _____ () C:\WINDOWS\DPINST.LOG
2014-11-12 20:40 - 2013-08-22 15:46 - 00379879 _____ () C:\WINDOWS\setupact.log
2014-11-12 20:40 - 2012-12-24 12:28 - 00000000 ____D () C:\ProgramData\Razer
2014-11-12 20:40 - 2012-12-16 15:42 - 00000000 ____D () C:\Program Files (x86)\Razer
2014-11-12 20:05 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-11-12 19:51 - 2012-12-16 15:14 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-11-12 19:50 - 2012-12-18 23:38 - 00001808 _____ () C:\WINDOWS\Sandboxie.ini
2014-11-12 19:49 - 2013-08-22 16:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-11-12 19:49 - 2013-08-22 16:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2014-11-12 19:48 - 2012-12-23 14:42 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2014-11-12 19:48 - 2012-12-15 18:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-11-12 19:48 - 2012-07-26 06:26 - 00000167 _____ () C:\WINDOWS\win.ini
2014-11-12 19:47 - 2013-08-18 03:44 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-11-12 19:45 - 2012-12-18 03:03 - 103374192 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-11-12 19:38 - 2013-11-24 11:36 - 00000000 ____D () C:\Users\Oliver
2014-11-12 17:03 - 2013-11-27 10:32 - 00003954 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{F7191B28-7D04-41A3-B84A-29E25A2A9F1F}
2014-11-12 13:16 - 2012-12-18 08:26 - 00000000 ____D () C:\Users\Oliver\Documents\PRIVATES - FIRMENTECHNISCH
2014-11-12 13:15 - 2013-12-11 09:49 - 00000000 ____D () C:\Users\Oliver\Desktop\transfer Ordner
2014-11-12 13:15 - 2013-04-02 11:22 - 00000000 ____D () C:\Users\Oliver\Desktop\pocketgolf
2014-11-12 13:07 - 2013-08-02 09:57 - 00000000 ____D () C:\Users\Oliver\Desktop\golf simulator zentrum
2014-11-12 13:06 - 2013-03-20 21:52 - 00000000 ____D () C:\Users\Oliver\Desktop\ebay
2014-11-12 13:06 - 2012-12-23 09:12 - 00000000 ____D () C:\Users\Oliver\AppData\Roaming\TeamViewer
2014-11-12 13:06 - 2012-12-21 13:55 - 00000000 ____D () C:\Users\Oliver\AppData\Roaming\Origin
2014-11-12 13:06 - 2012-12-19 18:11 - 00000000 ____D () C:\Users\Oliver\AppData\Roaming\Adobe Mini Bridge CS5
2014-11-12 13:06 - 2012-12-16 15:52 - 00000000 ____D () C:\Users\Oliver\AppData\Roaming\UseNeXT
2014-11-12 13:06 - 2012-12-15 21:11 - 00000000 ____D () C:\Users\Oliver\AppData\Roaming\vlc
2014-11-12 13:06 - 2012-12-15 17:57 - 00000000 ____D () C:\Users\Oliver\AppData\Roaming\jtl-software
2014-11-12 13:00 - 2013-08-05 22:01 - 00000000 ___HD () C:\Tgl
2014-11-12 13:00 - 2012-12-30 10:45 - 00000000 ____D () C:\ProgramData\Aimersoft Video Converter Ultimate
2014-11-12 13:00 - 2012-12-21 13:54 - 00000000 ____D () C:\ProgramData\Origin
2014-11-12 13:00 - 2012-12-18 23:39 - 00000000 ___RD () C:\Sandbox
2014-11-12 12:59 - 2012-12-23 14:07 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-11-12 12:59 - 2012-12-21 13:53 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-11-12 12:58 - 2012-12-20 12:49 - 00000000 ____D () C:\Meine Webseiten
2014-11-12 04:03 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-11-12 02:00 - 2012-12-16 15:15 - 00000000 ____D () C:\Users\Oliver\AppData\Local\Adobe
2014-11-04 08:37 - 2013-01-08 15:18 - 00001456 _____ () C:\Users\Oliver\AppData\Local\Adobe Für Web speichern 13.0 Prefs
2014-11-03 09:17 - 2012-12-15 17:10 - 00000000 ____D () C:\Users\Oliver\AppData\Local\Packages
2014-10-30 12:25 - 2012-12-18 03:04 - 00275080 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-10-21 14:11 - 2012-12-15 17:16 - 00004118 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-21 14:11 - 2012-12-15 17:16 - 00003882 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-18 20:12 - 2012-12-16 09:05 - 00000000 ____D () C:\Users\Oliver\AppData\Roaming\Apple Computer
2014-10-18 09:28 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-10-18 08:55 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-10-18 08:54 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\MediaViewer
2014-10-18 08:54 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\FileManager
2014-10-18 08:54 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Camera

Files to move or delete:
====================
C:\Users\Oliver\AppData\Local\Temp\Rar$EXa0.819\PureText.exe
C:\ProgramData\SMRResults430.dat


Some content of TEMP:
====================
C:\Users\Oliver\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Oliver\AppData\Local\Temp\jre-7u60-windows-i586-iftw.exe
C:\Users\Oliver\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Oliver\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Oliver\AppData\Local\Temp\nvSCPAPI64.dll
C:\Users\Oliver\AppData\Local\Temp\nvStInst.exe
C:\Users\Oliver\AppData\Local\Temp\SHSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-11 05:16

==================== End Of Log ============================

--- --- ---

--- --- ---

FRST Additions Logfile:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-11-2014
Ran by Oliver at 2014-11-12 21:58:05
Running from C:\Users\Oliver\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat 9 Pro Extended - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}) (Version: 9.0.0 - Adobe Systems)
Adobe Acrobat 9 Pro Extended 64-bit Add-On (HKLM\...\{AC76BA86-1033-0000-0064-0003D0000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.5.0.880 - Adobe Systems Incorporated)
Adobe Creative Suite 6 Master Collection (HKLM-x32\...\{E8AD3069-9EB7-4BA8-8BFE-83F4E69355C0}) (Version: 6 - Adobe Systems Incorporated)
Adobe Download Assistant (HKLM-x32\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2.3 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Media Player (HKLM-x32\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 4.2 64-bit (HKLM\...\{B71CCF77-38A2-4805-9759-A6F7D2C52F3A}) (Version: 4.2.1 - Adobe)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Widget Browser (HKLM-x32\...\com.adobe.WidgetBrowser) (Version: 2.0 Build 348 - Adobe Systems Incorporated.)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.5.0.0 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.1.2 - EA Digital Illusions CE AB)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CINEMA 4D 12.016 (HKLM\...\MAXON8C02D5E0) (Version: 12.016 - MAXON Computer GmbH)
ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB)
FileZilla Client 3.9.0.5 (HKLM-x32\...\FileZilla Client) (Version: 3.9.0.5 - Tim Kosse)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google AdWords Editor (HKLM-x32\...\{14069A87-872C-41E6-9D36-B1BE3870C35A}) (Version: 10.6.0 - Google)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google SketchUp 8 (HKLM-x32\...\{4BA6784F-3B10-473A-B9F5-33A36AC354D5}) (Version: 3.0.14358 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
GSAControlPanel 7.6.4.6 (HKLM-x32\...\GSAControlPanel) (Version: 7.6.4.6 - GSA Golf LLC)
iCloud (HKLM\...\{2AAF09D5-4B3F-4975-B6A9-ECE2631FC942}) (Version: 4.0.5.20 - Apple Inc.)
Java 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.670 - Oracle)
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
JDownloader Packages (HKU\S-1-5-21-794392239-4017259344-355818948-1001\...\JDownloader Packages) (Version:  - ) <==== ATTENTION
JTL-Wawi (HKLM-x32\...\JTL-Wawi_is1) (Version: 0.99923 - )
K-Lite Codec Pack 7.2.0 (Basic) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 7.2.0 - )
KMSpico 3.1 (HKLM\...\KMSpico v3.1_is1) (Version: 3.1 - )
KMSpico v9.1.3 (HKLM\...\KMSpico_is1) (Version: 9.1.3 - )
Logitech Gaming Software 8.40 (HKLM\...\Logitech Gaming Software) (Version: 8.40.83 - Logitech Inc.)
M-Audio FireWire Driver 6.0.1 (x64) (HKLM\...\{3C33BA1B-D447-41CF-A228-84DD499F6F61}) (Version: 6.0.1 - M-Audio)
Microsoft Office Professional Plus 2013 (HKLM-x32\...\Office15.PROPLUSR) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-794392239-4017259344-355818948-1001\...\OneDriveSetup.exe) (Version: 17.3.1229.0918 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Embedded Browser version 2.0 (HKLM-x32\...\Mozilla Embedded Browser_is1) (Version: 2.0.0.16 - NuSphere Corp.)
Mozilla Firefox 19.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 19.0.2 (x86 de)) (Version: 19.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 19.0.2 - Mozilla)
Mozilla Thunderbird 17.0.7 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 17.0.7 (x86 de)) (Version: 17.0.7 - Mozilla)
NuSphere PhpED version 5.6 (HKLM-x32\...\NuSphere PhpED_is1) (Version: 5.6 - NuSphere Corp.)
NVIDIA 3D Vision Controller-Treiber 335.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 335.21 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 335.23 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 335.23 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 335.23 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.1.3.2637 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PDF Settings CS6 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Php Documentor version 1.4.2 for NuSphere PhpED (HKLM-x32\...\PHP Documentor_is1) (Version: 5.6 - NuSphere Corp.)
php-5.2.6 for NuSphere PhpED (HKLM-x32\...\PHP5_is1) (Version: 5.6 - NuSphere Corp.)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
Razer Core (HKLM-x32\...\Razer Core) (Version: 1.0.1.66 - Razer Inc)
Razer Synapse 2.0 (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 1.18.17.22879 - Razer Inc.)
Samsung ML-1710 Series (HKLM-x32\...\Samsung ML-1710 Series) (Version:  - )
Samsung Universal Print Driver (HKLM-x32\...\Samsung Universal Print Driver) (Version: 2.03.09.00 - Samsung Electronics Co., Ltd.)
Sandboxie 4.06 (64-bit) (HKLM\...\Sandboxie) (Version: 4.06 - Sandboxie Holdings, LLC)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM-x32\...\{91150000-0011-0000-0000-0000000FF1CE}_Office15.PROPLUSR_{7F6C4883-A18C-459A-82C1-A2F9403F2DA6}) (Version:  - Microsoft)
SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version:  - Tangysoft Ltd.)
VLC media player 2.0.5 (HKLM-x32\...\VLC media player) (Version: 2.0.5 - VideoLAN)
VNC Viewer 5.0.3 (HKLM\...\RealVNCViewer_is1) (Version: 5.0.3 - RealVNC Ltd)
Windows-Treiberpaket - FTDI CDM Driver Package - Bus/D2XX Driver (03/18/2011 2.08.14) (HKLM\...\EA13FC3821BC88E6D6BB1C2C2384BA45B079B0F2) (Version: 03/18/2011 2.08.14 - FTDI)
Windows-Treiberpaket - FTDI CDM Driver Package - VCP Driver (03/18/2011 2.08.14) (HKLM\...\AB1873BA4F75B84A16B2D4D1EE2E470EE5A2D8C2) (Version: 03/18/2011 2.08.14 - FTDI)
Windows-Treiberpaket - KEYLOK (usbkey) USB  (06/10/2010 64.0.0.0) (HKLM\...\B048A6D4B0188E5A802ADFF30A7C78FA4AD99BE0) (Version: 06/10/2010 64.0.0.0 - KEYLOK)
WinRAR 4.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-794392239-4017259344-355818948-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Oliver\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

27-10-2014 05:34:45 Geplanter Prüfpunkt
06-11-2014 02:36:07 Geplanter Prüfpunkt
12-11-2014 18:44:43 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-12-18 23:43 - 2012-12-18 23:43 - 00001497 ____N C:\WINDOWS\system32\Drivers\etc\hosts
 127.0.0.1 3dns-3.adobe.com
       127.0.0.1 3dns-2.adobe.com
       127.0.0.1 activate.adobe.com
       127.0.0.1 activate.adobe.com:443
       127.0.0.1 activate-sea.adobe.com
       127.0.0.1 activate-sjc0.adobe.com
       127.0.0.1 activate.wip3.adobe.com
       127.0.0.1 192.150.18.108
       127.0.0.1 adobeereg.com
       127.0.0.1 adobe-dns.adobe.com
       127.0.0.1 adobe-dns-2.adobe.com
       127.0.0.1 adobe-dns-3.adobe.com
       127.0.0.1 ereg.wip3.adobe.com
       127.0.0.1 ereg.adobe.com
       127.0.0.1 practivate.adobe.com
       127.0.0.1 wip3.adobe.com
       127.0.0.1 wwis-dubc1-vip60.adobe.com
       127.0.0.1 activate.adobe.com

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {436EF36C-67E4-42DC-AD95-F6685D906D9D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-15] (Google Inc.)
Task: {5661A09A-D266-46AB-B162-E3610C50AFC0} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {736E4225-61A6-4534-AAD8-57B1971F715F} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
Task: {7E925692-32D8-4833-980C-2001204C11EF} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-22] (Microsoft Corporation)
Task: {8B7B9604-90AC-4183-91D7-1D8F21CEFEEF} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-794392239-4017259344-355818948-1001 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {8EBCFE32-EB1A-4EA2-9595-13EEFDA127F7} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-22] (Microsoft Corporation)
Task: {A3D9CF8E-E621-456A-9FAA-20F76F08D897} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-or@newbreeze.at => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {A3EED56A-2ABD-4B49-9998-01D50E9080F7} - System32\Tasks\Microsoft Office 15 Sync Maintenance for OLIVERPC_WIN8-Oliver oliverPC_win8 => C:\Program Files (x86)\Microsoft Office\Office15\MsoSync.exe [2014-07-27] (Microsoft Corporation)
Task: {B7EFA9B5-A5E0-4A61-BA4F-6A415F123C9E} - System32\Tasks\KMS Activation => C:\Program Files\KMSpico\RandomFile.exe [2013-02-20] ()
Task: {D28F6A92-4BC8-4506-A807-B8B9E32074C4} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe [2013-12-11] ()
Task: {E9CAA3C8-0934-4634-A066-20C88C53F800} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-15] (Google Inc.)
Task: {EA17A198-8283-417B-A056-93F6975A2E75} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-11-12] (Microsoft Corporation)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-11-24 11:35 - 2014-03-04 14:05 - 00116056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-12-16 09:18 - 2011-04-11 06:26 - 00034304 _____ () C:\WINDOWS\System32\spd__l.dll
2014-05-01 20:29 - 2014-05-01 20:29 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2014-07-31 11:16 - 2014-07-31 11:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-09-06 17:44 - 2014-09-06 17:44 - 00035328 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00091648 _____ () C:\Program Files (x86)\FileZilla FTP Client\libgcc_s_sjlj-1.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00892416 _____ () C:\Program Files (x86)\FileZilla FTP Client\libstdc++-6.dll
2014-10-28 16:17 - 2014-10-22 05:04 - 01042760 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libglesv2.dll
2014-10-28 16:17 - 2014-10-22 05:04 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libegl.dll
2014-10-28 16:17 - 2014-10-22 05:04 - 08910664 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll
2014-10-28 16:17 - 2014-10-22 05:04 - 01681224 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll
2014-09-25 12:31 - 2014-09-25 12:31 - 01754296 _____ () C:\Program Files (x86)\Microsoft Office\Office15\tmpod.dll
2014-01-23 14:55 - 2014-01-23 14:55 - 01030312 _____ () C:\Program Files (x86)\Microsoft Office\Office15\ADDINS\UmOutlookAddin.dll
2014-10-28 16:17 - 2014-10-22 05:05 - 14902600 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Oliver\SkyDrive:ms-properties
AlternateDataStreams: C:\Users\Oliver\Documents\.DS_Store:AFP_AfpInfo
AlternateDataStreams: C:\Users\Public\.DS_Store:AFP_AfpInfo
AlternateDataStreams: C:\Users\Public\Documents\.DS_Store:AFP_AfpInfo

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-794392239-4017259344-355818948-500 - Administrator - Disabled)
Gast (S-1-5-21-794392239-4017259344-355818948-501 - Limited - Disabled)
Oliver (S-1-5-21-794392239-4017259344-355818948-1001 - Administrator - Enabled) => C:\Users\Oliver
SiteKiosk (S-1-5-21-794392239-4017259344-355818948-1008 - Limited - Enabled) => C:\Users\SiteKiosk

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (11/12/2014 09:37:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iCloudDrive.exe, Version: 1.2.34.1, Zeitstempel: 0x53d97094
Name des fehlerhaften Moduls: ChunkingLibrary.dll, Version: 163.3.0.1, Zeitstempel: 0x53ed5951
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00018ff4
ID des fehlerhaften Prozesses: 0x13e4
Startzeit der fehlerhaften Anwendung: 0xiCloudDrive.exe0
Pfad der fehlerhaften Anwendung: iCloudDrive.exe1
Pfad des fehlerhaften Moduls: iCloudDrive.exe2
Berichtskennung: iCloudDrive.exe3
Vollständiger Name des fehlerhaften Pakets: iCloudDrive.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: iCloudDrive.exe5

Error: (11/12/2014 09:35:58 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (11/12/2014 08:40:27 PM) (Source: RzOvlMon) (EventID: 0) (User: )
Description: RzOvlMonOpenService failed w/err 0x00000424

Error: (11/12/2014 08:11:26 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: There was an error with the Windows Location Provider database

Error: (11/12/2014 08:06:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iCloudDrive.exe, Version: 1.2.34.1, Zeitstempel: 0x53d97094
Name des fehlerhaften Moduls: ChunkingLibrary.dll, Version: 163.3.0.1, Zeitstempel: 0x53ed5951
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00018ff4
ID des fehlerhaften Prozesses: 0x11c0
Startzeit der fehlerhaften Anwendung: 0xiCloudDrive.exe0
Pfad der fehlerhaften Anwendung: iCloudDrive.exe1
Pfad des fehlerhaften Moduls: iCloudDrive.exe2
Berichtskennung: iCloudDrive.exe3
Vollständiger Name des fehlerhaften Pakets: iCloudDrive.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: iCloudDrive.exe5

Error: (11/12/2014 08:00:19 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: rdyboost4

Error: (11/12/2014 07:58:01 PM) (Source: VNC Server) (EventID: 256) (User: )
Description: SDisplayCoreDd-MsgDD error(Failed desktop duplication error -2005270527)

Error: (11/12/2014 07:58:01 PM) (Source: VNC Server) (EventID: 256) (User: )
Description: SDisplayCoreDd-MsgDD error(Failed desktop duplication error -2005270527)

Error: (11/12/2014 07:57:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: vncserver.exe, Version: 5.0.3.37046, Zeitstempel: 0x506b0efd
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000002386b30
ID des fehlerhaften Prozesses: 0x1174
Startzeit der fehlerhaften Anwendung: 0xvncserver.exe0
Pfad der fehlerhaften Anwendung: vncserver.exe1
Pfad des fehlerhaften Moduls: vncserver.exe2
Berichtskennung: vncserver.exe3
Vollständiger Name des fehlerhaften Pakets: vncserver.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: vncserver.exe5

Error: (11/12/2014 07:50:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Service_KMS.exe, Version: 11.0.0.0, Zeitstempel: 0x52a8d15d
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0x00000000
Fehleroffset: 0x00007ffb7a700565
ID des fehlerhaften Prozesses: 0x760
Startzeit der fehlerhaften Anwendung: 0xService_KMS.exe0
Pfad der fehlerhaften Anwendung: Service_KMS.exe1
Pfad des fehlerhaften Moduls: Service_KMS.exe2
Berichtskennung: Service_KMS.exe3
Vollständiger Name des fehlerhaften Pakets: Service_KMS.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Service_KMS.exe5


System errors:
=============
Error: (11/12/2014 09:36:46 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Service KMSELDI" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/12/2014 09:36:39 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (11/12/2014 08:49:53 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "TrueCafe Server" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/12/2014 08:05:56 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Service KMSELDI" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/12/2014 08:05:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (11/12/2014 07:50:17 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Service KMSELDI" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (11/12/2014 07:49:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (11/12/2014 07:49:12 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8007045b fehlgeschlagen: Update für Windows 8.1 für x64-Systeme (KB2976536)

Error: (11/12/2014 07:48:36 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8007045b fehlgeschlagen: Update für Windows 8.1 für x64-Systeme (KB3008627)

Error: (11/12/2014 07:48:36 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8007045b fehlgeschlagen: Sicherheitsupdate für Windows 8.1 für x64-basierte Systeme (KB2992611)


Microsoft Office Sessions:
=========================
Error: (11/12/2014 09:37:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iCloudDrive.exe1.2.34.153d97094ChunkingLibrary.dll163.3.0.153ed5951c000000500018ff413e401cffeb86b26c724C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exeC:\Program Files (x86)\Common Files\Apple\Internet Services\ChunkingLibrary.dlla8ed8d4d-6aab-11e4-bece-3085a94095de

Error: (11/12/2014 09:35:58 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (11/12/2014 08:40:27 PM) (Source: RzOvlMon) (EventID: 0) (User: )
Description: RzOvlMonOpenService failed w/err 0x00000424

Error: (11/12/2014 08:11:26 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: -2147024883

Error: (11/12/2014 08:06:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iCloudDrive.exe1.2.34.153d97094ChunkingLibrary.dll163.3.0.153ed5951c000000500018ff411c001cffeabba06cf10C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exeC:\Program Files (x86)\Common Files\Apple\Internet Services\ChunkingLibrary.dllf7cb32bb-6a9e-11e4-becd-3085a94095de

Error: (11/12/2014 08:00:19 PM) (Source: Perflib) (EventID: 1023) (User: )
Description: rdyboost4

Error: (11/12/2014 07:58:01 PM) (Source: VNC Server) (EventID: 256) (User: )
Description: SDisplayCoreDd-MsgDD error(Failed desktop duplication error -2005270527)

Error: (11/12/2014 07:58:01 PM) (Source: VNC Server) (EventID: 256) (User: )
Description: SDisplayCoreDd-MsgDD error(Failed desktop duplication error -2005270527)

Error: (11/12/2014 07:57:45 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: vncserver.exe5.0.3.37046506b0efdunknown0.0.0.000000000c00000050000000002386b30117401cffea98670bb58C:\Program Files\RealVNC\VNC Server\vncserver.exeunknownc8ed89bd-6a9d-11e4-becc-3085a94095de

Error: (11/12/2014 07:50:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Service_KMS.exe11.0.0.052a8d15dunknown0.0.0.0000000000000000000007ffb7a70056576001cffea974b9e2ecC:\Program Files\KMSpico\Service_KMS.exeunknownbc3a357d-6a9c-11e4-becc-3085a94095de


CodeIntegrity Errors:
===================================
  Date: 2014-11-12 13:22:14.065
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-12 13:22:13.973
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-12 13:22:13.876
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-12 13:22:13.026
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-11 05:22:17.803
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-11 05:22:17.723
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-11 05:22:17.641
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-11 05:22:16.551
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-11 05:22:16.260
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-11-10 04:43:08.729
  Description: Code Integrity determined that a process (\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume2\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3350P CPU @ 3.10GHz
Percentage of memory in use: 50%
Total physical RAM: 8145.97 MB
Available physical RAM: 4059.55 MB
Total Pagefile: 13521.97 MB
Available Pagefile: 10416.26 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:238.13 GB) (Free:74.93 GB) NTFS
Drive h: () (Fixed) (Total:931.51 GB) (Free:37.36 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: AB85628C)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=238.1 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 876C0233)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================

--- --- ---

Bootsektor · 12.11.2014, 22:26

Hallo,

hast du unter C:\ einen Ordner der Zerolocker heisst?

ich hab grad etwas Bauchschmerzen bezüglich der Einträge in den Hosts, die auf nicht legal erworbene Adobe-Produkte hindeuten und KMS welches auf ein nicht legales Office hindeutet.

Die von mir gelisteten Einträge deuten stark darauf hin, dass auf diesem Rechner Software benutzt wird, die nicht legal erworben wurde.

Supportunterbrechung
Cracks und Keygens
Den Kopierschutz von Software zu umgehen ist nach geltendem Recht illegal. Die Logfiles deuten stark darauf hin, dass du nicht legal erworbene Software einsetzt. Zudem sind Cracks und Patches aus dubioser Quelle sehr oft mit Schädlingen versehen, womit man sich also fast vorsätzlich infiziert.

Wir haben uns hier auf dem Board darauf geeinigt, dass wir an dieser Stelle nicht weiter bereinigen, bis diese Software entfernt wurde.
Hinzu kommt, dass wir dich in unserer
Anleitung und auch in diesem Wichtig-Thema unmissverständlich darauf hingewiesen haben, wie wir damit umgehen werden. Saubere, gute Software hat seinen Preis und die Softwarefirmen leben von diesen Einnahmen.

oriepl · 12.11.2014, 22:32

Also mein Office ist mit 100% Sicherheit gekauft, genauso wie das windows 8 - keine ahnung wie du da drauf kommst das ich hier das gecrackt haben sollte.

den ordner in C: gibt es leider nicht

und ich gebe zu das kleingedruckte habe ich nicht gelesen, schließlich will ich nur die fotos von der frau retten die ich vor 3 monaten verloren habe.

Bitte sagt mir einfach was muss ich machen das mir hier weiter geholfen wird.

Bootsektor · 12.11.2014, 22:43

Hallo,

ja, ich kann dich verstehen, deswegen hab ich jetzt ja auch Bauchschmerzen.

Mach die illegalen Sachen von Adobe runter, hast du noch Logs von den Scannern?

oriepl · 12.11.2014, 22:56

hallo,

adobe photoshop ist gekauft, der rest indesign und illustrator nicht um ehrlich zu sein - werde das dann runter geben und nochmals das FRST posten.

Nein keine log files mehr da.

Die waren direkt auf der Maschine per VNC, wie das gehen soll bei dem Passwort das ich vergeben habe keine idee. Jedenfalls habe ich kurz mal zu gesehen was der gemacht der mit dem rechner verbunden war, der wollte dann nochmals das VB Script starten und dann habe ich ihn gekappt.

im netz ist zu dem exe file ja leider nichts zu finden.

und wenn der A..... die fotos auf dem backup server nicht auch encrypted hätte - wäre mir das mehr oder weniger sogar egal - aber die fotos sind das einzige das mir noch geblieben ist und daher bin ich wirklich total verzweifelt.

Bootsektor · 12.11.2014, 23:08

Ja, das verstehe ich, aber abgesehen von den .encrypted hinter den Files habe ich keine Information, was das für ein Verschlüssler sein könnte. Würdest du den Bildschirm mit der Meldung wiedererkennen oder hast du den noch?

oriepl · 12.11.2014, 23:48

den screen habe ich leider nicht mehr - wollte das nur schnell weg haben, das die files encrypted sind habe ich dann erst später gesgehen - würde diesen aber sicher wieder erkenne.

oben stand was mit am 15.11. bzw 72 stunden wird der code vernichtet usw.

darunter eine seite mit botcoin hinweis.

Bootsektor · 12.11.2014, 23:54

Es ist schwierig, ohne genau zu wissen, welcher Verschlüssler da am Werk war, generell stehen die Chancen eher schlecht, zu entschlüsseln ohne zu bezahlen,für einige wenige gibt es mittlerweile Tools.

Der wars nicht, oder?
ZeroLocker - a new destructive encrypting ransomware - News

oriepl · 13.11.2014, 00:00

nein der war es leider nicht - wie gesagt der war direkt auf meinem rechner - keine ahnung was der da getan hat. auf der backup platte ist nur ein teil encrypted leider auch dr alle fotos dabei.

da ich kaum files empfange geschweige den aufmache und schon gar nicht in letzter zeit, kann ich mir da so über email usw. kaum was eingefangen haben.

das ist echt ein tragödie - werde sicher einige fotos von freunden auch wieder bekommen, aber die privaten sind denke ich alle weg - vor allem die wo sie mit unserem sohn drauf ist.

das in der zeit auch noch zu verlieren, ich glaube nicht mehr an die menschheit - wir sind anscheinend echt ein krebsgeschwür das den planeten zerstört und weg gehört :-(

wo kann ich schauen ob ich informationen her bekomme.

wie gesagt das file hat "cryptoapp.exe" geheissen - das war das programm das sich gestartet hat so ein MFC logo war auch dabei. evtl. kann ich das exe file wiederherstellen?

Bootsektor · 13.11.2014, 00:04

Vielleicht haben wir Glück und dort sind noch Schattenkopien auf deinem Rechner.

Gehe mal auf eine von den verschlüsselten Dateien, wähle da dann mit Rechtsklick Eigenschaften, gehe dort in den Reiter Vorgängerversionen und stelle diese wieder her, wähle aber bitte kopieren aus, anstelle von Wiederherstellen.

oriepl · 13.11.2014, 00:15

gibt leider keinen reiter "vorgängerversionen" :-(

hab jetzt mal 10 files mir angesehen, da gibt es das nirgends.

Bootsektor · 13.11.2014, 00:18

Hmm, ja Windows 8.

Dann schauen wir mit dem Shadowexplorer nach:

ShadowExplorer - Download - Filepony

bitte runterladen, installieren und nachschauen

oriepl · 13.11.2014, 00:26

Hallo,

ja da finden sich viele dateien wieder, sind aber alle nur halb zu öffnen - oder lassen sich gar nicht öffnen.

es sind aber einige fotos drinnen die ich brauchen kann und gerade exportiere - pdf's usw. lassen sich aber nicht öffnen.

12.11.2014, 22:43	#6
Bootsektor Ruhe in Frieden † 2019	CryptoApp.exe - .encrypted Files auf Desktop und persönlichen Ordner Hallo, ja, ich kann dich verstehen, deswegen hab ich jetzt ja auch Bauchschmerzen. Mach die illegalen Sachen von Adobe runter, hast du noch Logs von den Scannern? __________________ --> CryptoApp.exe - .encrypted Files auf Desktop und persönlichen Ordner

CryptoApp.exe - .encrypted Files auf Desktop und persönlichen Ordner

Plagegeister aller Art und deren Bekämpfung: CryptoApp.exe - .encrypted Files auf Desktop und persönlichen Ordner