| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Virus hängt an alle Dateien .vvvWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
01.12.2015, 00:31
| #1 |
| |  Virus hängt an alle Dateien .vvv Hallo, mich - meinen Rechner - hat ein Virus erwischt. An alle Word-, Excel- und PDF-Dateien wurde ein .vvv angehängt. Betroffene Dateien sind nicht mehr zu öffnen. jpg- und mp3-Dateien - auf der gleichen Platte, aber eine andere Partition - sind nicht betroffen. Beim Start von zum Beispiel Excel kommt ein englischer Text:All of your files were protected by a strong encryption with RSA-2048. Alle Dateien habe ich auf einer externen Festplatte gesichert, die nach der Sicherung vom System getrennt wurde. Insofern bin ich erst einmal beruhigt. Wäre aber blöd, alles neu aufsetzen zu müssen, da die zwischenzeitlich erstellten Dateien meiner Finanzsoftware (Wiso Mein Geld) weg wären. Ich habe defogger laufen lassen. Es wurde kein Neustart gefordert. Systemscan mit FRST habe ich durchgeführt FRST.txt: Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:30-11-2015
durchgeführt von Ulla & Christian (Administrator) auf PC (01-12-2015 00:13:46)
Gestartet von C:\Users\Ulla & Christian\Downloads
Geladene Profile: Ulla & Christian & (Verfügbare Profile: Ulla & Christian & Jan)
Platform: Windows 8.1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Sicherheit-Ordnung\Avira\AntiVir Desktop\sched.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Sicherheit-Ordnung\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(The OpenVPN Project) C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Sicherheit-Ordnung\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.226\SSScheduler.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Sicherheit-Ordnung\Avira\AntiVir Desktop\avgnt.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpn-gui.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Sicherheit-Ordnung\Avira\AntiVir Desktop\avcenter.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteUser.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [41664 2013-11-20] (Hewlett-Packard )
HKLM\...\Run: [Ocs_SM] => C:\Users\Ulla & Christian\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2013-06-17] (OCS)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-07-27] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-11-20] (IDT, Inc.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Sicherheit-Ordnung\Avira\AntiVir Desktop\avgnt.exe [788176 2015-11-10] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [openvpn-gui] => C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpn-gui.exe [436776 2013-06-14] ()
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [304568 2010-10-12] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [204136 2012-09-12] (Logitech Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-07-27] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3876800203-89553269-3656360523-1001\...\Run: [CCleaner Monitoring] => C:\Program Files (x86)\Sicherheit-Ordnung\CCleaner64.exe [8455960 2015-08-20] (Piriform Ltd)
HKU\S-1-5-21-3876800203-89553269-3656360523-1001\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)
HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [CCleaner Monitoring] => C:\Program Files (x86)\Sicherheit-Ordnung\CCleaner64.exe [8455960 2015-08-20] (Piriform Ltd)
HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-11-15]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.226\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\how_recover+yer.html [2015-11-29] ()
Startup: C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\how_recover+yer.txt [2015-11-29] ()
GroupPolicyUsers\S-1-5-21-3876800203-89553269-3656360523-1003\User: Beschränkung <======= ACHTUNG
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{82DFC5A4-518D-445C-A2B1-591A6747A3D5}: [DhcpNameServer] 192.168.103.1 192.168.103.20
Tcpip\..\Interfaces\{B56279DC-0CCA-4C4C-8F65-B5B765D59070}: [DhcpNameServer] 192.168.2.1
Internet Explorer:
==================
HKU\S-1-5-21-3876800203-89553269-3656360523-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK13/4
HKU\S-1-5-21-3876800203-89553269-3656360523-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com
HKU\S-1-5-21-3876800203-89553269-3656360523-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK13/4
HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bing.com
HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
HKU\S-1-5-21-3876800203-89553269-3656360523-1003-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPDSK13/4
HKU\S-1-5-21-3876800203-89553269-3656360523-1003-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPDSK13/4
HKU\S-1-5-21-3876800203-89553269-3656360523-1003-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK13/4
URLSearchHook: [S-1-5-21-3876800203-89553269-3656360523-1003-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0] ACHTUNG => Standard URLSearchHook fehlt
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {471E55EA-5870-4D06-85B1-087E723116A4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {471E55EA-5870-4D06-85B1-087E723116A4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001 -> {0376A5AC-5698-4CFB-BF5B-1A12FE88CE17} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=8106a2b4-3f40-4652-b50f-5ed672b28841&pid=fotofreeware&mode=bounce&k=0
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001 -> {2B9277F9-9AFF-4BE1-8D9F-5C47ACDE8AF9} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=8106a2b4-3f40-4652-b50f-5ed672b28841&pid=fotofreeware&mode=bounce&k=0
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001 -> {471E55EA-5870-4D06-85B1-087E723116A4} URL = hxxp://www.amazon.de.anonymize-me.de/?anonymto=687474703A2F2F7777772E616D617A6F6E2E64652F732F7265663D617A735F6F73645F69656164653F69653D5554462D38267461673D68702D6465312D7673622D3231266C696E6B253546636F64653D717326696E6465783D617073266669656C642D6B6579776F7264733D7B7365617263685465726D737D&st={searchTerms}&clid=8106a2b4-3f40-4652-b50f-5ed672b28841&pid=fotofreeware&k=0
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001 -> {68DA0295-7A32-4CC5-A929-A2513D7186F0} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=8106a2b4-3f40-4652-b50f-5ed672b28841&pid=fotofreeware&mode=bounce&k=0
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001 -> {B52B0020-6410-4905-8380-4EED9883BE80} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=8106a2b4-3f40-4652-b50f-5ed672b28841&pid=fotofreeware&mode=bounce&k=0
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com.anonymize-me.de/?anonymto=687474703A2F2F726F7665722E656261792E636F6D2F726F7665722F312F3730372D3135343334352D31323132382D322F34203F6D7072653D687474702533412532462532467777772E656261792E636F6D2532467363682532462533465F6E6B772533447B7365617263685465726D737D266B6579776F72643D7B7365617263685465726D737D&st={searchTerms}&clid=8106a2b4-3f40-4652-b50f-5ed672b28841&pid=fotofreeware&k=0
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001 -> {F2109080-1672-4F41-BDB0-B480859F3699} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {0376A5AC-5698-4CFB-BF5B-1A12FE88CE17} URL = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=8106a2b4-3f40-4652-b50f-5ed672b28841&pid=fotofreeware&mode=bounce&k=0
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {2B9277F9-9AFF-4BE1-8D9F-5C47ACDE8AF9} URL = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=8106a2b4-3f40-4652-b50f-5ed672b28841&pid=fotofreeware&mode=bounce&k=0
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {471E55EA-5870-4D06-85B1-087E723116A4} URL = hxxp://www.amazon.de.anonymize-me.de/?anonymto=687474703A2F2F7777772E616D617A6F6E2E64652F732F7265663D617A735F6F73645F69656164653F69653D5554462D38267461673D68702D6465312D7673622D3231266C696E6B253546636F64653D717326696E6465783D617073266669656C642D6B6579776F7264733D7B7365617263685465726D737D&st={searchTerms}&clid=8106a2b4-3f40-4652-b50f-5ed672b28841&pid=fotofreeware&k=0
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {68DA0295-7A32-4CC5-A929-A2513D7186F0} URL = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=8106a2b4-3f40-4652-b50f-5ed672b28841&pid=fotofreeware&mode=bounce&k=0
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {B52B0020-6410-4905-8380-4EED9883BE80} URL = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=8106a2b4-3f40-4652-b50f-5ed672b28841&pid=fotofreeware&mode=bounce&k=0
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com.anonymize-me.de/?anonymto=687474703A2F2F726F7665722E656261792E636F6D2F726F7665722F312F3730372D3135343334352D31323132382D322F34203F6D7072653D687474702533412532462532467777772E656261792E636F6D2532467363682532462533465F6E6B772533447B7365617263685465726D737D266B6579776F72643D7B7365617263685465726D737D&st={searchTerms}&clid=8106a2b4-3f40-4652-b50f-5ed672b28841&pid=fotofreeware&k=0
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {F2109080-1672-4F41-BDB0-B480859F3699} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1003-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0 -> {471E55EA-5870-4D06-85B1-087E723116A4} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3876800203-89553269-3656360523-1003-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-154345-12128-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-28] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-28] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-3876800203-89553269-3656360523-1001 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Keine Datei
Toolbar: HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Keine Datei
Handler-x32: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL [1999-02-03] (Microsoft Corporation)
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2010-10-12] (Citrix Systems, Inc.)
FireFox:
========
FF ProfilePath: C:\Users\Ulla & Christian\AppData\Roaming\Mozilla\Firefox\Profiles\7shvkqc1.default
FF SelectedSearchEngine: Bing
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-10] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files (x86)\Filme - Video\VLC\npvlc.dll [2012-06-28] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-10] ()
FF Plugin-x32: @ei.UtilityChest_49.com/Plugin -> C:\Program Files (x86)\UtilityChest_49EI\Installr\1.bin\NP49EISB.dll [2013-07-02] (Utility Chest)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Bilder\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-28] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-28] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-07-28] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-08-29] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-08-29] (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3876800203-89553269-3656360523-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Ulla & Christian\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll [2013-05-22] (Amazon.com, Inc.)
FF Plugin HKU\S-1-5-21-3876800203-89553269-3656360523-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Ulla & Christian\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll [2013-05-22] (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll [2010-10-12] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\cgpcfg.dll [2010-10-12] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll [2010-10-12] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll [2010-10-12] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll [2010-10-12] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ctxmui.dll [2010-10-12] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\icafile.dll [2010-10-12] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\icalogon.dll [2010-10-12] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll [2010-10-12] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2013-12-21] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\sslsdk_b.dll [2010-07-14] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll [2010-10-12] (Citrix Systems, Inc.)
FF SearchPlugin: C:\Users\Ulla & Christian\AppData\Roaming\Mozilla\Firefox\Profiles\7shvkqc1.default\searchplugins\how_recover+yer.html [2015-11-29]
FF SearchPlugin: C:\Users\Ulla & Christian\AppData\Roaming\Mozilla\Firefox\Profiles\7shvkqc1.default\searchplugins\how_recover+yer.txt [2015-11-29]
FF Extension: Shrunked Image Resizer - C:\Users\Ulla & Christian\AppData\Roaming\Mozilla\Firefox\Profiles\7shvkqc1.default\extensions\shrunked@darktrojan.net.xpi [2015-09-14]
FF Extension: Avira Browser Safety - C:\Users\Ulla & Christian\AppData\Roaming\Mozilla\Firefox\Profiles\7shvkqc1.default\Extensions\abs@avira.com [2015-11-29] [ist nicht signiert]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [43112 2012-02-16] (ArcSoft Inc.)
S2 AntiVirMailService; C:\Program Files (x86)\Sicherheit-Ordnung\Avira\AntiVir Desktop\avmailc7.exe [936544 2015-11-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Sicherheit-Ordnung\Avira\AntiVir Desktop\sched.exe [466408 2015-11-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Sicherheit-Ordnung\Avira\AntiVir Desktop\avguard.exe [466408 2015-11-10] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Sicherheit-Ordnung\Avira\AntiVir Desktop\avwebg7.exe [1105952 2015-11-10] (Avira Operations GmbH & Co. KG)
S3 DfSdkS; C:\Program Files (x86)\Ashampoo\Ashampoo WinOptimizer 2015\DfsdkS64.exe [544768 2009-08-24] (mst software GmbH, Germany) [Datei ist nicht signiert]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [Datei ist nicht signiert]
R2 HPConnectedRemote; c:\Program Files (x86)\Hewlett-Packard\HP Connected Remote\HPConnectedRemoteService.exe [35744 2012-10-12] (Hewlett-Packard)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.226\McCHSvc.exe [289256 2015-10-30] (McAfee, Inc.)
S3 OpenVPNService; C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe [59432 2013-06-14] (The OpenVPN Project)
R2 OpenVPNServiceInteractive; C:\Program Files (x86)\Sophos\Sophos SSL VPN Client\bin\openvpnserv.exe [59432 2013-06-14] (The OpenVPN Project)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [339456 2013-11-20] (IDT, Inc.) [Datei ist nicht signiert]
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248736 2014-12-17] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R0 ambakdrv; C:\Windows\System32\ambakdrv.sys [30648 2013-04-27] () [Datei ist nicht signiert]
R2 ammntdrv; C:\windows\system32\ammntdrv.sys [151480 2013-04-27] () [Datei ist nicht signiert]
R2 amwrtdrv; C:\windows\system32\amwrtdrv.sys [17848 2013-02-06] () [Datei ist nicht signiert]
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [137800 2015-09-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [148632 2015-08-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [74440 2015-09-23] (Avira Operations GmbH & Co. KG)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-12-01 00:11 - 2015-12-01 00:11 - 00000000 _____ C:\Users\Ulla & Christian\defogger_reenable
2015-12-01 00:10 - 2015-12-01 00:10 - 00050477 _____ C:\Users\Ulla & Christian\Downloads\Defogger.exe
2015-11-30 23:21 - 2015-12-01 00:10 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-11-30 23:21 - 2015-11-30 23:49 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-11-30 23:21 - 2015-11-30 23:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-11-30 23:19 - 2015-11-30 23:49 - 00109272 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-11-30 23:19 - 2015-11-30 23:19 - 00000000 ____D C:\Malwarebytes
2015-11-30 23:18 - 2015-11-30 23:18 - 16563352 _____ (Malwarebytes Corp.) C:\Users\Ulla & Christian\Downloads\mbar-1.09.3.1001.exe
2015-11-30 23:06 - 2015-11-30 23:07 - 00053534 _____ C:\Users\Ulla & Christian\Downloads\Addition.txt
2015-11-30 23:05 - 2015-12-01 00:13 - 00030188 _____ C:\Users\Ulla & Christian\Downloads\FRST.txt
2015-11-30 23:05 - 2015-12-01 00:13 - 00000000 ____D C:\FRST
2015-11-30 23:04 - 2015-11-30 23:04 - 02350080 _____ (Farbar) C:\Users\Ulla & Christian\Downloads\FRST64(1).exe
2015-11-30 23:02 - 2015-11-30 23:02 - 02350080 _____ (Farbar) C:\Users\Ulla & Christian\Downloads\FRST64.exe
2015-11-30 13:54 - 2015-11-30 13:56 - 00000050 _____ C:\Users\Ulla & Christian\AppData\Roaming\AVSDVDPlayer.m3u
2015-11-30 13:54 - 2015-11-30 13:55 - 00000000 ___HD C:\$WINDOWS.~BT
2015-11-29 22:45 - 2015-11-29 22:45 - 00024261 _____ C:\Users\Ulla & Christian\Downloads\RX_151129_Bestellbestaetigung_VID3_2245.pdf
2015-11-29 21:46 - 2015-11-29 21:46 - 00006921 _____ C:\WINDOWS\Tasks\how_recover+yer.html
2015-11-29 21:46 - 2015-11-29 21:46 - 00002401 _____ C:\WINDOWS\Tasks\how_recover+yer.txt
2015-11-29 21:45 - 2015-11-29 21:45 - 00006921 _____ C:\Users\Ulla & Christian\how_recover+yer.html
2015-11-29 21:45 - 2015-11-29 21:45 - 00002401 _____ C:\Users\Ulla & Christian\how_recover+yer.txt
2015-11-29 21:33 - 2015-11-29 21:34 - 00006921 _____ C:\Users\Ulla & Christian\Documents\how_recover+yer.html
2015-11-29 21:33 - 2015-11-29 21:34 - 00002401 _____ C:\Users\Ulla & Christian\Documents\how_recover+yer.txt
2015-11-29 21:33 - 2015-11-29 21:33 - 00006921 _____ C:\Users\Ulla & Christian\Downloads\how_recover+yer.html
2015-11-29 21:33 - 2015-11-29 21:33 - 00002401 _____ C:\Users\Ulla & Christian\Downloads\how_recover+yer.txt
2015-11-29 21:26 - 2015-11-29 21:26 - 00006921 _____ C:\Users\Ulla & Christian\AppData\how_recover+yer.html
2015-11-29 21:26 - 2015-11-29 21:26 - 00002401 _____ C:\Users\Ulla & Christian\AppData\how_recover+yer.txt
2015-11-29 21:25 - 2015-11-29 21:45 - 00006921 _____ C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\how_recover+yer.html
2015-11-29 21:25 - 2015-11-29 21:45 - 00002401 _____ C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\how_recover+yer.txt
2015-11-29 21:25 - 2015-11-29 21:25 - 00006921 _____ C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\how_recover+yer.html
2015-11-29 21:25 - 2015-11-29 21:25 - 00006921 _____ C:\Users\Ulla & Christian\AppData\LocalLow\how_recover+yer.html
2015-11-29 21:25 - 2015-11-29 21:25 - 00002401 _____ C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\how_recover+yer.txt
2015-11-29 21:25 - 2015-11-29 21:25 - 00002401 _____ C:\Users\Ulla & Christian\AppData\LocalLow\how_recover+yer.txt
2015-11-29 21:23 - 2015-11-29 21:34 - 00006921 _____ C:\Users\Ulla & Christian\AppData\Local\how_recover+yer.html
2015-11-29 21:23 - 2015-11-29 21:34 - 00002401 _____ C:\Users\Ulla & Christian\AppData\Local\how_recover+yer.txt
2015-11-29 21:23 - 2015-11-29 21:26 - 00006921 _____ C:\Users\Ulla & Christian\AppData\Roaming\how_recover+yer.html
2015-11-29 21:23 - 2015-11-29 21:26 - 00002401 _____ C:\Users\Ulla & Christian\AppData\Roaming\how_recover+yer.txt
2015-11-29 21:23 - 2015-11-29 21:23 - 00006921 _____ C:\Users\Ulla & Christian\AppData\Local\Apps\how_recover+yer.html
2015-11-29 21:23 - 2015-11-29 21:23 - 00006921 _____ C:\Users\Public\how_recover+yer.html
2015-11-29 21:23 - 2015-11-29 21:23 - 00006921 _____ C:\Users\Public\Downloads\how_recover+yer.html
2015-11-29 21:23 - 2015-11-29 21:23 - 00002401 _____ C:\Users\Ulla & Christian\AppData\Local\Apps\how_recover+yer.txt
2015-11-29 21:23 - 2015-11-29 21:23 - 00002401 _____ C:\Users\Public\how_recover+yer.txt
2015-11-29 21:23 - 2015-11-29 21:23 - 00002401 _____ C:\Users\Public\Downloads\how_recover+yer.txt
2015-11-29 21:21 - 2015-11-29 21:23 - 00006921 _____ C:\Users\Public\Documents\how_recover+yer.html
2015-11-29 21:21 - 2015-11-29 21:23 - 00006921 _____ C:\ProgramData\how_recover+yer.html
2015-11-29 21:21 - 2015-11-29 21:23 - 00002401 _____ C:\Users\Public\Documents\how_recover+yer.txt
2015-11-29 21:21 - 2015-11-29 21:23 - 00002401 _____ C:\ProgramData\how_recover+yer.txt
2015-11-29 21:19 - 2015-11-29 21:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2015-11-29 21:19 - 2015-11-29 21:19 - 00000000 ____D C:\Program Files (x86)\7-Zip
2015-11-29 21:18 - 2015-11-29 21:18 - 01466656 _____ C:\Users\Ulla & Christian\Downloads\7 Zip 32 Bit - CHIP-Installer.exe
2015-11-29 21:16 - 2015-11-29 21:26 - 00000670 _____ C:\Users\Ulla & Christian\Documents\recover_file_jkvrflnqu.txt.vvv
2015-11-28 23:24 - 2015-11-28 23:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in
2015-11-28 23:22 - 2015-10-22 18:43 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\kbdgeoqw.dll
2015-11-28 23:22 - 2015-10-22 18:43 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDAZST.DLL
2015-11-28 23:22 - 2015-10-22 18:43 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDAZEL.DLL
2015-11-28 23:22 - 2015-10-22 18:43 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDAZE.DLL
2015-11-28 23:22 - 2015-10-22 17:59 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kbdgeoqw.dll
2015-11-28 23:22 - 2015-10-22 17:59 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDAZST.DLL
2015-11-28 23:22 - 2015-10-22 17:59 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDAZEL.DLL
2015-11-28 23:22 - 2015-10-22 17:59 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDAZE.DLL
2015-11-28 23:22 - 2015-10-22 17:21 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll
2015-11-28 23:22 - 2015-10-22 17:21 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll
2015-11-28 23:22 - 2015-10-22 16:58 - 00868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll
2015-11-28 23:22 - 2015-10-22 16:58 - 00200704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GlobCollationHost.dll
2015-11-28 23:22 - 2015-10-22 15:08 - 00513456 _____ C:\WINDOWS\SysWOW64\locale.nls
2015-11-28 23:22 - 2015-10-22 15:08 - 00513456 _____ C:\WINDOWS\system32\locale.nls
2015-11-28 23:22 - 2015-01-06 04:01 - 00072192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndproxy.sys
2015-11-28 23:22 - 2015-01-06 03:59 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wanarp.sys
2015-11-28 23:22 - 2015-01-06 02:12 - 00185856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascfg.dll
2015-11-28 23:22 - 2015-01-06 02:02 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rascfg.dll
2015-11-28 23:21 - 2015-10-11 07:34 - 00468824 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2015-11-28 23:21 - 2015-10-11 07:34 - 00462168 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2015-11-28 23:21 - 2015-10-11 07:34 - 00443224 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbport.sys
2015-11-28 23:21 - 2015-10-11 07:34 - 00092504 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbehci.sys
2015-11-28 23:21 - 2015-10-11 07:34 - 00027992 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbd.sys
2015-11-28 23:21 - 2015-10-10 19:41 - 00037376 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbuhci.sys
2015-11-28 23:21 - 2015-10-10 19:41 - 00030208 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbohci.sys
2015-11-28 23:21 - 2015-10-10 19:40 - 00078848 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winusb.sys
2015-11-28 23:21 - 2015-10-10 18:20 - 00186880 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll
2015-11-28 23:21 - 2015-10-08 17:11 - 00060928 _____ (Microsoft Corporation) C:\WINDOWS\system32\PCPKsp.dll
2015-11-28 23:21 - 2015-10-08 16:50 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PCPKsp.dll
2015-11-28 23:21 - 2015-10-05 19:28 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininit.exe
2015-11-28 23:21 - 2015-10-05 19:25 - 00572928 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2015-11-28 23:21 - 2015-10-03 20:41 - 01385280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2015-11-28 23:21 - 2015-10-03 20:41 - 01124384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2015-11-28 23:21 - 2015-09-28 19:31 - 02775552 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2015-11-28 23:21 - 2015-09-28 19:24 - 02462720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2015-11-28 23:21 - 2015-05-01 02:13 - 06521800 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2015-11-28 23:21 - 2015-05-01 02:13 - 01488000 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll
2015-11-28 23:21 - 2015-05-01 02:13 - 00261376 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppwinob.dll
2015-11-28 22:23 - 2015-11-28 22:23 - 14108096 _____ (Citrix Systems, Inc.) C:\Users\Ulla & Christian\Downloads\CitrixOnlinePluginWeb(3).exe
2015-11-25 23:20 - 2015-11-25 23:23 - 88173384 _____ (Buhl Data Service GmbH) C:\Users\Ulla & Christian\Downloads\WISOFinanz2016.exe
2015-11-23 07:26 - 2015-11-29 21:25 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\DataDesign
2015-11-22 17:53 - 2015-11-22 17:54 - 14108096 _____ (Citrix Systems, Inc.) C:\Users\Ulla & Christian\Downloads\CitrixOnlinePluginWeb(2).exe
2015-11-18 20:20 - 2015-11-18 20:20 - 00000000 ____D C:\Users\Jan\AppData\Roaming\HpUpdate
2015-11-15 17:06 - 2015-11-15 17:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2015-11-15 17:06 - 2015-11-15 17:06 - 00000000 ____D C:\Program Files\McAfee Security Scan
2015-11-14 17:17 - 2015-11-30 23:51 - 00008510 _____ C:\WINDOWS\System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl
2015-11-10 23:24 - 2015-11-10 23:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-11-10 19:37 - 2015-10-31 00:46 - 25818624 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-11-10 19:37 - 2015-10-31 00:25 - 02886656 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-11-10 19:37 - 2015-10-31 00:24 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-11-10 19:37 - 2015-10-31 00:11 - 05990912 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-11-10 19:37 - 2015-10-31 00:11 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-11-10 19:37 - 2015-10-30 23:52 - 20331520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-11-10 19:37 - 2015-10-30 23:47 - 00504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-11-10 19:37 - 2015-10-30 23:42 - 02279936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-11-10 19:37 - 2015-10-30 23:39 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-11-10 19:37 - 2015-10-30 23:36 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-11-10 19:37 - 2015-10-30 23:32 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-11-10 19:37 - 2015-10-30 23:31 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-11-10 19:37 - 2015-10-30 23:22 - 14457856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-11-10 19:37 - 2015-10-30 23:17 - 02487808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-11-10 19:37 - 2015-10-30 23:16 - 04527616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-11-10 19:37 - 2015-10-30 23:14 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-11-10 19:37 - 2015-10-30 23:10 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-11-10 19:37 - 2015-10-30 23:09 - 12854272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-11-10 19:37 - 2015-10-30 23:04 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-11-10 19:37 - 2015-10-30 22:53 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-11-10 19:37 - 2015-10-30 22:51 - 02011136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-11-10 19:37 - 2015-10-30 22:48 - 01311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-11-10 19:37 - 2015-10-30 22:46 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-11-10 19:35 - 2015-10-20 22:54 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-11-10 19:35 - 2015-10-20 15:53 - 03705856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-11-10 19:35 - 2015-10-20 15:36 - 02243072 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-11-10 19:35 - 2015-10-20 15:35 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-11-10 19:35 - 2015-10-20 15:34 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-11-10 19:35 - 2015-10-20 15:34 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-11-10 19:35 - 2015-10-20 15:34 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-11-10 19:35 - 2015-10-20 15:33 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-11-10 19:35 - 2015-10-20 15:14 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-11-10 19:35 - 2015-10-20 15:13 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-11-10 19:35 - 2015-10-20 15:13 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-11-10 19:35 - 2015-10-20 15:13 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-11-10 19:35 - 2015-10-15 17:08 - 00990208 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-11-10 19:35 - 2015-10-15 16:46 - 00803328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-11-10 19:35 - 2015-10-15 00:02 - 07455064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-11-10 19:35 - 2015-10-15 00:02 - 01659560 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2015-11-10 19:35 - 2015-10-15 00:02 - 01519592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2015-11-10 19:35 - 2015-10-15 00:02 - 01487008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2015-11-10 19:35 - 2015-10-15 00:02 - 01355848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2015-11-10 19:35 - 2015-10-13 18:10 - 00559616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2015-11-10 19:35 - 2015-10-13 18:10 - 00108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
2015-11-10 19:35 - 2015-10-13 16:59 - 00397224 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2015-11-10 19:35 - 2015-10-13 16:59 - 00340872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2015-11-10 19:35 - 2015-10-13 16:59 - 00137960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncrypt.dll
2015-11-10 19:35 - 2015-10-13 16:59 - 00120376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncrypt.dll
2015-11-10 19:35 - 2015-10-13 16:59 - 00106952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptsslp.dll
2015-11-10 19:35 - 2015-10-13 16:59 - 00091416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptsslp.dll
2015-11-10 19:35 - 2015-10-11 07:36 - 00561952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-11-10 19:35 - 2015-10-11 07:36 - 00177496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-11-10 19:35 - 2015-10-10 19:40 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2015-11-10 19:35 - 2015-10-10 19:39 - 00401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2015-11-10 19:35 - 2015-10-10 19:07 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-11-10 19:35 - 2015-10-10 18:33 - 01441280 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-11-10 19:35 - 2015-10-10 18:27 - 00432640 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-11-10 19:35 - 2015-10-10 18:11 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-11-10 19:35 - 2015-10-10 17:45 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-11-10 19:35 - 2015-09-29 13:24 - 00155480 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tpm.sys
2015-11-10 19:35 - 2015-09-12 14:47 - 00414559 _____ C:\WINDOWS\system32\ApnDatabase.xml
2015-11-10 19:35 - 2015-09-07 17:22 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2015-11-10 19:35 - 2015-09-07 16:54 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2015-11-10 19:35 - 2015-09-07 16:30 - 01091584 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2015-11-10 19:35 - 2015-09-04 20:24 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tunnel.sys
2015-11-10 19:35 - 2015-08-28 23:20 - 00183368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AuthHost.exe
2015-11-10 19:35 - 2015-08-20 21:45 - 01380048 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2015-11-10 19:35 - 2015-08-20 18:48 - 01096704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2015-11-10 19:30 - 2015-10-17 15:19 - 04176384 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-11-10 19:30 - 2015-10-08 17:08 - 01083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2015-11-10 19:30 - 2015-08-10 19:15 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2015-11-10 19:30 - 2015-08-10 19:06 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2015-11-10 19:30 - 2015-08-10 18:49 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2015-11-10 19:30 - 2015-08-10 17:56 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2015-11-10 19:30 - 2015-08-10 17:46 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2015-11-07 18:17 - 2015-11-07 18:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warships
2015-11-07 18:14 - 2015-11-07 18:14 - 07369576 _____ (Wargaming.net ) C:\Users\Ulla & Christian\Downloads\WoWS_internet_install_eu.exe
2015-11-07 15:58 - 2015-11-07 22:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-11-06 12:48 - 2015-11-06 12:49 - 14108096 _____ (Citrix Systems, Inc.) C:\Users\Ulla & Christian\Downloads\CitrixOnlinePluginWeb(1).exe
2015-11-03 13:42 - 2015-11-29 21:23 - 00000000 ____D C:\Users\Ulla & Christian\.android
2015-11-03 13:41 - 2015-11-29 21:25 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\MyPhoneExplorer
2015-11-03 13:41 - 2015-11-03 13:41 - 00002078 _____ C:\Users\Public\Desktop\MyPhoneExplorer.lnk
2015-11-03 13:41 - 2015-11-03 13:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPhoneExplorer
2015-11-03 13:41 - 2015-11-03 13:41 - 00000000 ____D C:\Program Files (x86)\MyPhoneExplorer
2015-11-03 13:39 - 2015-11-03 13:39 - 01466656 _____ C:\Users\Ulla & Christian\Downloads\MyPhoneExplorer - CHIP-Installer(1).exe
2015-11-03 13:37 - 2015-11-03 13:38 - 01466656 _____ C:\Users\Ulla & Christian\Downloads\MyPhoneExplorer - CHIP-Installer.exe
2015-11-02 11:28 - 2015-11-02 11:28 - 00000383 _____ C:\ftconfig.ini
2015-11-01 22:19 - 2015-11-29 21:33 - 00392270 _____ C:\Users\Ulla & Christian\Downloads\10984200_908781199162434_4585968420000991718_o.jpg.vvv
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-12-01 00:11 - 2014-11-27 07:27 - 00000000 ____D C:\Users\Ulla & Christian
2015-11-30 23:59 - 2013-09-12 20:04 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-11-30 23:51 - 2014-09-24 07:17 - 01989598 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-11-30 23:51 - 2014-09-24 06:43 - 00844836 _____ C:\WINDOWS\system32\perfh007.dat
2015-11-30 23:51 - 2014-09-24 06:43 - 00192568 _____ C:\WINDOWS\system32\perfc007.dat
2015-11-30 23:51 - 2013-08-22 14:36 - 00000000 ____D C:\WINDOWS\Inf
2015-11-30 23:45 - 2014-11-27 07:21 - 00000000 ____D C:\ProgramData\NVIDIA
2015-11-30 23:45 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\ADFS
2015-11-30 23:45 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-11-30 23:45 - 2013-08-22 15:44 - 00505968 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-11-30 23:44 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-11-30 23:06 - 2013-08-22 14:36 - 00000000 ____D C:\Windows
2015-11-30 13:55 - 2014-11-27 07:18 - 00000000 ___DC C:\WINDOWS\Panther
2015-11-30 13:14 - 2013-06-16 20:58 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3876800203-89553269-3656360523-1001
2015-11-29 21:46 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\tracing
2015-11-29 21:46 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\SysWOW64\FxsTmp
2015-11-29 21:45 - 2014-08-31 18:37 - 00000000 ___RD C:\Users\Ulla & Christian\SkyDrive
2015-11-29 21:45 - 2013-06-16 20:51 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\VirtualStore
2015-11-29 21:34 - 2015-09-03 14:21 - 00000000 ____D C:\Users\Ulla & Christian\Neuer Ordner (2)
2015-11-29 21:34 - 2015-04-04 14:47 - 00000000 ____D C:\Users\Ulla & Christian\Neuer Ordner
2015-11-29 21:34 - 2013-10-05 10:52 - 00000000 ___RD C:\Users\Ulla & Christian\Dropbox
2015-11-29 21:34 - 2013-06-25 13:22 - 00000000 ____D C:\Users\Ulla & Christian\Mozilla Thunderbird
2015-11-29 21:33 - 2015-10-28 22:39 - 00113870 _____ C:\Users\Ulla & Christian\Downloads\ZIAUFEIN_gquatybzpgcfmcaexqtkhxyk6abcs.pdf.vvv
2015-11-29 21:33 - 2015-10-28 22:31 - 00020558 _____ C:\Users\Ulla & Christian\Downloads\_14576829_KuendigungsbestaetigungneuerLieferant_20151027_408d6e5b9a03c91b25785313609ad7d0.pdf.vvv
2015-11-29 21:33 - 2015-10-28 22:24 - 00021150 _____ C:\Users\Ulla & Christian\Downloads\_122679474_KuendigungsbestaetigungneuerLieferant_20151027_16f7742108956c86b068dca1a61d62c6.pdf.vvv
2015-11-29 21:33 - 2015-10-28 22:20 - 00566430 _____ C:\Users\Ulla & Christian\Downloads\005056881A0F1EE59F995BDDE2AF0EF0.pdf.vvv
2015-11-29 21:33 - 2015-10-25 12:55 - 01781646 _____ C:\Users\Ulla & Christian\Downloads\Ahnenblatt-Handbuch.pdf.vvv
2015-11-29 21:33 - 2015-09-28 21:21 - 00451534 _____ C:\Users\Ulla & Christian\Downloads\320.pdf.vvv
2015-11-29 21:33 - 2015-09-20 20:07 - 00313454 _____ C:\Users\Ulla & Christian\Downloads\_14576829_Preisinformation_20150908_005df263fe16be59a1e07e1fd8a76672.pdf.vvv
2015-11-29 21:33 - 2015-09-13 12:54 - 00122526 _____ C:\Users\Ulla & Christian\Downloads\2390_499_1.PDF.vvv
2015-11-29 21:33 - 2015-09-13 12:32 - 00114462 _____ C:\Users\Ulla & Christian\Downloads\2390_493_1.PDF.vvv
2015-11-29 21:33 - 2015-08-15 23:11 - 00000000 ____D C:\Users\Ulla & Christian\Downloads\Lacey
2015-11-29 21:33 - 2015-08-15 22:19 - 09891454 _____ C:\Users\Ulla & Christian\Downloads\freemusicdownloader_1-59.zip.vvv
2015-11-29 21:33 - 2015-05-17 20:41 - 00030910 _____ C:\Users\Ulla & Christian\Downloads\RS9823838721(1).pdf.vvv
2015-11-29 21:33 - 2015-05-17 20:38 - 00030910 _____ C:\Users\Ulla & Christian\Downloads\RS9823838721.pdf.vvv
2015-11-29 21:33 - 2015-04-11 15:42 - 00178222 _____ C:\Users\Ulla & Christian\Downloads\rlmpdf.pdf.vvv
2015-11-29 21:33 - 2015-03-06 20:40 - 00984990 _____ C:\Users\Ulla & Christian\Downloads\Bedarfsfeldbroschuere_Vermoegen_anlegen_VR.pdf.vvv
2015-11-29 21:33 - 2015-01-09 23:24 - 01414318 _____ C:\Users\Ulla & Christian\Downloads\Syno_QIG_2bay2_deu.pdf.vvv
2015-11-29 21:33 - 2014-12-26 20:27 - 30247390 _____ C:\Users\Ulla & Christian\Downloads\TL-WN851ND_V1_110114.zip.vvv
2015-11-29 21:33 - 2014-12-26 20:27 - 11537854 _____ C:\Users\Ulla & Christian\Downloads\TL-WN851ND_V1_Utility99.zip.vvv
2015-11-29 21:33 - 2014-12-26 20:26 - 21632238 _____ C:\Users\Ulla & Christian\Downloads\TL-WN851ND_v1_110825.zip.vvv
2015-11-29 21:33 - 2014-12-21 14:12 - 00027790 _____ C:\Users\Ulla & Christian\Downloads\RX_141221_Bestellbestaetigung_VID616_1412.pdf.vvv
2015-11-29 21:33 - 2014-11-23 21:39 - 00039278 _____ C:\Users\Ulla & Christian\Downloads\_14576829_Lieferbestaetigung_20141121_df4db33247be1b6428d8ec0eb7955911.pdf.vvv
2015-11-29 21:33 - 2014-10-25 22:41 - 00000000 ____D C:\Users\Ulla & Christian\Downloads\Gameforge Live
2015-11-29 21:33 - 2014-08-03 12:06 - 00225342 _____ C:\Users\Ulla & Christian\Downloads\testresultate_farbspruehgeraete.pdf.vvv
2015-11-29 21:33 - 2014-07-28 19:47 - 00916606 _____ C:\Users\Ulla & Christian\Downloads\flexibrass.pdf.vvv
2015-11-29 21:33 - 2014-05-27 19:08 - 00342942 _____ C:\Users\Ulla & Christian\Downloads\IMM1294E.PDF.vvv
2015-11-29 21:33 - 2014-05-27 18:54 - 01053998 _____ C:\Users\Ulla & Christian\Downloads\custodian-parent(1).pdf.vvv
2015-11-29 21:33 - 2014-05-10 14:46 - 00239358 _____ C:\Users\Ulla & Christian\Downloads\document.pdf.vvv
2015-11-29 21:33 - 2014-05-04 12:08 - 01053998 _____ C:\Users\Ulla & Christian\Downloads\custodian-parent.pdf.vvv
2015-11-29 21:33 - 2014-02-13 22:20 - 00078174 _____ C:\Users\Ulla & Christian\Downloads\identificationAstIdent.PDF.vvv
2015-11-29 21:33 - 2013-12-21 20:55 - 00001150 _____ C:\Users\Ulla & Christian\Downloads\umsatz-5232________0800-20131221.csv.vvv
2015-11-29 21:33 - 2013-12-01 19:02 - 00000000 ____D C:\Users\Ulla & Christian\Documents\SelfMV
2015-11-29 21:33 - 2013-10-05 20:18 - 00000000 ____D C:\Users\Ulla & Christian\Documents\Turbo Lister
2015-11-29 21:33 - 2013-07-25 15:22 - 00000000 ___RD C:\Users\Ulla & Christian\Documents\Scanned Documents
2015-11-29 21:33 - 2013-07-12 21:07 - 00509358 _____ C:\Users\Ulla & Christian\Downloads\15875_1373659579.pdf.vvv
2015-11-29 21:33 - 2013-07-12 21:05 - 00103934 _____ C:\Users\Ulla & Christian\Downloads\versicherungsbedingungen_indiv_praktikum.pdf.vvv
2015-11-29 21:33 - 2013-07-03 22:32 - 00000000 ____D C:\Users\Ulla & Christian\Documents\Volition
2015-11-29 21:33 - 2013-06-30 13:26 - 00000000 ____D C:\Users\Ulla & Christian\Documents\Turbo Lister Backup
2015-11-29 21:33 - 2013-06-23 12:08 - 00000000 ____D C:\Users\Ulla & Christian\Documents\WISO Mein Geld
2015-11-29 21:33 - 2013-06-17 21:43 - 00000000 ____D C:\Users\Ulla & Christian\Documents\samsung
2015-11-29 21:26 - 2014-11-17 00:01 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\WorldofTanks
2015-11-29 21:26 - 2014-08-17 16:22 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Skype
2015-11-29 21:26 - 2013-09-25 20:16 - 00000000 ____D C:\Users\Ulla & Christian\Documents\My Games
2015-11-29 21:26 - 2013-07-25 15:22 - 00000000 ____D C:\Users\Ulla & Christian\Documents\Fax
2015-11-29 21:26 - 2013-07-25 12:37 - 00000000 ____D C:\Users\Ulla & Christian\Documents\Amazon MP3
2015-11-29 21:26 - 2013-07-05 20:19 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\vlc
2015-11-29 21:26 - 2013-07-05 20:11 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\WebApp
2015-11-29 21:26 - 2013-07-05 20:06 - 00000000 ____D C:\Users\Ulla & Christian\Documents\CyberLink
2015-11-29 21:26 - 2013-07-02 22:05 - 00000000 ____D C:\Users\Ulla & Christian\Documents\default
2015-11-29 21:26 - 2013-06-23 21:54 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Thunderbird
2015-11-29 21:26 - 2013-06-22 08:01 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Wargaming.net
2015-11-29 21:26 - 2013-06-21 22:14 - 00000000 ____D C:\Users\Ulla & Christian\Bilder
2015-11-29 21:26 - 2013-06-18 01:05 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\WinBatch
2015-11-29 21:26 - 2013-06-17 13:03 - 00000000 ____D C:\Users\Ulla & Christian\Documents\Ahnenblatt
2015-11-29 21:26 - 2013-06-16 20:50 - 00000000 ___HD C:\Users\Ulla & Christian\Documents\hp.system.package.metadata
2015-11-29 21:26 - 2013-06-16 20:50 - 00000000 ___HD C:\Users\Ulla & Christian\Documents\hp.applications.package.appdata
2015-11-29 21:25 - 2015-10-25 13:02 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ahnenblatt
2015-11-29 21:25 - 2015-05-17 15:43 - 00000000 ____D C:\Users\Ulla & Christian\AppData\LocalLow\Hewlett-Packard
2015-11-29 21:25 - 2015-05-17 15:42 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\HpUpdate
2015-11-29 21:25 - 2014-12-25 23:08 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\java
2015-11-29 21:25 - 2014-12-25 23:08 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\.minecraft
2015-11-29 21:25 - 2014-12-24 22:48 - 00000000 __SHD C:\Users\Ulla & Christian\AppData\LocalLow\EmieSiteList
2015-11-29 21:25 - 2014-12-13 11:06 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\hpqLog
2015-11-29 21:25 - 2014-11-20 09:32 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Iminent
2015-11-29 21:25 - 2014-11-17 00:03 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Opera Software
2015-11-29 21:25 - 2014-11-17 00:01 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WorldofTanks
2015-11-29 21:25 - 2014-11-17 00:01 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\WorldofTanks
2015-11-29 21:25 - 2014-09-24 19:55 - 00000000 ____D C:\Users\Ulla & Christian\AppData\LocalLow\Temp
2015-11-29 21:25 - 2014-08-17 16:22 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Skype
2015-11-29 21:25 - 2014-02-02 11:21 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google+ Auto Backup
2015-11-29 21:25 - 2013-12-22 18:24 - 00000000 ____D C:\Users\Ulla & Christian\AppData\LocalLow\Sun
2015-11-29 21:25 - 2013-10-05 20:51 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\ArcSoft
2015-11-29 21:25 - 2013-10-05 10:49 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-11-29 21:25 - 2013-10-05 10:48 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Dropbox
2015-11-29 21:25 - 2013-09-25 20:16 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder
2015-11-29 21:25 - 2013-09-25 20:16 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\WarThunder
2015-11-29 21:25 - 2013-09-01 20:00 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Leadertech
2015-11-29 21:25 - 2013-08-27 20:03 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\ICAClient
2015-11-29 21:25 - 2013-08-26 19:55 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Sophos
2015-11-29 21:25 - 2013-08-26 19:50 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sophos
2015-11-29 21:25 - 2013-08-09 18:00 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameShadow
2015-11-29 21:25 - 2013-08-07 20:57 - 00000000 __RHD C:\Users\Ulla & Christian\AppData\Roaming\SecuROM
2015-11-29 21:25 - 2013-07-25 12:37 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2015-11-29 21:25 - 2013-07-25 12:37 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Amazon
2015-11-29 21:25 - 2013-07-25 12:37 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Program Files
2015-11-29 21:25 - 2013-07-10 21:30 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LaserSoft Imaging
2015-11-29 21:25 - 2013-07-10 21:27 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Lasersoft Imaging
2015-11-29 21:25 - 2013-07-05 20:39 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Media Player Classic
2015-11-29 21:25 - 2013-07-05 20:36 - 00000462 _____ C:\Users\Ulla & Christian\AppData\Roaming\AVSDVDPlayer.m3u.vvv
2015-11-29 21:25 - 2013-07-05 20:34 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\dvdcss
2015-11-29 21:25 - 2013-07-05 20:13 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Windows Live
2015-11-29 21:25 - 2013-07-05 20:06 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\CyberLink
2015-11-29 21:25 - 2013-07-05 19:55 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Mozilla
2015-11-29 21:25 - 2013-07-03 22:40 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wing Commander Saga
2015-11-29 21:25 - 2013-07-03 22:24 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spiele
2015-11-29 21:25 - 2013-07-02 22:15 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\AVS4YOU
2015-11-29 21:25 - 2013-07-02 22:01 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Ashampoo
2015-11-29 21:25 - 2013-07-02 13:12 - 00000000 ____D C:\Users\Ulla & Christian\AppData\LocalLow\UtilityChest_49EI
2015-11-29 21:25 - 2013-07-02 06:37 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Canon
2015-11-29 21:25 - 2013-07-01 22:08 - 00000000 ____D C:\Users\Ulla & Christian\AppData\LocalLow\Adobe
2015-11-29 21:25 - 2013-06-23 21:54 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Thunderbird
2015-11-29 21:25 - 2013-06-23 20:27 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AVS4YOU
2015-11-29 21:25 - 2013-06-23 18:02 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Avira
2015-11-29 21:25 - 2013-06-23 17:55 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Canneverbe Limited
2015-11-29 21:25 - 2013-06-23 12:08 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Buhl Data Service GmbH
2015-11-29 21:25 - 2013-06-23 12:08 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Buhl Data Service
2015-11-29 21:25 - 2013-06-19 21:22 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\NVIDIA
2015-11-29 21:25 - 2013-06-18 13:18 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Microsoft Web Folders
2015-11-29 21:25 - 2013-06-17 21:54 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\MediaMonkey
2015-11-29 21:25 - 2013-06-17 21:47 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl
2015-11-29 21:25 - 2013-06-17 21:46 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Opera
2015-11-29 21:25 - 2013-06-17 21:46 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\OCS
2015-11-29 21:25 - 2013-06-17 21:43 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Samsung
2015-11-29 21:25 - 2013-06-17 21:43 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Samsung
2015-11-29 21:25 - 2013-06-17 13:02 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Ahnenblatt
2015-11-29 21:25 - 2013-06-16 21:38 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Macromedia
2015-11-29 21:25 - 2013-06-16 20:53 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Adobe
2015-11-29 21:25 - 2013-06-16 20:51 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Roaming\Hewlett-Packard
2015-11-29 21:25 - 2013-06-16 20:51 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Power2Go8
2015-11-29 21:25 - 2013-06-16 20:51 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Packages
2015-11-29 21:24 - 2014-11-17 00:03 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Opera Software
2015-11-29 21:24 - 2013-06-21 20:57 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Microsoft Help
2015-11-29 21:24 - 2013-06-17 22:31 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Mozilla
2015-11-29 21:23 - 2015-06-09 21:46 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\GWX
2015-11-29 21:23 - 2015-05-17 15:43 - 00000000 ____D C:\ProgramData\Visan
2015-11-29 21:23 - 2015-01-10 22:40 - 00000000 ____D C:\ProgramData\Synology
2015-11-29 21:23 - 2014-11-27 07:20 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-11-29 21:23 - 2014-11-17 00:04 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-11-29 21:23 - 2014-08-31 18:37 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2015-11-29 21:23 - 2014-08-17 16:22 - 00000000 ____D C:\ProgramData\Skype
2015-11-29 21:23 - 2013-12-22 18:26 - 00000000 ____D C:\ProgramData\Sun
2015-11-29 21:23 - 2013-12-22 18:26 - 00000000 ____D C:\ProgramData\Oracle
2015-11-29 21:23 - 2013-11-14 20:02 - 00000000 ____D C:\Users\Public\Documents\CrashDump
2015-11-29 21:23 - 2013-11-10 17:07 - 00000000 ____D C:\ProgramData\tmp
2015-11-29 21:23 - 2013-10-03 19:03 - 00000000 ____D C:\Users\Ulla & Christian\2013_10_03
2015-11-29 21:23 - 2013-09-25 20:16 - 00000000 ____D C:\ProgramData\WarThunder
2015-11-29 21:23 - 2013-09-25 20:13 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Gameforge4d
2015-11-29 21:23 - 2013-09-01 20:05 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Logitech® Webcam-Software
2015-11-29 21:23 - 2013-08-27 20:03 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Citrix
2015-11-29 21:23 - 2013-08-22 16:36 - 00000000 __RHD C:\Users\Public\Libraries
2015-11-29 21:23 - 2013-07-12 20:34 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Apps\2.0
2015-11-29 21:23 - 2013-07-05 20:06 - 00000000 ____D C:\Users\Public\CyberLink
2015-11-29 21:23 - 2013-07-04 20:16 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Logitech
2015-11-29 21:23 - 2013-07-03 22:25 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\DFH
2015-11-29 21:23 - 2013-07-03 22:25 - 00000000 ____D C:\Users\Public\Documents\Softwrap
2015-11-29 21:23 - 2013-07-02 22:00 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\ashampoo
2015-11-29 21:23 - 2013-07-02 06:30 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\HP
2015-11-29 21:23 - 2013-06-30 15:28 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\HP Quick Start
2015-11-29 21:23 - 2013-06-23 18:11 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\ArcSoft
2015-11-29 21:23 - 2013-06-23 12:08 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Buhl Data Service
2015-11-29 21:23 - 2013-06-23 11:54 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Macromedia
2015-11-29 21:23 - 2013-06-17 22:27 - 00000000 ____D C:\ProgramData\Mozilla
2015-11-29 21:23 - 2013-06-17 21:59 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Google
2015-11-29 21:23 - 2013-06-17 21:54 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\MediaMonkey
2015-11-29 21:23 - 2013-06-17 21:43 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2015-11-29 21:23 - 2013-06-17 21:33 - 00000000 ____D C:\ProgramData\Samsung
2015-11-29 21:23 - 2013-06-17 21:31 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Downloaded Installations
2015-11-29 21:23 - 2013-06-17 21:30 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Adobe
2015-11-29 21:23 - 2013-06-16 21:18 - 00000000 ____D C:\Users\Ulla & Christian\AppData\Local\Hewlett-Packard
2015-11-29 21:23 - 2013-06-16 20:44 - 00000000 __RHD C:\Users\Public\AccountPictures
2015-11-29 21:23 - 2013-01-12 06:38 - 00000000 ____D C:\Users\Public\Symantec
2015-11-29 21:23 - 2013-01-12 06:38 - 00000000 ____D C:\ProgramData\Norton
2015-11-29 21:23 - 2013-01-12 06:37 - 00000000 ____D C:\ProgramData\NortonInstaller
2015-11-29 21:23 - 2013-01-12 06:36 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive
2015-11-29 21:23 - 2013-01-12 06:23 - 00000000 ____D C:\ProgramData\Temp
2015-11-29 21:23 - 2013-01-12 06:14 - 00000000 ____D C:\ProgramData\SoundResearch
2015-11-29 21:23 - 2012-08-10 16:06 - 00000000 ____D C:\ProgramData\PRICache
2015-11-29 21:23 - 2010-01-25 22:35 - 00000000 ___DC C:\ProgramData\Mozilla Thunderbird
2015-11-29 21:22 - 2015-05-17 15:43 - 00000000 ____D C:\ProgramData\HP Photo Creations
2015-11-29 21:22 - 2015-05-17 15:41 - 00000000 ____D C:\ProgramData\HP
2015-11-29 21:22 - 2014-12-20 16:57 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2015-11-29 21:22 - 2014-11-20 09:32 - 00000000 ____D C:\ProgramData\Iminent
2015-11-29 21:22 - 2013-11-26 07:45 - 00000000 ____D C:\ProgramData\McAfee
2015-11-29 21:22 - 2013-11-10 17:07 - 00000000 ____D C:\ProgramData\hps
2015-11-29 21:22 - 2013-09-01 21:25 - 00000000 ____D C:\ProgramData\FLEXnet
2015-11-29 21:22 - 2013-09-01 20:00 - 00000000 ____D C:\ProgramData\LogiShrd
2015-11-29 21:22 - 2013-07-03 22:32 - 00000000 ____D C:\ProgramData\InstallMate
2015-11-29 21:22 - 2013-06-23 18:07 - 00000000 ____D C:\ProgramData\eBay
2015-11-29 21:22 - 2013-06-21 22:16 - 00000000 ____D C:\ProgramData\MediaMonkey
2015-11-29 21:22 - 2013-01-12 06:25 - 00000000 ____D C:\ProgramData\install_clap
2015-11-29 21:22 - 2013-01-12 06:19 - 00000000 ____D C:\ProgramData\Hewlett-Packard
2015-11-29 21:21 - 2015-01-10 19:07 - 00000000 ___HD C:\ProgramData\CanonIJEGV
2015-11-29 21:21 - 2014-11-27 08:00 - 00000000 ____D C:\ProgramData\AmUStor
2015-11-29 21:21 - 2013-08-27 20:03 - 00000000 ____D C:\ProgramData\Citrix
2015-11-29 21:21 - 2013-07-02 22:20 - 00000000 ____D C:\ProgramData\AomeiBR
2015-11-29 21:21 - 2013-07-02 22:00 - 00000000 ____D C:\ProgramData\Ashampoo
2015-11-29 21:21 - 2013-07-02 06:37 - 00000000 ___HD C:\ProgramData\CanonIJScan
2015-11-29 21:21 - 2013-07-01 20:47 - 00000000 ____D C:\ProgramData\Adobe
2015-11-29 21:21 - 2013-06-23 20:30 - 00000000 ____D C:\ProgramData\AVS4YOU
2015-11-29 21:21 - 2013-06-23 18:11 - 00000000 ____D C:\ProgramData\ArcSoft
2015-11-29 21:21 - 2013-06-23 17:57 - 00000000 ____D C:\ProgramData\Avira
2015-11-29 21:21 - 2013-06-23 17:55 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2015-11-29 21:21 - 2013-06-23 11:35 - 00000000 ____D C:\ProgramData\Buhl Data Service GmbH
2015-11-29 21:21 - 2013-01-12 06:26 - 00000000 ____D C:\ProgramData\CyberLink
2015-11-29 21:21 - 2013-01-12 06:26 - 00000000 ____D C:\ProgramData\Apple
2015-11-29 21:18 - 2012-10-12 04:21 - 00000000 _RSHD C:\SYSTEM.SAV
2015-11-29 21:17 - 2013-07-01 23:00 - 00000000 ____D C:\Program Files (x86)l
2015-11-29 21:17 - 2013-06-18 21:29 - 00000000 ____D C:\sources
2015-11-29 21:17 - 2012-10-12 04:24 - 00000000 ____D C:\SWSETUP
2015-11-29 21:16 - 2014-07-03 20:43 - 00000000 ____D C:\My Music
2015-11-29 21:16 - 2013-01-07 12:12 - 00000000 _RSHD C:\hp
2015-11-28 23:24 - 2012-07-26 08:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-11-23 06:45 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-11-18 20:56 - 2015-10-06 19:48 - 00001048 _____ C:\Users\Jan\Desktop\nativelog.txt
2015-11-18 20:56 - 2015-10-03 14:43 - 00000000 ____D C:\Users\Jan\AppData\Roaming\.minecraft
2015-11-18 20:30 - 2015-10-01 13:15 - 00003594 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3876800203-89553269-3656360523-1003
2015-11-18 20:25 - 2013-08-22 16:36 - 00000000 ___HD C:\Program Files\WindowsApps
2015-11-16 23:50 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\Registration
2015-11-15 17:06 - 2014-12-20 16:57 - 00001959 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2015-11-13 22:18 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\rescache
2015-11-12 23:13 - 2013-08-22 16:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-11-12 21:39 - 2013-06-21 20:57 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-11-12 21:34 - 2013-08-27 20:47 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-11-12 21:29 - 2013-06-17 22:17 - 145617392 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-11-10 23:24 - 2015-05-07 21:02 - 00002274 _____ C:\Users\Public\Desktop\Avira Antivirus.lnk
2015-11-10 21:59 - 2014-11-29 17:24 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-11-08 13:16 - 2015-03-08 14:44 - 00000000 ____D C:\WINDOWS\Minidump
2015-11-08 10:34 - 2015-04-23 12:23 - 00000000 ___RD C:\Users\Ulla & Christian\Desktop\Spiele
2015-11-07 22:39 - 2013-06-17 22:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-11-07 18:16 - 2013-06-21 23:19 - 00000000 ____D C:\Program Files (x86)\Spiele
2015-11-03 01:23 - 2014-12-13 10:44 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-11-03 01:23 - 2014-12-13 10:44 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2013-06-23 18:04 - 2006-07-18 08:49 - 0587249 _____ (MAGIX AG) C:\Program Files (x86)\addoninstall.exe
2013-06-23 18:04 - 2002-02-13 07:00 - 0022016 _____ (Borland Software Corporation) C:\Program Files (x86)\borlndmm.dll
2013-06-23 18:04 - 2003-03-17 05:04 - 1500160 _____ (Borland Corporation) C:\Program Files (x86)\cc3260mt.dll
2013-06-23 18:04 - 2006-06-28 08:32 - 0004694 _____ () C:\Program Files (x86)\e-mode-upgradedialog.rtf
2013-06-23 18:04 - 2006-06-28 08:32 - 0004716 _____ () C:\Program Files (x86)\e-mode-upgradedlg-exit.rtf
2013-06-23 18:04 - 2013-06-23 18:04 - 0002885 _____ () C:\Program Files (x86)\e-mode.ini
2013-06-23 18:04 - 2006-06-28 09:55 - 0315392 _____ (MAGIX AG) C:\Program Files (x86)\eModeUpgradeDlg.dll
2013-06-23 18:04 - 2003-02-12 10:20 - 0028672 _____ () C:\Program Files (x86)\explore.exe
2013-06-23 18:04 - 2006-07-26 15:46 - 2442752 _____ (MAGIX) C:\Program Files (x86)\FotoClinic.exe
2013-06-23 18:04 - 2013-06-23 18:04 - 0000707 _____ () C:\Program Files (x86)\FotoClinic.ini
2013-06-23 18:04 - 2013-06-23 18:04 - 0001138 _____ () C:\Program Files (x86)\Install.cfg
2013-06-23 18:04 - 2013-06-23 18:04 - 0040289 _____ () C:\Program Files (x86)\INSTALL.LOG
2013-06-23 18:04 - 2013-06-23 18:04 - 0006564 _____ () C:\Program Files (x86)\INSTALL1.LOG
2013-06-23 18:04 - 2006-07-17 09:58 - 0184320 _____ (MAGIX AG) C:\Program Files (x86)\instslct.exe
2013-06-23 18:04 - 2006-07-26 15:29 - 0100352 _____ () C:\Program Files (x86)\libpng.dll
2013-06-23 18:04 - 2005-06-16 08:43 - 0008980 _____ () C:\Program Files (x86)\license.txt
2013-06-23 18:04 - 2005-08-08 14:51 - 0786305 _____ () C:\Program Files (x86)\MAGIX Creation Logo.pdf
2013-06-23 18:04 - 2004-04-15 14:48 - 0032768 _____ () C:\Program Files (x86)\MagixUpdater.exe
2013-06-23 18:04 - 2006-04-25 09:27 - 0014810 _____ () C:\Program Files (x86)\order.rtf
2013-06-23 18:04 - 2005-03-04 17:51 - 0005509 _____ () C:\Program Files (x86)\pa.cnt
2013-06-23 18:04 - 2005-03-04 17:51 - 0361656 _____ () C:\Program Files (x86)\pa.hlp
2013-06-23 18:04 - 2006-07-26 15:46 - 0055296 _____ () C:\Program Files (x86)\palng.dll
2013-06-23 18:04 - 2006-07-26 15:45 - 0240128 _____ () C:\Program Files (x86)\pcomponents.bpl
2013-06-23 18:04 - 2006-07-26 15:29 - 0018432 _____ () C:\Program Files (x86)\ps8bf.dll
2013-06-23 18:04 - 2013-06-23 18:04 - 0002757 _____ () C:\Program Files (x86)\register.rtf
2013-06-23 18:04 - 1999-12-10 12:00 - 0431376 _____ (Microsoft Corporation) C:\Program Files (x86)\riched20.dll
2013-06-23 18:04 - 2003-03-17 05:04 - 0685056 _____ (Borland Software Corporation) C:\Program Files (x86)\rtl60.bpl
2013-06-23 18:04 - 2003-03-17 05:04 - 0618496 _____ () C:\Program Files (x86)\stlpmt45.dll
2013-06-23 18:04 - 2005-11-02 14:34 - 0016460 _____ () C:\Program Files (x86)\support.rtf
2013-06-23 18:04 - 2006-07-17 12:30 - 0129024 _____ () C:\Program Files (x86)\uninstall.exe
2013-06-23 18:04 - 2002-02-18 10:06 - 0006034 _____ () C:\Program Files (x86)\uninstall.ini
2013-06-23 18:04 - 2006-07-17 10:09 - 0081920 _____ (MAGIX AG) C:\Program Files (x86)\unwise.adf
2013-06-23 18:04 - 2006-07-17 10:10 - 0176128 _____ (MAGIX AG) C:\Program Files (x86)\unwise.exe
2013-06-23 18:04 - 2013-06-23 18:04 - 0000723 _____ () C:\Program Files (x86)\unwise.ini
2013-06-23 18:04 - 2006-07-26 13:50 - 0139264 _____ () C:\Program Files (x86)\UpgradeInfo.exe
2013-06-23 18:04 - 2006-02-14 14:03 - 0024576 _____ (Magix AG) C:\Program Files (x86)\Validation.exe
2013-06-23 18:04 - 2013-06-23 18:04 - 0000140 _____ () C:\Program Files (x86)\Validation.ini
2013-06-23 18:04 - 2002-02-13 07:00 - 1326080 _____ (Borland Software Corporation) C:\Program Files (x86)\vcl60.bpl
2013-06-23 18:04 - 2006-07-26 15:29 - 0046080 _____ () C:\Program Files (x86)\zlib.dll
2015-11-30 13:54 - 2015-11-30 13:56 - 0000050 _____ () C:\Users\Ulla & Christian\AppData\Roaming\AVSDVDPlayer.m3u
2013-07-05 20:36 - 2015-11-29 21:25 - 0000462 _____ () C:\Users\Ulla & Christian\AppData\Roaming\AVSDVDPlayer.m3u.vvv
2015-11-29 21:23 - 2015-11-29 21:26 - 0006921 _____ () C:\Users\Ulla & Christian\AppData\Roaming\how_recover+yer.html
2015-11-29 21:23 - 2015-11-29 21:26 - 0002401 _____ () C:\Users\Ulla & Christian\AppData\Roaming\how_recover+yer.txt
2013-12-25 21:18 - 2015-10-20 22:01 - 0028256 _____ () C:\Users\Ulla & Christian\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2013-12-25 21:14 - 2013-12-25 21:16 - 0028295 _____ () C:\Users\Ulla & Christian\AppData\Roaming\Tabulatorgetrennte Werte (Windows).ADR
2013-10-20 11:29 - 2015-07-02 13:29 - 0005632 _____ () C:\Users\Ulla & Christian\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-11-29 21:23 - 2015-11-29 21:34 - 0006921 _____ () C:\Users\Ulla & Christian\AppData\Local\how_recover+yer.html
2015-11-29 21:23 - 2015-11-29 21:34 - 0002401 _____ () C:\Users\Ulla & Christian\AppData\Local\how_recover+yer.txt
2013-12-10 20:40 - 2015-09-13 22:27 - 0007605 _____ () C:\Users\Ulla & Christian\AppData\Local\resmon.resmoncfg
2015-05-17 15:41 - 2015-05-17 15:41 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-11-29 21:21 - 2015-11-29 21:23 - 0006921 _____ () C:\ProgramData\how_recover+yer.html
2015-11-29 21:21 - 2015-11-29 21:23 - 0002401 _____ () C:\ProgramData\how_recover+yer.txt
2013-06-16 20:51 - 2013-06-16 20:51 - 0000141 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
2013-07-10 21:31 - 2013-07-10 21:42 - 0020531 ____H () C:\ProgramData\R49LW
Einige Dateien in TEMP:
====================
C:\Users\Jan\AppData\Local\Temp\avgnt.exe
C:\Users\Ulla & Christian\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-11-29 14:04
==================== Ende von FRST.txt ============================
Kann mir jemand helfen? Im Voraus schon mal Danke. Christian |
| Themen zu Virus hängt an alle Dateien .vvv |
| .vvv-anhang, adobe, antivir, avira, bonjour, defender, desktop, dnsapi.dll, explorer, festplatte, firefox, flash player, geld, home, hängt, mozilla, neustart, prozesse, registry, security, services.exe, svchost.exe, synology, system, usb, virus, windows, wiso |
Baum-Darstellung