PC hängt sich im I-net nach 10 min auf - Win 7 / Firefox

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-09-2014
Ran by Snoopy (administrator) on SNOOPY-PC on 18-09-2014 19:45:12
Running from C:\Users\Snoopy\Desktop
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Registration\GREGsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec MyWinLocker\x86\mwlDaemon.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Insyde Software Corp.) C:\Program Files\Acer\Android Manager\iSync.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LMworker.exe
(Insyde Software Corp.) C:\Program Files\Acer\Updater\iUpdate.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Sony Corporation) C:\Program Files\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [968272 2010-06-22] (Dritek System Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9292392 2010-06-22] (Realtek Semiconductor)
HKLM\...\Run: [SuiteTray] => C:\Program Files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-05-27] (Egis Technology Inc.)
HKLM\...\Run: [EgisUpdate] => C:\Program Files\EgisTec IPS\EgisUpdate.exe [201584 2010-03-11] (Egis Technology Inc.)
HKLM\...\Run: [EgisTecPMMUpdate] => C:\Program Files\EgisTec IPS\PmmUpdate.exe [407920 2010-03-11] (Egis Technology Inc.)
HKLM\...\Run: [mwlDaemon] => C:\Program Files\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1692968 2010-02-05] (Synaptics Incorporated)
HKLM\...\Run: [iSyncData] => C:\Program Files\Acer\Android Manager\iSync.exe [407416 2010-01-08] (Insyde Software Corp.)
HKLM\...\Run: [AndroidManager] => C:\Program Files\Acer\Android Manager\AML.exe [508280 2010-01-08] ()
HKLM\...\Run: [iPatchData] => C:\Program Files\Acer\Updater\iUpdate.exe [492096 2010-07-21] (Insyde Software Corp.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [715296 2010-06-11] (Acer Incorporated)
HKLM\...\Run: [Reader Application Helper] => C:\Program Files\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2014-05-23] (Sony Corporation)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKU\.DEFAULT\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-01-05] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files\WISO\Steuersoftware 2014\mshaktuell.exe ()
ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files\EgisTec MyWinLocker\x86\psdprotect.dll (Egis Technology Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b51213x015l0494ww35w47n2u618
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b51213x015l0494ww35w47n2u618
SearchScopes: HKLM - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE568
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE568
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Acer\Acer VCM\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Snoopy\AppData\Roaming\Mozilla\Firefox\Profiles\xfhffkzy.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @sony.com/ReaderDesktop -> C:\Program Files\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Snoopy\AppData\Roaming\Mozilla\Firefox\Profiles\xfhffkzy.default\user.js
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Snoopy\AppData\Roaming\Mozilla\Firefox\Profiles\xfhffkzy.default\Extensions\2020Player_IKEA@2020Technologies.com [2014-04-27]
FF Extension: Avira Browser Safety - C:\Users\Snoopy\AppData\Roaming\Mozilla\Firefox\Profiles\xfhffkzy.default\Extensions\abs@avira.com [2014-09-17]
FF Extension: Adblock Plus - C:\Users\Snoopy\AppData\Roaming\Mozilla\Firefox\Profiles\xfhffkzy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-17]

Chrome: 
=======
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [161016 2014-09-15] (Avira Operations GmbH & Co. KG)
R2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [735776 2010-06-11] (Acer Incorporated)
R2 GREGService; C:\Program Files\Acer\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
S3 MWLService; C:\Program Files\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.)
R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)
S3 Sony SCSI Helper Service; C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe [73728 2014-04-25] (Sony Corporation) [File not signed]
R2 Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232 2010-01-29] (Acer Group)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 EUCR; C:\Windows\System32\DRIVERS\EUCR6SK.SYS [82768 2010-06-17] (ENE Technology Inc.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-09-18] (Malwarebytes Corporation)
R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [18992 2009-06-03] (Egis Technology Inc.)
R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2009-06-03] (Egis Technology Inc.)
R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [60976 2009-06-03] (Egis Technology Inc.)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-18 19:45 - 2014-09-18 19:47 - 00012543 _____ () C:\Users\Snoopy\Desktop\FRST.txt
2014-09-18 19:44 - 2014-09-18 19:45 - 00000000 ____D () C:\FRST
2014-09-18 19:43 - 2014-09-18 19:49 - 01097728 _____ (Farbar) C:\Users\Snoopy\Desktop\FRST.exe
2014-09-18 19:09 - 2014-09-18 19:09 - 00000000 ____D () C:\ProgramData\boost_interprocess
2014-09-18 00:06 - 2014-09-18 00:18 - 00001099 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-18 00:06 - 2014-09-18 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-18 00:06 - 2014-09-18 00:06 - 00000000 ____D () C:\ProgramData\Avira
2014-09-18 00:06 - 2014-09-18 00:06 - 00000000 ____D () C:\Program Files\Avira
2014-09-18 00:05 - 2014-09-18 00:05 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-17 23:38 - 2014-09-18 19:10 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-17 23:37 - 2014-09-17 23:37 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-17 23:37 - 2014-09-17 23:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-17 23:37 - 2014-09-17 23:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-17 23:37 - 2014-09-17 23:37 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-09-17 23:37 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-17 23:37 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-17 23:37 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-17 23:36 - 2014-09-17 23:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Snoopy\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-17 23:34 - 2014-09-18 00:08 - 00013732 _____ () C:\Windows\PFRO.log
2014-09-17 23:31 - 2014-09-17 23:31 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Snoopy\Downloads\mbam-clean-2.1.1.1001.exe
2014-09-17 20:26 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-17 20:14 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-17 20:14 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-17 20:13 - 2014-09-17 20:14 - 00000000 ____D () C:\5d3b7d6795166d6f0cfb3443da07
2014-09-17 20:13 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-17 20:12 - 2014-09-05 03:52 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-17 20:12 - 2014-09-05 03:47 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-17 20:12 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-11 20:26 - 2014-09-11 20:26 - 00000000 ____D () C:\Windows\Hewlett-Packard
2014-08-31 20:37 - 2014-08-31 20:37 - 01058200 _____ (Adobe) C:\Users\Snoopy\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe
2014-08-31 19:13 - 2014-08-23 03:46 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-31 19:13 - 2014-08-23 02:42 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-18 19:49 - 2014-09-18 19:43 - 01097728 _____ (Farbar) C:\Users\Snoopy\Desktop\FRST.exe
2014-09-18 19:47 - 2014-09-18 19:45 - 00012543 _____ () C:\Users\Snoopy\Desktop\FRST.txt
2014-09-18 19:46 - 2014-01-04 23:28 - 01262304 _____ () C:\Windows\WindowsUpdate.log
2014-09-18 19:46 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-09-18 19:45 - 2014-09-18 19:44 - 00000000 ____D () C:\FRST
2014-09-18 19:45 - 2014-01-02 21:35 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-18 19:33 - 2009-07-14 06:34 - 00023664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-18 19:33 - 2009-07-14 06:34 - 00023664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-18 19:30 - 2014-01-02 21:34 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-18 19:28 - 2014-02-25 17:35 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-18 19:10 - 2014-09-17 23:38 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-18 19:09 - 2014-09-18 19:09 - 00000000 ____D () C:\ProgramData\boost_interprocess
2014-09-18 19:09 - 2014-07-26 08:36 - 00002688 _____ () C:\Windows\setupact.log
2014-09-18 19:09 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-18 00:18 - 2014-09-18 00:06 - 00001099 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-18 00:08 - 2014-09-17 23:34 - 00013732 _____ () C:\Windows\PFRO.log
2014-09-18 00:06 - 2014-09-18 00:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-18 00:06 - 2014-09-18 00:06 - 00000000 ____D () C:\ProgramData\Avira
2014-09-18 00:06 - 2014-09-18 00:06 - 00000000 ____D () C:\Program Files\Avira
2014-09-18 00:05 - 2014-09-18 00:05 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-18 00:03 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Speech
2014-09-18 00:01 - 2014-01-10 14:07 - 00000000 ____D () C:\Users\Snoopy\AppData\Local\genienext
2014-09-18 00:01 - 2014-01-10 14:07 - 00000000 ____D () C:\Users\Snoopy\AppData\Local\Conduit
2014-09-18 00:01 - 2014-01-10 14:07 - 00000000 ____D () C:\Program Files\Conduit
2014-09-17 23:37 - 2014-09-17 23:37 - 00001068 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-09-17 23:37 - 2014-09-17 23:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-09-17 23:37 - 2014-09-17 23:37 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-17 23:37 - 2014-09-17 23:37 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-09-17 23:36 - 2014-09-17 23:36 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Snoopy\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-17 23:31 - 2014-09-17 23:31 - 00321848 _____ (Malwarebytes Corporation) C:\Users\Snoopy\Downloads\mbam-clean-2.1.1.1001.exe
2014-09-17 23:30 - 2010-08-05 15:18 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-17 22:31 - 2013-12-29 20:03 - 00000000 ____D () C:\Users\Snoopy\AppData\Local\Adobe
2014-09-17 21:15 - 2014-02-20 22:12 - 00000000 ____D () C:\Windows\system32\Adobe
2014-09-17 20:26 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-09-17 20:25 - 2014-05-07 18:08 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-17 20:14 - 2014-09-17 20:13 - 00000000 ____D () C:\5d3b7d6795166d6f0cfb3443da07
2014-09-11 21:28 - 2013-12-31 16:25 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-11 21:28 - 2013-12-31 16:25 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-11 20:32 - 2014-04-29 12:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-09-11 20:32 - 2014-04-29 12:19 - 00000000 ____D () C:\Program Files\HP
2014-09-11 20:30 - 2014-04-29 12:22 - 00000000 ____D () C:\Users\Snoopy\AppData\Roaming\HpUpdate
2014-09-11 20:26 - 2014-09-11 20:26 - 00000000 ____D () C:\Windows\Hewlett-Packard
2014-09-06 19:56 - 2009-07-14 06:33 - 00288200 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-05 03:52 - 2014-09-17 20:12 - 00445952 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 03:47 - 2014-09-17 20:12 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-31 20:37 - 2014-08-31 20:37 - 01058200 _____ (Adobe) C:\Users\Snoopy\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe
2014-08-25 06:53 - 2013-12-29 18:52 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-24 20:22 - 2013-12-29 20:11 - 00000000 ____D () C:\Users\Snoopy\Documents\Silke
2014-08-23 03:46 - 2014-08-31 19:13 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 02:42 - 2014-08-31 19:13 - 02352640 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

Some content of TEMP:
====================
C:\Users\Snoopy\AppData\Local\Temp\install_flashplayer15x32_mssd_aaa_aih.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-07-13 13:44

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-09-2014
Ran by Snoopy at 2014-09-18 19:49:43
Running from C:\Users\Snoopy\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acer Crystal Eye webcam (HKLM\...\{51F026FA-5146-4232-A8BA-1364740BD053}) (Version: 4.0.2.1 - Liteon)
Acer ePower Management (HKLM\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 5.00.3005 - Acer Incorporated)
Acer eRecovery Management (HKLM\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3013 - Acer Incorporated)
Acer GameZone Console (HKLM\...\{58F4D244-314F-4D26-B5EF-C28AB32E22CB}_is1) (Version: 6.1.0.9 - Oberon Media, Inc.)
Acer Registration (HKLM\...\Acer Registration) (Version: 1.03.3003 - Acer Incorporated)
Acer ScreenSaver (HKLM\...\Acer Screensaver) (Version: 1.1.0624.2010 - Acer Incorporated)
Acer Updater (HKLM\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3001 - Acer Incorporated)
Acer VCM (HKLM\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3002 - Acer Incorporated)
Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Digital Editions 2.0 (HKLM\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 MUI (HKLM\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
AndroidInstaller (Version: 1.00.022 - Ihr Firmenname) Hidden
Apple Application Support (HKLM\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{0592EF96-69D8-4E4B-9CC9-88F58EA86F01}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.0.31 - Atheros Communications Inc.)
Avira (HKLM\...\{eda8822d-3385-4a68-9b2b-e11ce7466ddd}) (Version: 1.1.21.30000 - Avira Operations GmbH & Co. KG)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
calibre (HKLM\...\{09076BCB-56D7-483C-969E-1723E9FC3F4E}) (Version: 1.32.0 - Kovid Goyal)
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
ENE USB Card Reader Driver (HKLM\...\3B29FD3CCF1F5B855DA0C521597413EBABE97DFB) (Version: 5.89.0.70 - ENE)
eSobi v2 (HKLM\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (Version: 2.0.4.000274 - esobi Inc.) Hidden
HP Deskjet 1050 J410 series - Grundlegende Software für das Gerät (HKLM\...\{9C31FFDC-E796-4884-B990-41B9A5B2A647}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
HP Deskjet 1050 J410 series Hilfe (HKLM\...\{5C90D8CF-F12A-41C6-9007-3B651A1F0D78}) (Version: 140.0.66.66 - Hewlett Packard)
HP Photo Creations (HKLM\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
Identity Card (HKLM\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.14.10.2117 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
iTunes (HKLM\...\{C197BC08-3D82-4651-8886-E68C21578A38}) (Version: 11.1.3.8 - Apple Inc.)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Launch Manager (HKLM\...\LManager) (Version: 4.0.12 - Acer Inc.)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (HKLM\...\Mozilla Firefox 26.0 (x86 de)) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 24.6.0 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden
MyWinLocker (Version: 3.1.212.0 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM\...\InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}) (Version: 3.1.212.0 - Egis Technology Inc.)
MyWinLocker Suite (Version: 3.1.212.0 - Egis Technology Inc.) Hidden
OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
QuickTime (HKLM\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Reader for PC (HKLM\...\{38FB32F7-5A2A-40E4-B106-4C35F75725CD}) (Version: 2.4.00.05230 - Sony Corporation)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6141 - Realtek Semiconductor Corp.)
schnittvision vol.2de Version 1.5 (HKLM\...\{12D37FD6-6C80-4BB6-B443-8B6E1420B7E3}_is1) (Version: 1.5 - schnittvision couture)
Shredder (Version: 2.0.8.3 - Egis Technology Inc.) Hidden
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.7.0 - Synaptics Incorporated)
Welcome Center (HKLM\...\Acer Welcome Center) (Version: 1.02.3004 - Acer Incorporated)
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 5.01 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
WISO Steuer 2014 (HKLM\...\{95318615-F8B0-4865-9DC2-8F8F31F3CB2B}) (Version: 21.00.8480 - Buhl Data Service GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

16-07-2014 05:53:30 Windows Update
26-07-2014 06:40:20 Windows Update
27-07-2014 08:49:26 Windows Update
31-07-2014 17:30:22 Windows Update
01-08-2014 19:45:46 Windows Update
01-08-2014 19:50:14 Windows Update
05-08-2014 08:09:38 Windows Update
07-08-2014 16:58:34 Windows Update
10-08-2014 15:04:34 Windows Update
11-08-2014 19:33:35 Windows Update
12-08-2014 17:19:02 Windows Update
12-08-2014 18:14:45 Installed Reader for PC.
14-08-2014 15:18:11 Windows Update
17-08-2014 21:31:50 Windows Update
18-08-2014 17:33:55 Windows Update
24-08-2014 18:15:48 Windows Update
25-08-2014 18:28:08 Windows Update
31-08-2014 16:52:56 Windows Update
05-09-2014 18:03:48 Windows Update
11-09-2014 18:19:17 Windows Update
11-09-2014 18:26:56 Installed HP Update.
17-09-2014 18:07:07 Windows Update
17-09-2014 18:21:22 Windows Update
17-09-2014 19:11:24 Removed Studie zur Verbesserung von HP Deskjet 1050 J410 series Produkten
18-09-2014 17:13:27 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0444158E-8AD9-403C-BE11-90C3DF2CDE6B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-11] (Adobe Systems Incorporated)
Task: {7B0226DA-E65F-44B1-AA25-B7ADBF827001} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-09-13 20:51 - 2013-09-13 20:51 - 00087952 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2013-09-13 20:51 - 2013-09-13 20:51 - 01242952 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-09-15 11:56 - 2014-09-15 11:56 - 00140024 _____ () C:\Program Files\Avira\My Avira\Avira.OE.NativeCore.dll
2010-08-05 16:00 - 2009-05-20 08:02 - 00072200 _____ () C:\Program Files\Launch Manager\CdDirIo.dll
2010-07-20 14:54 - 2010-07-20 14:54 - 00411136 _____ () C:\Program Files\Acer\Android Manager\DEU.dll
2014-05-23 19:13 - 2014-05-23 19:13 - 00880640 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\fsk.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00040264 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskMediaPlayers.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00239944 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\Fskin.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00026952 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskinLocalize.dll
2014-04-25 22:27 - 2014-04-25 22:27 - 00798720 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskSecurity.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00125256 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskDocumentViewer.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00016200 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskPower.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00024904 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskNetInterface.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00017224 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskMobileMediaDevice.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00015176 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\FskTimeHardware.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00034632 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\ticket.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00018760 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\ebookDeviceNotifier.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00092488 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\ebookUsb.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00149832 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\readerAppHelper.dll
2014-05-23 19:15 - 2014-05-23 19:15 - 00178504 _____ () C:\Program Files\Sony\ReaderDesktop\appHelper\USBDetector.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/17/2014 11:24:39 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.OE.Systray.exe, Version: 1.1.21.30000, Zeitstempel: 0x5416b774
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x1698
Startzeit der fehlerhaften Anwendung: 0xAvira.OE.Systray.exe0
Pfad der fehlerhaften Anwendung: Avira.OE.Systray.exe1
Pfad des fehlerhaften Moduls: Avira.OE.Systray.exe2
Berichtskennung: Avira.OE.Systray.exe3

Error: (09/17/2014 11:24:36 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.Systray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
Stapel:
   bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
   bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
   bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.get_AppSettings()
   bei Avira.OE.WinCore.OeProductInfo.get_Culture()
   bei Avira.OE.WinCore.Utility.CultureSetter.SetDefaultCultureDefinedInAppsettings()
   bei Avira.OE.Systray.Program.Main(System.String[])

Error: (09/17/2014 11:23:23 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.Systray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.TypeInitializationException
Stapel:
   bei NLog.Common.InternalLogger.Debug(System.String, System.Object[])
   bei NLog.LogFactory.get_Configuration()
   bei NLog.LogFactory.GetLogger(LoggerCacheKey)
   bei NLog.LogFactory.GetLogger(System.String)
   bei NLog.LogManager.GetLogger(System.String)
   bei Avira.OE.WinCore.Utility.LoggerFacade.GetLogger(System.String)
   bei Avira.OE.WinCore.Utility.LoggerFacade.GetCurrentClassLogger()
   bei Avira.OE.WinCore.Lazy`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].get_Value()
   bei Avira.OE.Systray.Program.Main(System.String[])

Error: (09/17/2014 11:21:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.OE.Systray.exe, Version: 1.1.21.30000, Zeitstempel: 0x5416b774
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x10b8
Startzeit der fehlerhaften Anwendung: 0xAvira.OE.Systray.exe0
Pfad der fehlerhaften Anwendung: Avira.OE.Systray.exe1
Pfad des fehlerhaften Moduls: Avira.OE.Systray.exe2
Berichtskennung: Avira.OE.Systray.exe3

Error: (09/17/2014 11:21:49 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.Systray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
Stapel:
   bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
   bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
   bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.get_AppSettings()
   bei Avira.OE.WinCore.OeProductInfo.get_Culture()
   bei Avira.OE.WinCore.Utility.CultureSetter.SetDefaultCultureDefinedInAppsettings()
   bei Avira.OE.Systray.Program.Main(System.String[])

Error: (09/17/2014 11:20:59 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.OE.Systray.exe, Version: 1.1.21.30000, Zeitstempel: 0x5416b774
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x1674
Startzeit der fehlerhaften Anwendung: 0xAvira.OE.Systray.exe0
Pfad der fehlerhaften Anwendung: Avira.OE.Systray.exe1
Pfad des fehlerhaften Moduls: Avira.OE.Systray.exe2
Berichtskennung: Avira.OE.Systray.exe3

Error: (09/17/2014 11:20:59 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.Systray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
Stapel:
   bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
   bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
   bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.get_AppSettings()
   bei Avira.OE.WinCore.OeProductInfo.get_Culture()
   bei Avira.OE.WinCore.Utility.CultureSetter.SetDefaultCultureDefinedInAppsettings()
   bei Avira.OE.Systray.Program.Main(System.String[])

Error: (09/17/2014 11:20:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.OE.Systray.exe, Version: 1.1.21.30000, Zeitstempel: 0x5416b774
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x1580
Startzeit der fehlerhaften Anwendung: 0xAvira.OE.Systray.exe0
Pfad der fehlerhaften Anwendung: Avira.OE.Systray.exe1
Pfad des fehlerhaften Moduls: Avira.OE.Systray.exe2
Berichtskennung: Avira.OE.Systray.exe3

Error: (09/17/2014 11:20:33 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.Systray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
Stapel:
   bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
   bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
   bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.get_AppSettings()
   bei Avira.OE.WinCore.OeProductInfo.get_Culture()
   bei Avira.OE.WinCore.Utility.CultureSetter.SetDefaultCultureDefinedInAppsettings()
   bei Avira.OE.Systray.Program.Main(System.String[])

Error: (09/17/2014 11:19:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.OE.ServiceHost.exe, Version: 1.1.21.30000, Zeitstempel: 0x5416b759
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0x12f0
Startzeit der fehlerhaften Anwendung: 0xAvira.OE.ServiceHost.exe0
Pfad der fehlerhaften Anwendung: Avira.OE.ServiceHost.exe1
Pfad des fehlerhaften Moduls: Avira.OE.ServiceHost.exe2
Berichtskennung: Avira.OE.ServiceHost.exe3


System errors:
=============
Error: (09/18/2014 07:45:32 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8024200d fehlgeschlagen: Update für Windows 7 (KB2820331)

Error: (09/18/2014 07:29:51 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x800b0100 fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 3.5.1 unter Windows 7 SP1 x86 (KB2894844)

Error: (09/18/2014 07:09:19 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (09/18/2014 07:09:05 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎18.‎09.‎2014 um 19:07:24 unerwartet heruntergefahren.

Error: (09/18/2014 07:06:58 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "iPod-Dienst" wurde mit folgendem Fehler beendet: 
%%-2147417831

Error: (09/18/2014 07:06:53 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (09/18/2014 07:06:36 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎18.‎09.‎2014 um 19:04:28 unerwartet heruntergefahren.

Error: (09/18/2014 07:04:01 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (09/18/2014 07:03:46 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎18.‎09.‎2014 um 19:01:36 unerwartet heruntergefahren.

Error: (09/18/2014 07:00:55 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom


Microsoft Office Sessions:
=========================
Error: (09/17/2014 11:24:39 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Avira.OE.Systray.exe1.1.21.300005416b774KERNELBASE.dll6.1.7601.18409531599f6e04343520000812f169801cfd2bdb84ebf44C:\Program Files\Avira\My Avira\Avira.OE.Systray.exeC:\Windows\system32\KERNELBASE.dll07da5ef3-3eb1-11e4-8b94-88ae1da473b4

Error: (09/17/2014 11:24:36 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.Systray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
Stapel:
   bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
   bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
   bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.get_AppSettings()
   bei Avira.OE.WinCore.OeProductInfo.get_Culture()
   bei Avira.OE.WinCore.Utility.CultureSetter.SetDefaultCultureDefinedInAppsettings()
   bei Avira.OE.Systray.Program.Main(System.String[])

Error: (09/17/2014 11:23:23 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.Systray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.TypeInitializationException
Stapel:
   bei NLog.Common.InternalLogger.Debug(System.String, System.Object[])
   bei NLog.LogFactory.get_Configuration()
   bei NLog.LogFactory.GetLogger(LoggerCacheKey)
   bei NLog.LogFactory.GetLogger(System.String)
   bei NLog.LogManager.GetLogger(System.String)
   bei Avira.OE.WinCore.Utility.LoggerFacade.GetLogger(System.String)
   bei Avira.OE.WinCore.Utility.LoggerFacade.GetCurrentClassLogger()
   bei Avira.OE.WinCore.Lazy`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].get_Value()
   bei Avira.OE.Systray.Program.Main(System.String[])

Error: (09/17/2014 11:21:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Avira.OE.Systray.exe1.1.21.300005416b774KERNELBASE.dll6.1.7601.18409531599f6e04343520000812f10b801cfd2bd641258f3C:\Program Files\Avira\My Avira\Avira.OE.Systray.exeC:\Windows\system32\KERNELBASE.dlla22a28d0-3eb0-11e4-8b94-88ae1da473b4

Error: (09/17/2014 11:21:49 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.Systray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
Stapel:
   bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
   bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
   bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.get_AppSettings()
   bei Avira.OE.WinCore.OeProductInfo.get_Culture()
   bei Avira.OE.WinCore.Utility.CultureSetter.SetDefaultCultureDefinedInAppsettings()
   bei Avira.OE.Systray.Program.Main(System.String[])

Error: (09/17/2014 11:20:59 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Avira.OE.Systray.exe1.1.21.300005416b774KERNELBASE.dll6.1.7601.18409531599f6e04343520000812f167401cfd2bd467fb925C:\Program Files\Avira\My Avira\Avira.OE.Systray.exeC:\Windows\system32\KERNELBASE.dll84af2fb5-3eb0-11e4-8b94-88ae1da473b4

Error: (09/17/2014 11:20:59 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.Systray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
Stapel:
   bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
   bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
   bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.get_AppSettings()
   bei Avira.OE.WinCore.OeProductInfo.get_Culture()
   bei Avira.OE.WinCore.Utility.CultureSetter.SetDefaultCultureDefinedInAppsettings()
   bei Avira.OE.Systray.Program.Main(System.String[])

Error: (09/17/2014 11:20:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Avira.OE.Systray.exe1.1.21.300005416b774KERNELBASE.dll6.1.7601.18409531599f6e04343520000812f158001cfd2bd36ac5313C:\Program Files\Avira\My Avira\Avira.OE.Systray.exeC:\Windows\system32\KERNELBASE.dll74d24421-3eb0-11e4-8b94-88ae1da473b4

Error: (09/17/2014 11:20:33 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.Systray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund eines Ausnahmefehlers beendet.
Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
Stapel:
   bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
   bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
   bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.GetSection(System.String)
   bei System.Configuration.ConfigurationManager.get_AppSettings()
   bei Avira.OE.WinCore.OeProductInfo.get_Culture()
   bei Avira.OE.WinCore.Utility.CultureSetter.SetDefaultCultureDefinedInAppsettings()
   bei Avira.OE.Systray.Program.Main(System.String[])

Error: (09/17/2014 11:19:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Avira.OE.ServiceHost.exe1.1.21.300005416b759KERNELBASE.dll6.1.7601.18409531599f6e04343520000812f12f001cfd2bd2120914cC:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exeC:\Windows\system32\KERNELBASE.dll5fd7b64b-3eb0-11e4-8b94-88ae1da473b4


==================== Memory info =========================== 

Processor: Intel(R) Atom(TM) CPU N550 @ 1.50GHz
Percentage of memory in use: 93%
Total physical RAM: 1013.09 MB
Available physical RAM: 68.11 MB
Total Pagefile: 2037.09 MB
Available Pagefile: 622.79 MB
Total Virtual: 2047.88 MB
Available Virtual: 1908.91 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:215.78 GB) (Free:160.26 GB) NTFS
Drive d: (SILKE) (Removable) (Total:14.54 GB) (Free:14.35 GB) FAT32
Drive e: () (Fixed) (Total:4 GB) (Free:2.66 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 7780DBDC)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Not Active) - (Size=4 GB) - (Type=0C)
Partition 3: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=215.8 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 14.6 GB) (Disk ID: 6E652072)
No partition Table on disk 1.

==================== End Of Log ============================
         

<?xml version="1.0" encoding="UTF-16" ?>
<mbam-log>
<header>
<date>2014/09/17 23:39:01 +0200</date>
<logfile>mbam-log-2014-09-17 (23-38-59).xml</logfile>
<isadmin>yes</isadmin>
</header>
<engine>
<version>2.00.2.1012</version>
<malware-database>v2014.09.17.09</malware-database>
<rootkit-database>v2014.09.15.01</rootkit-database>
<license>free</license>
<file-protection>disabled</file-protection>
<web-protection>disabled</web-protection>
<self-protection>disabled</self-protection>
</engine>
<system>
<osversion>Windows 7 Service Pack 1</osversion>
<arch>x86</arch>
<username>Snoopy</username>
<filesys>NTFS</filesys>
</system>
<summary>
<type>threat</type>
<result>completed</result>
<objects>284801</objects>
<time>1164</time>
<processes>0</processes>
<modules>0</modules>
<keys>4</keys>
<values>1</values>
<datas>0</datas>
<folders>6</folders>
<files>5</files>
<sectors>0</sectors>
</summary>
<options>
<memory>enabled</memory>
<startup>enabled</startup>
<filesystem>enabled</filesystem>
<archives>enabled</archives>
<rootkits>disabled</rootkits>
<deeprootkit>disabled</deeprootkit>
<heuristics>enabled</heuristics>
<pup>enabled</pup>
<pum>enabled</pum>
</options>
<items>
<key><path>HKLM\SOFTWARE\CLASSES\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}</path><vendor>PUP.Optional.DynConIE.A</vendor><action>success</action><hash>bffe826c0c6f96a0189a0c7f40c2837d</hash></key>
<key><path>HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{93DBF2BB-A2B3-4683-A92E-57E60751F346}</path><vendor>PUP.Optional.ValueApps.A</vendor><action>success</action><hash>15a8c02e47347cba1fc90784ff0309f7</hash></key>
<key><path>HKU\S-1-5-21-2301319699-1085852292-2356845617-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\DynConIE</path><vendor>PUP.Optional.MultiIE.A</vendor><action>success</action><hash>59646c82b1ca3600b094026745bffe02</hash></key>
<key><path>HKU\S-1-5-21-2301319699-1085852292-2356845617-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CONDUIT\ValueApps</path><vendor>PUP.Optional.ValueApps.A</vendor><action>success</action><hash>4b72c727a3d84fe79653a095ac5745bb</hash></key>
<value><path>HKU\S-1-5-21-2301319699-1085852292-2356845617-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN</path><valuename>NextLive</valuename><vendor>PUP.Optional.NextLive.A</vendor><action>success</action><valuedata>C:\Windows\system32\rundll32.exe &quot;C:\Users\Snoopy\AppData\Roaming\newnext.me\nengine.dll&quot;,EntryPoint -m l</valuedata><hash>eecf0de1bbc069cdd1e02a3a9869d62a</hash></value>
<folder><path>C:\Users\Snoopy\AppData\Roaming\newnext.me</path><vendor>PUP.Optional.NextLive.A</vendor><action>success</action><hash>8b32fcf25d1eb185fe15954050b213ed</hash></folder>
<folder><path>C:\Users\Snoopy\AppData\Roaming\newnext.me\cache</path><vendor>PUP.Optional.NextLive.A</vendor><action>success</action><hash>8b32fcf25d1eb185fe15954050b213ed</hash></folder>
<folder><path>C:\Program Files\Conduit\ValueApps</path><vendor>PUP.Optional.ValueAppsplugin.A</vendor><action>success</action><hash>8e2fa6480477bb7b1b3706cfa65c38c8</hash></folder>
<folder><path>C:\Program Files\Conduit\ValueApps\IE</path><vendor>PUP.Optional.ValueAppsplugin.A</vendor><action>success</action><hash>8e2fa6480477bb7b1b3706cfa65c38c8</hash></folder>
<folder><path>C:\Users\Snoopy\AppData\Local\Conduit\ValueApps</path><vendor>PUP.Optional.ValueAppsplugin.A</vendor><action>success</action><hash>9e1faf3fed8e50e6a9aba1342fd326da</hash></folder>
<folder><path>C:\Program Files\Re-markit</path><vendor>PUP.Optional.ReMarkIt.A</vendor><action>success</action><hash>c6f7c22ce79435011e64736632d09070</hash></folder>
<file><path>C:\Users\Snoopy\AppData\Roaming\newnext.me\nengine.dll</path><vendor>PUP.Optional.NextLive.A</vendor><action>success</action><hash>eecf0de1bbc069cdd1e02a3a9869d62a</hash></file>
<file><path>C:\Users\Snoopy\AppData\Local\genienext\nengine.dll</path><vendor>PUP.Optional.NextLive.A</vendor><action>success</action><hash>03ba4ea06b10d2645c5599cbbe43f60a</hash></file>
<file><path>C:\Users\Snoopy\AppData\Roaming\newnext.me\nengine.cookie</path><vendor>PUP.Optional.NextLive.A</vendor><action>success</action><hash>8b32fcf25d1eb185fe15954050b213ed</hash></file>
<file><path>C:\Users\Snoopy\AppData\Roaming\newnext.me\cache\spark.bin</path><vendor>PUP.Optional.NextLive.A</vendor><action>success</action><hash>8b32fcf25d1eb185fe15954050b213ed</hash></file>
<file><path>C:\Program Files\Conduit\ValueApps\IE\tmpresp.tmp</path><vendor>PUP.Optional.ValueAppsplugin.A</vendor><action>success</action><hash>8e2fa6480477bb7b1b3706cfa65c38c8</hash></file>
</items>
</mbam-log>