RedBarron

May 3, 2012

Ok, so I thought I was good, then I got the same thing again:

2012/05/02 10:52:53 +0800 IP-BLOCK 122.70.141.101 (Type: outgoing, Port: 59021, Process: chrome.exe)

Here is the OTL log:

All processes killed

========== OTL ==========

Registry value HKEY_USERS\S-1-5-21-3948093705-1484294097-1952622497-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.

========== COMMANDS ==========

[EMPTYJAVA]

User: All Users

User: Arne

->Java cache emptied: 10237700 bytes

User: Default

User: Default User

User: Public

Total Java Files Cleaned = 10.00 mb

[EMPTYTEMP]

User: All Users

User: Arne

->Temp folder emptied: 56522282 bytes

->Temporary Internet Files folder emptied: 56483518 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 80288214 bytes

->Google Chrome cache emptied: 363081678 bytes

->Flash cache emptied: 112725 bytes

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Public

->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 74464 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 531.00 mb

OTL by OldTimer - Version 3.2.42.1 log created on 05032012_122652

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Here is the MBAM, ran a full scan:

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org

Database version: v2012.05.03.01

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 8.0.7601.17514

[administrator]

Protection: Enabled

03.05.2012 13:29:15

mbam-log-2012-05-03 (13-29-15).txt

Scan type: Full scan

Scan options disabled: P2P

Objects scanned: 293548

Time elapsed: 1 hour(s), 26 minute(s), 30 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

April 28, 2012

Hey, sorry I didn't see your last post, I will do it tomorrow.. btw. this is the last time Malwarebytes blocked anything:

2012/04/26 00:59:13 +0800 IP-BLOCK 60.190.222.181 (Type: outgoing, Port: 50196, Process: chrome.exe)

so fingers crossed, maybe something helped along the way

April 27, 2012

OTL logfile created on: 4/27/2012 11:53:35 PM - Run 1

OTL by OldTimer - Version 3.2.42.1 Folder = C:\Users\Arne\Desktop

Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000409 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy

1013.30 Mb Total Physical Memory | 157.65 Mb Available Physical Memory | 15.56% Memory free

2.10 Gb Paging File | 0.61 Gb Available in Paging File | 28.98% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files

Drive C: | 150.27 Gb Total Space | 90.28 Gb Free Space | 60.08% Space Free | Partition Type: NTFS

Drive D: | 67.51 Gb Total Space | 65.42 Gb Free Space | 96.90% Space Free | Partition Type: NTFS

Computer Name: ARNE-PC | User Name: Arne | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/27 23:52:40 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Arne\Desktop\OTL.exe

PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2012/04/04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2011/09/29 20:13:22 | 000,771,640 | ---- | M] () -- C:\Program Files\Google\Google Pinyin 3\GooglePinyinService.exe

PRC - [2011/09/29 20:13:19 | 001,181,240 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Google Pinyin 3\GooglePinyinDaemon.exe

PRC - [2011/08/04 04:43:45 | 000,645,048 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe

PRC - [2011/06/15 15:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe

PRC - [2011/04/27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

PRC - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

PRC - [2011/02/25 13:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2011/01/17 18:37:40 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe

PRC - [2011/01/17 18:37:40 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin

PRC - [2011/01/17 18:37:40 | 000,307,200 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\scalc.exe

PRC - [2010/11/23 14:26:41 | 000,503,808 | ---- | M] (Author - Igor Vigdorchik) -- C:\Program Files\Sticky Notes\StickyNotes.exe

PRC - [2010/11/20 20:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2009/11/20 12:01:36 | 002,247,168 | ---- | M] (SEC) -- C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe

PRC - [2009/10/26 19:53:14 | 000,091,136 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe

PRC - [2009/10/02 23:48:26 | 000,795,936 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

PRC - [2009/10/02 23:48:26 | 000,595,232 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

PRC - [2009/03/05 17:54:50 | 000,311,296 | ---- | M] () -- C:\Windows\System32\Rezip.exe

========== Modules (No Company Name) ==========

MOD - [2012/04/12 15:37:34 | 000,444,400 | ---- | M] () -- C:\Users\Arne\AppData\Local\Google\Chrome\Application\18.0.1025.162\ppgooglenaclpluginchrome.dll

MOD - [2012/04/12 15:37:33 | 003,915,248 | ---- | M] () -- C:\Users\Arne\AppData\Local\Google\Chrome\Application\18.0.1025.162\pdf.dll

MOD - [2012/04/12 15:36:18 | 000,544,240 | ---- | M] () -- C:\Users\Arne\AppData\Local\Google\Chrome\Application\18.0.1025.162\libglesv2.dll

MOD - [2012/04/12 15:36:17 | 000,117,744 | ---- | M] () -- C:\Users\Arne\AppData\Local\Google\Chrome\Application\18.0.1025.162\libegl.dll

MOD - [2012/04/12 15:36:08 | 000,122,880 | ---- | M] () -- C:\Users\Arne\AppData\Local\Google\Chrome\Application\18.0.1025.162\avutil-51.dll

MOD - [2012/04/12 15:36:06 | 000,220,672 | ---- | M] () -- C:\Users\Arne\AppData\Local\Google\Chrome\Application\18.0.1025.162\avformat-53.dll

MOD - [2012/04/12 15:36:05 | 001,747,456 | ---- | M] () -- C:\Users\Arne\AppData\Local\Google\Chrome\Application\18.0.1025.162\avcodec-53.dll

MOD - [2012/04/12 14:51:55 | 008,743,584 | ---- | M] () -- C:\Users\Arne\AppData\Local\Google\Chrome\Application\18.0.1025.162\gcswf32.dll

MOD - [2011/09/29 20:13:22 | 000,771,640 | ---- | M] () -- C:\Program Files\Google\Google Pinyin 3\GooglePinyinService.exe

MOD - [2011/03/15 20:40:00 | 000,985,088 | ---- | M] () -- C:\Program Files\OpenOffice.org 3\program\libxml2.dll

MOD - [2011/03/15 20:40:00 | 000,170,496 | ---- | M] () -- C:\Program Files\OpenOffice.org 3\program\libxslt.dll

========== Win32 Services (SafeList) ==========

SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2011/08/04 04:43:45 | 000,645,048 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent)

SRV - [2011/04/27 15:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)

SRV - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)

SRV - [2009/10/02 23:48:26 | 000,595,232 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)

SRV - [2009/07/14 09:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2009/03/05 17:54:50 | 000,311,296 | ---- | M] () [Auto | Running] -- C:\Windows\System32\Rezip.exe -- (Rezip)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Arne\AppData\Local\Temp\phoenix\PhnxBldr.sys -- (PhnxBuilder)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\HyperSpace\PhnxBldr.sys -- (PhnxBldr)

DRV - File not found [Kernel | On_Demand | Unknown] -- C:\ComboFix\mbr.sys -- (mbr)

DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\Arne\AppData\Local\Temp\catchme.sys -- (catchme)

DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\Arne\AppData\Local\Temp\aswMBR.sys -- (aswMBR)

DRV - [2012/04/27 08:15:47 | 000,029,904 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{48200D8E-3AB9-437A-A139-7AE66C543B8C}\MpKsl61bf4070.sys -- (MpKsl61bf4070)

DRV - [2012/04/25 22:52:35 | 000,013,824 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:\Windows\System32\drivers\TrueSight.sys -- (TrueSight)

DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2011/12/13 03:32:24 | 002,228,224 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)

DRV - [2011/08/04 04:27:28 | 000,019,192 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vpnva.sys -- (vpnva)

DRV - [2011/04/27 15:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)

DRV - [2011/04/18 13:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)

DRV - [2010/11/20 18:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010/11/20 17:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2010/06/17 04:33:40 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\taphss.sys -- (taphss)

DRV - [2009/09/28 17:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)

DRV - [2009/07/14 07:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)

DRV - [2009/07/02 04:46:20 | 000,043,944 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btusbflt.sys -- (btusbflt)

DRV - [2009/05/01 18:11:06 | 000,384,896 | ---- | M] (Phoenix Technologies Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CryptOSD.sys -- (CryptOSD)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN'>http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7'>http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3948093705-1484294097-1952622497-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/

IE - HKU\S-1-5-21-3948093705-1484294097-1952622497-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}

IE - HKU\S-1-5-21-3948093705-1484294097-1952622497-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-3948093705-1484294097-1952622497-1000\..\SearchScopes\{4C7AABE8-8045-4207-926A-F5EE06FA9BD6}: "URL" = http://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=937811&p={searchTerms}

IE - HKU\S-1-5-21-3948093705-1484294097-1952622497-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN'>http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_en

IE - HKU\S-1-5-21-3948093705-1484294097-1952622497-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7'>http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKU\S-1-5-21-3948093705-1484294097-1952622497-1000\..\SearchScopes\{8B5AE1A3-BDD6-4CE8-8289-C5C05BBAAA7F}: "URL" = http://de.search.yahoo.com/search?fr=mcafee&p={SearchTerms}

IE - HKU\S-1-5-21-3948093705-1484294097-1952622497-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Secure Search"

FF - prefs.js..browser.search.selectedEngine: "Wikipedia (en)"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "www.google.com"

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26

FF - prefs.js..extensions.enabledItems: {5384767E-00D9-40E9-B72F-9CC39D655D6F}:1.4.1.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29

FF - prefs.js..keyword.URL: "http://www.google.com/search?hl=en-GB&q="

FF - prefs.js..network.proxy.autoconfig_url: "http://proxy.io8.org/autoproxy/e1.pac"

FF - prefs.js..network.proxy.http: "http://proxy.io8.org/autoproxy/e1.pac"

FF - prefs.js..network.proxy.type: 0

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\windows\system32\npdeployJava1.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll File not found

FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall,version=1.0.0: %commonprogramfiles%\tencent\NPQSCALL\npqscall.dll File not found

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Arne\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Arne\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/10 00:20:44 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/27 23:42:54 | 000,000,000 | ---D | M]

[2010/07/02 20:33:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Arne\AppData\Roaming\Mozilla\Extensions

[2012/02/25 21:55:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Arne\AppData\Roaming\Mozilla\Firefox\Profiles\6pojc2zr.default\extensions

[2012/02/19 14:49:05 | 000,000,000 | ---D | M] (EPUBReader) -- C:\Users\Arne\AppData\Roaming\Mozilla\Firefox\Profiles\6pojc2zr.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}

[2012/02/25 21:55:52 | 000,000,000 | ---D | M] (Perapera Chinese) -- C:\Users\Arne\AppData\Roaming\Mozilla\Firefox\Profiles\6pojc2zr.default\extensions\chineseperakun@gmail.com

[2010/10/24 00:05:57 | 000,001,632 | ---- | M] () -- C:\Users\Arne\AppData\Roaming\Mozilla\Firefox\Profiles\6pojc2zr.default\searchplugins\firefox-add-ons.xml

[2010/10/24 00:09:28 | 000,001,330 | ---- | M] () -- C:\Users\Arne\AppData\Roaming\Mozilla\Firefox\Profiles\6pojc2zr.default\searchplugins\wikipedia-en.xml

[2010/10/24 00:36:42 | 000,001,032 | ---- | M] () -- C:\Users\Arne\AppData\Roaming\Mozilla\Firefox\Profiles\6pojc2zr.default\searchplugins\wikipedia-eng.xml

[2012/04/27 23:43:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2012/04/27 23:43:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA}

[2012/04/10 00:20:43 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2012/02/16 18:42:53 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

[2010/07/08 18:12:54 | 000,002,027 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml

[2012/02/16 18:42:53 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: google.com (Default) (Enabled)

CHR - default_search_provider: search_url = http://www.google.com/search?hl=en&source=hp&biw=1228&bih=610&q={searchTerms}&btnG=Google+Search&aq=1&aqi=g10&aql=&oq=cowboy

CHR - default_search_provider: suggest_url =

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Users\Arne\AppData\Local\Google\Chrome\Application\18.0.1025.162\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Arne\AppData\Local\Google\Chrome\Application\18.0.1025.162\pdf.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Arne\AppData\Local\Google\Chrome\Application\18.0.1025.162\gcswf32.dll

CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Arne\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32.dll

CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll

CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll

CHR - plugin: Java Platform SE 6 U29 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll

CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll

CHR - plugin: Google Update (Enabled) = C:\Users\Arne\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll

CHR - plugin: Shockwave for Director (Enabled) = C:\windows\system32\Adobe\Director\np32dsw.dll

CHR - Extension: Offline Google Mail = C:\Users\Arne\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejidjjhkpiempkbhmpbfngldlkglhimk\1.13_0\

CHR - Extension: Google Calendar = C:\Users\Arne\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn\4.5.3_0\

CHR - Extension: Zhongwen: A Chinese-English Popup Dictionary = C:\Users\Arne\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkmlkkjojmombglmlpbpapmhcaljjkde\3.2.1_0\

CHR - Extension: Google Play Books = C:\Users\Arne\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmimngoggfoobjdlefbcabngfnmieonb\1.1.3_0\

O1 HOSTS File: ([2012/04/26 00:22:24 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O3 - HKU\S-1-5-21-3948093705-1484294097-1952622497-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

O4 - HKLM..\Run: [Google Pinyin 3 Autoupdater] C:\Program Files\Google\Google Pinyin 3\GooglePinyinDaemon.exe (Google Inc.)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)

O4 - Startup: C:\Users\Arne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sticky Notes.lnk = C:\Program Files\Sticky Notes\StickyNotes.exe (Author - Igor Vigdorchik)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-3948093705-1484294097-1952622497-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-3948093705-1484294097-1952622497-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 File not found

O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Arne\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html File not found

O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()

O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)

O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)

O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{24FDB2AB-187E-413F-BAF1-7D983CBF9F6D}: DhcpNameServer = 10.0.0.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{581B304F-E7EA-4D69-8E16-B3D564BACED7}: DhcpNameServer = 192.168.1.1

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009/06/11 05:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012/04/27 23:52:35 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Arne\Desktop\OTL.exe

[2012/04/27 23:43:37 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2012/04/26 10:16:31 | 004,731,392 | ---- | C] (AVAST Software) -- C:\Users\Arne\Desktop\aswMBR.exe

[2012/04/26 00:28:13 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012/04/26 00:27:57 | 000,000,000 | ---D | C] -- C:\windows\temp

[2012/04/26 00:21:51 | 000,000,000 | ---D | C] -- C:\Users\Arne\AppData\Local\temp

[2012/04/26 00:05:26 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe

[2012/04/26 00:05:26 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe

[2012/04/26 00:05:26 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe

[2012/04/26 00:05:10 | 000,000,000 | ---D | C] -- C:\windows\ERDNT

[2012/04/26 00:05:00 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012/04/25 23:56:45 | 004,475,034 | R--- | C] (Swearware) -- C:\Users\Arne\Desktop\ComboFix.exe

[2012/04/25 22:52:28 | 000,000,000 | ---D | C] -- C:\Users\Arne\Desktop\RK_Quarantine

[2012/04/23 15:43:51 | 000,000,000 | ---D | C] -- C:\Program Files\igowin

[2012/04/18 23:23:17 | 000,000,000 | ---D | C] -- C:\Users\Arne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anvisoft

[2012/04/18 23:22:55 | 000,000,000 | ---D | C] -- C:\Program Files\Anvisoft

[2012/04/18 19:43:48 | 000,000,000 | ---D | C] -- C:\Users\Arne\AppData\Roaming\Malwarebytes

[2012/04/18 19:43:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012/04/18 19:42:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012/04/18 19:42:48 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys

[2012/04/18 19:42:47 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012/04/18 19:20:11 | 000,000,000 | ---D | C] -- C:\Users\Arne\Documents\China Reading

[2012/04/18 15:14:04 | 000,000,000 | ---D | C] -- C:\Users\Arne\.FBReader

[2012/04/18 15:09:39 | 000,000,000 | ---D | C] -- C:\Users\Arne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FBReader for Windows

[2012/04/18 15:09:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FBReader for Windows

[2012/04/18 15:09:34 | 000,000,000 | ---D | C] -- C:\Program Files\FBReader

[2012/04/18 14:52:12 | 000,000,000 | ---D | C] -- C:\Users\Arne\AppData\Roaming\calibre

[2012/04/12 21:24:31 | 000,000,000 | ---D | C] -- C:\Users\Arne\Desktop\German

[2012/04/12 21:24:05 | 000,000,000 | ---D | C] -- C:\Users\Arne\Desktop\English

[2012/04/11 19:48:59 | 000,000,000 | ---D | C] -- C:\Users\Arne\Desktop\bigword

[2012/04/05 20:29:36 | 000,000,000 | ---D | C] -- C:\windows\Minidump

========== Files - Modified Within 30 Days ==========

[2012/04/27 23:52:40 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Arne\Desktop\OTL.exe

[2012/04/27 23:43:10 | 000,001,116 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3948093705-1484294097-1952622497-1000UA.job

[2012/04/27 23:13:03 | 000,000,886 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job

[2012/04/27 22:43:10 | 000,000,094 | -H-- | M] () -- C:\Users\Arne\Documents\.~lock.Plan.ods#

[2012/04/27 22:43:04 | 000,001,064 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-3948093705-1484294097-1952622497-1000Core.job

[2012/04/27 20:13:01 | 000,000,882 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job

[2012/04/27 18:28:19 | 000,037,637 | ---- | M] () -- C:\Users\Arne\Documents\Plan.ods

[2012/04/27 16:45:06 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat

[2012/04/26 16:31:18 | 000,649,912 | ---- | M] () -- C:\Users\Arne\Desktop\02.jpg

[2012/04/26 16:29:54 | 000,301,135 | ---- | M] () -- C:\Users\Arne\Desktop\01.jpg

[2012/04/26 10:49:37 | 000,254,651 | ---- | M] () -- C:\Users\Arne\Desktop\malware still there.jpg

[2012/04/26 10:48:40 | 000,000,512 | ---- | M] () -- C:\Users\Arne\Desktop\MBR.dat

[2012/04/26 10:17:24 | 004,731,392 | ---- | M] (AVAST Software) -- C:\Users\Arne\Desktop\aswMBR.exe

[2012/04/26 00:22:24 | 000,000,027 | ---- | M] () -- C:\windows\System32\drivers\etc\hosts

[2012/04/25 23:57:15 | 004,475,034 | R--- | M] (Swearware) -- C:\Users\Arne\Desktop\ComboFix.exe

[2012/04/25 23:51:07 | 000,194,984 | ---- | M] () -- C:\Users\Arne\Desktop\most recent malware.jpg

[2012/04/25 22:52:35 | 000,013,824 | ---- | M] () -- C:\windows\System32\drivers\TrueSight.sys

[2012/04/25 18:45:36 | 000,010,272 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012/04/25 18:45:36 | 000,010,272 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012/04/25 18:38:06 | 796,889,088 | -HS- | M] () -- C:\hiberfil.sys

[2012/04/24 19:42:28 | 000,038,593 | ---- | M] () -- C:\Users\Arne\Desktop\outgoing malware small.jpg

[2012/04/24 19:41:36 | 000,208,399 | ---- | M] () -- C:\Users\Arne\Desktop\outgoing malware.jpg

[2012/04/24 13:02:27 | 154,344,779 | ---- | M] () -- C:\windows\MEMORY.DMP

[2012/04/19 00:03:58 | 000,618,108 | ---- | M] () -- C:\windows\System32\perfh009.dat

[2012/04/19 00:03:58 | 000,107,388 | ---- | M] () -- C:\windows\System32\perfc009.dat

[2012/04/18 19:43:13 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012/04/18 15:09:40 | 000,001,835 | ---- | M] () -- C:\Users\Arne\Desktop\FBReader.lnk

[2012/04/18 11:31:05 | 000,001,984 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk

[2012/04/18 11:07:08 | 000,349,848 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT

[2012/04/14 01:14:56 | 000,002,358 | ---- | M] () -- C:\Users\Arne\Desktop\Google Chrome.lnk

[2012/04/08 23:14:32 | 011,364,790 | ---- | M] () -- C:\Users\Arne\Documents\671790WP0P127500China020300complete.pdf

[2012/04/04 18:44:35 | 000,726,148 | ---- | M] () -- C:\Users\Arne\Documents\chinas_12th_five-year_plan.pdf

[2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2012/04/27 22:43:10 | 000,000,094 | -H-- | C] () -- C:\Users\Arne\Documents\.~lock.Plan.ods#

[2012/04/26 16:24:36 | 000,301,135 | ---- | C] () -- C:\Users\Arne\Desktop\01.jpg

[2012/04/26 16:24:19 | 000,649,912 | ---- | C] () -- C:\Users\Arne\Desktop\02.jpg

[2012/04/26 10:49:36 | 000,254,651 | ---- | C] () -- C:\Users\Arne\Desktop\malware still there.jpg

[2012/04/26 10:48:40 | 000,000,512 | ---- | C] () -- C:\Users\Arne\Desktop\MBR.dat

[2012/04/26 00:05:26 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe

[2012/04/26 00:05:26 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe

[2012/04/26 00:05:26 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe

[2012/04/26 00:05:26 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe

[2012/04/26 00:05:26 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe

[2012/04/25 23:51:07 | 000,194,984 | ---- | C] () -- C:\Users\Arne\Desktop\most recent malware.jpg

[2012/04/25 22:52:35 | 000,013,824 | ---- | C] () -- C:\windows\System32\drivers\TrueSight.sys

[2012/04/24 19:42:27 | 000,038,593 | ---- | C] () -- C:\Users\Arne\Desktop\outgoing malware small.jpg

[2012/04/24 19:41:35 | 000,208,399 | ---- | C] () -- C:\Users\Arne\Desktop\outgoing malware.jpg

[2012/04/18 19:43:13 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012/04/18 15:09:40 | 000,001,835 | ---- | C] () -- C:\Users\Arne\Desktop\FBReader.lnk

[2012/04/08 23:19:19 | 011,364,790 | ---- | C] () -- C:\Users\Arne\Documents\671790WP0P127500China020300complete.pdf

[2012/04/05 20:29:31 | 154,344,779 | ---- | C] () -- C:\windows\MEMORY.DMP

[2012/04/04 18:44:42 | 000,726,148 | ---- | C] () -- C:\Users\Arne\Documents\chinas_12th_five-year_plan.pdf

[2011/09/29 20:13:23 | 000,305,720 | ---- | C] () -- C:\windows\System32\GooglePinyin3EnRes.dll

[2011/09/25 15:47:48 | 000,018,760 | ---- | C] () -- C:\windows\System32\QQVistaHelper.dll

[2011/09/02 15:11:11 | 000,004,608 | ---- | C] () -- C:\Users\Arne\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011/08/17 17:27:18 | 000,000,000 | ---- | C] () -- C:\windows\PowerReg.dat

[2010/12/21 16:11:28 | 000,007,599 | ---- | C] () -- C:\Users\Arne\AppData\Local\Resmon.ResmonCfg

[2010/11/23 14:57:24 | 000,000,652 | ---- | C] () -- C:\windows\System32\drivers\scdskr01.dat

[2010/11/23 14:57:24 | 000,000,500 | ---- | C] () -- C:\windows\System32\drivers\RSTable.dat

[2010/11/23 14:57:24 | 000,000,436 | ---- | C] () -- C:\windows\System32\drivers\scdhkr01.dat

[2010/11/23 14:57:23 | 000,000,036 | ---- | C] () -- C:\windows\System32\drivers\scdstr01.dat

[2010/08/25 21:14:55 | 000,000,000 | ---- | C] () -- C:\Users\Arne\AppData\Roaming\wklnhst.dat

[2010/08/08 22:51:39 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2010/06/29 22:31:44 | 000,000,002 | ---- | C] () -- C:\windows\HotFixList.ini

========== LOP Check ==========

[2012/02/11 17:32:06 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\.anki

[2012/02/11 10:56:25 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\.matplotlib

[2012/02/17 11:00:39 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\Azureus

[2012/04/18 15:12:46 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\calibre

[2010/10/20 05:25:17 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\DataCast

[2010/10/03 21:39:22 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\DVDVideoSoftIEHelpers

[2012/01/19 01:13:19 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\mplayer

[2010/08/25 06:36:11 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\OpenOffice.org

[2010/08/11 20:04:09 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\PDF reDirect

[2011/02/09 18:45:53 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\PlayFirst

[2010/08/25 21:14:56 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\Template

[2011/09/25 16:01:12 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\Tencent

[2011/06/22 10:36:37 | 000,000,000 | ---D | M] -- C:\Users\Arne\AppData\Roaming\Windows Live Writer

[2012/04/24 13:02:44 | 000,032,608 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Files - Unicode (All) ==========

[2011/11/12 00:53:35 | 000,033,915 | ---- | M] ()(C:\Users\Arne\Documents\??????????????????????.docx) -- C:\Users\Arne\Documents\北京中医药大学国医堂中医门诊部专家出诊时间表.docx

[2011/11/12 00:53:24 | 000,033,915 | ---- | C] ()(C:\Users\Arne\Documents\??????????????????????.docx) -- C:\Users\Arne\Documents\北京中医药大学国医堂中医门诊部专家出诊时间表.docx

========== Alternate Data Streams ==========

@Alternate Data Stream - 139 bytes -> C:\ProgramData\Temp:E1F04E8D

@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:A42A9F39

@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:4CF61E54

@Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:ABE89FFE

< End of report >

OTL Extras logfile created on: 4/27/2012 11:53:36 PM - Run 1

OTL by OldTimer - Version 3.2.42.1 Folder = C:\Users\Arne\Desktop

Starter Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7601.17514)

Locale: 00000409 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy

1013.30 Mb Total Physical Memory | 157.65 Mb Available Physical Memory | 15.56% Memory free

2.10 Gb Paging File | 0.61 Gb Available in Paging File | 28.98% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files

Drive C: | 150.27 Gb Total Space | 90.28 Gb Free Space | 60.08% Space Free | Partition Type: NTFS

Drive D: | 67.51 Gb Total Space | 65.42 Gb Free Space | 96.90% Space Free | Partition Type: NTFS

Computer Name: ARNE-PC | User Name: Arne | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-3948093705-1484294097-1952622497-1000\SOFTWARE\Classes\<extension>]

.bat [@ = batfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"FirewallDisableNotify" = 0

"AntiVirusDisableNotify" = 0

"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{172585EC-A1E4-4B74-830F-2D7C4C2C3E2C}" = lport=2869 | protocol=6 | dir=in | app=system |

"{5E81CDA4-8FC7-4303-B7A7-E0909113DFEA}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |

"{668E2972-5AC1-42D4-B84C-5B1E4B780BC1}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |

"{6AD63518-332F-4098-8F62-AE4ED8AD1BDA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{076C08A2-71AB-45FF-A705-794B0EF82BBA}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |

"{2595AB1F-AC01-4C45-A751-58A1CA407403}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |

"{E5C6471B-A467-490A-B202-30760FFAFA80}" = dir=in | app=c:\program files\skype\phone\skype.exe |

"TCP Query User{0FE0F6EF-5EFF-4946-ABAF-5156CD6BBFC4}C:\program files\vuze\azureus.exe" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |

"UDP Query User{73D83F21-1D89-4EBE-A2B6-3B61D17820C0}C:\program files\vuze\azureus.exe" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam

"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware

"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution 4

"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works

"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager

"{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}" = EasyBatteryManager

"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.6.2

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{26A24AE4-039D-4CA4-87B4-2F83216032FF}" = Java 6 Update 32

"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3

"{44257960-C5CC-45BA-8E83-524E4A0F3FD5}" = Cisco AnyConnect VPN Client

"{45535A5E-1F81-4F35-BE1D-43D10A7D03B4}" = Easy Resolution Manager

"{4725E135-CF7D-4906-B4D0-D9F5FED44254}" = PreSetup HyperSpace

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client

"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime

"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{6D0C6BE4-F674-43D2-96BC-3509345108C9}_is1" = PokerStove version 1.23

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}" = BatteryLifeExtender

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager

"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003

"{92D50865-FC60-4EA8-BA7A-5581B0D13EFB}" = ChargeableUSB

"{95140000-00AF-0409-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer

"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

"{9CF4A37B-A8C4-44D7-8C53-13B9D9594BB2}" = Paint.NET v3.5.8

"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = WIDCOMM Bluetooth Software

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.1

"{B660E0D0-A8CB-45A7-96FB-93E8C915A0B2}" = Easy Network Manager

"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide

"{C19BE821-89B1-4A96-AC7C-873810C0CB5F}" = ContentSAFER for Wizmax

"{C455C4E0-6D64-4CA8-9CE7-C50ADCE61674}" = Xtra Controller Pro

"{CCC2B140-B47A-45FA-AAE3-BD60DA41AE00}" = Samsung Support Center

"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2

"{D1434266-0486-4469-B338-A60082CC04E1}" = Atheros Client Installation Program

"{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus

"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker

"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support

"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F2BC3383-F000-410C-A038-3846ADBE8D90}" = REALTEK Wireless LAN Software

"755087041320E005CB1E8A67C5C55A260EB81B90" = Windows Driver Package - Broadcom Bluetooth (09/11/2009 6.2.0.9407)

"7-Zip" = 7-Zip 4.65

"8461-7759-5462-8226" = Vuze

"A6A8668C0A13640CA28FE2A7D9654BE4AE478B13" = Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405)

"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.6

"Anki" = Anki

"BF20603967CFDCB2BBF91950E8A56DFBC5C833FE" = Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800)

"FBReader for Windows" = FBReader for Windows

"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4

"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8

"GooglePinyin3" = 谷歌拼音输入法 3.0

"HDMI" = Intel® Graphics Media Accelerator Driver

"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400

"Marvell Miniport Driver" = Marvell Miniport Driver

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft Security Client" = Microsoft Security Essentials

"Mozilla Firefox 11.0 (x86 en-US)" = Mozilla Firefox 11.0 (x86 en-US)

"PokerStars" = PokerStars

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"TIPP10_is1" = TIPP10 Version 2.0.3

"Uninstall_is1" = Uninstall 1.0.0.1

"VirtualCloneDrive" = VirtualCloneDrive

"VLC media player" = VLC media player 1.1.5

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3948093705-1484294097-1952622497-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 4/11/2012 12:56:30 PM | Computer Name = Arne-PC | Source = SideBySide | ID = 16842824

Description = Activation context generation failed for "c:\program files\microsoft

security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft

security client\MSESysprep.dll" on line 10. The element imaging appears as a child

of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by

this version of Windows.

Error - 4/13/2012 12:52:02 AM | Computer Name = Arne-PC | Source = SideBySide | ID = 16842785

Description = Activation context generation failed for "C:\Program Files\Samsung\Samsung

Support Center\Drv\drv2x64\KStartMem.exe.Manifest". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"

could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 4/13/2012 12:53:19 AM | Computer Name = Arne-PC | Source = SideBySide | ID = 16842785

Description = Activation context generation failed for "C:\Program Files\Samsung\BatteryLifeExtender\Drv\SABI2x64\KStartMem.exe.Manifest".

Dependent

Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"

could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 4/13/2012 12:55:04 AM | Computer Name = Arne-PC | Source = SideBySide | ID = 16842824

Description = Activation context generation failed for "c:\program files\microsoft

security client\MSESysprep.dll".Error in manifest or policy file "c:\program files\microsoft

security client\MSESysprep.dll" on line 10. The element imaging appears as a child

of element urn:schemas-microsoft-com:asm.v1^assembly which is not supported by

this version of Windows.

Error - 4/13/2012 12:57:35 AM | Computer Name = Arne-PC | Source = SideBySide | ID = 16842785

Description = Activation context generation failed for "c:\program files\Samsung\chargeableusb\ChargeableUSB_64.exe".

Dependent

Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"

could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 4/13/2012 12:57:41 AM | Computer Name = Arne-PC | Source = SideBySide | ID = 16842785

Description = Activation context generation failed for "c:\program files\Samsung\chargeableusb\vista_xp_driver\x64\KStartMem.exe.Manifest".

Dependent

Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"

could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 4/13/2012 1:45:50 PM | Computer Name = Arne-PC | Source = SideBySide | ID = 16842785

Description = Activation context generation failed for "C:\Program Files\Samsung\Samsung

Support Center\Drv\drv2x64\KStartMem.exe.Manifest". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"

could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 4/13/2012 1:47:21 PM | Computer Name = Arne-PC | Source = SideBySide | ID = 16842785

Description = Activation context generation failed for "C:\Program Files\Samsung\BatteryLifeExtender\Drv\SABI2x64\KStartMem.exe.Manifest".

Dependent

Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"

could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 4/16/2012 5:44:01 AM | Computer Name = Arne-PC | Source = SideBySide | ID = 16842785

Description = Activation context generation failed for "C:\Program Files\Samsung\Samsung

Support Center\Drv\drv2x64\KStartMem.exe.Manifest". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"

could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 4/16/2012 9:14:17 PM | Computer Name = Arne-PC | Source = SideBySide | ID = 16842785

Description = Activation context generation failed for "C:\Program Files\Samsung\Samsung

Support Center\Drv\drv2x64\KStartMem.exe.Manifest". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"

could not be found. Please use sxstrace.exe for detailed diagnosis.

[ Cisco AnyConnect VPN Client Events ]

Error - 4/26/2012 7:44:21 PM | Computer Name = ARNE-PC | Source = vpnagent | ID = 67108866

Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:

644 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33161196

(0xFE060014) Description: ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE

Error - 4/26/2012 7:44:21 PM | Computer Name = ARNE-PC | Source = vpnagent | ID = 67108866

Description = Function: CNetEnvironment::TestNetEnv File: .\NetEnvironment.cpp Line:

190 Invoked Function: CNetEnvironment::testNetwork Return Code: -33161196 (0xFE060014)

Description:

ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE