Spyware / Malware / Virus Removal

Firefox redirecting me to search.hotspotshield.com

6 min read

Looking for the outcome? Ask AI

xXSheperdXx Topic Starter

Post #1July 19, 2011, 6:18 AM UTC

Sup every one !? Like the topic title says: Firefox keeps redirecting me to search.hotspotshield.com which is banned by my webmaster. (Gives me the "ERROR" screen) This got really annoying, I tried uninstalling Hotspot shield didn't work. Any help would by highly appreciated

Am willing to cooperate.

Blottedisk

Post #2July 19, 2011, 12:57 PM UTC

Hi xXSheperdXx, welcome to WhatTheTech

My name is Blottedisk and I will be helping you with your malware issues. Before we delve into this, please take a look at the following notes:

Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Watch Topic button to the right of your topic title and then choosing the notification method ( Recommended: Inmediate Notification)
Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then the thread will be locked due to inactivity. However, if you will be away, let us know and we will be sure to keep the thread open.

Step 1 | Download DDS from any of the links below:

Link 1
Link 2
Link 2

——————————————————————–

Save it to your desktop.
Please disable any anti-malware program that will block scripts from running before running DDS.
Double-Click on dds and a command window will appear. This is normal.
Shortly after two logs will appear:
- DDS.txt
- Attach.txt
A window will open instructing you save & post the logs.
Save the logs to a convenient place such as your desktop.
Post the contents of the DDS.txt report in your next reply.
Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

Step 2 | Please download GMER from one of the following locations and save it to your desktop:

Main Mirror - This version will download a randomly named file (Recommended)
Zipped Mirror - This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

——————————————————————–

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.

Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

[external image: Posted Image]

GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system…click NO.
Make sure all options are checked except:
IAT/EAT
Drives/Partition other than Systemdrive, which is typically C:\
Show All (This is important, so do not miss it.)

[external image: Posted Image]
Click the image to enlarge it

Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save… button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and re-enable all active protection when done.

– If you encounter any problems, try running GMER in Safe Mode.

Step 3 | Please download aswMBR to your desktop.

Double click the aswMBR icon to run it.
Vista and Windows 7 users right click the icon and choose "Run as administrator".
Click the Scan button to start scan.
When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it

xXSheperdXx

Post #3July 19, 2011, 5:41 PM UTC

Thank you for responding

So the DDS thing didn't work (I noticed the "Please disable any anti-malware program that will block scripts from running before running DDS." and i have non that i know of, no anti-viruses either)
================================================================================
The GMER Results:
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-07-19 18:37:07
Windows 6.1.7600 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD5000AAKS-55A7B2 rev.01.03B01
Running: l9u7smwt.exe; Driver: C:\Users\Home\AppData\Local\Temp\kxldapob.sys

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82C8A579 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82CAEF52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, …] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
PAGE spsys.sys!?SPRevision@@3PADA + 4F90 A17AB000 290 Bytes [8B, FF, 55, 8B, EC, 33, C0, …]
PAGE spsys.sys!?SPRevision@@3PADA + 50B3 A17AB123 629 Bytes [65, 7A, A1, FE, 05, 34, 65, …]
PAGE spsys.sys!?SPRevision@@3PADA + 5329 A17AB399 101 Bytes [6A, 28, 59, A5, 5E, C6, 03, …]
PAGE spsys.sys!?SPRevision@@3PADA + 538F A17AB3FF 148 Bytes [18, 5D, C2, 14, 00, 8B, FF, …]
PAGE spsys.sys!?SPRevision@@3PADA + 543B A17AB4AB 2228 Bytes [8B, FF, 55, 8B, EC, FF, 75, …]
PAGE …

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Tunngle\TnglCtrl.exe[2020] ntdll.dll!DbgBreakPoint 76F43540 1 Byte [90]
CODE C:\Windows\System32\install\svchost.exe[3220] C:\Windows\System32\install\svchost.exe entry point in "CODE" section [0x0040E1A8]
UPX1 C:\WINDOWS\system\csrss.exe[3884] C:\WINDOWS\system\csrss.exe entry point in "UPX1" section [0x0042F150]
.rsrc C:\WINDOWS\system\csrss.exe[3884] C:\WINDOWS\system\csrss.exe section is executable [0x00430000, 0x18000, 0xE0000020]
.text C:\Program Files\Real\RealPlayer\Update\realsched.exe[4024] kernel32.dll!SetUnhandledExceptionFilter 76A93142 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

—- Devices - GMER 1.0.15 —-

Device \Driver\ACPI_HAL \Device\00000053 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{8C31D1BA-6E9D-11DF-81AC-806E6F6E6963} 5574880784
Reg HKCU\Software\Microsoft\Windows Live\Companion\[removed]@22733b33e6954cd807242066fd8f7b24\r\n 0x49 0xB5 0x76 0x0D …
Reg HKCU\Software\Microsoft\Windows Live\Companion\[removed]@6128aa11103f5c6d1f9de0e01db71946\r\n 0x26 0xBF 0x58 0x32 …

—- Files - GMER 1.0.15 —-

File C:\Windows\System32\LogFiles\Scm\1a7b610e-671c-4ee2-aa96-0f549088cd71 20 bytes

—- EOF - GMER 1.0.15 —-
================================================================================
The aswMBR Results:
aswMBR version 0.9.7.777 Copyright© 2011 AVAST Software
Run date: 2011-07-19 18:07:20
—————————–
18:07:20.571 OS Version: Windows 6.1.7600
18:07:20.571 Number of processors: 4 586 0x403
18:07:20.572 ComputerName: USER-PC UserName: Home
18:07:21.002 Initialize success
18:07:27.287 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
18:07:27.289 Disk 0 Vendor: WDC_WD5000AAKS-55A7B2 01.03B01 Size: 476940MB BusType: 3
18:07:27.295 Disk 0 MBR read successfully
18:07:27.297 Disk 0 MBR scan
18:07:27.299 Disk 0 Windows 7 default MBR code
18:07:27.301 Disk 0 scanning sectors +976771072
18:07:27.387 Disk 0 scanning C:\Windows\system32\drivers
18:07:32.681 Service scanning
18:07:35.399 Disk 0 trace - called modules:
18:07:35.436 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS pciide.sys
18:07:35.440 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8638e7d0]
18:07:35.444 3 CLASSPNP.SYS[8bdac59e] -> nt!IofCallDriver -> [0x85e7c898]
18:07:35.449 5 ACPI.sys[8b80f3b2] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8638d908]
18:07:35.454 Scan finished successfully
18:10:44.882 Disk 0 MBR has been saved successfully to "C:\Users\Home\Desktop\MBR.dat"
18:10:44.890 The log file has been saved successfully to "C:\Users\Home\Desktop\aswMBR.txt"

Blottedisk

Post #4July 19, 2011, 6:23 PM UTC

Don't worry. Please do the following:

Step 1 | Please download OTL from one of the following mirrors:

This is THE Mirror

——————————————————————–

Save it to your desktop
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop. Click here to download it.
Double click inside the Custom Scan box at the bottom.
A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel".
Click the OK button and navigate to the file scan.txt which we just saved to your desktop.
Select scan.txt and click Open. Writing will now appear under the Custom Scan box.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in this topic.
You may need two posts to fit them both in.

Step 2 | Please go to the following site to scan a file: Virus Total

Click on Browse, and upload the following file for analysis:
- C:\WINDOWS\system\csrss.exe
Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

xXSheperdXx

Post #5July 19, 2011, 7:44 PM UTC

K I think we have a prob when I click the download link
[external image: Posted Image]
it redirects me to: http://search.hotspotshield.com/g/results.php?

Blottedisk

Post #6July 19, 2011, 8:46 PM UTC

That's the redirect infection in action. Please omit my previous OTL instructions and follow these ones:

Please download OTL from one of the following mirrors:

This is THE Mirror

——————————————————————–

Save it to your desktop.
Double click on the [external image: Posted Image] icon on your desktop.
Click the "Scan All Users" checkbox.
Push the [external image: Posted Image] button.
Two reports will open, copy and paste them in your next reply:

OTListIt.txt <– Will be opened
Extras.txt <– Will be minimized

Also, remember to do the VirusTotal scan.

xXSheperdXx

Post #7July 21, 2011, 8:44 AM UTC

Sorry for the late reply.
Here's the OTL.Txt :
OTL logfile created on: 7/21/2011 10:41:51 AM - Run 3
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\Home\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.32 Gb Available Physical Memory | 71.52% Memory free
6.50 Gb Paging File | 5.59 Gb Available in Paging File | 86.03% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 117.09 Gb Total Space | 23.67 Gb Free Space | 20.21% Space Free | Partition Type: NTFS
Drive D: | 166.47 Gb Total Space | 45.88 Gb Free Space | 27.56% Space Free | Partition Type: NTFS
Drive E: | 182.10 Gb Total Space | 49.83 Gb Free Space | 27.37% Space Free | Partition Type: NTFS
Drive F: | 1.38 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: USER-PC | User Name: Home | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/19 21:20:38 | 000,579,584 | —- | M] (OldTimer Tools) – C:\Users\Home\Desktop\OTL.exe
PRC - [2011/07/08 07:01:52 | 000,274,608 | —- | M] (RealNetworks, Inc.) – C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2011/07/01 20:40:28 | 000,129,352 | —- | M] () – C:\Program Files\Hotspot Shield\bin\openvpntray.exe
PRC - [2011/07/01 20:38:58 | 000,298,824 | —- | M] () – C:\Program Files\Hotspot Shield\bin\openvpnas.exe
PRC - [2011/06/28 10:03:22 | 001,843,000 | —- | M] (Orbitdownloader.com) – C:\Program Files\Orbitdownloader\orbitdm.exe
PRC - [2011/05/25 17:29:54 | 001,951,112 | —- | M] (LogMeIn Inc.) – C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2011/05/25 17:29:48 | 001,336,712 | —- | M] (LogMeIn Inc.) – C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
PRC - [2011/05/25 02:54:54 | 000,329,544 | —- | M] () – C:\Program Files\Hotspot Shield\bin\hsswd.exe
PRC - [2011/05/25 01:40:12 | 000,363,336 | —- | M] (AnchorFree Inc.) – C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
PRC - [2011/04/01 22:41:24 | 000,742,192 | —- | M] (Pinball Corporation.) – C:\Program Files\ClickPotatoLite\bin\10.0.673.0\ClickPotatoLiteSA.exe
PRC - [2010/07/06 18:14:56 | 000,716,024 | —- | M] (Tunngle.net GmbH) – C:\Program Files\Tunngle\TnglCtrl.exe
PRC - [2010/06/09 00:07:46 | 001,937,344 | —- | M] (Discordia Limited) – C:\Program Files\Bandoo\Bandoo.exe
PRC - [2010/05/06 14:31:34 | 000,796,608 | —- | M] (iMesh, Inc) – C:\Program Files\Windows Searchqu Toolbar\DataMngr\DataMngrUI.exe
PRC - [2010/04/28 22:28:18 | 003,727,411 | —- | M] (FreeDownloadManager.ORG) – C:\Program Files\Free Download Manager\fdm.exe
PRC - [2009/09/27 16:48:00 | 000,240,232 | —- | M] (NVIDIA Corporation) – C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2009/07/14 03:14:42 | 000,049,152 | —- | M] (Microsoft Corporation) – C:\Windows\System32\taskhost.exe
PRC - [2009/07/14 03:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2009/02/26 10:28:54 | 000,084,992 | RHS- | M] () – C:\Windows\system\windows.exe
PRC - [2009/02/26 10:28:54 | 000,084,992 | RHS- | M] () – C:\Windows\system\csrss.exe
PRC - [2005/03/27 05:35:22 | 001,624,064 | —- | M] () – C:\Windows\System32\install\svchost.exe

========== Modules (SafeList) ==========

MOD - [2011/07/19 21:20:38 | 000,579,584 | —- | M] (OldTimer Tools) – C:\Users\Home\Desktop\OTL.exe
MOD - [2009/07/14 03:03:50 | 001,680,896 | —- | M] (Microsoft Corporation) – C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/07/01 20:40:36 | 000,063,976 | —- | M] () [On_Demand | Stopped] – C:\Program Files\Hotspot Shield\bin\HssTrayService.exe – (HssTrayService)
SRV - [2011/07/01 20:38:58 | 000,298,824 | —- | M] () [Auto | Running] – C:\Program Files\Hotspot Shield\bin\openvpnas.exe – (hshld)
SRV - [2011/05/25 17:29:48 | 001,336,712 | —- | M] (LogMeIn Inc.) [Auto | Running] – C:\Program Files\LogMeIn Hamachi\hamachi-2.exe – (Hamachi2Svc)
SRV - [2011/05/25 02:54:54 | 000,329,544 | —- | M] () [Auto | Running] – C:\Program Files\Hotspot Shield\bin\hsswd.exe – (HssWd)
SRV - [2011/05/25 01:40:12 | 000,363,336 | —- | M] (AnchorFree Inc.) [Auto | Running] – C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe – (HssSrv)
SRV - [2010/07/06 18:14:56 | 000,716,024 | —- | M] (Tunngle.net GmbH) [Auto | Running] – C:\Program Files\Tunngle\TnglCtrl.exe – (TunngleService)
SRV - [2010/06/09 00:07:46 | 001,937,344 | —- | M] (Discordia Limited) [Auto | Running] – C:\Program Files\Bandoo\Bandoo.exe – (Bandoo Coordinator)
SRV - [2010/03/29 08:51:54 | 000,068,000 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2009/09/27 16:48:00 | 000,240,232 | —- | M] (NVIDIA Corporation) [Auto | Running] – C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe – (Stereo Service)
SRV - [2009/07/14 03:16:13 | 000,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/14 03:16:12 | 001,004,544 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Windows\System32\PeerDistSvc.dll – (PeerDistSvc)
SRV - [2009/07/14 03:15:41 | 000,680,960 | —- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)

========== Driver Services (SafeList) ==========

DRV - [2011/05/25 01:40:12 | 000,037,376 | —- | M] (AnchorFree Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\HssDrv.sys – (HssDrv)
DRV - [2009/12/30 11:21:16 | 000,027,192 | —- | M] (VS Revo Group) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\revoflt.sys – (Revoflt)
DRV - [2009/11/12 23:42:16 | 000,032,768 | —- | M] (AnchorFree Inc) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\taphss.sys – (taphss)
DRV - [2009/09/28 01:12:21 | 009,509,832 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\nvlddmkm.sys – (nvlddmkm)
DRV - [2009/09/16 08:02:40 | 000,027,136 | —- | M] (Tunngle.net) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\tap0901t.sys – (tap0901t) TAP-Win32 Adapter V9 (Tunngle)
DRV - [2009/07/14 03:19:10 | 000,175,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vmbus.sys – (vmbus)
DRV - [2009/07/14 03:19:10 | 000,040,896 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\vmstorfl.sys – (storflt)
DRV - [2009/07/14 03:19:10 | 000,028,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\storvsc.sys – (storvsc)
DRV - [2009/07/14 01:53:40 | 000,117,248 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\Windows\System32\drivers\rmcast.sys – (RMCAST)
DRV - [2009/07/14 01:51:11 | 000,034,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\winusb.sys – (WinUsb)
DRV - [2009/07/14 01:28:47 | 000,005,632 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\vms3cap.sys – (s3cap)
DRV - [2009/07/14 01:28:45 | 000,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\system32\DRIVERS\VMBusHID.sys – (VMBusHID)
DRV - [2009/05/05 04:00:28 | 000,014,392 | —- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] – C:\Windows\system32\DRIVERS\AtiPcie.sys – (AtiPcie) AMD PCI Express (3GIO)
DRV - [2009/03/18 17:35:40 | 000,026,176 | -H– | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\hamachi.sys – (hamachi)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.hotspotshield.com/g/?c=h
IE - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = proxy.net.sy:3128
IE - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.net.sy:3128

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Hotspot Shield Private Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.1
FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.5
FF - prefs.js..extensions.enabledItems: {DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.3.4
FF - prefs.js..extensions.enabledItems: {A5DCA3F5-ED5A-4ed3-9671-DBB0C68FA469}:1.0
FF - prefs.js..extensions.enabledItems: [removed]:10.0.673.0
FF - prefs.js..keyword.URL: "http://search.hotspotshield.com/g/results.php?c=s&q="
FF - prefs.js..network.proxy.backup.ftp: "proxy.net.sy"
FF - prefs.js..network.proxy.backup.ftp_port: 3128
FF - prefs.js..network.proxy.backup.gopher: "proxy.net.sy"
FF - prefs.js..network.proxy.backup.gopher_port: 3128
FF - prefs.js..network.proxy.backup.socks: "proxy.net.sy"
FF - prefs.js..network.proxy.backup.socks_port: 3128
FF - prefs.js..network.proxy.backup.ssl: "proxy.net.sy"
FF - prefs.js..network.proxy.backup.ssl_port: 3128
FF - prefs.js..network.proxy.ftp: "proxy.net.sy"
FF - prefs.js..network.proxy.ftp_port: 3128
FF - prefs.js..network.proxy.gopher: "proxy.net.sy"
FF - prefs.js..network.proxy.gopher_port: 3128
FF - prefs.js..network.proxy.http: "proxy.net.sy"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "proxy.net.sy"
FF - prefs.js..network.proxy.socks_port: 3128
FF - prefs.js..network.proxy.ssl: "proxy.net.sy"
FF - prefs.js..network.proxy.ssl_port: 3128
FF - prefs.js..network.proxy.type: 1

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll File not found
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.609: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.609: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.652: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.652: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.609: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\ClickPotatoLite\bin\10.0.673.0\firefox\extensions [2011/04/03 20:15:25 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/07/08 07:02:04 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/08 07:02:01 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/07/15 14:40:06 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\[removed]: C:\Users\Home\AppData\Roaming\IDM\idmmzcc5

[2011/02/26 21:02:23 | 000,000,000 | —D | M] (No name found) – C:\Users\Home\AppData\Roaming\Mozilla\Extensions
[2011/07/08 07:15:14 | 000,000,000 | —D | M] (No name found) – C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\37a0yc2d.default\extensions
[2011/04/03 19:56:21 | 000,000,000 | —D | M] (Web Enhancements) – C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\37a0yc2d.default\extensions\{A5DCA3F5-ED5A-4ed3-9671-DBB0C68FA469}
[2011/04/03 20:38:24 | 000,000,000 | —D | M] (Torbutton) – C:\Users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\37a0yc2d.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}
[2011/07/14 07:58:10 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/05/03 16:39:21 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2011/07/14 07:58:10 | 000,000,000 | —D | M] (ScanQuery) – C:\Program Files\Mozilla Firefox\extensions\{DE9265D8-D55D-4286-9DC4-F8D8A0CA2F64}
[2011/07/07 06:34:23 | 000,000,000 | —D | M] (afurladvisor) – C:\Program Files\Mozilla Firefox\extensions\[removed]
File not found (No name found) –
[2011/07/08 07:15:12 | 000,000,000 | —D | M] (OneClick YouTube Downloader) – C:\PROGRAM FILES\ORBITDOWNLOADER\ADDONS\ONECLICKYOUTUBEDOWNLOADER
() (No name found) – C:\USERS\HOME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\37A0YC2D.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
[2011/07/07 09:53:18 | 000,142,296 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/04/01 22:50:44 | 000,087,344 | —- | M] (Pinball Corporation.) – C:\Program Files\mozilla firefox\plugins\npclntax_ClickPotatoLiteSA.dll
[2011/05/03 16:39:18 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/01/01 10:00:00 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/05/25 01:41:10 | 000,001,847 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\privatesearch.xml
[2010/04/12 14:01:50 | 000,005,495 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\SearchquWebSearch.xml

O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (ShoppingReport2) - {258C9770-1713-4021-8D7E-1F184A2BD754} - C:\Program Files\ShoppingReport2\Bin\2.7.37\ShoppingReport.dll (SmartShopper Networks)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Searchqu Toolbar) - {7FF99715-3016-4381-84CE-E4E4C9673020} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\SearchquDx.dll ()
O2 - BHO: (FlashGetBHO) - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - File not found
O2 - BHO: (Web Enhancements) - {CC0F2900-8A5B-4D0D-9E44-10435BC40774} - C:\Program Files\WebEnhancements\WebEnhancements.dll (TODO: )
O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll ()
O2 - BHO: (AnchorFree Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Search-Results)
O2 - BHO: (BandooIEPlugin Class) - {EB5CEE80-030A-4ED8-8E20-454E9C68380F} - C:\Program Files\Bandoo\Plugins\IE\ieplugin.dll (Discordia Limited)
O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.)
O2 - BHO: (Yontoo Layers) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files\Yontoo Layers\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {7FF99715-3016-4381-84CE-E4E4C9673020} - C:\Program Files\Windows Searchqu Toolbar\ToolBar\SearchquDx.dll ()
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKLM\..\Toolbar: (AnchorFree Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Search-Results)
O3 - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002\..\Toolbar\WebBrowser: (AnchorFree Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Search-Results)
O4 - HKLM..\Run: [C:\WINDOWS\system\csrss.exe] C:\Windows\system\csrss.exe ()
O4 - HKLM..\Run: [C:\WINDOWS\system\windows.exe] C:\Windows\system\windows.exe ()
O4 - HKLM..\Run: [ClickPotatoLiteSA] C:\Program Files\ClickPotatoLite\bin\10.0.673.0\ClickPotatoLiteSA.exe (Pinball Corporation.)
O4 - HKLM..\Run: [D:\Games.exe] D:\Games.exe ()
O4 - HKLM..\Run: [DataMngr] C:\Program Files\Windows Searchqu Toolbar\DataMngr\DataMngrUI.exe (iMesh, Inc)
O4 - HKLM..\Run: [G:\New Folder.exe] File not found
O4 - HKLM..\Run: [G:\RECYCLER.exe] File not found
O4 - HKLM..\Run: [HKLM] C:\Windows\System32\install\svchost.exe ()
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe (FreeDownloadManager.ORG)
O4 - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002..\Run: [fsm] File not found
O4 - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002..\Run: [HKCU] C:\Windows\System32\install\svchost.exe ()
O4 - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002..\Run: [msnmsgr] File not found
O4 - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002..\Run: [Vidalia] C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe ()
O4 - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002..\Run: [مجلدجديد.exe] C:\Windows\System32\winlog0n.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\Windows\System32\install\svchost.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\Windows\System32\install\svchost.exe ()
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Download all with Free Download Manager - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Download selected with Free Download Manager - C:\Program Files\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Download video with Free Download Manager - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Download with Free Download Manager - C:\Program Files\Free Download Manager\dllink.htm ()
O9 - Extra Button: ClickPotato - {B58926D6-CFB0-45d2-9C28-4B5A0F0368AE} - C:\Program Files\ClickPotatoLite\bin\10.0.673.0\ClickPotatoLiteSABHO.dll (Pinball Corporation)
O9 - Extra Button: ShopperReports - Compare product prices - {DB38E21A-0133-419d-92AD-ECDFD5244D6D} - C:\Program Files\ShoppingReport2\Bin\2.7.37\ShoppingReport.dll (SmartShopper Networks)
O9 - Extra Button: ShopperReports - Compare travel rates - {EB620C54-E229-4942-87CE-E717109FC8C6} - C:\Program Files\ShoppingReport2\Bin\2.7.37\ShoppingReport.dll (SmartShopper Networks)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-2595867459-2590384048-1320628684-1002\..Trusted Ranges: Range1979 ([http] in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O20 - AppInit_DLLs: (c:\progra~1\wia6eb~1\datamngr\datamngr.dll) - c:\Program Files\Windows Searchqu Toolbar\DataMngr\datamngr.dll (iMesh, Inc)
O20 - AppInit_DLLs: (c:\progra~1\bandoo\bndhook.dll) - c:\Program Files\Bandoo\BndHook.dll (Discordia Limited)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2011/07/09 19:50:32 | 000,000,122 | -HS- | M] () - E:\autorun.inf – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/20 14:12:26 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Focus Home Interactive
[2011/07/20 10:56:46 | 000,000,000 | —D | C] – C:\Users\Home\Documents\Electronic Arts
[2011/07/19 21:20:20 | 000,579,584 | —- | C] (OldTimer Tools) – C:\Users\Home\Desktop\OTL.exe
[2011/07/19 18:04:20 | 001,913,344 | —- | C] (AVAST Software) – C:\Users\Home\Desktop\aswMBR.exe
[2011/07/19 16:05:31 | 000,351,780 | —- | C] (Swearware) – C:\Users\Home\Desktop\dds.scr
[2011/07/17 18:16:13 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\3DMGAME
[2011/07/15 14:40:03 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/07/15 10:02:23 | 000,000,000 | —D | C] – C:\Users\Home\Documents\Command & Conquer 3 Kane's Wrath
[2011/07/15 10:01:21 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Command & Conquer 3 Kane's Wrath
[2011/07/15 09:35:39 | 000,000,000 | —D | C] – C:\Users\Home\Documents\Command and Conquer Generals Data
[2011/07/15 08:11:03 | 000,000,000 | —D | C] – C:\Users\Home\Documents\Command & Conquer 3 Tiberium Wars
[2011/07/15 08:08:27 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2011/07/14 21:24:38 | 000,000,000 | —D | C] – C:\Users\Home\Documents\Command and Conquer Generals Zero Hour Data
[2011/07/14 21:12:16 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Command and Conquer Generals Zero Hour
[2011/07/14 21:00:34 | 000,000,000 | —D | C] – C:\Users\Home\Documents\ZeroHour
[2011/07/08 20:08:24 | 000,000,000 | -H-D | C] – C:\Windows\PIF
[2011/07/08 07:15:15 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\ProgSense
[2011/07/08 07:15:13 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\GrabPro
[2011/07/08 07:15:12 | 000,000,000 | —D | C] – C:\Program Files\Orbitdownloader
[2011/07/08 07:15:12 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Orbit
[2011/07/08 07:15:12 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Orbit
[2011/07/08 07:02:05 | 000,000,000 | —D | C] – C:\Program Files\Common Files\xing shared
[2011/07/08 07:02:00 | 000,199,904 | —- | C] (RealNetworks, Inc.) – C:\Windows\System32\rmoc3260.dll
[2011/07/08 07:01:53 | 000,272,896 | —- | C] (Progressive Networks) – C:\Windows\System32\pncrt.dll
[2011/07/08 07:01:53 | 000,006,656 | —- | C] (RealNetworks, Inc.) – C:\Windows\System32\pndx5016.dll
[2011/07/08 07:01:53 | 000,005,632 | —- | C] (RealNetworks, Inc.) – C:\Windows\System32\pndx5032.dll
[2011/07/08 07:01:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Real
[2011/07/07 06:35:01 | 000,000,000 | —D | C] – C:\ProgramData\hssff
[2011/07/07 06:34:33 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hotspot Shield
[2011/07/07 06:34:23 | 000,000,000 | —D | C] – C:\Program Files\Hotspot Shield
[2011/07/06 14:41:44 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Simple Port Forwarding
[2011/07/06 14:41:43 | 000,000,000 | —D | C] – C:\Windows\Simple Port Forwarding
[2011/07/06 14:41:43 | 000,000,000 | —D | C] – C:\Program Files\Simple Port Forwarding
[2011/07/06 14:24:17 | 000,000,000 | —D | C] – C:\Windows\Simple Static IP
[2011/07/06 14:24:17 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Simple Static IP
[2011/07/06 14:24:17 | 000,000,000 | —D | C] – C:\Program Files\Simple Static IP
[2011/07/06 13:55:32 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\PMB Files
[2011/07/05 22:17:12 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Heroes of Newerth
[2011/07/05 22:17:11 | 000,000,000 | —D | C] – C:\Users\Home\Documents\Heroes of Newerth
[2011/07/05 16:12:13 | 000,000,000 | RHSD | C] – C:\Downloads
[2011/07/05 16:08:22 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Free Download Manager
[2011/07/05 16:08:21 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Download Manager
[2011/07/05 16:08:20 | 000,000,000 | —D | C] – C:\ProgramData\FreeDownloadManager.ORG
[2011/07/05 16:08:20 | 000,000,000 | —D | C] – C:\Program Files\Free Download Manager
[2011/07/05 14:36:31 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\DMCache
[2011/07/05 14:36:30 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager
[2011/07/05 14:33:10 | 004,463,360 | —- | C] (Tonec Inc.) – C:\Users\Home\Desktop\idman606.exe
[2011/07/05 07:55:22 | 000,000,000 | —D | C] – C:\Users\Home\Documents\My DAP Downloads
[2011/07/05 07:55:21 | 000,000,000 | —D | C] – C:\ProgramData\SpeedBit
[2011/07/05 07:55:21 | 000,000,000 | —D | C] – C:\Program Files\Common Files\SpeedBit
[2011/07/05 07:55:19 | 000,000,000 | —D | C] – C:\Program Files\DAP
[2011/07/03 14:48:20 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\LogMeIn Hamachi
[2011/07/03 14:48:04 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2011/07/03 14:48:04 | 000,000,000 | —D | C] – C:\Program Files\LogMeIn Hamachi
[2011/07/03 14:36:56 | 000,000,000 | RHSD | C] – C:\Expat Shield
[2011/07/03 14:32:47 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\Microsoft Games
[2011/07/03 14:15:24 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SecurityKISS Tunnel
[2011/07/03 14:15:24 | 000,000,000 | —D | C] – C:\Program Files\SecurityKISS Tunnel
[2011/07/03 14:15:16 | 002,367,061 | —- | C] ( ) – C:\Users\Home\Desktop\SecurityKISSsetup.exe
[2011/06/29 20:06:01 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\ALI213
[2011/06/22 15:42:27 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\THQ
[2011/06/22 15:22:30 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AlAlaa Center
[2011/06/21 15:13:58 | 000,000,000 | —D | C] – C:\Users\Home\AppData\Local\My Games
[2011/06/21 10:50:06 | 000,098,304 | —- | C] (Sony DADC Austria AG.) – C:\Windows\System32\CmdLineExt.dll
[8 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/21 10:41:46 | 000,432,233 | -H– | M] () – C:\Users\Home\AppData\Roaming\Homelog.dat
[2011/07/21 10:20:04 | 000,014,192 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/21 10:20:04 | 000,014,192 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/21 10:15:16 | 000,001,847 | —- | M] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Orbit.lnk
[2011/07/21 10:14:57 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/07/21 10:14:51 | 2616,598,528 | -HS- | M] () – C:\hiberfil.sys
[2011/07/21 10:13:36 | 000,000,000 | —- | M] () – C:\Windows\System32\Access.dat
[2011/07/21 09:36:40 | 000,000,600 | —- | M] () – C:\Users\Home\PUTTY.RND
[2011/07/21 09:30:24 | 000,000,069 | —- | M] () – C:\Windows\NeroDigital.ini
[2011/07/21 09:27:04 | 356,225,686 | —- | M] () – C:\Users\Home\Desktop\Darksiders_2antrext.mov
[2011/07/20 17:32:35 | 059,404,238 | —- | M] () – C:\Users\Home\Desktop\Sasha Grey and Penny Flame - Pornhub.com.flv.flv
[2011/07/20 11:01:58 | 000,000,737 | —- | M] () – C:\Users\Public\Desktop\The Sims 3.lnk
[2011/07/19 21:24:51 | 000,055,423 | —- | M] () – C:\Users\Home\Desktop\OTL Custom scan file.png
[2011/07/19 21:20:38 | 000,579,584 | —- | M] (OldTimer Tools) – C:\Users\Home\Desktop\OTL.exe
[2011/07/19 18:10:44 | 000,000,512 | —- | M] () – C:\Users\Home\Desktop\MBR.dat
[2011/07/19 18:05:35 | 001,913,344 | —- | M] (AVAST Software) – C:\Users\Home\Desktop\aswMBR.exe
[2011/07/19 16:15:49 | 000,302,592 | —- | M] () – C:\Users\Home\Desktop\l9u7smwt.exe
[2011/07/19 16:05:49 | 000,351,780 | —- | M] (Swearware) – C:\Users\Home\Desktop\dds.scr
[2011/07/19 10:00:39 | 092,098,998 | —- | M] () – C:\Users\Home\Desktop\P2TendrilPower720p.mov
[2011/07/18 09:12:43 | 076,807,958 | —- | M] () – C:\Users\Home\Desktop\Dragon aga 2 Legacy.mp4
[2011/07/17 20:24:36 | 266,145,587 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/07/17 18:12:10 | 000,000,877 | —- | M] () – C:\Users\Home\Desktop\Homefront.lnk
[2011/07/15 14:40:07 | 000,001,984 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/07/15 10:01:10 | 000,000,912 | —- | M] () – C:\Users\Public\Desktop\Command & Conquer 3.lnk
[2011/07/15 10:00:51 | 000,000,988 | —- | M] () – C:\Users\Public\Desktop\Command & Conquer 3 Kane's Wrath.lnk
[2011/07/14 14:04:07 | 000,642,044 | —- | M] () – C:\Windows\System32\perfh00C.dat
[2011/07/14 14:04:07 | 000,618,714 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/07/14 14:04:07 | 000,445,322 | —- | M] () – C:\Windows\System32\perfh001.dat
[2011/07/14 14:04:07 | 000,111,438 | —- | M] () – C:\Windows\System32\perfc00C.dat
[2011/07/14 14:04:07 | 000,107,034 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/07/14 14:04:07 | 000,079,756 | —- | M] () – C:\Windows\System32\perfc001.dat
[2011/07/09 21:12:23 | 361,735,729 | —- | M] () – C:\Users\Home\Desktop\Battlefield_3thun.mp4
[2011/07/08 07:15:12 | 000,001,013 | —- | M] () – C:\Users\Home\Desktop\Orbit.lnk
[2011/07/08 07:02:09 | 000,001,238 | —- | M] () – C:\Users\Public\Desktop\RealPlayer.lnk
[2011/07/08 07:02:00 | 000,199,904 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\rmoc3260.dll
[2011/07/08 07:01:53 | 000,272,896 | —- | M] (Progressive Networks) – C:\Windows\System32\pncrt.dll
[2011/07/08 07:01:53 | 000,006,656 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5016.dll
[2011/07/08 07:01:53 | 000,005,632 | —- | M] (RealNetworks, Inc.) – C:\Windows\System32\pndx5032.dll
[2011/07/07 06:34:58 | 000,001,110 | —- | M] () – C:\Users\Public\Desktop\Hotspot Shield Launch.lnk
[2011/07/06 19:17:58 | 000,016,906 | —- | M] () – C:\Users\Home\Desktop\192.168.1.1.png
[2011/07/06 14:41:44 | 000,001,920 | —- | M] () – C:\Users\Home\Desktop\Simple Port Forwarding.lnk
[2011/07/06 14:41:21 | 005,031,676 | —- | M] () – C:\Users\Home\Desktop\simple_port_forwarding_v3.2.2_setup.exe
[2011/07/06 14:24:17 | 000,001,939 | —- | M] () – C:\Users\Home\Desktop\Simple Static IP.lnk
[2011/07/06 14:24:05 | 000,800,413 | —- | M] () – C:\Users\Home\Desktop\Simple_Static_IP_v1.3.0_Setup.exe
[2011/07/06 11:36:46 | 000,418,377 | —- | M] () – C:\Users\Home\Desktop\CMD test result 2.png
[2011/07/06 11:15:11 | 000,379,633 | —- | M] () – C:\Users\Home\Desktop\CMD test results.png
[2011/07/05 22:17:13 | 000,000,732 | —- | M] () – C:\Users\Home\Desktop\Heroes of Newerth.lnk
[2011/07/05 22:11:55 | 565,804,632 | —- | M] () – C:\Users\Home\Desktop\HoNClient-2.0.36.1.exe
[2011/07/05 16:08:21 | 000,001,029 | —- | M] () – C:\Users\Home\Desktop\Free Download Manager.lnk
[2011/07/05 15:24:22 | 000,002,560 | —- | M] () – C:\Windows\_MSRSTRT.EXE
[2011/07/05 14:36:16 | 004,463,360 | —- | M] (Tonec Inc.) – C:\Users\Home\Desktop\idman606.exe
[2011/07/05 07:55:20 | 000,109,216 | —- | M] () – C:\Windows\System32\EasyHook64.dll
[2011/07/05 07:55:20 | 000,090,784 | —- | M] () – C:\Windows\System32\EasyHook32.dll
[2011/07/03 15:11:45 | 008,773,736 | —- | M] () – C:\Users\Home\Desktop\HSS-2.06-install-anchorfree-247-conduit3.exe
[2011/07/03 15:02:35 | 000,267,312 | —- | M] () – C:\Users\Home\Desktop\DM-247.exe
[2011/07/03 14:48:04 | 000,000,896 | —- | M] () – C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
[2011/07/03 14:47:24 | 003,768,320 | —- | M] () – C:\Users\Home\Desktop\hamachi.msi
[2011/07/03 14:39:29 | 000,000,137 | —- | M] () – C:\Users\Home\SecurityKISSTunnel.config
[2011/07/03 14:15:24 | 000,001,022 | —- | M] () – C:\Users\Home\Desktop\SecurityKISS Tunnel.lnk
[2011/07/03 14:15:12 | 002,367,061 | —- | M] ( ) – C:\Users\Home\Desktop\SecurityKISSsetup.exe
[2011/06/30 10:44:50 | 028,211,359 | —- | M] () – C:\Users\Home\Desktop\Mass_Effecte32011.mp4
[2011/06/29 19:50:02 | 000,000,802 | —- | M] () – C:\Users\Home\Desktop\Red Faction Armageddon.lnk
[2011/06/29 19:16:13 | 016,770,597 | —- | M] () – C:\Users\Home\Desktop\Back to the Future Alternate Ending Biff is Dead - CollegeHumor Video.mp4
[2011/06/28 10:32:26 | 043,551,565 | —- | M] () – C:\Users\Home\Desktop\Birthday Party Groupsex! - Pornhub.com.wmv
[2011/06/24 19:21:03 | 021,966,012 | —- | M] () – C:\Users\Home\Desktop\Future of YouTube Exposed!.flv
[2011/06/22 19:19:18 | 000,047,837 | —- | M] () – C:\Users\Home\Desktop\MoFunZone.com–saint_s_row_2_11_trainer.zip
[2011/06/22 15:22:30 | 000,000,479 | —- | M] () – C:\Users\Public\Desktop\Saints Row 2.lnk
[2011/06/21 20:31:17 | 006,804,921 | —- | M] () – C:\Users\Home\Desktop\Girls Watch Porn Too - CollegeHumor Video.mp4
[2011/06/21 11:02:16 | 000,000,729 | —- | M] () – C:\Users\Public\Desktop\Dark Messiah of Might and Magic.lnk
[2011/06/21 10:50:06 | 000,098,304 | —- | M] (Sony DADC Austria AG.) – C:\Windows\System32\CmdLineExt.dll
[8 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/07/20 20:56:58 | 356,225,686 | —- | C] () – C:\Users\Home\Desktop\Darksiders_2antrext.mov
[2011/07/20 16:47:31 | 059,404,238 | —- | C] () – C:\Users\Home\Desktop\Sasha Grey and Penny Flame - Pornhub.com.flv.flv
[2011/07/20 10:39:43 | 000,000,737 | —- | C] () – C:\Users\Public\Desktop\The Sims 3.lnk
[2011/07/19 21:24:51 | 000,055,423 | —- | C] () – C:\Users\Home\Desktop\OTL Custom scan file.png
[2011/07/19 18:10:44 | 000,000,512 | —- | C] () – C:\Users\Home\Desktop\MBR.dat
[2011/07/19 16:15:38 | 000,302,592 | —- | C] () – C:\Users\Home\Desktop\l9u7smwt.exe
[2011/07/19 08:50:39 | 092,098,998 | —- | C] () – C:\Users\Home\Desktop\P2TendrilPower720p.mov
[2011/07/18 09:12:45 | 076,807,958 | —- | C] () – C:\Users\Home\Desktop\Dragon aga 2 Legacy.mp4
[2011/07/17 18:12:10 | 000,000,877 | —- | C] () – C:\Users\Home\Desktop\Homefront.lnk
[2011/07/15 14:40:07 | 000,001,984 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2011/07/15 10:01:10 | 000,000,912 | —- | C] () – C:\Users\Public\Desktop\Command & Conquer 3.lnk
[2011/07/15 09:48:49 | 000,000,988 | —- | C] () – C:\Users\Public\Desktop\Command & Conquer 3 Kane's Wrath.lnk
[2011/07/11 19:08:48 | 000,000,600 | —- | C] () – C:\Users\Home\PUTTY.RND
[2011/07/09 12:17:35 | 361,735,729 | —- | C] () – C:\Users\Home\Desktop\Battlefield_3thun.mp4
[2011/07/08 07:15:15 | 000,001,847 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Orbit.lnk
[2011/07/08 07:15:12 | 000,001,013 | —- | C] () – C:\Users\Home\Desktop\Orbit.lnk
[2011/07/08 07:02:09 | 000,001,238 | —- | C] () – C:\Users\Public\Desktop\RealPlayer.lnk
[2011/07/07 06:34:58 | 000,001,110 | —- | C] () – C:\Users\Public\Desktop\Hotspot Shield Launch.lnk
[2011/07/06 19:17:58 | 000,016,906 | —- | C] () – C:\Users\Home\Desktop\192.168.1.1.png
[2011/07/06 14:41:44 | 000,001,920 | —- | C] () – C:\Users\Home\Desktop\Simple Port Forwarding.lnk
[2011/07/06 14:41:29 | 005,031,676 | —- | C] () – C:\Users\Home\Desktop\simple_port_forwarding_v3.2.2_setup.exe
[2011/07/06 14:24:17 | 000,001,939 | —- | C] () – C:\Users\Home\Desktop\Simple Static IP.lnk
[2011/07/06 14:24:10 | 000,800,413 | —- | C] () – C:\Users\Home\Desktop\Simple_Static_IP_v1.3.0_Setup.exe
[2011/07/06 11:36:46 | 000,418,377 | —- | C] () – C:\Users\Home\Desktop\CMD test result 2.png
[2011/07/06 11:15:11 | 000,379,633 | —- | C] () – C:\Users\Home\Desktop\CMD test results.png
[2011/07/05 22:17:13 | 000,000,732 | —- | C] () – C:\Users\Home\Desktop\Heroes of Newerth.lnk
[2011/07/05 16:12:13 | 565,804,632 | —- | C] () – C:\Users\Home\Desktop\HoNClient-2.0.36.1.exe
[2011/07/05 16:08:21 | 000,001,029 | —- | C] () – C:\Users\Home\Desktop\Free Download Manager.lnk
[2011/07/05 15:24:21 | 000,002,560 | —- | C] () – C:\Windows\_MSRSTRT.EXE
[2011/07/05 07:55:19 | 000,109,216 | —- | C] () – C:\Windows\System32\EasyHook64.dll
[2011/07/05 07:55:19 | 000,090,784 | —- | C] () – C:\Windows\System32\EasyHook32.dll
[2011/07/03 15:40:34 | 000,084,992 | —- | C] () – C:\Expat Shield.exe
[2011/07/03 15:02:54 | 008,773,736 | —- | C] () – C:\Users\Home\Desktop\HSS-2.06-install-anchorfree-247-conduit3.exe
[2011/07/03 15:02:39 | 000,267,312 | —- | C] () – C:\Users\Home\Desktop\DM-247.exe
[2011/07/03 14:48:04 | 000,000,896 | —- | C] () – C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
[2011/07/03 14:47:41 | 003,768,320 | —- | C] () – C:\Users\Home\Desktop\hamachi.msi
[2011/07/03 14:15:26 | 000,000,137 | —- | C] () – C:\Users\Home\SecurityKISSTunnel.config
[2011/07/03 14:15:24 | 000,001,022 | —- | C] () – C:\Users\Home\Desktop\SecurityKISS Tunnel.lnk
[2011/06/30 10:44:58 | 028,211,359 | —- | C] () – C:\Users\Home\Desktop\Mass_Effecte32011.mp4
[2011/06/29 19:50:02 | 000,000,802 | —- | C] () – C:\Users\Home\Desktop\Red Faction Armageddon.lnk
[2011/06/29 19:31:16 | 016,770,597 | —- | C] () – C:\Users\Home\Desktop\Back to the Future Alternate Ending Biff is Dead - CollegeHumor Video.mp4
[2011/06/28 10:24:41 | 043,551,565 | —- | C] () – C:\Users\Home\Desktop\Birthday Party Groupsex! - Pornhub.com.wmv
[2011/06/24 19:21:45 | 021,966,012 | —- | C] () – C:\Users\Home\Desktop\Future of YouTube Exposed!.flv
[2011/06/22 19:19:23 | 000,047,837 | —- | C] () – C:\Users\Home\Desktop\MoFunZone.com–saint_s_row_2_11_trainer.zip
[2011/06/22 15:22:30 | 000,000,479 | —- | C] () – C:\Users\Public\Desktop\Saints Row 2.lnk
[2011/06/22 06:26:15 | 006,804,921 | —- | C] () – C:\Users\Home\Desktop\Girls Watch Porn Too - CollegeHumor Video.mp4
[2011/06/21 10:44:28 | 000,000,729 | —- | C] () – C:\Users\Public\Desktop\Dark Messiah of Might and Magic.lnk
[2011/04/12 04:50:33 | 000,084,992 | —- | C] () – C:\Windows\System32\vcredist.exe
[2011/04/12 04:50:33 | 000,084,992 | —- | C] () – C:\Windows\System32\Support.exe
[2011/04/12 04:50:33 | 000,084,992 | —- | C] () – C:\Windows\System32\SetupMedia.exe
[2011/04/12 04:50:33 | 000,084,992 | —- | C] () – C:\Windows\System32\PhysX.exe
[2011/04/12 04:50:33 | 000,084,992 | —- | C] () – C:\Windows\System32\Net35sp1.exe
[2011/04/12 04:50:33 | 000,084,992 | —- | C] () – C:\Windows\System32\MSChart.exe
[2011/04/12 04:50:33 | 000,084,992 | —- | C] () – C:\Windows\System32\Live.exe
[2011/02/26 21:02:13 | 000,000,000 | —- | C] () – C:\Windows\nsreg.dat
[2011/02/17 14:02:53 | 000,084,992 | —- | C] () – C:\Windows\System32\Downloaded Videos.exe
[2011/02/17 14:02:53 | 000,084,992 | —- | C] () – C:\Windows\System32\@.exe
[2011/02/06 13:58:29 | 000,000,598 | —- | C] () – C:\Windows\System32\secushr.dat
[2011/01/28 11:24:47 | 000,000,025 | —- | C] () – C:\Windows\libem.INI
[2010/12/27 16:50:48 | 000,000,000 | —- | C] () – C:\Windows\System32\cd.dat
[2010/07/24 15:25:33 | 000,000,000 | —- | C] () – C:\Windows\System32\Access.dat
[2010/07/24 10:27:24 | 000,000,069 | —- | C] () – C:\Windows\NeroDigital.ini
[2010/07/14 10:30:57 | 000,084,992 | RHS- | C] () – C:\Windows\windowsxp.exe
[2010/06/03 02:09:43 | 000,165,376 | —- | C] () – C:\Windows\System32\unrar.dll
[2010/06/03 02:09:43 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2010/06/03 02:09:42 | 000,815,104 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2010/06/03 02:09:42 | 000,180,224 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2010/06/03 02:09:42 | 000,108,032 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2010/06/03 01:49:20 | 000,389,120 | —- | C] () – C:\Windows\System32\HookShield.dll
[2010/06/03 01:49:20 | 000,225,280 | —- | C] () – C:\Windows\System32\HookMap.dll
[2010/06/03 01:49:20 | 000,134,504 | —- | C] () – C:\Windows\System32\smdll.dll
[2010/06/03 01:49:20 | 000,057,344 | —- | C] () – C:\Windows\System32\startup.exe
[2010/06/03 01:49:20 | 000,040,960 | —- | C] () – C:\Windows\System32\executeosd.exe
[2010/06/03 01:49:20 | 000,036,200 | —- | C] () – C:\Windows\System32\Auxiliary.dll
[2010/06/03 01:42:57 | 000,642,044 | —- | C] () – C:\Windows\System32\perfh00C.dat
[2010/06/03 01:42:57 | 000,445,322 | —- | C] () – C:\Windows\System32\perfh001.dat
[2010/06/03 01:42:57 | 000,344,522 | —- | C] () – C:\Windows\System32\perfi00C.dat
[2010/06/03 01:42:57 | 000,289,060 | —- | C] () – C:\Windows\System32\perfi001.dat
[2010/06/03 01:42:57 | 000,111,438 | —- | C] () – C:\Windows\System32\perfc00C.dat
[2010/06/03 01:42:57 | 000,079,756 | —- | C] () – C:\Windows\System32\perfc001.dat
[2010/06/03 01:42:57 | 000,042,056 | —- | C] () – C:\Windows\System32\perfd001.dat
[2010/06/03 01:42:57 | 000,038,160 | —- | C] () – C:\Windows\System32\perfd00C.dat
[2010/06/03 01:37:01 | 000,146,432 | —- | C] () – C:\Windows\System32\APOMngr.DLL
[2010/06/03 01:37:01 | 000,072,704 | —- | C] () – C:\Windows\System32\CmdRtr.DLL
[2010/06/03 01:36:47 | 000,508,560 | R— | C] () – C:\Windows\System32\drivers\rtvienna.dat
[2010/06/03 01:36:14 | 000,073,728 | —- | C] () – C:\Windows\System32\RtNicProp32.dll
[2009/12/26 10:11:04 | 000,002,045 | -H– | C] () – C:\Windows\System32\whlprd32a.dll
[2009/07/14 06:57:37 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2009/07/14 06:33:53 | 000,441,656 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2009/07/14 04:05:48 | 000,618,714 | —- | C] () – C:\Windows\System32\perfh009.dat
[2009/07/14 04:05:48 | 000,291,294 | —- | C] () – C:\Windows\System32\perfi009.dat
[2009/07/14 04:05:48 | 000,107,034 | —- | C] () – C:\Windows\System32\perfc009.dat
[2009/07/14 04:05:48 | 000,031,548 | —- | C] () – C:\Windows\System32\perfd009.dat
[2009/07/14 04:05:05 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2009/07/14 04:04:11 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2009/07/14 02:19:49 | 000,066,048 | —- | C] () – C:\Windows\System32\PrintBrmUi.exe
[2009/07/14 01:55:01 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2009/07/14 01:51:43 | 000,073,728 | —- | C] () – C:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 01:42:10 | 000,064,000 | —- | C] () – C:\Windows\System32\BWContextHandler.dll
[2009/06/10 23:26:10 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2008/10/28 17:40:48 | 000,173,552 | —- | C] () – C:\Windows\System32\xlive.dll.cat
[2005/04/08 04:16:43 | 000,432,233 | -H– | C] () – C:\Users\Home\AppData\Roaming\Homelog.dat

========== Alternate Data Streams ==========

@Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:C265C458
@Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:553CA6CA

< End of report >

xXSheperdXx

Post #8July 21, 2011, 8:54 AM UTC last edited July 21, 2011, 9:08 AM UTC

I know the OTL.Txt and the Extras.Txt are from diffrent runs but when i deleted the first run's OTL.Txt and Extras.Txt the second run didn't give me a Extras.Txt so I had to restor it from the Recycle Bin, I can give you the first run's OTL.Txt if you'de like.
Here's the Extras.Txt:
OTL Extras logfile created on: 7/21/2011 9:43:52 AM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\Home\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.25 Gb Total Physical Memory | 2.42 Gb Available Physical Memory | 74.53% Memory free
6.50 Gb Paging File | 5.67 Gb Available in Paging File | 87.30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 117.09 Gb Total Space | 23.68 Gb Free Space | 20.22% Space Free | Partition Type: NTFS
Drive D: | 166.47 Gb Total Space | 45.88 Gb Free Space | 27.56% Space Free | Partition Type: NTFS
Drive E: | 182.10 Gb Total Space | 49.83 Gb Free Space | 27.37% Space Free | Partition Type: NTFS
Drive F: | 1.38 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF

Computer Name: USER-PC | User Name: Home | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe" = C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3 – (Trend Media Corporation Limited)
"C:\Program Files\Orbitdownloader\orbitdm.exe" = C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit – (Orbitdownloader.com)
"C:\Program Files\Orbitdownloader\orbitnet.exe" = C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit – (Orbitdownloader.com)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04796FD2-FE5C-4EC2-9966-D2589A9018A0}" = StarCraft II
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
"{08F32589-5E39-42B8-8BC5-6A8126ED2A70}" = Microsoft Visual C++ 2008 Redistributable Package
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1307FD99-A7D6-49C6-8527-5031758C4425}" = Crysis 2
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java™ 6 Update 25
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2BD75090-9C11-4464-8C3D-6227D9C5C578}" = Transformers - War for Cybertron
"{2CD0FC53-896B-4767-AA2A-98AA36B08C56}" = Command & Conquer Generals Zero Hour
"{322FB57A-8989-421C-9032-1BBE23A50CE0}" = Brink
"{374D8C1A-3275-4168-B662-36A80586A96F}" = Napoleon Total War
"{398A7808-A57C-48EC-A05C-2912CDA097C4}" = SPORE
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}" = Google Earth
"{415030B8-3E8B-462A-8C03-41D95AA3AB3B}" = Medal of Honor ™
"{45410935-3E72-472B-8C35-AB1000008200}" = Bulletstorm
"{45410935-B52C-468A-A836-0D1000018201}" = BulletStorm
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{5212F6D1-61B5-4F9F-9B0F-4EAB0C0E97F6}" = Command & Conquer 3 Kane's Wrath
"{526FBFFE-74A7-4E83-887F-660D531468E0}" = The Sims 3
"{54D52A02-3B09-4699-A900-AB79CC541A9D}" = Cities XL 2011
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{65C0025A-2CDE-43C5-82D0-C7A56EF0DB39}" = Bing Bar Platform
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.1
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6ACF2525-12B5-4C23-A325-F2B9CF721230}" = Saints Row 2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8533B258-9BB4-4F72-BED1-AB2A98A6BFF8}" = Dark Messiah of Might and Magic
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Search-Results Toolbar
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows Vista and Later
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8C52A46C-7961-4A81-AB4B-92CF65CB4772}_is1" = Sothink Web Video Downloader
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FB495A1-4A3F-4C1D-BD27-3F3AB2E66763}" = iMesh
"{90120000-0015-0401-0000-0000000FF1CE}" = Microsoft Office Access MUI (Arabic) 2007
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0401-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Arabic) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0017-0401-0000-0000000FF1CE}" = Microsoft Office SharePoint Designer MUI (Arabic) 2007
"{90120000-0018-0401-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Arabic) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0401-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Arabic) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0401-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Arabic) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0401-0000-0000000FF1CE}" = Microsoft Office Word MUI (Arabic) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0401-0000-0000000FF1CE}" = Microsoft Office Proofing (Arabic) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0401-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Arabic) 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0401-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Arabic) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0401-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Arabic) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0100-0401-0000-0000000FF1CE}" = Microsoft Office O MUI (Arabic) 2007
"{90120000-0101-0401-0000-0000000FF1CE}" = Microsoft Office X MUI (Arabic) 2007
"{90120000-0114-0401-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (Arabic) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C916142-C18C-429D-BFED-40094A7E0BEB}" = The Settlers 7 - Paths to a Kingdom
"{9E2BD6FF-CE8D-47B5-AD9C-0A5C2D54EB3C}" = League of Legends
"{A1C962E2-2426-49C6-A38B-9A07E40D607C}" = Microsoft Games for Windows - LIVE
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.5
"{AE4962BF-F768-4080-A62E-746E1675B81E}" = Empire Total War
"{C3FE3117-AA36-492F-819D-3CACE226472B}" = The Witcher Enhanced Edition
"{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser
"{CAAB0192-5704-469F-A0BE-2D842D70E93B}_is1" = Sothink FLV Player
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF40DA70-3021-482C-BE70-2CCE26A2BF5C}" = Civilization V
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D47087E7-AA15-4D1D-8C0A-60F7E446D597}" = PSP ISO Compressor
"{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = COWON Media Center - jetAudio Basic VX
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E5E510EE-6D26-EFA5-59E2-EF47F9BF545F}" = ATI Catalyst Install Manager
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EEF985E8-8B36-4230-B174-117A2381C17F}" = LogMeIn Hamachi
"{F2E23139-3404-4E3C-9855-7724415D62A5}" = Dragon Age II
"{F4747644-7E5A-4AB8-A88B-C0DB55B6441C}" = Batman Arkham Asylum
"{FD052FB9-FE90-4438-B355-15EDC89D8FB1}" = Microsoft Games for Windows - LIVE Redistributable
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"AAA Logo 2008_is1" = AAA Logo 2008 2.10
"AAA Logo Free Trial_is1" = AAA Logo 3.10 Free Trial
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Aiseesoft HD Video Converter_is1" = Aiseesoft HD Video Converter
"Bandoo" = Bandoo
"ClickPotatoLiteSA" = ClickPotato
"Command and Conquer Generals Zero Hour_is1" = 1.2
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Fallout New Vegas_is1" = Fallout New Vegas
"FlashGet 3.3" = FlashGet 3.3
"Free Download Manager_is1" = Free Download Manager 3.0
"Garena" = Garena 2010
"GFWL_{45410935-3E72-472B-8C35-AB1000008200}" = Bulletstorm
"hon" = Heroes of Newerth
"HotspotShield" = Hotspot Shield 2.06
"iMesh" = iMesh
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.0.0 (Full)
"LogMeIn Hamachi" = LogMeIn Hamachi
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 5.0 (x86 en-US)" = Mozilla Firefox 5.0 (x86 en-US)
"Nero8Lite_is1" = Nero 8 Micro [removed]
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OMUI.ar-sa" = Microsoft Office Language Pack 2007 - Arabic العربية
"OpenAL" = OpenAL
"Orbit_is1" = Orbit Downloader
"Polipo" = Polipo [removed]
"Postal 2_is1" = Portal 2
"Real-Draw PRO_is1" = Real-Draw PRO 4.0
"RealPlayer 12.0" = RealPlayer
"Searchqu MediaBar" = Windows Searchqu Toolbar
"SecurityKISS Tunnel_is1" = SecurityKISS Tunnel v0.1.5
"ShoppingReport2" = ShopperReports
"Simple Port Forwarding" = Simple Port Forwarding
"Simple Static IP" = Simple Static IP
"Software Informer_is1" = Software Informer 1.0 BETA
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Tor" = Tor 0.2.1.27
"Total Video Converter 3.12_is1" = Total Video Converter 3.12 080330
"Tunngle beta_is1" = Tunngle beta
"UseNeXT_is1" = UseNeXT
"Vidalia" = Vidalia 0.2.10
"WebEnhancements_is1" = WebEnhancements
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"World of Warcraft" = World of Warcraft
"Xilisoft PSP Video Converter 6" = Xilisoft PSP Video Converter 6
"Xmlbar FlvDownloader" = Youtube Downloader(xmlbar)(remove only)
"Xvid_is1" = Xvid 1.2.1 final uninstall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"blinkx beat" = blinkx beat
"Wurm Online 3.0.1" = Wurm Online 3.0.1

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/21/2011 1:16:04 PM | Computer Name = user-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Real\RealPlayer\plugins\rmxrend.dll".
Dependent
Assembly Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/21/2011 1:16:31 PM | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Faulting application name: explorer.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bc60d Faulting module name: rpshellextension.dll, version: 12.0.1.609,
time stamp: 0x4cd44e6c Exception code: 0xc0000005 Fault offset: 0x00013156 Faulting
process id: 0x1624 Faulting application start time: 0x01cc17daaf961ac7 Faulting application
path: C:\Windows\explorer.exe Faulting module path: C:\Program Files\Real\RealPlayer\RCAPlugins\rpshellextension.dll
Report
Id: 1205ade9-83ce-11e0-b778-406186c637b5

Error - 5/21/2011 1:29:51 PM | Computer Name = user-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Real\RealPlayer\plugins\rmxrend.dll".
Dependent
Assembly Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/21/2011 2:25:40 PM | Computer Name = user-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Real\RealPlayer\plugins\rmxrend.dll".
Dependent
Assembly Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/21/2011 2:33:01 PM | Computer Name = user-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Real\RealPlayer\plugins\rmxrend.dll".
Dependent
Assembly Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/21/2011 2:33:31 PM | Computer Name = user-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Real\RealPlayer\plugins\rmxrend.dll".
Dependent
Assembly Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/21/2011 2:33:36 PM | Computer Name = user-PC | Source = Application Error | ID = 1000
Description = Faulting application name: explorer.exe, version: 6.1.7600.16385,
time stamp: 0x4a5bc60d Faulting module name: ntdll.dll, version: 6.1.7600.16385,
time stamp: 0x4a5bdadb Exception code: 0xc0000005 Fault offset: 0x00053067 Faulting
process id: 0x9f0 Faulting application start time: 0x01cc17e478e156f1 Faulting application
path: C:\Windows\explorer.exe Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report
Id: d63b5d2d-83d8-11e0-95a0-406186c637b5

Error - 5/21/2011 2:33:36 PM | Computer Name = user-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Real\RealPlayer\plugins\rmxrend.dll".
Dependent
Assembly Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/22/2011 12:17:50 AM | Computer Name = user-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Real\RealPlayer\plugins\rmxrend.dll".
Dependent
Assembly Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 5/22/2011 12:18:21 AM | Computer Name = user-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "C:\Program Files\Real\RealPlayer\plugins\rmxrend.dll".
Dependent
Assembly Microsoft.VC90.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"
could not be found. Please use sxstrace.exe for detailed diagnosis.

[ Media Center Events ]
Error - 10/2/2010 4:56:57 AM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 10:56:57 ص - Error connecting to the internet. 10:56:57 ص - Unable
to contact server..

Error - 10/2/2010 4:58:06 AM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 10:58:01 ص - Error connecting to the internet. 10:58:01 ص - Unable
to contact server..

Error - 10/3/2010 7:20:29 AM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 01:20:29 م - Error connecting to the internet. 01:20:29 م - Unable
to contact server..

Error - 10/3/2010 7:21:21 AM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 01:21:18 م - Error connecting to the internet. 01:21:18 م - Unable
to contact server..

Error - 10/3/2010 10:23:34 AM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 04:23:34 م - Error connecting to the internet. 04:23:34 م - Unable
to contact server..

Error - 10/3/2010 10:24:27 AM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 04:24:22 م - Error connecting to the internet. 04:24:22 م - Unable
to contact server..

Error - 10/3/2010 11:25:16 AM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 05:25:16 م - Error connecting to the internet. 05:25:16 م - Unable
to contact server..

Error - 10/3/2010 11:26:05 AM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 05:26:05 م - Error connecting to the internet. 05:26:05 م - Unable
to contact server..

Error - 10/4/2010 10:32:05 AM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 04:32:05 م - Error connecting to the internet. 04:32:05 م - Unable
to contact server..

Error - 10/4/2010 10:32:59 AM | Computer Name = user-PC | Source = MCUpdate | ID = 0
Description = 04:32:54 م - Error connecting to the internet. 04:32:54 م - Unable
to contact server..

[ System Events ]
Error - 7/19/2011 3:47:53 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7016
Description = The NVIDIA Display Driver Service service has reported an invalid
current state 32.

Error - 7/20/2011 4:32:52 AM | Computer Name = user-PC | Source = cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.

Error - 7/20/2011 4:54:37 AM | Computer Name = user-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 10:53:07 ص on ‏20/‏07/‏2011 was unexpected.

Error - 7/20/2011 5:41:31 AM | Computer Name = user-PC | Source = Service Control Manager | ID = 7016
Description = The NVIDIA Display Driver Service service has reported an invalid
current state 32.

Error - 7/20/2011 7:47:12 AM | Computer Name = user-PC | Source = Service Control Manager | ID = 7016
Description = The NVIDIA Display Driver Service service has reported an invalid
current state 32.

Error - 7/20/2011 7:55:44 AM | Computer Name = user-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 01:54:41 م on ‏20/‏07/‏2011 was unexpected.

Error - 7/20/2011 8:00:22 AM | Computer Name = user-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 01:58:39 م on ‏20/‏07/‏2011 was unexpected.

Error - 7/20/2011 8:14:54 AM | Computer Name = user-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 02:13:18 م on ‏20/‏07/‏2011 was unexpected.

Error - 7/20/2011 4:15:42 PM | Computer Name = user-PC | Source = Service Control Manager | ID = 7016
Description = The NVIDIA Display Driver Service service has reported an invalid
current state 32.

Error - 7/21/2011 3:35:40 AM | Computer Name = user-PC | Source = Service Control Manager | ID = 7016
Description = The NVIDIA Display Driver Service service has reported an invalid
current state 32.

< End of report >

xXSheperdXx

Post #9July 21, 2011, 9:07 AM UTC

When I do the Virus Total scan tis happens :
[external image: Posted Image]

Then:
[external image: Posted Image]

Finally:
[external image: Posted Image]

Blottedisk

Post #10July 21, 2011, 4:09 PM UTC

Thanks for the logs. I'm working on a fix right now, I'll post as soon as possible. Cheers.

Blottedisk

Post #11July 21, 2011, 7:36 PM UTC

Hi there,

We need to uninstall HotspotShield.

Click "start" on the taskbar and then click on the "Control Panel" icon.
Doubleclick the "Add or Remove Programs" icon
A list of programs installed will be "populated" (this may take a bit of time).
Select and uninstall the following program:

"HotspotShield"

After that, please download Combofix from either of the links below and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Right-click and choose "Run as administrator" on Combofix.exe & follow the prompts. When finished, it will produce a report for you.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.
When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Blottedisk

Post #12July 29, 2011, 9:03 PM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Firefox redirecting me to search.hotspotshield.com

✨ Ask AI

Ask AI