[robertupland]

EDIT: it's CheckDisk not CheckPoint

I came to the computer and there were all these error messages so I closed them and the computer rebooted. When it came back up everything looked normal the a message came up saying:
The system has been restored after a critical error. Data integrity verification required.

The system has been restored after a critical error. Data integrity verification required.

I clicked ok and then a fake antivrus program popped up. I pressed control+alt+delete and ended the program. Then my desktop went black except for the icons and the start menu disappeared. Can someone please help???
Here are my OTL logs.....

OTL logfile created on: 11/21/2010 7:09:48 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\mmbm\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

895.00 Mb Total Physical Memory | 398.00 Mb Available Physical Memory | 44.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.95 Gb Total Space | 94.16 Gb Free Space | 65.41% Space Free | Partition Type: NTFS
Drive D: | 5.08 Gb Total Space | 2.58 Gb Free Space | 50.73% Space Free | Partition Type: FAT32
Drive E: | 1.69 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: YOUR-BC185A12A1 | User Name: mmbm | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/21 19:09:19 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mmbm\Desktop\OTL.exe
PRC - [2010/11/21 18:12:18 | 000,357,376 | ---- | M] () -- C:\Documents and Settings\mmbm\Local Settings\temp\187378187.exe
PRC - [2010/11/21 18:12:15 | 000,448,000 | ---- | M] ( ) -- C:\Documents and Settings\mmbm\Local Settings\temp\XadVPXkgvP.exe
PRC - [2010/09/21 13:29:16 | 002,969,496 | ---- | M] () -- C:\Program Files\Pando Networks\Media Booster\PMB.exe
PRC - [2010/09/15 03:34:02 | 001,094,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe
PRC - [2010/06/02 19:50:58 | 001,144,104 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/03/25 20:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
PRC - [2008/09/09 19:31:21 | 000,029,744 | ---- | M] (Google) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/11/09 22:51:19 | 000,172,032 | ---- | M] (New Boundary Technologies, Inc.) -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
PRC - [2007/07/13 19:19:16 | 005,252,936 | ---- | M] (SpareBackup, Inc.) -- C:\Program Files\Spare Backup\SpareBackup.exe
PRC - [2006/03/06 12:48:46 | 000,286,720 | ---- | M] () -- C:\Program Files\Lexmark 2400 Series\lxcrmon.exe
PRC - [2006/02/20 14:23:08 | 000,495,616 | ---- | M] ( ) -- C:\WINDOWS\system32\lxcrcoms.exe
PRC - [2006/02/07 00:10:34 | 000,098,304 | ---- | M] (Lexmark International Inc.) -- C:\Program Files\Lexmark 2400 Series\ezprint.exe


========== Modules (SafeList) ==========

MOD - [2010/11/21 19:09:19 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mmbm\Desktop\OTL.exe
MOD - [2010/08/23 11:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/03/25 20:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
SRV - [2008/12/01 10:59:52 | 000,033,752 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_HelperSvc.exe -- (getPlus® Helper) getPlus®
SRV - [2008/09/09 19:31:21 | 000,029,744 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- (GoogleDesktopManager-061008-081103)
SRV - [2008/07/15 16:38:32 | 000,394,608 | ---- | M] (SupportSoft, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Supportsoft\bin\ssrc.exe -- (SupportSoft RemoteAssist)
SRV - [2007/11/09 22:51:19 | 000,172,032 | ---- | M] (New Boundary Technologies, Inc.) [Auto | Running] -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- (PrismXL)
SRV - [2007/08/29 16:58:47 | 000,181,800 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\eMachines Games\eMachines Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2006/02/20 14:23:08 | 000,495,616 | ---- | M] ( ) [On_Demand | Running] -- C:\WINDOWS\System32\lxcrcoms.exe -- (lxcr_device)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\SymIM.sys -- (SymIMMP)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\SymIM.sys -- (SymIM)
DRV - [2008/04/13 13:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 13:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/04/13 11:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/03/07 19:31:52 | 000,062,570 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\jl2005c.sys -- (JL2005C)
DRV - [2007/10/02 04:32:14 | 004,613,120 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007/08/08 22:11:00 | 000,102,400 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\NVGTS.SYS -- (nvgts)
DRV - [2006/11/27 04:33:54 | 000,019,968 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006/11/27 04:33:50 | 000,058,368 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2006/10/31 02:35:00 | 003,964,256 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2006/07/18 17:16:08 | 000,990,592 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2006/07/18 17:15:18 | 000,256,128 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2006/07/18 17:15:10 | 000,728,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2005/04/05 22:30:16 | 000,026,752 | R--- | M] (ENCORE ELECTRONICS, INC. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ipfnd51.sys -- (ip100xp)
DRV - [2001/08/17 23:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 23:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 23:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 23:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 23:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 22:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 22:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 22:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 22:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 22:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 22:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 22:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 22:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 22:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 22:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2001/08/17 21:10:58 | 000,069,692 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\el575ND5.sys -- (el575nd5)
DRV - [2001/08/17 16:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.amazon.co...words=&x=3&y=24
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

FF - HKLM\software\mozilla\Firefox\extensions\\{E87DFB23-7587-40DC-B6F9-2C4DDA53A71C}: C:\Documents and Settings\Owner\Local Settings\Application Data\{E87DFB23-7587-40DC-B6F9-2C4DDA53A71C}
FF - HKLM\software\mozilla\Firefox\extensions\\{D667880E-AD92-40AE-98BF-50F8835C2CD0}: C:\Documents and Settings\mmbm\Local Settings\Application Data\{D667880E-AD92-40AE-98BF-50F8835C2CD0}\ [2010/10/26 12:59:27 | 000,000,000 | ---D | M]

[2010/04/30 18:13:22 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/05/04 18:39:03 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 2400 Series\ezprint.exe (Lexmark International Inc.)
O4 - HKLM..\Run: [FaxCenterServer] C:\Program Files\Lexmark Fax Solutions\fm3032.exe ()
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LXCRCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.DLL ()
O4 - HKLM..\Run: [lxcrmon.exe] C:\Program Files\Lexmark 2400 Series\lxcrmon.exe ()
O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\WINDOWS\creator\Remind_XP.exe (SoftThinks)
O4 - HKLM..\Run: [SkyTel] C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Spare Backup] C:\Program Files\Spare Backup\SpareBackup.exe (SpareBackup, Inc.)
O4 - HKCU..\Run: [187378187] C:\Documents and Settings\mmbm\Local Settings\temp\187378187.exe ()
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [Power2GoExpress] File not found
O4 - HKCU..\Run: [XadVPXkgvP.exe] C:\Documents and Settings\mmbm\Local Settings\temp\XadVPXkgvP.exe ( )
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: pogo.com ([www] https in Trusted sites)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} https://supportcente...oad/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://appldnld.appl...ex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop...t/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} http://static.ak.fac...fbootloader.cab (Reg Error: Key error.)
O16 - DPF: {38AB6A6C-CC4C-4F9E-A3DD-3C5681EF18A1} http://www-cdn.freer...ller.cab?v=1043 (SonyOnlineInstallerX)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.aka...vex-2.2.4.1.cab (DLM Control)
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace....ploader1006.cab (MySpace Uploader Control)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onec...lscbase6087.cab (Windows Live Safety Center Base Module)
O16 - DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} http://download-game...h2.1.0.0.53.cab (CPlayFirstDinerDash2Control Object)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.syma...n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx...owserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} http://utilities.pcp...opAntiVirus.dll (PCPitstop AntiVirus)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebo...oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} http://lads.myspace....ceUploader2.cab (MySpace Uploader Control)
O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} http://download-game...tg.1.0.0.33.cab (CPlayFirstddfotgControl Object)
O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} http://simcity.ea.co...ic/SimCityX.cab (SimCityX Control)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://wwwimages.ado...obat/nos/gp.cab (get_atlcom Class)
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} http://3dlifeplayer....r_installer.exe (Virtools WebPlayer Class)
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} http://games.bigfish...inematycoon.cab (TikGames Online Control)
O16 - DPF: {EA6246B4-F380-443F-8727-9AEA3371146C} http://pogo.oberon-m...sh.1.0.0.47.cab (CPlayFirstWeddingDashControl Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 65.32.5.111 65.32.5.112
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\mmbm\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\mmbm\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/05/06 19:38:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2003/08/08 17:24:26 | 000,000,045 | -HS- | M] () - D:\autorun.inf.aug.8 -- [ FAT32 ]
O33 - MountPoints2\{bf59b18e-6b69-11df-8ae4-00064f800d39}\Shell - "" = AutoRun
O33 - MountPoints2\{bf59b18e-6b69-11df-8ae4-00064f800d39}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{bf59b18e-6b69-11df-8ae4-00064f800d39}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/21 19:09:34 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\mmbm\Desktop\OTL.exe
[2010/11/20 10:11:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmbm\Local Settings\Application Data\Paint.NET
[2010/11/19 14:08:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2010/11/19 14:08:14 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010/11/19 14:07:42 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2010/11/10 17:21:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmbm\Application Data\Feruxy
[2010/11/09 16:58:52 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime(2)
[2010/10/26 12:59:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mmbm\Local Settings\Application Data\{D667880E-AD92-40AE-98BF-50F8835C2CD0}
[2008/04/15 23:10:30 | 000,409,600 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrinpa.dll
[2008/04/15 23:10:29 | 000,393,216 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcriesc.dll
[2008/04/15 23:08:17 | 001,183,744 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrserv.dll
[2008/04/15 23:08:17 | 000,995,328 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrusb1.dll
[2008/04/15 23:08:17 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrprox.dll
[2008/04/15 23:08:16 | 000,536,576 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrlmpm.dll
[2008/04/15 23:08:16 | 000,114,688 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrpplc.dll
[2008/04/15 23:08:14 | 000,610,304 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrcomc.dll
[2008/04/15 23:08:14 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrcomm.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/21 19:09:19 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mmbm\Desktop\OTL.exe
[2010/11/21 19:07:18 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/11/21 19:02:49 | 000,000,782 | ---- | M] () -- C:\Documents and Settings\mmbm\Desktop\Check Disk.lnk
[2010/11/21 19:02:29 | 000,081,496 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2010/11/21 19:02:17 | 000,000,878 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/21 19:02:07 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At19.job
[2010/11/21 19:02:06 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/21 19:02:05 | 939,053,056 | -HS- | M] () -- C:\hiberfil.sys
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At9.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At8.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At7.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At6.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At5.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At4.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At3.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At24.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At23.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At22.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At21.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At20.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At2.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At18.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At17.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At16.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At15.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At14.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At13.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At12.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At11.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At10.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\tasks\At1.job
[2010/11/21 18:14:01 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/19 14:15:18 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 8.lnk
[2010/11/19 14:12:05 | 000,441,432 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/11/19 14:12:05 | 000,071,176 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/11/19 14:09:42 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/19 13:52:10 | 000,000,006 | ---- | M] () -- C:\Documents and Settings\mmbm\Application Data\completescan
[2010/11/19 13:11:45 | 000,000,006 | ---- | M] () -- C:\Documents and Settings\mmbm\Application Data\start
[2010/11/19 13:06:43 | 000,000,010 | ---- | M] () -- C:\Documents and Settings\mmbm\Application Data\install
[2010/11/16 16:49:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/26 21:02:43 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Iwupaduxoxux.dat
[2010/10/26 12:59:31 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Ywelifad.bin
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/11/21 19:02:48 | 000,000,782 | ---- | C] () -- C:\Documents and Settings\mmbm\Desktop\Check Disk.lnk
[2010/11/19 14:09:37 | 939,053,056 | -HS- | C] () -- C:\hiberfil.sys
[2010/11/19 13:11:45 | 000,000,006 | ---- | C] () -- C:\Documents and Settings\mmbm\Application Data\start
[2010/11/19 13:11:03 | 000,000,006 | ---- | C] () -- C:\Documents and Settings\mmbm\Application Data\completescan
[2010/11/19 13:06:43 | 000,000,010 | ---- | C] () -- C:\Documents and Settings\mmbm\Application Data\install
[2010/11/19 13:05:19 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At24.job
[2010/11/19 13:05:17 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At23.job
[2010/11/19 13:05:15 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At22.job
[2010/11/19 13:05:12 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At21.job
[2010/11/19 13:05:10 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At20.job
[2010/11/19 13:05:08 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At19.job
[2010/11/19 13:05:06 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At18.job
[2010/11/19 13:05:05 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At17.job
[2010/11/19 13:05:04 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At16.job
[2010/11/19 13:05:03 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At15.job
[2010/11/19 13:05:02 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At14.job
[2010/11/19 13:05:01 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At13.job
[2010/11/19 13:05:00 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At12.job
[2010/11/19 13:04:59 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At9.job
[2010/11/19 13:04:59 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At8.job
[2010/11/19 13:04:59 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At7.job
[2010/11/19 13:04:59 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At6.job
[2010/11/19 13:04:59 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At11.job
[2010/11/19 13:04:59 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At10.job
[2010/11/19 13:04:58 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At5.job
[2010/11/19 13:04:58 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At4.job
[2010/11/19 13:04:58 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At3.job
[2010/11/19 13:04:58 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At2.job
[2010/11/19 13:04:58 | 000,000,422 | ---- | C] () -- C:\WINDOWS\tasks\At1.job
[2010/10/26 12:59:31 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Iwupaduxoxux.dat
[2010/10/26 12:59:31 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Ywelifad.bin
[2010/09/03 17:25:38 | 000,000,122 | ---- | C] () -- C:\Documents and Settings\mmbm\Application Data\wklnhst.dat
[2010/09/02 10:12:09 | 000,000,024 | ---- | C] () -- C:\Documents and Settings\NetworkService\Application Data\hngmfc.dat
[2010/05/01 10:55:12 | 000,028,672 | ---- | C] () -- C:\Documents and Settings\mmbm\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/05 16:01:57 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010/02/05 15:31:27 | 000,000,107 | ---- | C] () -- C:\WINDOWS\VobEdit.INI
[2010/01/26 17:13:48 | 000,000,367 | ---- | C] () -- C:\WINDOWS\IfoEdit.INI
[2009/01/01 19:38:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PTWebCam.INI
[2008/09/10 21:05:52 | 000,000,206 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2008/04/15 23:10:31 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxcrvs.dll
[2008/04/15 23:10:28 | 000,303,104 | ---- | C] () -- C:\WINDOWS\System32\lxcrcoin.dll
[2008/04/15 23:10:10 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxcrcaps.dll
[2008/04/15 23:10:09 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxcrdrs.dll
[2008/04/15 23:10:09 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\lxcrcnv4.dll
[2008/04/15 23:09:52 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXPMONUI.DLL
[2008/04/15 23:09:51 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\LXPRMON.DLL
[2008/04/15 23:08:18 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\LXCRinst.dll
[2007/11/09 18:38:35 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2007/11/09 18:38:35 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2007/11/09 18:38:33 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2007/11/09 18:38:32 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007/11/09 18:38:30 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2007/11/09 18:38:30 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2007/11/09 18:38:23 | 000,196,608 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2006/07/01 01:01:25 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/05/06 19:24:27 | 000,001,364 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2006/05/06 19:24:27 | 000,000,456 | ---- | C] () -- C:\WINDOWS\System32\emver.ini
[2006/05/06 19:24:24 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll
[2006/05/06 19:24:24 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll
[2006/05/06 19:24:24 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll
[2006/05/06 19:24:24 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll
[2006/05/06 19:24:24 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll
[2006/05/06 12:31:05 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

========== LOP Check ==========

[2010/05/21 15:37:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Cadsoft
[2010/08/25 15:08:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MyVirtualHome
[2010/04/30 14:20:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCPitstop
[2009/05/06 21:57:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PlayFirst
[2010/09/21 13:29:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2009/05/06 22:03:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2009/07/13 12:26:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\VideoConverter
[2009/07/09 15:16:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WildTangent
[2007/11/09 23:07:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[2010/06/30 13:05:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmbm\Application Data\AnvSoft
[2010/05/26 10:06:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmbm\Application Data\Facebook
[2010/11/19 13:32:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmbm\Application Data\Feruxy
[2010/04/30 14:59:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmbm\Application Data\GetRightToGo
[2010/08/15 18:25:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmbm\Application Data\gtk-2.0
[2010/05/01 10:51:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmbm\Application Data\Opera
[2007/11/09 23:11:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmbm\Application Data\SampleView
[2010/11/21 19:03:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmbm\Application Data\Spare Backup
[2010/09/03 17:26:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\mmbm\Application Data\Template
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At1.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At10.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At11.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At12.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At13.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At14.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At15.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At16.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At17.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At18.job
[2010/11/21 19:02:07 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At19.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At2.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At20.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At21.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At22.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At23.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At24.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At3.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At4.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At5.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At6.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At7.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At8.job
[2010/11/21 18:41:01 | 000,000,422 | ---- | M] () -- C:\WINDOWS\Tasks\At9.job
[2010/11/21 19:07:18 | 000,000,408 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 143 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1C5692E6

< End of report >

and the extras log...

OTL Extras logfile created on: 11/21/2010 7:09:48 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\mmbm\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

895.00 Mb Total Physical Memory | 398.00 Mb Available Physical Memory | 44.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 143.95 Gb Total Space | 94.16 Gb Free Space | 65.41% Space Free | Partition Type: NTFS
Drive D: | 5.08 Gb Total Space | 2.58 Gb Free Space | 50.73% Space Free | Partition Type: FAT32
Drive E: | 1.69 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: YOUR-BC185A12A1 | User Name: mmbm | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"56993:TCP" = 56993:TCP:*:Enabled:Pando Media Booster
"56993:UDP" = 56993:UDP:*:Enabled:Pando Media Booster

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"56993:TCP" = 56993:TCP:*:Enabled:Pando Media Booster
"56993:UDP" = 56993:UDP:*:Enabled:Pando Media Booster

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{15377C3E-9655-400F-B441-E69F0A6BEAFE}" = Recovery Software Suite eMachines
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{171E6C1E-B5FC-11DF-B115-005056C00008}" = Google Earth Plug-in
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 17
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
"{43602F34-1AA3-44FB-AEB2-D08C2C73743F}" = Paint.NET v3.36
"{4E868D3D-6EEB-4273-926C-2287236B5B79}" = 3DVIA player 4.1
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{70C592EC-AE9B-4734-928B-676E824FB41E}" = MFC RunTime files
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{A2A60894-E3ED-46FE-9A6A-7CF7A87572A0}" = Opera 9.64
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A57C6094-FC5A-4DEC-B1E0-1B2F48EEE8F4}" = Spare Backup
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA531FBD-E130-4F3B-A856-507190DBE11D}" = Envisioneer 4.5c2 Express
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.5
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}" = getPlus® for Adobe
"{DBEA1034-5882-4A88-8033-81C4EF0CFA29}" = Google Toolbar for Internet Explorer
"{DF86A72C-4585-4D75-B592-968C8C6604A1}" = eMachines Connect
"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware
"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F3CA9611-CD42-4562-ADAB-A554CF8E17F1}" = Microsoft WSE 2.0 SP3 Runtime
"{F8722041-B63A-47FB-82A8-5F0977E1CF45}" = TWC Customer Controls
"7394C7E1FE86ACFE6FB7A2879139A6AEB420EC10" = Windows Driver Package - NVIDIA (NVENETFD) Net (11/27/2006 65.4.8)
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Any Video Converter_is1" = Any Video Converter 3.0.5
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F40&SUBSYS_200014F1" = Soft Data Fax Modem with SmartCP
"D93CE88F69FBAD21C270C82347C084C1411AFF43" = Windows Driver Package - NVIDIA (nvnetbus) NVIDIA Network Bus Enumerator (11/27/2006 65.4.8)
"DivX Setup.divx.com" = DivX Setup
"Dual Mode Camera_is1" = Uninstall Dual Mode Camera
"DVD Flick_is1" = DVD Flick 1.3.0.7
"Google Desktop" = Google Desktop
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{AA531FBD-E130-4F3B-A856-507190DBE11D}" = Envisioneer 4.5c2 Express
"Lexmark 2400 Series" = Lexmark 2400 Series
"Lexmark Fax Solutions" = Lexmark Fax Solutions
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Essentials" = Microsoft Security Essentials
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PhoTagsExpress" = PhoTags Express
"SymSetup.{C1C185CA-C531-49F5-A6FA-B838405A049D}" = Norton Internet Security (Symantec Corporation)
"WGA" = Windows Genuine Advantage Validation Tool
"WildTangent emachines Master Uninstall" = eMachines Games
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.6
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"Play89" = Play89

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/19/2010 2:04:06 PM | Computer Name = YOUR-BC185A12A1 | Source = Application Error | ID = 1000
Description = Faulting application roeanswmcx.tmp, version 0.0.0.0, faulting module
unknown, version 0.0.0.0, fault address 0x000018a2.

Error - 11/19/2010 2:13:51 PM | Computer Name = YOUR-BC185A12A1 | Source = Spare Backup | ID = 0
Description =

Error - 11/19/2010 2:15:02 PM | Computer Name = YOUR-BC185A12A1 | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/19/2010 3:12:01 PM | Computer Name = YOUR-BC185A12A1 | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 9980, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 11/19/2010 3:12:01 PM | Computer Name = YOUR-BC185A12A1 | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The Error code is the first DWORD in Data section.

Error - 11/19/2010 3:12:05 PM | Computer Name = YOUR-BC185A12A1 | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 9980, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 11/21/2010 7:15:22 PM | Computer Name = YOUR-BC185A12A1 | Source = MPSampleSubmission | ID = 5000
Description = EventType avsubmit, P1 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P2 1.1.6402.0, P3 1.95.313.0, P4 1.95.313.0, P5 trojan_win32_fakesysdef, P6 NIL,
P7 NIL, P8 NIL, P9 NIL, P10 NIL.

Error - 11/21/2010 7:43:35 PM | Computer Name = YOUR-BC185A12A1 | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 11/21/2010 7:43:35 PM | Computer Name = YOUR-BC185A12A1 | Source = MSSecurityEssentials | ID = 5000
Description =

Error - 11/21/2010 7:45:15 PM | Computer Name = YOUR-BC185A12A1 | Source = MPSampleSubmission | ID = 5000
Description = EventType avsubmit, P1 microsoft antimalware (bcf43643-a118-4432-aede-d861fcbcfcde),
P2 1.1.6402.0, P3 1.95.313.0, P4 1.95.313.0, P5 trojan_win32_fakesysdef, P6 NIL,
P7 NIL, P8 NIL, P9 NIL, P10 NIL.

[ System Events ]
Error - 11/19/2010 3:06:34 PM | Computer Name = YOUR-BC185A12A1 | Source = Service Control Manager | ID = 7001
Description = The DNS Client service depends on the TCP/IP Protocol Driver service
which failed to start because of the following error: %%31

Error - 11/19/2010 3:06:34 PM | Computer Name = YOUR-BC185A12A1 | Source = Service Control Manager | ID = 7001
Description = The TCP/IP NetBIOS Helper service depends on the AFD service which
failed to start because of the following error: %%31

Error - 11/19/2010 3:06:34 PM | Computer Name = YOUR-BC185A12A1 | Source = Service Control Manager | ID = 7001
Description = The IPSEC Services service depends on the IPSEC driver service which
failed to start because of the following error: %%31

Error - 11/19/2010 3:06:34 PM | Computer Name = YOUR-BC185A12A1 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD Fips IPSec MpFilter MRxSmb NetBIOS NetBT Processor RasAcd Rdbss Tcpip

Error - 11/19/2010 3:07:21 PM | Computer Name = YOUR-BC185A12A1 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 11/21/2010 4:00:32 AM | Computer Name = YOUR-BC185A12A1 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80246007: Windows Malicious Software Removal Tool - November 2010
(KB890830).

Error - 11/21/2010 4:00:32 AM | Computer Name = YOUR-BC185A12A1 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80246007: Security Update for Microsoft Office PowerPoint Viewer 2007
(KB2413381).

Error - 11/21/2010 4:00:32 AM | Computer Name = YOUR-BC185A12A1 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80246007: Security Update for Microsoft Office 2007 System (KB2289158).

Error - 11/21/2010 7:15:23 PM | Computer Name = YOUR-BC185A12A1 | Source = Microsoft Antimalware | ID = 1008
Description = %%861 has encountered an error when taking action on spyware or other
potentially unwanted software. For more information please see the following: http://go.microsoft....atid=2147639286

User:
YOUR-BC185A12A1\mmbm Name: Trojan:Win32/FakeSysdef ID: 2147639286 Severity: Severe

Category:
Trojan Path: Action: %%808 Error Code: 0x80508023 Error description: The program could
not find the spyware and other potentially unwanted software on this computer.
Status: Signature Version: AV: 1.95.313.0, AS: 1.95.313.0 Engine Version: 1.1.6402.0

Error - 11/21/2010 7:43:34 PM | Computer Name = YOUR-BC185A12A1 | Source = Service Control Manager | ID = 7031
Description = The Microsoft Antimalware Service service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in
15000 milliseconds: Restart the service.


< End of report >

Edited by robertupland, 21 November 2010 - 06:12 PM.

[Advertisements]

I did a scan with HouseCall and it found to trojans and removed them. Everything seems to be workin now except my desktop.

At firtst I couldn't see anything except for the start menu at the bottom. I right clicked and clicked "Arrange Icons By" and there was an option to show desktop icons. I checked that and the icons showed back up but the black background is still there and every time I try to change my background nothing happens. It won't let me click on anything in the display properties.

I was able to right click ona photo and choose "Set As Background" and it changed.

[robertupland]

I did a scan with HouseCall and it found to trojans and removed them. Everything seems to be workin now except my desktop.

At firtst I couldn't see anything except for the start menu at the bottom. I right clicked and clicked "Arrange Icons By" and there was an option to show desktop icons. I checked that and the icons showed back up but the black background is still there and every time I try to change my background nothing happens. It won't let me click on anything in the display properties.

I was able to right click ona photo and choose "Set As Background" and it changed.

[eddie5659]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.