Solved Win 7 Antivirus 2012

[Resolved] Win 7 Antivirus 2012

My sisters new computer got infected with the Win 7 Antivirus 2012. She let Norton expire and didn't update the computer with antivirus. I was finally able to get Norton to scan in safe mode, six viruses were found, one was sucessfully quarantined, the others still need attention. I ran all of the recommended scans - GMER log showed nothing. Thanks for your assistance.

Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2011.12.31.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Owner :: OWNER-PC [administrator]

12/31/2011 5:27:28 PM
mbam-log-2011-12-31 (17-27-28).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 172244
Time elapsed: 3 minute(s), 4 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

aswMBR version 0.9.9.1124 Copyright(c) 2011 AVAST Software
Run date: 2011-12-31 17:31:58
-----------------------------
17:31:58.682 OS Version: Windows x64 6.1.7601 Service Pack 1
17:31:58.682 Number of processors: 2 586 0x2A07
17:31:58.682 ComputerName: OWNER-PC UserName: Owner
17:31:59.790 Initialize success
17:33:11.817 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
17:33:11.832 Disk 0 Vendor: Hitachi_ ES2O Size: 305245MB BusType: 3
17:33:11.848 Disk 0 MBR read successfully
17:33:11.848 Disk 0 MBR scan
17:33:11.864 Disk 0 Windows VISTA default MBR code
17:33:11.864 Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS 1500 MB offset 2048
17:33:11.879 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 288988 MB offset 3074048
17:33:11.910 Disk 0 Partition 3 00 17 Hidd HPFS/NTFS NTFS 14756 MB offset 594921472
17:33:11.910 Service scanning
17:33:13.470 Modules scanning
17:33:13.470 Disk 0 trace - called modules:
17:33:13.533 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
17:33:13.548 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8005f5f060]
17:33:13.548 3 CLASSPNP.SYS[fffff880019ba43f] -> nt!IofCallDriver -> [0xfffffa80041ba560]
17:33:13.564 5 ACPI.sys[fffff88000f767a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80041be050]
17:33:13.564 Scan finished successfully
17:33:32.939 Disk 0 MBR has been saved successfully to "C:\Users\Owner\Desktop\MBR.dat "
17:33:32.955 The log file has been saved successfully to "C:\Users\Owner\Desktop\aswMBR.txt "


.
DDS (Ver_2011-06-23.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Owner at 17:37:01 on 2011-12-31
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4008.2779 [GMT -5:00]
.
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\windows\system32\wininit.exe
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k netsvcs
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\GFNEXSrv.exe
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Norton Internet Security\Engine\19.2.0.10\ccSvcHst.exe
C:\windows\system32\taskhost.exe
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Program Files (x86)\Norton Internet Security\Engine\19.2.0.10\ccSvcHst.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\TOSHIBA\TECO\TecoService.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe
C:\windows\system32\wbem\unsecapp.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\TECO\Teco.exe
C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
C:\Program Files\Common Files\Bluebeam Software\Brewery\V45\Printer Support\BBPrint.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\windows\system32\SearchIndexer.exe
C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files (x86)\Toshiba\TOSHIBA Sleep Utility\TSleepSrv.exe
C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\SymcPCCULaunchSvc.exe
C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
C:\windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\windows\system32\wuauclt.exe
C:\Windows\system32\WUDFHost.exe
C:\windows\system32\DllHost.exe
C:\windows\system32\DllHost.exe
C:\windows\system32\DllHost.exe
C:\windows\SysWOW64\cmd.exe
C:\windows\system32\conhost.exe
C:\windows\SysWOW64\cscript.exe
C:\windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://start.toshiba.com/?cid=C001B2Y
uInternet Settings,ProxyOverride = <local>
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Norton Identity Protection: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.2.0.10\coIEPlg.dll
BHO: Norton Vulnerability Protection: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\19.2.0.10\IPS\IPSBHO.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: TOSHIBA Media Controller Plug-in: {f3c88694-effa-4d78-b409-54b7b2535b14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\19.2.0.10\coIEPlg.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "
mRun: [TSleepSrv] %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
mRun: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun: [ToshibaAppPlace] "C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe "
mRun: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" UNATTENDED
mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1 71.243.0.12
TCP: Interfaces\{619CCF45-EE8F-4924-9CF5-F8E079DBFC5E} : DhcpNameServer = 172.24.1.1
TCP: Interfaces\{9AC39DC5-39C9-4369-BBF4-2151F8140232} : DhcpNameServer = 192.168.1.1 71.243.0.12
TCP: Interfaces\{9AC39DC5-39C9-4369-BBF4-2151F8140232}\4796B616D656B616 : DhcpNameServer = 192.168.1.1 71.243.0.12
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.2.0.10\coIEPlg.dll
BHO-X64: Norton Identity Protection - No File
BHO-X64: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.2.0.10\IPS\IPSBHO.DLL
BHO-X64: Norton Vulnerability Protection - No File
BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO-X64: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO-X64: TOSHIBA Media Controller Plug-in: {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll
TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.2.0.10\coIEPlg.dll
TB-X64: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
mRun-x64: [TSleepSrv] %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
mRun-x64: [ToshibaServiceStation] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60
mRun-x64: [ToshibaAppPlace] "C:\Program Files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe "
mRun-x64: [NortonOnlineBackupReminder] "C:\Program Files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" UNATTENDED
mRunOnce-x64: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
.
============= SERVICES / DRIVERS ===============
.
R0 SymDS;Symantec Data Store;C:\windows\system32\drivers\NISx64\1302000.00A\SYMDS64.SYS --> C:\windows\system32\drivers\NISx64\1302000.00A\SYMDS64.SYS [?]
R0 SymEFA;Symantec Extended File Attributes;C:\windows\system32\drivers\NISx64\1302000.00A\SYMEFA64.SYS --> C:\windows\system32\drivers\NISx64\1302000.00A\SYMEFA64.SYS [?]
R0 tos_sps64;TOSHIBA tos_sps64 Service;C:\windows\system32\DRIVERS\tos_sps64.sys --> C:\windows\system32\DRIVERS\tos_sps64.sys [?]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20111221.003\BHDrvx64.sys [2011-12-26 1156216]
R1 ccSet_NIS;Norton Internet Security Settings Manager;C:\windows\system32\drivers\NISx64\1302000.00A\ccSetx64.sys --> C:\windows\system32\drivers\NISx64\1302000.00A\ccSetx64.sys [?]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20111226.001\IDSviA64.sys [2011-12-27 488568]
R1 SymIRON;Symantec Iron Driver;C:\windows\system32\drivers\NISx64\1302000.00A\Ironx64.SYS --> C:\windows\system32\drivers\NISx64\1302000.00A\Ironx64.SYS [?]
R1 SymNetS;Symantec Network Security WFP Driver;C:\windows\system32\Drivers\NISx64\1302000.00A\SYMNETS.SYS --> C:\windows\system32\Drivers\NISx64\1302000.00A\SYMNETS.SYS [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\windows\system32\DRIVERS\vwififlt.sys --> C:\windows\system32\DRIVERS\vwififlt.sys [?]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]
R2 GFNEXSrv;GFNEX Service;C:\Windows\System32\GFNEXSrv.exe --> C:\Windows\System32\GFNEXSrv.exe [?]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\19.2.0.10\ccsvchst.exe [2011-11-25 138760]
R2 Norton PC Checkup Application Launcher;Toshiba Laptop Checkup Application Launcher;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\SymcPCCULaunchSvc.exe [2011-9-23 123320]
R2 PCCUJobMgr;Common Client Job Manager Service;C:\Program Files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [2011-9-23 126392]
R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-9-14 508264]
R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;C:\Program Files\TOSHIBA\TECO\TecoService.exe [2011-5-24 294848]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\system32\DRIVERS\TVALZFL.sys --> C:\windows\system32\DRIVERS\TVALZFL.sys [?]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-9-23 2656280]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-11-25 138360]
R3 IntcDAud;Intel(R) Display Audio;C:\windows\system32\DRIVERS\IntcDAud.sys --> C:\windows\system32\DRIVERS\IntcDAud.sys [?]
R3 MEIx64;Intel(R) Management Engine Interface;C:\windows\system32\DRIVERS\HECIx64.sys --> C:\windows\system32\DRIVERS\HECIx64.sys [?]
R3 PGEffect;Pangu effect driver;C:\windows\system32\DRIVERS\pgeffect.sys --> C:\windows\system32\DRIVERS\pgeffect.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\windows\system32\DRIVERS\Rt64win7.sys --> C:\windows\system32\DRIVERS\Rt64win7.sys [?]
R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\windows\system32\DRIVERS\rtl8192Ce.sys --> C:\windows\system32\DRIVERS\rtl8192Ce.sys [?]
R3 Sftfs;Sftfs;C:\windows\system32\DRIVERS\Sftfslh.sys --> C:\windows\system32\DRIVERS\Sftfslh.sys [?]
R3 Sftplay;Sftplay;C:\windows\system32\DRIVERS\Sftplaylh.sys --> C:\windows\system32\DRIVERS\Sftplaylh.sys [?]
R3 Sftredir;Sftredir;C:\windows\system32\DRIVERS\Sftredirlh.sys --> C:\windows\system32\DRIVERS\Sftredirlh.sys [?]
R3 Sftvol;Sftvol;C:\windows\system32\DRIVERS\Sftvollh.sys --> C:\windows\system32\DRIVERS\Sftvollh.sys [?]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-9-14 219496]
R3 TMachInfo;TMachInfo;C:\Program Files (x86)\Toshiba\TOSHIBA Service Station\TMachInfo.exe [2011-9-23 57216]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2011-6-9 138152]
R3 TPCHSrv;TPCH Service;C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [2011-7-1 828856]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-9-23 136176]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-9-23 136176]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\system32\Drivers\RtsUStor.sys --> C:\windows\system32\Drivers\RtsUStor.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\windows\system32\drivers\tsusbflt.sys --> C:\windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\system32\drivers\TsUsbGD.sys --> C:\windows\system32\drivers\TsUsbGD.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\windows\system32\Wat\WatAdminSvc.exe --> C:\windows\system32\Wat\WatAdminSvc.exe [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
2011-12-31 22:26:21 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{CB627CCF-9185-43F7-9E9F-813EE6E4E3FA}\offreg.dll
2011-12-31 22:26:18 -------- d-----w- C:\Users\Owner\AppData\Roaming\Malwarebytes
2011-12-31 22:26:11 -------- d-----w- C:\ProgramData\Malwarebytes
2011-12-31 22:26:10 23152 ----a-w- C:\windows\System32\drivers\mbam.sys
2011-12-31 22:26:10 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2011-12-31 21:10:22 8822856 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{CB627CCF-9185-43F7-9E9F-813EE6E4E3FA}\mpengine.dll
2011-12-27 23:14:34 8822856 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2011-12-13 23:27:41 43520 ----a-w- C:\windows\System32\csrsrv.dll
2011-12-13 23:27:41 3145216 ----a-w- C:\windows\System32\win32k.sys
2011-12-13 23:27:40 723456 ----a-w- C:\windows\System32\EncDec.dll
2011-12-13 23:27:39 534528 ----a-w- C:\windows\SysWow64\EncDec.dll
2011-12-13 23:27:36 2048 ----a-w- C:\windows\SysWow64\tzres.dll
2011-12-13 23:27:36 2048 ----a-w- C:\windows\System32\tzres.dll
2011-12-07 22:41:53 -------- d-----w- C:\Users\Owner\AppData\Roaming\Individual Software
2011-12-07 22:41:49 -------- d-----w- C:\temp
2011-12-07 22:37:01 -------- d-----w- C:\ProgramData\Individual Software
2011-12-07 22:37:00 260096 ----a-w- C:\windows\SysWow64\RichTx32.ocx
2011-12-07 22:36:57 570128 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\dao350.dll
2011-12-07 22:36:57 24576 ----a-w- C:\windows\SysWow64\msxml3a.dll
2011-12-07 22:36:57 1048576 ----a-w- C:\windows\SysWow64\Roboex32.dll
2011-12-07 22:36:56 87952 ----a-w- C:\windows\SysWow64\Twain.dll
2011-12-07 22:36:56 61440 ----a-w- C:\windows\SysWow64\twunk_32.exe
2011-12-07 22:36:56 49376 ----a-w- C:\windows\SysWow64\Twunk_16.exe
2011-12-07 22:36:56 1355776 ----a-w- C:\windows\SysWow64\Msvbvm50.dll
2011-12-07 22:36:56 102400 ----a-w- C:\windows\SysWow64\Twain_32.dll
2011-12-07 22:36:56 -------- d-----w- C:\Program Files (x86)\Total 3D Home
2011-12-07 22:36:56 -------- d-----w- C:\Program Files (x86)\Common Files\Individual Software
.
==================== Find3M ====================
.
2011-11-15 19:29:56 270720 ------w- C:\windows\System32\MpSigStub.exe
2011-11-04 01:53:39 2309120 ----a-w- C:\windows\System32\jscript9.dll
2011-11-04 01:44:47 1390080 ----a-w- C:\windows\System32\wininet.dll
2011-11-04 01:44:21 1493504 ----a-w- C:\windows\System32\inetcpl.cpl
2011-11-04 01:34:43 2382848 ----a-w- C:\windows\System32\mshtml.tlb
2011-11-03 22:47:42 1798144 ----a-w- C:\windows\SysWow64\jscript9.dll
2011-11-03 22:40:21 1427456 ----a-w- C:\windows\SysWow64\inetcpl.cpl
2011-11-03 22:39:47 1127424 ----a-w- C:\windows\SysWow64\wininet.dll
2011-11-03 22:31:57 2382848 ----a-w- C:\windows\SysWow64\mshtml.tlb
.
============= FINISH: 17:37:26.85 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-23.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 11/18/2011 10:54:41 AM
System Uptime: 12/31/2011 5:23:14 PM (0 hours ago)
.
Motherboard: Intel Corporation | | Oneonta Falls
Processor: Intel(R) Pentium(R) CPU B950 @ 2.10GHz | CPU 1 | 2100/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 282 GiB total, 241.83 GiB free.
D: is CDROM ()
E: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP3: 11/18/2011 10:55:10 AM - Installed TOSHIBA Quality Application
RP4: 11/25/2011 9:22:40 AM - Windows Update
RP5: 11/25/2011 11:14:30 AM - Windows Update
RP6: 11/27/2011 10:39:56 AM - Installed DirectX
RP7: 11/27/2011 10:40:29 AM - Installed Bluebeam PDF Revu x64 v9.5.1
RP8: 11/27/2011 11:58:49 AM - Windows Update
RP9: 11/29/2011 6:15:37 PM - Windows Update
RP10: 12/15/2011 6:04:46 PM - Windows Update
RP11: 12/27/2011 6:14:07 PM - Windows Update
RP12: 12/29/2011 9:01:45 AM - Removed Skype Launcher
RP13: 12/31/2011 4:10:04 PM - Windows Update
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X MUI
Bejeweled 3
Bluebeam PDF Revu CAD x64 v9.5.1
Chuzzle Deluxe
D3DX10
DHTML Editing Component
FATE - The Traitor Soul
Fishdom (TM) 2
Google Chrome
Google Toolbar for Internet Explorer
Google Update Helper
Intel(R) Management Engine Components
Intel(R) Processor Graphics
Intel(R) Rapid Storage Technology
Java Auto Updater
Java(TM) 6 Update 25
Junk Mail filter update
Label@Once 1.0
Malwarebytes Anti-Malware version 1.60.0.1800
Mesh Runtime
Microsoft Office 2010
Microsoft Office Click-to-Run 2010
Microsoft Office Starter 2010 - English
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
MSVCRT
MSVCRT_amd64
Norton Internet Security
Penguins!
Plants vs. Zombies - Game of the Year
PlayReady PC Runtime x86
Polar Bowler
Realtek Ethernet Controller Driver
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
Realtek WLAN Driver
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Tom Clancy's Splinter Cell
Toshiba App Place
TOSHIBA Application Installer
TOSHIBA Assist
Toshiba Book Place
TOSHIBA Bulletin Board
TOSHIBA Face Recognition
TOSHIBA Hardware Setup
Toshiba Laptop Checkup
TOSHIBA Media Controller
TOSHIBA Media Controller Plug-in
Toshiba Online Backup
TOSHIBA Quality Application
TOSHIBA Recovery Media Creator
TOSHIBA ReelTime
TOSHIBA Resolution+ Plug-in for Windows Media Player
TOSHIBA Service Station
TOSHIBA Sleep Utility
TOSHIBA Supervisor Password
TOSHIBA Value Added Package
TOSHIBA Web Camera Application
TOSHIBA Wireless LAN Indicator
TOSHIBARegistration
Total 3D Home
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update Installer for WildTangent Games App
Virtual Villagers 5 - New Believers
WildTangent Games
WildTangent Games App (Toshiba Games)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Zuma's Revenge
.
==== Event Viewer Messages From Past Week ========
.
12/31/2011 4:55:34 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
12/31/2011 4:35:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
12/31/2011 4:35:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
12/31/2011 4:35:03 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
12/31/2011 4:35:03 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
12/31/2011 4:34:52 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
12/31/2011 4:34:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
12/31/2011 4:34:41 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD BHDrvx64 ccSet_NIS DfsC discache eeCtrl IDSVia64 NetBIOS NetBT nsiproxy Psched rdbss spldr SRTSPX SymIRON SymNetS tdx vwififlt Wanarpv6 WfpLwf
12/31/2011 4:34:36 PM, Error: Service Control Manager [7001] - The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error: The dependency service or group failed to start.
12/31/2011 4:34:33 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/31/2011 4:34:33 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
12/31/2011 4:34:33 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
12/31/2011 4:34:33 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
12/31/2011 4:34:33 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
12/31/2011 4:34:33 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
12/31/2011 4:34:33 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/31/2011 4:34:33 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
12/31/2011 4:34:33 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
12/31/2011 4:34:33 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
12/31/2011 4:33:11 PM, Error: Service Control Manager [7038] - The upnphost service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: The request is not supported. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).
12/31/2011 4:33:11 PM, Error: Service Control Manager [7000] - The UPnP Device Host service failed to start due to the following error: The service did not start due to a logon failure.
12/31/2011 4:33:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1069" attempting to start the service upnphost with arguments " " in order to run the server: {204810B9-73B2-11D4-BF42-00B0D0118B56}
12/31/2011 4:31:06 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
12/31/2011 3:02:17 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD avipbb avkmgr BHDrvx64 ccSet_NIS DfsC discache eeCtrl IDSVia64 NetBIOS NetBT nsiproxy Psched rdbss spldr SRTSPX SymIRON SymNetS tdx vwififlt Wanarpv6 WfpLwf
12/31/2011 2:51:21 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service BITS with arguments " " in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
12/31/2011 2:45:24 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: BHDrvx64 ccSet_NIS discache eeCtrl IDSVia64 spldr SRTSPX SymIRON SymNetS Wanarpv6
12/27/2011 6:38:32 PM, Error: ACPI [10] - ACPI: ACPI BIOS is attempting to write to an illegal PCI Operation Region (0x4), Please contact your system vendor for technical assistance.
.
==== End Of File ===========================

 

Bootkit Remover
(c) 2009 Esage Lab
www.esagelab.com

Program version: 1.2.0.1
OS Version: Microsoft Windows 7 Home Premium Edition Service Pack 1 (build 7601)
, 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Controlled by rootkit!

Boot code on some of your physical disks is hidden by a rootkit.
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]


Done;
Press any key to quit...

 

After running ComboFix can't open Internet explorer or Chrome - getting error "illegal operation attempted on a registry key that has been marked for deletion ".


ComboFix 11-12-31.03 - Owner 01/01/2012 10:23:56.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4008.2659 [GMT -5:00]
Running from: c:\users\Owner\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\twain.dll
.
----- File Replicators -----
.
c:\programdata\Adobe\ARM\Reader_10.0.0\1131\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\1131\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\1131\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\12578\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\12578\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\12578\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\14207\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\14207\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\14207\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\15681\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\15681\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\15681\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\17257\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\17257\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\17257\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\18147\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\18147\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\18147\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\18391\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\18391\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\18391\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\19936\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\19936\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\19936\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\20562\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\20562\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\20562\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\22317\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\22317\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\22317\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\23387\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\23387\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\23387\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\26390\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\26390\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\26390\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\27215\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\27215\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\27215\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\29108\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\29108\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\29108\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\30509\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\30509\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\30509\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\30718\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\30718\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\30718\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\31320\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\31320\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\31320\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\32134\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\32134\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\32134\ReaderUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\8197\AcrobatUpdater.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\8197\AdobeARM.exe
c:\programdata\Adobe\ARM\Reader_10.0.0\8197\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\1131\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\1131\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\1131\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\12578\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\12578\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\12578\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\14207\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\14207\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\14207\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\15681\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\15681\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\15681\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\17257\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\17257\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\17257\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\18147\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\18147\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\18147\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\18391\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\18391\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\18391\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\19936\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\19936\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\19936\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\20562\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\20562\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\20562\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\22317\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\22317\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\22317\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\23387\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\23387\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\23387\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\26390\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\26390\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\26390\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\27215\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\27215\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\27215\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\29108\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\29108\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\29108\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\30509\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\30509\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\30509\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\30718\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\30718\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\30718\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\31320\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\31320\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\31320\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\32134\AcrobatUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\32134\AdobeARM.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\32134\ReaderUpdater.exe
c:\users\All Users\Adobe\ARM\Reader_10.0.0\8197\ReaderUpdater.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-12-01 to 2012-01-01 )))))))))))))))))))))))))))))))
.
.
2012-01-01 15:28 . 2012-01-01 15:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-12-31 22:26 . 2011-12-31 22:26 -------- d-----w- c:\users\Owner\AppData\Roaming\Malwarebytes
2011-12-31 22:26 . 2011-12-31 22:26 -------- d-----w- c:\programdata\Malwarebytes
2011-12-31 22:26 . 2011-12-31 22:26 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-12-31 22:26 . 2011-12-10 20:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-31 21:10 . 2011-11-30 07:21 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{CB627CCF-9185-43F7-9E9F-813EE6E4E3FA}\mpengine.dll
2011-12-13 23:27 . 2011-11-24 04:52 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-12-13 23:27 . 2011-10-26 05:21 43520 ----a-w- c:\windows\system32\csrsrv.dll
2011-12-13 23:27 . 2011-10-15 06:31 723456 ----a-w- c:\windows\system32\EncDec.dll
2011-12-13 23:27 . 2011-10-15 05:38 534528 ----a-w- c:\windows\SysWow64\EncDec.dll
2011-12-13 23:27 . 2011-11-05 05:32 2048 ----a-w- c:\windows\system32\tzres.dll
2011-12-13 23:27 . 2011-11-05 04:26 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-12-07 22:41 . 2011-12-07 22:41 -------- d-----w- c:\users\Owner\AppData\Roaming\Individual Software
2011-12-07 22:41 . 2011-12-07 22:41 -------- d-----w- C:\temp
2011-12-07 22:37 . 2011-12-07 22:37 -------- d-----w- c:\programdata\Individual Software
2011-12-07 22:37 . 2000-10-10 15:01 260096 ----a-w- c:\windows\SysWow64\RichTx32.ocx
2011-12-07 22:36 . 2002-08-30 11:28 570128 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\DAO\dao350.dll
2011-12-07 22:36 . 2001-11-10 23:03 1048576 ----a-w- c:\windows\SysWow64\Roboex32.dll
2011-12-07 22:36 . 2001-07-30 23:40 24576 ----a-w- c:\windows\SysWow64\msxml3a.dll
2011-12-07 22:36 . 2011-12-07 22:41 -------- d-----w- c:\program files (x86)\Total 3D Home
2011-12-07 22:36 . 2011-12-07 22:37 -------- d-----w- c:\program files (x86)\Common Files\Individual Software
2011-12-07 22:36 . 2002-08-30 11:29 1355776 ----a-w- c:\windows\SysWow64\Msvbvm50.dll
2011-12-07 22:36 . 1999-03-07 18:33 49376 ----a-w- c:\windows\SysWow64\Twunk_16.exe
2011-12-07 22:36 . 1999-03-07 18:33 61440 ----a-w- c:\windows\SysWow64\twunk_32.exe
2011-12-07 22:36 . 1999-03-07 17:00 102400 ----a-w- c:\windows\SysWow64\Twain_32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-25 15:43 . 2011-03-29 01:36 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-11-15 19:29 . 2010-11-21 03:27 270720 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg "= "c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-09-23 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ToshibaServiceStation "= "c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2011-07-12 1298816]
"ToshibaAppPlace "= "c:\program files (x86)\Toshiba\Toshiba App Place\ToshibaAppPlace.exe" [2010-09-23 552960]
"NortonOnlineBackupReminder "= "c:\program files (x86)\Toshiba\Toshiba Online Backup\Activation\TOBuActivation.exe" [2011-06-22 3218864]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23 136176]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23 136176]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2011-07-12 57216]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2011-06-10 138152]
R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2011-07-01 828856]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1302000.00A\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1302000.00A\SYMEFA64.SYS [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\BASHDefs\20111221.003\BHDrvx64.sys [2011-11-15 1156216]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1302000.00A\ccSetx64.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\Definitions\IPSDefs\20111226.001\IDSvia64.sys [2011-11-24 488568]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1302000.00A\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1302000.00A\SYMNETS.SYS [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]
S2 GFNEXSrv;GFNEX Service;c:\windows\System32\GFNEXSrv.exe [x]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.2.0.10\ccSvcHst.exe [2011-08-10 138760]
S2 Norton PC Checkup Application Launcher;Toshiba Laptop Checkup Application Launcher;c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\SymcPCCULaunchSvc.exe [2011-07-19 123320]
S2 PCCUJobMgr;Common Client Job Manager Service;c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe [2011-07-19 126392]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]
S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2011-05-24 294848]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2010-12-21 2656280]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-11-25 138360]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23 20:16]
.
2011-12-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-09-23 20:16]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2011-04-08 167256]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2011-04-08 391000]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2011-04-08 418136]
"RtHDVCpl "= "c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-07-07 12558440]
"RtHDVBg_Dolby "= "c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-06-03 2226280]
"TosSENotify "= "c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2011-06-10 710560]
"TosVolRegulator "= "c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]
"BbPrintMonitor "= "c:\program files\Common Files\Bluebeam Software\Brewery\V45\Printer Support\BBPrint.exe" [2010-11-30 201376]
"BbInstallUser "= "c:\program files\Bluebeam Software\Pushbutton PDF\Bluebeam Admin User.exe" [2011-10-07 38560]
"Logitech Download Assistant "= "c:\windows\system32\rundll32.exe" [2009-07-14 45568]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs "=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 192.168.1.1 71.243.0.12
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-TSleepSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
Toolbar-Locked - (no file)
HKLM-Run-(Default) - (no file)
HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe
HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe
HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe
HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath "= "\ "c:\program files (x86)\Norton Internet Security\Engine\19.2.0.10\ccSvcHst.exe\" /s \ "NIS\" /m \ "c:\program files (x86)\Norton Internet Security\Engine\19.2.0.10\diMaster.dll\" /prefetch:1 "
--
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCCUJobMgr]
"ImagePath "= "\ "c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\ccSvcHst.exe\" /s \ "PCCUJobMgr\" /m \ "c:\program files (x86)\Norton PC Checkup\Engine\2.0.13.11\diMaster.dll\" /prefetch:1 "
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.10 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2012-01-01 10:32:40 - machine was rebooted
ComboFix-quarantined-files.txt 2012-01-01 15:32
.
Pre-Run: 259,692,552,192 bytes free
Post-Run: 259,754,668,032 bytes free
.
- - End Of File - - 687D00AD148EE9554432FD90768FC49F

 

Sorry, missed "Note 3" in Combofix instructions - all set now. FixTDSS found no infections. New Bootkit log:

Bootkit Remover
(c) 2009 Esage Lab
www.esagelab.com

Program version: 1.2.0.1
OS Version: Microsoft Windows 7 Home Premium Edition Service Pack 1 (build 7601)
, 64-bit

System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000`5dd00000

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Controlled by rootkit!

Boot code on some of your physical disks is hidden by a rootkit.
To disinfect the master boot sector, use the following command:
remover.exe fix <device_name>
To inspect the boot code manually, dump the master boot sector:
remover.exe dump <device_name> [output_file]


Done;
Press any key to quit...

 

The fixmbr command completed sucessfully. The fixboot command issued the message "The volume does not contain a recognized file system. Please make sure that all required file system drivers are loaded and that the volume is not corrupted ". Ran Bootkit Remover and for some strange reason I can't copy and paste into notepad. The log is exactly the same as the last scan log.

 

diskpart:
Microsoft Diskpart version 6.1.7601
Copyright (C) 1999-2008 Microsoft Corporation
On computer: MININT-Q8IVHRV

LIST DISK
Disk ### Status Size Free Dyn Gpt
--------- ---------- ---------- --------- --- ---
Disk 0 Online 298 GB 0 B

Nothing listed with an "*" next to it

 

Disk 0 is now the selected disk

 

Yes, the "*" is now there

 

Partition ### Type Size Offset
Partition 1 Recovery 1500 mb 1024 kb
Partition 2 Primary 282 gb 1501 mb
Partition 3 Primary 14 gb 283 gb

 

no "* "

 

I don't know. This is not my computer, my sister just bought it a little over a month ago and I'm sure she would have no idea.