Inactive Generaly Poor Performance - Possible Virus? Logs Included

[Inactive] Generaly Poor Performance - Possible Virus? Logs Included

Hi all,

I posted in the general Windows 7 forum about an issue I was having with a coworker's laptop. Here is that quick post. I was directed here.

Well, oddly enough, Windows Update and some of the other services that wouldn't run magically started running over the weekend and I was able to get her fully update. SP1 is now installed. I also ran all the requested programs. Here are the logs. Please, if you see anything, let me know!

Overall, she's running OK, although a tad slow, and the battery still won't charge above (supposedly) 34%, although that could actually be hardware.

MBAM
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.05.28.03

Windows 7 x86 NTFS
Internet Explorer 9.0.8112.16421
Administrator :: MARIES-PC [administrator]

5/28/2012 9:10:12 AM
mbam-log-2012-05-28 (09-10-12).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 337714
Time elapsed: 1 hour(s), 47 minute(s), 34 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

GMER
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-05-28 20:59:37
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 TOSHIBA_ rev.FG00
Running: gnsyf9w3.exe; Driver: C:\Users\ADMINI~1\AppData\Local\Temp\kxdiypod.sys


---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!ZwRollbackEnlistment + 1409 82079989 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 820994E2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- Devices - GMER 1.0.15 ----

Device \Driver\ACPI_HAL \Device\00000048 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

aswMBR
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-28 21:04:14
-----------------------------
21:04:14.274 OS Version: Windows 6.1.7601 Service Pack 1
21:04:14.274 Number of processors: 2 586 0x1C0A
21:04:14.290 ComputerName: MARIES-PC UserName:
21:04:15.506 Initialize success
21:07:18.511 AVAST engine defs: 12052800
21:07:36.763 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
21:07:36.778 Disk 0 Vendor: TOSHIBA_ FG00 Size: 238475MB BusType: 3
21:07:36.934 Disk 0 MBR read successfully
21:07:36.950 Disk 0 MBR scan
21:07:37.044 Disk 0 Windows 7 default MBR code
21:07:37.122 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 12291 MB offset 63
21:07:37.387 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 101 MB offset 25173855
21:07:37.574 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 226080 MB offset 25382700
21:07:37.964 Disk 0 scanning sectors +488395120
21:07:38.916 Disk 0 scanning C:\Windows\system32\drivers
21:09:43.809 Service scanning
21:10:21.468 Service MpKsl9bac1880 c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{C80745A0-9F2C-4594-B061-21B21E1A1F93}\MpKsl9bac1880.sys **LOCKED** 32
21:11:11.435 Modules scanning
21:12:57.453 Disk 0 trace - called modules:
21:12:57.546 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll iaStor.sys
21:12:57.562 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8517e848]
21:12:57.577 3 CLASSPNP.SYS[87a5d59e] -> nt!IofCallDriver -> [0x8478c2f8]
21:12:57.593 5 ACPI.sys[872223d4] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x84725028]
21:12:58.576 AVAST engine scan C:\Windows
21:14:17.138 AVAST engine scan C:\Windows\system32
21:25:43.164 AVAST engine scan C:\Windows\system32\drivers
21:26:30.120 AVAST engine scan C:\Users\Administrator
21:27:23.878 AVAST engine scan C:\ProgramData
21:29:56.384 Scan finished successfully
21:40:26.469 Disk 0 MBR has been saved successfully to "C:\Users\Administrator\Desktop\MBR.dat "
21:40:26.500 The log file has been saved successfully to "C:\Users\Administrator\Desktop\aswMBR.txt "

DDS
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421
Run by Administrator at 21:41:02 on 2012-05-28
Microsoft Windows 7 Starter 6.1.7601.1.1252.1.1033.18.1013.353 [GMT -4:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Acer\Acer Updater\UpdaterService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=ao532h&r=27b50110d325l0364ww15w49i2r24r
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=ao532h&r=27b50110d325l0364ww15w49i2r24r
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=ao532h&r=27b50110d325l0364ww15w49i2r24r
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.2
TCP: Interfaces\{AA1629AD-3BA2-4F0C-9440-5D4C499CF67A} : DhcpNameServer = 192.168.1.2
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-3-20 171064]
R1 MpKsl9bac1880;MpKsl9bac1880;c:\programdata\microsoft\microsoft antimalware\definition updates\{c80745a0-9f2c-4594-b061-21b21e1a1f93}\MpKsl9bac1880.sys [2012-5-28 29904]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-13 48128]
R2 Updater Service;Updater Service;c:\program files\acer\acer updater\UpdaterService.exe [2009-11-5 240160]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\drivers\L1C62x86.sys [2009-11-5 54784]
S1 MpKsle435ca6d;MpKsle435ca6d;c:\programdata\microsoft\microsoft antimalware\definition updates\{c80745a0-9f2c-4594-b061-21b21e1a1f93}\MpKsle435ca6d.sys [2012-5-28 29904]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-29 135664]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 EUCR;EUCR;c:\windows\system32\drivers\EUCR6SK.sys [2009-11-5 102784]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-29 135664]
S3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\drivers\NisDrvWFP.sys [2012-3-20 74112]
S3 NisSrv;Microsoft Network Inspection;c:\program files\microsoft security client\NisSrv.exe [2012-3-26 214952]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2012-5-28 52224]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-13 14336]
.
=============== Created Last 30 ================
.
2012-05-28 23:56:32 29904 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{c80745a0-9f2c-4594-b061-21b21e1a1f93}\MpKsl9bac1880.sys
2012-05-28 22:05:44 6737808 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\{c80745a0-9f2c-4594-b061-21b21e1a1f93}\mpengine.dll
2012-05-28 21:54:13 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-05-28 21:54:13 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-05-28 18:12:58 -------- d-----w- c:\windows\system32\SPReview
2012-05-28 18:08:10 606208 ----a-w- c:\windows\system32\wbem\fastprox.dll
2012-05-28 18:08:10 323072 ----a-w- c:\windows\system32\drvstore.dll
2012-05-28 18:08:10 257024 ----a-w- c:\windows\system32\dpx.dll
2012-05-28 18:08:09 780288 ----a-w- c:\windows\system32\wbem\wbemcore.dll
2012-05-28 18:08:09 697344 ----a-w- c:\windows\system32\SmiEngine.dll
2012-05-28 18:08:09 363008 ----a-w- c:\windows\system32\wbemcomn.dll
2012-05-28 18:08:09 351232 ----a-w- c:\windows\system32\wmicmiplugin.dll
2012-05-28 18:08:09 209920 ----a-w- c:\windows\system32\PkgMgr.exe
2012-05-28 18:08:09 189952 ----a-w- c:\windows\system32\wdscore.dll
2012-05-28 18:08:09 189952 ----a-w- c:\windows\system32\sqmapi.dll
2012-05-28 18:08:09 189952 ----a-w- c:\program files\windows portable devices\sqmapi.dll
2012-05-28 17:53:59 453632 ----a-w- c:\windows\system32\vds.exe
2012-05-28 17:52:55 218112 ----a-w- c:\windows\system32\OnLineIDCpl.dll
2012-05-28 17:51:59 732160 ----a-w- c:\windows\system32\imapi2fs.dll
2012-05-28 17:50:59 295936 ----a-w- c:\windows\system32\apphelp.dll
2012-05-28 17:39:48 -------- d-----w- c:\windows\system32\EventProviders
2012-05-28 16:36:41 -------- d-----w- c:\windows\system32\x64
2012-05-28 16:25:33 713784 ------w- c:\programdata\microsoft\microsoft antimalware\definition updates\{ff0f7525-a7c3-45e8-b47a-7c637be23f0f}\gapaengine.dll
2012-05-28 16:24:44 6737808 ----a-w- c:\programdata\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-05-28 16:19:42 -------- d-----w- c:\program files\Microsoft Security Client
2012-05-28 14:22:12 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-05-28 14:22:11 5120 ----a-w- c:\windows\system32\wmi.dll
2012-05-28 14:22:11 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-05-28 14:22:11 159232 ----a-w- c:\windows\system32\imagehlp.dll
2012-05-28 13:53:35 1291632 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-28 13:53:29 936960 ----a-w- c:\program files\common files\microsoft shared\ink\journal.dll
2012-05-28 13:53:00 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-28 13:52:59 3913072 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-28 13:52:57 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-05-28 13:52:55 56176 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-28 13:52:51 1077248 ----a-w- c:\windows\system32\DWrite.dll
2012-05-28 13:45:48 826880 ----a-w- c:\windows\system32\rdpcore.dll
2012-05-28 13:45:48 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-05-28 13:45:47 24576 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-05-28 13:45:47 18432 ----a-w- c:\windows\system32\drivers\tdpipe.sys
2012-05-28 13:45:25 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-05-28 13:09:40 6737808 ------w- c:\programdata\microsoft\windows defender\definition updates\{f7f4ce46-b5a8-4b4a-8917-fa00237bffda}\mpengine.dll
2012-05-27 15:00:24 163048 ----a-w- c:\programdata\microsoft\windows\sqm\manifest\Sqm10141.bin
2012-05-27 14:44:24 -------- d-----w- c:\users\administrator\appdata\local\ElevatedDiagnostics
2012-05-27 14:21:22 476960 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-05-27 14:14:04 -------- d-----w- c:\users\administrator\appdata\local\Apple
2012-05-27 14:13:25 -------- d-----w- c:\users\administrator\appdata\roaming\Malwarebytes
2012-05-27 01:10:17 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-05-27 01:10:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-05-18 13:00:20 -------- d-----w- C:\inetpub
.
==================== Find3M ====================
.
2012-05-28 18:30:02 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-05-27 14:20:28 472864 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-21 00:44:12 74112 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-03-21 00:44:12 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys
.
============= FINISH: 21:42:56.61 ===============

DDS - (ATTACH)
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Starter
Boot Device: \Device\HarddiskVolume2
Install Date: 1/29/2010 3:43:25 PM
System Uptime: 5/28/2012 7:53:56 PM (2 hours ago)
.
Motherboard: Acer | | AO532h
Processor: Intel(R) Atom(TM) CPU N450 @ 1.66GHz | CPU | 999/667mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 221 GiB total, 197.879 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: WAN Miniport (L2TP)
Device ID: ROOT\MS_L2TPMINIPORT\0000
Manufacturer: Microsoft
Name: WAN Miniport (L2TP)
PNP Device ID: ROOT\MS_L2TPMINIPORT\0000
Service: Rasl2tp
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: WAN Miniport (Network Monitor)
Device ID: ROOT\MS_NDISWANBH\0000
Manufacturer: Microsoft
Name: WAN Miniport (Network Monitor)
PNP Device ID: ROOT\MS_NDISWANBH\0000
Service: NdisWan
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: WAN Miniport (IP)
Device ID: ROOT\MS_NDISWANIP\0000
Manufacturer: Microsoft
Name: WAN Miniport (IP)
PNP Device ID: ROOT\MS_NDISWANIP\0000
Service: NdisWan
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: WAN Miniport (IPv6)
Device ID: ROOT\MS_NDISWANIPV6\0000
Manufacturer: Microsoft
Name: WAN Miniport (IPv6)
PNP Device ID: ROOT\MS_NDISWANIPV6\0000
Service: NdisWan
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: WAN Miniport (PPPOE)
Device ID: ROOT\MS_PPPOEMINIPORT\0000
Manufacturer: Microsoft
Name: WAN Miniport (PPPOE)
PNP Device ID: ROOT\MS_PPPOEMINIPORT\0000
Service: RasPppoe
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: WAN Miniport (PPTP)
Device ID: ROOT\MS_PPTPMINIPORT\0000
Manufacturer: Microsoft
Name: WAN Miniport (PPTP)
PNP Device ID: ROOT\MS_PPTPMINIPORT\0000
Service: PptpMiniport
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: MpKsle435ca6d
Device ID: ROOT\LEGACY_MPKSLE435CA6D\0000
Manufacturer:
Name: MpKsle435ca6d
PNP Device ID: ROOT\LEGACY_MPKSLE435CA6D\0000
Service: MpKsle435ca6d
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft Teredo Tunneling Adapter
Device ID: ROOT\*TEREDO\0001
Manufacturer: Microsoft
Name: Teredo Tunneling Pseudo-Interface
PNP Device ID: ROOT\*TEREDO\0001
Service: tunnel
.
==== System Restore Points ===================
.
RP314: 5/28/2012 1:40:51 PM - Windows 7 Service Pack 1
RP315: 5/28/2012 2:11:26 PM - Windows Update
RP316: 5/28/2012 6:04:33 PM - Windows Update
RP317: 5/28/2012 6:20:56 PM - Windows Update
.
==== Installed Programs ======================
.
Acer Crystal Eye Webcam
Acer Updater
Adobe Flash Player 10 ActiveX
Adobe Reader 9.3.3 MUI
ALPS Touch Pad Driver
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
Bonjour
Canon MX320 series MP Drivers
Google Toolbar for Internet Explorer
Google Update Helper
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
iTunes
Java Auto Updater
Java(TM) 6 Update 32
Malwarebytes Anti-Malware version 1.61.0.1400
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works
OGA Notifier 2.0.0048.0
QuickTime
RealPlayer
Realtek High Definition Audio Driver
RealUpgrade 1.0
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Yahoo! Messenger
.
==== Event Viewer Messages From Past Week ========
.
5/28/2012 9:39:51 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80246007: Microsoft Office Compatibility Pack Service Pack 3 (SP3).
5/28/2012 7:55:03 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: cdrom
5/28/2012 6:18:00 PM, Error: Service Control Manager [7022] - The Windows Search service hung on starting.
5/28/2012 6:10:55 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070308: Security Update for Microsoft .NET Framework 3.5.1 on Windows 7 SP1 x86 (KB2604115).
5/28/2012 12:31:17 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.127.889.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8403.0 Error code: 0x80240016 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
5/28/2012 12:31:17 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.127.889.0 Update Source: Microsoft Update Server Update Stage: Install Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8403.0 Error code: 0x80240016 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
5/28/2012 12:31:17 PM, Error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.127.889.0 Update Source: Microsoft Update Server Update Stage: Download Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.8403.0 Error code: 0x80240016 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
5/28/2012 12:28:46 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070002: Windows 7 Service Pack 1 (KB976932).
5/28/2012 1:46:04 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Windows 7 Service Pack 1 (KB976932).
5/28/2012 1:12:34 PM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a preshutdown control.
5/27/2012 9:59:54 AM, Error: Service Control Manager [7031] - The Windows Event Log service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
5/27/2012 9:58:53 AM, Error: Service Control Manager [7031] - The Windows Event Log service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
5/27/2012 9:58:52 AM, Error: Service Control Manager [7023] - The IP Helper service terminated with the following error: The service has not been started.
5/27/2012 9:58:51 AM, Error: Service Control Manager [7024] - The Bonjour Service service terminated with service-specific error A system call has failed..
5/27/2012 9:58:51 AM, Error: Service Control Manager [7023] - The IKE and AuthIP IPsec Keying Modules service terminated with the following error: A specified authentication package is unknown.
5/27/2012 9:58:49 AM, Error: Service Control Manager [7024] - The Windows Firewall service terminated with service-specific error The parameter is incorrect..
5/27/2012 9:58:49 AM, Error: Service Control Manager [7022] - The TCP/IP NetBIOS Helper service hung on starting.
5/27/2012 9:58:49 AM, Error: Service Control Manager [7001] - The Task Scheduler service depends on the Windows Event Log service which failed to start because of the following error: The authentication service is unknown.
5/27/2012 9:58:46 AM, Error: Service Control Manager [7022] - The DHCP Client service hung on starting.
5/27/2012 9:57:25 AM, Error: Service Control Manager [7023] - The WLAN AutoConfig service terminated with the following error: The authentication service is unknown.
5/27/2012 9:57:24 AM, Error: Microsoft-Windows-WLAN-AutoConfig [4002] - WLAN AutoConfig service has failed to start. Error Code: 1747
5/27/2012 9:57:23 AM, Error: Service Control Manager [7023] - The DNS Client service terminated with the following error: A system call has failed.
5/27/2012 9:57:22 AM, Error: Service Control Manager [7022] - The System Event Notification Service service hung on starting.
5/27/2012 9:54:27 AM, Error: Service Control Manager [7034] - The Windows Event Log service terminated unexpectedly. It has done this 5 time(s).
5/27/2012 9:54:24 AM, Error: Service Control Manager [7023] - The Windows Time service terminated with the following error: A system call has failed.
5/27/2012 9:54:24 AM, Error: Microsoft-Windows-Time-Service [46] - The time service encountered an error and was forced to shut down. The error was: 0x8007277B: A system call has failed.
5/27/2012 9:52:48 AM, Error: Service Control Manager [7034] - The Windows Event Log service terminated unexpectedly. It has done this 4 time(s).
5/27/2012 11:53:23 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
5/27/2012 11:53:23 AM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535.
5/27/2012 11:25:59 AM, Error: Service Control Manager [7034] - The Kaspersky Anti-Virus Service service terminated unexpectedly. It has done this 1 time(s).
5/27/2012 10:03:57 AM, Error: Service Control Manager [7000] - The GRegService service failed to start due to the following error: The system cannot find the file specified.
5/27/2012 10:01:54 AM, Error: Service Control Manager [7034] - The Windows Event Log service terminated unexpectedly. It has done this 3 time(s).
5/27/2012 10:01:54 AM, Error: Service Control Manager [7023] - The Windows Event Log service terminated with the following error: The authentication service is unknown.
5/27/2012 10:01:34 AM, Error: Service Control Manager [7024] - The Network Location Awareness service terminated with service-specific error %%-1073741502.
5/27/2012 10:01:33 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The service has not been started.
5/27/2012 10:01:33 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The operation completed successfully.
5/27/2012 10:01:04 AM, Error: Microsoft-Windows-Directory-Services-SAM [12291] - SAM failed to start the TCP/IP or SPX/IPX listening thread
5/27/2012 10:00:57 AM, Error: Service Control Manager [7023] - The Windows Update service terminated with the following error: %%-2147012892
5/27/2012 10:00:53 AM, Error: Service Control Manager [7024] - The Background Intelligent Transfer Service service terminated with service-specific error %%-2147014789.
5/27/2012 10:00:53 AM, Error: Microsoft-Windows-Bits-Client [16392] - The BITS service failed to start. Error 0x8007277B.
.
==== End Of File ===========================

Thanks, everyone!

 

OK, here you go!

COMBOFIX LOG:
ComboFix 12-05-30.02 - Billy 05/30/2012 9:25.1.2 - x86
Microsoft Windows 7 Starter 6.1.7601.1.1252.1.1033.18.1013.457 [GMT -4:00]
Running from: c:\users\Billy\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2012-04-28 to 2012-05-30 )))))))))))))))))))))))))))))))
.
.
2012-05-30 13:41 . 2012-05-30 13:41 -------- d-----w- c:\users\Renee\AppData\Local\temp
2012-05-29 15:54 . 2012-05-29 15:54 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-28 21:54 . 2012-01-25 05:32 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-05-28 21:54 . 2012-01-25 05:32 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-05-28 18:12 . 2012-05-28 18:12 -------- d-----w- c:\windows\system32\SPReview
2012-05-28 18:08 . 2010-11-20 12:19 606208 ----a-w- c:\windows\system32\wbem\fastprox.dll
2012-05-28 18:08 . 2010-11-20 12:18 323072 ----a-w- c:\windows\system32\drvstore.dll
2012-05-28 18:08 . 2010-11-20 12:18 257024 ----a-w- c:\windows\system32\dpx.dll
2012-05-28 18:08 . 2010-11-20 12:21 351232 ----a-w- c:\windows\system32\wmicmiplugin.dll
2012-05-28 18:08 . 2010-11-20 12:21 189952 ----a-w- c:\windows\system32\wdscore.dll
2012-05-28 18:08 . 2010-11-20 12:21 780288 ----a-w- c:\windows\system32\wbem\wbemcore.dll
2012-05-28 18:08 . 2010-11-20 12:21 363008 ----a-w- c:\windows\system32\wbemcomn.dll
2012-05-28 18:08 . 2010-11-20 12:21 189952 ----a-w- c:\windows\system32\sqmapi.dll
2012-05-28 18:08 . 2010-11-20 12:21 189952 ----a-w- c:\program files\Windows Portable Devices\sqmapi.dll
2012-05-28 18:08 . 2010-11-20 12:21 697344 ----a-w- c:\windows\system32\SmiEngine.dll
2012-05-28 18:08 . 2010-11-20 12:17 209920 ----a-w- c:\windows\system32\PkgMgr.exe
2012-05-28 17:53 . 2010-11-20 12:21 151040 ----a-w- c:\windows\system32\vdsutil.dll
2012-05-28 17:52 . 2010-11-20 12:20 218112 ----a-w- c:\windows\system32\OnLineIDCpl.dll
2012-05-28 17:51 . 2010-11-20 12:19 732160 ----a-w- c:\windows\system32\imapi2fs.dll
2012-05-28 17:50 . 2010-11-20 12:21 152064 ----a-w- c:\windows\system32\SmartcardCredentialProvider.dll
2012-05-28 17:39 . 2012-05-28 17:39 -------- d-----w- c:\windows\system32\EventProviders
2012-05-28 16:36 . 2012-05-28 16:36 -------- d-----w- c:\windows\system32\x64
2012-05-28 14:22 . 2012-03-01 05:46 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-05-28 14:22 . 2012-03-01 05:37 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-05-28 14:22 . 2012-03-01 05:33 159232 ----a-w- c:\windows\system32\imagehlp.dll
2012-05-28 14:22 . 2012-03-01 05:29 5120 ----a-w- c:\windows\system32\wmi.dll
2012-05-28 13:53 . 2012-03-30 10:23 1291632 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-05-28 13:53 . 2012-03-31 04:29 936960 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-28 13:53 . 2012-03-31 04:39 3968368 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-05-28 13:52 . 2012-03-31 04:39 3913072 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-05-28 13:52 . 2012-03-31 02:36 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-05-28 13:52 . 2012-03-17 07:27 56176 ----a-w- c:\windows\system32\drivers\partmgr.sys
2012-05-28 13:52 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\system32\DWrite.dll
2012-05-28 13:45 . 2012-02-17 05:34 826880 ----a-w- c:\windows\system32\rdpcore.dll
2012-05-28 13:45 . 2012-02-17 04:14 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-05-28 13:45 . 2012-02-17 04:13 24576 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-05-28 13:45 . 2010-11-20 10:21 18432 ----a-w- c:\windows\system32\drivers\tdpipe.sys
2012-05-28 13:45 . 2012-01-25 05:27 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-05-28 13:09 . 2012-05-15 05:43 6737808 ------w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F7F4CE46-B5A8-4B4A-8917-FA00237BFFDA}\mpengine.dll
2012-05-27 15:00 . 2012-05-27 15:00 163048 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin
2012-05-27 14:32 . 2012-05-27 14:32 -------- d-----w- c:\program files\Common Files\Java
2012-05-27 14:21 . 2012-05-27 14:20 476960 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-05-27 14:07 . 2012-05-27 14:08 -------- d-----w- c:\users\Administrator
2012-05-27 01:10 . 2012-04-04 19:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-05-27 01:10 . 2012-05-27 01:10 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-05-18 13:00 . 2012-05-18 13:04 -------- d-----w- C:\inetpub
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-29 15:54 . 2011-07-29 18:08 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-28 18:30 . 2009-07-14 02:05 152576 ----a-w- c:\windows\system32\msclmd.dll
2012-05-27 14:20 . 2011-05-15 22:53 472864 ----a-w- c:\windows\system32\deployJava1.dll
2012-03-12 15:42 . 2012-03-12 15:42 86528 ----a-w- c:\windows\system32\iesysprep.dll
2012-03-12 15:42 . 2012-03-12 15:42 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-03-12 15:42 . 2012-03-12 15:42 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-03-12 15:42 . 2012-03-12 15:42 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-03-12 15:42 . 2012-03-12 15:42 161792 ----a-w- c:\windows\system32\msls31.dll
2012-03-12 15:42 . 2012-03-12 15:42 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-03-12 15:42 . 2012-03-12 15:42 63488 ----a-w- c:\windows\system32\tdc.ocx
2012-03-12 15:42 . 2012-03-12 15:42 74752 ----a-w- c:\windows\system32\iesetup.dll
2012-03-12 15:42 . 2012-03-12 15:42 420864 ----a-w- c:\windows\system32\vbscript.dll
2012-03-12 15:42 . 2012-03-12 15:42 367104 ----a-w- c:\windows\system32\html.iec
2012-03-12 15:42 . 2012-03-12 15:42 35840 ----a-w- c:\windows\system32\imgutil.dll
2012-03-12 15:42 . 2012-03-12 15:42 23552 ----a-w- c:\windows\system32\licmgr10.dll
2012-03-12 15:42 . 2012-03-12 15:42 152064 ----a-w- c:\windows\system32\wextract.exe
2012-03-12 15:42 . 2012-03-12 15:42 150528 ----a-w- c:\windows\system32\iexpress.exe
2012-03-12 15:42 . 2012-03-12 15:42 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-03-12 15:42 . 2012-03-12 15:42 11776 ----a-w- c:\windows\system32\mshta.exe
2012-03-12 15:42 . 2012-03-12 15:42 101888 ----a-w- c:\windows\system32\admparse.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!) "= "c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2011-06-16 6276408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif "= "c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl "= "c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-12 7707168]
"Apoint "= "c:\program files\Apoint2K\Apoint.exe" [2009-10-08 233472]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-10-03 202256]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2011-01-25 421160]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2010-10-25 141848]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2010-10-25 173592]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2010-10-25 150552]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 0 (0x0)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableLUA "= 0 (0x0)
"EnableUIADesktopToggle "= 0 (0x0)
"PromptOnSecureDesktop "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-01-25 20:08 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PLFSetI]
2009-08-13 00:20 200704 ----a-w- c:\windows\PLFSetI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2012-01-18 18:02 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 135664]
R3 dc3d;MS Hardware Device Detection Driver (HID);c:\windows\system32\DRIVERS\dc3d.sys [2010-04-17 22416]
R3 EUCR;EUCR;c:\windows\system32\DRIVERS\EUCR6SK.SYS [2009-10-09 102784]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 135664]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [2009-09-04 54784]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-29 15:54]
.
2012-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 01:46]
.
2012-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 01:46]
.
.
------- Supplementary Scan -------
.
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0409&m=ao532h&r=27b50110d325l0364ww15w49i2r24r
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: DhcpNameServer = 4.2.2.2
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
MSConfigStartUp-Acer Assist Launcher - c:\program files\Acer\Acer Assist\launcher.exe
MSConfigStartUp-msnmsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
MSConfigStartUp-uTorrent - c:\program files\uTorrent\uTorrent.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-05-30 09:47:14
ComboFix-quarantined-files.txt 2012-05-30 13:47
.
Pre-Run: 211,799,990,272 bytes free
Post-Run: 212,006,277,120 bytes free
.
- - End Of File - - 513525506FF54D8ABF53FEAA9697DDA3

RKILL LOG:
This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 05/30/2012 at 9:56:43.
Operating System: Windows 7 Starter

Processes terminated by Rkill or while it was running:

Rkill completed on 05/30/2012 at 9:56:53.


Certainly seems clean... Still running OK. Waddya think?

 

OK, thanks!