Inactive Malware Problems!

ComboFix log

I did read that note, but when ComboFix was finished it restarted the machine. And since the screen I saw was a bit different than the pics I had seen I was a little confused and went to the fall back of "if unsure or have questions, ask before continuing.... But, thanks.. we learn as we do...

So here is the ComboFix log:

_________________________________________________________________

ComboFix 12-04-07.02 - mikw 04/07/2012 12:22:04.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.2811.1830 [GMT -4:00]
Running from: c:\users\mikw\Desktop\ComboFix.exe
AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Security Suite *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Security Suite *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
G:\Setup.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-03-07 to 2012-04-07 )))))))))))))))))))))))))))))))
.
.
2012-04-06 21:24 . 2012-04-06 21:24 29808 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2012-04-04 18:17 . 2012-04-04 18:17 8738464 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2012-04-04 16:04 . 2012-04-04 18:17 418464 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-03-26 00:55 . 2011-12-23 03:09 25224 ----a-w- c:\windows\system32\fbnative.exe
2012-03-25 19:05 . 2012-03-25 19:05 -------- d-----w- c:\users\mikw\AppData\Local\XPS2OneNote
2012-03-25 18:58 . 2012-03-25 18:58 -------- d-----w- c:\program files (x86)\CodePlex
2012-03-22 17:28 . 2012-03-22 17:54 -------- d-----w- c:\program files (x86)\Wise PC Engineer
2012-03-22 12:50 . 2012-03-22 12:50 -------- d-----w- c:\windows\system32\drivers\NBRTWizardx64
2012-03-22 12:50 . 2012-03-22 12:50 -------- d-----w- c:\program files (x86)\Norton Bootable Recovery Tool Wizard
2012-03-20 01:05 . 2012-03-21 13:37 -------- d-----r- c:\program files (x86)\Skype
2012-03-20 01:05 . 2012-03-20 01:05 -------- d-----w- c:\program files (x86)\Common Files\Skype
2012-03-20 01:05 . 2012-03-20 01:05 -------- d-----w- c:\programdata\Skype
2012-03-19 22:21 . 2012-03-19 22:21 -------- d-----w- c:\users\mikw\AppData\Roaming\Motive
2012-03-19 22:21 . 2012-03-19 22:21 -------- d-----w- c:\program files\Comcast
2012-03-19 22:21 . 2012-03-19 22:21 -------- d-----w- c:\program files (x86)\Comcast
2012-03-19 22:19 . 2012-03-19 22:21 -------- d-----w- c:\program files (x86)\Common Files\Motive
2012-03-19 22:19 . 2012-03-19 22:21 -------- d-----w- c:\program files\Common Files\Motive
2012-03-19 20:55 . 2012-03-19 22:26 -------- d-----w- c:\programdata\Motive
2012-03-19 17:32 . 2012-03-22 17:55 -------- d-----w- c:\users\mikw\AppData\Roaming\Wise Disk Cleaner
2012-03-19 17:31 . 2012-03-19 17:31 -------- d-----w- c:\program files (x86)\Wise Disk Cleaner
2012-03-19 17:20 . 2012-03-19 17:30 -------- d-----w- c:\users\mikw\AppData\Roaming\Wise Registry Cleaner
2012-03-19 17:16 . 2012-03-19 17:16 -------- d-----w- c:\program files (x86)\Wise Registry Cleaner
2012-03-19 15:10 . 2012-03-19 15:59 1656 ----a-w- c:\windows\system32\ASOROSet.bin
2012-03-19 15:04 . 2012-03-19 15:28 -------- d-----w- c:\users\mikw\AppData\Roaming\SpeedMaxPc
2012-03-19 15:04 . 2012-03-19 15:04 -------- d-----w- c:\users\mikw\AppData\Roaming\DriverCure
2012-03-19 15:03 . 2012-03-19 15:28 -------- d-----w- c:\programdata\SpeedMaxPc
2012-03-19 14:35 . 2012-03-19 14:35 -------- d-----w- c:\users\mikw\AppData\Roaming\Systweak
2012-03-19 14:35 . 2012-02-24 20:43 18816 ----a-w- c:\windows\system32\roboot64.exe
2012-03-19 01:56 . 2012-03-19 01:56 -------- d-----w- c:\users\mikw\AppData\Roaming\VS Revo Group
2012-03-18 00:17 . 2012-03-18 00:39 -------- d-----w- c:\users\mikw\AppData\Local\NPE
2012-03-18 00:11 . 2012-03-18 00:11 -------- d-----w- c:\users\mikw\AppData\Local\Symantec
2012-03-17 05:32 . 2012-03-17 15:34 -------- d-----w- c:\windows\system32\drivers\N360x64\0502000.00D
2012-03-17 05:32 . 2012-03-17 05:32 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared
2012-03-17 03:06 . 2012-03-17 03:10 174200 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2012-03-17 03:06 . 2012-03-17 03:10 -------- d-----w- c:\program files\Symantec
2012-03-17 03:05 . 2012-03-17 03:05 -------- d-----w- c:\program files (x86)\Norton Security Suite
2012-03-17 03:05 . 2012-03-22 12:50 -------- d-----w- c:\program files (x86)\NortonInstaller
2012-03-17 02:09 . 2012-03-17 02:09 -------- d-----w- c:\users\mikw\AppData\Roaming\f-secure
2012-03-17 02:08 . 2012-03-17 02:08 -------- d-----w- c:\programdata\F-Secure
2012-03-16 20:22 . 2012-03-22 13:15 -------- d-----w- c:\programdata\Norton
2012-03-16 17:14 . 2012-03-01 18:21 8643640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3394C38E-1E5A-47C1-BBA1-89A5B04B62B6}\mpengine.dll
2012-03-16 12:33 . 2012-03-19 17:02 -------- d-----w- c:\users\Crystal\AppData\Roaming\Clipdiary
2012-03-16 11:11 . 2012-03-16 11:12 -------- d-----w- c:\program files (x86)\xfin_portal
2012-03-15 20:37 . 2012-03-15 20:37 -------- d-----w- c:\users\mikw\AppData\Roaming\Tific
2012-03-15 20:30 . 2012-03-15 20:30 -------- d-----w- c:\program files (x86)\Microsoft Office OneNote 2007 PowerToys
2012-03-15 18:55 . 2012-03-16 04:27 -------- d-----w- c:\programdata\WeCareReminder
2012-03-14 14:38 . 2012-03-14 21:42 -------- d-----w- c:\users\mikw\AppData\Local\LogMeIn Rescue Applet
2012-03-14 10:51 . 2011-11-19 15:20 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-14 10:51 . 2011-11-19 14:50 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-14 10:51 . 2011-11-19 14:50 3913584 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-14 10:46 . 2012-02-03 04:34 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-03-14 10:46 . 2012-02-10 06:36 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-03-14 10:46 . 2012-02-10 05:38 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-03-14 10:46 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-03-14 10:46 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-03-14 10:46 . 2012-01-25 06:33 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
2012-03-14 10:45 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-03-14 10:45 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-03-14 10:45 . 2012-02-17 04:58 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-03-14 10:45 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-03-13 18:08 . 2012-03-13 18:08 -------- d-----w- c:\program files (x86)\SlimDrivers
2012-03-12 03:10 . 2012-03-12 03:10 -------- d-----w- c:\program files (x86)\Easy Audio Mp3 Wma Ogg Cutter
2012-03-12 03:08 . 2011-09-28 13:20 200704 ----a-w- c:\windows\SysWow64\vbalExpBar6.ocx
2012-03-12 03:08 . 2012-03-12 03:08 -------- d-----w- c:\program files (x86)\Free Easy CD DVD Burner
2012-03-12 03:08 . 2012-03-12 03:08 -------- d-----w- c:\users\mikw\AppData\Roaming\FreeBurner
2012-03-12 03:08 . 2011-09-29 18:20 484352 ----a-w- c:\windows\SysWow64\lame_enc.dll
2012-03-12 03:08 . 2011-09-28 13:20 40960 ----a-w- c:\windows\SysWow64\SSubTmr6.dll
2012-03-12 03:08 . 2011-09-28 13:20 32768 ----a-w- c:\windows\SysWow64\CMDLGFR.DLL
2012-03-12 03:08 . 2011-09-28 13:20 15360 ----a-w- c:\windows\SysWow64\inetfr.DLL
2012-03-12 03:08 . 2011-09-28 13:20 141312 ----a-w- c:\windows\SysWow64\MSCMCFR.DLL
2012-03-12 03:08 . 2011-09-28 13:20 119568 ----a-w- c:\windows\SysWow64\VB6FR.DLL
2012-03-12 03:08 . 2011-09-28 13:20 115920 ----a-w- c:\windows\SysWow64\msinet.OCX
2012-03-12 03:08 . 2011-09-28 13:20 101888 ----a-w- c:\windows\SysWow64\VB6STKIT.DLL
2012-03-12 02:07 . 2012-03-20 21:20 -------- d-----w- C:\DVD Burning Temp Space
2012-03-11 15:39 . 2012-03-11 16:01 -------- d-----w- c:\programdata\Freemake
2012-03-11 15:39 . 2012-03-11 15:39 -------- d-----w- c:\program files (x86)\Freemake
2012-03-11 15:29 . 2012-03-11 15:29 -------- d-----w- c:\program files (x86)\Common Files\Solveig Multimedia
2012-03-11 15:29 . 2012-03-11 15:29 -------- d-----w- c:\program files (x86)\Solveig Multimedia
2012-03-11 15:21 . 2012-03-11 15:21 -------- d-----w- c:\program files (x86)\AVIedit
2012-03-11 12:57 . 2012-03-12 03:06 -------- d-----w- c:\users\mikw\AppData\Roaming\FreeVideoConverter
2012-03-11 12:57 . 2012-03-11 12:57 -------- d-----w- c:\program files (x86)\Free Video Converter
2012-03-11 12:37 . 2012-03-11 14:31 -------- d-----w- c:\users\mikw\AppData\Roaming\Winff
2012-03-11 12:35 . 2012-03-11 12:35 -------- d-----w- c:\users\mikw\AppData\Local\APN
2012-03-11 12:34 . 2012-03-11 12:34 -------- d-----w- c:\users\mikw\AppData\Roaming\WeatherBug
2012-03-11 12:32 . 2012-03-11 12:32 -------- d-----w- c:\program files (x86)\WinFF
2012-03-11 05:34 . 2012-03-11 05:34 -------- d-----w- c:\program files (x86)\AnvSoft
2012-03-11 01:12 . 2012-03-11 01:12 -------- d-----w- c:\users\mikw\AppData\Roaming\AnvSoft
2012-03-11 00:39 . 2012-03-11 00:39 -------- d-----w- c:\programdata\PIXELA
2012-03-11 00:35 . 2012-03-11 00:35 -------- d-----w- c:\program files (x86)\Digital Photo Navigator 1.5
2012-03-11 00:35 . 2001-09-05 08:18 225280 ------w- c:\program files (x86)\Common Files\InstallShield\IScript\iscript.dll
2012-03-11 00:35 . 2001-09-05 08:18 77824 ----a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2012-03-11 00:35 . 2001-09-05 08:14 176128 ------w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2012-03-11 00:35 . 2001-09-05 08:13 32768 ------w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2012-03-09 12:15 . 2012-03-09 12:15 -------- d-----w- c:\program files\Free Opener
2012-03-09 12:14 . 2012-03-09 16:53 -------- d-----w- c:\programdata\Yahoo!
2012-03-09 12:14 . 2012-03-09 16:52 -------- d-----w- c:\program files (x86)\Yahoo!
2012-03-09 11:11 . 2012-03-09 11:11 -------- d-----w- c:\program files (x86)\ADLSoft UnCompressor
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-07 19:47 . 2012-01-14 17:46 13920 ----a-w- c:\windows\system32\drivers\SWDUMon.sys
2012-04-04 18:17 . 2011-09-20 22:37 70304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-24 02:31 . 2012-02-24 02:31 750488 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-02-24 02:31 . 2010-07-11 05:29 660368 ----a-w- c:\windows\system32\deployJava1.dll
2012-02-23 13:18 . 2011-09-20 02:35 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-17 14:00 . 2012-02-17 14:00 637848 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2012-02-17 14:00 . 2010-07-11 05:29 567696 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-02-08 19:48 . 2011-09-20 16:18 48264 ----a-w- c:\windows\system32\drivers\EUBKMON.sys
2012-02-04 14:57 . 2011-03-28 23:36 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-01-26 01:23 . 2012-01-26 01:24 147752 ----a-w- c:\windows\system32\SynTPCo4.dll
2012-01-25 23:56 . 2012-02-17 03:39 54728 ----a-w- c:\windows\system32\drivers\Soluto.sys
2012-01-12 00:19 . 2012-01-12 00:19 4448256 ----a-w- c:\windows\SysWow64\GPhotos.scr
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\mikw\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\mikw\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\mikw\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@= "{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 94208 ----a-w- c:\users\mikw\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Clipdiary "= "c:\program files (x86)\Clipdiary\clipdiary.exe" [2011-07-06 4572160]
"RoboForm "= "c:\program files (x86)\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2012-03-22 108136]
"MusicManager "= "c:\users\mikw\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [2012-02-21 13320704]
"Skype "= "c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552]
"ComcastAntispyClient "= "c:\program files (x86)\comcasttb\ComcastSpywareScan\ComcastAntispy.exe" [2009-08-19 1589208]
"HPAdvisorDock "= "c:\program files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe" [2010-02-10 1712184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HP Quick Launch "= "c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-11-09 586296]
"Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
c:\users\mikw\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
XPS2OneNote.lnk - c:\users\mikw\AppData\Roaming\Microsoft\Installer\{6DD7A9DA-6732-47D2-8362-6A12BD0EA053}\_FBB2488C0F33C1DFE6AC1F.exe [2012-3-25 10134]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@= "Service "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SolutoService]
@= "Service "
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"EaseUs Tray "= "c:\program files (x86)\EaseUS\Todo Backup\bin\TrayNotify.exe "
"HP Software Update "=c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe
"StartCCC "= "c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"DivXUpdate "= "c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"SunJavaUpdateSched "= "c:\program files (x86)\Common Files\Java\Java Update\jusched.exe "
"SearchSettings "= "c:\program files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe "
"Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [2011-09-09 86072]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-06-18 103992]
R2 RtVOsdService;RtVOsdService Installer;c:\program files\Realtek\RtVOsd\RtVOsdService.exe [2010-06-24 315392]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
R2 vToolbarUpdater;vToolbarUpdater; [x]
R3 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 253600]
R3 CinemaNow Service;CinemaNow Service;c:\program files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe [2010-05-21 140272]
R3 EaseUS Agent;EaseUS Agent;c:\program files (x86)\EaseUS\Todo Backup\bin\Agent.exe [2011-12-23 61064]
R3 EUBAKUP0;EUBAKUP0; [x]
R3 EUBKMON0;EUBKMON0; [x]
R3 EUFDDISK0;EUFDDISK0; [x]
R3 Guard Agent;Guard Agent;c:\program files (x86)\EaseUS\Todo Backup\bin\GuardAgent.exe [2011-12-23 23176]
R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [x]
R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 EUBAKUP;EUBAKUP;c:\windows\system32\drivers\eubakup.sys [x]
S0 EUBKMON;EUBKMON;c:\windows\system32\drivers\EUBKMON.sys [x]
S0 Soluto;Soluto;c:\windows\system32\DRIVERS\Soluto.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\0502000.00D\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\0502000.00D\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20120317.002\BHDrvx64.sys [2012-03-02 1157240]
S1 EUDSKACS;EUDSKACS;c:\windows\system32\drivers\eudskacs.sys [x]
S1 EUFDDISK;EUFDDISK;c:\windows\system32\drivers\EuFdDisk.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20120406.002\IDSvia64.sys [2012-03-17 488568]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\0502000.00D\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\0502000.00D\SYMNETS.SYS [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiSpywareService;Comcast AntiSpyware;c:\program files (x86)\comcasttb\ComcastSpywareScan\ComcastAntiSpyService.exe [2009-06-17 616408]
S2 Freemake Improver;Freemake Improver;c:\programdata\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [2012-03-12 82944]
S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-03-28 94264]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-09 26680]
S2 N360;Norton Security Suite;c:\program files (x86)\Norton Security Suite\Engine\5.2.0.13\ccSvcHst.exe [2011-04-17 130008]
S2 pcCMService;pcCMService;c:\program files (x86)\Common Files\Motive\pcCMService.exe [2012-01-18 361472]
S2 pcCMService64;pcCMService64;c:\program files\Common Files\Motive\pcCMService.exe [2012-01-18 441344]
S2 SolutoService;Soluto PCGenome Core Service;c:\program files\Soluto\SolutoService.exe [2012-01-26 547872]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 cpuz135;cpuz135;c:\windows\TEMP\cpuz135\cpuz135_x64.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-03-18 138360]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2010-05-19 18:36 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 18:17]
.
2012-04-07 c:\windows\Tasks\GlaryInitialize.job
- c:\program files (x86)\Glary Utilities\initialize.exe [2012-02-20 03:31]
.
2012-04-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4075119198-2154832473-4072255513-1000Core.job
- c:\users\mikw\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-27 19:58]
.
2012-04-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4075119198-2154832473-4072255513-1000UA.job
- c:\users\mikw\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-27 19:58]
.
2012-04-07 c:\windows\Tasks\HPCeeScheduleFormikw.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 03:15]
.
2012-04-07 c:\windows\Tasks\RegistryBooster.job
- c:\program files (x86)\Uniblue\RegistryBooster\rbmonitor.exe [2011-12-06 08:26]
.
2012-04-07 c:\windows\Tasks\SlimDrivers Startup.job
- c:\program files (x86)\SlimDrivers\SlimDrivers.exe [2012-03-07 19:17]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\mikw\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\mikw\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\mikw\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@= "{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-02-14 22:58 97792 ----a-w- c:\users\mikw\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPWirelessAssistant "= "c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-06-18 8192]
"RTHDVCPL "= "c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-09-30 6489704]
"Comcast_McciTrayApp "= "c:\program files\Comcast\pcTrayApp.exe" [2012-01-18 2727936]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs "=0x1
.
------- Supplementary Scan -------
.
uStart Page = hxxp://comcast.net/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Clear Fields - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComClearFields.html
IE: Customize Menu - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Logoff - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComLogoff.html
IE: Password Generator - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComPasswordGenerator.html
IE: Reset Fields - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComResetFields.html
IE: RoboForm Editor - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComEditIdent.html
IE: RoboForm Options - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComOptions.html
IE: RoboForm TaskBar Icon - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComTaskBarIcon.html
IE: Save Forms - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: Set Fields - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSetFields.html
IE: Show RoboForm Toolbar - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Sync RoboForm Data - file://c:\program files (x86)\Siber Systems\AI RoboForm\RoboFormComSync.html
IE: {{320AF880-6646-11D3-ABEE-C5DBF3571F4D} - {320AF880-6646-11D3-ABEE-C5DBF3571F4D} - c:\program files (x86)\Siber Systems\AI RoboForm\roboform.dll
IE: {{320AF880-6646-11D3-ABEE-C5DBF3571F4E} - {320AF880-6646-11D3-ABEE-C5DBF3571F4E} - c:\program files (x86)\Siber Systems\AI RoboForm\roboform.dll
TCP: DhcpNameServer = 75.75.76.76 75.75.75.75
FF - ProfilePath - c:\users\mikw\AppData\Roaming\Mozilla\Firefox\Profiles\wzmzvzyo.default\
FF - prefs.js: browser.startup.homepage - hxxp://xfinity.comcast.net/?cid=mtmh03222012
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
Toolbar-10 - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\N360]
"ImagePath "= "\ "c:\program files (x86)\Norton Security Suite\Engine\5.2.0.13\ccSvcHst.exe\" /s \ "N360\" /m \ "c:\program files (x86)\Norton Security Suite\Engine\5.2.0.13\diMaster.dll\" /prefetch:1 "
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_228_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_228_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.11 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker4 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe
.
**************************************************************************
.
Completion time: 2012-04-07 15:53:33 - machine was rebooted
ComboFix-quarantined-files.txt 2012-04-07 19:53
.
Pre-Run: 246,865,063,936 bytes free
Post-Run: 246,701,727,744 bytes free
.
- - End Of File - - 3872AF27481DFA0DF37D9E50C20E7D2A

 

Current Symptoms

One of the most consistent, which just began recently (I replaced my paid for version of Avast 7 with the free Comcast ISP provided version of Norton 2012 - I think it is a modified version of the Internet Security package. Maybe the 360 one... I am not sure, about two months ago.) Anyway, when I open a new window, IE, Explorer, Word document, Excel SS, it freezes with the ".....Not Responding" in the header or the top of the frame... the cursor freezes and I sit. Sometimes for well, easily a minute.... When it started this, I would ctrl/alt/delete for the Task Manage to kill it and start again. But sometimes just hitting those keys would clear things out and it would all start behaving properly...

At about the same time frame, I began getting a "High CPU Usage" message from Norton. CPU usage would be from 90% to 100%. The service it identified would be listed as "Okay ", and it would indicate that "Many Users" used this file and it was an authorized file, etc. All the files that were doing this seemed to be system files, the last time, just a few minutes ago, I think it was one called "winsat" another I seem to associate in my head as a ".....hostsrvs" file (I know I'm not spelling that right....) but I seem to have seen that in the Task Manager consistently in the Services tab.

It is generally significantly slower than just a few months ago, overall.

IE 9 consistently crashes daily. It does its magic recovery on its own, but this is a new event.

When clicking on a button to begin a new action in whatever program, it takes a significant amount of time to complete it. There is no icon or graphic indicating that something is working or active... I am use to seeing an icon, clock, little circle, line graph turning colors, etc. But the screen doesn't change from what it was, it just sits there for however long, then the action is carried out and the display changes to the requested action.

My Firefox browser crashes as well. Though I only have it for the occasional times I am somewhere and the Cust. Service Rep's only answer to help me is "Try another browser. I know I use Firefox and I never have a problem on our site." Both browsers at first seemed to be crashing when I had a large number of tabs open, sometimes while watching a movie at NetFlix. So I thought at first that was an issue. But when I began paying attention the crashes were occurring with no streaming going on at all, or no DVD's playing in Windows Media Player (the only one I really use. I got tired of having several installed...)

When doing several things at once (normally while writing) I have OneNote open, and IE for research while I am writing. This will cause freeze ups and crashes as if there is too much multi tasking going on.

I keep thinking it is acting like it is short on RAM, but I have 3 GB of 1600 installed. I have a USB stick as well as a USB 3.0 external HDD which is always installed. I guess I could configure Ready Boost if that might help. I just don't know. None of these issues ever surfaced back when I was paying for Avast and playing in its sandbox.... If that has anything to do with it.??? Is Norton just a piece of ***???? Or am I just giving in to ignorance there?

My boot time according to Soluto is 2 minutes, 26 seconds. I have used it to tailor the boot process, and to track crashes etc... Although, after about 8 months they are still saying that all the fixes I need are "just days away.." from being loaded in their cloud...

Well broni, I think that's about it. I seem to be leaving something out but I'm finished with the notes in my log and can't recall anything else. I hope hope hope you have an idea or two or can advise me to go to see if there is something, some remedy out there. I miss my old performance. I have even thought of doing a re-install ov Win 7 and starting out all over with a clean machine, but that is something I would truly like to do as a last resort...

Thanks, and you have made me a beiever. I have fixed income issues (disability) but have already put in my budget a saving account for donation. you guys are great!

Mike

 

Broni,

Thanks for all your help. At least now I know it is not malware related, my stress level is already down to a reasonable level again. I will go over to the windows section like you advised. I really don't know how to convey the extent of my appreciation...

Mike