Norton finds at gmail.com Webattack: fake scan webpage 12 cannot kill

when i check my gmail in internet explorer, norton finds "fake scan webpage 12" and redirects me to a screen that says that an intrusion attempt was blocked.  This does not happen in Chrome.  Seems to only happen in internet explorer when I login to my gmail account.  

Malware Bytes; Spybot Search and Destroy; Norton Internet Security, and Norton Power Eraser do not find the trojan.  

I downloaded and ran aswMBR and Farbar Recovery scan tool per What The Tech instructions and have included the logs below.  aswMBR did not run thought.  It produced an error.  I have included the log from Norton Internet security as well below, only including the intrusion detection entries.

Thank you in advance for your help.

R Bryan Davis

—————————————–Norton log—————————

malwarebytes rootkit scanner did not find the malware!  damn!

I ran the aswMBR avasti scanner again and it found win32: Aluroot -B [rtk] immediately in c:\windows\system32\csrsrv.dll

I have run antirootkit from malwarebites, kaspersky's tdsskiller, spybot search and destroy, norton internet security, avasti browser scanner, FRST.exe scanner, norton power eraser.

what in the world can kill this thing?

the original symptom is gone though.  Norton is nolonger reporting an attack when I check my gmail.  but from what I read, the symptonms will reappear perhaps in another fashion.

here are the results from malwrebytes antirootkit.

———————————–

Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2016.10.14.08
  rootkit: v2016.09.26.02

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 11.0.9600.18499
pos :: WSERVER [administrator]

10/14/2016 2:40:47 PM
mbar-log-2016-10-14 (14-40-47).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 304840
Time elapsed: 24 minute(s), 47 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
 

———————————–

Malwarebytes Anti-Rootkit BETA 1.09.3.1001

© Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x86

Account is Administrative

Internet Explorer version: 11.0.9600.18499

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, Q:\ DRIVE_FIXED
CPU speed: 3.093000 GHz
Memory total: 3398365184, free: 1189322752

Downloaded database version: v2016.10.14.08
Downloaded database version: v2016.09.26.02
Downloaded database version: v2016.09.21.01
=======================================
Initializing…
———— Kernel report ————
     10/14/2016 14:40:39
———— Loaded modules ———–
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\39916371.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\iaStor.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\PxHelp20.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\system32\drivers\NIS\1607010.020\SYMEFASI.SYS
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\system32\DRIVERS\PBADRV.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\drivers\NIS\1607010.020\ccSetx86.sys
\SystemRoot\system32\drivers\NIS\1607010.020\Ironx86.SYS
\??\C:\Windows\system32\Drivers\SYMEVENT.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\System32\Drivers\NIS\1607010.020\SYMNETS.SYS
\SystemRoot\system32\drivers\NIS\1607010.020\SRTSPX.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\??\C:\Program Files\Norton Internet Security\NortonData\22.5.0.124\Definitions\IPSDefs\20161013.001\IDSvix86.sys
\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\??\C:\Program Files\Norton Internet Security\NortonData\22.5.0.124\Definitions\BASHDefs\20161005.001\BHDrvx86.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\igdkmd32.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HECI.sys
\SystemRoot\system32\DRIVERS\e1c6232.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\lmimirr.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\drivers\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RTDVHDA.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\IntcDAud.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_iaStor.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\drivers\hidusb.sys
\SystemRoot\system32\drivers\HIDCLASS.SYS
\SystemRoot\system32\drivers\HIDPARSE.SYS
\SystemRoot\system32\drivers\USBD.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\drivers\usbccgp.sys
\SystemRoot\system32\DRIVERS\usbscan.sys
\SystemRoot\system32\DRIVERS\usbprint.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\DRIVERS\Sftvollh.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\drivers\mrxdav.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\parvdm.sys
\??\C:\Program Files\LogMeIn\x86\RaInfo.sys
\??\C:\Windows\system32\drivers\LMIRfsDriver.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\system32\DRIVERS\Sftfslh.sys
\SystemRoot\system32\DRIVERS\Sftplaylh.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\Sftredirlh.sys
\??\C:\Windows\system32\drivers\mwac.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\Drivers\NIS\1607010.020\SRTSP.SYS
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
———– End ———–
Done!

Scan started
Database versions:
  main:    v2016.10.14.08
  rootkit: v2016.09.26.02

<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff87bea5f0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
——— Disk Stack ——
DevicePointer: 0xffffffff87bf0020, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff87bea5f0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff86090028, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
———— End ———-
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers…
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0…
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 409FB431

Partition information:

    Partition 0 type is Other (0xde)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 63  Numsec = 80262
    Partition is not bootable

    Partition 1 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 81920  Numsec = 28606464
    Partition is bootable
    Partition file system is NTFS

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 28688384  Numsec = 459702272
    Partition is not bootable
    Partition file system is NTFS

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 250059350016 bytes
Sector size: 512 bytes

Done!
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-63-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-1-81920-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-2-28688384-i.mbam…
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam…
Removal finished
 

————————————

I have run combofix.  The log follows.

The symptom has disappeared.  when the problem first occurred, the trojan tried to redirect me when I logged into gmail.  It is no longer doing that.  I am testing that as I type this…waiting for gmail to load actually.  okay.  took a while to load.  but norton is not blocking a redirect attempt now and is not reporting a Fake Webscan 12 block. 

here is the combofix log.  I am running another aswMBR.exe scan to see if it still sees the Aluroot -B Rootkit trojan.

———————combo fix log ————————–

ComboFix 16-10-17.01 - pos 10/17/2016  14:44:01.1.4 - x86
Microsoft Windows 7 Professional   6.1.7601.1.1252.263.1033.18.3241.1449 [GMT -4:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
FW: Norton Internet Security *Enabled* {6BFC5632-188D-B806-D13E-C607121B42A0}
SP: Norton Internet Security *Disabled/Updated* {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\pos\GoToAssistDownloadHelper.exe
c:\windows\system32\AdobePDF.dll
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((((   Files Created from 2016-09-17 to 2016-10-17  )))))))))))))))))))))))))))))))
.
.
2016-10-17 18:52 . 2016-10-17 18:52    ——–    d—–w-    c:\users\Default\AppData\Local\temp
2016-10-14 22:56 . 2016-10-15 14:42    ——–    d—–w-    c:\windows\system32\drivers\NIS\1608000.032
2016-10-14 18:40 . 2016-10-14 19:16    ——–    d—–w-    c:\programdata\Malwarebytes' Anti-Malware (portable)
2016-10-13 07:12 . 2016-08-29 14:55    2972672    —-a-w-    c:\windows\explorer.exe
2016-10-13 07:12 . 2016-08-29 15:12    1499648    —-a-w-    c:\windows\system32\ExplorerFrame.dll
2016-10-13 07:12 . 2016-08-29 15:12    1806848    —-a-w-    c:\windows\system32\authui.dll
2016-10-13 07:11 . 2015-07-16 19:12    856064    —-a-w-    c:\windows\system32\rdvidcrl.dll
2016-10-13 07:11 . 2015-07-16 19:12    53248    —-a-w-    c:\windows\system32\tsgqec.dll
2016-10-13 07:11 . 2015-07-16 19:12    6131200    —-a-w-    c:\windows\system32\mstscax.dll
2016-10-13 07:11 . 2015-07-16 15:14    355840    —-a-w-    c:\windows\system32\wksprt.exe
2016-10-13 07:11 . 2014-12-11 17:47    74240    —-a-w-    c:\windows\system32\TSWbPrxy.exe
2016-10-13 07:10 . 2016-08-16 20:26    46592    —-a-w-    c:\windows\system32\drivers\usbehci.sys
2016-10-13 07:10 . 2016-08-16 20:26    285696    —-a-w-    c:\windows\system32\drivers\usbport.sys
2016-10-13 07:10 . 2016-08-16 20:27    259072    —-a-w-    c:\windows\system32\drivers\usbhub.sys
2016-10-13 07:10 . 2016-08-16 20:27    76288    —-a-w-    c:\windows\system32\drivers\usbccgp.sys
2016-10-13 07:10 . 2016-08-16 20:26    20480    —-a-w-    c:\windows\system32\drivers\usbohci.sys
2016-10-13 07:10 . 2016-08-16 20:26    24576    —-a-w-    c:\windows\system32\drivers\usbuhci.sys
2016-10-13 07:10 . 2016-08-16 20:26    6016    —-a-w-    c:\windows\system32\drivers\usbd.sys
2016-10-12 16:24 . 2016-10-12 16:29    ——–    d—–w-    C:\FRST
2016-10-12 09:18 . 2016-07-22 14:51    123904    —-a-w-    c:\windows\system32\poqexec.exe
2016-10-11 21:47 . 2016-10-17 18:53    170200    —-a-w-    c:\windows\system32\drivers\MBAMSwissArmy.sys
2016-10-11 21:47 . 2016-10-14 18:39    94936    —-a-w-    c:\windows\system32\drivers\mbamchameleon.sys
2016-10-11 21:47 . 2016-10-13 21:22    ——–    d—–w-    c:\program files\Malwarebytes Anti-Malware
2016-10-11 21:47 . 2016-10-11 21:47    ——–    d—–w-    c:\programdata\Malwarebytes
2016-10-11 21:47 . 2016-03-10 18:09    53120    —-a-w-    c:\windows\system32\drivers\mwac.sys
2016-10-11 21:47 . 2016-03-10 18:08    24448    —-a-w-    c:\windows\system32\drivers\mbam.sys
2016-10-11 20:26 . 2016-10-17 18:39    ——–    d—–w-    c:\programdata\Spybot - Search & Destroy
2016-10-11 20:26 . 2016-10-17 18:53    ——–    d—–w-    c:\program files\Spybot - Search & Destroy 2
2016-10-11 20:25 . 2016-10-11 20:25    ——–    d—–w-    c:\users\pos\AppData\Local\Programs
2016-10-11 16:45 . 2012-08-23 14:44    14848    —-a-w-    c:\windows\system32\drivers\rdpvideominiport.sys
2016-10-11 16:45 . 2012-08-23 11:12    192000    —-a-w-    c:\windows\system32\rdpendp_winip.dll
2016-10-11 16:43 . 2013-10-01 23:45    32256    —-a-w-    c:\windows\system32\TsUsbGDCoInstaller.dll
2016-10-11 16:43 . 2013-10-02 00:42    49152    —-a-w-    c:\windows\system32\drivers\TsUsbFlt.sys
2016-10-11 16:43 . 2013-10-02 00:32    12800    —-a-w-    c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2016-10-11 16:43 . 2013-10-02 00:30    14336    —-a-w-    c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2016-10-11 16:43 . 2013-10-02 00:14    50176    —-a-w-    c:\windows\system32\MsRdpWebAccess.dll
2016-10-11 16:43 . 2013-10-02 00:14    17920    —-a-w-    c:\windows\system32\wksprtPS.dll
2016-10-11 16:43 . 2013-10-01 22:34    1068544    —-a-w-    c:\windows\system32\mstsc.exe
2016-10-11 16:29 . 2015-08-05 17:40    15872    —-a-w-    c:\windows\system32\icaapi.dll
2016-10-11 16:29 . 2015-08-05 16:58    31232    —-a-w-    c:\windows\system32\drivers\tssecsrv.sys
2016-10-11 16:16 . 2016-10-11 16:16    ——–    d—–w-    c:\program files\Common Files\Java
2016-10-11 16:15 . 2016-10-11 16:15    ——–    d—–w-    c:\users\pos\.oracle_jre_usage
2016-10-11 16:15 . 2016-10-11 16:15    95808    —-a-w-    c:\windows\system32\WindowsAccessBridge.dll
2016-10-11 16:15 . 2016-10-11 16:16    ——–    d—–w-    c:\programdata\Oracle
2016-10-11 16:15 . 2016-10-11 16:15    ——–    d—–w-    c:\program files\Java
2016-10-11 15:58 . 2016-10-11 16:15    ——–    d—–w-    c:\users\pos\AppData\Local\NPE
2016-09-21 05:42 . 2016-08-05 15:13    2048    —-a-w-    c:\windows\system32\tzres.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-10-14 22:56 . 2011-10-27 15:39    87792    —-a-w-    c:\windows\system32\drivers\SYMEVENT.SYS
2016-10-11 14:25 . 2012-06-04 13:29    796352    —-a-w-    c:\windows\system32\FlashPlayerApp.exe
2016-10-11 14:25 . 2011-10-14 02:25    142528    —-a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
2016-09-22 15:58 . 2016-10-14 20:02    9837072    —-a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{32633027-E901-46CE-8603-A3807AA5621C}\mpengine.dll
2016-09-16 14:17 . 2011-10-26 21:16    102944    —-a-w-    c:\windows\system32\LMIRfsClientNP.dll
2016-09-16 14:17 . 2011-10-26 21:16    96768    —-a-w-    c:\windows\system32\LMIinit.dll
2016-09-14 14:17 . 2011-10-26 21:16    102944    —-a-w-    c:\windows\system32\LMIRfsClientNP.dll.000.bak
2016-09-08 14:17 . 2011-10-26 21:16    102944    —-a-w-    c:\windows\system32\LMIRfsClientNP.dll.001.bak
2016-08-16 20:42 . 2016-10-13 07:10    3072    —-a-w-    c:\windows\system32\drivers\en-US\usbehci.sys.mui
2016-08-16 20:42 . 2016-10-13 07:10    11776    —-a-w-    c:\windows\system32\drivers\en-US\usbhub.sys.mui
2016-08-16 20:41 . 2016-10-13 07:10    24576    —-a-w-    c:\windows\system32\drivers\en-US\usbport.sys.mui
2016-08-16 02:48 . 2016-09-14 11:05    811520    —-a-w-    c:\windows\system32\user32.dll
2016-08-12 16:46 . 2016-10-11 16:31    2560    —-a-w-    c:\windows\apppatch\AcRes.dll
2016-08-12 16:21 . 2016-09-14 11:05    310784    —-a-w-    c:\windows\system32\drivers\srv.sys
2016-08-12 16:21 . 2016-09-14 11:05    313856    —-a-w-    c:\windows\system32\drivers\srv2.sys
2016-08-12 16:21 . 2016-09-14 11:05    116224    —-a-w-    c:\windows\system32\drivers\srvnet.sys
2016-08-06 15:15 . 2016-09-14 11:05    581632    —-a-w-    c:\windows\system32\oleaut32.dll
2016-08-05 19:09 . 2016-08-05 19:09    28352    —-a-w-    c:\windows\system32\aspnet_counters.dll
2016-08-05 19:09 . 2016-08-05 19:09    19104    —-a-w-    c:\windows\system32\msvcr110_clr0400.dll
2016-08-05 19:09 . 2016-08-05 19:09    19104    —-a-w-    c:\windows\system32\msvcr100_clr0400.dll
2016-08-05 19:09 . 2016-08-05 19:09    19104    —-a-w-    c:\windows\system32\msvcp110_clr0400.dll
2016-07-26 18:24 . 2011-10-20 15:20    406184    ——w-    c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2016-10-10 18:33    223552    —-a-w-    c:\users\pos\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt10]
@="{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE2-A251-47B7-93E1-CDD82E34AF8B}]
2016-10-10 18:33    223552    —-a-w-    c:\users\pos\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2016-10-10 18:33    223552    —-a-w-    c:\users\pos\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt3]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2016-10-10 18:33    223552    —-a-w-    c:\users\pos\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt4]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2016-10-10 18:33    223552    —-a-w-    c:\users\pos\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt5]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2016-10-10 18:33    223552    —-a-w-    c:\users\pos\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt6]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2016-10-10 18:33    223552    —-a-w-    c:\users\pos\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt7]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2016-10-10 18:33    223552    —-a-w-    c:\users\pos\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt8]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2016-10-10 18:33    223552    —-a-w-    c:\users\pos\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ DropboxExt9]
@="{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE1-A251-47B7-93E1-CDD82E34AF8B}]
2016-10-10 18:33    223552    —-a-w-    c:\users\pos\AppData\Roaming\Dropbox\bin\DropboxExt.65536.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"
[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]
2011-05-27 22:38    120184    —-a-w-    c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"
[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]
2011-05-27 22:38    120184    —-a-w-    c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Acrobat Synchronizer"="c:\program files\Adobe\Acrobat 10.0\Acrobat\AdobeCollabSync.exe" [2010-10-25 1216416]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2013-05-09 39408]
"Adobe Reader Synchronizer"="c:\program files\Adobe\Reader 11.0\Reader\AdobeCollabSync.exe" [2016-10-01 762080]
"Dropbox Update"="c:\users\pos\AppData\Local\Dropbox\Update\DropboxUpdate.exe" [2015-06-24 134512]
"GoogleChromeAutoLaunch_EA50915169FF4E1E3C03EAB2862059C7"="c:\program files\Google\Chrome\Application\chrome.exe" [2016-09-25 966760]
"SpybotPostWindows10UpgradeReInstall"="c:\program files\Common Files\AV\Spybot - Search and Destroy\Test.exe" [2015-07-28 1011200]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtDCpl.exe" [2010-10-04 2697832]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-06-28 142616]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-06-28 177432]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-06-28 176408]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160]
"IMSS"="c:\program files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2011-01-17 112152]
"TdmNotify"="c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmNotify.exe" [2011-05-27 214384]
"RemoteControl9"="c:\program files\CyberLink\PowerDVD9\PDVD9Serv.exe" [2009-07-06 87336]
"PDVD9LanguageShortcut"="c:\program files\CyberLink\PowerDVD9\Language\Language.exe" [2010-04-29 50472]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2010-10-25 36760]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2010-10-25 821144]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112]
"Desktop Disc Tool"="c:\program files\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544]
"DBRMTray"="c:\dell\DBRM\Reminder\DbrmTrayIcon.exe" [2011-03-08 227328]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2011-09-16 63048]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2016-06-22 598552]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2016-09-16 1156824]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"DBRMTray"="c:\dell\DBRM\Reminder\TrayApp.exe" [2010-02-04 7168]
.
c:\users\pos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\pos\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2016-10-13 25366584]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
RPRO Scheduler.lnk - c:\pos\Retail\Rpro\Schedule.exe [2009-10-8 1064960]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2011-10-20 15:21    13672    —-a-w-    c:\program files\Citrix\GoToAssist\705\g2awinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist Express Customer]
2016-10-11 15:41    610528    —-a-w-    c:\program files\Citrix\GoToAssist Remote Support Customer\1092\g2ax_winlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\spba]
2010-09-15 16:11    1971536    —-a-w-    c:\program files\Common Files\SPBA\homefus2.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute    REG_MULTI_SZ       autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages    REG_MULTI_SZ       msv1_0 wvauth
.
R2 Monetra;Monetra;c:\program files\Main Street Softworks\Monetra\bin\monetra.exe [2011-10-21 868352]
R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2016-09-30 102912]
R3 netvsc;netvsc;c:\windows\system32\DRIVERS\netvsc60.sys [2010-11-20 126464]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]
R3 SynthVid;SynthVid;c:\windows\system32\DRIVERS\VMBusVideoM.sys [2010-11-20 19456]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2013-10-02 49152]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-11-12 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 SymEFASI;Symantec Extended File Attributes (SI);c:\windows\system32\drivers\NIS\1608000.032\SYMEFASI.SYS [2016-09-23 1291992]
S1 BHDrvx86;BHDrvx86;c:\program files\Norton Internet Security\NortonData\22.5.0.124\Definitions\BASHDefs\20161005.001\BHDrvx86.sys [2016-08-18 1334008]
S1 ccSet_NIS;NIS Settings Manager;c:\windows\system32\drivers\NIS\1608000.032\ccSetx86.sys [2016-06-02 137456]
S1 IDSVix86;IDSVix86;c:\program files\Norton Internet Security\NortonData\22.5.0.124\Definitions\IPSDefs\20161014.003\IDSvix86.sys [2016-09-26 768728]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1608000.032\Ironx86.SYS [2016-09-23 229616]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NIS\1608000.032\SYMNETS.SYS [2016-09-23 423640]
S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2015-03-18 822496]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 GoToAssist Remote Support Customer;GoToAssist Remote Support Customer;c:\program files\Citrix\GoToAssist Remote Support Customer\1092\g2ax_service.exe Start=service [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-06 13336]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe [2010-09-22 110752]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files\Intel\Services\IPT\jhi_service.exe [2011-02-24 212944]
S2 LMIGuardianSvc;Support LogMeIn processes with quality assurance feedback;c:\program files\LogMeIn Ignition\LMIGuardianSvc.exe [2015-11-30 411632]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [2013-05-25 13624]
S2 LMIRescueUA_83083;LogMeIn Rescue (83083);c:\users\pos\AppData\Local\LogMeIn Rescue Unattended\LMIR0001.tmp\unattended_srv.exe [2015-06-23 2452792]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes Anti-Malware\mbamscheduler.exe [2016-03-10 1514464]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes Anti-Malware\mbamservice.exe [2016-03-10 1136608]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\22.8.0.50\NIS.exe [2016-09-24 289080]
S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2013-06-26 523944]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-08-08 2656536]
S2 Wave Authentication Manager Service;Wave Authentication Manager Service;c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Authentication Manager\WaveAMService.exe [2011-07-01 1131520]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2016-10-04 124632]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2014-08-26 364504]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2016-03-10 24448]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2016-10-17 170200]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2016-03-10 53120]
S3 MEI;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECI.sys [2010-10-20 41088]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2013-06-26 583848]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2013-06-26 197800]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2013-06-26 24232]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2013-06-26 20136]
S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2013-06-26 207528]
.
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - MBAMSWISSARMY
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation    REG_MULTI_SZ       SSDPSRV upnphost SCardSvr fdrespub AppIDSvc QWAVE wcncsvc Mcx2Svc SensrSvc
HPZ12    REG_MULTI_SZ       Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt    REG_MULTI_SZ       hpqcxs08 hpqddsvc
utcsvc    REG_MULTI_SZ       DiagTrack
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2016-10-03 19:17    1266792    —-a-w-    c:\program files\Google\Chrome\Application\53.0.2785.143\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2016-10-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-04 14:25]
.
2016-10-17 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3413578862-766043431-1328377809-1000Core.job
- c:\users\pos\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-24 13:38]
.
2016-10-17 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3413578862-766043431-1328377809-1000UA.job
- c:\users\pos\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-24 13:38]
.
2016-10-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-05-09 05:43]
.
2016-10-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-05-09 05:43]
.
.
——- Supplementary Scan ——-
.
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
TCP: Interfaces\{934FEA4A-D6DB-44D8-BD8E-C6887769C449}: NameServer = 192.168.1.254
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
SafeBoot-57173677.sys
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\22.8.0.50\NIS.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\22.8.0.50\diMaster.dll\" /prefetch:1"
"ImagePath"="\SystemRoot\System32\Drivers\NIS\1608000.032\SYMNETS.SYS"
"TrustedImagePaths"="c:\program files\Norton Internet Security\Engine\22.8.0.50"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_23_0_0_185_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_23_0_0_185_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'lsass.exe'(620)
c:\windows\system32\wvauth.DLL
.
- - - - - - - > 'Explorer.exe'(8188)
c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmIconOverlay.dll
.
———————— Other Running Processes ————————
.
c:\program files\Dell\Dell Data Protection\Access\Advanced\Wave\Trusted Drive Manager\TdmService.exe
c:\program files\Common Files\SPBA\upeksvr.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Citrix\GoToAssist Remote Support Customer\1092\g2ax_service.exe
c:\program files\LogMeIn\x86\RaMaint.exe
c:\users\pos\AppData\Local\LogMeIn Rescue Unattended\LMIR0001.tmp\unattended.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Malwarebytes Anti-Malware\mbam.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\LogMeIn\x86\LMIGuardianSvc.exe
c:\program files\Citrix\GoToAssist Remote Support Customer\1092\g2ax_comm_customer.exe
c:\program files\Citrix\GoToAssist Remote Support Customer\1092\g2ax_system_customer.exe
c:\program files\Citrix\GoToAssist Remote Support Customer\1092\g2ax_user_customer.exe
c:\program files\LogMeIn\x86\LMIGuardianSvc.exe
c:\windows\system32\conhost.exe
c:\users\pos\AppData\Roaming\Dropbox\bin\Dropbox.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\DllHost.exe
c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Completion time: 2016-10-17  15:07:40 - machine was rebooted
ComboFix-quarantined-files.txt  2016-10-17 19:07
.
Pre-Run: 168,289,054,720 bytes free
Post-Run: 168,193,294,336 bytes free
.
- - End Of File - - BD2F759C5AE0AE914220E0833F9D3D96
5C616939100B85E558DA92B899A0FC36

———————————————-

I believe all those entries are ok. One more scan to run . You can download  the TdssKiller exe file 

This forum as well as all the other forums can be read by people from all parts of the world with internet access.  Its possible for sensitive info to be revealed on the logs mosty your IP address.