Thank you for your invaluable service. I only turn here to ask for help from you kind wisdom and experience as a last resort.
I have a Windows 7 64bit Lenovo laptop. The other night, running executables produced strange effects and the two programs I tried to launch didn't appear to run, so I rebooted only for this boot loop nightmare to start. Many days spent reading and trying out all sorts of fixes have resulted in nothing that works. The two most common causes online appear to be a rootkit and/or a windows update. I have windows update on manual after previously encountering issues, so I suspect a rootkit.
I have a Windows 7 DVD and have a system image (Windows Backup and Restore) from the day before the "crash" as well as from a couple of months ago. Restoring the image from the day before the event has not helped, neither has using System Restore going back 7 to 10 days before the event. I haven't tried restoring to two months ago.
Using another machine (Vista), a usb stick, and instructions on geekstogo, I got the FRST.txt log file, pasted below:
Thank you kindly in advance,
===========================================================
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-10-2013 01
Ran by SYSTEM on MININT-GM9CLVU on 20-10-2013 23:17:17
Running from F:\
Windows 7 Ultimate Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [44096 2012-01-16] (Lenovo Group Limited)
HKLM\...\Run: [TpShocks] - C:\Windows\system32\TpShocks.exe [382528 2012-02-24] (Lenovo.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916112 2012-04-08] (Synaptics Incorporated)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [Dolby Tuning and Profile Creator] - C:\Program Files\Dolby Tuning and Profile Creator\pcee4.exe [506712 2011-02-03] (Dolby Laboratories Inc.)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1281512 2013-01-27] (Microsoft Corporation)
HKLM\...\Run: [NetWorx] - C:\Program Files\NetWorx\networx.exe [4743568 2012-10-02] (SoftPerfect Research)
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKLM-x32\...\Run: [PWMTRV] - C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL [5941344 2012-05-15] (Lenovo Group Limited)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-17] (Intel Corporation)
HKLM-x32\...\Run: [RotateImage] - C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [BCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252296 2012-01-17] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Sony Ericsson PC Suite] - C:\Program Files (x86)\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [528384 2007-06-12] ()
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe [37232 2008-06-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [640376 2008-06-11] (Adobe Systems Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [309688 2012-10-11] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [AdobeCS4ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [611712 2008-08-13] (Adobe Systems Incorporated)
HKU\Default\...\RunOnce: [Lenovo.ShowBand] - C:\Program Files\Lenovo\SimpleTap DeskBand\ShowBand.exe [52584 2013-05-17] (Lenovo)
HKU\Default User\...\RunOnce: [Lenovo.ShowBand] - C:\Program Files\Lenovo\SimpleTap DeskBand\ShowBand.exe [52584 2013-05-17] (Lenovo)
HKU\morgan\...\Run: [Google Update] - C:\Users\morgan\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2012-07-24] (Google Inc.)
HKU\morgan\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [966072 2012-10-11] (Samsung)
HKU\morgan\...\Run: [KiesAirMessage] - C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe [580096 2012-10-09] (Samsung Electronics)
HKU\morgan\...\Run: [] - C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [842680 2012-10-11] (Samsung)
HKU\morgan\...\Run: [AdobeBridge] - [x]
HKU\morgan\...\Run: [mDesktop] - C:\Program Files (x86)\mDesktop\mDesktop.exe [794112 2013-04-17] ()
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [260928 2012-03-07] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [215360 2012-03-07] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\Users\morgan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> (No File)
Startup: C:\Users\morgan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2010 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
==================== Services (Whitelisted) =================
S3 COMSysApp; C:\Windows\system32\dllhost.exe [9728 2009-07-13] ()
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2012-05-15] (Lenovo.)
S2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22376 2013-06-26] ()
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3325232 2012-06-25] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
S1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-07-23] (DT Soft Ltd)
S1 HWiNFO32; C:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS [30592 2012-05-10] (REALiX™)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)
S1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [249152 2012-03-07] (NVIDIA Corporation)
S3 pbfilter; C:\Program Files\PeerBlock\pbfilter.sys [24176 2010-11-06] ()
S1 PHCORE; C:\Program Files\Lenovo\RapidBoot\PHCORE64.SYS [33344 2012-03-26] (Lenovo Group Limited)
S3 s116bus; C:\Windows\System32\DRIVERS\s116bus.sys [108296 2007-04-03] (MCCI Corporation)
S3 s116mdfl; C:\Windows\System32\DRIVERS\s116mdfl.sys [19720 2007-04-03] (MCCI Corporation)
S3 s116mdm; C:\Windows\System32\DRIVERS\s116mdm.sys [144648 2007-04-03] (MCCI Corporation)
S3 s116mgmt; C:\Windows\System32\DRIVERS\s116mgmt.sys [126216 2007-04-03] (MCCI Corporation)
S3 s116nd5; C:\Windows\System32\DRIVERS\s116nd5.sys [31496 2007-04-03] (MCCI Corporation)
S3 s116obex; C:\Windows\System32\DRIVERS\s116obex.sys [123656 2007-04-03] (MCCI Corporation)
S3 s116unic; C:\Windows\System32\DRIVERS\s116unic.sys [130824 2007-04-03] (MCCI Corporation)
S2 smihlp2; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
S3 dgderdrv; System32\drivers\dgderdrv.sys [x]
S5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-20 23:16 - 2013-10-20 23:16 - 00000000 ____D C:\FRST
2013-10-16 22:41 - 2013-10-16 22:41 - 00000000 ____D C:\Windows\Microsoft Antimalware
2013-10-16 10:48 - 2013-10-16 22:34 - 00000000 __SHD C:\found.000
2013-10-13 04:26 - 2013-10-13 04:26 - 00000709 _____ C:\Users\morgan\Desktop\amazon seller central lockout.txt
2013-09-25 07:04 - 2013-10-07 22:46 - 00005640 _____ C:\Windows\setupact.log
2013-09-25 07:04 - 2013-09-25 07:04 - 00000000 _____ C:\Windows\setuperr.log
2013-09-24 21:22 - 2013-09-24 21:22 - 00000000 ____D C:\Program Files (x86)\Viewer_20121214
==================== One Month Modified Files and Folders =======
2013-10-20 23:16 - 2013-10-20 23:16 - 00000000 ____D C:\FRST
2013-10-20 22:14 - 2012-09-11 23:50 - 00000000 ____D C:\Users\morgan\AppData\Roaming\MyPhoneExplorer
2013-10-20 22:14 - 2012-07-19 04:41 - 00000000 ____D C:\ProgramData\NVIDIA
2013-10-20 22:14 - 2012-07-15 09:20 - 00000000 ____D C:\users\morgan
2013-10-20 22:14 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-10-20 22:14 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\com
2013-10-20 22:14 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\AppCompat
2013-10-20 22:11 - 2012-09-17 04:35 - 00000000 ____D C:\Users\morgan\AppData\Roaming\Dropbox
2013-10-20 22:11 - 2012-07-24 06:27 - 00000000 ____D C:\Users\morgan\AppData\Roaming\Skype
2013-10-20 22:11 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration
2013-10-16 22:41 - 2013-10-16 22:41 - 00000000 ____D C:\Windows\Microsoft Antimalware
2013-10-16 22:34 - 2013-10-16 10:48 - 00000000 __SHD C:\found.000
2013-10-15 17:21 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\tracing
2013-10-13 04:26 - 2013-10-13 04:26 - 00000709 _____ C:\Users\morgan\Desktop\amazon seller central lockout.txt
2013-10-07 22:50 - 2009-07-13 20:45 - 00020480 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-07 22:50 - 2009-07-13 20:45 - 00020480 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-07 22:48 - 2012-07-24 17:12 - 01496087 _____ C:\Windows\WindowsUpdate.log
2013-10-07 22:48 - 2009-07-13 21:13 - 00782922 _____ C:\Windows\System32\PerfStringBackup.INI
2013-10-07 22:46 - 2013-09-25 07:04 - 00005640 _____ C:\Windows\setupact.log
2013-10-07 22:43 - 2012-12-23 10:33 - 00065536 _____ C:\Windows\System32\Ikeext.etl
2013-10-07 22:42 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-06 13:20 - 2012-07-24 13:29 - 00000912 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-91059494-2544289635-1420198269-1000UA.job
2013-10-05 01:20 - 2012-07-24 13:29 - 00000860 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-91059494-2544289635-1420198269-1000Core.job
2013-10-05 01:15 - 2012-07-24 13:29 - 00003888 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-91059494-2544289635-1420198269-1000UA
2013-10-05 01:15 - 2012-07-24 13:29 - 00003492 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-91059494-2544289635-1420198269-1000Core
2013-09-28 13:16 - 2012-12-17 12:48 - 00000000 ____D C:\Users\morgan\AppData\Roaming\Mozilla
2013-09-26 01:05 - 2012-10-20 22:57 - 00000000 ____D C:\Users\morgan\AppData\Roaming\abelhadigital.com
2013-09-25 07:04 - 2013-09-25 07:04 - 00000000 _____ C:\Windows\setuperr.log
2013-09-24 21:22 - 2013-09-24 21:22 - 00000000 ____D C:\Program Files (x86)\Viewer_20121214
2013-09-22 22:55 - 2012-07-29 11:33 - 00000000 ____D C:\Users\morgan\AppData\Roaming\vlc
==================== Known DLLs (Whitelisted) ================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
==================== Memory info ===========================
Percentage of memory in use: 15%
Total physical RAM: 3983.23 MB
Available physical RAM: 3356.97 MB
Total Pagefile: 3981.43 MB
Available Pagefile: 3344.31 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB
==================== Drives ================================
Drive c: (OS_Win7) (Fixed) (Total:85.33 GB) (Free:42.18 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:380.43 GB) (Free:5.82 GB) NTFS
Drive e: (GSP1RMCULXFRER_EN_DVD) (CDROM) (Total:3.09 GB) (Free:0 GB) UDF
Drive f: (WDO_MEDIA64) (Removable) (Total:0.93 GB) (Free:0.6 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 5CD45D08)
Partition 1: (Active) - (Size=85 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=380 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 960 MB) (Disk ID: C73BC0DF)
Partition 1: (Active) - (Size=959 MB) - (Type=0B)
LastRegBack: 2013-10-10 15:47
==================== End Of Log ============================