Critical Object Termination on running System Restore

Background
I got home on Friday night to be informed by my roommate that they had been conned by a scam operation claiming to be "Microsoft Certified Technicians".

They called her in the afternoon, and claimed that her computer had been infected by Trojan.w32.sober since September. They read of a string of random numbers and letters, claiming it was her "computer license ID", that only authorized technicians would have, and then proceeded to walk her through opening msconfig and counting the number of services listed as "stopped", which they then spun as evidence of virus infection and the need to pay them to fix the problem. Similar game was played opening event viewer. All standard spiel for this sort of con.

At this point, they tried to get her to download and run TeamviewerQS to remotely access her machine. Now, I already have the latest Teamviewer running on the computer, so TeamviewerQS would have thrown up a prompt saying something was already running. As she recalls, they had her click "OK" (rather than "Show running Teamviewer"), then directed her to a version page on the Teamviewer web site to download version 7 of the same app. (So far as I can tell, all versions downloaded were version 7.) When this didn't work, the scammer told her he'd have a supervisor call.

A few hours later, another phone call. I can't get a clear recount of the story from that point, but apparently they figured out how to drive the machine remotely, because I can see four system restore points created at that time. Roommate ended the call and session when they started asking for hundreds of dollars for a support plan. The scammers called again late that night, and twice more the next day.

System Restore Crashes
According to System Restore, HP Support Assistant and HP Solutions Framework were uninstalled, two unnamed Windows Modules were installed. Add/Remove programs shows nothing as installed that day. So I decide safest thing to do is restore to an earlier restore point.

System Restore starts up fine, but then spontaneously reboots shortly after getting started. Windows comes back up saying it has recovered from an error. Separate dialog indicates that System Restore failed to complete. Try again on another restore point. Spontaneous reboot. This time, c:/windows/registration permissions are hosed and require resetting just to get into safe mode. All system restore points similarly reboot (thankfully without again hosing permissions).

Minidump shows Critical_Object_Termination each time. I try running from safe mode, from clean boot, and from Win7 repair disc. Ran sfc /scannow, disk check and Seatools. Memtest runs without errors 16 passes. Malwarebytes, Bootkitremoval and TDSSKiller find nothing. Clear temp files, uninstall Zonealarm and try again. Spontaneous reboot.

Tell Driver Verifier to watch everything. Machine is slow, but steady. Try system restore again with Driver Verifier. Spontaneous reboot, only this time no minidump generated. I'm presently running Symantec's Sober Removal tool just to sanity check that they didn't *install* a virus while they had remote access, but again, Zonealarm, Malwarebytes, etc. gave clean bills of health.

What now?
At this point, I don't know if the critical_object_termination is down to scam artist tampering, or if it's down to an incompatible driver that would have bit us in the ass whenever we tried to run a System Restore, even without con-artist tampering.

I'm prepared to run Driver Verifier in batches, trying to get a minidump that says something other than critical_object_termination, as I really don't want to go through the rigmarole of doing a clean install of the OS and reinstalling applications, especially if at the end of the process we might be right back at the same place with some incompatible driver killing System Restore.

But before I do, I figured I'd ask ya'll and see if there's something obvious I might be missing.

Unhelpfully, I ran the dm log collector, waited 45 minutes for it to complete, only for it to generate an empty zip file on my desktop, so I've nothing to upload at the moment. Will run it again.

----

Ran dm log collector again. Empty zip file again. Noticed SF debug files folder this time, so zipped and attached that.