hendu3270

Members
  • Content count

    47
  • Joined

  • Last visited

About hendu3270

  • Rank
    New Member

Contact Methods

  • ICQ
    0
  1. Holy crap!!!! No longer getting the redirect. thank you !!!!
  2. Shortcut Cleaner 1.2.6 by Lawrence Abrams (Grinler) http://www.bleepingcomputer.com/ Copyright 2008-2013 BleepingComputer.com More Information about Shortcut Cleaner can be found at this link: http://www.bleepingcomputer.com/download/shortcut-cleaner/ Windows Version: Windows 8 Program started at: 12/20/2013 07:39:53 PM. Scanning for registry hijacks: * No issues found in the Registry. Searching for Hijacked Shortcuts: Searching C:\Users\Chris L Hendrick\AppData\Roaming\Microsoft\Windows\Start Menu\ * Shortcut Cleaned: C:\Users\Chris L Hendrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk => C:\Program Files\Internet Explorer\iexplore.exe http://do-search.com/?type=sc&ts=1384647336&from=mp3&uid=HitachiXHTS541010A9E680_J8100076GHWPEAGHWPEAX Searching C:\ProgramData\Microsoft\Windows\Start Menu\ Searching C:\Users\Chris L Hendrick\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\ * Shortcut Cleaned: C:\Users\Chris L Hendrick\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk => C:\Program Files\Internet Explorer\iexplore.exe http://do-search.com/?type=sc&ts=1384647336&from=mp3&uid=HitachiXHTS541010A9E680_J8100076GHWPEAGHWPEAX * Shortcut Cleaned: C:\Users\Chris L Hendrick\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk => C:\Program Files\Internet Explorer\iexplore.exe http://do-search.com/?type=sc&ts=1384647336&from=mp3&uid=HitachiXHTS541010A9E680_J8100076GHWPEAGHWPEAX Searching C:\Users\Public\Desktop\ Searching C:\Users\Chris L Hendrick\Desktop 3 bad shortcuts found. Program finished at: 12/20/2013 07:39:56 PM Execution time: 0 hours(s), 0 minute(s), and 2 seconds(s)
  3. waiting for reply
  4. Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-12-2013 01 Ran by Chris L Hendrick at 2013-12-10 19:33:50 Run:2 Running from C:\Users\Chris L Hendrick\Downloads Boot Mode: Normal ============================================== Content of fixlist: ***************** reg: reg query "HKLM\system\currentcontrolset\services\appmgmt" *****************   ========= reg query "HKLM\system\currentcontrolset\services\appmgmt" =========   HKEY_LOCAL_MACHINE\system\currentcontrolset\services\appmgmt ImagePath REG_EXPAND_SZ %SystemRoot%\system32\svchost.exe -k netsvcs HKEY_LOCAL_MACHINE\system\currentcontrolset\services\appmgmt\Parameters   ========= End of Reg: =========   ==== End of Fixlog ====
  5. Marius, I still have this issue. Have you been able to figure anything out?
  6. Not a problem at all Marius. I'd like to get it taken care of but it's not taking my computer out of commission so do what you need to. Would it matter if I let you know what I was doing when it happened?
  7. Marius, Here's the file from the new scan. FRST.txt
  8. Marius, That file doesn't seem to exist?
  9. Still redirecting. That last "fix" step was almost instant though. It almost seemd like it didn't fully do what it was supposed to do. Although I don't have a reference to know how long it should have taken.
  10. Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-11-2013 01 Ran by Chris L Hendrick at 2013-11-25 18:20:38 Run:1 Running from C:\Users\Chris L Hendrick\Downloads Boot Mode: Normal ============================================== Content of fixlist: ***************** HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://do-search.com...76GHWPEAGHWPEAX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://do-search.com...HWPEAGHWPEAX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://do-search.com...HWPEAGHWPEAX&q={searchTerms} SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = BHO-x32: WordOv - {14E5E74B-0B52-4669-8B78-6527C7A09831} - C:\Users\Chris L Hendrick\AppData\Roaming\WordOv\temp.dat () C:\Users\Chris L Hendrick\AppData\Roaming\WordOv ***************** HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{14E5E74B-0B52-4669-8B78-6527C7A09831} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{14E5E74B-0B52-4669-8B78-6527C7A09831} => Key deleted successfully. C:\Users\Chris L Hendrick\AppData\Roaming\WordOv => Moved successfully. ==== End of Fixlog ====
  11. Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-11-2013 Ran by Chris L Hendrick at 2013-11-25 06:01:01 Running from C:\Users\Chris L Hendrick\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AV: Norton Security Suite (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Norton Security Suite (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202} FW: Norton Security Suite (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} ==================== Installed Programs ====================== 4 Elements II (x32 Version: 2.2.0.98) Adobe Photoshop Elements 11 (x32 Version: 11.0) Adobe Shockwave Player 11.6 (x32 Version: 11.6.5.635) AMD Accelerated Video Transcoding (Version: 12.5.100.20808) AMD APP SDK Runtime (Version: 10.0.938.2) AMD Catalyst Install Manager (Version: 8.0.881.0) AMD Fuel (Version: 2012.0808.1024.16666) AMD Quick Stream (Version: 3.3.26.0) AMD VISION Engine Control Center (x32 Version: 2012.0808.1024.16666) Apple Application Support (x32 Version: 2.3.6) Apple Mobile Device Support (Version: 7.0.0.117) Apple Software Update (x32 Version: 2.1.3.127) Bejeweled 3 (x32 Version: 2.2.0.98) Bing Bar (x32 Version: 7.0.619.0) Bonjour (Version: 3.0.0.10) Build-a-lot 4 - Power Source (x32 Version: 2.2.0.98) Catalyst Control Center - Branding (x32 Version: 1.00.0000) Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0808.1024.16666) Catalyst Control Center InstallProxy (x32 Version: 2012.0808.1024.16666) Catalyst Control Center Localization All (x32 Version: 2012.0808.1024.16666) CCC Help Chinese Standard (x32 Version: 2012.0808.1023.16666) CCC Help Chinese Traditional (x32 Version: 2012.0808.1023.16666) CCC Help Czech (x32 Version: 2012.0808.1023.16666) CCC Help Danish (x32 Version: 2012.0808.1023.16666) CCC Help Dutch (x32 Version: 2012.0808.1023.16666) CCC Help English (x32 Version: 2012.0808.1023.16666) CCC Help Finnish (x32 Version: 2012.0808.1023.16666) CCC Help French (x32 Version: 2012.0808.1023.16666) CCC Help German (x32 Version: 2012.0808.1023.16666) CCC Help Greek (x32 Version: 2012.0808.1023.16666) CCC Help Hungarian (x32 Version: 2012.0808.1023.16666) CCC Help Italian (x32 Version: 2012.0808.1023.16666) CCC Help Japanese (x32 Version: 2012.0808.1023.16666) CCC Help Korean (x32 Version: 2012.0808.1023.16666) CCC Help Norwegian (x32 Version: 2012.0808.1023.16666) CCC Help Polish (x32 Version: 2012.0808.1023.16666) CCC Help Portuguese (x32 Version: 2012.0808.1023.16666) CCC Help Russian (x32 Version: 2012.0808.1023.16666) CCC Help Spanish (x32 Version: 2012.0808.1023.16666) CCC Help Swedish (x32 Version: 2012.0808.1023.16666) CCC Help Thai (x32 Version: 2012.0808.1023.16666) CCC Help Turkish (x32 Version: 2012.0808.1023.16666) ccc-utility64 (Version: 2012.0808.1024.16666) Chuzzle Deluxe (x32 Version: 2.2.0.95) Cradle Of Egypt Collector's Edition (x32 Version: 2.2.0.98) Cradle of Rome 2 (x32 Version: 2.2.0.98) Cypherix LE 10 (x32 Version: 10) D3DX10 (x32 Version: 15.4.2368.0902) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) Elements 11 Organizer (x32 Version: 11.0) Energy Star (Version: 1.0.8) Facebook Video Calling 1.2.0.287 (x32 Version: 1.2.287) Farm Frenzy (x32 Version: 2.2.0.98) FATE: The Cursed King (x32 Version: 2.2.0.97) Final Drive Fury (x32 Version: 2.2.0.95) FlatOut 2 (x32 Version: 2.2.0.98) Google Earth (x32 Version: 7.1.1.1888) Google Update Helper (x32 Version: 1.3.21.165) Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.95) Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000) Hoyle Card Games (x32 Version: 2.2.0.95) HP 3D DriveGuard (Version: 4.2.9.1) HP Connected Music (Meridian - installer) (x32 Version: v1.0) HP CoolSense (x32 Version: 2.10.51) HP Customer Experience Enhancements (x32 Version: 6.0.1.7) HP Documentation (x32 Version: 1.1.0.0) HP Games (x32 Version: 1.0.3.0) HP MyRoom (x32 Version: 9.0.0.0) HP Postscript Converter (Version: 3.1.3554) HP Quick Launch (x32 Version: 3.0.3) HP Recovery Manager (x32 Version: 7.00) HP Registration Service (Version: 1.0.5976.4186) HP Software Framework (x32 Version: 4.6.10.1) HP Support Assistant (x32 Version: 7.0.39.15) HP Utility Center (x32 Version: 1.0.7) HP Wireless Button Driver (x32 Version: 1.0.5.1) IDT Audio (x32 Version: 1.0.6425.0) iTunes (Version: 11.1.3.8) Java 7 Update 25 (x32 Version: 7.0.250) Java Auto Updater (x32 Version: 2.1.9.5) Jewel Match 3 (x32 Version: 2.2.0.98) John Deere Drive Green (x32 Version: 2.2.0.95) Junk Mail filter update (x32 Version: 15.4.3502.0922) Luxor Evolved (x32 Version: 2.2.0.98) Mahjongg Dimensions Deluxe: Tiles in Time (x32 Version: 2.2.0.98) Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300) Mesh Runtime (x32 Version: 15.4.5722.2) Messenger Companion (x32 Version: 15.4.3502.0922) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2010 Service Pack 1 (SP1) (x32) Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Excel MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Home and Student 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000) Microsoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Outlook Connector (x32 Version: 14.0.5118.5000) Microsoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000) Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000) Microsoft Office Word MUI (English) 2010 (x32 Version: 14.0.6029.1000) Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (x32 Version: 14.0.5120.5000) Microsoft Silverlight (Version: 5.1.20913.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319) Mortimer Beckett and the Crimson Thief Premium Edition (x32 Version: 2.2.0.98) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98) Norton Security Suite (x32 Version: 21.1.0.18) Peggle Nights (x32 Version: 2.2.0.98) Penguins! (x32 Version: 2.2.0.98) Photomatix Essentials 64-bit version 3.2.1 (Version: 3.2.1) Picasa 3 (x32 Version: 3.8) Polar Bowler (x32 Version: 2.2.0.97) Polar Golfer (x32 Version: 2.2.0.98) PSE11 STI Installer (x32 Version: 11.0) Qualcomm Atheros Driver Installation Program (x32 Version: 10.0) QuickTime (x32 Version: 7.74.80.86) Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012) Realtek PCIE Card Reader (x32 Version: 6.2.8400.29029) Roads of Rome 3 (x32 Version: 2.2.0.98) Spybot - Search & Destroy (x32 Version: 1.6.2) swMSM (x32 Version: 12.0.0.1) Synaptics Pointing Device Driver (Version: 16.5.3.3) Tales of Lagoona (x32 Version: 2.2.0.110) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553065) (x32) Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2566458) (x32) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32) Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32) Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32) Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32) Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32) Update Installer for WildTangent Games App (x32) Vacation Quest™ - Australia (x32 Version: 2.2.0.98) Warcraft III (x32) WildTangent Games (x32 Version: 1.0.3.0) WildTangent Games App (HP Games) (x32 Version: 4.0.10.5) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3555.0308) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3555.0308) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3538.0513) Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) WordOv (HKCU Version: 1) Zuma's Revenge (x32 Version: 2.2.0.98) ==================== Restore Points ========================= 29-10-2013 11:41:09 Windows Update 18-11-2013 03:42:55 Scheduled Checkpoint 21-11-2013 11:39:13 ComboFix created restore point ==================== Hosts content: ========================== 2012-07-25 23:26 - 2013-11-22 05:40 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {14216C36-437E-4641-BD4D-8BEF15CE8CF8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-28] (Google Inc.) Task: {1EDCD7C3-A7B0-4383-9002-044E6AB5CA90} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-11-29] (Hewlett-Packard Company) Task: {40A4C3A9-2DE0-4576-8EFE-FE0D5581E747} - System32\Tasks\RunAsStdUser Task => C:\Users\Chris L Hendrick\AppData\Local\Oxy\Application\oxy.exe Task: {46AD6FD3-9675-470E-90D7-B8B5C2BD96AD} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {47AEC3C5-9CFE-4190-980F-CCB3363DE315} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\WSCStub.exe [2013-10-08] (Symantec Corporation) Task: {55F8CFE9-4601-4AF0-AB9A-73E4EE2907C1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company) Task: {65136D60-DD22-430E-92EF-90759032E990} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\System32\NotificationUI.exe [2013-08-15] (Microsoft Corporation) Task: {7348A324-F698-4719-8FBB-96F05ADB71C0} - System32\Tasks\Norton Security Suite\Norton Error Analyzer => C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\symerr.exe [2013-08-01] (Symantec Corporation) Task: {7536BF82-C1BF-497F-A8AA-32641EE54B30} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-05-29] (Synaptics Incorporated) Task: {8F49CAF4-6625-4DFE-A46A-E61319D2C1D3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-28] (Google Inc.) Task: {9A9D87AF-04C3-4A11-B4B5-ECE936EAFB8C} - \Desk 365 RunAsStdUser No Task File Task: {B6FDE6AA-8A7F-4962-87AF-958D05B6FBAE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-10-15] (Hewlett-Packard) Task: {F47ABD79-C1F2-4AA0-8DFB-ED879E8B7454} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company) Task: {F93A56B7-B378-4993-9970-194A0275AB13} - System32\Tasks\Norton Security Suite\Norton Error Processor => C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\symerr.exe [2013-08-01] (Symantec Corporation) Task: {FB7560AB-D106-42B4-BFB4-F6991160EE42} - System32\Tasks\AdobeAAMUpdater-1.0-WoodCreations-Chris L Hendrick => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [2011-06-16] (Adobe Systems Incorporated) Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2012-07-26 01:55 - 2012-07-26 01:53 - 00170864 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll 2012-08-08 12:36 - 2012-08-08 12:36 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll 2012-08-08 12:22 - 2012-08-08 12:22 - 00369664 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2012-11-28 14:13 - 2012-11-28 14:13 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2012-11-28 14:13 - 2012-11-28 14:13 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (11/24/2013 11:53:48 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: WoodCreations) Description: Activation of app microsoft.windowsphotos_8wekyb3d8bbwe!Microsoft.WindowsLive.ModernPhotos failed with error: -2144927141 See the Microsoft-Windows-TWinUI/Operational log for additional information. Error: (11/24/2013 11:50:27 PM) (Source: Microsoft-Windows-Immersive-Shell) (User: WoodCreations) Description: App microsoft.windowsphotos_8wekyb3d8bbwe!Microsoft.WindowsLive.ModernPhotos did not launch within its allotted time. Error: (11/24/2013 11:44:06 PM) (Source: Application Error) (User: ) Description: Faulting application name: IEXPLORE.EXE, version: 10.0.9200.16537, time stamp: 0x512347f7 Faulting module name: IEFRAME.dll, version: 10.0.9200.16736, time stamp: 0x5258c998 Exception code: 0xc0000005 Fault offset: 0x001f21a0 Faulting process id: 0x1b34 Faulting application start time: 0xIEXPLORE.EXE0 Faulting application path: IEXPLORE.EXE1 Faulting module path: IEXPLORE.EXE2 Report Id: IEXPLORE.EXE3 Faulting package full name: IEXPLORE.EXE4 Faulting package-relative application ID: IEXPLORE.EXE5 Error: (11/24/2013 11:37:23 PM) (Source: Application Error) (User: ) Description: Faulting application name: IEXPLORE.EXE, version: 10.0.9200.16537, time stamp: 0x512347f7 Faulting module name: IEFRAME.dll, version: 10.0.9200.16736, time stamp: 0x5258c998 Exception code: 0xc0000005 Fault offset: 0x001f21a0 Faulting process id: 0x1230 Faulting application start time: 0xIEXPLORE.EXE0 Faulting application path: IEXPLORE.EXE1 Faulting module path: IEXPLORE.EXE2 Report Id: IEXPLORE.EXE3 Faulting package full name: IEXPLORE.EXE4 Faulting package-relative application ID: IEXPLORE.EXE5 Error: (11/24/2013 10:50:22 PM) (Source: Application Error) (User: ) Description: Faulting application name: IEXPLORE.EXE, version: 10.0.9200.16537, time stamp: 0x512347f7 Faulting module name: IEFRAME.dll, version: 10.0.9200.16736, time stamp: 0x5258c998 Exception code: 0xc0000005 Fault offset: 0x001f21a0 Faulting process id: 0x11c4 Faulting application start time: 0xIEXPLORE.EXE0 Faulting application path: IEXPLORE.EXE1 Faulting module path: IEXPLORE.EXE2 Report Id: IEXPLORE.EXE3 Faulting package full name: IEXPLORE.EXE4 Faulting package-relative application ID: IEXPLORE.EXE5 Error: (11/24/2013 08:30:05 PM) (Source: Application Error) (User: ) Description: Faulting application name: IEXPLORE.EXE, version: 10.0.9200.16537, time stamp: 0x512347f7 Faulting module name: IEFRAME.dll, version: 10.0.9200.16736, time stamp: 0x5258c998 Exception code: 0xc0000005 Fault offset: 0x001f21a0 Faulting process id: 0xd0c Faulting application start time: 0xIEXPLORE.EXE0 Faulting application path: IEXPLORE.EXE1 Faulting module path: IEXPLORE.EXE2 Report Id: IEXPLORE.EXE3 Faulting package full name: IEXPLORE.EXE4 Faulting package-relative application ID: IEXPLORE.EXE5 Error: (11/24/2013 08:17:04 PM) (Source: Application Error) (User: ) Description: Faulting application name: IEXPLORE.EXE, version: 10.0.9200.16537, time stamp: 0x512347f7 Faulting module name: IEFRAME.dll, version: 10.0.9200.16736, time stamp: 0x5258c998 Exception code: 0xc0000005 Fault offset: 0x001f21a0 Faulting process id: 0x2260 Faulting application start time: 0xIEXPLORE.EXE0 Faulting application path: IEXPLORE.EXE1 Faulting module path: IEXPLORE.EXE2 Report Id: IEXPLORE.EXE3 Faulting package full name: IEXPLORE.EXE4 Faulting package-relative application ID: IEXPLORE.EXE5 Error: (11/24/2013 07:43:55 PM) (Source: Application Error) (User: ) Description: Faulting application name: IEXPLORE.EXE, version: 10.0.9200.16537, time stamp: 0x512347f7 Faulting module name: IEFRAME.dll, version: 10.0.9200.16736, time stamp: 0x5258c998 Exception code: 0xc0000005 Fault offset: 0x001f21a0 Faulting process id: 0x2a68 Faulting application start time: 0xIEXPLORE.EXE0 Faulting application path: IEXPLORE.EXE1 Faulting module path: IEXPLORE.EXE2 Report Id: IEXPLORE.EXE3 Faulting package full name: IEXPLORE.EXE4 Faulting package-relative application ID: IEXPLORE.EXE5 Error: (11/24/2013 07:37:38 PM) (Source: Customer Experience Improvement Program) (User: ) Description: 80070005 Error: (11/24/2013 06:06:06 PM) (Source: Application Error) (User: ) Description: Faulting application name: IEXPLORE.EXE, version: 10.0.9200.16537, time stamp: 0x512347f7 Faulting module name: IEFRAME.dll, version: 10.0.9200.16736, time stamp: 0x5258c998 Exception code: 0xc0000005 Fault offset: 0x001f21a0 Faulting process id: 0x3cc Faulting application start time: 0xIEXPLORE.EXE0 Faulting application path: IEXPLORE.EXE1 Faulting module path: IEXPLORE.EXE2 Report Id: IEXPLORE.EXE3 Faulting package full name: IEXPLORE.EXE4 Faulting package-relative application ID: IEXPLORE.EXE5 System errors: ============= Error: (11/24/2013 11:53:42 PM) (Source: DCOM) (User: WoodCreations) Description: Windows.Networking.BackgroundTransfer.Internal.BackgroundTransferTask.ClassId.1 Error: (11/24/2013 06:06:59 PM) (Source: cdrom) (User: ) Description: The device, \Device\CdRom0, is not ready for access yet. Error: (11/23/2013 10:54:52 PM) (Source: cdrom) (User: ) Description: The device, \Device\CdRom0, is not ready for access yet. Error: (11/23/2013 06:27:05 PM) (Source: cdrom) (User: ) Description: The device, \Device\CdRom0, is not ready for access yet. Error: (11/23/2013 02:11:55 PM) (Source: cdrom) (User: ) Description: The device, \Device\CdRom0, is not ready for access yet. Error: (11/23/2013 02:11:35 PM) (Source: cdrom) (User: ) Description: The device, \Device\CdRom0, is not ready for access yet. Error: (11/23/2013 02:11:20 PM) (Source: cdrom) (User: ) Description: The device, \Device\CdRom0, is not ready for access yet. Error: (11/23/2013 11:17:44 AM) (Source: DCOM) (User: WoodCreations) Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9} Error: (11/23/2013 11:17:44 AM) (Source: DCOM) (User: WoodCreations) Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9} Error: (11/22/2013 11:08:08 PM) (Source: cdrom) (User: ) Description: The device, \Device\CdRom0, is not ready for access yet. Microsoft Office Sessions: ========================= Error: (11/24/2013 11:53:48 PM) (Source: Microsoft-Windows-Immersive-Shell)(User: WoodCreations) Description: microsoft.windowsphotos_8wekyb3d8bbwe!Microsoft.WindowsLive.ModernPhotos-2144927141 Error: (11/24/2013 11:50:27 PM) (Source: Microsoft-Windows-Immersive-Shell)(User: WoodCreations) Description: microsoft.windowsphotos_8wekyb3d8bbwe!Microsoft.WindowsLive.ModernPhotos Error: (11/24/2013 11:44:06 PM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE10.0.9200.16537512347f7IEFRAME.dll10.0.9200.167365258c998c0000005001f21a01b3401cee9a0773e527bC:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\SYSTEM32\IEFRAME.dll987be433-5594-11e3-becc-8434978b5abc Error: (11/24/2013 11:37:23 PM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE10.0.9200.16537512347f7IEFRAME.dll10.0.9200.167365258c998c0000005001f21a0123001cee999db4eb663C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\SYSTEM32\IEFRAME.dlla866da92-5593-11e3-becc-8434978b5abc Error: (11/24/2013 10:50:22 PM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE10.0.9200.16537512347f7IEFRAME.dll10.0.9200.167365258c998c0000005001f21a011c401cee991b5e207c7C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\SYSTEM32\IEFRAME.dll16c71adb-558d-11e3-becc-8434978b5abc Error: (11/24/2013 08:30:05 PM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE10.0.9200.16537512347f7IEFRAME.dll10.0.9200.167365258c998c0000005001f21a0d0c01cee9847cb04e47C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\SYSTEM32\IEFRAME.dll7ddb2240-5579-11e3-becc-8434978b5abc Error: (11/24/2013 08:17:04 PM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE10.0.9200.16537512347f7IEFRAME.dll10.0.9200.167365258c998c0000005001f21a0226001cee97fd151c8f5C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\SYSTEM32\IEFRAME.dllac62cf1f-5577-11e3-becc-8434978b5abc Error: (11/24/2013 07:43:55 PM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE10.0.9200.16537512347f7IEFRAME.dll10.0.9200.167365258c998c0000005001f21a02a6801cee97f138807e3C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\SYSTEM32\IEFRAME.dll0b437d03-5573-11e3-becc-8434978b5abc Error: (11/24/2013 07:37:38 PM) (Source: Customer Experience Improvement Program)(User: ) Description: 80070005 Error: (11/24/2013 06:06:06 PM) (Source: Application Error)(User: ) Description: IEXPLORE.EXE10.0.9200.16537512347f7IEFRAME.dll10.0.9200.167365258c998c0000005001f21a03cc01cee96ce87dfdd1C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\SYSTEM32\IEFRAME.dll610180d5-5565-11e3-becc-8434978b5abc CodeIntegrity Errors: =================================== Date: 2013-06-12 18:05:03.476 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\EEL64A.dll because the set of per-page image hashes could not be found on the system. Date: 2013-06-12 18:02:25.539 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\EEL64A.dll because the set of per-page image hashes could not be found on the system. Date: 2013-06-12 18:02:03.586 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\EEL64A.dll because the set of per-page image hashes could not be found on the system. Date: 2013-06-11 20:44:04.630 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\EEL64A.dll because the set of per-page image hashes could not be found on the system. Date: 2013-06-11 20:41:18.877 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\EEL64A.dll because the set of per-page image hashes could not be found on the system. Date: 2013-06-11 19:32:22.571 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\EEL64A.dll because the set of per-page image hashes could not be found on the system. Date: 2013-06-11 19:31:42.433 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\EEL64A.dll because the set of per-page image hashes could not be found on the system. Date: 2013-06-11 17:46:03.386 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\EEL64A.dll because the set of per-page image hashes could not be found on the system. Date: 2013-06-11 05:56:19.580 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\EEL64A.dll because the set of per-page image hashes could not be found on the system. Date: 2013-06-10 21:48:17.618 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\EEL64A.dll because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Percentage of memory in use: 28% Total physical RAM: 7650.26 MB Available physical RAM: 5481.54 MB Total Pagefile: 8802.26 MB Available Pagefile: 6403.65 MB Total Virtual: 8192 MB Available Virtual: 8191.77 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:905.44 GB) (Free:823.43 GB) NTFS ==>[system with boot components (obtained from reading drive)] Drive d: (RECOVERY) (Fixed) (Total:25.31 GB) (Free:3.02 GB) NTFS ==>[system with boot components (obtained from reading drive)] Drive e: (Warcraft III) (CDROM) (Total:0.62 GB) (Free:0 GB) CDFS Drive f: () (Removable) (Total:29.71 GB) (Free:29.62 GB) FAT32 ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 932 GB) (Disk ID: 1EFAD293) Partition: GPT Partition Type ======================================================== Disk: 1 (Size: 30 GB) (Disk ID: 00000000) Partition 1: (Not Active) - (Size=30 GB) - (Type=0C) ==================== End Of Log ============================
  12. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-11-2013 Ran by Chris L Hendrick (administrator) on WOODCREATIONS on 25-11-2013 05:59:51 Running from C:\Users\Chris L Hendrick\Downloads Windows 8 (X64) OS Language: English(US) Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe (Hewlett-Packard Company) C:\Windows\System32\hpservice.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Cypherix Software (India) Pvt. Ltd.) C:\Windows\SysWOW64\cypxsrv10.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.165\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.21.165\GoogleCrashHandler64.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe (WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Microsoft Corporation) C:\Windows\System32\LogonUI.exe (Microsoft Corporation) C:\Windows\System32\LogonUI.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) C:\Windows\System32\LogonUI.exe (Microsoft Corporation) C:\Windows\System32\LogonUI.exe (Microsoft Corporation) C:\Windows\System32\LogonUI.exe (Microsoft Corporation) C:\Windows\System32\LogonUI.exe (Microsoft Corporation) C:\Windows\System32\LogonUI.exe (AMD) C:\Windows\System32\atieclxx.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe\LiveComm.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16683_none_62280e15510f8e79\TiWorker.exe (Microsoft Corporation) C:\Windows\System32\msiexec.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe [499608 2011-06-16] (Adobe Systems Incorporated) HKLM\...\Run: [sysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1664000 2013-06-12] (IDT, Inc.) HKCU\...\Run: [spybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.) HKLM-x32\...\Run: [startCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-08] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [580512 2012-07-09] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HP CoolSense] - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1343904 2012-11-05] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://do-search.com/?type=hp&ts=1384647336&from=mp3&uid=HitachiXHTS541010A9E680_J8100076GHWPEAGHWPEAX HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://do-search.com/web/?type=ds&ts=1384647336&from=mp3&uid=HitachiXHTS541010A9E680_J8100076GHWPEAGHWPEAX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=N360&pvid=20.4.0.40 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://do-search.com/web/?type=ds&ts=1384647336&from=mp3&uid=HitachiXHTS541010A9E680_J8100076GHWPEAGHWPEAX&q={searchTerms} SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms} SearchScopes: HKLM - {E598BBD8-5D35-4A18-B21A-94FB88D45535} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms} SearchScopes: HKLM-x32 - {E598BBD8-5D35-4A18-B21A-94FB88D45535} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-154371-11896-2/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms} BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine64\21.1.0.18\CoIEPlg.dll (Symantec Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: WordOv - {14E5E74B-0B52-4669-8B78-6527C7A09831} - C:\Users\Chris L Hendrick\AppData\Roaming\WordOv\temp.dat () BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\CoIEPlg.dll (Symantec Corporation) BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\IPS\IPSBHO.dll (Symantec Corporation) BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine64\21.1.0.18\CoIEPlg.dll (Symantec Corporation) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\CoIEPlg.dll (Symantec Corporation) Tcpip\Parameters: [DhcpNameServer] 75.75.76.76 75.75.75.75 ==================== Services (Whitelisted) ================= R2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171600 2012-09-17] (Adobe Systems Incorporated) R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-08-08] (Advanced Micro Devices, Inc.) R2 cypherix10service; C:\Windows\SysWOW64\cypxsrv10.exe [1055072 2012-01-18] (Cypherix Software (India) Pvt. Ltd.) R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [240736 2013-09-05] (WildTangent) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 N360; C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe [264360 2013-10-18] (Symantec Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-01] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-17] (Advanced Micro Devices) R1 BHDrvx64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20131114.001\BHDrvx64.sys [1524824 2013-11-01] (Symantec Corporation) R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1501000.012\ccSetx64.sys [162392 2013-09-25] (Symantec Corporation) R1 cypxdv10; C:\Windows\system32\Drivers\cypxdv10.sys [102656 2012-01-18] (Cypherix Software (India) Pvt. Ltd.) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-11-19] (Symantec Corporation) R1 IDSVia64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20131120.003\IDSvia64.sys [521816 2013-11-19] (Symantec Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 NAVENG; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20131120.017\ENG64.SYS [126040 2013-11-19] (Symantec Corporation) R3 NAVEX15; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20131120.017\EX64.SYS [2099288 2013-11-19] (Symantec Corporation) R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-10] (Corel Corporation) R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [269968 2012-07-03] (Realtek Semiconductor Corp.) S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-08-24] (Synaptics Incorporated) S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [43832 2012-08-24] (Synaptics Incorporated) R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1501000.012\SRTSP64.SYS [858200 2013-09-26] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSPX64.SYS [36952 2013-09-09] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\N360x64\1501000.012\SYMDS64.SYS [493656 2013-09-09] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\N360x64\1501000.012\SYMEFA64.SYS [1147480 2013-09-26] (Symantec Corporation) S4 SymELAM; C:\Windows\system32\drivers\N360x64\1501000.012\SymELAM.sys [23568 2013-09-09] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-11-18] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\N360x64\1501000.012\Ironx64.SYS [264280 2013-09-26] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1501000.012\SYMNETS.SYS [590936 2013-09-25] (Symantec Corporation) R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20288 2012-08-03] (Hewlett-Packard Development Company, L.P.) S1 AntiLog32; \??\C:\Windows\system32\drivers\AntiLog64.sys [x] U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2012-09-20] (Microsoft Corporation) S3 keycrypt; system32\DRIVERS\KeyCrypt64.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-11-25 05:59 - 2013-11-25 06:00 - 00015439 _____ C:\Users\Chris L Hendrick\Downloads\FRST.txt 2013-11-25 05:59 - 2013-11-25 05:59 - 00000000 ____D C:\FRST 2013-11-25 05:58 - 2013-11-25 05:59 - 01958440 _____ (Farbar) C:\Users\Chris L Hendrick\Downloads\FRST64.exe 2013-11-24 23:49 - 2013-11-24 23:50 - 00000000 ____D C:\Users\Chris L Hendrick\Desktop\crib 2013-11-24 21:51 - 2013-11-24 21:51 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{A77F0B18-E3C2-483D-BE98-4117E9D02005} 2013-11-24 08:22 - 2013-11-24 08:22 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{925EB317-ECA8-4EA1-B528-B2204333718E} 2013-11-23 16:54 - 2013-11-05 16:58 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-11-23 16:53 - 2013-11-05 16:58 - 00694232 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-11-23 11:19 - 2013-10-01 17:37 - 02035712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2013-11-23 11:19 - 2013-10-01 17:26 - 02304512 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2013-11-23 11:19 - 2013-08-23 01:22 - 02062848 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll 2013-11-23 11:19 - 2013-08-22 19:44 - 01711616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll 2013-11-23 10:50 - 2013-11-23 10:50 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{ACDD2058-A770-47EA-9085-36A63227C358} 2013-11-22 22:23 - 2013-11-22 22:23 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{EB19AF16-C806-4A78-8366-087541F4D132} 2013-11-22 05:45 - 2013-11-22 05:45 - 00016495 _____ C:\ComboFix.txt 2013-11-22 05:30 - 2013-11-22 05:30 - 00001181 _____ C:\CF-Submit.htm 2013-11-22 05:23 - 2013-11-22 05:24 - 05147802 ____R (Swearware) C:\Users\Chris L Hendrick\Downloads\ComboFix.exe 2013-11-21 22:06 - 2013-11-21 22:06 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{4061554F-788F-4D01-A76F-1DD510702D8C} 2013-11-21 19:09 - 2013-11-21 19:09 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{240BB396-AF8B-4A10-8A93-422FC165A7D4} 2013-11-21 05:39 - 2011-06-26 00:45 - 00256000 _____ C:\Windows\PEV.exe 2013-11-21 05:39 - 2010-11-07 11:20 - 00208896 _____ C:\Windows\MBR.exe 2013-11-21 05:39 - 2009-04-19 22:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2013-11-21 05:39 - 2000-08-30 18:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2013-11-21 05:39 - 2000-08-30 18:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2013-11-21 05:39 - 2000-08-30 18:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe 2013-11-21 05:39 - 2000-08-30 18:00 - 00098816 _____ C:\Windows\sed.exe 2013-11-21 05:39 - 2000-08-30 18:00 - 00080412 _____ C:\Windows\grep.exe 2013-11-21 05:39 - 2000-08-30 18:00 - 00068096 _____ C:\Windows\zip.exe 2013-11-21 05:34 - 2013-11-22 05:46 - 00000000 ____D C:\Qoobox 2013-11-21 05:33 - 2013-11-21 05:51 - 00000000 ____D C:\Windows\erdnt 2013-11-20 19:37 - 2013-10-10 05:53 - 00096600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys 2013-11-20 19:37 - 2013-10-10 03:21 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2013-11-20 19:37 - 2013-10-10 03:20 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL 2013-11-20 19:37 - 2013-10-02 17:25 - 01300992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2013-11-20 19:37 - 2013-10-01 17:37 - 01569280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-11-20 19:37 - 2013-10-01 17:26 - 01890816 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-11-20 19:37 - 2013-10-01 16:22 - 01022976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2013-11-20 19:37 - 2013-09-23 16:30 - 00419328 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2013-11-20 19:37 - 2013-09-23 16:30 - 00323072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2013-11-20 19:37 - 2013-09-13 19:15 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2013-11-20 19:37 - 2013-09-13 16:36 - 00628736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2013-11-20 19:37 - 2013-09-13 16:36 - 00247296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll 2013-11-20 19:37 - 2013-09-13 16:36 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2013-11-20 19:37 - 2013-09-13 16:36 - 00084992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2013-11-20 19:37 - 2013-09-13 16:36 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2013-11-20 19:37 - 2013-09-13 16:34 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2013-11-20 19:37 - 2013-09-13 16:33 - 03279360 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2013-11-20 19:37 - 2013-09-13 16:33 - 01622016 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2013-11-20 19:37 - 2013-09-13 16:33 - 00773120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2013-11-20 19:37 - 2013-09-13 16:33 - 00328192 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll 2013-11-20 19:37 - 2013-09-13 16:33 - 00252928 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll 2013-11-20 19:37 - 2013-09-13 16:33 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll 2013-11-20 19:37 - 2013-09-13 16:33 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2013-11-20 19:37 - 2013-09-13 16:33 - 00099328 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2013-11-20 19:37 - 2013-09-03 21:11 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-11-20 19:37 - 2013-08-29 23:43 - 00061784 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\crashdmp.sys 2013-11-20 19:37 - 2013-08-29 23:20 - 01173504 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll 2013-11-20 19:37 - 2013-08-29 17:48 - 00914432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAutomationCore.dll 2013-11-20 19:37 - 2013-08-21 00:39 - 00465240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys 2013-11-20 19:37 - 2013-08-10 00:30 - 00151896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tpm.sys 2013-11-20 19:37 - 2013-08-09 23:21 - 00817152 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2013-11-20 19:37 - 2013-08-09 21:58 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2013-11-20 19:37 - 2013-07-24 17:10 - 10799104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll 2013-11-20 19:37 - 2013-07-24 17:07 - 13661696 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll 2013-11-20 19:37 - 2013-07-11 19:38 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\WSDApi.dll 2013-11-20 19:37 - 2013-07-11 19:30 - 00485376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSDApi.dll 2013-11-20 19:36 - 2013-10-12 02:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-11-20 19:36 - 2013-10-12 02:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-11-20 19:36 - 2013-10-12 02:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-11-20 19:36 - 2013-10-12 02:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-11-20 19:36 - 2013-10-12 02:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-11-20 19:36 - 2013-10-12 02:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-11-20 19:36 - 2013-10-12 02:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-11-20 19:36 - 2013-10-12 02:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-11-20 19:36 - 2013-10-12 02:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-11-20 19:36 - 2013-10-12 01:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-11-20 19:36 - 2013-10-12 01:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-11-20 19:36 - 2013-10-12 01:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-11-20 19:36 - 2013-10-12 01:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-11-20 19:36 - 2013-10-12 01:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-11-20 19:36 - 2013-10-12 01:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-11-20 19:36 - 2013-10-12 01:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-11-20 19:36 - 2013-10-12 01:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-11-20 19:09 - 2013-11-20 19:09 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{0183819B-2A25-4127-B44C-861B8B6301C5} 2013-11-20 19:04 - 2013-11-17 12:48 - 00001801 _____ C:\Users\Chris L Hendrick\Desktop\iTunes.lnk 2013-11-20 06:23 - 2013-11-20 06:23 - 00014625 _____ C:\Users\Chris L Hendrick\Desktop\JRT.txt 2013-11-20 06:11 - 2013-11-20 06:11 - 00000000 ____D C:\Windows\ERUNT 2013-11-20 06:09 - 2013-11-20 06:11 - 01034531 _____ (Thisisu) C:\Users\Chris L Hendrick\Downloads\JRT.exe 2013-11-20 05:55 - 2013-11-20 05:56 - 00000000 ____D C:\AdwCleaner 2013-11-20 05:52 - 2013-11-20 05:52 - 01085542 _____ C:\Users\Chris L Hendrick\Downloads\adwcleaner.exe 2013-11-19 17:42 - 2013-11-19 17:42 - 00001808 _____ C:\sc-cleaner.txt 2013-11-19 17:40 - 2013-11-19 17:40 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\Chris L Hendrick\Downloads\sc-cleaner.exe 2013-11-18 21:19 - 2013-11-18 21:19 - 00000000 ____D C:\Windows\System32\Tasks\Norton Security Suite 2013-11-18 21:18 - 2013-11-20 06:05 - 00000000 ____D C:\Users\Chris L Hendrick\Desktop\log files for forum 2013-11-18 21:14 - 2013-11-18 21:14 - 00688992 ____R (Swearware) C:\Users\Chris L Hendrick\Downloads\dds.com 2013-11-18 20:09 - 2013-11-18 21:11 - 00002440 _____ C:\Users\Public\Desktop\Norton Security Suite.lnk 2013-11-18 19:41 - 2013-11-18 19:41 - 00001113 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2013-11-18 19:41 - 2013-11-18 19:41 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Roaming\Malwarebytes 2013-11-18 19:40 - 2013-11-19 19:29 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-11-18 19:40 - 2013-11-18 19:40 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-18 19:40 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-11-18 19:39 - 2013-11-18 19:39 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Chris L Hendrick\Downloads\mbam-setup-1.75.0.1300.exe 2013-11-17 21:48 - 2013-11-17 21:48 - 00000962 _____ C:\Windows\wininit.ini 2013-11-17 21:28 - 2013-11-17 23:18 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-11-17 21:28 - 2013-11-17 21:30 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2013-11-17 21:28 - 2013-11-17 21:28 - 00001262 _____ C:\Users\Chris L Hendrick\Desktop\Spybot - Search & Destroy.lnk 2013-11-17 21:26 - 2013-11-17 21:26 - 16409960 _____ (Safer Networking Limited ) C:\Users\Chris L Hendrick\Downloads\spybotsd162.exe 2013-11-17 13:10 - 2013-11-17 13:10 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Roaming\eCyber 2013-11-17 13:08 - 2013-11-17 13:08 - 00000000 ____D C:\Windows\system32\log 2013-11-17 12:47 - 2013-11-17 12:48 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-11-17 12:47 - 2013-11-17 12:48 - 00000000 ____D C:\Program Files\iTunes 2013-11-17 12:47 - 2013-11-17 12:48 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-11-17 12:47 - 2013-11-17 12:47 - 00000000 ____D C:\Program Files\iPod 2013-11-16 18:31 - 2013-11-16 18:31 - 00003212 _____ C:\Windows\System32\Tasks\{47569167-7622-4A8F-BB6A-974A27B7C7D8} 2013-11-16 18:19 - 2013-11-16 18:19 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Roaming\WordOv 2013-11-16 18:19 - 2013-11-16 18:19 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WordOv 2013-11-16 18:15 - 2013-11-16 18:15 - 00003518 _____ C:\Windows\System32\Tasks\RunAsStdUser Task 2013-11-16 18:14 - 2013-11-16 18:14 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\Chromium 2013-11-16 18:08 - 2013-11-16 18:08 - 05332936 _____ C:\Users\Chris L Hendrick\Downloads\.exe_Downloader.exe 2013-11-15 19:25 - 2013-11-15 19:29 - 00000000 ____D C:\Users\Chris L Hendrick\Desktop\to print 2013-11-12 05:54 - 2013-11-12 05:54 - 00000000 ____D C:\Users\Chris L Hendrick\Desktop\Funny pics 2013-11-04 19:32 - 2013-11-04 19:32 - 00002018 _____ C:\Users\Chris L Hendrick\Documents\NV English parent letter 2013.txt 2013-11-02 18:32 - 2013-11-24 15:27 - 00000000 ____D C:\Users\Chris L Hendrick\Documents\Jeep ==================== One Month Modified Files and Folders ======= 2013-11-25 06:00 - 2013-11-25 05:59 - 00015439 _____ C:\Users\Chris L Hendrick\Downloads\FRST.txt 2013-11-25 06:00 - 2012-12-25 03:50 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4104927379-2764548753-2349426943-1002 2013-11-25 06:00 - 2012-07-26 02:12 - 00000000 ____D C:\Windows\system32\sru 2013-11-25 05:59 - 2013-11-25 05:59 - 00000000 ____D C:\FRST 2013-11-25 05:59 - 2013-11-25 05:58 - 01958440 _____ (Farbar) C:\Users\Chris L Hendrick\Downloads\FRST64.exe 2013-11-25 05:58 - 2012-12-25 03:45 - 00003990 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D3E60DB6-9612-443B-BC5E-BE6E9263C33F} 2013-11-25 05:58 - 2012-12-25 03:41 - 01873915 _____ C:\Windows\WindowsUpdate.log 2013-11-25 05:56 - 2012-12-28 16:57 - 00000942 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-11-24 23:50 - 2013-11-24 23:49 - 00000000 ____D C:\Users\Chris L Hendrick\Desktop\crib 2013-11-24 23:27 - 2012-12-28 16:57 - 00000946 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-11-24 21:51 - 2013-11-24 21:51 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{A77F0B18-E3C2-483D-BE98-4117E9D02005} 2013-11-24 15:27 - 2013-11-02 18:32 - 00000000 ____D C:\Users\Chris L Hendrick\Documents\Jeep 2013-11-24 15:27 - 2012-07-26 01:28 - 00941050 _____ C:\Windows\system32\PerfStringBackup.INI 2013-11-24 08:22 - 2013-11-24 08:22 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{925EB317-ECA8-4EA1-B528-B2204333718E} 2013-11-23 22:47 - 2013-01-31 12:14 - 00000000 ____D C:\Program Files (x86)\Warcraft III 2013-11-23 21:32 - 2012-12-26 12:55 - 00003986 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{988327F8-5136-4646-945D-2B5007A20155} 2013-11-23 18:59 - 2012-12-26 13:00 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4104927379-2764548753-2349426943-1005 2013-11-23 18:57 - 2013-08-29 22:34 - 00000000 ____D C:\Users\Nathyn Hendrick\AppData\Roaming\.minecraft 2013-11-23 18:53 - 2012-12-26 10:15 - 104857600 _____ C:\Users\Chris L Hendrick\Documents\cxl1705 2013-11-23 16:53 - 2012-07-26 01:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-11-23 16:51 - 2012-07-25 23:26 - 00524288 ___SH C:\Windows\system32\config\BBI 2013-11-23 16:49 - 2012-07-26 02:12 - 00000000 ___RD C:\Windows\ToastData 2013-11-23 16:49 - 2012-07-26 02:12 - 00000000 ____D C:\Windows\WinStore 2013-11-23 11:33 - 2013-01-20 12:40 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-11-23 11:28 - 2013-08-17 07:35 - 00000000 ____D C:\Windows\system32\MRT 2013-11-23 11:25 - 2013-08-29 22:22 - 00000000 ____D C:\Users\Brandyn L. Hendrick\AppData\Roaming\.minecraft 2013-11-23 11:25 - 2012-12-26 21:45 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-11-23 11:22 - 2013-08-29 22:16 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4104927379-2764548753-2349426943-1007 2013-11-23 11:20 - 2012-07-26 02:12 - 00000000 ____D C:\Windows\AUInstallAgent 2013-11-23 10:50 - 2013-11-23 10:50 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{ACDD2058-A770-47EA-9085-36A63227C358} 2013-11-22 22:23 - 2013-11-22 22:23 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{EB19AF16-C806-4A78-8366-087541F4D132} 2013-11-22 05:46 - 2013-11-21 05:34 - 00000000 ____D C:\Qoobox 2013-11-22 05:45 - 2013-11-22 05:45 - 00016495 _____ C:\ComboFix.txt 2013-11-22 05:40 - 2012-07-25 23:26 - 00000215 _____ C:\Windows\system.ini 2013-11-22 05:39 - 2012-08-03 16:23 - 00701856 _____ C:\Windows\PFRO.log 2013-11-22 05:30 - 2013-11-22 05:30 - 00001181 _____ C:\CF-Submit.htm 2013-11-22 05:24 - 2013-11-22 05:23 - 05147802 ____R (Swearware) C:\Users\Chris L Hendrick\Downloads\ComboFix.exe 2013-11-21 22:06 - 2013-11-21 22:06 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{4061554F-788F-4D01-A76F-1DD510702D8C} 2013-11-21 19:09 - 2013-11-21 19:09 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{240BB396-AF8B-4A10-8A93-422FC165A7D4} 2013-11-21 05:54 - 2012-07-25 23:37 - 00000000 __RHD C:\Users\Default 2013-11-21 05:51 - 2013-11-21 05:33 - 00000000 ____D C:\Windows\erdnt 2013-11-20 19:09 - 2013-11-20 19:09 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\{0183819B-2A25-4127-B44C-861B8B6301C5} 2013-11-20 06:23 - 2013-11-20 06:23 - 00014625 _____ C:\Users\Chris L Hendrick\Desktop\JRT.txt 2013-11-20 06:11 - 2013-11-20 06:11 - 00000000 ____D C:\Windows\ERUNT 2013-11-20 06:11 - 2013-11-20 06:09 - 01034531 _____ (Thisisu) C:\Users\Chris L Hendrick\Downloads\JRT.exe 2013-11-20 06:05 - 2013-11-18 21:18 - 00000000 ____D C:\Users\Chris L Hendrick\Desktop\log files for forum 2013-11-20 05:58 - 2012-07-26 02:12 - 00000000 ___HD C:\Windows\ELAMBKUP 2013-11-20 05:56 - 2013-11-20 05:55 - 00000000 ____D C:\AdwCleaner 2013-11-20 05:52 - 2013-11-20 05:52 - 01085542 _____ C:\Users\Chris L Hendrick\Downloads\adwcleaner.exe 2013-11-19 19:29 - 2013-11-18 19:40 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-11-19 17:42 - 2013-11-19 17:42 - 00001808 _____ C:\sc-cleaner.txt 2013-11-19 17:40 - 2013-11-19 17:40 - 00406264 _____ (Bleeping Computer, LLC) C:\Users\Chris L Hendrick\Downloads\sc-cleaner.exe 2013-11-18 21:19 - 2013-11-18 21:19 - 00000000 ____D C:\Windows\System32\Tasks\Norton Security Suite 2013-11-18 21:14 - 2013-11-18 21:14 - 00688992 ____R (Swearware) C:\Users\Chris L Hendrick\Downloads\dds.com 2013-11-18 21:14 - 2012-07-25 23:26 - 00262144 ___SH C:\Windows\system32\config\ELAM 2013-11-18 21:11 - 2013-11-18 20:09 - 00002440 _____ C:\Users\Public\Desktop\Norton Security Suite.lnk 2013-11-18 21:11 - 2013-02-16 23:36 - 00003228 _____ C:\Windows\System32\Tasks\Norton WSC Integration 2013-11-18 21:11 - 2013-02-16 23:35 - 00000000 ____D C:\Windows\system32\Drivers\N360x64 2013-11-18 20:09 - 2013-02-16 23:36 - 00177752 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS 2013-11-18 20:09 - 2013-02-16 23:36 - 00008222 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT 2013-11-18 20:09 - 2012-11-18 21:25 - 00000000 ____D C:\ProgramData\Norton 2013-11-18 20:05 - 2013-02-16 23:35 - 00000000 ____D C:\Program Files (x86)\Norton Security Suite 2013-11-18 20:01 - 2013-02-16 23:33 - 00000000 ____D C:\Users\Public\Downloads\Norton 2013-11-18 19:41 - 2013-11-18 19:41 - 00001113 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2013-11-18 19:41 - 2013-11-18 19:41 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Roaming\Malwarebytes 2013-11-18 19:40 - 2013-11-18 19:40 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-11-18 19:39 - 2013-11-18 19:39 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Chris L Hendrick\Downloads\mbam-setup-1.75.0.1300.exe 2013-11-17 23:18 - 2013-11-17 21:28 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-11-17 21:48 - 2013-11-17 21:48 - 00000962 _____ C:\Windows\wininit.ini 2013-11-17 21:30 - 2013-11-17 21:28 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2013-11-17 21:28 - 2013-11-17 21:28 - 00001262 _____ C:\Users\Chris L Hendrick\Desktop\Spybot - Search & Destroy.lnk 2013-11-17 21:26 - 2013-11-17 21:26 - 16409960 _____ (Safer Networking Limited ) C:\Users\Chris L Hendrick\Downloads\spybotsd162.exe 2013-11-17 13:10 - 2013-11-17 13:10 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Roaming\eCyber 2013-11-17 13:08 - 2013-11-17 13:08 - 00000000 ____D C:\Windows\system32\log 2013-11-17 13:08 - 2012-07-09 14:40 - 00421032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp100.dll 2013-11-17 12:48 - 2013-11-20 19:04 - 00001801 _____ C:\Users\Chris L Hendrick\Desktop\iTunes.lnk 2013-11-17 12:48 - 2013-11-17 12:47 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-11-17 12:48 - 2013-11-17 12:47 - 00000000 ____D C:\Program Files\iTunes 2013-11-17 12:48 - 2013-11-17 12:47 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-11-17 12:47 - 2013-11-17 12:47 - 00000000 ____D C:\Program Files\iPod 2013-11-17 12:25 - 2013-08-29 22:10 - 00004002 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{8C801562-28AB-47F9-8DCE-8956E24A2C43} 2013-11-16 18:31 - 2013-11-16 18:31 - 00003212 _____ C:\Windows\System32\Tasks\{47569167-7622-4A8F-BB6A-974A27B7C7D8} 2013-11-16 18:31 - 2012-12-25 03:45 - 00000000 ___RD C:\Users\Chris L Hendrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-11-16 18:29 - 2012-12-26 17:46 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log 2013-11-16 18:29 - 2012-12-26 17:46 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2013-11-16 18:19 - 2013-11-16 18:19 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Roaming\WordOv 2013-11-16 18:19 - 2013-11-16 18:19 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WordOv 2013-11-16 18:16 - 2012-12-25 03:45 - 00001652 _____ C:\Users\Chris L Hendrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2013-11-16 18:15 - 2013-11-16 18:15 - 00003518 _____ C:\Windows\System32\Tasks\RunAsStdUser Task 2013-11-16 18:15 - 2012-12-25 03:41 - 00000000 ____D C:\Users\Chris L Hendrick 2013-11-16 18:14 - 2013-11-16 18:14 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Local\Chromium 2013-11-16 18:08 - 2013-11-16 18:08 - 05332936 _____ C:\Users\Chris L Hendrick\Downloads\.exe_Downloader.exe 2013-11-16 09:11 - 2013-03-02 21:17 - 00000000 ____D C:\Users\Chris L Hendrick\AppData\Roaming\.minecraft 2013-11-15 19:29 - 2013-11-15 19:25 - 00000000 ____D C:\Users\Chris L Hendrick\Desktop\to print 2013-11-12 05:54 - 2013-11-12 05:54 - 00000000 ____D C:\Users\Chris L Hendrick\Desktop\Funny pics 2013-11-05 16:58 - 2013-11-23 16:54 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-11-05 16:58 - 2013-11-23 16:53 - 00694232 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-11-04 19:32 - 2013-11-04 19:32 - 00002018 _____ C:\Users\Chris L Hendrick\Documents\NV English parent letter 2013.txt 2013-11-04 19:24 - 2013-02-03 09:31 - 00000000 ____D C:\Users\Chris L Hendrick\Documents\Outlook Files 2013-10-30 20:48 - 2013-09-10 18:07 - 00000000 ____D C:\Users\Chris L Hendrick\Desktop\Nathyn football (2013) 2013-10-29 06:37 - 2012-07-26 02:12 - 00000000 ____D C:\Windows\rescache Some content of TEMP: ==================== C:\Users\Nathyn Hendrick\AppData\Local\temp\SIntf16.dll C:\Users\Nathyn Hendrick\AppData\Local\temp\SIntf32.dll C:\Users\Nathyn Hendrick\AppData\Local\temp\SIntfNT.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-11-19 19:04 ==================== End Of Log ============================
  13. Marius, Do I need to make sure all my Norton stuff is still turned off or just leave on?
  14. Marius, I got it to work. The file has been uploaded.
  15. Marius, I can upload the file to that site, but when I click on the text box to provide a link to this topic, (the thread location where file was requested), it just opens up a new tab to "quibids" and I can't actually state who the file is for or who requested it. Should I upload my file anyways?