Do-search infection?

hendu3270 · November 19, 2013

Hey guys, I seem to have a web browser hijack called "do-search.com". I can't change my home page back to msn and it just opens a window to another site if try to use the do-search. Logs attached.

dds log

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16537 BrowserJavaVersion: 10.25.2
Run by Chris L Hendrick at 21:16:07 on 2013-11-18
Microsoft Windows 8 6.2.9200.0.1252.1.1033.18.7650.6034 [GMT -6:00]
.
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton Security Suite *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Security Suite *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\system32\dwm.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\atieclxx.exe
C:\Program Files\IDT\WDM\STacSV64.exe
C:\Windows\system32\Hpservice.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
C:\Windows\system32\svchost.exe -k apphost
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\SysWOW64\cypxsrv10.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\system32\taskhostex.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Google\Update\1.3.21.165\GoogleCrashHandler.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Google\Update\1.3.21.165\GoogleCrashHandler64.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\dashost.exe
C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe\LiveComm.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe
C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe
C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.

mWinlogon: Userinit = userinit.exe,
BHO: WordOv: {14E5E74B-0B52-4669-8B78-6527C7A09831} - C:\Users\Chris L Hendrick\AppData\Roaming\WordOv\temp.dat
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\CoIEPlg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\IPS\IPSBHO.dll
BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -
BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\CoIEPlg.dll
uRun: [Facebook Update] "C:\Users\Chris L Hendrick\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
uRun: [spybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun: [HP CoolSense] C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe -byrunkey
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
IE: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
TCP: NameServer = 75.75.76.76 75.75.75.75
TCP: Interfaces\{03D64A0C-F464-4A8A-A66E-4A87E84E45E0} : DHCPNameServer = 40.20.1.201 40.20.1.203 40.20.1.202
TCP: Interfaces\{29D867D7-C9DC-44E2-8B2C-6AE050BB2900} : DHCPNameServer = 75.75.76.76 75.75.75.75
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>

x64-BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine64\21.1.0.18\CoIEPlg.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll
x64-TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine64\21.1.0.18\CoIEPlg.dll
x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-RunOnce: [NCPluginUpdater] "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update
x64-IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 amd_sata;amd_sata;C:\Windows\System32\Drivers\amd_sata.sys [2012-7-24 79528]
R0 amd_xata;amd_xata;C:\Windows\System32\Drivers\amd_xata.sys [2012-7-24 26280]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\Drivers\PxHlpa64.sys [2013-1-20 56336]
R0 SymDS;Symantec Data Store;C:\Windows\System32\Drivers\N360x64\1501000.012\SymDS64.sys [2013-11-18 493656]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\Drivers\N360x64\1501000.012\SymEFA64.sys [2013-11-18 1147480]
R1 BHDrvx64;BHDrvx64;C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [2013-11-18 1525848]
R1 ccSet_N360;N360 Settings Manager;C:\Windows\System32\Drivers\N360x64\1501000.012\ccSetx64.sys [2013-11-18 162392]
R1 cypxdv10;cypxdv10;C:\Windows\System32\Drivers\cypxdv10.sys [2012-12-26 102656]
R1 IDSVia64;IDSVia64;C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20130930.001\IDSviA64.sys [2013-11-18 520280]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\Drivers\N360x64\1501000.012\Ironx64.sys [2013-11-18 264280]
R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\Drivers\N360x64\1501000.012\symnets.sys [2013-11-18 590936]
R2 AdobeActiveFileMonitor11.0;Adobe Active File Monitor V11;C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [2012-9-17 171600]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-8-9 239616]
R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-8-8 361984]
R2 APXACC;AppEx Networks Accelerator LWF;C:\Windows\System32\Drivers\appexDrv.sys [2012-11-18 199008]
R2 cypherix10service;Cypherix 10 service;C:\Windows\SysWOW64\cypxsrv10.exe [2012-12-26 1055072]
R2 GamesAppIntegrationService;GamesAppIntegrationService;C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [2013-9-5 240736]
R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2012-9-27 86528]
R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2012-9-24 31040]
R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-7-9 35232]
R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-11-18 2451456]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-11-18 418376]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-11-18 701512]
R2 N360;Norton Security Suite;C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe [2013-11-18 264360]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\Drivers\AtihdW86.sys [2012-7-17 98472]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\Drivers\mbam.sys [2013-11-18 25928]
R3 RSP2STOR;Realtek PCIE CardReader Driver - P2;C:\Windows\System32\Drivers\RtsP2Stor.sys [2012-11-18 269968]
R3 RTL8168;Realtek 8168 NT Driver;C:\Windows\System32\Drivers\Rt630x64.sys [2012-11-18 690832]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\Drivers\usbfilter.sys [2012-11-18 57000]
R3 WirelessButtonDriver;HP Wireless Button Driver Service;C:\Windows\System32\Drivers\WirelessButtonDriver64.sys [2012-8-3 20288]
S0 SymELAM;Symantec ELAM Driver;C:\Windows\System32\Drivers\N360x64\1501000.012\SymELAM.sys [2013-11-18 23568]
S3 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-4-1 183560]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 iaStorA;iaStorA;C:\Windows\System32\Drivers\iaStorA.sys [2012-7-31 645952]
S3 SmbDrv;SmbDrv;C:\Windows\System32\Drivers\Smb_driver_AMDASF.sys [2012-11-18 41272]
S3 SmbDrvI;SmbDrvI;C:\Windows\System32\Drivers\Smb_driver_Intel.sys [2012-11-18 43832]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\Drivers\usbaapl64.sys [2012-12-13 54784]
S3 WUDFWpdMtp;WUDFWpdMtp;C:\Windows\System32\Drivers\WUDFRd.sys [2012-7-25 198656]
S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
SUnknown EraserUtilRebootDrv;EraserUtilRebootDrv; [x]
.
=============== File Associations ===============
.
FileExt: .txt: textfile="C:\Program Files (x86)\Windows NT\Accessories\WORDPAD.EXE" "%1" [userChoice]
.
=============== Created Last 30 ================
.
2013-11-19 02:05:50 858200 ----a-r- C:\Windows\System32\drivers\N360x64\1501000.012\srtsp64.sys
2013-11-19 02:05:50 590936 ----a-r- C:\Windows\System32\drivers\N360x64\1501000.012\symnets.sys
2013-11-19 02:05:50 493656 ----a-r- C:\Windows\System32\drivers\N360x64\1501000.012\SymDS64.sys
2013-11-19 02:05:50 36952 ----a-r- C:\Windows\System32\drivers\N360x64\1501000.012\srtspx64.sys
2013-11-19 02:05:50 264280 ----a-r- C:\Windows\System32\drivers\N360x64\1501000.012\Ironx64.sys
2013-11-19 02:05:50 23568 ----a-r- C:\Windows\System32\drivers\N360x64\1501000.012\SymELAM.sys
2013-11-19 02:05:50 1147480 ----a-r- C:\Windows\System32\drivers\N360x64\1501000.012\SymEFA64.sys
2013-11-19 02:05:49 162392 ----a-r- C:\Windows\System32\drivers\N360x64\1501000.012\ccSetx64.sys
2013-11-19 02:05:12 -------- d-----w- C:\Windows\System32\drivers\N360x64\1501000.012
2013-11-19 01:41:12 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Roaming\Malwarebytes
2013-11-19 01:40:59 -------- d-----w- C:\ProgramData\Malwarebytes
2013-11-19 01:40:58 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2013-11-19 01:40:58 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-18 03:28:46 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2013-11-18 03:28:46 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2013-11-17 19:10:59 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Roaming\eCyber
2013-11-17 19:08:15 -------- d-----w- C:\Windows\System32\log
2013-11-17 19:08:10 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Roaming\iSafe
2013-11-17 19:08:08 -------- d-----w- C:\Program Files (x86)\WinZipper
2013-11-17 18:47:42 -------- d-----w- C:\Program Files\iPod
2013-11-17 18:47:41 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-11-17 18:47:41 -------- d-----w- C:\Program Files\iTunes
2013-11-17 18:47:41 -------- d-----w- C:\Program Files (x86)\iTunes
2013-11-17 18:28:28 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{93B8EDCF-1ADF-4F01-9543-5FAAC73303C9}
2013-11-17 00:19:06 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Roaming\WordOv
2013-11-17 00:15:11 -------- d-----w- C:\Users\Chris L Hendrick\.config
2013-11-17 00:14:48 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\Oxy
2013-11-17 00:14:48 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\Chromium
2013-11-17 00:09:02 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Roaming\Oxy
2013-11-16 15:12:44 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{87E8411A-25A5-4015-BAD8-531DA7613251}
2013-11-16 01:32:14 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{6D9C4F41-C98E-4FFC-86C9-A55607AD4512}
2013-11-15 23:06:50 300720 ----a-w- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10225.bin
2013-11-12 11:55:42 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{1850BCF1-572A-4EB3-B426-C299C8C21B2D}
2013-11-11 04:16:52 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{2F48B740-0827-4C0F-A3FE-CFC66CACCDF3}
2013-11-09 22:15:33 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{BD88BB94-3A1A-4C61-A68A-CE2E758BE434}
2013-11-09 01:55:02 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{BE615B06-55AB-4AB9-859D-1D1784D128E6}
2013-11-06 03:10:41 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{ED3BAE77-826C-4F48-B542-D12935B89010}
2013-11-05 01:25:26 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{7EB49BDC-8DA4-4A4E-AAD8-B80AC2B2ABA6}
2013-11-04 02:29:13 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{565F9A39-F88C-45C0-857E-73D78F945964}
2013-11-03 13:50:40 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{2F787DCB-C081-4566-9E79-7CA1035C6D90}
2013-11-03 00:17:55 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{5506E125-9D96-4E35-BAC0-6268CB688786}
2013-11-01 00:50:59 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{2C5B82B4-08AB-4D25-92FE-6DDD8ED7B042}
2013-10-30 23:47:10 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{71B4C1F6-F67D-47D0-B4A9-1CC1C583E897}
2013-10-30 00:49:43 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{CE7D3633-EC11-44C0-AEB9-7A3489247F63}
2013-10-29 00:55:12 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{11DCC4D5-476C-4284-8F77-6FFA133D818F}
2013-10-28 11:45:01 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{DFA59DB5-977D-4061-AA07-BED5801F2CFC}
2013-10-27 17:02:12 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{1BBC40F1-E6A3-49CE-8693-6633CE6423AC}
2013-10-27 04:36:42 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{EFC1BBC8-5B22-4065-A0BC-547FC5D462CC}
2013-10-26 03:21:27 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{AA94FFD2-9026-4413-AF8C-31AB83BF9117}
2013-10-25 02:45:03 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{81B25805-CAE0-4ABD-AE22-686BD89FDEDE}
2013-10-22 02:07:52 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{D2CB1C0A-E3A2-4954-BA4E-A2C61E95D36E}
2013-10-20 05:19:00 -------- d-----w- C:\Users\Chris L Hendrick\AppData\Local\{93854808-7585-42AD-836C-40AD74D8D192}
.
==================== Find3M ====================
.
2013-11-19 02:09:27 177752 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
2013-11-17 19:08:07 421032 ----a-w- C:\Windows\SysWow64\msvcp100.dll
2013-10-02 01:38:13 78296 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-10-02 01:38:13 694232 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-09-22 23:28:06 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-09-22 23:27:49 2876928 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-09-22 22:55:10 2241024 ----a-w- C:\Windows\System32\wininet.dll
2013-09-22 22:54:51 3959296 ----a-w- C:\Windows\System32\jscript9.dll
2013-08-23 05:11:57 4040192 ----a-w- C:\Windows\System32\win32k.sys
.
============= FINISH: 21:17:39.37 ===============

attach log

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 8
Boot Device: \Device\HarddiskVolume2
Install Date: 12/25/2012 3:41:21 AM
System Uptime: 11/18/2013 9:08:52 PM (0 hours ago)
.
Motherboard: Hewlett-Packard | | 184B
Processor: AMD A6-4400M APU with Radeon HD Graphics | Socket FT1 | 2700/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 905 GiB total, 825.608 GiB free.
D: is FIXED (NTFS) - 25 GiB total, 3.015 GiB free.
E: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP54: 10/29/2013 6:41:09 AM - Windows Update
RP55: 11/17/2013 9:42:55 PM - Scheduled Checkpoint
.
==== Installed Programs ======================
.
4 Elements II
Adobe Photoshop Elements 11
Adobe Shockwave Player 11.6
AMD Accelerated Video Transcoding
AMD APP SDK Runtime
AMD Catalyst Install Manager
AMD Fuel
AMD Quick Stream
AMD VISION Engine Control Center
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Bejeweled 3
Bing Bar
Bonjour
Build-a-lot 4 - Power Source
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-utility64
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Chuzzle Deluxe
Cradle Of Egypt Collector's Edition
Cradle of Rome 2
Cypherix LE 10
D3DX10
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Elements 11 Organizer
Energy Star
Facebook Video Calling 1.2.0.287
Farm Frenzy
FATE: The Cursed King
Final Drive Fury
FlatOut 2
Google Earth
Google Update Helper
Governor of Poker 2 Premium Edition
Hewlett-Packard ACLM.NET v1.2.1.1
Hoyle Card Games
HP 3D DriveGuard
HP Connected Music (Meridian - installer)
HP CoolSense
HP Customer Experience Enhancements
HP Documentation
HP Games
HP MyRoom
HP Postscript Converter
HP Quick Launch
HP Recovery Manager
HP Registration Service
HP Software Framework
HP Support Assistant
HP Utility Center
HP Wireless Button Driver
IDT Audio
iTunes
Java 7 Update 25
Java Auto Updater
Jewel Match 3
John Deere Drive Green
Junk Mail filter update
Luxor Evolved
Mahjongg Dimensions Deluxe: Tiles in Time
Malwarebytes Anti-Malware version 1.75.0.1300
Mesh Runtime
Messenger Companion
Microsoft Application Error Reporting
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Home and Student 2010
Microsoft Office Office 64-bit Components 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared 64-bit MUI (English) 2010
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Single Image 2010
Microsoft Office Word MUI (English) 2010
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Mortimer Beckett and the Crimson Thief Premium Edition
MSVCRT
MSVCRT_amd64
Mystery P.I. - Curious Case of Counterfeit Cove
Norton Security Suite
Peggle Nights
Penguins!
Photomatix Essentials 64-bit version 3.2.1
Picasa 3
Polar Bowler
Polar Golfer
PSE11 STI Installer
Qualcomm Atheros Driver Installation Program
QuickTime
Realtek Ethernet Controller Driver
Realtek PCIE Card Reader
Roads of Rome 3
Security Update for Microsoft Excel 2010 (KB2826033) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2760406) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2687276) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2687510) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2826023) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2826035) 32-Bit Edition
Security Update for Microsoft Outlook 2010 (KB2794707) 32-Bit Edition
Security Update for Microsoft Publisher 2010 (KB2553147) 32-Bit Edition
Security Update for Microsoft Visio 2010 (KB2810068) 32-Bit Edition
Spybot - Search & Destroy
swMSM
Synaptics Pointing Device Driver
Tales of Lagoona
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition
Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition
Update Installer for WildTangent Games App
Vacation Quest™ - Australia
Warcraft III
WildTangent Games
WildTangent Games App (HP Games)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WordOv
Zuma's Revenge
.
==== Event Viewer Messages From Past Week ========
.
11/18/2013 7:31:35 PM, Error: cdrom [15] - The device, \Device\CdRom0, is not ready for access yet.
11/17/2013 8:58:08 PM, Error: Service Control Manager [7034] - The WinZiper service service terminated unexpectedly. It has done this 1 time(s).
11/17/2013 6:10:57 PM, Error: Schannel [36888] - A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 70. The Windows SChannel error state is 11.
11/16/2013 6:24:50 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HPWMISVC service.
.
==== End Of File ===========================

Psychotic · November 19, 2013

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

ShortcutCleaner (by Grinler)

Please download Shortcutcleaner and save the file to your desktop.

Run it by double click, it will scan your computer. Wen finished, it makes a sc-cleaner.txt to your desktop.

Post the content of the file here.

hendu3270 · November 19, 2013

Thank you for your assistance Marius. When I click on "Shortcutcleaner" it takes me to bleepingcomputer.com and says "page not found".

hendu3270 · November 19, 2013

Nevermind. I found it. running now.

hendu3270 · November 19, 2013

Shortcut Cleaner 1.2.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Shortcut Cleaner can be found at this link:
http://www.bleepingcomputer.com/download/shortcut-cleaner/

Windows Version: Windows 8
Program started at: 11/19/2013 05:42:10 PM.

Scanning for registry hijacks:

* No issues found in the Registry.

Searching for Hijacked Shortcuts:

Searching C:\Users\Chris L Hendrick\AppData\Roaming\Microsoft\Windows\Start Menu\

Searching C:\ProgramData\Microsoft\Windows\Start Menu\

Searching C:\Users\Chris L Hendrick\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\

Searching C:\Users\Public\Desktop\

Searching C:\Users\Chris L Hendrick\Desktop

0 bad shortcuts found.

Psychotic · November 20, 2013

Delete junk with adwCleaner

Please download AdwCleaner to your desktop.

Run adwcleaner.exe
Hit Scan and wait for the scan to finish.
Confirm the message but don´t uncheck anything.
Hit Clean
When the run is finished, it will open up a text file
Please post its contents within your next reply
You´ll find the log file at C:\AdwCleaner[s1].txt also

Delete junk with JRT

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

hendu3270 · November 20, 2013

Marius, Here's the adw log. I will have to wait until after work today to do the second scan. Thanks.

# AdwCleaner v3.012 - Report created 20/11/2013 at 05:56:45

# Updated 11/11/2013 by Xplode

# Operating System : Windows 8 (64 bits)

# Username : Chris L Hendrick - WOODCREATIONS

# Running from : C:\Users\Chris L Hendrick\Downloads\adwcleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\WinZipper

Folder Deleted : C:\Users\Chris L Hendrick\AppData\Local\Oxy

Folder Deleted : C:\Users\Chris L Hendrick\AppData\Roaming\iSafe

Folder Deleted : C:\Users\Chris L Hendrick\AppData\Roaming\Oxy

Folder Deleted : C:\Users\Nathyn Hendrick\AppData\Roaming\iSafe

Folder Deleted : C:\Users\Brandyn L. Hendrick\AppData\Roaming\iSafe

File Deleted : C:\Users\Public\Desktop\eBay.lnk

File Deleted : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

Key Deleted : HKLM\Software\hdcode

Key Deleted : HKLM\Software\InstallIQ

Key Deleted : HKLM\Software\winzipersvc

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16537

*************************

AdwCleaner[R0].txt - [2365 octets] - [20/11/2013 05:55:22]

AdwCleaner[s0].txt - [2100 octets] - [20/11/2013 05:56:45]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [2160 octets] ##########

hendu3270 · November 20, 2013

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.0.8 (11.05.2013:1)

OS: Windows 8 x64

Ran by Chris L Hendrick on Wed 11/20/2013 at 6:11:22.54

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{180780f0-b348-4b44-8210-94a8f3ee15b2}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E598BBD8-5D35-4A18-B21A-94FB88D45535}

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{E598BBD8-5D35-4A18-B21A-94FB88D45535}

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{14E5E74B-0B52-4669-8B78-6527C7A09831}

Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{14E5E74B-0B52-4669-8B78-6527C7A09831}

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\microsoft\Internet Explorer\SearchScopes\{E598BBD8-5D35-4A18-B21A-94FB88D45535}

Failed to delete: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{E598BBD8-5D35-4A18-B21A-94FB88D45535}

~~~ Files

~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{0A1682C0-A1B7-4C53-AED2-86613F0CF4D2}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{0CFE3FBF-22D3-4D6D-A8B8-14B019AA2098}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{10655D2E-EC10-4425-ADA1-A84526F32EDF}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{11DCC4D5-476C-4284-8F77-6FFA133D818F}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{13A16BAB-CF17-4C92-98E3-F271D5AE636F}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{1850BCF1-572A-4EB3-B426-C299C8C21B2D}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{1AD887CD-12BF-4B31-8B0C-64703670C1FC}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{1BBC40F1-E6A3-49CE-8693-6633CE6423AC}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{1D3E0EE6-CCA8-4DC1-83F1-7984D4D54A68}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{1F2690B1-854D-4E5C-AF67-541AF451FAB1}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{1FDB7CBB-C9D4-4630-A79D-EC9F55FC564F}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{22A7A7A5-1FBA-462C-9796-20BFA5870F5F}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{22AC056E-57F5-4DA4-B756-8A15FC3460EB}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{24F31697-AEEF-45AB-A699-178907DAE1A8}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{28EB5016-EBBE-41B1-9BC6-F2ED07B700F8}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{29CB7304-2F26-4B11-AB30-9FEF0AFEA590}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{2C5B82B4-08AB-4D25-92FE-6DDD8ED7B042}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{2F0278C1-480E-4068-90F5-A8C7185C816A}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{2F48B740-0827-4C0F-A3FE-CFC66CACCDF3}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{2F787DCB-C081-4566-9E79-7CA1035C6D90}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{2FA4DCC9-7851-4FDA-AC9B-D67E115AFE7F}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{39AEE9A5-B3B6-47ED-AD0E-212827B7F812}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{3ADB4A8F-1061-4F48-A4E4-2194943FD81C}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{3C56FA56-7ABF-426C-8961-9C01E7F88AD4}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{404AB7E5-8AA3-416C-B33A-53A07EA51E02}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{406D3A99-E819-4052-A6E2-73C5BC935D45}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{446E4002-5444-4961-82AE-A67E8E8F0A5A}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{47529586-436A-41BD-8B4A-2D979065554C}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{4872CFBA-A845-461C-B87C-DC128FA3CC27}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{494A7F97-3E09-4583-8ED1-A1CA8B1F6A88}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{542205DF-EC86-4D04-B878-1B4E1E6B6B8C}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{5506E125-9D96-4E35-BAC0-6268CB688786}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{565F9A39-F88C-45C0-857E-73D78F945964}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{5964917D-BD85-4D89-8370-22578B495B3C}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{59DBEC40-0F1F-4E62-ABD1-6CF11599A821}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{5BC1FF05-2F6D-4624-AD5B-E620145F0F44}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{5D4106A3-DFBC-433D-9943-55C0687E91AC}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{5FD5211B-DD3B-47DA-BF5D-DA87493F5822}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{6057EC09-E0C4-48CF-B5CD-B32D6AECF6CE}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{623B50F6-E0D1-46CF-9695-1A8894AAFC42}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{63A60A54-57B2-419C-8A6C-368E70F463EE}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{66AFA3B7-EDE8-4D32-A99D-633AB308E9DD}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{6D9C4F41-C98E-4FFC-86C9-A55607AD4512}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{6DC43B74-B1A1-4E86-913C-F215D4461AFD}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{71B4C1F6-F67D-47D0-B4A9-1CC1C583E897}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{725A8070-DE7D-447F-889D-31BD4F763D11}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{73F55D10-A566-4A2D-A6E6-397E57AF509D}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{7690CD6F-EA6E-43B8-85A6-64E06EE70FFC}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{769D7073-8C38-4EC5-91BA-754CA632D086}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{792CB395-0014-4886-86A6-009BAF30CE36}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{7AF4F2C8-6F58-46F1-A7DB-2DF4854A19F2}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{7E2852D6-5DE2-4785-B237-45E34B2F75A5}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{7EB49BDC-8DA4-4A4E-AAD8-B80AC2B2ABA6}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{8145C940-EA2C-4F5E-A3B4-0EA1E563B6C5}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{81B25805-CAE0-4ABD-AE22-686BD89FDEDE}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{83AA44D1-1A86-4FEF-997C-E6053F5C58C9}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{866F1B05-5BC3-493E-902A-0C3A22E1E83C}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{87378EDC-AA1C-4E52-9A2B-AEC8A4D6D44A}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{87E8411A-25A5-4015-BAD8-531DA7613251}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{8BBB9BAC-A8E2-46EE-B227-624F90255C0A}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{8D78038F-7C86-4D57-8A19-7AA6557177A2}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{9194DB5F-F7CD-4984-B214-64C3FBEC1ADA}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{93854808-7585-42AD-836C-40AD74D8D192}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{93B8EDCF-1ADF-4F01-9543-5FAAC73303C9}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{9416EC64-B8A6-4421-A9F7-2BC8493B6CCC}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{95396AD9-7EC7-41B8-8631-6C0E4DECC9B1}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{95E574D6-0633-4F99-AE75-D5BD0657F4AC}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{97920B0F-B441-4F61-9A0D-C91900964B14}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{97A46ACD-1154-4976-BA53-60A0308C7A2C}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{99C0745F-0854-4D62-A642-1D4D90B14642}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{9A2D7845-5077-4502-B1E0-514DCB0A88D7}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{9E8E9A2D-F02A-487E-AD5D-88F3D1825773}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{9E93501F-BFDE-46B1-8F12-CE30F813AE6D}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{A23062E7-9DD1-44E3-8094-265B981DA9CE}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{A33FF9C4-B608-4E08-B8C9-CF7297939415}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{A6EF4152-C081-4A64-AE2E-600FB04D43A7}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{A761083C-E7FD-46BF-87FE-21B16CC0EF08}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{AA94FFD2-9026-4413-AF8C-31AB83BF9117}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{ACAFA65E-66FE-410A-8819-6AB2658EA2D4}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{AD67ED31-333C-491E-A52E-E92B57969799}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{ADE7BC89-FEF1-47DA-AE58-F9844B8C5B06}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{AEDF14B3-AC7C-4B78-AC5D-521A30082C9B}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{B8905D02-BDEB-48D6-BC42-B4DC1858770F}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{BD88BB94-3A1A-4C61-A68A-CE2E758BE434}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{BE615B06-55AB-4AB9-859D-1D1784D128E6}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{BFCC3C12-C2B0-4BA1-99E1-D5C7DC8E16F3}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{C0000EBA-1F9E-4E96-9F74-F946288CAA67}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{C2F6B51B-0FFE-4526-BE38-A47BCC0C0313}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{C72EE796-2BEC-420C-9A18-769E984288EA}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{CA94A001-E7A4-4DCE-9228-F22CF7980D0D}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{CE7D3633-EC11-44C0-AEB9-7A3489247F63}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{CF4481EB-2646-4E0C-8D8E-4AD210384CEB}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{D1B57FAA-C21F-4276-A1DE-DEC7F7AE48CF}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{D2CB1C0A-E3A2-4954-BA4E-A2C61E95D36E}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{D45C12E8-6D10-4519-AB60-1E0A5F37FB9D}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{DE6922B2-C689-4D6F-9F34-FBB15AEE1CE5}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{DEBD6704-2786-4371-98B0-ACC0CB56F131}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{DFA59DB5-977D-4061-AA07-BED5801F2CFC}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{E55BCD82-6B88-4132-8988-F4549B4E69E9}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{E760B46B-0F42-4B30-A5AF-4843235C77FD}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{E82D12B0-F8BC-46E9-B84E-60C76B1BAEFF}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{E90DA703-E0A3-46DD-B372-7E5FAAA87D3E}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{ECAC387C-695F-4898-A933-2DDF4E8F74FC}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{ED3BAE77-826C-4F48-B542-D12935B89010}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{EF0B21AB-5B14-46DF-9F04-8C4288826FA3}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{EFC1BBC8-5B22-4065-A0BC-547FC5D462CC}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{F15DF4AA-6025-495E-95A6-09502FC0A1A4}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{F40F0148-02C5-437F-95C5-38F4243B8CDD}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{F6C53EBE-5A87-42E2-ACDC-C886D1F7FE8F}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{F881F98F-486C-4C35-B834-C8FD42CC06BA}

Successfully deleted: [Empty Folder] C:\Users\Chris L Hendrick\appdata\local\{FA9EDBE8-5A8C-4A71-AC15-AE6FA115DCCC}

~~~ Event Viewer Logs were cleared

Psychotic · November 20, 2013

Are you still being redirected?

hendu3270 · November 20, 2013

Yes, still redirects to Do-search

Psychotic · November 21, 2013

Combofix

Combofix should only be run when adviced by a team member!

Link

Important - Save the file to your desktop!

Deactivate any and all of your antivirus programs /spyware scanners - they can prevent CF from doing its work.
Run Combofix.exe

When finished, Combofix creates a log file named C:\Combofix.txt. Please post its content in your next reply.

Note: When receiving an error message containing ""Illegal operation attempted on a registry key that has been marked for deletion" simply restart your computer to fix this.

hendu3270 · November 21, 2013

Here's the combofix log. Still redirecting to do-search.

ComboFix 13-11-19.01 - Chris L Hendrick 11/21/2013 5:43.1.2 - x64

Microsoft Windows 8 6.2.9200.0.1252.1.1033.18.7650.6063 [GMT -6:00]

Running from: c:\users\Chris L Hendrick\Downloads\ComboFix.exe

AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Norton Security Suite *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2013-10-21 to 2013-11-21 )))))))))))))))))))))))))))))))

.

2013-11-21 11:51 . 2013-11-21 11:51 -------- d-----w- c:\users\Nathyn Hendrick\AppData\Local\temp

2013-11-21 11:51 . 2013-11-21 11:51 -------- d-----w- c:\users\Guest\AppData\Local\temp

2013-11-20 12:11 . 2013-11-20 12:11 -------- d-----w- c:\windows\ERUNT

2013-11-20 11:55 . 2013-11-20 11:56 -------- d-----w- C:\AdwCleaner

2013-11-19 02:05 . 2013-11-19 03:09 -------- d-----w- c:\windows\system32\drivers\N360x64\1501000.012

2013-11-19 01:41 . 2013-11-19 01:41 -------- d-----w- c:\users\Chris L Hendrick\AppData\Roaming\Malwarebytes

2013-11-19 01:40 . 2013-11-19 01:40 -------- d-----w- c:\programdata\Malwarebytes

2013-11-19 01:40 . 2013-11-20 01:29 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2013-11-19 01:40 . 2013-04-04 20:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-11-18 03:28 . 2013-11-18 05:18 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2013-11-18 03:28 . 2013-11-18 03:30 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy

2013-11-17 19:10 . 2013-11-17 19:10 -------- d-----w- c:\users\Chris L Hendrick\AppData\Roaming\eCyber

2013-11-17 19:08 . 2013-11-17 19:08 -------- d-----w- c:\windows\system32\log

2013-11-17 18:47 . 2013-11-17 18:47 -------- d-----w- c:\program files\iPod

2013-11-17 18:47 . 2013-11-17 18:48 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-11-17 18:47 . 2013-11-17 18:48 -------- d-----w- c:\program files\iTunes

2013-11-17 18:47 . 2013-11-17 18:48 -------- d-----w- c:\program files (x86)\iTunes

2013-11-17 00:23 . 2013-11-17 00:23 -------- d-----w- c:\windows\ServiceProfiles\LocalService\winhttp

2013-11-17 00:19 . 2013-11-17 00:19 -------- d-----w- c:\users\Chris L Hendrick\AppData\Roaming\WordOv

2013-11-17 00:15 . 2013-11-17 00:15 -------- d-----w- c:\users\Chris L Hendrick\.config

2013-11-17 00:14 . 2013-11-17 00:14 -------- d-----w- c:\users\Chris L Hendrick\AppData\Local\Chromium

2013-11-15 23:06 . 2013-11-15 23:06 300720 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10225.bin

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-11-19 02:09 . 2013-02-17 05:36 177752 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS

2013-11-17 19:08 . 2012-07-09 20:40 421032 ----a-w- c:\windows\SysWow64\msvcp100.dll

2013-10-16 03:02 . 2012-12-27 03:45 80541720 ----a-w- c:\windows\system32\MRT.exe

2013-10-02 01:38 . 2013-10-01 03:54 78296 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-10-02 01:38 . 2013-10-01 03:54 694232 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

2013-09-22 23:28 . 2013-10-12 22:03 1767936 ----a-w- c:\windows\SysWow64\wininet.dll

2013-09-22 23:27 . 2013-10-12 22:03 2876928 ----a-w- c:\windows\SysWow64\jscript9.dll

2013-09-22 22:55 . 2013-10-12 22:03 51712 ----a-w- c:\windows\system32\ie4uinit.exe

2013-09-22 22:55 . 2013-10-12 22:03 2241024 ----a-w- c:\windows\system32\wininet.dll

2013-09-22 22:55 . 2013-10-12 22:03 1365504 ----a-w- c:\windows\system32\urlmon.dll

2013-09-22 22:54 . 2013-10-12 22:03 603136 ----a-w- c:\windows\system32\msfeeds.dll

2013-09-22 22:54 . 2013-10-12 22:03 19252224 ----a-w- c:\windows\system32\mshtml.dll

2013-09-22 22:54 . 2013-10-12 22:03 855552 ----a-w- c:\windows\system32\jscript.dll

2013-09-22 22:54 . 2013-10-12 22:03 3959296 ----a-w- c:\windows\system32\jscript9.dll

2013-09-22 22:54 . 2013-10-12 22:03 15404544 ----a-w- c:\windows\system32\ieframe.dll

2013-09-22 22:54 . 2013-10-12 22:03 2647552 ----a-w- c:\windows\system32\iertutil.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{14E5E74B-0B52-4669-8B78-6527C7A09831}]

2013-11-14 00:04 1165183 ----a-w- c:\users\Chris L Hendrick\AppData\Roaming\WordOv\temp.dat

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-08-08 642216]

"HP Quick Launch"="c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2012-07-09 580512]

"HP CoolSense"="c:\program files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe" [2012-11-05 1343904]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]

"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-11-02 152392]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableCursorSuppression"= 1 (0x1)

"ConsentPromptBehaviorUser"= 3 (0x3)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

R1 AntiLog32;AntiLog32;c:\windows\system32\drivers\AntiLog64.sys;c:\windows\SYSNATIVE\drivers\AntiLog64.sys [x]

R3 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]

R3 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]

R3 keycrypt;keycrypt;c:\windows\system32\DRIVERS\KeyCrypt64.sys;c:\windows\SYSNATIVE\DRIVERS\KeyCrypt64.sys [x]

R3 SmbDrv;SmbDrv;c:\windows\System32\drivers\Smb_driver_AMDASF.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_AMDASF.sys [x]

R3 SmbDrvI;SmbDrvI;c:\windows\System32\drivers\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_Intel.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\System32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]

R4 SymELAM;Symantec ELAM Driver;c:\windows\system32\drivers\N360x64\1501000.012\SymELAM.sys;c:\windows\SYSNATIVE\drivers\N360x64\1501000.012\SymELAM.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 amd_sata;amd_sata;c:\windows\System32\drivers\amd_sata.sys;c:\windows\SYSNATIVE\drivers\amd_sata.sys [x]

S0 amd_xata;amd_xata;c:\windows\System32\drivers\amd_xata.sys;c:\windows\SYSNATIVE\drivers\amd_xata.sys [x]

S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\1501000.012\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1501000.012\SYMDS64.SYS [x]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\1501000.012\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1501000.012\SYMEFA64.SYS [x]

S1 BHDrvx64;BHDrvx64;c:\program files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20131114.001\BHDrvx64.sys;c:\program files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20131114.001\BHDrvx64.sys [x]

S1 ccSet_N360;N360 Settings Manager;c:\windows\system32\drivers\N360x64\1501000.012\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\N360x64\1501000.012\ccSetx64.sys [x]

S1 cypxdv10;cypxdv10;c:\windows\system32\Drivers\cypxdv10.sys;c:\windows\SYSNATIVE\Drivers\cypxdv10.sys [x]

S1 IDSVia64;IDSVia64;c:\program files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20131120.003\IDSvia64.sys;c:\program files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20131120.003\IDSvia64.sys [x]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\1501000.012\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1501000.012\Ironx64.SYS [x]

S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\1501000.012\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\N360x64\1501000.012\SYMNETS.SYS [x]

S2 AdobeActiveFileMonitor11.0;Adobe Active File Monitor V11;c:\program files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]

S2 APXACC;AppEx Networks Accelerator LWF;c:\windows\system32\DRIVERS\appexDrv.sys;c:\windows\SYSNATIVE\DRIVERS\appexDrv.sys [x]

S2 cypherix10service;Cypherix 10 service;c:\windows\SysWOW64\cypxsrv10.exe;c:\windows\SysWOW64\cypxsrv10.exe [x]

S2 GamesAppIntegrationService;GamesAppIntegrationService;c:\program files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [x]

S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]

S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [x]

S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 N360;Norton Security Suite;c:\program files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe;c:\program files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW86.sys;c:\windows\SYSNATIVE\drivers\AtihdW86.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 RSP2STOR;Realtek PCIE CardReader Driver - P2;c:\windows\system32\DRIVERS\RtsP2Stor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsP2Stor.sys [x]

S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]

S3 WirelessButtonDriver;HP Wireless Button Driver Service;c:\windows\System32\drivers\WirelessButtonDriver64.sys;c:\windows\SYSNATIVE\drivers\WirelessButtonDriver64.sys [x]

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

apphost REG_MULTI_SZ apphostsvc

iissvcs REG_MULTI_SZ w3svc was

.

Contents of the 'Scheduled Tasks' folder

.

2013-11-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-28 22:57]

.

2013-11-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-12-28 22:57]

.

--------- X64 Entries -----------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-06-16 499608]

"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2013-06-12 1664000]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"NCPluginUpdater"="c:\program files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" [2013-11-06 21720]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

TCP: DhcpNameServer = 75.75.76.76 75.75.75.75

.

- - - - ORPHANS REMOVED - - - -

.

Wow6432Node-HKCU-Run-Facebook Update - c:\users\Chris L Hendrick\AppData\Local\Facebook\Update\FacebookUpdate.exe

AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]

"ImagePath"="\"c:\program files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton Security Suite\Engine\21.1.0.18\diMaster.dll\" /prefetch:1"

"ImagePath"="\SystemRoot\System32\Drivers\N360x64\1501000.012\SYMNETS.SYS"

"TrustedImagePaths"="c:\program files (x86)\Norton Security Suite\Engine\21.1.0.18;c:\program files (x86)\Norton Security Suite\Engine64\21.1.0.18"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

@SACL=(02 0000)

.

Completion time: 2013-11-21 05:54:27

ComboFix-quarantined-files.txt 2013-11-21 11:54

.

Pre-Run: 885,341,671,424 bytes free

Post-Run: 885,730,160,640 bytes free

.

- - End Of File - - 7E302664DB448553A43EA4D55569822B

5FB38429D5D77768867C76DCBDB35194

Psychotic · November 21, 2013

Combofix scripting

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Download the attached CFScript.txt and save it to the location where Combofix is.

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

CFScript.txt

hendu3270 · November 22, 2013

My do-search issue is still happening after this scan.

ComboFix 13-11-19.01 - Chris L Hendrick 11/21/2013 18:00:14.2.2 - x64

Microsoft Windows 8 6.2.9200.0.1252.1.1033.18.7650.5751 [GMT -6:00]

Running from: c:\users\Chris L Hendrick\Downloads\ComboFix.exe

Command switches used :: c:\users\Chris L Hendrick\Downloads\CFScript.txt

AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Norton Security Suite *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2013-10-22 to 2013-11-22 )))))))))))))))))))))))))))))))

.

2013-11-22 00:07 . 2013-11-22 00:07 -------- d-----w- c:\users\Nathyn Hendrick\AppData\Local\temp

2013-11-22 00:07 . 2013-11-22 00:07 -------- d-----w- c:\users\Guest\AppData\Local\temp

2013-11-22 00:07 . 2013-11-22 00:07 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-11-22 00:07 . 2013-11-22 00:07 -------- d-----w- c:\users\Brandyn L. Hendrick\AppData\Local\temp

2013-11-21 11:54 . 2013-11-22 00:10 -------- d-----w- c:\users\Chris L Hendrick\AppData\Local\temp