Solved Verizon Email mysteriously stopped working

[Buratti]

Sorry... I got ahead of myself there for a minute. I didn't see any of the last 6 responses before I posted my last response. the latest thing I tried before that response was adding Verizon.com and .net to the trusted sites and that did nothing. The problem still worsens though with now not being able to access the Verizon site altogether. I am no longer at my work computer so I cannot boot into safe mode, but I do often remote desktop form home. From home I have rebooted, "flushed the IP", preformed a clean boot and rebooted again, but still the same thing; Verison Email not working in Outlook and the Verizon website altogether not working.

 

[Slartybart]

Ok, carry on with what's already been suggested and please post the results.

It might be a good idea to complete one request, post the results, wait for a member to digest the status, and respond to that.

Ok, I thought we all might be out of sync - no problem, but we can do better!

I'll slow down and wait for you and Mike to finish those paths.

But please go ahead and do the full recap - including posting the malware scan logs.

As for me, I'm only interested in the problematic machine - telling me about the machine or network that didn't have the issue only confuses me. It's good information as comparison, but I'm not sure which machine / network has the issue now. See, I get confused easily

You home machine is the one with the issue - right?
And you can access Verizon on other devices on your home network. I'm sorry if I've asked this before, details about the issue are of utmost importance.

Bill
.

 

[Buratti]

Ok had to take a few hours off. I wrote this long response with everything I did up to date and included all log files from previous scans, and then my browser crashed right before I was about to send it. Here it goes again...

To recap my problem and everything I have done to correct it is as follows. My main problem is that I cannot access my Verizon email account from Outlook. A secondary issue which may or may not be related to the first is that I also cannot access the Verizon website. Originally I could only not access the dropdown login, but now the entire Verizon domain seems "blocked". As post #19 asked, other https sites seem to load ok, but are slower loading than other sites. What I have done to try to correct this problem is now as follows in order:

Scanned with MBAM and results are clean
Turned OFF Active X filtering
Reset IE to original settings
Tried Enhanced Protection Mode ON and OFF

At this point I ran several different scans as directed by another forum which I started before I started this one. The other forum was regarding my ORIGINAL problem of suspicious activity, possibly by a hacker. A more detailed but still summarized explanation of that problem is stated in my opening post. The scans I ran are (in order) ComboFix, RogueKiller, adwcleaner, and JRT (junk removal tool). I still have the logs from each scan and will post them each in a separate post after I finish this one. After all of these scans were completed is when the problem worsened by now not being able to view the Verizon website altogether. Then I continued with suggestions here and did the following...

Added Verizon.com /.net to the trusted sites
Restarted
Did a manual flush as post #16 suggested
Restarted
Preformed a "Clean Boot"
Reset the Hosts file
Ran a System Scan as post #19 suggested (log to follow in one of the next several posts)
Restart

As stated in an earlier post I am now home for the weekend and not physically at my work computer, but I do often connect via Remote Desktop and can preform most tasks from home but am limited with booting into safe mode and etc. until Monday. The link in post #20 DOES work, but that's VerizonWIRELESS.com Still anything from Verizon.com (or.net) just wont load at all, even other Verizon links suggested through various posts suggested to me here.

If you need any screenshots of anything let me know. The log files are following this...

 

[Buratti]

ComboFix Log:

ComboFix 14-09-24.01 - Joe 09/25/2014 17:17:58.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3982.1892 [GMT -4:00]
Running from: c:\users\Joe\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Joe\AppData\Local\Microsoft\Windows\Temporary Internet Files\7576AccountantCenter.html
c:\users\Joe\AppData\Local\Microsoft\Windows\Temporary Internet Files\ac.css
c:\users\Joe\AppData\Local\Microsoft\Windows\Temporary Internet Files\ac.js
c:\users\Joe\AppData\Local\Microsoft\Windows\Temporary Internet Files\close_pop.png
c:\users\Joe\AppData\Local\Microsoft\Windows\Temporary Internet Files\jq.css
c:\users\Joe\AppData\Local\Microsoft\Windows\Temporary Internet Files\jquery.corner.js
c:\users\Joe\AppData\Local\Microsoft\Windows\Temporary Internet Files\jquery.min.js
c:\users\Joe\AppData\Local\Microsoft\Windows\Temporary Internet Files\qbw.css
c:\users\Joe\AppData\Local\TapTap
c:\users\Joe\AppData\Local\TapTap\score.xml
c:\windows\Fonts\USPSIMBStandard.ttf
.
.
((((((((((((((((((((((((( Files Created from 2014-08-25 to 2014-09-25 )))))))))))))))))))))))))))))))
.
.
2014-09-25 21:24 . 2014-09-25 21:24 -------- d-----w- c:\users\Remote Login\AppData\Local\temp
2014-09-25 21:24 . 2014-09-25 21:24 -------- d-----w- c:\users\QBDataServiceUser24\AppData\Local\temp
2014-09-25 21:24 . 2014-09-25 21:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-09-25 13:48 . 2014-09-25 13:48 -------- d-sh--w- c:\users\Joe\AppData\Local\EmieUserList
2014-09-25 13:48 . 2014-09-25 13:48 -------- d-sh--w- c:\users\Joe\AppData\Local\EmieSiteList
2014-09-25 13:34 . 2014-09-25 13:54 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-09-25 12:51 . 2014-09-25 12:51 -------- d-----w- c:\programdata\PDFC
2014-09-24 05:45 . 2014-09-09 22:11 2048 ----a-w- c:\windows\system32\tzres.dll
2014-09-24 05:45 . 2014-09-09 21:47 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-09-23 06:47 . 2014-09-23 06:47 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C2F961B9-F9BF-492D-A664-4849B233EE46}\offreg.dll
2014-09-23 06:46 . 2014-09-09 02:05 11578928 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C2F961B9-F9BF-492D-A664-4849B233EE46}\mpengine.dll
2014-09-16 01:24 . 2014-09-16 01:24 -------- d-----w- c:\program files (x86)\ESET
2014-09-15 19:06 . 2014-09-15 19:21 -------- d-----w- c:\programdata\Recovery
2014-09-15 17:06 . 2014-09-25 21:16 -------- d-----w- c:\users\QBDataServiceUser24.JOE
2014-09-14 07:14 . 2014-09-14 07:14 -------- d-----w- c:\windows\Migration
2014-09-12 14:23 . 2014-09-12 14:23 -------- d-----w- C:\PROJECTTEMPLATESROOT
2014-09-12 14:01 . 2014-09-12 14:01 -------- d-----w- c:\program files (x86)\Common Files\Nuance
2014-09-12 14:01 . 2014-09-12 14:01 -------- d-----w- c:\programdata\Nuance
2014-09-11 14:48 . 2014-09-25 13:34 128728 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-11 07:01 . 2014-06-27 02:08 2777088 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2014-09-11 07:01 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2014-09-10 17:01 . 2014-09-10 17:01 -------- d-----w- c:\users\Joe\AppData\Local\Macroplant_LLC
2014-09-10 16:58 . 2014-09-11 14:41 -------- d-----w- c:\program files (x86)\iExplorer
2014-09-10 07:23 . 2014-08-01 11:53 1031168 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-09-10 07:23 . 2014-08-01 11:35 793600 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
2014-09-10 07:23 . 2014-06-24 03:29 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2014-09-10 07:23 . 2014-06-24 02:59 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2014-09-10 07:23 . 2014-07-07 02:06 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-09-10 07:23 . 2014-07-07 02:06 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-09-10 07:23 . 2014-07-07 01:40 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-09-10 07:23 . 2014-07-07 01:40 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-09-10 07:23 . 2014-07-07 01:39 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2014-09-10 07:23 . 2014-09-05 02:10 578048 ----a-w- c:\windows\system32\aepdu.dll
2014-09-10 07:23 . 2014-09-05 02:05 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-09-10 02:33 . 2014-09-10 02:33 -------- d-----w- c:\users\Joe\Tracing
2014-08-28 07:58 . 2014-08-23 02:07 404480 ----a-w- c:\windows\system32\gdi32.dll
2014-08-28 07:58 . 2014-08-23 01:45 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2014-08-28 07:58 . 2014-08-23 00:59 3163648 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-25 13:34 . 2014-07-15 17:13 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-09-15 13:06 . 2010-11-21 03:27 278152 ------w- c:\windows\system32\MpSigStub.exe
2014-09-11 14:56 . 2012-12-06 19:10 210944 ----a-w- c:\windows\system32\rdpclip.exe
2014-09-11 07:02 . 2013-02-27 17:56 101694776 ----a-w- c:\windows\system32\MRT.exe
2014-09-02 12:15 . 2011-03-29 02:36 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-07-25 06:35 . 2014-07-25 06:35 875688 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll
2014-07-25 03:47 . 2014-07-25 03:47 869544 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2014-07-14 02:02 . 2014-08-12 19:54 1216000 ----a-w- c:\windows\system32\rpcrt4.dll
2014-07-14 01:40 . 2014-08-12 19:54 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2014-07-09 02:03 . 2014-08-12 19:54 7168 ----a-w- c:\windows\system32\KBDYAK.DLL
2014-07-09 02:03 . 2014-08-12 19:54 7168 ----a-w- c:\windows\system32\KBDTAT.DLL
2014-07-09 02:03 . 2014-08-12 19:54 7168 ----a-w- c:\windows\system32\KBDRU1.DLL
2014-07-09 02:03 . 2014-08-12 19:54 6656 ----a-w- c:\windows\system32\KBDRU.DLL
2014-07-09 02:03 . 2014-08-12 19:54 7168 ----a-w- c:\windows\system32\KBDBASH.DLL
2014-07-09 01:31 . 2014-08-12 19:54 7168 ----a-w- c:\windows\SysWow64\KBDYAK.DLL
2014-07-09 01:31 . 2014-08-12 19:54 6656 ----a-w- c:\windows\SysWow64\KBDBASH.DLL
2014-06-30 22:24 . 2014-08-13 07:01 8856 ----a-w- c:\windows\system32\icardres.dll
2014-06-30 22:14 . 2014-08-13 07:01 8856 ----a-w- c:\windows\SysWow64\icardres.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2010-11-21 . E589BCD6041786C5E38E2D223C24C193 . 680960 . . [6.1.7601.17514] .. c:\windows\winsxs\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll
[-] 2010-11-21 . E589BCD6041786C5E38E2D223C24C193 . 680960 . . [6.1.7601.17514] .. c:\windows\system32\termsrv.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2013-01-14 21:12 1020424 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2013-01-14 21:12 1020424 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2013-01-14 21:12 1020424 ----a-r- c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-11-20 59720]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-11-20 59720]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"Carbonite Backup"="c:\program files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe" [2013-01-14 1065480]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-05-08 959904]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2011-09-05 36760]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2011-09-05 2904984]
"Intuit SyncManager"="c:\program files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2014-06-26 3775800]
.
c:\users\Joe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files (x86)\MagicDisc\MagicDisc.exe [2012-12-2 576000]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Intuit Data Protect.lnk - c:\program files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe /Startup [2014-6-26 6306104]
OSR_TinyWeb.lnk - c:\program files (x86)\Intuit\IDN\Common\TinyWeb\TINY.EXE "c:\program files (x86)\Intuit\IDN" 2211 127.0.0.1 [2013-11-7 58880]
QuickBooks Update Agent.lnk - c:\program files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2014-6-26 1129288]
QuickBooks_Standard_21.lnk - c:\program files (x86)\Intuit\QuickBooks 2014\QBW32.EXE -silent [2014-6-26 1215816]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 QuickBooksDB24;QuickBooksDB24;c:\progra~2\Intuit\QUICKB~3\QBDBMgrN.exe;c:\progra~2\Intuit\QUICKB~3\QBDBMgrN.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S2 CalendarSynchService;CalendarSynchService;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe;c:\program files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 MySQL55;MySQL55;c:\program files\MySQL\MySQL Server 5.5\bin\mysqld --defaults-file=c:\programdata\MySQL\MySQL Server 5.5\my.ini MySQL55;c:\program files\MySQL\MySQL Server 5.5\bin\mysqld --defaults-file=c:\programdata\MySQL\MySQL Server 5.5\my.ini MySQL55 [x]
S2 QBVSS;QBIDPService;c:\program files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe;c:\program files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - PROCMON23
*Deregistered* - PROCMON23
.
Contents of the 'Scheduled Tasks' folder
.
2013-03-26 c:\windows\Tasks\HPCeeScheduleForJoe.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15 12:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2013-01-14 21:01 1292808 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2013-01-14 21:01 1292808 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2013-01-14 21:01 1292808 ----a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPSYSDRV"="c:\program files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE" [2008-11-20 62768]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"MFNetworkScanUtility"="c:\program files\Canon\Canon MF Network Scan Utility\CNMFSUT6.EXE" [2012-09-27 486552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-01-11 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-01-11 399984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2013-01-11 441968]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
Trusted Zone: google.com
Trusted Zone: google.com\local
Trusted Zone: google.com\maps
Trusted Zone: google.com\www
TCP: DhcpNameServer = 167.206.245.135 167.206.245.136
TCP: Interfaces\{C8689D7E-ECE1-4260-9B44-C9B66C606ACC}: DhcpNameServer = 167.206.245.135 167.206.245.136
DPF: {0AD584EB-F10F-46F7-BCB8-1085C386BEAE} - hxxps://merchantaccount.quickbooks.com/recurchrg/IntuitRecurPayCom2009.cab
DPF: {5C709EEC-DDE1-4738-8E57-7564E2637891} - hxxps://merchantaccount.quickbooks.com/sync/QBMASSyncCom1_2009.cab
DPF: {788539E8-002D-4E59-9089-40B694A99C9A} - hxxps://merchantaccount.quickbooks.com/sync/QBMASSyncCom2_2008.cab
FF - ProfilePath - c:\users\Joe\AppData\Roaming\Mozilla\Firefox\Profiles\oyv1mqiu.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com/?ei=utf-8&fr=tightropetb&type=11053_091114
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=tightropetb&type=11053_091114&p=
FF - ExtSQL: !HIDDEN! 2013-02-18 13:52; [email protected]; c:\users\Joe\AppData\Roaming\Mozilla\Firefox\Extensions\MozillaHotfix
FF - user.js: plugin.state.npconduitfirefoxplugin - 0
FF - user.js: plugin.state.nptnt - 2
FF - user.js: plugin.state.nptnt - 2
FF - user.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=tightropetb&type=11053_091114&p=
FF - user.js: browser.search.defaultenginename - Yahoo:
FF - user.js: browser.keywordURLPromptDeclined - 1
FF - user.js: browser.startup.homepage - hxxp://search.yahoo.com/?ei=utf-8&fr=tightropetb&type=11053_091114
FF - user.js: browser.startup.page - 1
FF - user.js: browser.newtab.url - file:///c:\users\Joe\AppData\Local\TNT2\2.0.0.1855\pinnedSearch.htm
FF - user.js: browser.newtab.url -
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKLM-Run-tvncontrol - c:\program files (x86)\TightVNC\tvnserver.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM_Wow6432Node-ActiveSetup-{438363A8-F486-4C37-834C-4955773CB3D3} - msiexec
WebBrowser-{8D0BF943-CE38-44DF-A40D-B18FD3C8645B} - (no file)
AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MySQL55]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.5\bin\mysqld\" --defaults-file=\"c:\programdata\MySQL\MySQL Server 5.5\my.ini\" MySQL55"
.
Continued in next post...

 

[Buratti]

--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_152.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_152.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_152.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_152.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}]
@Denied: (A) (Everyone)
"Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane\0]
"Key"="ActionsPane"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-09-25 17:26:06
ComboFix-quarantined-files.txt 2014-09-25 21:26
.
Pre-Run: 354,597,793,792 bytes free
Post-Run: 361,665,290,240 bytes free
.
- - End Of File - - 21EBA100AE77A2E8AAB30296B824A2B9

 

[Buratti]

AdwCleaner Log:

# AdwCleaner v3.310 - Report created 26/09/2014 at 09:26:22
# Updated 12/09/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Joe - JOE
# Running from : C:\Users\Joe\Desktop\adwcleaner_3.310.exe
# Option : Clean
***** [ Services ] *****

***** [ Files / Folders ] *****
File Deleted : C:\Users\Joe\AppData\Roaming\Mozilla\Firefox\Profiles\oyv1mqiu.default\user.js
***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\biclient_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_free-pdf-unlocker_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_free-pdf-unlocker_RASMANCS
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : HKCU\Software\Softonic
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17280

-\\ Mozilla Firefox v18.0.1 (en-US)
[ File : C:\Users\Joe\AppData\Roaming\Mozilla\Firefox\Profiles\oyv1mqiu.default\prefs.js ]
Line Deleted : user_pref("plugin.state.npconduitfirefoxplugin", 0);
-\\ Google Chrome v
*************************
AdwCleaner[R0].txt - [2546 octets] - [26/09/2014 09:17:16]
AdwCleaner[S0].txt - [2332 octets] - [26/09/2014 09:26:22]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2392 octets] ##########

 

[Buratti]

JRT Log:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.2.2 (09.26.2014:2)
OS: Windows 7 Home Premium x64
Ran by Joe on Fri 09/26/2014 at 9:46:15.50
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


~~~ Services

~~~ Registry Values

~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{31712969-34FA-45D3-B2C7-B7790F15333F}

~~~ Files

~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Joe\appdata\local\{3F8D38B4-5A31-4ABB-997A-D9C43D23F0DF}

~~~ Event Viewer Logs were cleared


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 09/26/2014 at 9:48:28.94
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[Buratti]

The system scan log keeps crashing IE whenever I paste it so it is attached here instead...

 

[ThrashZone]

transaction
2014-09-26 17:10:12, Info                  CSI    0000032b Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2014-09-26 17:10:12, Info                  CSI    0000032c [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-09-26 17:10:12, Info                  CSI    0000032d Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2014-09-26 17:10:12, Info                  CSI    0000032e [SR] Cannot repair member file [l:22{11}]"termsrv.dll" of Microsoft-Windows-TerminalServices-RemoteConnectionManager, Version = 6.1.7601.17514, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral in the store, hash mismatch
2014-09-26 17:10:12, Info                  CSI    0000032f [SR] This component was referenced by [l:202{101}]"Microsoft-Windows-Foundation-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.WindowsFoundationDelivery"
2014-09-26 17:10:12, Info                  CSI    00000330 Hashes for file member \??\C:\windows\System32\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2014-09-26 17:10:12, Info                  CSI    00000331 Hashes for file member \SystemRoot\WinSxS\amd64_microsoft-windows-t..teconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_ecc547376ae3a1a3\termsrv.dll do not match actual file [l:22{11}]"termsrv.dll" :
  Found: {l:32 b:QYOQGQFNyArWS4rDiX4yE+DwPlLJ9doGTc1o3w47yls=} Expected: {l:32 b:b6DQfOGKOmnYLuSdh18UHjlAbpLDTqx2rE6wUubry80=}
2014-09-26 17:10:12, Info                  CSI    00000332 [SR] Could not reproject corrupted file [ml:520{260},l:46{23}]"\??\C:\windows\System32"\[l:22{11}]"termsrv.dll"; source file in store is also corrupted
2014-09-26 17:10:12, Info                  CSI    00000333 Repair results created:
POQ 137 starts:
     0: Set Key Value: Key = [l:168{84}]"\Registry\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Sysprep\Specialize", Value = [l:76{38}]"{6ae3a1a3-4737-ecc5-0218-900956130400}", Type = REG_SZ (1), Data = {l:116 b:43003a005c00770069006e0064006f00770073005c00530079007300740065006d00330032005c00730065007400750070005c007400730073007900730070007200650070002e0064006c006c002c00520043004d00530079007300500072006500700052006500730074006f00720065000000}
POQ 137 ends.
2014-09-26 17:10:12, Info                  CSI    00000334 [SR] Repair complete
2014-09-26 17:10:12, Info                  CSI    00000335 [SR] Committing transaction
2014-09-26 17:10:12, Info                  CSI    00000336 Creating NT transaction (seq 2), objectname [6]"(null)"
2014-09-26 17:10:12, Info                  CSI    00000337 Created NT transaction (seq 2) result 0x00000000, handle @0x1aec
2014-09-26 17:10:12, Info                  CSI    [EMAIL="00000338@2014/9/26:21:10:12.787"]00000338@2014/9/26:21:10:12.787[/EMAIL] CSI perf trace:
CSIPERF:TXCOMMIT;204494
2014-09-26 17:10:12, Info                  CSI    00000339 [SR] Verify and Repair Transaction completed. All files and registry keys listed in this transaction  have been successfully repaired

??????

 

[Buratti]

Not quite sure what you mean with the question marks... Is that from the attached system scan file??? if so, there is something fishy with that. If I try to copy and paste it directly in this message it instantly crashes IE. If I try to attach the file directly it says it exceeds the 2MB limit (actual size is 3.5MB) If copied and pasted into WORD it says its was over 1200 pages long... I re-copied, repasted and adjusted formatting to view better and reattached again. Hope this is better...

 

[ThrashZone]

Hi,
Yes they are too big,
You should be pasting into NotePad not word,
But yes they still need to be split and use the Text attachment,
I just happened to place a portion in code brackets to quickly show the last part,

You never did this :/
http://www.sevenforums.com/browsers...steriously-stopped-working-2.html#post2895351

 

[Buratti]

I have to split the CBS file into 5 .txt files in order for them to correctly upload and attached them. As for the question if I ever preformed that step... Like I stated in a previous post, I am away from the problematic computer until Monday, so everything I can do now is through Remote Desktop. I was able to preform the Clean Boot via Remote Desktop, but not able to boot into Safe Mode (unless you know of some trick to do so remotely).

Edit:
Oops. I didn't see the part where you asked for the screen shots. I will attach them in the next post...

 

[Buratti]

here are the MSConfig screenshots

 

[Anak]

I have to split the CBS file into 5 .txt files in order for them to correctly upload and attached them. As for the question if I ever preformed that step... Like I stated in a previous post, I am away from the problematic computer until Monday, so everything I can do now is through Remote Desktop. I was able to preform the Clean Boot via Remote Desktop, but not able to boot into Safe Mode (unless you know of some trick to do so remotely).

Edit:
Oops. I didn't see the part where you asked for the screen shots. I will attach them in the next post...

Hi Buratti, couple of questions.

• When you say remote desktop (RD) do you mean Windows RD?

• And, how are you trying to start safe mode, are you trying through a CMD prompt or going thru msconfig?

If you are having difficulty with some CMD's to the remote machine it may be because the operating systems are different. Is your machine at work Home Premium also?

My interest in your thread stems from the fact that I also have Vz Fios and I may have a couple of ways to straighten out your Outlook Mail situation.

• One is a Vz troubleshooter.

• The other is In-Home Agent (IHA), do you have IHA installed? If you do, where?

I will try to guide you on the path that ThrashZone (TZ), and Slartybart (SB) started you on until they return.
For now please answer my first two questions.

 

[Buratti]

Yes I am connecting through Windows Remote Desktop
While I am connected via RD I have NOT booted into safe mode, so the question of through CMD or MSCONFIG is irrelevant at the moment. When I return to work on Monday I can boot into Safe Mode via CMD. As for the OS's... They both are the same version... Win 7 home Premium.

You are correct as to the Fios service. I have Fios at home but use the same email address for work, which is why its so important to correct this problem. I have not tried the IHA nor the Verizon troubleshooter on either computer. I just figured they would suggest me to preform the basic tasks I have already done.

 

[ThrashZone]

Hi,
Yea I'm sorry I don't see any red flags but there are two Unknown entries :/
Home premium doesn't have group policies so that's out ?
Only thing I can think of is firewall blocking ?

Have you tried creating a new admin account to test with ?
Hopefully Anak or SlartyBart can come with something brilliant with the added info
Good luck and thanks everyone for all input
Cheers.

 

[Anak]

This could be a problem with IE11 on some systems, as far as I know Microsoft hasn't acknowledged the problem, yet.

I've located one thread where drop-down boxes are coming up blank and there are four possible work-around's for the problematic machine: Document mode and User Agent String dropdowns empty in F12 dev tools - Microsoft Community (MSC)

1.) One is TZ's suggestion to create a new user account. This helped some but not others. The problem here seems to stem from IE looking in the wrong place:

Actually the problem seems to be caused by some files being searched at the wrong (I believe he means location). A wrong profile looks for files in %appdata% path iirc while a newly created profile looks for files in the %userprofile% location. Deleting the mentioned registry entry fixes it all as the correct paths are created anew.....Source: 8th post | olefebvre

1a.) http://www.sevenforums.com/tutorials/181024-user-account-create.html There are instructions at the top of page 2 on the MSC thread to lessen the impact of a new user account by moving some of the old account data files to the new account.

2.) If you don't want to rebuild your settings for the new user account there is a registry mod, again helped some but not others.

3.) Make sure your graphics card drivers are up to date, but this made no difference to the original poster's situation.

4.) Delete the IETemp directory (Folder) this is a hidden file: %TEMP%\TempIE: http://www.sevenforums.com/tutorials/394-hidden-files-folders-show-hide.html


As far as IHA or the Verizon troubleshooter on either computer, you may be right; They may just suggest steps you've already done, but they may also suggest steps you haven't even considered.

This should be automatic with little input from you, the first one focuses on Outlook: Verizon Fix Your Email Account

In case you need IHA: Verizon In Home Agent

General email help: Troubleshooting | FiOS Internet | Residential Support | Verizon

 

[Slartybart]

Can you connect to Vze in Firefox?

Carry on with suggestions from Mike (Thrashzone) and Steve (Anak).

I'll look a little deeper into the CBS logs

Thanks for posting all of the information and the recap - it really helps a lot.

+edit

Following Steve's lead, you might try running the Old Timer - Temp File Cleaner
Restart your machine now in case there are any system operations pending

Click here to download Old Timer-Temp File Cleaner (TFC).

   Note

Save the application to your Desktop.

Old Timer-TFC is a standalone application, there is no install.

   Warning

Save your work and close all open windows.

:ar: TFC will close ALL open programs including your browser!

Do not work on other things while TFC is running - most applications use some sort of temporary files.
Let TFC run by itself on the machine until it completes, it shouldn't take very long.

Right click the Old Timer - TFC application on your Desktop,
Select Run as administrator from the alternate menu.

Click the Start button to begin the cleaning up temporary files and folders.

:busted: Restart your machine after TFC completes.

---

Researching this issue turned up some things that I'd like to move out of the way.

The first is RDP - please do all testing and suggested resolutions while physically at the machine exhibiting the issue. I came across a reference to remote ActiveX and another related to Terminal services licensing. I'm uncertain that these have any bearing on the issue, but it's better to eliminate possible causes to avoid chasing the wrong rabbit.

The next things are software installed on your system. These are mostly notes that require follow-up. Before making any changes, please discuss the software use with a SF member - you might not want to change some things - members need to know how you use your system to advise you.

GrooveMonitor - this is old software - if you do not use it, please see How to uninstall Groove. If you do use it, then we can see about updating it to the current offering -> SharePoint.

Switchboard: Part of Adobe Creative Suite applications and connected to Adobe Air applications.
This is one of those applications that require more discussion.
Do you use Adobe CS? I've never found a use for Adobe Air, but I don't have CS on my machine.

Bonjour - this can be uninstalled. It is tied to Apple software and provides zero configuration for networks. Windows already has this function - the Apple version is not needed.​

-edit

Bill
.

 

[Buratti]

OK, here's the latest update... Working on physical computer and not connected via remote desktop.
1. I tried open the website in Firefox. The website opened, but the login dropdown is still blank like the original problem. In IE the entire site still wont load.
2. I tried creating a new Admin account... The website opened in IE, but STILL the login dropdown was blank and Outlook wouldn't connect.
3. Tried the registry mod... no difference
4. Ran TFC- Restart... No change

Downloaded the IHA... Strangely enough I was able to open the download page for the IHA (being a Verizon.com domain), and downloaded it. I installed and now it also displays a "blank" login page. See screen shot.

This should be automatic with little input from you, the first one focuses on Outlook: Verizon Fix Your Email Account

This link will not open (Verizon.com domain)

4.) Delete the IETemp directory (Folder) this is a hidden file: %TEMP%\TempIE: Hidden Files and Folders - Show or Hide

Where is the %Temp% folder located?

I have no problem uninstalling some of those software titles listed. I DO use Adobe CS but not all of the entire suite. Can do without Air and other less used features.

A further note now that I am back in the office. This "blank" login dropdown on Verizon.com AND not being able to access email through Outlook is happening through ALL computers on this network. Maybe we should be looking more specifically at a router setting or something else that would effect all computers on the network. Thoughts???

 

[Slartybart]

Good stuff - more information and screen shots, more things to research.

Single sign-on - Wikipedia, the free encyclopedia
http://www.opengroup.org/security/sso/
I'm not that familiar with SSO, OpenId, or Active Directory ... but I'll look into them for an answer.
Another SF member might know this stuff and offer a few things while I'm still looking
+edit

What is the application in the screenshot that shows the web page error?​

-edit

Side question - is the eMail on Verizon or is it a verizon.Yahoo account?

%temp% is an environment variable that points to your Temp folder

If you open a command prompt and enter

cd %TEMP%​

you'll be in the temp folder.

If you enter

Dir /a​

you should see everything in the temp folder

To see the folder in Explorer, you have to change folder options -> view tab to display hidden files.

I looked on my machine and did not find an IEtemp or TempIE folder. I also searched the Internet for that specific folder name and didn't find a match - so it might just be nomenclature, although Mike specifically named it.

The easiest way to clean up IE is to Delete Browsing History in Internet Options. Select what you want deleted, but be careful - cookies and passwords will get deleted too if you pick those menu items.