Weird Icon Overlay Appearing Over Shortcuts/Executables

[Wingz]

So, for about a week or so, this icon as appeared as an overlay above the icons for my internet shortcuts and executable files.
It has also been recently replacing the normal icon that it overlays with a blank paper-like icon after running the shortcut/executable, no matter what the previous icon was.
I don't have a virus as I have ran MSE and Malwarebytes numerous times and they have both found nothing.
I honestly have no clue what the icon is for or where it came from.
If anyone could give any help, I'd be very appreciative.

Icon: [img]http://puu.sh/5rjMg.png[/img]
Example of it in action: [img]http://puu.sh/5rkgv.png[/img] [img]http://puu.sh/5rkny.png[/img]

[Psycommu]

I tried reverse image searching it.
[url=https://www.google.com/search?tbs=sbi:AMhZZitozsHqL2QxdNxl6z7JCDAJ2_1ELhxHdkVoGPVIXq9m_1xfxo8Ls0SzOzyixvBF_1m_1P3yyDmX63USL2nruKnrBIELR6nKwN0GuumywdA0lCCYfqV5BU1OOOQn9wvlF6ruUmyrpGrMUbtZHWEvsTmXsL2tVwoVFmuaUcY6Y8lM7kCLl0Nq-ykuG_14DmSzke3QFfVNPflB2cV0H5OTfa_1r84u-56EJ5iy9fEw3pa4O7TUvF3zlr24TsBfsSNuw4dgrLDklRuaXaEpaBYRWssMExLMSB1xf4B65I_1bktyFyE_10CgcIcmruRxkG8Rsgpi0pd3SbmEwGNkM-_1gweOovNGm_1HyfxsY2TCQsOS0OqOKNWx5rcA79wG2OEp0RyQIK_1jhi80MnPq6zeOoMmpCcEbxYeMAtRSeDBF0q6LBGSM-_1qzrl8egqk6lFQ63OJewRSvjIDxRzRxj65HzgMzdsq6rLz_149nfO70KI8oksp-yFqGX1XRRURD4uY49MQJmSwvu68SFbyXFcRnkRog5br5Vfx-Pc0P86l-sUIsGTODwcunaHoZuqYC9JEVBx7xra4gxlLAfcTc2kC0Mlw13wyOMWjF2gM8TFvZRL-wRcIYDQ01hcm6BNjxfwk6m5nttzJNoHIl8hmDS6LjS8hUB6FMbi2GBofzn_1AuXHVbIyPsaE89wWp_1upsGvqC33q4agrQrtk4u4TVHOnLxN4ZfUrC3hJv9mRtAFF9rzVOlEg9u4y5ij4AXfpijqpjfTUN0EQQTuz-7-T9xNyv_1D9k9SDD_1vxadY2QWuFSg2bDUOljEHPwYxoCIaVrxxjQPAAwQKexEfGEwtShxfr6xelRsSu6uidcnO1aZJkH_1pTIuG5G3JTo7CS9oKQ_1ksaadv_15cH7gLjNOrkD_1uQUOovyU5BWpzcdwiWXQiAgHbSS9HTMfk7JFh2BpCvNuB5hne-rQRxrBvygSZbPpfy45f0NfBi7KGalA0kj6TLWVhbAafqnEXvcunmayU5XRZK-2j5Q8rYYQ0h8L6oW3xZXMbkXZ0yzfDrK0HTuyK3_1DFKcY0aR1Qo3_1eL0QwQ5fwrPlLcBDsi1_1I4ZHZbwzcb0bwZ1c7cH2Pl0dBzK_1yXdKqjaL_1O_17zO9jtrhsW5j_1xTloHWMt5CDCTdqJp6KP-M_1t&hl=en&biw=1294&bih=683&site=imghp&sa=X&ei=sm-RUvHiBJHFsATg_oGoBw&ved=0CE8Q9Q8oAA]This is the result.[/url]

[Wingz]

yea, i did that too
but none of the results have any relevence with me

[Psycommu]

I didn't think so, which is what makes this even more strange.
Did you install anything recently? Any major changes to any settings that you can think of? Just trying to cover all the basic bases here.

[Wingz]

i dont have the greatest memory, and i dont know exactly when it happened, but i can give a couple of key things that i did that might have to do with it

1) i got a sort of bluescreen thing that shut off my computer completely out of the blue (it closed too fast so i couldnt read it, but it has since not been repeated) (it was the only bluescreen ive ever gotten, ever)
2) it takes explorer.exe about a minute to actually load my desktop and things like that (before the bluescreen, its been automatic
3) i can close and reopen explorer.exe for the desktop and stuff to immediately load
4) i have made a registry change regarding the windows 7 libraries (i removed them via a step-by-step tutorial found on the official windows 7 forums and in a way that shouldnt have affected anything else)

thats about all the relevent information i have
it really is an absolute mystery to me too, or I'd have it solved

[naelstrof]

Press windowskey+r and run msconfig

Try disabling non-critical services and boot items. Otherwise I believe there's a program that has been installed that integrated itself with explorer. (Photobook)

Which removing it should solve the problem

[Wingz]

ive ran msconfig everything was okay
ive never encountered or even searched for anything related to photobook before asking this question
and i also got my second blue screen today
i dont know how to make the blue screen last longer so i can actually read it tho

[whatthe]

[QUOTE=Wingz;42969915]ive ran msconfig everything was okay
ive never encountered or even searched for anything related to photobook before asking this question
and i also got my second blue screen today
i dont know how to make the blue screen last longer so i can actually read it tho[/QUOTE]

it should dump BSOD logs here: "c:/windows/minidump"

[Wingz]

okay, and how do i gain access to the info stored in a dmp file

[Mike_Tyson]

[QUOTE=Wingz;42970191]okay, and how do i gain access to the info stored in a dmp file[/QUOTE]

i can check it if you want, or you can use this program
[url]http://www.nirsoft.net/utils/blue_screen_view.html[/url]

[elix]

Try recreating the icon cache. Copy and paste the text in the quote below into a Notepad file and save it with a .bat extension on your desktop. Remember to make Notepad save it as "all files" and not a .txt file. When you're ready, run it as admin.

[B]Warning: This will shut down Windows Explorer and then restart your machine when you run it.[/B] Only run it when you've got everything you care about shut down properly.

[QUOTE]ie4uinit.exe -ClearIconCache
taskkill /IM explorer.exe /F
del "%localappdata%\IconCache.db" /A
shutdown /r /f /t 00[/QUOTE]

[URL="http://www.sevenforums.com/tutorials/49819-icon-cache-rebuild.html"]Source[/URL]

[Wingz]

[QUOTE=Mike Tyson;42972397]i can check it if you want, or you can use this program
[url]http://www.nirsoft.net/utils/blue_screen_view.html[/url][/QUOTE]

I've checked the dmp file and googled the bug check via the program. It lead me to this.
[url]http://msdn.microsoft.com/en-us/library/windows/hardware/ff559271(v=vs.85).aspx[/url]
The 3 offending (highlighted pinkish) files are hal.dll, ntoskrnl.exe, and win32k.sys.
According to the program, hal.dll appears to be a hardware abstraction layer dll, ntoskrnl.exe appears to be the NT kernel and system, and win32k.sys appears to be a multi-user win32 driver.
I found this on the above link
[img]http://puu.sh/5stLD.png[/img]
I will use the recovery console via a usb after trying to restart the icon cache as elixwhitetail explained.
Hopefully I can get this all sorted out.

[editline]24th November 2013[/editline]

oh, and this is the full thing tha ti failed to check before
apparently win32k.sys is the faulty driver/whatever
[img]http://puu.sh/5suwJ.png[/img]

[elix]

Oh, derp. I got all wrapped up in making sure I got the icon cache instructions and everything correct (so I didn't fuck your computer :v:) that I forgot to also suggest running the System File Checker. You may need a Win7 disc.

Open a command prompt as administrator and run this command: sfc /scannow

Do this before rebooting into the recovery console, because what you'd be doing in there is stopping the offending service..but we don't know what the problem is yet.

[Wingz]

[QUOTE=elixwhitetail;42972802]Oh, derp. I got all wrapped up in making sure I got the icon cache instructions and everything correct (so I didn't fuck your computer :v:) that I forgot to also suggest running the System File Checker. You may need a Win7 disc.

Open a command prompt as administrator and run this command: sfc /scannow

Do this before rebooting into the recovery console, because what you'd be doing in there is stopping the offending service..but we don't know what the problem is yet.[/QUOTE]

so, icon cache, then sfc /scannow, then recovery console?

[elix]

[QUOTE=Wingz;42972827]so, icon cache, then sfc /scannow, then recovery console?[/QUOTE]

Hold off on recovery console entirely for the moment, please. It's unwise to leap into disabling services (which is what the bit you posted above is suggesting you do with the recovery console) if you don't know the source of the problem.

I did a bit of searching on the BSOD error info you gave (the image). Tell me about your video card. What model is it, and what version are your drivers? (Nvidia are xxx.xx, AMD are xx.xx)

[URL="http://answers.microsoft.com/en-us/windows/forum/windows_7-system/blue-screen-0x1000008e/5bc2def6-083c-429d-8696-8423d1df3893"]Here's one source, on Microsoft's own forums.[/URL] The issue itself isn't the same as what you're experiencing, but the advice the top answer has is mostly broad and generic and refers to video drivers, BIOS, and then there's the fact that 0x1000008E is the same as 0x0000008E (haven't dug into that yet). I'm not in a rush to get too far ahead of myself, so don't update any drivers yet, just check your version.

[Wingz]

[QUOTE=elixwhitetail;42972856]Hold off on recovery console entirely for the moment, please. It's unwise to leap into disabling services (which is what the bit you posted above is suggesting you do with the recovery console) if you don't know the source of the problem.

I did a bit of searching on the BSOD error info you gave (the image). Tell me about your video card. What model is it, and what version are your drivers? (Nvidia are xxx.xx, AMD are xx.xx)[/QUOTE]

Alright, ill hold off on the recovery console. My GPU is an ATI Radeon HD 4200. Its version is 8.970.100.3000.

[img]http://puu.sh/5sv0V.png[/img]

[elix]

I edited my previous post with more info, please make sure you check it. :v:

I think a driver update is in order, but we're not going to do that [U]yet[/U]. One thing at a time.

Wingz, please run the icon cache rebuild. If, after the reboot, the icon stuff isn't fixed, please run sfc /scannow in the admin-level command prompt. That'll require a reboot if it changes anything, as well.

[Wingz]

righto

[elix]

While you're doing that, I've got one more thing racked up. If the icon thing is fixed, well, fantastic, but if Explorer is still crankyfucked like it has been since the BSOD, then we're not done.

Drivers are still on hold here. Download (use the button to generate a randomly-named exe instead of the zip download -- the exe can be trusted) GMER from [URL="http://www.gmer.net/"]gmer.net[/URL]. GMER is a powerful toolkit, but my primary interest in it at this moment is for diagnostic purposes.

When GMER starts up, it begins a scan of your system to sort of establish a baseline idea of what might be going on. The main window should start to have text showing up. Black text is normal and we can basically ignore it. Red text is a sign of trouble, but it is not quite the same as a positive hit on a virus scanner. After 3 minutes or so, unless it's still pushing text to the screen, it's probably finished with the initial scan.

[Wingz]

so, i rebuilt the icon cache
ran the sfc /scannow

the icon cache thing did nothing
the sfc /scannow only managed to get rid of my visual style

ill do the gmer thing now

[editline]24th November 2013[/editline]

should i click scan?
and if so, what settings do i enable
it doesnt appear to be doing anything atm
[img]http://puu.sh/5swY3.png[/img]

[editline]24th November 2013[/editline]

bump bcuz edit

[elix]

Make sure you run it as admin, it should be doing its thing silently. Give it 3 minutes or so. Sometimes it won't return anything during the first scan, and that's normal and usually a good thing.

If you want, uncheck Files and ADS and hit scan, remembering that red is bad, everything else is very likely normal.

Gmer is probably going to come up with nothing, and that's what we're hoping for, but it's worth running to make sure.

[Wingz]

gmer finished scanning
im not sure if you want the log, since nothing came up red
but here it is anyway
[quote]GMER 2.1.19163 - [url]http://www.gmer.net[/url]
Rootkit scan 2013-11-24 22:59:26
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\0000005d WDC_WD16 rev.03.0 149.05GB
Running: h59z8gd0.exe; Driver: C:\Users\Parent\AppData\Local\Temp\uxtoypow.sys

---- Kernel code sections - GMER 2.1 ----

.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 83855A15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 8388F212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x91C0C000, 0x2BFBF0, 0xE8000020]

---- User code sections - GMER 2.1 ----

.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtCreateFile + 6 773C560E 4 Bytes [28, A0, 1B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtCreateFile + B 773C5613 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtMapViewOfSection + 6 773C5C6E 4 Bytes [28, A3, 1B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtMapViewOfSection + B 773C5C73 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtOpenFile + 6 773C5D1E 4 Bytes [68, A0, 1B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtOpenFile + B 773C5D23 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtOpenProcess + 6 773C5DCE 4 Bytes [A8, A1, 1B, 00] {TEST AL, 0xa1; SBB EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtOpenProcess + B 773C5DD3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtOpenProcessToken + B 773C5DE3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtOpenProcessTokenEx + 6 773C5DEE 4 Bytes [A8, A2, 1B, 00] {TEST AL, 0xa2; SBB EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtOpenProcessTokenEx + B 773C5DF3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtOpenThread + 6 773C5E4E 4 Bytes [68, A1, 1B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtOpenThread + B 773C5E53 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtOpenThreadToken + 6 773C5E5E 4 Bytes [68, A2, 1B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtOpenThreadToken + B 773C5E63 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtOpenThreadTokenEx + B 773C5E73 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtQueryAttributesFile + 6 773C5F7E 4 Bytes [A8, A0, 1B, 00] {TEST AL, 0xa0; SBB EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtQueryAttributesFile + B 773C5F83 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtQueryFullAttributesFile + B 773C6033 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtSetInformationFile + 6 773C667E 4 Bytes [28, A1, 1B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtSetInformationFile + B 773C6683 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtSetInformationThread + 6 773C66DE 4 Bytes [28, A2, 1B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtSetInformationThread + B 773C66E3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtUnmapViewOfSection + 6 773C69FE 4 Bytes [68, A3, 1B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2132] ntdll.dll!NtUnmapViewOfSection + B 773C6A03 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtCreateFile + 6 773C560E 4 Bytes [28, A0, 8B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtCreateFile + B 773C5613 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtMapViewOfSection + 6 773C5C6E 4 Bytes [28, A3, 8B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtMapViewOfSection + B 773C5C73 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtOpenFile + 6 773C5D1E 4 Bytes [68, A0, 8B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtOpenFile + B 773C5D23 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtOpenProcess + 6 773C5DCE 4 Bytes [A8, A1, 8B, 00] {TEST AL, 0xa1; MOV EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtOpenProcess + B 773C5DD3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtOpenProcessToken + B 773C5DE3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtOpenProcessTokenEx + 6 773C5DEE 4 Bytes [A8, A2, 8B, 00] {TEST AL, 0xa2; MOV EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtOpenProcessTokenEx + B 773C5DF3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtOpenThread + 6 773C5E4E 4 Bytes [68, A1, 8B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtOpenThread + B 773C5E53 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtOpenThreadToken + 6 773C5E5E 4 Bytes [68, A2, 8B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtOpenThreadToken + B 773C5E63 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtOpenThreadTokenEx + B 773C5E73 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtQueryAttributesFile + 6 773C5F7E 4 Bytes [A8, A0, 8B, 00] {TEST AL, 0xa0; MOV EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtQueryAttributesFile + B 773C5F83 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtQueryFullAttributesFile + B 773C6033 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtSetInformationFile + 6 773C667E 4 Bytes [28, A1, 8B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtSetInformationFile + B 773C6683 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtSetInformationThread + 6 773C66DE 4 Bytes [28, A2, 8B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtSetInformationThread + B 773C66E3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtUnmapViewOfSection + 6 773C69FE 4 Bytes [68, A3, 8B, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2284] ntdll.dll!NtUnmapViewOfSection + B 773C6A03 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtCreateFile + 6 773C560E 4 Bytes [28, 90, 7E, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtCreateFile + B 773C5613 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtMapViewOfSection + 6 773C5C6E 4 Bytes [28, 93, 7E, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtMapViewOfSection + B 773C5C73 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtOpenFile + 6 773C5D1E 4 Bytes [68, 90, 7E, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtOpenFile + B 773C5D23 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtOpenProcess + 6 773C5DCE 4 Bytes [A8, 91, 7E, 00] {TEST AL, 0x91; JLE 0x4}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtOpenProcess + B 773C5DD3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtOpenProcessToken + B 773C5DE3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtOpenProcessTokenEx + 6 773C5DEE 4 Bytes [A8, 92, 7E, 00] {TEST AL, 0x92; JLE 0x4}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtOpenProcessTokenEx + B 773C5DF3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtOpenThread + 6 773C5E4E 4 Bytes [68, 91, 7E, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtOpenThread + B 773C5E53 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtOpenThreadToken + 6 773C5E5E 4 Bytes [68, 92, 7E, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtOpenThreadToken + B 773C5E63 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtOpenThreadTokenEx + B 773C5E73 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtQueryAttributesFile + 6 773C5F7E 4 Bytes [A8, 90, 7E, 00] {TEST AL, 0x90; JLE 0x4}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtQueryAttributesFile + B 773C5F83 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtQueryFullAttributesFile + B 773C6033 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtSetInformationFile + 6 773C667E 4 Bytes [28, 91, 7E, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtSetInformationFile + B 773C6683 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtSetInformationThread + 6 773C66DE 4 Bytes [28, 92, 7E, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtSetInformationThread + B 773C66E3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtUnmapViewOfSection + 6 773C69FE 4 Bytes [68, 93, 7E, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2508] ntdll.dll!NtUnmapViewOfSection + B 773C6A03 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtCreateFile + 6 773C560E 4 Bytes [28, C0, 33, 00] {SUB AL, AL; XOR EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtCreateFile + B 773C5613 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtMapViewOfSection + 6 773C5C6E 4 Bytes [28, C3, 33, 00] {SUB BL, AL; XOR EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtMapViewOfSection + B 773C5C73 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtOpenFile + 6 773C5D1E 4 Bytes [68, C0, 33, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtOpenFile + B 773C5D23 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtOpenProcess + 6 773C5DCE 4 Bytes [A8, C1, 33, 00] {TEST AL, 0xc1; XOR EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtOpenProcess + B 773C5DD3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtOpenProcessToken + B 773C5DE3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtOpenProcessTokenEx + 6 773C5DEE 4 Bytes [A8, C2, 33, 00] {TEST AL, 0xc2; XOR EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtOpenProcessTokenEx + B 773C5DF3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtOpenThread + 6 773C5E4E 4 Bytes [68, C1, 33, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtOpenThread + B 773C5E53 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtOpenThreadToken + 6 773C5E5E 4 Bytes [68, C2, 33, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtOpenThreadToken + B 773C5E63 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtOpenThreadTokenEx + B 773C5E73 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtQueryAttributesFile + 6 773C5F7E 4 Bytes [A8, C0, 33, 00] {TEST AL, 0xc0; XOR EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtQueryAttributesFile + B 773C5F83 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtQueryFullAttributesFile + B 773C6033 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtSetInformationFile + 6 773C667E 4 Bytes [28, C1, 33, 00] {SUB CL, AL; XOR EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtSetInformationFile + B 773C6683 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtSetInformationThread + 6 773C66DE 4 Bytes [28, C2, 33, 00] {SUB DL, AL; XOR EAX, [EAX]}
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtSetInformationThread + B 773C66E3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtUnmapViewOfSection + 6 773C69FE 4 Bytes [68, C3, 33, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[2764] ntdll.dll!NtUnmapViewOfSection + B 773C6A03 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtCreateFile + 6 773C560E 4 Bytes [28, 34, F7, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtCreateFile + B 773C5613 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtMapViewOfSection + 6 773C5C6E 4 Bytes [28, 37, F7, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtMapViewOfSection + B 773C5C73 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtOpenFile + 6 773C5D1E 4 Bytes [68, 34, F7, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtOpenFile + B 773C5D23 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtOpenProcess + 6 773C5DCE 4 Bytes [A8, 35, F7, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtOpenProcess + B 773C5DD3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtOpenProcessToken + B 773C5DE3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtOpenProcessTokenEx + 6 773C5DEE 4 Bytes [A8, 36, F7, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtOpenProcessTokenEx + B 773C5DF3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtOpenThread + 6 773C5E4E 4 Bytes [68, 35, F7, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtOpenThread + B 773C5E53 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtOpenThreadToken + 6 773C5E5E 4 Bytes [68, 36, F7, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtOpenThreadToken + B 773C5E63 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtOpenThreadTokenEx + B 773C5E73 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtQueryAttributesFile + 6 773C5F7E 4 Bytes [A8, 34, F7, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtQueryAttributesFile + B 773C5F83 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtQueryFullAttributesFile + B 773C6033 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtSetInformationFile + 6 773C667E 4 Bytes [28, 35, F7, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtSetInformationFile + B 773C6683 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtSetInformationThread + 6 773C66DE 4 Bytes [28, 36, F7, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtSetInformationThread + B 773C66E3 1 Byte [E2]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtUnmapViewOfSection + 6 773C69FE 4 Bytes [68, 37, F7, 00]
.text C:\Users\Parent\AppData\Local\Google\Chrome\Application\chrome.exe[5080] ntdll.dll!NtUnmapViewOfSection + B 773C6A03 1 Byte [E2]

---- User IAT/EAT - GMER 2.1 ----

IAT C:\Windows\explorer.exe[2000] @ C:\Windows\explorer.exe [USER32.dll!LoadImageW] [100057C0] C:\Program Files\Theme Resource Changer\ThemeResourceChanger.dll

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch 9244
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{8EC67ECC-718D-47A2-9D2B-4FCDD578088D}@LeaseObtainedTime 1385350651
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{8EC67ECC-718D-47A2-9D2B-4FCDD578088D}@T1 1385350778
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{8EC67ECC-718D-47A2-9D2B-4FCDD578088D}@T2 1385350874
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{8EC67ECC-718D-47A2-9D2B-4FCDD578088D}@LeaseTerminatesTime 1385350906

---- EOF - GMER 2.1 ----
[/quote]
next step?

[elix]

Hmm... also, sorry for messing up your visual style, but sfc'll do that if you had a custom style. Its job is to ensure that system files are the originals. :v:

Just to check, how far back do your system restores go? Any available prior to the BSOD incident?

[Wingz]

[QUOTE=elixwhitetail;42973946]Hmm... also, sorry for messing up your visual style, but sfc'll do that if you had a custom style. Its job is to ensure that system files are the originals. :v:

Just to check, how far back do your system restores go? Any available prior to the BSOD incident?[/QUOTE]

could i be reminded about how i would go about checking my system restores?

[editline]25th November 2013[/editline]

nevermind, my earliest system restore goes back to 11/20/13
i dont think itll help

[elix]

No, that likely won't. Go into Control Panel, then Administrative Tools.

In the Admin Tools, open up Event Viewer. We care about the system log. However, system log will be clogged with stuff we don't care about, so click the filter option on the right and check warning/alert/error, leave info and verbose off.

What's the error text (don't paste [I]all[/I] of the info, just the for-humans error message) of the topmost (most recent) event? Also, the Event ID and Source would be very useful to have. Thanks.

[Wingz]

[img]http://puu.sh/5sBKj.png[/img]
i cant find any filter options :(

[elix]

Normally I always get the dumb pane on the right-hand side of the window. However, under action, there will be "filter current log", that's the ticket.

[Wingz]

okay, so, i found the 2 most recent errors, and they seem to reoccur
[img]http://puu.sh/5sCu4.png[/img]

[img]http://puu.sh/5sCvy.png[/img]

[elix]

Hmm, have you ever used any VPN software? If not, yellow alert time.

[Wingz]

yea, ive used openvpn twice this week

[editline]25th November 2013[/editline]

also, as for the actual crash, i found this a little bit lower
[img]http://puu.sh/5sDwq.png[/img]