Solved IE/ Foxfire question

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-03-2017
Ran by hilton (administrator) on HILTON-PC (13-04-2017 12:34:55)
Running from C:\Users\hilton\Downloads
Loaded Profiles: hilton (Available Profiles: hilton)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Intel Corporation) C:\Program Files\Intel\AMT\atchksrv.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel Corporation) C:\Program Files\Intel\Bluetooth\ibtsiva.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Intel) C:\Program Files\Intel\AMT\LMS.exe
(Intel) C:\Program Files\Intel\AMT\UNS.exe
(AVAST Software s.r.o.) C:\Program Files\AVAST Software\Avast\aswidsagent.exe
(SlimWare Utilities, Inc.) C:\Program Files\DriverUpdate\DriverUpdate.exe
(Intel Corporation) C:\Program Files\Intel\AMT\atchk.exe
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Amazon Services LLC) C:\Users\hilton\AppData\Local\Amazon Music\Amazon Music Helper.exe
(Dell) C:\Users\hilton\AppData\Local\Apps\2.0\3VGPG9W0.MPE\2E0VXQW4.WA5\dell..tion_6d0a76327dca4869_0007.000b_df227eeaae3cac0d\DellSystemDetect.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Motorola Solutions, Inc.) C:\Program Files\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files\Intel\Bluetooth\obexsrv.exe
(Motorola Solutions, Inc.) C:\Program Files\Intel\Bluetooth\mediasrv.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(CANON INC.) C:\Program Files\Canon\Quick Menu\CNQMUPDT.EXE
(Google Inc.) C:\Program Files\Google\Update\1.3.33.3\GoogleCrashHandler.exe
(SlimWare Utilities Holdings, Inc.) C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe
(SlimWare Utilities Holdings, Inc.) C:\Program Files\SlimWare Utilities\Services\SlimWare.Session.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Siber Systems) C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_25_0_0_148_ActiveX.exe
(Farbar) C:\Users\hilton\Downloads\FRST (2).exe

==================== Registry (Whitelisted) ====================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [atchk] => C:\Program Files\Intel\AMT\atchk.exe [401408 2009-12-01] (Intel Corporation)
HKLM\...\Run: [SoundMAXPnP] => C:\Program Files\Analog Devices\Core\smax4pnp.exe [1314816 2010-06-15] (Analog Devices, Inc.)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213824 2017-04-12] (AVAST Software)
HKLM\...\Run: [Fences] => C:\Program Files\Stardock\Fences\Fences.exe [3934168 2016-09-16] (Stardock Corporation)
HKLM\...\Run: [CanonQuickMenu] => C:\Program Files\Canon\Quick Menu\CNQMMAIN.EXE [1314432 2016-06-09] (CANON INC.)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files\Intel\Bluetooth\btmshellex.dll",TrayApp
HKU\S-1-5-21-3292114827-816517840-1514174382-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [7348440 2017-03-03] (Piriform Ltd)
HKU\S-1-5-21-3292114827-816517840-1514174382-1000\...\Run: [Amazon Music] => C:\Users\hilton\AppData\Local\Amazon Music\Amazon Music Helper.exe [3694056 2017-01-31] (Amazon Services LLC)
HKU\S-1-5-21-3292114827-816517840-1514174382-1000\...\Run: [Fences] => C:\Program Files\Stardock\Fences\Fences.exe [3934168 2016-09-16] (Stardock Corporation)
HKU\S-1-5-21-3292114827-816517840-1514174382-1000\...\Run: [eM Client] => C:\Program Files\eM Client\MailClient.exe [24742760 2016-10-21] (eM Client s.r.o.)
HKU\S-1-5-21-3292114827-816517840-1514174382-1000\...\Run: [DellSystemDetect] => C:\Users\hilton\AppData\Local\Apps\2.0\3VGPG9W0.MPE\2E0VXQW4.WA5\dell..tion_6d0a76327dca4869_0007.000b_df227eeaae3cac0d\DellSystemDetect.exe [310728 2017-02-07] (Dell)
HKU\S-1-5-21-3292114827-816517840-1514174382-1000\...\Run: [RoboForm] => C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe [110376 2017-04-12] (Siber Systems)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2017-04-12] (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2017-02-27]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
GroupPolicy: Restriction ? <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62
Tcpip\..\Interfaces\{7F3D0977-3F81-48D1-8A0D-5B6CF1496778}: [NameServer] 77.234.40.79
Tcpip\..\Interfaces\{B78AF187-32FB-4F20-86D2-C40DA41B6832}: [DhcpNameServer] 209.18.47.61 209.18.47.62

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://us.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_mdaffmarmarie_16_28_rps115078_rps&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtC0EyE0F0FtC0BtC0FyEyEyEtCtBtN0D0Tzu0StCyCyDyBtN1L2XzutAtFtBtBtFtAtFtCtDtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StByCzyyEtCyEtAtAtGyCtA0EtDtG0Dzz0C0CtGyEyB0FtAtGzy0AyDyDtD0AtD0Azy0D0BtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StB0Bzy0C0FtC0CzytG0D0EtB0AtGyE0EyE0BtGzzyCtBzytG0F0D0CyDyEzyzy0EtCyEtAyE2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtBtCtD%26cr%3D861529325%26a%3Dwbf_mdaffmarmarie_16_28%26os_ver%3D6.1%26os%3DWindows%2B7%2BProfessional
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_mdaffmarmarie_16_28_rps115078_rps&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtC0EyE0F0FtC0BtC0FyEyEyEtCtBtN0D0Tzu0StCyCyDyBtN1L2XzutAtFtBtBtFtAtFtCtDtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StByCzyyEtCyEtAtAtGyCtA0EtDtG0Dzz0C0CtGyEyB0FtAtGzy0AyDyDtD0AtD0Azy0D0BtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StB0Bzy0C0FtC0CzytG0D0EtB0AtGyE0EyE0BtGzzyCtBzytG0F0D0CyDyEzyzy0EtCyEtAyE2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtBtCtD%26cr%3D861529325%26a%3Dwbf_mdaffmarmarie_16_28%26os_ver%3D6.1%26os%3DWindows%2B7%2BProfessional&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_mdaffmarmarie_16_28_rps115078_rps&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtC0EyE0F0FtC0BtC0FyEyEyEtCtBtN0D0Tzu0StCyCyDyBtN1L2XzutAtFtBtBtFtAtFtCtDtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StByCzyyEtCyEtAtAtGyCtA0EtDtG0Dzz0C0CtGyEyB0FtAtGzy0AyDyDtD0AtD0Azy0D0BtD2QtN1M1F1B2Z1V1N2Y1L1Qzu2StB0Bzy0C0FtC0CzytG0D0EtB0AtGyE0EyE0BtGzzyCtBzytG0F0D0CyDyEzyzy0EtCyEtAyE2QtN0A0LzuyEtN1B2Z1V1T1S1NzutBtBtCtD%26cr%3D861529325%26a%3Dwbf_mdaffmarmarie_16_28%26os_ver%3D6.1%26os%3DWindows%2B7%2BProfessional&p={searchTerms}
BHO: RoboForm Toolbar Helper -> {724d43a9-0d85-11d4-9908-00400523e39a} -> C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2017-04-12] (Siber Systems Inc.)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2017-04-12] (AVAST Software)
Toolbar: HKLM - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2017-04-12] (Siber Systems Inc.)
Toolbar: HKU\S-1-5-21-3292114827-816517840-1514174382-1000 -> &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll [2017-04-12] (Siber Systems Inc.)
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} hxxps://files.pcpitstop.com/cab/pcmatic.cab
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - No File
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF DefaultProfile: hiltonheflin@yahoo.com
FF ProfilePath: C:\Users\hilton\AppData\Roaming\Mozilla\Firefox\Profiles\pc153f57.default-1485114558992 [2017-04-13]
FF Extension: (Adblock Plus) - C:\Users\hilton\AppData\Roaming\Mozilla\Firefox\Profiles\pc153f57.default-1485114558992\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-02-03]
FF Extension: (Disable Prefetch) - C:\Users\hilton\AppData\Roaming\Mozilla\Firefox\Profiles\pc153f57.default-1485114558992\features\{24ba2855-20b3-4585-bcde-f033a53eda89}\disable-prefetch@mozilla.org.xpi [2017-04-06]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF48
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF48 [2017-04-12]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF48
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF48 [2017-04-12]
FF HKLM\...\Firefox\Extensions: [{22119944-ED35-4ab1-910B-E619EA06A115}] - C:\Program Files\Siber Systems\AI RoboForm\Firefox\roboform.xpi
FF Extension: (RoboForm Toolbar) - C:\Program Files\Siber Systems\AI RoboForm\Firefox\roboform.xpi [2017-04-12]
FF HKU\S-1-5-21-3292114827-816517840-1514174382-1000\...\Firefox\Extensions: [{22119944-ED35-4ab1-910B-E619EA06A115}] - C:\Program Files\Siber Systems\AI RoboForm\Firefox\roboform.xpi
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-12] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-12] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-04] (Adobe Systems Inc.)

Chrome:
=======
CHR Profile: C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default [2017-04-12]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-04-12]
CHR Extension: (Docs) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-04-12]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-25]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-25]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmnlcjabgnpnenekpadlanbbkooimhnj [2017-04-12]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-04-12]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2017-04-12]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-04-12]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-04-12]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-04-12]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd [2017-04-12]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-04-12]
CHR Extension: (Gmail) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-04-03]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-12]
CHR Extension: (No Name) - C:\Users\hilton\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnlccmojcmeohlpggmfnbbiapkmbliob [2017-04-12]
CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [okmhneofinpilciglijihehjpaegledb] - <no Path/update_url>
CHR HKLM\...\Chrome\Extension: [pnlccmojcmeohlpggmfnbbiapkmbliob] - C:\Program Files\Siber Systems\AI RoboForm\Chrome\rf-chrome.crx [2016-08-12]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [5758120 2017-04-12] (AVAST Software s.r.o.)
R2 atchksrv; C:\Program Files\Intel\AMT\atchksrv.exe [176128 2009-12-01] (Intel Corporation) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [261712 2017-04-12] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [310496 2017-04-12] (AVAST Software)
R2 Bluetooth Device Monitor; C:\Program Files\Intel\Bluetooth\devmonsrv.exe [1202216 2016-07-18] (Motorola Solutions, Inc.)
R2 Bluetooth Media Service; C:\Program Files\Intel\Bluetooth\mediasrv.exe [1722408 2016-07-18] (Motorola Solutions, Inc.)
R2 Bluetooth OBEX Service; C:\Program Files\Intel\Bluetooth\obexsrv.exe [1161256 2016-07-18] (Motorola Solutions, Inc.)
R2 iBtSiva; C:\Program Files\Intel\Bluetooth\ibtsiva.exe [151280 2016-07-23] (Intel Corporation)
R2 Intel(R) PROSet Monitoring Service; C:\Windows\system32\IProsetMonitor.exe [180992 2014-10-16] (Intel Corporation)
R2 LMS; C:\Program Files\Intel\AMT\LMS.exe [102400 2009-12-01] (Intel) [File not signed]
R3 SlimWareServices; C:\Program Files\SlimWare Utilities\Services\SlimWare.Services.exe [68952 2016-08-01] (SlimWare Utilities Holdings, Inc.)
S3 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-07-22] (DEVGURU Co., LTD.)
R2 UNS; C:\Program Files\Intel\AMT\UNS.exe [2519040 2009-12-01] (Intel) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [255184 2017-04-12] (AVAST Software s.r.o.)
R0 aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [148208 2017-04-12] (AVAST Software s.r.o.)
R0 aswblog; C:\Windows\system32\drivers\aswblogx.sys [267528 2017-04-12] (AVAST Software s.r.o.)
R0 aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [41176 2017-04-12] (AVAST Software s.r.o.)
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [34136 2017-04-12] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [31064 2017-04-12] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [106904 2017-04-12] (AVAST Software)
R3 aswNetNd6; C:\Windows\System32\DRIVERS\aswNetNd6.sys [27896 2017-03-12] (AVAST Software)
R1 aswNetSec; C:\Windows\system32\drivers\aswNetSec.sys [388488 2017-04-12] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [90336 2017-04-12] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [62152 2017-04-12] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [764064 2017-04-12] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [472760 2017-04-12] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [118800 2017-04-12] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [38984 2016-12-18] (The OpenVPN Project)
R0 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [279800 2017-04-12] (AVAST Software)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [168232 2012-03-31] (Broadcom Corporation.)
S3 btmaudio; C:\Windows\System32\drivers\btmaud.sys [72168 2015-10-13] (Motorola Solutions, Inc.)
S3 btmaux; C:\Windows\System32\DRIVERS\btmaux.sys [116200 2015-10-13] (Motorola Solutions, Inc.)
S3 btwampfl; C:\Windows\System32\DRIVERS\btwampfl.sys [504360 2012-03-31] (Broadcom Corporation.)
S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [107648 2016-07-22] (Samsung Electronics Co., Ltd.)
R3 e1express; C:\Windows\System32\DRIVERS\e1e6232.sys [232312 2012-10-30] (Intel Corporation)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [26792 2015-05-29] (Synaptics Incorporated)
S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [146048 2016-07-22] (Samsung Electronics Co., Ltd.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [11232 2016-09-21] ()
S3 mfeplk; system32\drivers\mfeplk.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-13 12:33 - 2017-04-13 12:33 - 01766912 _____ (Farbar) C:\Users\hilton\Downloads\FRST (4).exe
2017-04-13 12:15 - 2017-04-13 12:15 - 00001146 _____ C:\Users\hilton\Desktop\Addition - Shortcut.lnk
2017-04-13 12:15 - 2017-04-13 12:15 - 00001106 _____ C:\Users\hilton\Desktop\FRST - Shortcut.lnk
2017-04-13 12:07 - 2017-04-13 12:07 - 00001124 _____ C:\Users\hilton\Desktop\FRST (3) - Shortcut.lnk
2017-04-13 12:06 - 2017-04-13 12:06 - 01766912 _____ (Farbar) C:\Users\hilton\Downloads\FRST (3).exe
2017-04-13 12:00 - 2017-04-13 12:00 - 00001124 _____ C:\Users\hilton\Downloads\FRST (2) - Shortcut.lnk
2017-04-13 11:59 - 2017-04-13 11:59 - 01766912 _____ (Farbar) C:\Users\hilton\Downloads\FRST (2).exe
2017-04-13 11:45 - 2017-04-13 11:45 - 00001124 _____ C:\Users\hilton\Downloads\FRST (1) - Shortcut.lnk
2017-04-13 11:44 - 2017-04-13 11:44 - 01766912 _____ (Farbar) C:\Users\hilton\Downloads\FRST (1).exe
2017-04-13 11:42 - 2017-04-13 12:09 - 00063931 _____ C:\Users\hilton\Downloads\Shortcut.txt
2017-04-13 11:41 - 2017-04-13 12:09 - 00023142 _____ C:\Users\hilton\Downloads\Addition.txt
2017-04-13 11:40 - 2017-04-13 12:34 - 00018726 _____ C:\Users\hilton\Downloads\FRST.txt
2017-04-13 11:38 - 2017-04-13 11:38 - 01766912 _____ (Farbar) C:\Users\hilton\Downloads\FRST.exe
2017-04-12 16:04 - 2017-04-12 16:04 - 00000000 ____D C:\ProgramData\SWCUTemp
2017-04-12 15:18 - 2017-04-12 15:18 - 00000000 ____D C:\Users\TEMP\AppData\Roaming\AVAST Software
2017-04-12 15:18 - 2017-04-12 15:18 - 00000000 ____D C:\ProgramData\PC Drivers HeadQuarters
2017-04-12 15:17 - 2017-04-12 15:19 - 00000000 ____D C:\Users\TEMP
2017-04-12 14:42 - 2017-03-27 13:28 - 00346320 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2017-04-12 14:42 - 2017-03-25 15:39 - 20284416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-04-12 14:42 - 2017-03-25 15:07 - 04604416 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-04-12 14:42 - 2017-03-25 15:06 - 13654016 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-04-12 14:42 - 2017-03-25 14:55 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-04-12 14:42 - 2017-03-25 14:52 - 02289152 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2017-04-12 14:42 - 2017-03-25 14:51 - 01313280 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-04-12 14:42 - 2017-03-25 14:48 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-04-12 14:42 - 2017-03-25 14:47 - 02055680 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2017-04-12 14:42 - 2017-03-25 14:47 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-04-12 14:42 - 2017-03-25 14:47 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2017-04-12 14:42 - 2017-03-25 14:47 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2017-04-12 14:42 - 2017-03-25 14:47 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2017-04-12 14:42 - 2017-03-25 14:46 - 00693248 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-04-12 14:42 - 2017-03-25 14:46 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-04-12 14:42 - 2017-03-25 14:46 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2017-04-12 14:42 - 2017-03-25 14:46 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2017-04-12 14:42 - 2017-03-25 14:46 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2017-04-12 14:42 - 2017-03-25 14:46 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2017-04-12 14:42 - 2017-03-25 14:46 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2017-04-12 14:42 - 2017-03-25 14:46 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2017-04-12 14:42 - 2017-03-25 14:45 - 00689664 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2017-04-12 14:42 - 2017-03-25 14:45 - 00416256 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2017-04-12 14:42 - 2017-03-25 14:45 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2017-04-12 14:42 - 2017-03-25 14:45 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2017-04-12 14:42 - 2017-03-25 14:45 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2017-04-12 14:42 - 2017-03-25 14:45 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2017-04-12 14:42 - 2017-03-25 14:45 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2017-04-12 14:42 - 2017-03-25 14:45 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2017-04-12 14:42 - 2017-03-25 14:44 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2017-04-12 14:42 - 2017-03-25 14:44 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2017-04-12 14:42 - 2017-03-25 13:19 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2017-04-12 14:42 - 2017-03-25 13:06 - 00476160 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2017-04-12 14:42 - 2017-03-25 12:57 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2017-04-12 14:42 - 2017-03-25 12:27 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2017-04-12 14:42 - 2017-03-24 18:41 - 00306688 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-04-12 14:42 - 2017-03-22 11:24 - 02953216 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2017-04-12 14:42 - 2017-03-22 11:24 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2017-04-12 14:42 - 2017-03-22 11:20 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2017-04-12 14:42 - 2017-03-22 11:06 - 02091520 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-04-12 14:42 - 2017-03-22 11:05 - 00573440 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-04-12 14:42 - 2017-03-22 11:05 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2017-04-12 14:42 - 2017-03-22 11:05 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2017-04-12 14:42 - 2017-03-22 11:05 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2017-04-12 14:42 - 2017-03-22 11:05 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2017-04-12 14:42 - 2017-03-22 11:05 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2017-04-12 14:42 - 2017-03-22 11:05 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2017-04-12 14:42 - 2017-03-14 11:23 - 00730344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2017-04-12 14:42 - 2017-03-14 11:23 - 00218856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2017-04-12 14:42 - 2017-03-14 11:17 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2017-04-12 14:42 - 2017-03-10 12:27 - 00308456 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-04-12 14:42 - 2017-03-10 12:19 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2017-04-12 14:42 - 2017-03-10 12:19 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2017-04-12 14:42 - 2017-03-10 12:19 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2017-04-12 14:42 - 2017-03-10 11:54 - 02400256 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-04-12 14:42 - 2017-03-10 11:53 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-04-12 14:42 - 2017-03-08 16:10 - 00805376 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2017-04-12 14:42 - 2017-03-08 00:26 - 04000488 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2017-04-12 14:42 - 2017-03-08 00:26 - 03945192 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-04-12 14:42 - 2017-03-08 00:26 - 00137960 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2017-04-12 14:42 - 2017-03-08 00:26 - 00067304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2017-04-12 14:42 - 2017-03-08 00:24 - 01310528 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 01416192 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 01062912 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00872448 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00553472 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00400896 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00294400 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00261120 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00254464 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00171008 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2017-04-12 14:42 - 2017-03-08 00:22 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00644096 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2017-04-12 14:42 - 2017-03-08 00:21 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2017-04-12 14:42 - 2017-03-07 23:58 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2017-04-12 14:42 - 2017-03-07 23:58 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2017-04-12 14:42 - 2017-03-07 23:58 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2017-04-12 14:42 - 2017-03-07 23:58 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2017-04-12 14:42 - 2017-03-07 23:57 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2017-04-12 14:42 - 2017-03-07 23:56 - 00271360 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2017-04-12 14:42 - 2017-03-07 23:55 - 00262656 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2017-04-12 14:42 - 2017-03-07 23:54 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-04-12 14:42 - 2017-03-07 23:54 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-04-12 14:42 - 2017-03-07 23:54 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-04-12 14:42 - 2017-03-07 23:53 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2017-04-12 14:42 - 2017-03-07 23:53 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2017-04-12 14:42 - 2017-03-07 23:53 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2017-04-12 14:42 - 2017-03-07 23:53 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2017-04-12 14:42 - 2017-03-07 23:53 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2017-04-12 14:42 - 2017-03-07 23:53 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2017-04-12 14:42 - 2017-03-07 23:53 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2017-04-12 14:42 - 2017-03-07 23:53 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2017-04-12 14:42 - 2017-03-07 12:17 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2017-04-12 14:42 - 2017-03-03 21:14 - 01329664 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2017-04-12 14:42 - 2017-03-03 21:14 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\mfmjpegdec.dll
2017-04-12 14:42 - 2017-02-14 12:19 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-04-12 14:42 - 2017-02-11 12:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2017-04-12 14:42 - 2017-02-09 12:14 - 00575488 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2017-04-12 14:42 - 2017-02-09 12:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00922432 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00066400 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00022368 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00019808 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00017760 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00016224 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00015712 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00014176 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00013664 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00012640 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00012128 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2017-04-12 14:42 - 2017-01-18 11:35 - 00011616 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2017-04-12 14:40 - 2017-04-12 14:40 - 00330256 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2017-04-12 10:14 - 2017-04-12 13:57 - 00000000 ____D C:\Users\hilton75
2017-04-11 16:03 - 2017-04-13 12:34 - 00000000 ____D C:\FRST
2017-04-10 14:33 - 2017-04-12 16:22 - 00000594 _____ C:\Users\hilton\Desktop\SFC -SCANNOW s.website
2017-04-10 14:22 - 2017-04-10 14:22 - 00000000 ____D C:\Users\hilton\AppData\Roaming\Remo
2017-04-10 14:21 - 2017-04-10 16:17 - 00000000 ____D C:\Users\hilton\AppData\Roaming\Remo Speed Optimizer2.0
2017-04-10 14:21 - 2009-02-12 15:11 - 00022312 _____ (EldoS Corporation) C:\Windows\system32\Drivers\rsdrv.sys
2017-04-07 15:30 - 2017-04-12 13:52 - 00000608 _____ C:\Users\hilton\Desktop\Snopes. (1).website
2017-04-06 12:01 - 2017-04-12 14:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-04-06 12:01 - 2017-04-06 12:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-04-06 12:01 - 2017-04-06 12:01 - 00000000 ____D C:\Program Files\Malwarebytes
2017-04-02 12:24 - 2017-04-02 16:17 - 00025188 _____ C:\AdsFix_02_04_2017_16_17_19.txt
2017-04-02 12:17 - 2017-04-12 14:26 - 00000000 ____D C:\AdsFix
2017-04-01 15:23 - 2017-04-01 15:23 - 00000227 _____ C:\Users\hilton\Desktop\The ASA Monitor - Home Page.URL
2017-03-30 12:37 - 2017-03-30 12:37 - 00519075 _____ C:\Users\hilton\Documents\NorthCarolina2014.pdf
2017-03-30 12:29 - 2017-03-30 12:29 - 00230674 ____R C:\QuickDiag_30_03_2017_12_29_51.txt
2017-03-30 12:06 - 2017-04-12 14:25 - 00000000 ____D C:\QuickDiag
2017-03-20 00:48 - 2017-03-20 00:48 - 00028352 _____ (Microsoft Corporation) C:\Windows\system32\aspnet_counters.dll
2017-03-20 00:48 - 2017-03-20 00:48 - 00019112 _____ (Microsoft Corporation) C:\Windows\system32\msvcr110_clr0400.dll
2017-03-20 00:48 - 2017-03-20 00:48 - 00019112 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100_clr0400.dll
2017-03-20 00:48 - 2017-03-20 00:48 - 00019112 _____ (Microsoft Corporation) C:\Windows\system32\msvcp110_clr0400.dll
2017-03-19 13:44 - 2017-03-19 13:44 - 00832275 _____ C:\Users\hilton\Downloads\HealthSummary20170319.zip
2017-03-19 10:48 - 2017-03-19 10:48 - 09274608 _____ (Piriform Ltd) C:\Users\hilton\Downloads\ccsetup528(1).exe
2017-03-14 15:23 - 2017-02-11 11:50 - 00313856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2017-03-14 15:23 - 2017-02-11 11:50 - 00311808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2017-03-14 15:23 - 2017-02-11 11:50 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2017-03-14 15:23 - 2017-02-10 12:17 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2017-03-14 15:23 - 2017-02-10 10:33 - 01251328 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2017-03-14 15:23 - 2017-02-10 10:33 - 00909824 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2017-03-14 15:23 - 2017-02-09 12:14 - 00481792 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2017-03-14 15:23 - 2017-02-09 12:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2017-03-14 15:23 - 2017-02-09 11:51 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2017-03-14 15:23 - 2017-02-06 12:03 - 00497152 _____ (Microsoft Corporation) C:\Windows\HelpPane.exe
2017-03-14 15:23 - 2017-01-13 13:45 - 00741888 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2017-03-14 15:23 - 2017-01-13 13:45 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2017-03-14 15:23 - 2017-01-11 13:43 - 01241088 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2017-03-14 15:23 - 2017-01-11 13:43 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2017-03-14 13:11 - 2017-03-14 13:11 - 09274608 _____ (Piriform Ltd) C:\Users\hilton\Downloads\ccsetup528.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2017-04-13 12:34 - 2016-07-27 13:35 - 00000525 _____ C:\Users\hilton\Desktop\Yahoo Mail.website
2017-04-13 12:27 - 2017-02-25 15:57 - 00000608 _____ C:\Users\hilton\Desktop\ Microsoft Community (1).website
2017-04-13 11:36 - 2016-12-30 13:38 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-04-13 11:12 - 2016-11-21 15:06 - 00000503 _____ C:\Users\hilton\Desktop\Hefs71's Food Diary.website
2017-04-13 11:00 - 2016-09-14 12:55 - 00000487 _____ C:\Users\hilton\Desktop\GMAIL.website
2017-04-13 10:59 - 2016-06-29 19:08 - 00000617 _____ C:\Users\hilton\Desktop\outlook.website
2017-04-13 10:49 - 2016-12-30 13:39 - 00000000 ____D C:\Users\hilton\AppData\LocalLow\Mozilla
2017-04-13 10:49 - 2016-06-29 19:01 - 00000470 _____ C:\Users\hilton\Desktop\WELLS FARGO.website
2017-04-13 10:46 - 2016-06-30 15:18 - 00000544 _____ C:\Users\hilton\Desktop\Fredericksbur.website
2017-04-13 10:43 - 2016-06-30 15:19 - 00000565 _____ C:\Users\hilton\Desktop\N&O.website
2017-04-13 10:31 - 2016-06-30 15:17 - 00000629 _____ C:\Users\hilton\Desktop\DRUDGE REPORT 2016®.website
2017-04-13 04:19 - 2009-07-14 00:34 - 00021696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-04-13 04:19 - 2009-07-14 00:34 - 00021696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-04-12 19:43 - 2016-12-25 17:07 - 00002148 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-04-12 19:43 - 2016-12-25 17:07 - 00002136 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-04-12 19:43 - 2016-12-25 17:07 - 00002136 _____ C:\ProgramData\Desktop\Google Chrome.lnk
2017-04-12 18:39 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\rescache
2017-04-12 16:26 - 2016-07-05 15:22 - 00000494 _____ C:\Users\hilton\Desktop\Netflix.website
2017-04-12 16:26 - 2016-07-02 14:57 - 00001224 _____ C:\Users\hilton\Desktop\sprint.website
2017-04-12 16:25 - 2016-08-26 14:33 - 00000468 _____ C:\Users\hilton\Desktop\PC Help Forum.website
2017-04-12 16:19 - 2016-07-13 12:29 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-04-12 16:11 - 2016-08-12 15:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm
2017-04-12 16:09 - 2017-02-03 13:54 - 00000000 ____D C:\Users\hilton\AppData\Roaming\eM Client
2017-04-12 16:08 - 2010-11-20 17:01 - 00781298 _____ C:\Windows\system32\PerfStringBackup.INI
2017-04-12 16:08 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\inf
2017-04-12 16:06 - 2016-11-06 15:03 - 00000450 _____ C:\Windows\Tasks\DriverUpdate Scan.job
2017-04-12 16:03 - 2009-07-14 00:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-04-12 16:03 - 2009-07-14 00:33 - 00290256 _____ C:\Windows\system32\FNTCACHE.DAT
2017-04-12 15:29 - 2016-07-03 03:09 - 00000000 ____D C:\Windows\system32\MRT
2017-04-12 15:25 - 2016-07-09 17:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-04-12 15:25 - 2016-07-03 03:09 - 145733648 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-04-12 15:24 - 2016-07-09 17:12 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-04-12 15:18 - 2016-07-03 12:22 - 00065776 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2017-04-12 14:42 - 2016-07-04 15:23 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2017-04-12 14:42 - 2016-07-04 15:23 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2017-04-12 14:42 - 2016-07-04 15:23 - 00000000 ____D C:\Windows\system32\Macromed
2017-04-12 14:40 - 2016-12-18 22:20 - 00472760 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2017-04-12 14:40 - 2016-12-18 22:20 - 00279800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2017-04-12 14:40 - 2016-12-18 22:20 - 00118800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2017-04-12 14:40 - 2016-12-18 22:20 - 00106904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2017-04-12 14:40 - 2016-12-18 22:20 - 00090336 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2017-04-12 14:40 - 2016-12-18 22:20 - 00062152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2017-04-12 14:40 - 2016-12-18 22:20 - 00034136 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2017-04-12 14:40 - 2016-06-29 16:30 - 00000000 ____D C:\Users\hilton
2017-04-12 14:39 - 2016-12-18 22:38 - 00388488 _____ (AVAST Software) C:\Windows\system32\Drivers\aswNetSec.sys
2017-04-12 14:39 - 2016-12-18 22:22 - 00031064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2017-04-12 14:39 - 2016-12-18 22:20 - 00764064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2017-04-12 14:38 - 2017-03-12 08:27 - 00267528 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswblogx.sys
2017-04-12 14:38 - 2017-03-12 08:27 - 00255184 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsdriverx.sys
2017-04-12 14:38 - 2017-03-12 08:27 - 00148208 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidshx.sys
2017-04-12 14:38 - 2017-03-12 08:27 - 00041176 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbunivx.sys
2017-04-12 14:34 - 2017-01-03 12:16 - 00000000 _____ C:\Windows\system32\last.dump
2017-04-12 14:30 - 2017-01-20 14:40 - 00000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.3
2017-04-12 14:28 - 2017-03-13 15:54 - 00000000 ____D C:\Users\hilton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kodi
2017-04-12 14:28 - 2017-02-12 15:08 - 00000000 ____D C:\Windows\WindowsMobile
2017-04-12 14:28 - 2017-02-07 16:45 - 00000000 ____D C:\Users\hilton\Downloads\x64
2017-04-12 14:28 - 2017-02-07 16:45 - 00000000 ____D C:\Users\hilton\Downloads\HECI
2017-04-12 14:28 - 2017-02-07 16:29 - 00000000 ____D C:\Users\hilton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell
2017-04-12 14:28 - 2017-01-28 15:13 - 00000000 ___HD C:\Windows\system32\CanonIJ Uninstaller Information
2017-04-12 14:28 - 2017-01-20 14:48 - 00000000 ____D C:\Users\hilton\Documents\OpenOffice 4.1.3 (en-US) Installation Files
2017-04-12 14:28 - 2016-09-05 14:21 - 00000000 __RSD C:\Users\hilton\Documents\McAfee Vaults
2017-04-12 14:28 - 2016-09-05 14:04 - 00000000 ____D C:\Users\hilton\AppData\Roaming\McAfee
2017-04-12 14:28 - 2016-08-01 13:59 - 00000000 ____D C:\Users\Public\Documents\Downloaded Installers
2017-04-12 14:28 - 2016-08-01 13:59 - 00000000 ____D C:\ProgramData\Documents\Downloaded Installers
2017-04-12 14:28 - 2016-07-15 13:40 - 00000000 ____D C:\Users\hilton\AppData\Roaming\InstantSupport
2017-04-12 14:28 - 2016-07-06 16:40 - 00000000 ____D C:\Users\hilton\Documents\OpenOffice 4.1.2 (en-US) Installation Files
2017-04-12 14:28 - 2016-07-05 14:37 - 00000000 ____D C:\Users\hilton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon Music
2017-04-12 14:28 - 2016-07-02 15:44 - 00000000 ____D C:\Users\PCPitstopSVC
2017-04-12 14:28 - 2016-07-02 15:23 - 00000000 ____D C:\Users\hilton\AppData\LocalLow\Adblock Plus for IE
2017-04-12 14:28 - 2016-07-02 13:55 - 00000000 ____D C:\Windows\Minidump
2017-04-12 14:28 - 2016-07-01 13:11 - 00000000 ____D C:\Users\hilton\AppData\Roaming\RoboForm
2017-04-12 14:28 - 2016-06-30 18:39 - 00000000 ____D C:\Users\hilton\AppData\Local\Stardock
2017-04-12 14:28 - 2016-06-30 18:38 - 00000000 ____D C:\Users\hilton\Downloads\Stardock
2017-04-12 14:28 - 2012-07-23 20:44 - 00000000 ____D C:\Windows\OEM
2017-04-12 14:28 - 2012-07-23 20:44 - 00000000 ____D C:\Windows\ConfigSetRoot
2017-04-12 14:28 - 2012-07-23 19:52 - 00000000 ____D C:\Windows\system32\Lang
2017-04-12 14:28 - 2009-07-14 00:52 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2017-04-12 14:28 - 2009-07-14 00:52 - 00000000 ____D C:\Program Files\Windows Sidebar
2017-04-12 14:28 - 2009-07-14 00:34 - 00000000 ____D C:\Windows\Setup
2017-04-12 14:28 - 2009-07-13 22:37 - 00000000 __RHD C:\Users\Public\Libraries
2017-04-12 14:28 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\system32\NDF
2017-04-12 14:28 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\servicing
2017-04-12 14:28 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\PolicyDefinitions
2017-04-12 14:28 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\AppCompat
2017-04-12 14:28 - 2009-07-13 22:37 - 00000000 ____D C:\Program Files\Common Files\System
2017-04-12 14:27 - 2017-03-13 15:53 - 00000000 ____D C:\Program Files\Kodi
2017-04-12 14:27 - 2017-03-13 15:39 - 00000000 ____D C:\Users\hilton\AppData\Local\FromDocToPDFTooltab
2017-04-12 14:27 - 2017-02-03 13:52 - 00000000 ____D C:\Program Files\eM Client
2017-04-12 14:27 - 2017-01-28 15:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2017-04-12 14:27 - 2017-01-28 15:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG3200 series
2017-04-12 14:27 - 2016-12-30 13:38 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2017-04-12 14:27 - 2016-12-25 13:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stardock
2017-04-12 14:27 - 2016-12-18 22:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2017-04-12 14:27 - 2016-12-06 18:45 - 00000000 ____D C:\Users\hilton\AppData\Local\76f7c66
2017-04-12 14:27 - 2016-09-26 12:01 - 00000000 ____D C:\Users\hilton\AppData\Local\CrashRpt
2017-04-12 14:27 - 2016-09-26 12:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverUpdate
2017-04-12 14:27 - 2016-09-26 12:01 - 00000000 ____D C:\Program Files\SlimWare Utilities
2017-04-12 14:27 - 2016-09-26 12:01 - 00000000 ____D C:\Program Files\DriverUpdate
2017-04-12 14:27 - 2016-09-05 14:03 - 00000000 ____D C:\Program Files\McAfee
2017-04-12 14:27 - 2016-08-21 14:25 - 00000000 ____D C:\Program Files\Microsoft Games
2017-04-12 14:27 - 2016-08-01 14:09 - 00000000 ____D C:\ProgramData\SlimWare Utilities, Inc
2017-04-12 14:27 - 2016-08-01 13:59 - 00000000 ____D C:\Users\hilton\AppData\Local\SlimWare Utilities Inc
2017-04-12 14:27 - 2016-07-05 14:36 - 00000000 ____D C:\Users\hilton\AppData\Local\Amazon Music
2017-04-12 14:27 - 2016-07-02 15:54 - 00000000 ____D C:\Users\hilton\AppData\Local\PC_Drivers_Headquarters
2017-04-12 14:27 - 2016-07-02 15:53 - 00000000 ____D C:\Program Files\Driver Support
2017-04-12 14:27 - 2016-07-02 15:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2017-04-12 14:27 - 2016-07-02 15:47 - 00000000 ____D C:\Program Files\CCleaner
2017-04-12 14:27 - 2016-07-02 15:09 - 00000000 ____D C:\ProgramData\PCPitstop
2017-04-12 14:27 - 2012-07-23 19:53 - 00000000 ____D C:\Program Files\Common Files\postureAgent
2017-04-12 14:27 - 2012-07-23 19:52 - 00000000 ____D C:\Program Files\Intel
2017-04-12 14:27 - 2009-07-13 22:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-04-12 14:24 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\registration
2017-04-12 14:23 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\Vss
2017-04-12 14:23 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\system32\spool
2017-04-12 14:22 - 2009-07-14 00:34 - 00000000 ____D C:\Windows\ServiceProfiles
2017-04-12 14:22 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\PLA
2017-04-12 14:21 - 2009-07-13 22:37 - 00000000 ____D C:\Windows\Help
2017-04-12 14:19 - 2017-02-07 16:45 - 00000000 ____D C:\Users\hilton\Downloads\Lang
2017-04-12 14:19 - 2016-12-30 13:38 - 00000000 ____D C:\Users\hilton\AppData\Roaming\Mozilla
2017-04-12 14:19 - 2016-08-12 12:28 - 00000000 ____D C:\Users\hilton\AppData\Roaming\Dashlane
2017-04-12 14:19 - 2016-07-27 14:22 - 00000000 ____D C:\Users\hilton\Documents\Fax
2017-04-12 14:19 - 2016-07-04 15:13 - 00000000 ____D C:\Users\hilton\AppData\Roaming\OpenOffice
2017-04-12 14:19 - 2016-06-30 18:39 - 00000000 ____D C:\Users\hilton\Documents\Stardock
2017-04-12 14:19 - 2016-06-30 18:39 - 00000000 ____D C:\Users\hilton\AppData\Roaming\Stardock
2017-04-12 14:19 - 2016-06-29 17:49 - 00000000 ____D C:\Users\hilton\AppData\Roaming\Adobe
2017-04-12 14:19 - 2016-06-29 16:31 - 00000000 ____D C:\Users\hilton\AppData\Local\VirtualStore
2017-04-12 14:18 - 2016-12-30 13:38 - 00000000 ____D C:\Users\hilton\AppData\Local\Mozilla
2017-04-12 14:16 - 2016-12-25 17:07 - 00000000 ____D C:\Users\hilton\AppData\Local\Google
2017-04-12 14:16 - 2016-12-25 17:06 - 00000000 ____D C:\Users\hilton\AppData\Local\Apps\2.0
2017-04-12 14:16 - 2016-08-21 14:27 - 00000000 ____D C:\Users\hilton\AppData\Local\Microsoft Games
2017-04-12 14:15 - 2016-08-01 21:31 - 00000000 ____D C:\ProgramData\Package Cache
2017-04-12 14:15 - 2016-06-30 18:39 - 00000000 ____D C:\ProgramData\Stardock
2017-04-12 14:14 - 2017-02-27 15:03 - 00000000 ____D C:\Program Files\WIDCOMM
2017-04-12 14:14 - 2016-12-18 22:19 - 00000000 ____D C:\ProgramData\AVAST Software
2017-04-12 14:14 - 2016-09-26 12:37 - 00000000 ____D C:\Program Files\Synaptics
2017-04-12 14:14 - 2016-07-13 12:28 - 00000000 ____D C:\ProgramData\Adobe
2017-04-12 14:14 - 2016-07-05 14:18 - 00000000 ___HD C:\ProgramData\CanonBJ
2017-04-12 14:14 - 2016-07-02 15:54 - 00000000 ____D C:\ProgramData\Driver Support
2017-04-12 14:14 - 2016-06-30 18:39 - 00000000 ____D C:\Program Files\Stardock
2017-04-12 14:14 - 2016-06-29 18:32 - 00000000 ____D C:\Program Files\Siber Systems
2017-04-12 14:14 - 2009-07-13 22:37 - 00000000 ____D C:\Program Files\Windows NT
2017-04-12 14:13 - 2016-08-31 14:14 - 00000000 ____D C:\Program Files\SAMSUNG
2017-04-12 14:13 - 2016-07-04 15:01 - 00000000 ____D C:\Program Files\OpenOffice 4
2017-04-12 14:13 - 2016-07-02 15:09 - 00000000 ____D C:\Program Files\PCPitstop
2017-04-12 14:13 - 2009-07-14 00:52 - 00000000 ____D C:\Program Files\MSBuild
2017-04-12 14:12 - 2017-01-28 15:19 - 00000000 ____D C:\Program Files\Canon
2017-04-12 14:12 - 2017-01-28 15:13 - 00000000 ___HD C:\Program Files\CanonBJ
2017-04-12 14:12 - 2016-12-25 17:07 - 00000000 ____D C:\Program Files\Google
2017-04-12 14:12 - 2016-12-18 22:21 - 00000000 ____D C:\Program Files\Common Files\AV
2017-04-12 14:12 - 2016-12-18 22:19 - 00000000 ____D C:\Program Files\AVAST Software
2017-04-12 14:12 - 2016-07-13 12:28 - 00000000 ____D C:\Program Files\Common Files\Adobe
2017-04-12 14:12 - 2012-07-23 19:53 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2017-04-12 14:10 - 2016-07-13 12:28 - 00000000 ____D C:\Program Files\Adobe
2017-04-12 14:10 - 2012-07-23 19:53 - 00000000 ____D C:\Program Files\Analog Devices
2017-04-12 14:02 - 2016-07-27 13:52 - 00000543 _____ C:\Users\hilton\Desktop\Calendar -.website
2017-04-12 13:49 - 2016-08-03 15:21 - 00000494 _____ C:\Users\hilton\Desktop\FLSurvey.website
2017-04-11 16:08 - 2016-07-11 16:19 - 00000479 _____ C:\Users\hilton\Desktop\BING.website
2017-04-11 15:55 - 2016-12-30 15:20 - 00003736 _____ C:\Users\hilton\Desktop\AmazonSmil.website
2017-04-10 16:59 - 2016-11-21 15:54 - 00000582 _____ C:\Users\hilton\Desktop\where is my phone android - Google Search.website
2017-04-09 11:49 - 2016-06-29 19:04 - 00000466 _____ C:\Users\hilton\Desktop\Discover.website
2017-04-08 15:56 - 2016-07-05 15:28 - 00000616 _____ C:\Users\hilton\Desktop\Time Warner Cable.website
2017-04-08 11:53 - 2016-07-05 13:57 - 00000422 _____ C:\Users\hilton\Desktop\AAA.website
2017-04-06 15:16 - 2016-07-10 13:21 - 00000494 _____ C:\Users\hilton\Desktop\Speedtest.net (1).website
2017-04-06 13:41 - 2016-07-03 13:44 - 00000476 _____ C:\Users\hilton\Desktop\YouTube.website
2017-04-05 10:15 - 2016-07-05 15:59 - 00000429 _____ C:\Users\hilton\Desktop\CoaguChek Link.website
2017-04-02 12:21 - 2016-08-02 12:37 - 00000451 _____ C:\Users\hilton\Desktop\Yahoo.website
2017-04-02 12:09 - 2016-07-01 13:17 - 00000413 _____ C:\Users\hilton\Desktop\humanaDRU.website
2017-03-31 14:45 - 2017-01-30 14:46 - 00000488 _____ C:\Users\hilton\Desktop\Home Delivery Supplies.website
2017-03-31 14:20 - 2016-07-03 16:25 - 00000501 _____ C:\Users\hilton\Desktop\Komando.com.website
2017-03-27 13:27 - 2017-03-09 15:08 - 00000563 _____ C:\Users\hilton\Desktop\USASACUP and 9thASA - A club for 9th ASA and USASACUP war stories - Yahoo Groups.website
2017-03-27 10:29 - 2016-08-31 11:56 - 00000507 _____ C:\Users\hilton\Desktop\Pharmacy.website
2017-03-26 15:37 - 2016-11-19 17:24 - 00000501 _____ C:\Users\hilton\Desktop\TiVoCommunity Forum.website
2017-03-26 13:18 - 2016-07-05 15:30 - 00000493 _____ C:\Users\hilton\Desktop\eBay.website
2017-03-20 03:56 - 2016-06-27 18:58 - 00181232 _____ C:\Windows\Minidump\032017-34242-01.dmp
2017-03-19 15:15 - 2017-03-12 14:18 - 00000000 ____D C:\Users\hilton\AppData\Roaming\Kodi
2017-03-19 13:44 - 2016-06-30 16:50 - 00000486 _____ C:\Users\hilton\Desktop\DUKE.website
2017-03-19 10:49 - 2016-07-02 15:47 - 00000972 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-03-19 10:49 - 2016-07-02 15:47 - 00000972 _____ C:\ProgramData\Desktop\CCleaner.lnk
2017-03-19 10:45 - 2016-08-16 11:51 - 00000000 ____D C:\Users\hilton\AppData\Local\CrashDumps
2017-03-19 01:00 - 2016-07-03 13:23 - 00000000 ____D C:\Users\hilton\AppData\Local\ElevatedDiagnostics
2017-03-15 03:22 - 2009-07-14 00:52 - 00000000 ____D C:\Program Files\DVD Maker
2017-03-14 16:29 - 2016-08-02 13:58 - 00000522 _____ C:\Users\hilton\Desktop\googole.website

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2017-04-13 00:19

Hello Hefs, just so you know I am training here in malware removal and before I can present any fix to you they will have to be checked by my teacher. That should not be such a bad thing because two pairs of eyes may be better than one, even though it may be a little slower than usual. Hope you are OK with this and I hope you stay with us until we give you the all clear.

I see you have already used some tools, and when we finish I will help you remove them all. Don't be concerned about the stuff Malwarebytes found and quarantined, it's safe there and will be dealt with.

Also where possible please download and run any tools from your desktop as previously requested. Whilst I check your log files can you please follow the instructions below and we will clean up your shortcuts.

As you ran FRST from your downloads folder the Shortcut.txt file will be there. Can you please move it to your desktop?

Download ClearLNK save it to your desktop.
Drag the file Shortcut.txt made with FRST earlier.
As per picture.
A report on the work as a file ClearLNK- <date> .log
Will be produced, post that log please

Hello Hefs, will return tomorrow

Hello Hefs, We will return to your shortcuts after we have cleaned your machine. In the meantime you can recreate any necessary ones.

FRST fix.

• Please download the attached Fixlist.txt file to your desktop.
• It is important that both the Fixlist file and FRST are in the same location or the fix will not work.
• Run FRST and click the button marked fix once.
• FRST will take a while to run the fix and at the completion will reboot your PC, please allow this.
• When your computer restarts FRST will generate a log file on your desktop called Fixlog.txt
• Can you please Copy and paste the contents of that file in your next reply.
• PLEASE NOTE: this script was specifically written for use on this particular machine. Running this fix on another machine may permanently damage the operating system.

Adware Cleaner Scan.

Please download AdwCleaner by Malwarebytes onto your desktop.

• Close all open programs and internet browsers.
• Double click on adwcleaner.exe to run the tool.
• Click on Scan button.
• When the scan has finished click on Clean button.
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the contents of that logfile with your next reply.
• You can find the logfile at C:\AdwCleaner[S1].txt as well.

Malwarebytes.

• Download MalwareBytes Anti-Malware : https://www.malwarebytes.com/mwb-download/ take the free version ( on the left )
• Perform the installation
• Uncheck "Enable Free Trial of Malwarebytes Anti-Malware Premium" if it's asked
• Malwarebytes will update, let this update,
• Click on the "Settings" tab and then on the "Detection and Protection" tab, Check the box "Search for Rootkits"
• Click on the "Analysis" tab and then on "Start analysis"
• Once the review is complete, check that all detections are checked and then click [Delete Selection]
• If Malwarebytes asks you to restart your PC, click "Yes"
• When restarting your PC, restarts Malwarebytes
• Opens the "History" tab and then "Application logs"
• Double click on the last Scan Log in date (the one above)
• At the bottom click [Export] -> select "Text file (* .txt)"
• In the explorer selects the desktop, name it mbam.txt, click [Save]

Your next reply should contain the contents of

1. Fixlog.txt
   
2. AdwCleaner[xx].txt
   
3. mbam.txt

Should you have any questions or difficulty with these instructions, please ask

With both FRST.exe and Fixlist.txt on the desktop you should start FRST and then click "FIX" button once. It should take about a minute to do the fix and create the log file. There is no need to hit the scan button on FRST at the moment.

Hello Hefs. The contents of that fixlist was not the one uploaded for you in post 28.

I shall attach the correct one again to this post. Can you please delete the fixlist you have used as using an incorrect one can damage your machine.

Please follow these steps carefully, if you're not sure of any part please give a shout

FRST fix.

• Please download the attached Fixlist.txt file to your desktop.
• It is important that both the Fixlist file and FRST are in the same location or the fix will not work.
• Right click FRST and select run as Administrator.
• Click the button marked fix once.
• FRST will take a while to run the fix and at the completion will reboot your PC, please allow this.
• When your computer restarts FRST will generate a log file on your desktop called Fixlog.txt
• Can you please Copy and paste (or if you wish attach) the contents of that file in your next reply.
• PLEASE NOTE: this script was specifically written for use on this particular machine. Running this fix on another machine may permanently damage the operating system.

Hilton Heflin said:

ok..I have deleted all the other attempts on this..start fresh..

Click to expand...

Sounds good, and we will win

Hilton Heflin said:

I see the fixit file attached..but it won't drag to desktop.

Click to expand...

Ok, there are two other easy ways to do this

1. Left click on the attached Fixlist.txt file, a box will appear asking if you want to open or save the file, select save. Another box should open and ask where to save it, choose Desktop.
   
2. If the first option doesn't work try right clicking on the attached fixlist.txt file and then click "Save link as" A dialogue box will open asking what to name the file and where to save it. Name it Fixlist.txt and save it to the desktop.

Hilton Heflin said:

the last time I ran frst as adm with fix..it just ran and ran..never rebooted my computer...some how I am doing something wrong...sorry ..but any ideas..

Click to expand...

Running FRST with a fix that was NOT made for your machine is frought with danger, and can destroy the operating system.

That fixlog you posted showed it was not the fix made and attached for your pc and it would not have rebooted the pc anyway. Just follow the instructions below carefully and you will do it. Do remember too that the actual FRST program and the fixlist HAVE TO BE IN THE SAME LOCATION, which is one reason we recommend the desktop.

• Right click FRST and select run as Administrator.
• Click the button marked fix once only. Do not hit the Scan button.
• FRST will take a little while to run the fix and at the completion will reboot your PC, please allow this.
• When your computer restarts FRST will generate a log file on your desktop called Fixlog.txt
• Can you please Copy and paste (or if you wish attach) the contents of that file in your next reply.

If you do not see a FRST icon on your desktop you can copy or move the FRST32.exe program file it from wherever it is to your desktop. I think you mentioned previously that it may have been in a download folder?

Let us know if we can help in the future, and good luck Hefs