Hi - I have downloaded FRST.exe saved both to my desktop and my flash drive.
Now I am just having trouble deciphering which files are infectious, to copy into the FRST.exe software to "fix".
Please help. Below is the copy of my FRST.exe scan results to notepad.
_________________________________________________________________________________________
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-06-2016 02
Ran by C&T Muhammad (administrator) on OFFICE-PC (26-06-2016 21:30:36)
Running from C:\Users\C&T Muhammad\Desktop
Loaded Profiles: C&T Muhammad (Available Profiles: C&T Muhammad)
Platform: Windows Vista ™ Home Premium Service Pack 2 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Malwarebytes) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6246400 2008-08-26] (Realtek Semiconductor)
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Windows\system32\WLTRAY.exe [3563520 2008-07-03] (Dell Inc.)
HKLM\...\Run: [DellOSD] => C:\Windows\System32\MediaButtons.exe [2166784 2008-05-08] ()
HKLM\...\Run: [BrowserPlugInHelper] => C:\Program Files\Aimersoft\Video Converter Ultimate\BrowserPlugInHelper.exe
HKLM\...\Run: [TkBellExe] => C:\Program Files\Real\RealPlayer\update\realsched.exe [295512 2014-04-12] (RealNetworks, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [986872 2016-01-29] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157456 2015-09-12] (Apple Inc.)
HKLM\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443640 2014-10-31] (BlackBerry Limited)
HKLM\...\Run: [RIM PeerManager] => C:\Program Files\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [4730616 2015-05-26] (BlackBerry Limited)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [595992 2016-05-20] (Oracle Corporation)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7405752 2016-06-23] (AVAST Software)
HKLM\...\Policies\Explorer: [NoSetActiveDesktop] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoSetActiveDesktop] 0
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2926592 2009-04-10] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Policies\Explorer: [NoSetActiveDesktop] 0
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2926592 2009-04-10] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-20] (Microsoft Corporation)
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\Run: [Google Update] => C:\Users\C&T Muhammad\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-27] (Google Inc.)
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\Run: [Dropbox Update] => C:\Users\C&T Muhammad\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-23] (Dropbox, Inc.)
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\Run: [Spotify Web Helper] => C:\Users\C&T Muhammad\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1524848 2016-05-19] (Spotify Ltd)
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\Run: [Spotify] => C:\Users\C&T Muhammad\AppData\Roaming\Spotify\Spotify.exe [6754928 2016-05-19] (Spotify Ltd)
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\RunOnce: [Application Restart #0] => C:\Windows\ehome\ehtray.exe [125952 2008-01-20] (Microsoft Corporation)
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\RunOnce: [Application Restart #1] => C:\Program Files\Windows Media Player\wmpnscfg.exe [202240 2008-01-20] (Microsoft Corporation)
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\RunOnce: [Application Restart #2] => C:\Program Files\Google\Chrome\Application\chrome.exe [874648 2016-04-06] (Google Inc.)
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\RunOnce: [Application Restart #3] => C:\Program Files\Microsoft Security Client\msseces.exe [986872 2016-01-29] (Microsoft Corporation)
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\Policies\Explorer: [NoSetActiveDesktop] 0
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\MountPoints2: {3c91c9be-d30f-11e3-b065-0021703901a5} - F:\setup.exe -a
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\MountPoints2: {b3cccb3c-44fc-11e5-9abc-0021703901a5} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\start.exe
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\MountPoints2: {f9770cbb-84cd-11de-8a6a-0021703901a5} - H:\start.exe
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2926592 2009-04-10] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssBranded.scr [8139264 2008-01-20] (Microsoft Corporation)
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2926592 2009-04-10] (Microsoft Corporation) <==== ATTENTION
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\C&T Muhammad\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-06-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\C&T Muhammad\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-06-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\C&T Muhammad\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-06-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\C&T Muhammad\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-06-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\C&T Muhammad\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-06-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\C&T Muhammad\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-06-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\C&T Muhammad\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-06-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\C&T Muhammad\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-06-13] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-06-19] (AVAST Software)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2008-11-05]
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (No File)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2008-11-05]
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (No File)
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Winsock: Catalog5 01 mswsock.dll No File ATTENTION: LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 05 mswsock.dll No File ATTENTION: LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 205.171.2.25
Tcpip\..\Interfaces\{28AE79C2-D1A0-4CB7-9A73-B3B4F663F01D}: [DhcpNameServer] 192.168.0.1 205.171.2.25
Tcpip\..\Interfaces\{A2D144FB-D371-4306-8E0E-6A9708623BAD}: [DhcpNameServer] 192.168.0.1 205.171.2.25
Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSSE
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.yahoo.com/yhs/search?type=agc511&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.yahoo.com/yhs/search?type=agc511&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yahoo.com/?fr=yset_ie_syc_oracle&type=orcl_hpset
HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxps://www.yahoo.com/?fr=hp-avast&type=agc511
URLSearchHook: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 - (No Name) - {238d4b4c-d63c-42a7-b6d8-dc96c8c0f5b9} - No File
URLSearchHook: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 - (No Name) - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No File
SearchScopes: HKLM -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKLM -> Backup.Old.DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
SearchScopes: HKLM -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKLM -> {CF739809-1C6C-47C0-85B9-569DBB141420} URL = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q={searchTerms}&crm=1
SearchScopes: HKU\.DEFAULT -> DefaultScope {CF739809-1C6C-47C0-85B9-569DBB141420} URL =
SearchScopes: HKU\.DEFAULT -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> Backup.Old.DefaultScope {CFF4DB9B-135F-47c0-9269-B4C6572FD61A}
SearchScopes: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=843&q={SearchTerms}&s_it=amonetizetest1-ie&tb_uuid=A348D76AC1BB458096F267DFB266A97A&tb_oid=24-07-2013&tb_mrud=24-07-2013
SearchScopes: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://mysearch.avg.com/search?cid={1FC92D32-0098-474D-81BF-9431C416E9C6}&mid=f8e11bf0b67b47d3a8f5d16836dde856-21abf109ef5bea8ce7654c8962254f79c0936920&lang=en&ds=ts018&coid=avgtbdists&cmpid=&pr=sa&d=2013-10-30 15:41:46&v=18.0.0.248&pid=safeguard&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> {C603FAF6-5718-4F44-840A-EC8BA0159093} URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> {CF739809-1C6C-47C0-85B9-569DBB141420} URL =
SearchScopes: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> {E5020A0D-E981-4474-B2BE-19D4FB675838} URL = hxxps://search.yahoo.com/search?p={searchTerms}&fr=yset_ie_syc_oracle&type=orcl_default
BHO: No Name -> {02478D38-C3F9-4efb-9B51-7695ECA05670} -> No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2013-08-14] (RealDownloader)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_91\bin\ssv.dll [2016-06-19] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-06-19] (AVAST Software)
BHO: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> No File
BHO: No Name -> {CA6319C0-31B7-401E-A518-A07C3DB8F777} -> No File
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-06-19] (Oracle Corporation)
Toolbar: HKLM - No Name - !{238d4b4c-d63c-42a7-b6d8-dc96c8c0f5b9} - No File
Toolbar: HKLM - No Name - !{EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
Toolbar: HKLM - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
Toolbar: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> No Name - {724D43A0-0D85-11D4-9908-00400523E39A} - No File
Toolbar: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Toolbar: HKU\S-1-5-21-2243051797-3227929194-3452157988-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-11-28] (Microsoft Corporation)
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.5\ViProtocol.dll [2014-05-09] (AVG Secure Search)
FireFox:
========
FF ProfilePath: C:\Users\C&T Muhammad\AppData\Roaming\Mozilla\Firefox\Profiles\vx5wbjwi.default-1384568325763
FF DefaultSearchEngine: Bing
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Homepage: hxxp://www.msn.com/?pc=U270&ocid=U270DHP&osmkt=en-us
FF Keyword.URL: hxxp://www.bing.com/search?FORM=U270DF&PC=U270&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_22_0_0_192.dll [2016-06-16] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2015-09-04] ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.5\\npsitesafety.dll [No File]
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-06-19] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-06-19] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=16.0.3.51 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll [2014-04-12] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll [2013-08-14] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.3.51 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll [2014-04-12] (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2013-08-14] (RealDownloader)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll [2015-05-22] ()
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin: @unity3d.com/UnityPlayer -> C:\Program Files\Unity\WebPlayer\loader\npUnity3D32.dll [2011-06-29] (Unity Technologies ApS)
FF Plugin: @videolan.org/vlc,version=2.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2243051797-3227929194-3452157988-1000: @citrixonline.com/appdetectorplugin -> C:\Users\C&T Muhammad\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-12-07] (Citrix Online)
FF Plugin HKU\S-1-5-21-2243051797-3227929194-3452157988-1000: @fuzebox.com/Fuze Meeting NPAPI Plugin,version=1.0.0.1 -> C:\Users\C&T Muhammad\AppData\Local\Fuze Box\Fuze Meeting\npfuzeshare.dll [2014-01-03] ( )
FF Plugin HKU\S-1-5-21-2243051797-3227929194-3452157988-1000: @startmeeting.com/launcher -> C:\Users\C&T Muhammad\AppData\Local\SMPlugins\npsmlauncher.dll [2015-05-21] (Start Meeting)
FF Plugin HKU\S-1-5-21-2243051797-3227929194-3452157988-1000: @talk.google.com/GoogleTalkPlugin -> C:\Users\C&T Muhammad\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-2243051797-3227929194-3452157988-1000: @talk.google.com/O1DPlugin -> C:\Users\C&T Muhammad\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-2243051797-3227929194-3452157988-1000: @tools.google.com/Google Update;version=3 -> C:\Users\C&T Muhammad\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF Plugin HKU\S-1-5-21-2243051797-3227929194-3452157988-1000: @tools.google.com/Google Update;version=9 -> C:\Users\C&T Muhammad\AppData\Local\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-10] (Google Inc.)
FF user.js: detected! => C:\Users\C&T Muhammad\AppData\Roaming\Mozilla\Firefox\Profiles\vx5wbjwi.default-1384568325763\user.js [2014-02-09]
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL [2007-03-22] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll [2014-04-12] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2013-06-17] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2013-06-17] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2013-06-17] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2013-06-17] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2013-06-17] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll [2014-04-12] (RealPlayer)
FF Plugin ProgramFiles/Appdata: C:\Users\C&T Muhammad\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\C&T Muhammad\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF SearchPlugin: C:\Users\C&T Muhammad\AppData\Roaming\Mozilla\Firefox\Profiles\vx5wbjwi.default-1384568325763\searchplugins\bingp.xml [2015-09-30]
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\safeguard-secure-search.xml [2014-05-09]
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml [2012-05-17]
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml [2014-05-09]
FF Extension: Adblock Plus - C:\Users\C&T Muhammad\AppData\Roaming\Mozilla\Firefox\Profiles\vx5wbjwi.default-1384568325763\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-24] [not signed]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-02] [not signed]
FF HKLM\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\18.1.5.514 => not found
FF HKLM\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-04-12] [not signed]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [[email protected]] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-06-23]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-09-09]
Chrome:
=======
CHR HomePage: Default -> hxxp://www.search.ask.com/?gct=hp
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR DefaultSearchURL: Default -> hxxp://www.search.ask.com/web?q={searchTerms}
CHR DefaultSearchKeyword: Default -> search.ask.com
CHR DefaultSuggestURL: Default -> hxxp://ssmsp.ask.com/query?sstype=prefix&li=ff&q={searchTerms}
CHR Profile: C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (VideoDownloadConverter) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\aeljlhkkoipjimklndofjoafhpccdfjo [2015-02-13]
CHR Extension: (Google Docs) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-11]
CHR Extension: (Google Drive) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]
CHR Extension: (YouTube) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-26]
CHR Extension: (Google Search) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-28]
CHR Extension: (Dark Reader) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\eimadpbcbfnmbkopoojfekhnkhdbieeh [2016-05-20]
CHR Extension: (Google Docs Offline) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (SwagButton) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\gngocbkfmikdgphklgmmehbjjlfgdemm [2016-06-24]
CHR Extension: (Pin It Button) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2016-03-31]
CHR Extension: (Grammarly for Chrome) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbfnbcaeplbcioakkpcpgfkobkghlhen [2016-06-26]
CHR Extension: (Fuze on Chrome™) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcehcblfpidimbihdfophhhdejckolgh [2016-05-26]
CHR Extension: (BB10 / PlayBook App Manager) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmbaalodpmjjhpobkgljnelbpblnikkp [2016-01-09]
CHR Extension: (Adblock Super) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\knebimhcckndhiglamoabbnifdkijidd [2015-09-23]
CHR Extension: (Google Play) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\komhbcfkdcgmcdoenjcjheifdiabikfi [2016-03-27]
CHR Extension: (Chrome Web Store Payments) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-18]
CHR Extension: (StartMeeting.com Extension) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnedppabchbjaplcbjpbkcjhpmfdhpin [2016-04-17]
CHR Extension: (Gmail) - C:\Users\C&T Muhammad\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-07]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-06-19]
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]
CHR HKLM\...\Chrome\Extension: [nogdfjjfhknacchjpiccacoimeelkajb] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-2243051797-3227929194-3452157988-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) ========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AERTFilters; C:\Windows\system32\AERTSrv.exe [73728 2008-08-26] (Andrea Electronics Corporation)
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [243296 2016-06-19] (AVAST Software)
S3 BlackBerry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [588024 2014-10-31] (BlackBerry Limited)
S2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2016-01-29] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [292816 2016-01-29] (Microsoft Corporation)
S2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S2 RIM MDNS; C:\Program Files\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [396024 2015-05-26] (Apple Inc.)
S2 RIM Tunnel Service; C:\Program Files\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [1355000 2015-05-26] (BlackBerry Limited)
S2 SharedAccess; C:\Windows\System32\svchost.exe [21504 2008-01-20] (Microsoft Corporation)
S4 vToolbarUpdater18.1.5; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.5\ToolbarUpdater.exe [1801752 2014-05-09] (AVG Secure Search)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-20] (Microsoft Corporation)
S2 wltrysvc; C:\Windows\System32\bcmwltry.exe [2654208 2008-07-03] (Dell Inc.) [File not signed]
===================== Drivers (Whitelisted) ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [32792 2016-06-19] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [35096 2016-06-19] (AVAST Software)
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [91168 2016-06-19] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [64272 2016-06-19] (AVAST Software)
S0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [58776 2016-06-19] (AVAST Software)
S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [815792 2016-06-19] (AVAST Software)
S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [449640 2016-06-19] (AVAST Software)
S3 aswStmXP; C:\Windows\system32\drivers\aswStmXP.sys [187208 2016-06-19] (AVAST Software)
S3 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [67216 2016-06-19] (AVAST Software)
S0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [221368 2016-06-19] (AVAST Software)
S4 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [42784 2014-05-09] (AVG Technologies)
S3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18424 2008-07-03] (Broadcom Corporation)
S3 BVRPMPR5; C:\Windows\system32\drivers\BVRPMPR5.SYS [49904 2009-03-02] (Avanquest Software) [File not signed]
R3 DLXPDisplayName; C:\Windows\System32\DRIVERS\DLACPI.sys [14392 2008-04-16] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24448 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [170200 2016-06-26] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [53120 2016-03-10] (Malwarebytes Corporation)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [253704 2015-11-13] (Microsoft Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb.sys [69120 2015-01-14] (BlackBerry Limited)
R3 rimvndis; C:\Windows\System32\Drivers\rimvndis6.sys [14848 2015-05-26] (BlackBerry Limited)
S2 RtNdPt60; C:\Windows\System32\DRIVERS\RtNdPt60.sys [27648 2008-05-08] (Windows ® Codename Longhorn DDK provider)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [13464 2015-02-18] ()
S3 ATMFBUS; system32\DRIVERS\ATMFBUS.sys [X]
S3 ATMFCVsp; system32\DRIVERS\ATMFCVsp.sys [X]
S3 ATMFFLT; system32\DRIVERS\ATMFFLT.sys [X]
S3 ATMFMdm; system32\DRIVERS\ATMFMdm.sys [X]
S3 ATMFNET; system32\DRIVERS\ATMFNET.sys [X]
S3 ATMFNVsp; system32\DRIVERS\ATMFNVsp.sys [X]
S3 ATMFVsp; system32\DRIVERS\ATMFVsp.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-06-26 21:30 - 2016-06-26 21:31 - 00033253 _____ C:\Users\C&T Muhammad\Desktop\FRST.txt
2016-06-26 21:30 - 2016-06-26 21:30 - 00000000 ____D C:\Users\C&T Muhammad\Desktop\FRST-OlderVersion
2016-06-26 21:30 - 2016-06-26 21:30 - 00000000 ____D C:\FRST
2016-06-26 21:27 - 2016-06-26 21:30 - 01739776 _____ (Farbar) C:\Users\C&T Muhammad\Desktop\FRST.exe
2016-06-26 14:47 - 2016-06-26 12:07 - 54935552 _____ C:\Windows\system32\config\SOFTWARE.OLD
2016-06-26 14:47 - 2016-06-26 12:07 - 43511808 _____ C:\Windows\system32\config\COMPONENTS.OLD
2016-06-26 14:47 - 2016-06-26 12:07 - 30867456 _____ C:\Windows\system32\config\SYSTEM.OLD
2016-06-26 14:47 - 2016-06-26 12:07 - 01515520 _____ C:\Windows\system32\config\DEFAULT.OLD
2016-06-26 14:47 - 2016-06-26 12:07 - 00057344 _____ C:\Windows\system32\config\SAM.OLD
2016-06-26 14:47 - 2016-06-26 12:07 - 00028672 _____ C:\Windows\system32\config\SECURITY.OLD
2016-06-26 14:33 - 2016-06-26 14:33 - 00000000 ____D C:\Windows\system32\config\cackup
2016-06-26 14:33 - 2016-06-26 14:33 - 00000000 ____D C:\Windows\system32\config\backup
2016-06-24 17:08 - 2016-06-24 17:08 - 00000000 ____D C:\Users\C&T Muhammad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-06-23 18:30 - 2016-06-19 11:10 - 00334280 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-06-21 10:16 - 2016-06-21 10:16 - 00297020 _____ C:\Users\C&T Muhammad\Downloads\Entering 4th Grade Summer Math Packet (2).pdf
2016-06-21 10:15 - 2016-06-21 10:16 - 00297020 _____ C:\Users\C&T Muhammad\Downloads\Entering 4th Grade Summer Math Packet.pdf
2016-06-20 04:57 - 2016-06-20 04:57 - 00235686 _____ C:\Users\C&T Muhammad\Downloads\VS111.pdf
2016-06-20 04:57 - 2016-06-20 04:57 - 00235686 _____ C:\Users\C&T Muhammad\Downloads\1 App for Birth Record VS111.pdf
2016-06-19 11:24 - 2016-06-19 11:24 - 00000814 _____ C:\Users\Public\Desktop\Avast SafeZone Browser.lnk
2016-06-19 11:24 - 2016-06-19 11:24 - 00000814 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2016-06-19 11:19 - 2016-06-19 11:18 - 00035096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2016-06-19 11:15 - 2016-06-19 11:15 - 00000000 ____D C:\Users\C&T Muhammad\AppData\Roaming\AVAST Software
2016-06-19 11:14 - 2016-06-23 19:40 - 00001747 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2016-06-19 11:14 - 2016-06-19 11:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2016-06-19 11:12 - 2016-06-19 11:11 - 00449640 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2016-06-19 11:12 - 2016-06-19 11:11 - 00221368 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2016-06-19 11:12 - 2016-06-19 11:11 - 00187208 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStmXP.sys
2016-06-19 11:12 - 2016-06-19 11:11 - 00091168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2016-06-19 11:12 - 2016-06-19 11:11 - 00067216 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2016-06-19 11:12 - 2016-06-19 11:11 - 00064272 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys
2016-06-19 11:12 - 2016-06-19 11:11 - 00058776 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-06-19 11:12 - 2016-06-19 11:11 - 00032792 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-06-19 11:12 - 2016-06-19 11:09 - 00815792 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2016-06-19 11:10 - 2016-06-19 11:10 - 00052184 _____ (AVAST Software) C:\Windows\avastSS.scr
2016-06-19 11:05 - 2016-06-19 11:06 - 05066104 _____ (AVAST Software) C:\Users\C&T Muhammad\Downloads\avast_free_antivirus_setup_online_cnet2.exe
2016-06-19 10:32 - 2016-06-19 10:32 - 00000000 ____D C:\ProgramData\dbg
2016-06-19 09:48 - 2016-06-19 09:48 - 00000000 ____D C:\Program Files\Common Files\Java
2016-06-18 18:35 - 2016-06-18 18:35 - 02535247 _____ C:\Users\C&T Muhammad\Downloads\NoDocument (1).pdf
2016-06-18 12:44 - 2016-06-18 12:44 - 225955043 _____ C:\Windows\MEMORY.DMP
2016-06-18 12:44 - 2016-06-18 12:44 - 00147560 _____ C:\Windows\Minidump\Mini061816-01.dmp
2016-06-16 15:20 - 2016-06-16 15:20 - 00626217 _____ C:\Users\C&T Muhammad\Downloads\lexi stid (2).zip
2016-06-16 15:15 - 2016-06-16 15:15 - 00626217 _____ C:\Users\C&T Muhammad\Downloads\lexi stid.zip
2016-06-16 15:15 - 2016-06-16 15:15 - 00626217 _____ C:\Users\C&T Muhammad\Downloads\lexi stid (1).zip
2016-06-15 08:34 - 2016-06-15 08:34 - 00176894 _____ C:\Users\C&T Muhammad\Downloads\Ecosoc Notification Letter.pdf
2016-06-13 15:05 - 2016-06-13 15:06 - 02535247 _____ C:\Users\C&T Muhammad\Downloads\NoDocument.pdf
2016-06-10 16:17 - 2016-06-10 16:17 - 01679475 _____ C:\Users\C&T Muhammad\Downloads\SelfLoveAff.pdf
2016-06-09 15:45 - 2016-06-09 15:45 - 02151760 _____ C:\Users\C&T Muhammad\Downloads\6 Steps to Manifest (2).pdf
2016-06-09 15:17 - 2016-06-09 15:17 - 00076729 _____ C:\Users\C&T Muhammad\Downloads\{6245E3C4-F4D9-4C24-B9BD-12EFE1028086}.pdf
2016-06-09 14:57 - 2016-06-09 14:57 - 00077319 _____ C:\Users\C&T Muhammad\Downloads\{AAF07FC7-B8B4-4000-8E9F-A2266B676AA9}.pdf
2016-06-09 14:57 - 2016-06-09 14:57 - 00077319 _____ C:\Users\C&T Muhammad\Downloads\{AAF07FC7-B8B4-4000-8E9F-A2266B676AA9} (1).pdf
2016-06-07 11:17 - 2016-06-07 11:17 - 00050784 _____ C:\Users\C&T Muhammad\Downloads\todoandbemydreams1023final.pdf
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2016-06-26 21:10 - 2015-07-03 12:21 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-06-26 21:10 - 2011-04-09 21:29 - 01108498 _____ C:\Windows\ntbtlog.txt
2016-06-26 20:40 - 2009-04-29 13:31 - 00001356 _____ C:\Users\C&T Muhammad\AppData\Local\d3d9caps.dat
2016-06-26 18:34 - 2006-11-02 05:47 - 00349648 _____ C:\Windows\system32\FNTCACHE.DAT
2016-06-26 13:19 - 2015-09-23 18:40 - 00000882 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-06-26 13:19 - 2006-11-02 06:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-06-26 13:07 - 2006-11-02 05:47 - 00187392 _____ C:\Windows\system32\umstartup.etl
2016-06-26 11:59 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\inf
2016-06-25 16:38 - 2009-11-28 09:24 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-06-25 12:16 - 2015-04-19 14:36 - 00000406 ____H C:\Windows\Tasks\User_Feed_Synchronization-{AC4E15DC-E56F-4AF0-8146-FC7692F56C37}.job
2016-06-25 12:04 - 2013-11-16 04:05 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-06-25 12:03 - 2015-09-23 18:40 - 00000886 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-25 12:02 - 2015-06-23 13:50 - 00000946 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2243051797-3227929194-3452157988-1000UA.job
2016-06-25 11:44 - 2006-11-02 03:33 - 00756792 _____ C:\Windows\system32\PerfStringBackup.INI
2016-06-25 11:26 - 2013-11-07 09:15 - 00000936 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2243051797-3227929194-3452157988-1000UA.job
2016-06-25 11:00 - 2014-06-13 15:35 - 00000302 _____ C:\Windows\Tasks\PCHelpers_period.job
2016-06-25 10:33 - 2006-11-02 05:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2016-06-25 10:33 - 2006-11-02 05:47 - 00003616 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2016-06-25 09:44 - 2010-06-04 03:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-06-25 09:02 - 2013-08-14 03:12 - 00000000 ____D C:\Windows\system32\MRT
2016-06-25 08:06 - 2006-11-02 03:24 - 139785240 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2016-06-25 05:41 - 2006-11-02 04:18 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-06-25 04:51 - 2015-07-03 14:02 - 00002154 _____ C:\Windows\epplauncher.mif
2016-06-25 04:51 - 2015-07-03 14:02 - 00001744 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2016-06-25 04:49 - 2015-07-03 14:01 - 00000000 ____D C:\Program Files\Microsoft Security Client
2016-06-24 20:01 - 2015-06-23 13:50 - 00000894 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-2243051797-3227929194-3452157988-1000Core.job
2016-06-24 18:26 - 2013-11-07 09:15 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2243051797-3227929194-3452157988-1000Core.job
2016-06-24 17:09 - 2014-07-18 03:18 - 00000000 ____D C:\Users\C&T Muhammad\AppData\Roaming\Dropbox
2016-06-24 06:23 - 2012-07-04 09:51 - 00000000 ____D C:\Program Files\Yahoo!
2016-06-24 06:19 - 2016-03-26 09:52 - 00000000 ____D C:\Users\C&T Muhammad\Desktop\Conscious Graphic ART
2016-06-24 06:18 - 2016-05-19 09:07 - 00000000 ____D C:\Users\C&T Muhammad\AppData\Local\Spotify
2016-06-24 06:18 - 2014-01-11 14:41 - 00000000 ____D C:\Users\C&T Muhammad\AppData\Roaming\Spotify
2016-06-23 22:27 - 2006-11-02 06:01 - 00032650 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-06-23 19:15 - 2006-11-02 03:22 - 54263808 _____ C:\Windows\system32\config\software_previous
2016-06-23 19:15 - 2006-11-02 03:22 - 31457280 _____ C:\Windows\system32\config\system_previous
2016-06-23 19:14 - 2006-11-02 05:37 - 00000000 ____D C:\Windows\ShellNew
2016-06-23 19:14 - 2006-11-02 04:18 - 00000000 __RSD C:\Windows\Media
2016-06-23 19:14 - 2006-11-02 04:18 - 00000000 ___SD C:\Windows\Downloaded Program Files
2016-06-23 19:14 - 2006-11-02 04:18 - 00000000 ___RD C:\Windows\Offline Web Pages
2016-06-23 19:14 - 2006-11-02 04:18 - 00000000 ____D C:\Program Files\Common Files\Services
2016-06-23 19:13 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\system32\spool
2016-06-23 19:13 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\system32\Msdtc
2016-06-23 19:12 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\registration
2016-06-23 19:05 - 2006-11-02 03:22 - 00262144 _____ C:\Windows\system32\config\security_previous
2016-06-23 19:05 - 2006-11-02 03:22 - 00262144 _____ C:\Windows\system32\config\sam_previous
2016-06-23 18:17 - 2009-01-19 21:11 - 00000000 ____D C:\Users\C&T Muhammad
2016-06-23 13:40 - 2006-11-02 03:22 - 42729472 _____ C:\Windows\system32\config\components_previous
2016-06-23 13:40 - 2006-11-02 03:22 - 01572864 _____ C:\Windows\system32\config\default_previous
2016-06-21 19:38 - 2016-02-01 19:14 - 00000000 ____D C:\Users\C&T Muhammad\Desktop\SimpleTrend System
2016-06-21 19:38 - 2015-12-11 04:52 - 00000000 ____D C:\Users\C&T Muhammad\Desktop\Lexi ArmyROTC_ASU INFO
2016-06-21 10:16 - 2013-08-20 07:12 - 00000000 ____D C:\Users\C&T Muhammad\Desktop\Homeschool
2016-06-19 11:18 - 2014-06-13 15:39 - 00000000 ____D C:\Program Files\AVAST Software
2016-06-19 11:18 - 2014-06-13 15:37 - 00000000 ____D C:\ProgramData\AVAST Software
2016-06-19 10:54 - 2009-09-18 11:15 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\qmgr.dll
2016-06-19 09:51 - 2014-08-16 04:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-06-19 09:51 - 2010-10-01 12:36 - 00000000 ____D C:\Program Files\Java
2016-06-19 09:47 - 2015-12-11 11:25 - 00000000 ____D C:\Users\C&T Muhammad\.oracle_jre_usage
2016-06-19 09:45 - 2015-06-02 18:37 - 00095808 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2016-06-18 12:44 - 2010-09-01 09:42 - 00000000 ____D C:\Windows\Minidump
2016-06-16 17:04 - 2013-11-16 04:05 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-06-16 17:04 - 2013-11-16 04:05 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-06-16 08:43 - 2016-05-03 12:59 - 01569792 ____H C:\Users\C&T Muhammad\Desktop\~WRL1687.tmp
2016-06-16 08:30 - 2016-05-03 12:59 - 01568256 ____H C:\Users\C&T Muhammad\Desktop\~WRL3274.tmp
2016-06-16 08:30 - 2016-05-03 12:59 - 01568256 ____H C:\Users\C&T Muhammad\Desktop\~WRL3132.tmp
2016-06-16 07:14 - 2012-08-26 07:23 - 00000000 ____D C:\Users\C&T Muhammad\Desktop\THINGS TO DO and Projects Working On
2016-06-16 07:12 - 2016-05-03 12:59 - 01570304 ____H C:\Users\C&T Muhammad\Desktop\~WRL0987.tmp
2016-06-15 13:29 - 2016-05-03 12:59 - 01526272 ____H C:\Users\C&T Muhammad\Desktop\~WRL1855.tmp
2016-06-15 13:07 - 2016-05-03 12:59 - 01308160 ____H C:\Users\C&T Muhammad\Desktop\~WRL2610.tmp
2016-06-15 13:03 - 2016-05-03 12:59 - 01216000 ____H C:\Users\C&T Muhammad\Desktop\~WRL2858.tmp
2016-06-13 14:18 - 2016-05-10 11:26 - 00000000 ____D C:\Users\C&T Muhammad\Desktop\Lexi Picture Folder
2016-06-11 11:59 - 2016-05-03 12:59 - 01050624 ____H C:\Users\C&T Muhammad\Desktop\~WRL0546.tmp
2016-06-11 11:58 - 2016-05-03 12:59 - 00966144 ____H C:\Users\C&T Muhammad\Desktop\~WRL3251.tmp
2016-06-09 22:32 - 2016-05-26 19:03 - 00000000 ____D C:\Users\C&T Muhammad\Desktop\Zaahidah
2016-06-09 14:45 - 2013-07-26 18:48 - 00000000 ____D C:\Users\C&T Muhammad\Documents\Homeschool
2016-06-01 19:59 - 2015-08-26 12:28 - 00000000 ____D C:\Users\C&T Muhammad\Desktop\pictures for walgreens
2016-06-01 19:58 - 2016-05-16 12:16 - 00000000 ____D C:\Users\C&T Muhammad\Desktop\DES NEW app
2016-05-28 06:19 - 2016-05-26 18:28 - 00000000 ____D C:\Users\C&T Muhammad\Desktop\New Info To Organize
==================== Files in the root of some directories =======
2014-06-13 15:40 - 2014-06-14 11:00 - 0005265 _____ () C:\Users\C&T Muhammad\AppData\Roaming\callbanner.png
2011-06-15 06:16 - 2015-02-22 21:47 - 0018001 _____ () C:\Users\C&T Muhammad\AppData\Roaming\UserTile.png
2009-02-11 09:29 - 2009-03-02 21:51 - 0001468 _____ () C:\Users\C&T Muhammad\AppData\Roaming\wklnhst.dat
2009-04-29 13:31 - 2016-06-26 20:40 - 0001356 _____ () C:\Users\C&T Muhammad\AppData\Local\d3d9caps.dat
2009-02-11 14:46 - 2015-08-26 11:41 - 0231424 _____ () C:\Users\C&T Muhammad\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-02-11 14:55 - 2009-05-04 08:34 - 0008248 _____ () C:\Users\C&T Muhammad\AppData\Local\en.ini
2015-12-05 09:02 - 2015-12-05 09:02 - 0004096 ____H () C:\Users\C&T Muhammad\AppData\Local\keyfile3.drm
2015-06-27 19:34 - 2015-06-27 19:34 - 0000000 _____ () C:\Users\C&T Muhammad\AppData\Local\{F5BEE43F-0374-41C2-851C-243CD3D16C21}
2015-04-07 18:59 - 2015-06-29 11:29 - 0000112 _____ () C:\ProgramData\2iSA11.dat
ZeroAccess:
C:\Users\C&T Muhammad\AppData\Local\Google\Desktop\Install
ZeroAccess:
C:\Program Files\Google\Desktop\Install
Files to move or delete:
====================
C:\ProgramData\2iSA11.dat
Some files in TEMP:
====================
C:\Users\C&T Muhammad\AppData\Local\Temp\jre-8u91-windows-au.exe
C:\Users\C&T Muhammad\AppData\Local\Temp\{A1C3F053-67AE-4103-8485-BDAF5E5EB176}-DropboxClient_5.4.24.exe
==================== Bamital & volsnap =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2016-06-26 19:18
==================== End of FRST.txt ============================
Edited by novicecomputergirl, 27 June 2016 - 05:48 PM.
![I think my laptop is infected by virus idk, pls help me. [Closed] - last post by JSntgRvr](https://www.geekstogo.com/forum/uploads/av-143426.jpg?_r=0)
![Infection by PUM.Optional.NoDrives (and more) [Closed] - last post by LiquidTension](https://www.geekstogo.com/forum/uploads/profile/photo-387940.gif?_r=1401125445)
![Can't remove "Safesearch" locked by Admin [Solved] - last post by pystryker](https://www.geekstogo.com/forum/uploads/profile/photo-thumb-63328.jpg?_r=1423449705)
Sign In
Create Account
