TechSpot

I may have Trogan.Agent/Gen-backdoor

By Kactus
Nov 1, 2014
  1. I all, on 10/24 my McAfee software popped a box saying malicious threat and that it took care of it. So over the next week I noticed on reboot all the time that my home page reverted from MSN to about blank. Then web pages would hang up so I ran a Malwarebytes scan and nothing showed up so I ran a super anti spyware scan and it detected trogan.agent/gen-backdoor which I quaranteened and deleted. Rebooted and my home page was still misdirected to about.blank. Then last night my webpages were again hanging up and not allowing me to sign into one of them so I decided to perform a system restore. I restored it the date of 10/17 this morning, checked Microsoft for any critical updates, updated Java and then ran another super anti-spyware scan and again the same trogan came up. I again quaranteened and deleted it and decided whatever I did didn't work at getting rid of it so now I'm back here at the place that has always helped me out asking for your help again. So, please see below the scans per your instruction page.
    And thanks so much for your time and effort.

    Malwarebytes Anti-Malware
    www.malwarebytes.org
    Scan Date: 11/1/2014
    Scan Time: 3:42:08 PM
    Logfile: Malwarebytes scan 11-1-14.txt
    Administrator: Yes
    Version: 2.00.3.1025
    Malware Database: v2014.11.01.08
    Rootkit Database: v2014.11.01.02
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled
    OS: Windows 7 Service Pack 1
    CPU: x64
    File System: NTFS
    User: Deb
    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 382942
    Time Elapsed: 14 min, 9 sec
    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled
    Processes: 0
    (No malicious items detected)
    Modules: 0
    (No malicious items detected)
    Registry Keys: 0
    (No malicious items detected)
    Registry Values: 0
    (No malicious items detected)
    Registry Data: 0
    (No malicious items detected)
    Folders: 0
    (No malicious items detected)
    Files: 0
    (No malicious items detected)
    Physical Sectors: 0
    (No malicious items detected)

    (end)

    NLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume2
    Install Date: 12/19/2010 4:06:05 PM
    System Uptime: 11/1/2014 3:35:44 PM (1 hours ago)
    .
    Motherboard: Dell Inc. | | 0C2KJT
    Processor: Intel(R) Core(TM) i3 CPU 550 @ 3.20GHz | CPU 1 | 3200/133mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 919 GiB total, 796.237 GiB free.
    D: is CDROM ()
    E: is Removable
    F: is Removable
    G: is Removable
    H: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP275: 10/17/2014 3:00:31 AM - Windows Update
    RP276: 10/24/2014 7:57:21 PM - Scheduled Checkpoint
    RP277: 11/1/2014 12:00:02 AM - Scheduled Checkpoint
    RP278: 11/1/2014 12:35:36 AM - Restore Operation
    RP279: 11/1/2014 3:00:17 AM - Windows Update
    RP280: 11/1/2014 9:38:58 AM - Removed Java 7 Update 45
    RP281: 11/1/2014 9:39:59 AM - Removed Java 7 Update 45
    .
    ==== Installed Programs ======================
    .
    Adobe Flash Player 15 ActiveX
    Adobe Reader XI (11.0.05)
    Adobe Shockwave Player 12.0
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Bonjour
    Canon Camera Access Library
    Canon Camera Window DC_DV 6 for ZoomBrowser EX
    Canon Camera Window MC 6 for ZoomBrowser EX
    Canon Easy-PhotoPrint EX
    Canon G.726 WMP-Decoder
    Canon MG5300 series MP Drivers
    Canon MG5300 series On-screen Manual
    Canon MG5300 series User Registration
    Canon MovieEdit Task for ZoomBrowser EX
    Canon MP Navigator EX 5.0
    Canon My Printer
    Canon RAW Image Task for ZoomBrowser EX
    Canon RemoteCapture Task for ZoomBrowser EX
    Canon Solution Menu EX
    Canon Utilities EOS Utility
    Canon Utilities PhotoStitch
    Canon Utilities ZoomBrowser EX
    Consumer In-Home Service Agreement
    D3DX10
    Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
    Dell DataSafe Local Backup
    Dell DataSafe Local Backup - Support Software
    Dell DataSafe Online
    Dell Dock
    Dell Edoc Viewer
    Dell Getting Started Guide
    Dell Support Center
    eReg
    ESET Online Scanner v3
    GoToAssist Corporate
    Intel(R) Graphics Media Accelerator Driver
    Internet Explorer
    IrfanView (remove only)
    iTunes
    Java 7 Update 9
    Java 8 Update 25
    Java Auto Updater
    Junk Mail filter update
    Logitech Harmony Remote Software (x86)
    Logitech Harmony Remote Software 7
    Logitech SetPoint 6.65
    Malwarebytes Anti-Malware version 2.0.3.1025
    McAfee SecurityCenter
    Mesh Runtime
    Messenger Companion
    Microsoft .NET Framework 4.5.1
    Microsoft Application Error Reporting
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Click-to-Run 2010
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office Office 64-bit Components 2010
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Professional 2010
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2010
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared 64-bit MUI (English) 2010
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Single Image 2010
    Microsoft Office Word MUI (English) 2010
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
    MSVCRT
    MSVCRT_amd64
    Multimedia Card Reader
    Nuance PDF Reader
    QuickTime 7
    Realtek High Definition Audio Driver
    Remote Control USB Driver
    Roxio Burn
    Security Update for Microsoft .NET Framework 4.5.1 (KB2894854v2)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2972107)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2972216)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2979578v2)
    Security Update for Microsoft Office 2010 (KB2553284) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2810073) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2850016) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2880971) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2881071) 32-Bit Edition
    Security Update for Microsoft Word 2010 (KB2883013) 32-Bit Edition
    Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
    Shared C Run-time for x64
    Skype Toolbars
    Skype™ 6.11
    SpywareBlaster 5.0
    SUPERAntiSpyware
    swMSM
    Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
    Update for Microsoft Excel 2010 (KB2889836) 32-Bit Edition
    Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition
    Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2494150)
    Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2687502) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition
    Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition
    Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition
    Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition
    Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition
    Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition
    Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition
    Update Installer for WildTangent Games App
    WildTangent Games
    WildTangent Games App
    WildTangent Games App (Dell Games)
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live ID Sign-in Assistant
    Windows Live Installer
    Windows Live Language Selector
    Windows Live Mail
    Windows Live Mesh
    Windows Live Mesh ActiveX Control for Remote Connections
    Windows Live Messenger
    Windows Live Messenger Companion Core
    Windows Live MIME IFilter
    Windows Live Movie Maker
    Windows Live Photo Common
    Windows Live Photo Gallery
    Windows Live PIMT Platform
    Windows Live Remote Client
    Windows Live Remote Client Resources
    Windows Live Remote Service
    Windows Live Remote Service Resources
    Windows Live SOXE
    Windows Live SOXE Definitions
    Windows Live UX Platform
    Windows Live UX Platform Language Pack
    Windows Live Writer
    Windows Live Writer Resources
    Windows Mobile Device Updater Component
    Zune
    Zune Language Pack (CHS)
    Zune Language Pack (CHT)
    Zune Language Pack (CSY)
    Zune Language Pack (DAN)
    Zune Language Pack (DEU)
    Zune Language Pack (ELL)
    Zune Language Pack (ESP)
    Zune Language Pack (FIN)
    Zune Language Pack (FRA)
    Zune Language Pack (HUN)
    Zune Language Pack (IND)
    Zune Language Pack (ITA)
    Zune Language Pack (JPN)
    Zune Language Pack (KOR)
    Zune Language Pack (MSL)
    Zune Language Pack (NLD)
    Zune Language Pack (NOR)
    Zune Language Pack (PLK)
    Zune Language Pack (PTB)
    Zune Language Pack (PTG)
    Zune Language Pack (RUS)
    Zune Language Pack (SVE)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    11/1/2014 9:58:02 AM, Error: Service Control Manager [7034] - The Dock Login Service service terminated unexpectedly. It has done this 1 time(s).
    11/1/2014 3:36:56 PM, Error: Microsoft-Windows-Bits-Client [16398] - A new BITS job could not be created. The current job count for the user Deb-PC\Deb (60) is equal to or greater than the job limit (60) specified through group policy. To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.
    11/1/2014 3:28:04 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the McAfee Personal Firewall Service service to connect.
    11/1/2014 3:28:04 PM, Error: Service Control Manager [7000] - The McAfee Personal Firewall Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    11/1/2014 12:59:49 AM, Error: Service Control Manager [7024] - The Windows Firewall service terminated with service-specific error Access is denied..
    11/1/2014 10:40:22 AM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004
    11/1/2014 1:14:09 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the McAfee Proxy Service service to connect.
    11/1/2014 1:14:09 AM, Error: Service Control Manager [7000] - The McAfee Proxy Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    11/1/2014 1:13:45 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the McAfee Home Network service to connect.
    11/1/2014 1:13:45 AM, Error: Service Control Manager [7000] - The McAfee Home Network service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    11/1/2014 1:00:25 AM, Error: Service Control Manager [7034] - The Canon Camera Access Library 8 service terminated unexpectedly. It has done this 1 time(s).
    10/31/2014 12:40:02 AM, Error: Schannel [36887] - The following fatal alert was received: 40.
    10/31/2014 12:12:29 AM, Error: Service Control Manager [7031] - The McAfee Anti-Malware Core service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.
    10/31/2014 12:08:46 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {E579AB5F-1CC4-44B4-BED9-DE0991FF0623} and APPID {56BE716B-2F76-4DFA-8702-67AE10044F0B} to the user Deb-PC\Deb SID (S-1-5-21-2814169364-3148947929-1862132710-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    10/29/2014 2:03:02 PM, Error: Schannel [36888] - The following fatal alert was generated: 10. The internal error state is 10.
    10/28/2014 11:44:11 AM, Error: Service Control Manager [7031] - The McAfee Personal Firewall Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    .
    ==== End Of File ===========================

    DDS (Ver_2012-11-20.01) - NTFS_AMD64
    Internet Explorer: 11.0.9600.17344 BrowserJavaVersion: 11.25.2
    Run by Deb at 16:08:33 on 2014-11-01
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5943.3740 [GMT -5:00]
    .
    AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
    SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    FW: McAfee Firewall *Enabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Program Files\Dell\DellDock\DockLogin.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
    C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
    C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\McAfee\MSC\McAPExe.exe
    C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
    C:\Program Files (x86)\Canon\CAL\CALMAIN.exe
    C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
    C:\Windows\system32\taskhost.exe
    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\System32\WUDFHost.exe
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    C:\Program Files\Zune\ZuneLauncher.exe
    C:\Program Files\Logitech\SetPointP\SetPoint.exe
    C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
    C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Dell\DellDock\DellDock.exe
    C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
    C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\splwow64.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
    C:\Windows\system32\svchost.exe -k SDRSVC
    C:\PROGRA~1\McAfee\MSM\McSmtFwk.exe
    C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    C:\Windows\system32\PrintIsolationHost.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uProxyOverride = hxxp://localhost;*.local
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll
    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO: Logitech SetPoint: {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll
    uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    uRun: [ISUSPM] "C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe" -scheduler
    uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    mRun: [ShwiconXP9106] C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
    mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    mRun: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe
    mRun: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
    mRun: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini"
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [mcpltui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe
    StartupFolder: C:\Users\Deb\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files\Dell\DellDock\DellDock.exe
    uPolicies-Explorer: NoDrives = dword:0
    mPolicies-Explorer: NoDrives = dword:0
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
    IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    .
    INFO: HKCU has more than 50 listed domains.
    If you wish to scan all of them, select the 'Force scan all domains' option.
    .
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} - hxxp://kitchenplanner.ikea.com/US/Core/Player/2020PlayerAX_IKEA_Win32.cab
    DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxp://kitchenplanner.ikea.com/US/Core/Player/2020PlayerAX_Win32.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
    DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} - hxxp://www.superadblocker.com/activex/sabspx.cab
    DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
    TCP: NameServer = 192.168.1.1
    TCP: Interfaces\{B25DA075-B3E5-46AB-9BE8-7233FCD794CC} : DHCPNameServer = 192.168.1.1
    Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
    x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    x64-BHO: Logitech SetPoint: {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll
    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
    x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} -
    x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
    x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
    x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
    x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
    x64-Run: [Logitech Download Assistant] C:\Windows\System32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
    x64-Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
    x64-Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
    x64-Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    x64-Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll
    x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned>
    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
    x64-Notify: GoToAssist - C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll
    x64-Notify: igfxcui - igfxdev.dll
    x64-Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\System32\drivers\mfehidk.sys [2010-1-5 786296]
    R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\System32\drivers\mfewfpk.sys [2010-1-5 348552]
    R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2010-12-8 55280]
    R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
    R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
    R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2011-8-11 140672]
    R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2013-4-22 822504]
    R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648]
    R2 HomeNetSvc;McAfee Home Network;C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [2013-12-28 328928]
    R2 McAPExe;McAfee AP Service;C:\Program Files\mcafee\msc\McAPExe.exe [2013-12-28 178528]
    R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [2013-12-28 328928]
    R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [2013-12-28 328928]
    R2 mcpltsvc;McAfee Platform Services;C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [2013-12-28 328928]
    R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [2013-12-28 328928]
    R2 mfecore;McAfee Anti-Malware Core;C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe [2013-12-28 1041192]
    R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe [2010-12-8 219752]
    R2 mfevtp;McAfee Validation Trust Protection Service;C:\Program Files\Common Files\mcafee\systemcore\mfevtps.exe [2010-12-8 189912]
    R2 NOBU;Dell DataSafe Online;C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe [2010-8-25 2823000]
    R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2013-6-26 523944]
    R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2010-12-8 689472]
    R3 cfwids;McAfee Inc. cfwids;C:\Windows\System32\drivers\cfwids.sys [2010-1-5 72128]
    R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2010-12-8 56344]
    R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2010-12-8 271872]
    R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2010-12-8 321064]
    R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;C:\Windows\System32\drivers\LEqdUsb.sys [2014-3-18 77592]
    R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;C:\Windows\System32\drivers\LHidEqd.sys [2014-3-18 13080]
    R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-11-1 129752]
    R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\System32\drivers\mfeavfk.sys [2010-1-5 313544]
    R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\System32\drivers\mfefirek.sys [2010-1-5 523792]
    R3 mfencbdc;McAfee Inc. mfencbdc;C:\Windows\System32\drivers\mfencbdc.sys [2014-8-20 445512]
    R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2013-6-26 767144]
    R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2013-6-26 273576]
    R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2013-6-26 28840]
    R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2013-6-26 23208]
    R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2013-6-26 207528]
    S2 0197411414830831mcinstcleanup;McAfee Application Installer Cleanup (0197411414830831);C:\Windows\TEMP\019741~1.EXE -cleanup -nolog --> C:\Windows\TEMP\019741~1.EXE -cleanup -nolog [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]
    S3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;C:\Windows\System32\drivers\BVRPMPR5a64.SYS [2011-3-5 35840]
    S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
    S3 HipShieldK;McAfee Inc. HipShieldK;C:\Windows\System32\drivers\HipShieldK.sys [2014-4-22 197704]
    S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-11-1 111616]
    S3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2010-12-8 158976]
    S3 mfencrk;McAfee Inc. mfencrk;C:\Windows\System32\drivers\mfencrk.sys [2014-8-20 96592]
    S3 MHIKEY10;MHIKEY10;C:\Windows\System32\drivers\MHIKEY10x64.sys [2010-9-15 60288]
    S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2010-7-30 25072]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-6-20 59392]
    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2013-3-18 54784]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-12-25 1255736]
    S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
    S4 McOobeSv;McAfee OOBE Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2012-10-17 201304]
    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]
    .
    =============== Created Last 30 ================
    .
    2014-11-01 20:40:48 129752 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
    2014-11-01 20:40:28 93400 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
    2014-11-01 20:40:28 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
    2014-11-01 20:40:27 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2014-11-01 20:40:27 -------- d-----w- C:\ProgramData\Malwarebytes
    2014-11-01 20:40:27 -------- d-----w- C:\Program Files (x86)\Malwarebytes Anti-Malware
    2014-11-01 15:54:05 -------- d-----w- C:\Users\Deb\AppData\Local\Logishrd
    2014-11-01 14:50:33 98216 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    2014-11-01 06:15:47 507392 ----a-w- C:\Windows\System32\aepdu.dll
    2014-11-01 06:14:15 3241472 ----a-w- C:\Windows\System32\msi.dll
    2014-11-01 06:14:13 2363904 ----a-w- C:\Windows\SysWow64\msi.dll
    2014-10-31 00:13:09 -------- d--h--w- C:\a718302
    2014-10-22 22:04:12 -------- d--h--w- C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
    2014-10-16 11:24:07 60416 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
    .
    ==================== Find3M ====================
    .
    2014-11-01 15:50:58 18960 ----a-w- C:\Windows\System32\drivers\LNonPnP.sys
    2014-10-10 02:05:59 276480 ----a-w- C:\Windows\System32\generaltel.dll
    2014-10-10 02:00:38 424448 ----a-w- C:\Windows\System32\aeinv.dll
    2014-09-29 00:58:48 3198976 ----a-w- C:\Windows\System32\win32k.sys
    2014-09-25 22:32:04 2017280 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
    2014-09-25 22:31:02 2108416 ----a-w- C:\Windows\System32\inetcpl.cpl
    2014-09-25 02:08:38 371712 ----a-w- C:\Windows\System32\qdvd.dll
    2014-09-25 01:40:50 519680 ----a-w- C:\Windows\SysWow64\qdvd.dll
    2014-09-25 00:21:32 71344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-09-25 00:21:32 701104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
    2014-09-19 01:56:02 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
    2014-09-19 01:55:49 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
    2014-09-19 01:40:43 66048 ----a-w- C:\Windows\System32\iesetup.dll
    2014-09-19 01:40:03 547328 ----a-w- C:\Windows\System32\vbscript.dll
    2014-09-19 01:39:58 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
    2014-09-19 01:38:27 83968 ----a-w- C:\Windows\System32\MshtmlDac.dll
    2014-09-19 01:36:57 5829632 ----a-w- C:\Windows\System32\jscript9.dll
    2014-09-19 01:26:00 139264 ----a-w- C:\Windows\System32\ieUnatt.exe
    2014-09-19 01:25:49 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe
    2014-09-19 01:25:12 4201472 ----a-w- C:\Windows\SysWow64\jscript9.dll
    2014-09-19 01:25:09 758272 ----a-w- C:\Windows\System32\jscript9diag.dll
    2014-09-19 01:18:02 940032 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
    2014-09-19 01:14:57 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2014-09-19 01:06:47 72704 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
    2014-09-19 01:02:07 454656 ----a-w- C:\Windows\SysWow64\vbscript.dll
    2014-09-19 01:01:47 61952 ----a-w- C:\Windows\SysWow64\iesetup.dll
    2014-09-19 01:01:03 51200 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
    2014-09-19 00:59:40 61952 ----a-w- C:\Windows\SysWow64\MshtmlDac.dll
    2014-09-19 00:50:16 112128 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
    2014-09-19 00:49:31 597504 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
    2014-09-19 00:40:12 1249280 ----a-w- C:\Windows\System32\mshtmlmedia.dll
    2014-09-19 00:33:18 2309632 ----a-w- C:\Windows\System32\wininet.dll
    2014-09-19 00:18:55 1068032 ----a-w- C:\Windows\SysWow64\mshtmlmedia.dll
    2014-09-18 23:59:11 1810944 ----a-w- C:\Windows\SysWow64\wininet.dll
    2014-09-13 01:58:18 77312 ----a-w- C:\Windows\System32\packager.dll
    2014-09-13 01:40:05 67072 ----a-w- C:\Windows\SysWow64\packager.dll
    2014-09-09 22:11:04 2048 ----a-w- C:\Windows\System32\tzres.dll
    2014-09-09 21:47:10 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2014-09-04 05:23:20 424448 ----a-w- C:\Windows\System32\rastls.dll
    2014-09-04 05:04:15 372736 ----a-w- C:\Windows\SysWow64\rastls.dll
    2014-08-23 02:07:00 404480 ----a-w- C:\Windows\System32\gdi32.dll
    2014-08-23 01:45:55 311808 ----a-w- C:\Windows\SysWow64\gdi32.dll
    2014-08-20 13:07:00 11336 ----a-w- C:\Windows\System32\drivers\mfeclnrk.sys
    2014-08-20 13:06:14 96592 ----a-w- C:\Windows\System32\drivers\mfencrk.sys
    2014-08-20 13:05:28 445512 ----a-w- C:\Windows\System32\drivers\mfencbdc.sys
    .
    ============= FINISH: 16:09:23.41 ===============
     
  2. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ==================================

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download [​IMG] Malwarebytes Anti-Rootkit to your desktop.
    • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
    • Double click on downloaded file. OK self extracting prompt.
    • MBAR will start. Click "Next" to continue.
    • Click in the following screen "Update" to obtain the latest malware definitions.
    • Once the update is complete select "Next" and click "Scan".
    • When the scan is finished and no malware has been found select "Exit".
    • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
    • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
      • "mbar-log-{date} (xx-xx-xx).txt"
      • "system-log.txt"
     
  3. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    Hi Broni and thanks for your response.
    After creating the new restore point I was unable to download the malwarebytes anti-rootkit. Not sure why but notebox kept saying failed to download. So I rebooted the computer and removed my firewall which then allowed for the download to take place. Malwarebytes didn't detect any problems so no need to cleanup anything. Therefore I did not reboot again. Below are the files you requested:

    RogueKiller V10.0.4.0 [Oct 29 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com
    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Normal mode
    User : Deb [Administrator]
    Mode : Delete -- Date : 11/02/2014 09:33:06
    ¤¤¤ Processes : 2 ¤¤¤
    [Tr.Zeus] mcshield.exe -- [x] -> ERROR [12]
    [ZeroAccess] SUPERANTISPYWARE.EXE -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE[7] -> Killed [TermProc]
    ¤¤¤ Registry : 15 ¤¤¤
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\0197411414830831mcinstcleanup (C:\Windows\TEMP\019741~1.EXE -cleanup -nolog) -> Not selected
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\0197411414830831mcinstcleanup (C:\Windows\TEMP\019741~1.EXE -cleanup -nolog) -> Not selected
    [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\0197411414830831mcinstcleanup (C:\Windows\TEMP\019741~1.EXE -cleanup -nolog) -> Not selected
    [PUM.HomePage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Not selected
    [PUM.HomePage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Not selected
    [PUM.HomePage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Not selected
    [PUM.HomePage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Not selected
    [PUM.SearchPage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected
    [PUM.SearchPage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected
    [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-2814169364-3148947929-1862132710-1000\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected
    [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-2814169364-3148947929-1862132710-1000\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected
    [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected
    [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected
    ¤¤¤ Tasks : 0 ¤¤¤
    ¤¤¤ Files : 0 ¤¤¤
    ¤¤¤ Hosts File : 1 ¤¤¤
    [C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost
    ¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤
    ¤¤¤ Web browsers : 0 ¤¤¤
    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: WDC WD1001FAES-75W7A0 ATA Device +++++
    --- User ---
    [MBR] 13329e7f3410533ad0b8dbcb1a26ddf9
    [BSP] 976833c91be82e3a47ff2464d98af4e2 : HP MBR Code
    Partition table:
    0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 MB
    1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 81920 | Size: 13118 MB
    2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 26947584 | Size: 940710 MB
    User = LL1 ... OK
    User = LL2 ... OK
    +++++ PhysicalDrive1: Generic- SD/MMC USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )
    +++++ PhysicalDrive2: Generic- Compact Flash USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )
    +++++ PhysicalDrive3: Generic- SM/xD-Picture USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )
    +++++ PhysicalDrive4: Generic- MS/MS-Pro USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )
    +++++ PhysicalDrive5: Canon MG5300 series USB Device +++++
    Error reading User MBR! ([15] The device is not ready. )
    Error reading LL1 MBR! NOT VALID!
    Error reading LL2 MBR! ([32] The request is not supported. )

    ============================================
    RKreport_SCN_11022014_093215.log

    Malwarebytes Anti-Rootkit BETA 1.07.0.1012
    www.malwarebytes.org
    Database version: v2014.11.02.05
    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 11.0.9600.17358
    Deb :: DEB-PC [administrator]
    11/2/2014 10:20:16 AM
    mbar-log-2014-11-02 (10-20-16).txt
    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 383970
    Time elapsed: 12 minute(s), 31 second(s)
    Memory Processes Detected: 0
    (No malicious items detected)
    Memory Modules Detected: 0
    (No malicious items detected)
    Registry Keys Detected: 0
    (No malicious items detected)
    Registry Values Detected: 0
    (No malicious items detected)
    Registry Data Items Detected: 0
    (No malicious items detected)
    Folders Detected: 0
    (No malicious items detected)
    Files Detected: 0
    (No malicious items detected)
    Physical Sectors Detected: 0
    (No malicious items detected)
    (end)

    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.07.0.1012
    (c) Malwarebytes Corporation 2011-2012
    OS version: 6.1.7601 Windows 7 Service Pack 1 x64
    Account is Administrative
    Internet Explorer version: 11.0.9600.17358
    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED, Q:\ DRIVE_FIXED
    CPU speed: 3.192000 GHz
    Memory total: 6231810048, free: 3408191488
    Downloaded database version: v2014.11.02.05
    Downloaded database version: v2014.11.01.02
    Initializing...
    ======================
    ------------ Kernel report ------------
    11/02/2014 10:20:07
    ------------ Loaded modules -----------
    \SystemRoot\system32\ntoskrnl.exe
    \SystemRoot\system32\hal.dll
    \SystemRoot\system32\kdcom.dll
    \SystemRoot\system32\mcupdate_GenuineIntel.dll
    \SystemRoot\system32\PSHED.dll
    \SystemRoot\system32\CLFS.SYS
    \SystemRoot\system32\CI.dll
    \SystemRoot\system32\drivers\Wdf01000.sys
    \SystemRoot\system32\drivers\WDFLDR.SYS
    \SystemRoot\system32\drivers\ACPI.sys
    \SystemRoot\system32\drivers\WMILIB.SYS
    \SystemRoot\system32\drivers\msisadrv.sys
    \SystemRoot\system32\drivers\pci.sys
    \SystemRoot\system32\drivers\vdrvroot.sys
    \SystemRoot\System32\drivers\partmgr.sys
    \SystemRoot\system32\drivers\volmgr.sys
    \SystemRoot\System32\drivers\volmgrx.sys
    \SystemRoot\system32\drivers\pciide.sys
    \SystemRoot\system32\drivers\PCIIDEX.SYS
    \SystemRoot\System32\drivers\mountmgr.sys
    \SystemRoot\system32\drivers\atapi.sys
    \SystemRoot\system32\drivers\ataport.SYS
    \SystemRoot\system32\drivers\amdxata.sys
    \SystemRoot\system32\drivers\fltmgr.sys
    \SystemRoot\system32\drivers\fileinfo.sys
    \SystemRoot\system32\drivers\mfehidk.sys
    \SystemRoot\System32\Drivers\PxHlpa64.sys
    \SystemRoot\System32\Drivers\Ntfs.sys
    \SystemRoot\System32\Drivers\msrpc.sys
    \SystemRoot\System32\Drivers\ksecdd.sys
    \SystemRoot\System32\Drivers\cng.sys
    \SystemRoot\System32\drivers\pcw.sys
    \SystemRoot\System32\Drivers\Fs_Rec.sys
    \SystemRoot\system32\drivers\ndis.sys
    \SystemRoot\system32\drivers\NETIO.SYS
    \SystemRoot\System32\Drivers\ksecpkg.sys
    \SystemRoot\System32\drivers\tcpip.sys
    \SystemRoot\System32\drivers\fwpkclnt.sys
    \SystemRoot\system32\drivers\mfewfpk.sys
    \SystemRoot\system32\drivers\volsnap.sys
    \SystemRoot\System32\Drivers\spldr.sys
    \SystemRoot\System32\drivers\rdyboost.sys
    \SystemRoot\System32\Drivers\mup.sys
    \SystemRoot\System32\drivers\hwpolicy.sys
    \SystemRoot\System32\DRIVERS\fvevol.sys
    \SystemRoot\system32\DRIVERS\disk.sys
    \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
    \SystemRoot\system32\drivers\cdrom.sys
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\drivers\VIDEOPRT.SYS
    \SystemRoot\System32\drivers\watchdog.sys
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\system32\drivers\rdpencdd.sys
    \SystemRoot\system32\drivers\rdprefmp.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\system32\DRIVERS\tdx.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\System32\DRIVERS\netbt.sys
    \SystemRoot\system32\drivers\afd.sys
    \SystemRoot\system32\drivers\ws2ifsl.sys
    \SystemRoot\system32\DRIVERS\wfplwf.sys
    \SystemRoot\system32\DRIVERS\pacer.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\system32\drivers\termdd.sys
    \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
    \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\drivers\nsiproxy.sys
    \SystemRoot\system32\drivers\mssmbios.sys
    \SystemRoot\System32\drivers\discache.sys
    \SystemRoot\System32\Drivers\dfsc.sys
    \SystemRoot\system32\DRIVERS\blbdrive.sys
    \SystemRoot\system32\DRIVERS\tunnel.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\DRIVERS\igdkmd64.sys
    \SystemRoot\System32\drivers\dxgkrnl.sys
    \SystemRoot\System32\drivers\dxgmms1.sys
    \SystemRoot\system32\DRIVERS\HECIx64.sys
    \SystemRoot\system32\drivers\usbehci.sys
    \SystemRoot\system32\drivers\USBPORT.SYS
    \SystemRoot\system32\drivers\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\k57nd60a.sys
    \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
    \SystemRoot\system32\drivers\CompositeBus.sys
    \SystemRoot\system32\DRIVERS\AgileVpn.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\rassstp.sys
    \SystemRoot\system32\DRIVERS\kbdclass.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\system32\drivers\swenum.sys
    \SystemRoot\system32\drivers\ks.sys
    \SystemRoot\system32\drivers\umbus.sys
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\drivers\RTKVHD64.sys
    \SystemRoot\system32\drivers\portcls.sys
    \SystemRoot\system32\drivers\drmk.sys
    \SystemRoot\system32\drivers\ksthunk.sys
    \SystemRoot\system32\DRIVERS\IntcDAud.sys
    \SystemRoot\system32\drivers\mfeavfk.sys
    \SystemRoot\system32\drivers\mfefirek.sys
    \SystemRoot\system32\DRIVERS\mfencbdc.sys
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\drivers\Dxapi.sys
    \SystemRoot\system32\DRIVERS\usbccgp.sys
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\system32\drivers\usbscan.sys
    \SystemRoot\system32\DRIVERS\usbprint.sys
    \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    \SystemRoot\system32\DRIVERS\monitor.sys
    \SystemRoot\system32\drivers\hidusb.sys
    \SystemRoot\system32\drivers\HIDCLASS.SYS
    \SystemRoot\system32\drivers\HIDPARSE.SYS
    \SystemRoot\system32\DRIVERS\LEqdUsb.Sys
    \SystemRoot\system32\DRIVERS\kbdhid.sys
    \SystemRoot\system32\DRIVERS\mouhid.sys
    \SystemRoot\system32\DRIVERS\LHidEqd.Sys
    \SystemRoot\system32\DRIVERS\LHidFilt.Sys
    \SystemRoot\system32\DRIVERS\LMouFilt.Sys
    \SystemRoot\System32\TSDDD.dll
    \SystemRoot\System32\Drivers\crashdmp.sys
    \SystemRoot\System32\Drivers\dump_dumpata.sys
    \SystemRoot\System32\Drivers\dump_atapi.sys
    \SystemRoot\System32\Drivers\dump_dumpfve.sys
    \SystemRoot\System32\cdd.dll
    \SystemRoot\system32\drivers\luafv.sys
    \SystemRoot\system32\DRIVERS\Sftvollh.sys
    \SystemRoot\system32\DRIVERS\lltdio.sys
    \SystemRoot\system32\DRIVERS\rspndr.sys
    \SystemRoot\system32\drivers\HTTP.sys
    \SystemRoot\system32\DRIVERS\bowser.sys
    \SystemRoot\System32\drivers\mpsdrv.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\system32\DRIVERS\mrxsmb10.sys
    \SystemRoot\system32\DRIVERS\mrxsmb20.sys
    \SystemRoot\system32\drivers\peauth.sys
    \SystemRoot\System32\Drivers\secdrv.SYS
    \SystemRoot\system32\DRIVERS\Sftfslh.sys
    \SystemRoot\system32\DRIVERS\Sftplaylh.sys
    \SystemRoot\System32\DRIVERS\srvnet.sys
    \SystemRoot\System32\drivers\tcpipreg.sys
    \SystemRoot\system32\drivers\mfeapfk.sys
    \SystemRoot\System32\DRIVERS\srv2.sys
    \SystemRoot\System32\DRIVERS\srv.sys
    \SystemRoot\system32\DRIVERS\Sftredirlh.sys
    \SystemRoot\system32\drivers\WudfPf.sys
    \SystemRoot\system32\DRIVERS\WUDFRd.sys
    \SystemRoot\system32\drivers\cfwids.sys
    \SystemRoot\System32\Drivers\fastfat.SYS
    \??\C:\Windows\system32\drivers\mbamchameleon.sys
    \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
    \Windows\System32\ntdll.dll
    \Windows\System32\smss.exe
    \Windows\System32\apisetschema.dll
    \Windows\System32\autochk.exe
    \Windows\System32\gdi32.dll
    \Windows\System32\ole32.dll
    \Windows\System32\oleaut32.dll
    \Windows\System32\sechost.dll
    \Windows\System32\usp10.dll
    \Windows\System32\comdlg32.dll
    \Windows\System32\psapi.dll
    \Windows\System32\clbcatq.dll
    \Windows\System32\user32.dll
    \Windows\System32\msvcrt.dll
    \Windows\System32\msctf.dll
    \Windows\System32\nsi.dll
    \Windows\System32\lpk.dll
    \Windows\System32\ws2_32.dll
    \Windows\System32\iertutil.dll
    \Windows\System32\imagehlp.dll
    \Windows\System32\rpcrt4.dll
    \Windows\System32\wininet.dll
    \Windows\System32\advapi32.dll
    \Windows\System32\kernel32.dll
    \Windows\System32\urlmon.dll
    \Windows\System32\difxapi.dll
    \Windows\System32\Wldap32.dll
    \Windows\System32\imm32.dll
    \Windows\System32\normaliz.dll
    \Windows\System32\shlwapi.dll
    \Windows\System32\setupapi.dll
    \Windows\System32\shell32.dll
    \Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
    \Windows\System32\userenv.dll
    \Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
    \Windows\System32\wintrust.dll
    \Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
    \Windows\System32\crypt32.dll
    \Windows\System32\comctl32.dll
    \Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
    \Windows\System32\KernelBase.dll
    \Windows\System32\cfgmgr32.dll
    \Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
    \Windows\System32\devobj.dll
    \Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
    \Windows\System32\profapi.dll
    \Windows\System32\msasn1.dll
    \Windows\SysWOW64\normaliz.dll
    ----------- End -----------
    Done!
    <<<1>>>
    Upper Device Name: \Device\Harddisk5\DR5
    Upper Device Object: 0xfffffa8006fd7060
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\0000007f\
    Lower Device Object: 0xfffffa8006fd3060
    Lower Device Driver Name: \Driver\USBSTOR\
    <<<1>>>
    Upper Device Name: \Device\Harddisk4\DR4
    Upper Device Object: 0xfffffa8006fdc060
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\0000007e\
    Lower Device Object: 0xfffffa8006fd5b60
    Lower Device Driver Name: \Driver\USBSTOR\
    <<<1>>>
    Upper Device Name: \Device\Harddisk3\DR3
    Upper Device Object: 0xfffffa8006fd8060
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\0000007d\
    Lower Device Object: 0xfffffa8006fda830
    Lower Device Driver Name: \Driver\USBSTOR\
    <<<1>>>
    Upper Device Name: \Device\Harddisk2\DR2
    Upper Device Object: 0xfffffa8006fed060
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\0000007c\
    Lower Device Object: 0xfffffa8006fd1b60
    Lower Device Driver Name: \Driver\USBSTOR\
    <<<1>>>
    Upper Device Name: \Device\Harddisk1\DR1
    Upper Device Object: 0xfffffa8007f95060
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\00000076\
    Lower Device Object: 0xfffffa8006dc3060
    Lower Device Driver Name: \Driver\USBSTOR\
    <<<1>>>
    Upper Device Name: \Device\Harddisk0\DR0
    Upper Device Object: 0xfffffa8006460060
    Upper Device Driver Name: \Driver\Disk\
    Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
    Lower Device Object: 0xfffffa80061c5060
    Lower Device Driver Name: \Driver\atapi\
    <<<2>>>
    Physical Sector Size: 512
    Drive: 0, DevicePointer: 0xfffffa8006460060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa8006460b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa8006460060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    DevicePointer: 0xfffffa80053b5d10, DeviceName: Unknown, DriverName: \Driver\ACPI\
    DevicePointer: 0xfffffa80061c5060, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    Upper DeviceData: 0x0, 0x0, 0x0
    Lower DeviceData: 0x0, 0x0, 0x0
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    <<<2>>>
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
    Done!
    Drive 0
    This is a System drive
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: EC0328C2
    Partition information:
    Partition 0 type is Other (0xde)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 63 Numsec = 80262
    Partition 1 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 81920 Numsec = 26865664
    Partition file system is NTFS
    Partition is bootable
    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 26947584 Numsec = 1926574080
    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0
    Disk Size: 1000204886016 bytes
    Sector size: 512 bytes
    Scanning physical sectors of unpartitioned space on drive 0 (1-62-1953505168-1953525168)...
    Done!
    Physical Sector Size: 0
    Drive: 1, DevicePointer: 0xfffffa8007f95060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa8007f95b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa8007f95060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
    DevicePointer: 0xfffffa8006dc3060, DeviceName: \Device\00000076\, DriverName: \Driver\USBSTOR\
    ------------ End ----------
    Physical Sector Size: 0
    Drive: 2, DevicePointer: 0xfffffa8006fed060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa8006fedb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa8006fed060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
    DevicePointer: 0xfffffa8006fd1b60, DeviceName: \Device\0000007c\, DriverName: \Driver\USBSTOR\
    ------------ End ----------
    Physical Sector Size: 0
    Drive: 3, DevicePointer: 0xfffffa8006fd8060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa8006fd8b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa8006fd8060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
    DevicePointer: 0xfffffa8006fda830, DeviceName: \Device\0000007d\, DriverName: \Driver\USBSTOR\
    ------------ End ----------
    Physical Sector Size: 0
    Drive: 4, DevicePointer: 0xfffffa8006fdc060, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa8006fdcb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa8006fdc060, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\
    DevicePointer: 0xfffffa8006fd5b60, DeviceName: \Device\0000007e\, DriverName: \Driver\USBSTOR\
    ------------ End ----------
    Physical Sector Size: 0
    Drive: 5, DevicePointer: 0xfffffa8006fd7060, DeviceName: \Device\Harddisk5\DR5\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa8006fd7b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa8006fd7060, DeviceName: \Device\Harddisk5\DR5\, DriverName: \Driver\Disk\
    DevicePointer: 0xfffffa8006fd3060, DeviceName: \Device\0000007f\, DriverName: \Driver\USBSTOR\
    ------------ End ----------
    Scan finished
    =======================================

    Removal queue found; removal started
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-1-81920-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
    Removal finished
     
  4. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  5. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    Below is the combofix report log:

    ComboFix 14-10-29.01 - Deb 11/02/2014 17:25:50.3.4 - x64
    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.5943.3889 [GMT -6:00]
    Running from: c:\users\Deb\Desktop\ComboFix.exe
    AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
    FW: McAfee Firewall *Disabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
    SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2014-10-02 to 2014-11-02 )))))))))))))))))))))))))))))))
    .
    .
    2014-11-02 16:20 . 2014-11-02 16:54 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
    2014-11-02 15:27 . 2014-11-02 15:27 34808 ----a-w- c:\windows\system32\drivers\TrueSight.sys
    2014-11-02 15:27 . 2014-11-02 15:27 -------- d-----w- c:\programdata\RogueKiller
    2014-11-01 20:40 . 2014-11-02 16:20 128728 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2014-11-01 20:40 . 2014-11-02 16:19 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2014-11-01 20:40 . 2014-10-01 16:11 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
    2014-11-01 20:40 . 2014-11-01 20:40 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
    2014-11-01 20:40 . 2014-11-01 20:40 -------- d-----w- c:\programdata\Malwarebytes
    2014-11-01 20:40 . 2014-10-01 16:11 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
    2014-11-01 15:54 . 2014-11-01 15:54 -------- d-----w- c:\users\Deb\AppData\Local\Logishrd
    2014-11-01 15:49 . 2014-11-01 15:49 -------- d-----w- c:\program files\Logitech
    2014-11-01 14:50 . 2014-11-01 14:50 -------- d-----w- c:\program files (x86)\Common Files\Java
    2014-11-01 14:50 . 2014-11-01 14:50 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
    2014-11-01 06:15 . 2014-10-10 02:05 276480 ----a-w- c:\windows\system32\generaltel.dll
    2014-11-01 06:14 . 2014-09-18 02:00 3241472 ----a-w- c:\windows\system32\msi.dll
    2014-11-01 06:14 . 2014-09-18 01:32 2363904 ----a-w- c:\windows\SysWow64\msi.dll
    2014-10-31 00:13 . 2014-10-31 05:13 -------- d-----w- C:\a718302
    2014-10-22 22:04 . 2014-10-29 22:05 -------- d--h--w- c:\programdata\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
    2014-10-16 11:24 . 2014-09-19 00:36 60416 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2014-11-01 15:50 . 2011-07-30 14:49 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
    2014-11-01 08:00 . 2011-01-04 05:04 103265616 ----a-w- c:\windows\system32\MRT.exe
    2014-09-25 02:08 . 2014-10-01 05:50 371712 ----a-w- c:\windows\system32\qdvd.dll
    2014-09-25 01:40 . 2014-10-01 05:50 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
    2014-09-25 00:21 . 2013-08-22 16:41 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-09-25 00:21 . 2013-08-22 16:41 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2014-09-09 22:11 . 2014-09-24 06:52 2048 ----a-w- c:\windows\system32\tzres.dll
    2014-09-09 21:47 . 2014-09-24 06:52 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2014-08-27 23:59 . 2012-07-20 14:54 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2014-08-23 02:07 . 2014-08-28 00:05 404480 ----a-w- c:\windows\system32\gdi32.dll
    2014-08-23 01:45 . 2014-08-28 00:05 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
    2014-08-20 13:07 . 2014-08-20 13:07 11336 ----a-w- c:\windows\system32\drivers\mfeclnrk.sys
    2014-08-20 13:06 . 2014-08-20 13:06 96592 ----a-w- c:\windows\system32\drivers\mfencrk.sys
    2014-08-20 13:05 . 2014-08-20 13:05 445512 ----a-w- c:\windows\system32\drivers\mfencbdc.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2013-06-09 5622512]
    "ISUSPM"="c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "ShwiconXP9106"="c:\program files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe" [2010-01-27 237568]
    "mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2014-04-25 537992]
    "Dell DataSafe Online"="c:\program files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe" [2010-08-26 1117528]
    "CanonSolutionMenuEx"="c:\program files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE" [2011-03-28 1611160]
    "Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2010-07-05 333088]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
    "mcpltui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2014-04-25 537992]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-02-21 152392]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-10-07 507776]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
    "Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe" [2010-07-21 165184]
    .
    c:\users\deb old\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]
    .
    c:\users\Deb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]
    .
    c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe /firstrun [2010-5-28 1324384]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc]
    @=""
    .
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
    R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS;c:\windows\SYSNATIVE\drivers\BVRPMPR5a64.SYS [x]
    R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
    R3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys;c:\windows\SYSNATIVE\drivers\HipShieldK.sys [x]
    R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
    R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
    R3 mfencrk;McAfee Inc. mfencrk;c:\windows\system32\DRIVERS\mfencrk.sys;c:\windows\SYSNATIVE\DRIVERS\mfencrk.sys [x]
    R3 MHIKEY10;MHIKEY10;c:\windows\system32\Drivers\MHIKEY10x64.sys;c:\windows\SYSNATIVE\Drivers\MHIKEY10x64.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
    R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
    R4 McOobeSv;McAfee OOBE Service;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe;c:\program files\Common Files\mcafee\McSvcHost\McSvHost.exe [x]
    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
    S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys;c:\windows\SYSNATIVE\drivers\mfewfpk.sys [x]
    S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
    S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x]
    S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
    S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe;c:\program files\Dell\DellDock\DockLogin.exe [x]
    S2 HomeNetSvc;McAfee Home Network;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [x]
    S2 McAPExe;McAfee AP Service;c:\program files\McAfee\MSC\McAPExe.exe;c:\program files\McAfee\MSC\McAPExe.exe [x]
    S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [x]
    S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [x]
    S2 mcpltsvc;McAfee Platform Services;c:\program files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe;c:\program files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [x]
    S2 mfecore;McAfee Anti-Malware Core;c:\program files\Common Files\McAfee\AMCore\mcshield.exe;c:\program files\Common Files\McAfee\AMCore\mcshield.exe [x]
    S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
    S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [x]
    S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]
    S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
    S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]
    S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys;c:\windows\SYSNATIVE\drivers\cfwids.sys [x]
    S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
    S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
    S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
    S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
    S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
    S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys;c:\windows\SYSNATIVE\drivers\mfefirek.sys [x]
    S3 mfencbdc;McAfee Inc. mfencbdc;c:\windows\system32\DRIVERS\mfencbdc.sys;c:\windows\SYSNATIVE\DRIVERS\mfencbdc.sys [x]
    S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms;c:\program files\dell support center\pcdsrvc_x64.pkms [x]
    S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
    S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
    S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
    S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
    S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2014-11-02 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-22 00:21]
    .
    2014-11-01 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
    - c:\program files\Dell Support Center\uaclauncher.exe [2010-08-05 23:47]
    .
    2014-11-02 c:\windows\Tasks\SystemToolsDailyTest.job
    - c:\program files\Dell Support Center\pcdrcui.exe [2010-08-05 23:47]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-02-09 10060832]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-12 162328]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-12 386584]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-12 417304]
    "Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-04 1580368]
    "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2011-03-15 2779024]
    "Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2011-08-05 163552]
    "EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2014-05-19 3100440]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = hxxp://localhost;*.local
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
    Trusted Zone: safeguardinspectionservices.com\www
    TCP: DhcpNameServer = 192.168.1.1
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
    .
    .
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0]
    "ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker6"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.15"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker6"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
    "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
    00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
    @Denied: (A) (Everyone)
    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
    @Denied: (A) (Everyone)
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
    "Key"="ActionsPane3"
    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2014-11-02 17:35:26
    ComboFix-quarantined-files.txt 2014-11-02 23:35
    .
    Pre-Run: 857,025,388,544 bytes free
    Post-Run: 856,768,618,496 bytes free
    .
    - - End Of File - - 1C7699CCB543FEE305C802E7005E236F
    CDB4DE4BBD714F152979DA2DCBEF57EB
     
  6. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Looks good.

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.
    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.
    [​IMG] Please download Farbar Recovery Scan Tool and save it to your Desktop.

    Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please copy and paste it to your reply.
     
  7. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    Below are the reports you requested, looks like I'm limited in space so will break them up into a few replies:

    # AdwCleaner v3.311 - Report created 02/11/2014 at 23:47:34
    # Updated 30/09/2014 by Xplode
    # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
    # Username : Deb - DEB-PC
    # Running from : C:\Users\Deb\Desktop\adwcleaner_3.311.exe
    # Option : Clean
    ***** [ Services ] *****

    ***** [ Files / Folders ] *****

    ***** [ Scheduled Tasks ] *****

    ***** [ Shortcuts ] *****

    ***** [ Registry ] *****
    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
    Key Deleted : HKCU\Software\YahooPartnerToolbar
    ***** [ Browsers ] *****
    -\\ Internet Explorer v11.0.9600.17344

    *************************
    AdwCleaner[R0].txt - [1118 octets] - [02/11/2014 23:46:05]
    AdwCleaner[S0].txt - [882 octets] - [02/11/2014 23:47:34]
    ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [941 octets] ##########

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.3.5 (10.31.2014:1)
    OS: Windows 7 Home Premium x64
    Ran by Deb on Sun 11/02/2014 at 23:56:53.32
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    ~~~ Services
    ~~~ Registry Values
    ~~~ Registry Keys
    ~~~ Files
    ~~~ Folders
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{05827365-E3C6-4279-ADB6-7096BE098A26}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{064617A6-247E-439F-95F5-9280E5853B53}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{0C04A354-B425-4C0C-B8AD-91F37FF60D3B}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{0E7FAB21-77B8-41AC-A2DD-196156F1CAB4}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{126CA9B1-2F06-428D-8FD9-CA1E595BC72E}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{15015F55-705F-4F5D-A421-9A08AEFD9122}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{175406B0-166A-4551-AC42-D2833BDEFA8B}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{26B5E99C-33C5-48EB-8963-BCA41DA457EF}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{290D21DA-D18C-4007-A494-0A4A57162537}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{4C9A49A2-18D4-4DAA-A32B-10BD0CEBE9CC}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{52028113-C175-4D06-BA80-4660972E75A6}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{756D83BB-7A12-4348-9505-515763BE52AF}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{8442F467-E390-4149-93E2-FFFE4D614927}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{926DC0DE-39CF-4355-BF8A-52990F8F26FD}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{987EC206-0D4C-482A-83A5-7CC27046978F}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{9E0BD222-1D71-4118-A2FC-FD7353CA0E43}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{C0817EEE-AA5A-4C97-961A-EA300635B7CF}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{C822D6E0-EFD1-4AF4-B827-2E576A6CB597}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{D09BA9F6-D812-430F-AD62-EEBCCAAE3CB9}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{D0FB24D7-898F-458D-9A57-8EAECF11B0B7}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{DD4947B6-C623-4DD0-A65F-7974FCF0D867}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{F48BE459-DD89-4913-B904-655DB1057B81}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{F490CD1E-A72A-4D0D-9D9B-103E1314CA3F}
    Successfully deleted: [Empty Folder] C:\Users\Deb\appdata\local\{F9F39F5A-CA58-461F-A217-DB11FAE60ECD}
    ~~~ Event Viewer Logs were cleared
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Sun 11/02/2014 at 23:59:01.61
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
  8. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-11-2014
    Ran by Deb (administrator) on DEB-PC on 03-11-2014 00:02:53
    Running from C:\Users\Deb\Desktop
    Loaded Profile: Deb (Available profiles: Deb & deb old)
    Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
    Internet Explorer Version 11
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
    ==================== Processes (Whitelisted) =================
    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
    (Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
    (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe
    (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfevtps.exe
    (Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
    (SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (Canon Inc.) C:\Program Files (x86)\Canon\CAL\CALMAIN.exe
    (McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
    (McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
    (McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
    (McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
    (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
    () C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
    (Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe
    (Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
    (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
    (Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
    (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
    (Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe
    (Alcor Micro Corp.) C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe
    (CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
    (McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McUICnt.exe
    (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Microsoft Corporation) C:\Windows\splwow64.exe
    (Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
    (McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\Core\mchost.exe
    (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

    ==================== Registry (Whitelisted) ==================
    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
    HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10060832 2010-02-08] (Realtek Semiconductor)
    HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
    HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
    HKLM\...\Run: [Zune Launcher] => C:\Program Files\Zune\ZuneLauncher.exe [163552 2011-08-05] (Microsoft Corporation)
    HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3100440 2014-05-19] (Logitech, Inc.)
    HKLM-x32\...\Run: [ShwiconXP9106] => C:\Program Files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe [237568 2010-01-27] (Alcor Micro Corp.)
    HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
    HKLM-x32\...\Run: [Dell DataSafe Online] => C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-25] (Dell, Inc.)
    HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1611160 2011-03-28] (CANON INC.)
    HKLM-x32\...\Run: [Nuance PDF Reader-reminder] => C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [333088 2010-07-05] (Nuance Communications, Inc.)
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [537992 2014-04-25] (McAfee, Inc.)
    HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
    HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
    HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
    HKLM-x32\...\RunOnce: [Launcher] => C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe [165184 2010-07-21] (Softthinks)
    Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\615\G2AWinLogon_x64.dll (Citrix Online, a division of Citrix Systems, Inc.)
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
    HKU\S-1-5-21-2814169364-3148947929-1862132710-1000\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [5622512 2013-06-09] (SUPERAntiSpyware.com)
    HKU\S-1-5-21-2814169364-3148947929-1862132710-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
    Startup: C:\Users\Deb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
    ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\deb old\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
    ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    ==================== Internet (Whitelisted) ====================
    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
    HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    HKU\S-1-5-21-2814169364-3148947929-1862132710-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
    BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
    BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
    BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
    BHO-x32: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
    BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
    DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} http://kitchenplanner.ikea.com/US/Core/Player/2020PlayerAX_IKEA_Win32.cab
    DPF: HKLM-x32 {1C11B948-582A-433F-A98D-A8C4D5CC64F2} http://kitchenplanner.ikea.com/US/Core/Player/2020PlayerAX_Win32.cab
    DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
    DPF: HKLM-x32 {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} http://www.superadblocker.com/activex/sabspx.cab
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
    Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
    Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    FireFox:
    ========
    FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
    FF Plugin: @microsoft.com/GENUINE -> disabled No File
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1203133.dll (Adobe Systems, Inc.)
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
    FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin-x32: @logitech.com/HarmonyRemote,version=1.0.0 -> C:\Program Files (x86)\Logitech\Harmony Remote Driver\NprtHarmonyPlugin.dll (Logitech Inc.)
    FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
    FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
    FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF Plugin-x32: ZEON/PDF,version=2.0 -> C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
    FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
    FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014-11-01]
    Chrome:
    =======
    CHR HKLM-x32\...\Chrome\Extension: [omaonpoimgkmbllpdihbnmgphjoipdhf] - C:\Program Files (x86)\Logitech\Harmony Remote Driver\harmony_chrome.crx [2013-01-20]
    ==================== Services (Whitelisted) =================
    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
    R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2011-08-11] (SUPERAntiSpyware.com) [File not signed]
    R2 CCALib8; C:\Program Files (x86)\Canon\CAL\CALMAIN.exe [96341 2006-03-30] (Canon Inc.) [File not signed]
    R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2009-06-09] (Stardock Corporation) [File not signed]
    R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
    R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178528 2014-04-25] (McAfee, Inc.)
    R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
    R2 McNaiAnn; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
    S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [603424 2014-09-04] (McAfee, Inc.)
    S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
    R2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
    R2 McProxy; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
    R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1041192 2014-08-20] (McAfee, Inc.)
    R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-06-20] (McAfee, Inc.)
    R2 mfevtp; C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe [189912 2014-06-20] (McAfee, Inc.)
    ==================== Drivers (Whitelisted) ====================
    (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
    U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)
    R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72128 2014-06-20] (McAfee, Inc.)
    S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
    R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181704 2014-06-20] (McAfee, Inc.)
    R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313544 2014-06-20] (McAfee, Inc.)
    R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [523792 2014-06-20] (McAfee, Inc.)
    R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786296 2014-06-20] (McAfee, Inc.)
    R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [445512 2014-08-20] (McAfee, Inc.)
    S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [96592 2014-08-20] (McAfee, Inc.)
    R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348552 2014-06-20] (McAfee, Inc.)
    S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10x64.sys [60288 2010-09-15] (Generic USB smartcard reader)
    R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
    U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [34808 2014-11-02] ()
    S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0; \??\c:\program files\dell support center\pcdsrvc_x64.pkms [X]
    ==================== NetSvcs (Whitelisted) ===================
    (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

    ==================== One Month Created Files and Folders ========
    (If an entry is included in the fixlist, the file\folder will be moved.)
    2014-11-03 00:02 - 2014-11-03 00:03 - 00018127 _____ () C:\Users\Deb\Desktop\FRST.txt
    2014-11-03 00:02 - 2014-11-03 00:02 - 00000000 ____D () C:\FRST
    2014-11-03 00:01 - 2014-11-03 00:01 - 02114560 _____ (Farbar) C:\Users\Deb\Desktop\FRST64.exe
    2014-11-03 00:01 - 2014-11-03 00:01 - 01106432 _____ (Farbar) C:\Users\Deb\Desktop\FRST.exe
    2014-11-02 23:59 - 2014-11-02 23:59 - 00003129 _____ () C:\Users\Deb\Desktop\JRT.txt
    2014-11-02 23:59 - 2014-11-02 23:59 - 00003129 _____ () C:\Users\Deb\Desktop\JRT 11-2-14.txt
    2014-11-02 23:56 - 2014-11-02 23:56 - 00000000 ____D () C:\Windows\ERUNT
    2014-11-02 23:54 - 2014-11-02 23:54 - 01706359 _____ (Thisisu) C:\Users\Deb\Desktop\JRT.exe
    2014-11-02 23:54 - 2014-11-02 23:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
    2014-11-02 23:50 - 2014-11-02 23:50 - 00001020 _____ () C:\Users\Deb\Desktop\AdwCleaner[S0] 11-2-14.txt
    2014-11-02 23:45 - 2014-11-02 23:47 - 00000000 ____D () C:\AdwCleaner
    2014-11-02 23:44 - 2014-11-02 23:44 - 01375089 _____ () C:\Users\Deb\Desktop\adwcleaner_3.311.exe
    2014-11-02 17:44 - 2014-11-02 17:44 - 00021247 _____ () C:\Users\Deb\Desktop\Combofix report 11-2-14.txt
    2014-11-02 17:35 - 2014-11-02 17:35 - 00021247 _____ () C:\ComboFix.txt
    2014-11-02 17:23 - 2014-11-02 17:35 - 00000000 ____D () C:\Qoobox
    2014-11-02 17:23 - 2014-11-02 17:35 - 00000000 ____D () C:\ComboFix
    2014-11-02 17:23 - 2011-06-26 00:45 - 00256000 _____ () C:\Windows\PEV.exe
    2014-11-02 17:23 - 2010-11-07 11:20 - 00208896 _____ () C:\Windows\MBR.exe
    2014-11-02 17:23 - 2009-04-19 22:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
    2014-11-02 17:23 - 2000-08-30 18:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
    2014-11-02 17:23 - 2000-08-30 18:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
    2014-11-02 17:23 - 2000-08-30 18:00 - 00098816 _____ () C:\Windows\sed.exe
    2014-11-02 17:23 - 2000-08-30 18:00 - 00080412 _____ () C:\Windows\grep.exe
    2014-11-02 17:23 - 2000-08-30 18:00 - 00068096 _____ () C:\Windows\zip.exe
    2014-11-02 17:20 - 2014-11-02 17:20 - 05591672 ____R (Swearware) C:\Users\Deb\Desktop\ComboFix.exe
    2014-11-02 10:20 - 2014-11-02 10:54 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2014-11-02 10:19 - 2014-11-02 10:54 - 00000000 ____D () C:\Users\Deb\Desktop\mbar
    2014-11-02 10:18 - 2014-11-02 10:18 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Deb\Desktop\mbar-1.07.0.1012.exe
    2014-11-02 10:09 - 2014-11-02 10:04 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Deb\Downloads\mbar-1_07_0_1012_exe
    2014-11-02 09:33 - 2014-11-02 09:33 - 00005260 _____ () C:\Users\Deb\Desktop\RKreport_DEL_11022014_093306.log
    2014-11-02 09:27 - 2014-11-02 09:27 - 00034808 _____ () C:\Windows\system32\Drivers\TrueSight.sys
    2014-11-02 09:27 - 2014-11-02 09:27 - 00000000 ____D () C:\ProgramData\RogueKiller
    2014-11-02 09:26 - 2014-11-02 09:26 - 14670424 _____ () C:\Users\Deb\Desktop\RogueKiller.exe
    2014-11-01 15:09 - 2014-11-01 15:09 - 00022304 _____ () C:\Users\Deb\Desktop\dds.txt
    2014-11-01 15:09 - 2014-11-01 15:09 - 00012031 _____ () C:\Users\Deb\Desktop\attach.txt
    2014-11-01 15:02 - 2014-11-01 15:02 - 00001075 _____ () C:\Users\Deb\Desktop\Malwarebytes scan 11-1-14.txt
    2014-11-01 14:40 - 2014-11-02 10:20 - 00128728 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
    2014-11-01 14:40 - 2014-11-02 10:19 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
    2014-11-01 14:40 - 2014-11-01 14:40 - 00001068 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    2014-11-01 14:40 - 2014-11-01 14:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    2014-11-01 14:40 - 2014-11-01 14:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
    2014-11-01 14:40 - 2014-11-01 14:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
    2014-11-01 14:40 - 2014-10-01 10:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
    2014-11-01 14:40 - 2014-10-01 10:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
    2014-11-01 14:24 - 2014-11-01 14:25 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Deb\Desktop\mbam-setup-2.0.3.1025.exe
    2014-11-01 09:54 - 2014-11-01 09:54 - 00000000 ____D () C:\Users\Deb\AppData\Local\Logishrd
    2014-11-01 09:49 - 2014-11-01 09:49 - 00000000 ____D () C:\Program Files\Logitech
    2014-11-01 08:57 - 2014-11-01 08:57 - 00448512 _____ (OldTimer Tools) C:\Users\Deb\Downloads\TFC.exe
    2014-11-01 08:57 - 2014-11-01 08:57 - 00448512 _____ (OldTimer Tools) C:\Users\Deb\Desktop\TFC.exe
    2014-11-01 08:50 - 2014-11-01 08:50 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
    2014-11-01 08:50 - 2014-11-01 08:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
    2014-11-01 00:16 - 2014-09-28 18:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2014-11-01 00:16 - 2014-07-08 20:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
    2014-11-01 00:16 - 2014-07-08 20:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
    2014-11-01 00:16 - 2014-07-08 20:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
    2014-11-01 00:16 - 2014-07-08 20:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
    2014-11-01 00:16 - 2014-07-08 20:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
    2014-11-01 00:16 - 2014-07-08 19:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
    2014-11-01 00:16 - 2014-07-08 19:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
    2014-11-01 00:16 - 2014-07-08 19:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
    2014-11-01 00:16 - 2014-07-08 19:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
    2014-11-01 00:16 - 2014-07-08 19:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
    2014-11-01 00:16 - 2014-07-08 16:38 - 00419992 _____ () C:\Windows\system32\locale.nls
    2014-11-01 00:16 - 2014-07-08 16:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
    2014-11-01 00:16 - 2014-06-18 16:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
    2014-11-01 00:16 - 2014-06-18 16:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
    2014-11-01 00:16 - 2014-06-18 16:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
    2014-11-01 00:16 - 2014-06-18 16:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
    2014-11-01 00:16 - 2014-06-18 16:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
    2014-11-01 00:16 - 2014-06-18 16:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
    2014-11-01 00:15 - 2014-10-09 20:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
    2014-11-01 00:15 - 2014-10-09 20:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
    2014-11-01 00:15 - 2014-10-09 20:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
    2014-11-01 00:15 - 2014-10-06 20:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2014-11-01 00:15 - 2014-10-06 20:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2014-11-01 00:15 - 2014-09-25 16:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2014-11-01 00:15 - 2014-09-25 16:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2014-11-01 00:15 - 2014-09-25 16:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2014-11-01 00:15 - 2014-09-25 16:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2014-11-01 00:15 - 2014-09-25 16:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2014-11-01 00:15 - 2014-09-25 16:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2014-11-01 00:15 - 2014-09-25 16:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2014-11-01 00:15 - 2014-09-18 20:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2014-11-01 00:15 - 2014-09-18 19:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2014-11-01 00:15 - 2014-09-18 19:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2014-11-01 00:15 - 2014-09-18 19:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2014-11-01 00:15 - 2014-09-18 19:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2014-11-01 00:15 - 2014-09-18 19:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2014-11-01 00:15 - 2014-09-18 19:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2014-11-01 00:15 - 2014-09-18 19:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2014-11-01 00:15 - 2014-09-18 19:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2014-11-01 00:15 - 2014-09-18 19:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2014-11-01 00:15 - 2014-09-18 19:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2014-11-01 00:15 - 2014-09-18 19:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2014-11-01 00:15 - 2014-09-18 19:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2014-11-01 00:15 - 2014-09-18 19:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2014-11-01 00:15 - 2014-09-18 19:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2014-11-01 00:15 - 2014-09-18 19:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2014-11-01 00:15 - 2014-09-18 19:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2014-11-01 00:15 - 2014-09-18 19:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2014-11-01 00:15 - 2014-09-18 19:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2014-11-01 00:15 - 2014-09-18 19:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2014-11-01 00:15 - 2014-09-18 19:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2014-11-01 00:15 - 2014-09-18 19:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2014-11-01 00:15 - 2014-09-18 19:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2014-11-01 00:15 - 2014-09-18 19:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2014-11-01 00:15 - 2014-09-18 19:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2014-11-01 00:15 - 2014-09-18 19:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2014-11-01 00:15 - 2014-09-18 18:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2014-11-01 00:15 - 2014-09-18 18:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2014-11-01 00:15 - 2014-09-18 18:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2014-11-01 00:15 - 2014-09-18 18:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2014-11-01 00:15 - 2014-09-18 18:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2014-11-01 00:15 - 2014-09-18 18:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2014-11-01 00:15 - 2014-09-18 18:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2014-11-01 00:15 - 2014-09-18 18:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2014-11-01 00:15 - 2014-09-18 18:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2014-11-01 00:15 - 2014-09-18 18:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2014-11-01 00:15 - 2014-09-18 18:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2014-11-01 00:15 - 2014-09-18 18:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2014-11-01 00:15 - 2014-09-18 18:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2014-11-01 00:15 - 2014-09-18 18:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2014-11-01 00:15 - 2014-09-18 18:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2014-11-01 00:15 - 2014-09-18 18:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2014-11-01 00:15 - 2014-09-18 17:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2014-11-01 00:15 - 2014-09-18 17:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2014-11-01 00:15 - 2014-09-18 17:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2014-11-01 00:15 - 2014-09-18 17:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2014-11-01 00:14 - 2014-09-17 20:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
    2014-11-01 00:14 - 2014-09-17 19:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
    2014-11-01 00:13 - 2014-09-12 19:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
    2014-11-01 00:13 - 2014-09-12 19:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
    2014-11-01 00:13 - 2014-09-03 23:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
    2014-11-01 00:13 - 2014-09-03 23:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
    2014-11-01 00:13 - 2014-07-16 20:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
    2014-11-01 00:13 - 2014-07-16 20:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
    2014-11-01 00:13 - 2014-07-16 20:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
    2014-11-01 00:13 - 2014-07-16 20:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
    2014-11-01 00:13 - 2014-07-16 20:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
    2014-11-01 00:13 - 2014-07-16 20:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
    2014-11-01 00:13 - 2014-07-16 20:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
    2014-11-01 00:13 - 2014-07-16 20:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
    2014-11-01 00:13 - 2014-07-16 19:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
    2014-11-01 00:13 - 2014-07-16 19:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
    2014-11-01 00:13 - 2014-07-16 19:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
    2014-11-01 00:13 - 2014-07-16 19:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
    2014-11-01 00:13 - 2014-07-16 19:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
    2014-11-01 00:13 - 2014-07-16 19:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
    2014-11-01 00:13 - 2014-07-16 19:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
    2014-11-01 00:13 - 2014-07-16 19:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
    2014-10-30 18:26 - 2014-10-30 18:26 - 00008562 _____ () C:\Users\Deb\AppData\Local\DECRYPT_INSTRUCTION.HTML
    2014-10-30 18:26 - 2014-10-30 18:26 - 00004224 _____ () C:\Users\Deb\AppData\Local\DECRYPT_INSTRUCTION.TXT
    2014-10-30 18:26 - 2014-10-30 18:26 - 00000276 _____ () C:\Users\Deb\AppData\Local\INSTALL_TOR.URL
    2014-10-30 18:16 - 2014-10-30 18:16 - 00008562 _____ () C:\ProgramData\DECRYPT_INSTRUCTION.HTML
    2014-10-30 18:16 - 2014-10-30 18:16 - 00004224 _____ () C:\ProgramData\DECRYPT_INSTRUCTION.TXT
    2014-10-30 18:16 - 2014-10-30 18:16 - 00000276 _____ () C:\ProgramData\INSTALL_TOR.URL
    2014-10-30 18:14 - 2014-10-31 22:55 - 00000160 ____H () C:\ProgramData\@system3.att
    2014-10-30 18:13 - 2014-10-31 22:54 - 00000424 _____ () C:\ProgramData\@system.temp
    2014-10-30 18:13 - 2014-10-30 23:13 - 00000000 ____D () C:\a718302
    2014-10-30 18:13 - 2014-10-30 18:13 - 00000448 ____H () C:\Users\Deb\AppData\Roaming\麽鎒駓覜
    2014-10-22 16:06 - 2014-10-31 23:55 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage
    2014-10-22 16:04 - 2014-10-29 16:05 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
    2014-10-16 05:24 - 2014-09-18 18:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    ==================== One Month Modified Files and Folders =======
    (If an entry is included in the fixlist, the file\folder will be moved.)
    2014-11-02 23:56 - 2009-07-13 22:45 - 00022464 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2014-11-02 23:56 - 2009-07-13 22:45 - 00022464 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2014-11-02 23:53 - 2009-07-13 23:13 - 00817272 _____ () C:\Windows\system32\PerfStringBackup.INI
    2014-11-02 23:52 - 2009-07-13 23:10 - 01641806 _____ () C:\Windows\WindowsUpdate.log
    2014-11-02 23:49 - 2010-12-19 16:06 - 00000000 ____D () C:\Users\Deb\AppData\Local\SoftThinks
    2014-11-02 23:48 - 2010-12-08 11:36 - 00373978 _____ () C:\Windows\PFRO.log
    2014-11-02 23:48 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2014-11-02 23:48 - 2009-07-13 22:51 - 00083374 _____ () C:\Windows\setupact.log
    2014-11-02 23:24 - 2014-09-07 13:36 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2014-11-02 17:33 - 2009-07-13 20:34 - 00000215 _____ () C:\Windows\system.ini
    2014-11-02 15:01 - 2010-12-19 16:09 - 00000422 _____ () C:\Windows\Tasks\SystemToolsDailyTest.job
    2014-11-02 15:00 - 2010-12-24 15:00 - 00003488 _____ () C:\Windows\System32\Tasks\PCDEventLauncher
    2014-11-02 15:00 - 2010-12-19 16:09 - 00003436 _____ () C:\Windows\System32\Tasks\SystemToolsDailyTest
    2014-11-02 11:20 - 2010-12-08 09:49 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup
    2014-11-01 17:03 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache
    2014-11-01 09:54 - 2011-07-30 08:49 - 00022909 _____ () C:\Windows\LDPINST.LOG
    2014-11-01 09:54 - 2011-07-30 08:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Logitech
    2014-11-01 09:54 - 2011-07-30 08:48 - 00000000 ____D () C:\Program Files\Common Files\Logishrd
    2014-11-01 09:53 - 2011-07-30 08:49 - 00002682 _____ () C:\Windows\LkmdfCoInst.log
    2014-11-01 09:50 - 2011-07-30 08:49 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys
    2014-11-01 09:50 - 2011-07-30 08:49 - 00000000 ____D () C:\ProgramData\Logishrd
    2014-11-01 08:50 - 2013-12-23 17:52 - 00000000 ____D () C:\ProgramData\Oracle
    2014-11-01 08:50 - 2010-12-08 09:42 - 00000000 ____D () C:\Program Files (x86)\Java
    2014-11-01 02:26 - 2009-07-13 22:45 - 00408848 _____ () C:\Windows\system32\FNTCACHE.DAT
    2014-11-01 02:24 - 2014-05-06 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel
    2014-11-01 02:08 - 2010-12-28 11:43 - 00000000 ____D () C:\ProgramData\Microsoft Help
    2014-11-01 02:04 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT
    2014-11-01 02:00 - 2011-01-03 23:04 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2014-11-01 00:14 - 2010-12-08 09:51 - 00000000 ____D () C:\Program Files\Common Files\mcafee
    2014-11-01 00:00 - 2010-12-19 16:06 - 00000000 ____D () C:\Users\Deb
    2014-10-31 23:59 - 2012-05-30 21:49 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
    2014-10-31 23:59 - 2010-12-26 09:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft Application Virtualization Client
    2014-10-31 23:59 - 2010-12-19 16:09 - 00000564 _____ () C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
    2014-10-31 23:56 - 2014-01-26 15:16 - 00000000 ____D () C:\Program Files\Bonjour
    2014-10-31 23:56 - 2013-03-31 08:53 - 00000000 ____D () C:\Program Files\Zune
    2014-10-31 23:56 - 2010-12-19 17:03 - 00000000 ____D () C:\Users\deb old
    2014-10-31 23:56 - 2010-12-08 09:43 - 00000000 ____D () C:\Program Files (x86)\Multimedia Card Reader(9106)
    2014-10-31 23:56 - 2009-07-13 23:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
    2014-10-31 23:56 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\AppCompat
    2014-10-31 23:56 - 2009-07-13 21:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
    2014-10-31 23:55 - 2014-03-07 08:35 - 00000000 ____D () C:\Program Files (x86)\iTunes
    2014-10-31 23:55 - 2002-11-10 08:00 - 00000000 ____D () C:\I386
    2014-10-31 23:46 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\registration
    2014-10-31 23:42 - 2012-02-04 13:26 - 00000000 ____D () C:\Users\Deb\AppData\Roaming\Canon
    2014-10-31 23:42 - 2010-12-23 21:58 - 00000000 ____D () C:\Users\Deb\AppData\Roaming\Adobe
    2014-10-31 23:40 - 2010-12-26 10:09 - 00000000 ___HD () C:\ProgramData\CanonBJ
    2014-10-31 23:40 - 2010-12-23 22:48 - 00000000 ____D () C:\Users\Deb\AppData\Local\Microsoft Games
    2014-10-31 23:40 - 2010-12-08 10:00 - 00000000 ____D () C:\ProgramData\Dell
    2014-10-31 23:39 - 2010-12-26 10:05 - 00000000 ___RD () C:\MSOCache
    2014-10-30 18:16 - 2012-04-28 22:01 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
    2014-10-30 18:16 - 2010-12-19 17:31 - 00000000 ____D () C:\Users\Deb\AppData\Local\Apple Computer
    2014-10-30 18:15 - 2012-10-22 13:52 - 00000000 ____D () C:\ProgramData\ScanSoft
    2014-10-30 18:15 - 2010-12-08 09:51 - 00000000 ____D () C:\ProgramData\Sonic
    2014-10-30 17:06 - 2009-07-13 23:37 - 00000000 ____D () C:\Windows\SysWOW64\sysprep
    2014-10-05 21:00 - 2010-12-19 16:09 - 00004254 _____ () C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask
    Some content of TEMP:
    ====================
    C:\Users\Deb\AppData\Local\Temp\Quarantine.exe

    ==================== Bamital & volsnap Check =================
    (There is no automatic fix for files that do not pass verification.)
    C:\Windows\System32\winlogon.exe => File is digitally signed
    C:\Windows\System32\wininit.exe => File is digitally signed
    C:\Windows\SysWOW64\wininit.exe => File is digitally signed
    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\SysWOW64\explorer.exe => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\SysWOW64\svchost.exe => File is digitally signed
    C:\Windows\System32\services.exe => File is digitally signed
    C:\Windows\System32\User32.dll => File is digitally signed
    C:\Windows\SysWOW64\User32.dll => File is digitally signed
    C:\Windows\System32\userinit.exe => File is digitally signed
    C:\Windows\SysWOW64\userinit.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed
    C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

    LastRegBack: 2014-10-29 17:19
    ==================== End Of Log ============================
     
  9. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-11-2014
    Ran by Deb at 2014-11-03 00:04:37
    Running from C:\Users\Deb\Desktop
    Boot Mode: Normal
    ==========================================================

    ==================== Security Center ========================
    (If an entry is included in the fixlist, it will be removed.)
    AV: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {ADA629C7-7F48-5689-624A-3B76997E0892}
    AS: McAfee Anti-Virus and Anti-Spyware (Enabled - Up to date) {16C7C823-5972-5907-58FA-0004E2F9422F}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    FW: McAfee Firewall (Enabled) {959DA8E2-3527-57D1-4915-924367AD4FE9}
    ==================== Installed Programs ======================
    (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
    Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
    Adobe Reader XI (11.0.05) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.05 - Adobe Systems Incorporated)
    Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.3.133 - Adobe Systems, Inc.)
    Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
    Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
    Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
    Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
    Canon Camera Access Library (HKLM-x32\...\CAL) (Version: 8.2.0.1 - )
    Canon Camera Window DC_DV 6 for ZoomBrowser EX (HKLM-x32\...\CameraWindowDVC6) (Version: 6.3.0.11 - )
    Canon Camera Window MC 6 for ZoomBrowser EX (HKLM-x32\...\CameraWindowMC) (Version: 6.2.0.11 - )
    Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version: - )
    Canon G.726 WMP-Decoder (HKLM-x32\...\Canon G.726 WMP-Decoder) (Version: 1.0.1.3 - )
    Canon MG5300 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5300_series) (Version: - )
    Canon MG5300 series On-screen Manual (HKLM-x32\...\Canon MG5300 series On-screen Manual) (Version: - )
    Canon MG5300 series User Registration (HKLM-x32\...\Canon MG5300 series User Registration) (Version: - )
    Canon MovieEdit Task for ZoomBrowser EX (HKLM-x32\...\MovieEditTask) (Version: 2.3.0.19 - )
    Canon MP Navigator EX 5.0 (HKLM-x32\...\MP Navigator EX 5.0) (Version: - )
    Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
    Canon RAW Image Task for ZoomBrowser EX (HKLM-x32\...\RAW Image Task) (Version: 2.4.0.7 - )
    Canon RemoteCapture Task for ZoomBrowser EX (HKLM-x32\...\RemoteCaptureTask) (Version: 1.6.0.9 - )
    Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - )
    Canon Utilities EOS Utility (HKLM-x32\...\EOS Utility) (Version: 1.0.4.18 - )
    Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.18.42 - )
    Canon Utilities ZoomBrowser EX (HKLM-x32\...\ZoomBrowser EX) (Version: 5.7.0.74 - )
    Consumer In-Home Service Agreement (HKLM-x32\...\{F47C37A4-7189-430A-B81D-739FF8A7A554}) (Version: 2.0.0 - Dell Inc.)
    D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
    Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: - Dell)
    Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.48 - Dell)
    Dell DataSafe Online (HKLM-x32\...\{7EC66A95-AC2D-4127-940B-0445A526AB2F}) (Version: 2.1.19634 - Dell)
    Dell Dock (HKLM-x32\...\Dell Dock) (Version: 2.0 - Stardock Corporation)
    Dell Dock (Version: 2.0 - Stardock Corporation) Hidden
    Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
    Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
    Dell Support Center (HKLM\...\Dell Support Center) (Version: 3.0.5621.01 - Dell Inc.)
    Dell Support Center (Version: 3.0.5621.01 - PC-Doctor, Inc.) Hidden
    eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
    ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
    GoToAssist Corporate (HKLM-x32\...\GoToAssist) (Version: 9.1.0.615 - Citrix Online, a division of Citrix Systems, Inc.)
    Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2104 - Intel Corporation)
    Internet Explorer (x32 Version: 8 - Microsoft Corporation) Hidden
    IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.28 - Irfan Skiljan)
    iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
    Java 7 Update 9 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217009FF}) (Version: 7.0.90 - Oracle)
    Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
    Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Logitech Harmony Remote Software (x86) (HKLM-x32\...\{634F79E1-2A41-4C40-9E8D-89EC740AC9D6}) (Version: 2.0 - Logitech)
    Logitech Harmony Remote Software 7 (HKLM-x32\...\{5C6F884D-680C-448B-B4C9-22296EE1B206}) (Version: 7.7.0.0 - Logitech)
    Logitech SetPoint 6.65 (HKLM\...\sp6) (Version: 6.65.62 - Logitech)
    Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
    McAfee SecurityCenter (HKLM-x32\...\MSC) (Version: 12.8.992 - McAfee, Inc.)
    Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
    Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
    Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
    Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
    Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
    Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
    Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
    Multimedia Card Reader (HKLM-x32\...\InstallShield_{23B4636C-A780-4FEB-B4C9-A2564E9B9F7C}) (Version: 1.6.915.87 - Fitipower)
    Multimedia Card Reader (x32 Version: 1.6.915.87 - Fitipower) Hidden
    Nuance PDF Reader (HKLM-x32\...\{5F6C549F-78DA-4E0E-AE70-0BD981936D99}) (Version: 7.00.0000 - Nuance Communications, Inc.)
    QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
    Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6043 - Realtek Semiconductor Corp.)
    Remote Control USB Driver (HKLM-x32\...\{8471021C-F529-43DE-84DF-3612E10F58C4}) (Version: 2.3.2.317 - )
    Roxio Burn (HKLM-x32\...\{B2E47DE7-800B-40BB-BD1F-9F221C3AEE87}) (Version: 1.01 - Roxio)
    Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
    Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
    Skype Toolbars (HKLM-x32\...\{981029E0-7FC9-4CF3-AB39-6F133621921A}) (Version: 1.0.4051 - Skype Technologies S.A.)
    Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
    SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
    SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.0.1150 - SUPERAntiSpyware.com)
    swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
    Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
    WildTangent Games (HKLM-x32\...\WildTangent dell Master Uninstall) (Version: 1.0.0.71 - WildTangent)
    WildTangent Games App (Dell Games) (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-dell) (Version: 4.0.4.12 - WildTangent)
    WildTangent Games App (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-wildgames) (Version: 4.0.4.12 - WildTangent)
    Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
    Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
    Zune (HKLM\...\Zune) (Version: 04.08.2345.00 - Microsoft Corporation)
    ==================== Custom CLSID (selected items): ==========================
    (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

    ==================== Restore Points =========================
    01-11-2014 05:00:02 Scheduled Checkpoint
    01-11-2014 05:35:36 Restore Operation
    01-11-2014 08:00:17 Windows Update
    01-11-2014 14:38:58 Removed Java 7 Update 45
    01-11-2014 14:39:59 Removed Java 7 Update 45
    02-11-2014 15:36:38 virus cleaning 11-2-14
    ==================== Hosts content: ==========================
    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)
    2009-07-13 20:34 - 2012-10-21 11:12 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
    127.0.0.1 localhost
    ==================== Scheduled Tasks (whitelisted) =============
    (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
    Task: {25E4CA31-09BB-42E1-806A-7BEE4ABE148C} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
    Task: {4DD5292F-A7A1-4C7E-B4F8-DFCDE6E081AF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)
    Task: {639450DF-0196-4578-B262-9ED0BE727AA3} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell Support Center\uaclauncher.exe [2010-08-05] (PC-Doctor, Inc.)
    Task: {6850FD00-33EA-4F37-8B45-738ECD4511BF} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
    Task: {8AA378B5-D0B1-4A48-A041-6244B5C552F8} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\Dell Support Center\pcdrcui.exe [2010-08-05] (PC-Doctor, Inc.)
    Task: {E53B4232-B68F-47B9-8626-CB4887BCCE0A} - System32\Tasks\PCDEventLauncher => C:\Program Files\Dell Support Center\sessionchecker.exe [2010-08-05] ()
    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\Dell Support Center\uaclauncher.exe
    Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\Dell Support Center\pcdrcui.exe
    ==================== Loaded Modules (whitelisted) =============
    2010-12-08 09:49 - 2010-07-21 10:36 - 00783680 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe
    2014-11-01 02:32 - 2014-11-01 02:32 - 00472576 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_64\VistaBridgeLibrary\602ab9ddf3440af31bb4c168b59f2ba5\VistaBridgeLibrary.ni.dll
    2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
    2014-01-20 13:16 - 2014-01-20 13:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
    2010-12-08 09:49 - 2010-07-21 10:33 - 00058688 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\STCoreXml.dll
    2010-12-08 09:49 - 2010-07-21 10:33 - 00116032 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\PSTVdsDisk.dll
    2010-12-08 09:49 - 2010-07-21 10:33 - 00128320 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll
    2010-12-08 09:49 - 2010-07-21 10:33 - 01123648 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\LibXml2.dll
    2010-12-08 09:49 - 2010-07-21 10:34 - 00079168 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll
    2010-12-08 09:49 - 2010-07-21 10:33 - 00234816 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll
    2010-12-08 09:49 - 2010-07-21 10:34 - 00075072 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll
    2010-12-08 09:49 - 2010-07-21 10:33 - 00111936 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll
    2010-12-08 09:49 - 2010-07-21 10:33 - 00121152 _____ () C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll
    ==================== Alternate Data Streams (whitelisted) =========
    (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
    AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
    AlternateDataStreams: C:\Users\deb old\Documents\Sales Order# 97397_W PLEASE CONFIRM YOUR ORDER WITH THE SPA DEPOT tiffe.eml:OECustomProperty
    ==================== Safe Mode (whitelisted) ===================
    (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
    ==================== EXE Association (whitelisted) =============
    (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

    ==================== MSCONFIG/TASK MANAGER disabled items =========
    (Currently there is no automatic fix for this section.)
    MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    MSCONFIG\startupreg: Desktop Disc Tool => "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
    MSCONFIG\startupreg: Jasc => rundll32.exe C:\Users\Deb\AppData\Local\Jasc\nhxvobcb.dll,m4OutVideoInit
    MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
    ========================= Accounts: ==========================
    Administrator (S-1-5-21-2814169364-3148947929-1862132710-500 - Administrator - Disabled)
    Deb (S-1-5-21-2814169364-3148947929-1862132710-1000 - Administrator - Enabled) => C:\Users\Deb
    deb old (S-1-5-21-2814169364-3148947929-1862132710-1001 - Administrator - Enabled) => C:\Users\deb old
    Guest (S-1-5-21-2814169364-3148947929-1862132710-501 - Limited - Disabled)
    ==================== Faulty Device Manager Devices =============

    ==================== Event log errors: =========================
    Application errors:
    ==================
    System errors:
    =============
    Microsoft Office Sessions:
    =========================
    CodeIntegrity Errors:
    ===================================
    Date: 2013-02-08 19:23:57.743
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\mcafee\VSCore\SET5027.tmp because the set of per-page image hashes could not be found on the system.
    Date: 2013-02-08 19:23:57.739
    Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\mcafee\VSCore\SET5027.tmp because the set of per-page image hashes could not be found on the system.
    Date: 2012-10-21 12:12:00.455
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
    Date: 2012-10-21 12:12:00.367
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
    Date: 2012-04-29 13:30:11.923
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
    Date: 2012-04-29 13:30:11.869
    Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

    ==================== Memory info ===========================
    Processor: Intel(R) Core(TM) i3 CPU 550 @ 3.20GHz
    Percentage of memory in use: 38%
    Total physical RAM: 5943.12 MB
    Available physical RAM: 3671.8 MB
    Total Pagefile: 11884.41 MB
    Available Pagefile: 9303.07 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.83 MB
    ==================== Drives ================================
    Drive c: (OS) (Fixed) (Total:918.66 GB) (Free:797.8 GB) NTFS
    ==================== MBR & Partition Table ==================
    ========================================================
    Disk: 0 (Size: 931.5 GB) (Disk ID: EC0328C2)
    Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
    Partition 2: (Active) - (Size=12.8 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=918.7 GB) - (Type=07 NTFS)
    ==================== End Of Log ============================
     
  10. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST(FRST64) and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.
     

    Attached Files:

  11. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    Below is fixlog text:

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-11-2014
    Ran by Deb at 2014-11-03 18:00:20 Run:1
    Running from C:\Users\Deb\Desktop
    Loaded Profile: Deb (Available profiles: Deb & deb old)
    Boot Mode: Normal
    ==============================================
    Content of fixlist:
    *****************
    HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    HKU\S-1-5-21-2814169364-3148947929-1862132710-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
    U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [34808 2014-11-02] ()
    S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0; \??\c:\program files\dell support center\pcdsrvc_x64.pkms [X]
    C:\Users\Deb\AppData\Local\Temp\Quarantine.exe
    AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
    AlternateDataStreams: C:\Users\deb old\Documents\Sales Order# 97397_W PLEASE CONFIRM YOUR ORDER WITH THE SPA DEPOT tiffe.eml:OECustomProperty
    *****************
    "HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
    "HKU\S-1-5-21-2814169364-3148947929-1862132710-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
    "HKCR\PROTOCOLS\Handler\skype-ie-addon-data" => Key deleted successfully.
    "HKCR\CLSID\{91774881-D725-4E58-B298-07617B9B86A8}" => Key not found.
    TrueSight => Service deleted successfully.
    PCDSRVC{1E208CE0-FB7451FF-06020101}_0 => Service stopped successfully.
    PCDSRVC{1E208CE0-FB7451FF-06020101}_0 => Service deleted successfully.
    C:\Users\Deb\AppData\Local\Temp\Quarantine.exe => Moved successfully.
    C:\ProgramData\TEMP => ":5C321E34" ADS removed successfully.
    C:\Users\deb old\Documents\Sales Order# 97397_W PLEASE CONFIRM YOUR ORDER WITH THE SPA DEPOT tiffe.eml => ":OECustomProperty" ADS removed successfully.
    ==== End of Fixlog ====


    I don't really know what I'm looking at, though the mention of Spa Depot above was a way long time ago.

    One thing that happened today is every time I move from one internet page to another, no matter what I'm on a small box pops up saying the following:

    "Security Alert"
    You are about to leave a secure internet connection. It will be possible for others to view information you send. Do you want to continue"

    Then I click yes and when I move from that page the same thing again. It does have a box to check if I don't want to receive this message anymore though I haven't done that yet.
     
  12. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Open Internet Explorer. Click Tools > Internet Options > Advanced > Security.
    Uncheck the "Warn if changing between secure and not secure mode" box.

    How is computer doing?

    Last scans...

    [​IMG] Download Security Check from here or here and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2. SecurityCheck may produce some false warning(s), so leave the results reading to me.
    NOTE 3. If you receive UNSUPPORTED OPERATING SYSTEM! ABORTED! message restart computer and Security Check should run


    [​IMG] Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
      • Windows Defender
      • Other Services
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.

    [​IMG] Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.

    [​IMG] Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Internet Explorer users - Click on this link to open ESET OnlineScan.
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      • Click on ESET Smart Installer to download the ESET Smart Installer. Save it to your desktop.
      • Double click on the [img=[url]http://www.bleepstatic.com/fhost/uploads/0/esetsmartinstaller_enu.png][/url] icon on your desktop.
    • Check "YES, I accept the Terms of Use."
    • Click the Start button.
    • Accept any security warnings from your browser.
    • Check "Enable detection of potentially unwanted applications".
    • Click Advanced settings and make sure all 4 boxes are checkmarked (two of them are already checkmarked by default).
      Do NOT checkmark "Use custom proxy settings"
    • Click the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click List Threats
    • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • Click the Back button.
    • Click the Finish button.
     
  13. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    Below are the reports you requested. One thing that didn't happen as planned. The ESET scan ran for 9 hours and still said only 49% complete so I stopped it and posted the threats it identified in the List Threats. I didn't quaranteen any of them since it wasn't in your instructions so I may need to do this part over again. Otherwise on the positive side my computer is running great.

    Results of screen317's Security Check version 0.99.89
    Windows 7 Service Pack 1 x64 (UAC is enabled)
    Internet Explorer 11
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    McAfee Anti-Virus and Anti-Spyware
    WMI entry may not exist for antivirus; attempting automatic update.
    `````````Anti-malware/Other Utilities Check:`````````
    SpywareBlaster 5.0
    Java 7 Update 9
    Java 8 Update 25
    Java version out of Date!
    Adobe Reader XI
    ````````Process Check: objlist.exe by Laurent````````
    `````````````````System Health check`````````````````

    Total Fragmentation on Drive C: 1%
    ````````````````````End of Log``````````````````````

    Farbar Service Scanner Version: 21-07-2014
    Ran by Deb (administrator) on 03-11-2014 at 20:30:44
    Running from "C:\Users\Deb\Desktop"
    Microsoft Windows 7 Home Premium Service Pack 1 (X64)
    Boot Mode: Normal
    ****************************************************************
    Internet Services:
    ============
    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Yahoo.com is accessible.

    Windows Firewall:
    =============
    Firewall Disabled Policy:
    ==================

    System Restore:
    ============
    System Restore Disabled Policy:
    ========================

    Action Center:
    ============

    Windows Update:
    ============
    Windows Autoupdate Disabled Policy:
    ============================

    Windows Defender:
    ==============
    WinDefend Service is not running. Checking service configuration:
    The start type of WinDefend service is set to Demand. The default start type is Auto.
    The ImagePath of WinDefend service is OK.
    The ServiceDll of WinDefend service is OK.

    Windows Defender Disabled Policy:
    ==========================
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
    "DisableAntiSpyware"=DWORD:1

    Other Services:
    ==============

    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => File is digitally signed
    C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
    C:\Windows\System32\dhcpcore.dll => File is digitally signed
    C:\Windows\System32\drivers\afd.sys => File is digitally signed
    C:\Windows\System32\drivers\tdx.sys => File is digitally signed
    C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
    C:\Windows\System32\dnsrslvr.dll => File is digitally signed
    C:\Windows\System32\mpssvc.dll => File is digitally signed
    C:\Windows\System32\bfe.dll => File is digitally signed
    C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
    C:\Windows\System32\SDRSVC.dll => File is digitally signed
    C:\Windows\System32\vssvc.exe => File is digitally signed
    C:\Windows\System32\wscsvc.dll => File is digitally signed
    C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
    C:\Windows\System32\wuaueng.dll => File is digitally signed
    C:\Windows\System32\qmgr.dll => File is digitally signed
    C:\Windows\System32\es.dll => File is digitally signed
    C:\Windows\System32\cryptsvc.dll => File is digitally signed
    C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
    C:\Windows\System32\ipnathlp.dll => File is digitally signed
    C:\Windows\System32\iphlpsvc.dll => File is digitally signed
    C:\Windows\System32\svchost.exe => File is digitally signed
    C:\Windows\System32\rpcss.dll => File is digitally signed

    **** End of log ****
     
  14. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    This is the start of the ESET scan that identified 1200 threats. I would guess somethings not right.

    C:\Program Files (x86)\Dell DataSafe Local Backup\hstart.exe a variant of Win32/HiddenStart.A potentially unsafe application
    C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A potentially unsafe application
    C:\ProgramData\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\CanonBJ\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\CanonBJ\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\CanonBJ\IJPrinter\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\CanonBJ\IJPrinter\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MG5300 series Printer\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\CanonBJ\IJPrinter\CNMWindows\Canon MG5300 series Printer\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\Dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\Dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\Dell\Dell Datasafe Online\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\Dell\Dell Datasafe Online\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\Logishrd\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\Logishrd\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\Logishrd\Unifying\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\Logishrd\Unifying\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\Logishrd\Updater\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\Logishrd\Updater\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\Microsoft\RAC\PublishedData\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\Microsoft\RAC\PublishedData\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\ScanSoft\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\ScanSoft\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\ScanSoft\PDF Reader 7.0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\ScanSoft\PDF Reader 7.0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\Skype\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\Skype\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\Skype\Plugins\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\Skype\Plugins\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\Skype\Plugins\Plugins\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\Skype\Plugins\Plugins\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\Sonic\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\Sonic\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\SUPERAntiSpyware.com\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\SUPERAntiSpyware.com\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\CanonBJ\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\CanonBJ\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\CanonBJ\IJPrinter\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\CanonBJ\IJPrinter\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\CanonBJ\IJPrinter\CNMWindows\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\CanonBJ\IJPrinter\CNMWindows\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
     
  15. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    r\CNMWindows\Canon MG5300 series Printer\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\CanonBJ\IJPrinter\CNMWindows\Canon MG5300 series Printer\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\Dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\Dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\Dell\Dell Datasafe Online\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\Dell\Dell Datasafe Online\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\Logishrd\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\Logishrd\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\Logishrd\Unifying\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\Logishrd\Unifying\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\Logishrd\Updater\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\Logishrd\Updater\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\Microsoft\RAC\PublishedData\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\Microsoft\RAC\PublishedData\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\ScanSoft\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\ScanSoft\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\ScanSoft\PDF Reader 7.0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\ScanSoft\PDF Reader 7.0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\Skype\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\Skype\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\Skype\Plugins\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\Skype\Plugins\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\Skype\Plugins\Plugins\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\Skype\Plugins\Plugins\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\Sonic\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\Sonic\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\SUPERAntiSpyware.com\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\SUPERAntiSpyware.com\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\All Users\SUPERAntiSpyware.com\SUPERAntiSpyware\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\All Users\SUPERAntiSpyware.com\SUPERAntiSpyware\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Apple Computer\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Apple Computer\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Apple Computer\iTunes\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Apple Computer\iTunes\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Apple Computer\iTunes\iAd\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Apple Computer\iTunes\iAd\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Device Metadata\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Device Metadata\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\eHome\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\eHome\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Internet Explorer\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Internet Explorer\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Media Player\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Media Player\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Media Player\Art Cache\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Media Player\Art Cache\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Messenger\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Messenger\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\OIS\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\OIS\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\OIS\thumbnails\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\OIS\thumbnails\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Photo Acquisition\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Photo Acquisition\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabin.fever11@hotmail.com\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabin.fever11@hotmail.com\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabin.fever11@hotmail.com\15.5\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabin.fever11@hotmail.com\15.5\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabin.fever11@hotmail.com\15.5\DBStore\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabin.fever11@hotmail.com\15.5\DBStore\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabin.fever11@hotmail.com\15.5\DBStore\Backup\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabin.fever11@hotmail.com\15.5\DBStore\Backup\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabin.fever11@hotmail.com\15.5\DBStore\Backup\new\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabin.fever11@hotmail.com\15.5\DBStore\Backup\new\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabinfever30@hotmail.com\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabinfever30@hotmail.com\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabinfever30@hotmail.com\15.5\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabinfever30@hotmail.com\15.5\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabinfever30@hotmail.com\15.5\DBStore\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabinfever30@hotmail.com\15.5\DBStore\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabinfever30@hotmail.com\15.5\DBStore\Backup\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabinfever30@hotmail.com\15.5\DBStore\Backup\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabinfever30@hotmail.com\15.5\DBStore\Backup\new\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live\Contacts\cabinfever30@hotmail.com\15.5\DBStore\Backup\new\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live Mail\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live Mail\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live Mail\Backup\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live Mail\Backup\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live Mail\Backup\new\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live Mail\Backup\new\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live Mail\Sentinel\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Live Mail\Sentinel\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Mail\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Mail\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Mail\Backup\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Mail\Backup\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Mail\Backup\new\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Mail\Backup\new\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Mail\Stationery\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Mail\Stationery\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Media\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Media\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Media\12.0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Media\12.0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Photo Gallery\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Photo Gallery\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Windows Photo Gallery\Original Images\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Zune\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Zune\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Zune\Art Cache\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft\Zune\Art Cache\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft Games\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft Games\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft Games\FreeCell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft Games\FreeCell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft Games\Minesweeper\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft Games\Minesweeper\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft Games\Solitaire\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Local\Microsoft Games\Solitaire\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\10.0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\10.0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\10.0\Search\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\10.0\Search\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\11.0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\11.0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\11.0\Search\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\11.0\Search\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\9.0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\9.0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\9.0\Search\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Adobe\Acrobat\9.0\Search\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\OfficeStarter\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\OfficeStarter\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\OfficeStarter\1\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\OfficeStarter\1\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\OfficeStarter\1\http^3a^2f^2fads1.msads.net^2fads^2f95672\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\OfficeStarter\1\http^3a^2f^2fads1.msads.net^2fads^2f95672\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\OfficeStarter\1\http^3a^2f^2fads1.msn.com^2fads^2f95672\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\OfficeStarter\1\http^3a^2f^2fads1.msn.com^2fads^2f95672\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\3lozfbt13fcuaawha2aegjbiamxdgnwnjythcjhrraqxc0snupaaadaa\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\3lozfbt13fcuaawha2aegjbiamxdgnwnjythcjhrraqxc0snupaaadaa\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\3lozfbt13fcuaawha2aegjbiamxdgnwnjythcjhrraqxc0snupaaadaa\f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\3lozfbt13fcuaawha2aegjbiamxdgnwnjythcjhrraqxc0snupaaadaa\f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\jw40ub2geo4fq1x3fekmyxzwg5fakxc2ko44hrf4fxn2i23zpvaaaefa\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\jw40ub2geo4fq1x3fekmyxzwg5fakxc2ko44hrf4fxn2i23zpvaaaefa\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\jw40ub2geo4fq1x3fekmyxzwg5fakxc2ko44hrf4fxn2i23zpvaaaefa\f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\jw40ub2geo4fq1x3fekmyxzwg5fakxc2ko44hrf4fxn2i23zpvaaaefa\f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\mewroxz4xl15umzbtdmvalbpwtier4az3f4wmnjsoj14fmxfwgaaadea\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\mewroxz4xl15umzbtdmvalbpwtier4az3f4wmnjsoj14fmxfwgaaadea\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\mewroxz4xl15umzbtdmvalbpwtier4az3f4wmnjsoj14fmxfwgaaadea\f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\mewroxz4xl15umzbtdmvalbpwtier4az3f4wmnjsoj14fmxfwgaaadea\f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\psld1rq2evnjg2ki2ziatkouhebg2l4klzm3vvurqxwtu41pinaaahda\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\psld1rq2evnjg2ki2ziatkouhebg2l4klzm3vvurqxwtu41pinaaahda\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\psld1rq2evnjg2ki2ziatkouhebg2l4klzm3vvurqxwtu41pinaaahda\f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\psld1rq2evnjg2ki2ziatkouhebg2l4klzm3vvurqxwtu41pinaaahda\f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\qyzgmprsrfvdi1dud3uhxotpjjuckeishl2ttb4tzqqxe1rezlaaaaha\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\qyzgmprsrfvdi1dud3uhxotpjjuckeishl2ttb4tzqqxe1rezlaaaaha\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\qyzgmprsrfvdi1dud3uhxotpjjuckeishl2ttb4tzqqxe1rezlaaaaha\f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\qyzgmprsrfvdi1dud3uhxotpjjuckeishl2ttb4tzqqxe1rezlaaaaha\f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\v4banymub0jr0lze0uxf3gxhed1itk3pjxbwixc5kpkwfwelkpaaaeea\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\v4banymub0jr0lze0uxf3gxhed1itk3pjxbwixc5kpkwfwelkpaaaeea\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\v4banymub0jr0lze0uxf3gxhed1itk3pjxbwixc5kpkwfwelkpaaaeea\f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\v4banymub0jr0lze0uxf3gxhed1itk3pjxbwixc5kpkwfwelkpaaaeea\f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\zu0c0ebgz5fgdcgr3klcesjjfpoxjyoseh0kyuudrwtgecpi4yaaahga\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\zu0c0ebgz5fgdcgr3klcesjjfpoxjyoseh0kyuudrwtgecpi4yaaahga\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\zu0c0ebgz5fgdcgr3klcesjjfpoxjyoseh0kyuudrwtgecpi4yaaahga\f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Microsoft\Silverlight\is\bdesrvak.d0y\yzerhc5m.z04\1\s\zu0c0ebgz5fgdcgr3klcesjjfpoxjyoseh0kyuudrwtgecpi4yaaahga\f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\11\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\11\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\26\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\26\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\3\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\3\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\32\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\4\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\4\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\42\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\Deployment\SystemCache\6.0\42\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\jre1.6.0_23\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\jre1.6.0_23\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\jre1.6.0_24\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\LocalLow\Sun\Java\jre1.6.0_24\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Adobe\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Adobe\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Adobe\Flash Player\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Adobe\Flash Player\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Adobe\Flash Player\AssetCache\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Adobe\Flash Player\AssetCache\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Adobe\Flash Player\AssetCache\NESDBA7K\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Adobe\Flash Player\AssetCache\NESDBA7K\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Canon\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Canon\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Canon\MP Navigator EX V50\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Canon\MP Navigator EX V50\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Canon\MP Navigator EX V50\index\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Canon\MP Navigator EX V50\index\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Document Building Blocks\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Document Building Blocks\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Document Building Blocks\1033\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Document Building Blocks\1033\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Templates\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Templates\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Templates\LiveContent\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Templates\LiveContent\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Word Document Building Blocks\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Windows Live Photo Gallery\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\Microsoft\Windows Live Photo Gallery\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00106c8f-56bf-4f54-b410-37355de8482e\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00106c8f-56bf-4f54-b410-37355de8482e\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00106c8f-56bf-4f54-b410-37355de8482e\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00106c8f-56bf-4f54-b410-37355de8482e\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\003254a3-5fb0-4f56-93f4-d70fb18c87f5\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\003254a3-5fb0-4f56-93f4-d70fb18c87f5\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\003254a3-5fb0-4f56-93f4-d70fb18c87f5\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\003254a3-5fb0-4f56-93f4-d70fb18c87f5\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\006cff21-6b51-4466-839e-1691e9239bab\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\006cff21-6b51-4466-839e-1691e9239bab\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\006cff21-6b51-4466-839e-1691e9239bab\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\006cff21-6b51-4466-839e-1691e9239bab\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\008b1423-fe4f-4299-a151-56ff01382fff\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\008b1423-fe4f-4299-a151-56ff01382fff\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\008b1423-fe4f-4299-a151-56ff01382fff\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\008b1423-fe4f-4299-a151-56ff01382fff\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\008bb271-6bb5-4e47-a895-b2ab793f25ba\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\008bb271-6bb5-4e47-a895-b2ab793f25ba\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\008bb271-6bb5-4e47-a895-b2ab793f25ba\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\008bb271-6bb5-4e47-a895-b2ab793f25ba\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00a26ee9-03b2-4bdb-957b-9d604525a4af\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00a26ee9-03b2-4bdb-957b-9d604525a4af\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00a26ee9-03b2-4bdb-957b-9d604525a4af\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00a26ee9-03b2-4bdb-957b-9d604525a4af\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00aff554-fa97-47b9-a337-108e523ea861\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00aff554-fa97-47b9-a337-108e523ea861\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00aff554-fa97-47b9-a337-108e523ea861\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00aff554-fa97-47b9-a337-108e523ea861\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00cab306-cd67-41d1-90c4-b851f70ec03e\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00cab306-cd67-41d1-90c4-b851f70ec03e\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00cab306-cd67-41d1-90c4-b851f70ec03e\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00cab306-cd67-41d1-90c4-b851f70ec03e\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00ebfbea-f872-4ab8-8f24-b1f174d79553\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00ebfbea-f872-4ab8-8f24-b1f174d79553\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00ebfbea-f872-4ab8-8f24-b1f174d79553\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\00ebfbea-f872-4ab8-8f24-b1f174d79553\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\012af006-5429-49bc-92e5-0b3315f928c1\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\012af006-5429-49bc-92e5-0b3315f928c1\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\012af006-5429-49bc-92e5-0b3315f928c1\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\012af006-5429-49bc-92e5
     
  16. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    -0b3315f928c1\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\019cf85e-6c01-4f76-b5c5-7297dfff9cbb\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\019cf85e-6c01-4f76-b5c5-7297dfff9cbb\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\019cf85e-6c01-4f76-b5c5-7297dfff9cbb\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\019cf85e-6c01-4f76-b5c5-7297dfff9cbb\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\01da9331-e213-44d9-93fd-18e84671aa0a\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\01da9331-e213-44d9-93fd-18e84671aa0a\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\01da9331-e213-44d9-93fd-18e84671aa0a\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\01da9331-e213-44d9-93fd-18e84671aa0a\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02450d79-4bad-45c9-a9ae-cbae807be2b1\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02450d79-4bad-45c9-a9ae-cbae807be2b1\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02450d79-4bad-45c9-a9ae-cbae807be2b1\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02450d79-4bad-45c9-a9ae-cbae807be2b1\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\027f7d11-18b0-4000-8ec0-7c4b5040dadf\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\027f7d11-18b0-4000-8ec0-7c4b5040dadf\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\027f7d11-18b0-4000-8ec0-7c4b5040dadf\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\027f7d11-18b0-4000-8ec0-7c4b5040dadf\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0293a1fd-d8e5-4c2b-afe9-a807b535e624\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0293a1fd-d8e5-4c2b-afe9-a807b535e624\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0293a1fd-d8e5-4c2b-afe9-a807b535e624\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0293a1fd-d8e5-4c2b-afe9-a807b535e624\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02ad5f24-27a9-468a-8a1c-22e552d5aa64\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02ad5f24-27a9-468a-8a1c-22e552d5aa64\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02ad5f24-27a9-468a-8a1c-22e552d5aa64\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02ad5f24-27a9-468a-8a1c-22e552d5aa64\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02c7aefc-dddb-4f5a-9525-ded95b863403\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02c7aefc-dddb-4f5a-9525-ded95b863403\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02c7aefc-dddb-4f5a-9525-ded95b863403\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02c7aefc-dddb-4f5a-9525-ded95b863403\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02cd1507-2410-43a0-94df-3c7fb7524641\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02cd1507-2410-43a0-94df-3c7fb7524641\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02cd1507-2410-43a0-94df-3c7fb7524641\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02cd1507-2410-43a0-94df-3c7fb7524641\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02de7f79-f5bd-4f4c-8b1b-6cdb937587fd\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02de7f79-f5bd-4f4c-8b1b-6cdb937587fd\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02de7f79-f5bd-4f4c-8b1b-6cdb937587fd\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\02de7f79-f5bd-4f4c-8b1b-6cdb937587fd\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03042c08-fbb9-4c8b-b4ce-653b2f30bb0b\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03042c08-fbb9-4c8b-b4ce-653b2f30bb0b\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03042c08-fbb9-4c8b-b4ce-653b2f30bb0b\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03042c08-fbb9-4c8b-b4ce-653b2f30bb0b\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03104681-f195-46e0-9bab-83027e790aab\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03104681-f195-46e0-9bab-83027e790aab\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03104681-f195-46e0-9bab-83027e790aab\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03104681-f195-46e0-9bab-83027e790aab\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03296743-e1d3-4ec7-9c3a-f5423819fe88\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03296743-e1d3-4ec7-9c3a-f5423819fe88\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03296743-e1d3-4ec7-9c3a-f5423819fe88\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03296743-e1d3-4ec7-9c3a-f5423819fe88\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03675d57-0c58-46b6-8336-73d186e450ba\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03675d57-0c58-46b6-8336-73d186e450ba\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03675d57-0c58-46b6-8336-73d186e450ba\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03675d57-0c58-46b6-8336-73d186e450ba\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\037ad737-336f-4c2a-a5bc-b97b01fd1f27\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\037ad737-336f-4c2a-a5bc-b97b01fd1f27\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\037ad737-336f-4c2a-a5bc-b97b01fd1f27\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\037ad737-336f-4c2a-a5bc-b97b01fd1f27\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03c5ae90-4387-4e5a-812b-390b165f4f45\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03c5ae90-4387-4e5a-812b-390b165f4f45\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03c5ae90-4387-4e5a-812b-390b165f4f45\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03c5ae90-4387-4e5a-812b-390b165f4f45\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03e58fe2-fa76-474f-af77-1f9720276b94\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03e58fe2-fa76-474f-af77-1f9720276b94\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03e58fe2-fa76-474f-af77-1f9720276b94\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03e58fe2-fa76-474f-af77-1f9720276b94\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03e5e5c8-96be-45be-ae95-0e5495f63e97\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03e5e5c8-96be-45be-ae95-0e5495f63e97\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03e5e5c8-96be-45be-ae95-0e5495f63e97\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03e5e5c8-96be-45be-ae95-0e5495f63e97\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03ec0c1f-2bcf-4eae-b7ee-eb03a135f87f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03ec0c1f-2bcf-4eae-b7ee-eb03a135f87f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03ec0c1f-2bcf-4eae-b7ee-eb03a135f87f\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\03ec0c1f-2bcf-4eae-b7ee-eb03a135f87f\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\04bd1496-236b-4850-9b84-eff2ad8c8402\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\04bd1496-236b-4850-9b84-eff2ad8c8402\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\04bd1496-236b-4850-9b84-eff2ad8c8402\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\04bd1496-236b-4850-9b84-eff2ad8c8402\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\050e982f-bc1c-4655-9599-913e9d05dcd8\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\050e982f-bc1c-4655-9599-913e9d05dcd8\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\050e982f-bc1c-4655-9599-913e9d05dcd8\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\050e982f-bc1c-4655-9599-913e9d05dcd8\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05215fbe-ac77-4d92-9850-9c58584611d3\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05215fbe-ac77-4d92-9850-9c58584611d3\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05215fbe-ac77-4d92-9850-9c58584611d3\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05215fbe-ac77-4d92-9850-9c58584611d3\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05982063-17a8-48de-bc67-0ea02b2acb8b\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05982063-17a8-48de-bc67-0ea02b2acb8b\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05982063-17a8-48de-bc67-0ea02b2acb8b\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05982063-17a8-48de-bc67-0ea02b2acb8b\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05a066dc-6c18-4a9d-bded-aba7735b0779\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05a066dc-6c18-4a9d-bded-aba7735b0779\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05a066dc-6c18-4a9d-bded-aba7735b0779\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05a066dc-6c18-4a9d-bded-aba7735b0779\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05ef1419-fa76-400a-b051-f1bfa3b08171\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05ef1419-fa76-400a-b051-f1bfa3b08171\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05ef1419-fa76-400a-b051-f1bfa3b08171\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\05ef1419-fa76-400a-b051-f1bfa3b08171\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\062a7e68-9ea8-41a1-ad29-fe13cf2688d0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\062a7e68-9ea8-41a1-ad29-fe13cf2688d0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\062a7e68-9ea8-41a1-ad29-fe13cf2688d0\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\062a7e68-9ea8-41a1-ad29-fe13cf2688d0\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\063126b3-7dff-46c6-835d-44d632a4ddb9\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\063126b3-7dff-46c6-835d-44d632a4ddb9\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\063126b3-7dff-46c6-835d-44d632a4ddb9\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\063126b3-7dff-46c6-835d-44d632a4ddb9\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\063f5c96-9886-45da-ae32-3352b8b3e910\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\063f5c96-9886-45da-ae32-3352b8b3e910\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\063f5c96-9886-45da-ae32-3352b8b3e910\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\063f5c96-9886-45da-ae32-3352b8b3e910\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0645c7f9-9f9f-4b91-9f0e-fe6620257251\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0645c7f9-9f9f-4b91-9f0e-fe6620257251\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0645c7f9-9f9f-4b91-9f0e-fe6620257251\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0645c7f9-9f9f-4b91-9f0e-fe6620257251\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\06c42ea3-cbd2-4d68-8290-7675ec356211\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\06c42ea3-cbd2-4d68-8290-7675ec356211\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\06c42ea3-cbd2-4d68-8290-7675ec356211\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\06c42ea3-cbd2-4d68-8290-7675ec356211\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\06e94f59-eb01-44e2-8472-d925c958e39f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\06e94f59-eb01-44e2-8472-d925c958e39f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\06e94f59-eb01-44e2-8472-d925c958e39f\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\06e94f59-eb01-44e2-8472-d925c958e39f\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\07189271-6495-4091-86f4-976f282df138\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\07189271-6495-4091-86f4-976f282df138\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\07189271-6495-4091-86f4-976f282df138\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\07189271-6495-4091-86f4-976f282df138\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\078840ed-9094-4055-8a97-ee5b9b78016e\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\078840ed-9094-4055-8a97-ee5b9b78016e\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\078840ed-9094-4055-8a97-ee5b9b78016e\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\078840ed-9094-4055-8a97-ee5b9b78016e\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\078d5b64-6570-4f50-b1d8-12d4dbfe315d\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\078d5b64-6570-4f50-b1d8-12d4dbfe315d\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\078d5b64-6570-4f50-b1d8-12d4dbfe315d\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\078d5b64-6570-4f50-b1d8-12d4dbfe315d\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0790775e-bd21-46f3-9d3f-90fc13b6aeb6\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0790775e-bd21-46f3-9d3f-90fc13b6aeb6\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0790775e-bd21-46f3-9d3f-90fc13b6aeb6\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0790775e-bd21-46f3-9d3f-90fc13b6aeb6\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0798252e-8b9d-4b5d-90bd-038b9d89f1d8\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0798252e-8b9d-4b5d-90bd-038b9d89f1d8\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0798252e-8b9d-4b5d-90bd-038b9d89f1d8\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0798252e-8b9d-4b5d-90bd-038b9d89f1d8\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\07b15b29-c27e-4896-9e2d-04d427af624c\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\07b15b29-c27e-4896-9e2d-04d427af624c\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\07b15b29-c27e-4896-9e2d-04d427af624c\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\07b15b29-c27e-4896-9e2d-04d427af624c\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\07c7b5c0-2db5-40ae-a89f-16c1dbd41907\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\07c7b5c0-2db5-40ae-a89f-16c1dbd41907\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\07c7b5c0-2db5-40ae-a89f-16c1dbd41907\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\07c7b5c0-2db5-40ae-a89f-16c1dbd41907\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\08234a28-165b-42cd-9f2e-567371dd0ed5\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\08234a28-165b-42cd-9f2e-567371dd0ed5\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\08234a28-165b-42cd-9f2e-567371dd0ed5\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\08234a28-165b-42cd-9f2e-567371dd0ed5\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0894555d-6d67-4ea7-8491-cc3768a76813\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0894555d-6d67-4ea7-8491-cc3768a76813\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0894555d-6d67-4ea7-8491-cc3768a76813\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0894555d-6d67-4ea7-8491-cc3768a76813\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\08e3ab40-09d8-41c7-8ac2-a841b550b3a2\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\08e3ab40-09d8-41c7-8ac2-a841b550b3a2\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\08e3ab40-09d8-41c7-8ac2-a841b550b3a2\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\08e3ab40-09d8-41c7-8ac2-a841b550b3a2\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\08f859d3-ba19-4558-b221-b7ec244376bc\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\08f859d3-ba19-4558-b221-b7ec244376bc\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\08f859d3-ba19-4558-b221-b7ec244376bc\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\08f859d3-ba19-4558-b221-b7ec244376bc\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\097e6824-1b89-4ecd-a8cc-25f47b6040f9\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\097e6824-1b89-4ecd-a8cc-25f47b6040f9\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\097e6824-1b89-4ecd-a8cc-25f47b6040f9\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\097e6824-1b89-4ecd-a8cc-25f47b6040f9\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\098638c5-0fff-4142-a6a4-1ed0f921fd95\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\098638c5-0fff-4142-a6a4-1ed0f921fd95\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
     
  17. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    -1ed0f921fd95\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\098638c5-0fff-4142-a6a4-1ed0f921fd95\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\09dab3e9-92b1-498e-a93b-649bfdb875ab\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\09dab3e9-92b1-498e-a93b-649bfdb875ab\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\09dab3e9-92b1-498e-a93b-649bfdb875ab\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\09dab3e9-92b1-498e-a93b-649bfdb875ab\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0a71dd54-3961-4c85-88fe-12af46a64cdb\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0a71dd54-3961-4c85-88fe-12af46a64cdb\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0a71dd54-3961-4c85-88fe-12af46a64cdb\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0a71dd54-3961-4c85-88fe-12af46a64cdb\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0af9bdee-f135-4d60-805c-1de4073f6bd2\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0af9bdee-f135-4d60-805c-1de4073f6bd2\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0af9bdee-f135-4d60-805c-1de4073f6bd2\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0af9bdee-f135-4d60-805c-1de4073f6bd2\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b1e28f8-75de-441b-8f2a-e827e65a3e7e\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b1e28f8-75de-441b-8f2a-e827e65a3e7e\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b1e28f8-75de-441b-8f2a-e827e65a3e7e\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b1e28f8-75de-441b-8f2a-e827e65a3e7e\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b47ccbc-1aa9-4b30-a729-8d1f3ffbd784\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b47ccbc-1aa9-4b30-a729-8d1f3ffbd784\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b47ccbc-1aa9-4b30-a729-8d1f3ffbd784\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b47ccbc-1aa9-4b30-a729-8d1f3ffbd784\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b684ea4-73dc-452d-b71a-22ca28ffbe7c\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b684ea4-73dc-452d-b71a-22ca28ffbe7c\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b684ea4-73dc-452d-b71a-22ca28ffbe7c\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b684ea4-73dc-452d-b71a-22ca28ffbe7c\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b7820f6-f8d6-48b3-bd3c-a6cd5a3d3793\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b7820f6-f8d6-48b3-bd3c-a6cd5a3d3793\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b7820f6-f8d6-48b3-bd3c-a6cd5a3d3793\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0b7820f6-f8d6-48b3-bd3c-a6cd5a3d3793\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0be1145f-244c-40a8-8799-7717f68ce9c7\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0be1145f-244c-40a8-8799-7717f68ce9c7\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0be1145f-244c-40a8-8799-7717f68ce9c7\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0be1145f-244c-40a8-8799-7717f68ce9c7\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c30885a-adcc-40f6-8c6e-2ea900fca802\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c30885a-adcc-40f6-8c6e-2ea900fca802\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c30885a-adcc-40f6-8c6e-2ea900fca802\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c30885a-adcc-40f6-8c6e-2ea900fca802\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c45bafe-6d03-4167-9766-4dabc5e1404e\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c45bafe-6d03-4167-9766-4dabc5e1404e\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c45bafe-6d03-4167-9766-4dabc5e1404e\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c45bafe-6d03-4167-9766-4dabc5e1404e\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c4ca5bb-ce07-451c-8672-ab9ea8fb3160\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c4ca5bb-ce07-451c-8672-ab9ea8fb3160\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c4ca5bb-ce07-451c-8672-ab9ea8fb3160\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c4ca5bb-ce07-451c-8672-ab9ea8fb3160\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c6c3832-241a-45aa-844f-7361f451df91\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c6c3832-241a-45aa-844f-7361f451df91\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c6c3832-241a-45aa-844f-7361f451df91\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0c6c3832-241a-45aa-844f-7361f451df91\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ca243fc-2cfb-45aa-888b-e9c7b0800e83\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ca243fc-2cfb-45aa-888b-e9c7b0800e83\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ca243fc-2cfb-45aa-888b-e9c7b0800e83\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ca243fc-2cfb-45aa-888b-e9c7b0800e83\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0cab864d-e78a-40ae-9bae-479700617f2f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0cab864d-e78a-40ae-9bae-479700617f2f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0cab864d-e78a-40ae-9bae-479700617f2f\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0cab864d-e78a-40ae-9bae-479700617f2f\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ccf1b66-e1d8-4c28-85f0-475d275ee79d\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ccf1b66-e1d8-4c28-85f0-475d275ee79d\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ccf1b66-e1d8-4c28-85f0-475d275ee79d\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ccf1b66-e1d8-4c28-85f0-475d275ee79d\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ce90127-13db-4ff6-9b9d-83fbecaedd9d\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ce90127-13db-4ff6-9b9d-83fbecaedd9d\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ce90127-13db-4ff6-9b9d-83fbecaedd9d\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ce90127-13db-4ff6-9b9d-83fbecaedd9d\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0d2d1cd6-a2c1-4816-8a44-bb77d53c685e\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0d2d1cd6-a2c1-4816-8a44-bb77d53c685e\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0d2d1cd6-a2c1-4816-8a44-bb77d53c685e\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0d2d1cd6-a2c1-4816-8a44-bb77d53c685e\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0d698b04-2a8d-4987-bc7a-6f563b889b3d\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0d698b04-2a8d-4987-bc7a-6f563b889b3d\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0d698b04-2a8d-4987-bc7a-6f563b889b3d\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0d698b04-2a8d-4987-bc7a-6f563b889b3d\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0d8f020d-103e-4e01-855e-5087fb0021dd\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0d8f020d-103e-4e01-855e-5087fb0021dd\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0d8f020d-103e-4e01-855e-5087fb0021dd\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0d8f020d-103e-4e01-855e-5087fb0021dd\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0da05e94-bd7e-459d-9ce3-944ac2f19489\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0da05e94-bd7e-459d-9ce3-944ac2f19489\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0da05e94-bd7e-459d-9ce3-944ac2f19489\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0da05e94-bd7e-459d-9ce3-944ac2f19489\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0db1ff04-0e8a-4333-b8dd-601052aaa2dc\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0db1ff04-0e8a-4333-b8dd-601052aaa2dc\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0db1ff04-0e8a-4333-b8dd-601052aaa2dc\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0db1ff04-0e8a-4333-b8dd-601052aaa2dc\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0dc024f7-5a0f-41ae-91bb-58caf591f78d\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0dc024f7-5a0f-41ae-91bb-58caf591f78d\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0dc024f7-5a0f-41ae-91bb-58caf591f78d\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0dc024f7-5a0f-41ae-91bb-58caf591f78d\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0df6df38-b761-4b3d-849e-5447d626abdc\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0df6df38-b761-4b3d-849e-5447d626abdc\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0df6df38-b761-4b3d-849e-5447d626abdc\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0df6df38-b761-4b3d-849e-5447d626abdc\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0e44adb4-84ca-48f3-a5ab-01a4919ad4dd\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0e44adb4-84ca-48f3-a5ab-01a4919ad4dd\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0e44adb4-84ca-48f3-a5ab-01a4919ad4dd\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0e44adb4-84ca-48f3-a5ab-01a4919ad4dd\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0e5b5c21-06b4-4530-a170-7ea250f9c039\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0e5b5c21-06b4-4530-a170-7ea250f9c039\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0e5b5c21-06b4-4530-a170-7ea250f9c039\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0e5b5c21-06b4-4530-a170-7ea250f9c039\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0e92bfd9-145f-43d2-9bb2-95724ba52698\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0e92bfd9-145f-43d2-9bb2-95724ba52698\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0e92bfd9-145f-43d2-9bb2-95724ba52698\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0e92bfd9-145f-43d2-9bb2-95724ba52698\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ecacd92-7a0f-412c-b4b2-f6c69f37f60c\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ecacd92-7a0f-412c-b4b2-f6c69f37f60c\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ecacd92-7a0f-412c-b4b2-f6c69f37f60c\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0ecacd92-7a0f-412c-b4b2-f6c69f37f60c\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0f068adc-1cdd-40a7-9215-908bb76999fb\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0f068adc-1cdd-40a7-9215-908bb76999fb\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0f068adc-1cdd-40a7-9215-908bb76999fb\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0f068adc-1cdd-40a7-9215-908bb76999fb\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0f9640ed-9996-4422-b2cd-106f2b50a10a\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0f9640ed-9996-4422-b2cd-106f2b50a10a\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0f9640ed-9996-4422-b2cd-106f2b50a10a\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0f9640ed-9996-4422-b2cd-106f2b50a10a\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0f9dcc36-791e-43a0-a414-b8954e616a9a\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0f9dcc36-791e-43a0-a414-b8954e616a9a\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0f9dcc36-791e-43a0-a414-b8954e616a9a\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\0f9dcc36-791e-43a0-a414-b8954e616a9a\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\10066c9c-bbf0-47c5-af48-fd2c3d5d7f56\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\10066c9c-bbf0-47c5-af48-fd2c3d5d7f56\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\10066c9c-bbf0-47c5-af48-fd2c3d5d7f56\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\10066c9c-bbf0-47c5-af48-fd2c3d5d7f56\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1039fb18-41a6-4bf4-bfc5-9cfa2ccb1ed0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1039fb18-41a6-4bf4-bfc5-9cfa2ccb1ed0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1039fb18-41a6-4bf4-bfc5-9cfa2ccb1ed0\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1039fb18-41a6-4bf4-bfc5-9cfa2ccb1ed0\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1054c001-46fe-4238-b87f-f413d9017499\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1054c001-46fe-4238-b87f-f413d9017499\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1054c001-46fe-4238-b87f-f413d9017499\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1054c001-46fe-4238-b87f-f413d9017499\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\10a79c5c-b5d8-4242-9f56-f9071e555608\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\10a79c5c-b5d8-4242-9f56-f9071e555608\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\10a79c5c-b5d8-4242-9f56-f9071e555608\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\10a79c5c-b5d8-4242-9f56-f9071e555608\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\10cb4ef1-c6d2-43d0-b3a0-c2512646ce2b\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\10cb4ef1-c6d2-43d0-b3a0-c2512646ce2b\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\10cb4ef1-c6d2-43d0-b3a0-c2512646ce2b\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\10cb4ef1-c6d2-43d0-b3a0-c2512646ce2b\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\110d0c3e-5a34-4597-8923-ba6ae05e8b9a\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\110d0c3e-5a34-4597-8923-ba6ae05e8b9a\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\110d0c3e-5a34-4597-8923-ba6ae05e8b9a\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\110d0c3e-5a34-4597-8923-ba6ae05e8b9a\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11167d81-cfae-48d1-87b8-b49eb2bb5a9a\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11167d81-cfae-48d1-87b8-b49eb2bb5a9a\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11167d81-cfae-48d1-87b8-b49eb2bb5a9a\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11167d81-cfae-48d1-87b8-b49eb2bb5a9a\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\111f5d77-f31f-4e78-8aee-768fb7919f6d\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\111f5d77-f31f-4e78-8aee-768fb7919f6d\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\111f5d77-f31f-4e78-8aee-768fb7919f6d\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\111f5d77-f31f-4e78-8aee-768fb7919f6d\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11340891-a2ea-4d00-af13-e82b35bdeaa9\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11340891-a2ea-4d00-af13-e82b35bdeaa9\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11340891-a2ea-4d00-af13-e82b35bdeaa9\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11340891-a2ea-4d00-af13-e82b35bdeaa9\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\115651ba-aca4-41e0-9590-81eb3de27bb6\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\115651ba-aca4-41e0-9590-81eb3de27bb6\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\115651ba-aca4-41e0-9590-81eb3de27bb6\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\115651ba-aca4-41e0-9590-81eb3de27bb6\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\116f5003-bd67-4ecb-9ecc-d1fd591c25d3\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\116f5003-bd67-4ecb-9ecc-d1fd591c25d3\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\116f5003-bd67-4ecb-9ecc-d1fd591c25d3\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\116f5003-bd67-4ecb-9ecc-d1fd591c25d3\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\117eb811-9e26-4136-a60b-ad7ed89ed23f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\117eb811-9e26-4136-a60b-ad7ed89ed23f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\117eb811-9e26-4136-a60b-ad7ed89ed23f\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\117eb811-9e26-4136-a60b-ad7ed89ed23f\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\119d9d30-47c0-427c-adca-96ef0c0a8358\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\119d9d30-47c0-427c-adca-96ef0c0a8358\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\119d9d30-47c0-427c-adca-96ef0c0a8358\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\119d9d30-47c0-427c-adca-96ef0c0a8358\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\119e29f0-ba2a-4940-a10e-832bdde80e9c\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\119e29f0-ba2a-4940-a10e-832bdde80e9c\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\119e29f0-ba2a-4940-a10e-832bdde80e9c\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\119e29f0-ba2a-4940-a10e-832bdde80e9c\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
     
  18. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    -2beb660cc25f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11c4d848-5f00-46c1-9582-2beb660cc25f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11c4d848-5f00-46c1-9582-2beb660cc25f\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11c4d848-5f00-46c1-9582-2beb660cc25f\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11dd0a39-3f58-4b85-ad5f-1192623b9269\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11dd0a39-3f58-4b85-ad5f-1192623b9269\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11dd0a39-3f58-4b85-ad5f-1192623b9269\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\11dd0a39-3f58-4b85-ad5f-1192623b9269\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\122f5621-4daa-4355-b747-6ec12aca3ab5\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\122f5621-4daa-4355-b747-6ec12aca3ab5\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\122f5621-4daa-4355-b747-6ec12aca3ab5\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\122f5621-4daa-4355-b747-6ec12aca3ab5\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\12533a63-9fcf-4fb9-b89b-1609c595c7bb\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\12533a63-9fcf-4fb9-b89b-1609c595c7bb\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\12533a63-9fcf-4fb9-b89b-1609c595c7bb\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\12533a63-9fcf-4fb9-b89b-1609c595c7bb\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\127897cf-3f7e-4184-a31b-3df817a91263\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\127897cf-3f7e-4184-a31b-3df817a91263\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\127897cf-3f7e-4184-a31b-3df817a91263\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\127897cf-3f7e-4184-a31b-3df817a91263\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\128ffe26-cd3d-4621-9894-af6f65b8631c\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\128ffe26-cd3d-4621-9894-af6f65b8631c\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\128ffe26-cd3d-4621-9894-af6f65b8631c\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\128ffe26-cd3d-4621-9894-af6f65b8631c\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\12968671-0d8b-403d-9962-b0452e091d5c\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\12968671-0d8b-403d-9962-b0452e091d5c\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\12968671-0d8b-403d-9962-b0452e091d5c\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\12968671-0d8b-403d-9962-b0452e091d5c\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\12d36b8e-d44d-445e-9c64-4d8f0d45b605\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\12d36b8e-d44d-445e-9c64-4d8f0d45b605\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\12d36b8e-d44d-445e-9c64-4d8f0d45b605\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\12d36b8e-d44d-445e-9c64-4d8f0d45b605\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\134b63a8-6a26-4003-9b6a-6f8bf2eb3432\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\134b63a8-6a26-4003-9b6a-6f8bf2eb3432\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\134b63a8-6a26-4003-9b6a-6f8bf2eb3432\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\134b63a8-6a26-4003-9b6a-6f8bf2eb3432\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\134e3799-49a0-446a-a7fc-77fcb548f967\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\134e3799-49a0-446a-a7fc-77fcb548f967\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\134e3799-49a0-446a-a7fc-77fcb548f967\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\134e3799-49a0-446a-a7fc-77fcb548f967\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\139adad8-2194-4a15-ba8f-688a55e5b664\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\139adad8-2194-4a15-ba8f-688a55e5b664\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\139adad8-2194-4a15-ba8f-688a55e5b664\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\139adad8-2194-4a15-ba8f-688a55e5b664\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\13b34d03-fea1-48e2-ae23-0233c76d5b4f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\13b34d03-fea1-48e2-ae23-0233c76d5b4f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\13b34d03-fea1-48e2-ae23-0233c76d5b4f\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\13b34d03-fea1-48e2-ae23-0233c76d5b4f\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\13fbf653-2544-4427-a5b9-09599745430a\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\13fbf653-2544-4427-a5b9-09599745430a\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\13fbf653-2544-4427-a5b9-09599745430a\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\13fbf653-2544-4427-a5b9-09599745430a\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1402d279-c299-492b-8bc3-c0a06208bdfe\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1402d279-c299-492b-8bc3-c0a06208bdfe\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1402d279-c299-492b-8bc3-c0a06208bdfe\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1402d279-c299-492b-8bc3-c0a06208bdfe\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\140a383a-bf1b-40a6-b5b4-a5d39e01f39c\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\140a383a-bf1b-40a6-b5b4-a5d39e01f39c\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\140a383a-bf1b-40a6-b5b4-a5d39e01f39c\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\140a383a-bf1b-40a6-b5b4-a5d39e01f39c\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\142b35f8-cc48-49c9-9b11-e18eef192252\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\142b35f8-cc48-49c9-9b11-e18eef192252\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\142b35f8-cc48-49c9-9b11-e18eef192252\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\142b35f8-cc48-49c9-9b11-e18eef192252\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\145533b7-98eb-4787-81f5-33167f8e74ef\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\145533b7-98eb-4787-81f5-33167f8e74ef\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\145533b7-98eb-4787-81f5-33167f8e74ef\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\145533b7-98eb-4787-81f5-33167f8e74ef\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1471d402-40db-4306-87ab-cc07a2d45c51\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1471d402-40db-4306-87ab-cc07a2d45c51\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1471d402-40db-4306-87ab-cc07a2d45c51\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1471d402-40db-4306-87ab-cc07a2d45c51\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\14f68f22-c286-4420-abab-67f9834cfb6c\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\14f68f22-c286-4420-abab-67f9834cfb6c\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\14f68f22-c286-4420-abab-67f9834cfb6c\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\14f68f22-c286-4420-abab-67f9834cfb6c\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\151a7c66-4458-4210-af7e-cf545c30b505\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\151a7c66-4458-4210-af7e-cf545c30b505\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\151a7c66-4458-4210-af7e-cf545c30b505\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\151a7c66-4458-4210-af7e-cf545c30b505\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15202dd6-c4d3-4ca0-a595-9ddfb9420cd3\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15202dd6-c4d3-4ca0-a595-9ddfb9420cd3\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15202dd6-c4d3-4ca0-a595-9ddfb9420cd3\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15202dd6-c4d3-4ca0-a595-9ddfb9420cd3\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1529af28-3173-455a-a660-709357897ad7\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1529af28-3173-455a-a660-709357897ad7\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1529af28-3173-455a-a660-709357897ad7\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1529af28-3173-455a-a660-709357897ad7\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1534e4b5-637f-4c49-a41a-01b7bd1125af\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1534e4b5-637f-4c49-a41a-01b7bd1125af\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1534e4b5-637f-4c49-a41a-01b7bd1125af\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1534e4b5-637f-4c49-a41a-01b7bd1125af\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\153a4421-4f2c-444a-a77b-21afa65b8054\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\153a4421-4f2c-444a-a77b-21afa65b8054\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\153a4421-4f2c-444a-a77b-21afa65b8054\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\153a4421-4f2c-444a-a77b-21afa65b8054\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15aac99a-4abd-4f6c-9a4e-410e97966939\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15aac99a-4abd-4f6c-9a4e-410e97966939\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15aac99a-4abd-4f6c-9a4e-410e97966939\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15aac99a-4abd-4f6c-9a4e-410e97966939\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15be4849-436b-4e46-bcfc-56b6cffe2b91\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15be4849-436b-4e46-bcfc-56b6cffe2b91\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15be4849-436b-4e46-bcfc-56b6cffe2b91\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15be4849-436b-4e46-bcfc-56b6cffe2b91\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15c7c333-38ce-4ad7-ab3f-e4efeb01be11\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15c7c333-38ce-4ad7-ab3f-e4efeb01be11\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15c7c333-38ce-4ad7-ab3f-e4efeb01be11\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15c7c333-38ce-4ad7-ab3f-e4efeb01be11\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15e087fb-90c2-4dfc-9227-9d620c186ce8\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15e087fb-90c2-4dfc-9227-9d620c186ce8\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15e087fb-90c2-4dfc-9227-9d620c186ce8\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15e087fb-90c2-4dfc-9227-9d620c186ce8\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15e56c1b-55c9-4c06-b5d7-ec724d083b16\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15e56c1b-55c9-4c06-b5d7-ec724d083b16\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15e56c1b-55c9-4c06-b5d7-ec724d083b16\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\15e56c1b-55c9-4c06-b5d7-ec724d083b16\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1605362a-c138-4d50-a8ab-b89a0b57d275\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1605362a-c138-4d50-a8ab-b89a0b57d275\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1605362a-c138-4d50-a8ab-b89a0b57d275\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1605362a-c138-4d50-a8ab-b89a0b57d275\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\16184d91-4b7b-4dd2-a7d3-5c512cba6c8d\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\16184d91-4b7b-4dd2-a7d3-5c512cba6c8d\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\16184d91-4b7b-4dd2-a7d3-5c512cba6c8d\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\16184d91-4b7b-4dd2-a7d3-5c512cba6c8d\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\162599ac-b636-4efd-a788-5476129852f7\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\162599ac-b636-4efd-a788-5476129852f7\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\162599ac-b636-4efd-a788-5476129852f7\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\162599ac-b636-4efd-a788-5476129852f7\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1637dc7f-bb12-483b-94d8-03b9c43eba1a\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1637dc7f-bb12-483b-94d8-03b9c43eba1a\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1637dc7f-bb12-483b-94d8-03b9c43eba1a\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1637dc7f-bb12-483b-94d8-03b9c43eba1a\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1740b577-6bfb-4b38-97e0-b8b4142b4380\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1740b577-6bfb-4b38-97e0-b8b4142b4380\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1740b577-6bfb-4b38-97e0-b8b4142b4380\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1740b577-6bfb-4b38-97e0-b8b4142b4380\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1785c2bb-9b9c-4202-8028-b0520f473a28\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1785c2bb-9b9c-4202-8028-b0520f473a28\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1785c2bb-9b9c-4202-8028-b0520f473a28\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1785c2bb-9b9c-4202-8028-b0520f473a28\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\17b6e151-8632-4055-8f1a-cb4b5f9e05a0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\17b6e151-8632-4055-8f1a-cb4b5f9e05a0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\17b6e151-8632-4055-8f1a-cb4b5f9e05a0\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\17b6e151-8632-4055-8f1a-cb4b5f9e05a0\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\17cc4730-2074-43c9-ad1f-29a2b99ca4ea\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\17cc4730-2074-43c9-ad1f-29a2b99ca4ea\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\17cc4730-2074-43c9-ad1f-29a2b99ca4ea\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\17cc4730-2074-43c9-ad1f-29a2b99ca4ea\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\17ddb8ad-91a8-4b22-8b7a-f93563faaa53\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\17ddb8ad-91a8-4b22-8b7a-f93563faaa53\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\17ddb8ad-91a8-4b22-8b7a-f93563faaa53\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\17ddb8ad-91a8-4b22-8b7a-f93563faaa53\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\184382fa-a272-447c-a64c-4d939e629442\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\184382fa-a272-447c-a64c-4d939e629442\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\184382fa-a272-447c-a64c-4d939e629442\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\184382fa-a272-447c-a64c-4d939e629442\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\18613b4f-d1ba-4aa9-b8f9-5d32057c9c38\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\18613b4f-d1ba-4aa9-b8f9-5d32057c9c38\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\18613b4f-d1ba-4aa9-b8f9-5d32057c9c38\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\18613b4f-d1ba-4aa9-b8f9-5d32057c9c38\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19041f2b-5117-4f95-81d1-267c1b3e1675\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19041f2b-5117-4f95-81d1-267c1b3e1675\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19041f2b-5117-4f95-81d1-267c1b3e1675\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19041f2b-5117-4f95-81d1-267c1b3e1675\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\195e94a6-bbbc-421c-8fb3-3671ae59501a\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\195e94a6-bbbc-421c-8fb3-3671ae59501a\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\195e94a6-bbbc-421c-8fb3-3671ae59501a\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\195e94a6-bbbc-421c-8fb3-3671ae59501a\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
     
  19. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    -70284f81d320\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1989db62-dcef-49d6-bd73-70284f81d320\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1989db62-dcef-49d6-bd73-70284f81d320\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1989db62-dcef-49d6-bd73-70284f81d320\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19db2ca7-0d29-4159-856f-fe2a40f37a62\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19db2ca7-0d29-4159-856f-fe2a40f37a62\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19db2ca7-0d29-4159-856f-fe2a40f37a62\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19db2ca7-0d29-4159-856f-fe2a40f37a62\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19e1b326-8ad3-4d54-8f5e-0f71c544a067\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19e1b326-8ad3-4d54-8f5e-0f71c544a067\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19e1b326-8ad3-4d54-8f5e-0f71c544a067\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19e1b326-8ad3-4d54-8f5e-0f71c544a067\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19effd5e-6d40-411e-ab87-574d1a87bcb7\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19effd5e-6d40-411e-ab87-574d1a87bcb7\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19effd5e-6d40-411e-ab87-574d1a87bcb7\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\19effd5e-6d40-411e-ab87-574d1a87bcb7\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1a15a718-4cd2-4273-9c43-e5b455ec2014\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1a15a718-4cd2-4273-9c43-e5b455ec2014\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1a15a718-4cd2-4273-9c43-e5b455ec2014\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1a15a718-4cd2-4273-9c43-e5b455ec2014\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1b6f1e78-cca3-416f-b8bd-80a70ec61faa\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1b6f1e78-cca3-416f-b8bd-80a70ec61faa\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1b6f1e78-cca3-416f-b8bd-80a70ec61faa\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1b6f1e78-cca3-416f-b8bd-80a70ec61faa\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1ba08125-26a6-4c84-a681-fbf5b3e908c6\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1ba08125-26a6-4c84-a681-fbf5b3e908c6\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1ba08125-26a6-4c84-a681-fbf5b3e908c6\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1ba08125-26a6-4c84-a681-fbf5b3e908c6\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1bcef763-0862-449b-8d0a-06da70387300\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1bcef763-0862-449b-8d0a-06da70387300\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1bcef763-0862-449b-8d0a-06da70387300\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1bcef763-0862-449b-8d0a-06da70387300\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1bcf8570-cf8b-4456-809a-64be50f58149\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1bcf8570-cf8b-4456-809a-64be50f58149\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1bcf8570-cf8b-4456-809a-64be50f58149\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1bcf8570-cf8b-4456-809a-64be50f58149\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1bfca8af-c55c-4e12-be8f-8be68298d768\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1bfca8af-c55c-4e12-be8f-8be68298d768\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1bfca8af-c55c-4e12-be8f-8be68298d768\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1bfca8af-c55c-4e12-be8f-8be68298d768\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c32cab4-5088-43b2-b194-c8a7c9528fc0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c32cab4-5088-43b2-b194-c8a7c9528fc0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c32cab4-5088-43b2-b194-c8a7c9528fc0\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c32cab4-5088-43b2-b194-c8a7c9528fc0\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c480a61-376f-4810-a0f7-7b1906c3022e\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c480a61-376f-4810-a0f7-7b1906c3022e\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c480a61-376f-4810-a0f7-7b1906c3022e\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c480a61-376f-4810-a0f7-7b1906c3022e\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c8c96f7-d2d6-42f6-8df4-52cf3c8503ba\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c8c96f7-d2d6-42f6-8df4-52cf3c8503ba\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c8c96f7-d2d6-42f6-8df4-52cf3c8503ba\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c8c96f7-d2d6-42f6-8df4-52cf3c8503ba\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c92bfde-8dc3-4718-b803-2b7c2cf2d400\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c92bfde-8dc3-4718-b803-2b7c2cf2d400\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c92bfde-8dc3-4718-b803-2b7c2cf2d400\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c92bfde-8dc3-4718-b803-2b7c2cf2d400\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c96ca98-610b-4843-a22a-c28fed162f7f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c96ca98-610b-4843-a22a-c28fed162f7f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c96ca98-610b-4843-a22a-c28fed162f7f\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1c96ca98-610b-4843-a22a-c28fed162f7f\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1cbd87e2-4658-42f9-ac20-f716b645edc2\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1cbd87e2-4658-42f9-ac20-f716b645edc2\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1cbd87e2-4658-42f9-ac20-f716b645edc2\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1cbd87e2-4658-42f9-ac20-f716b645edc2\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1cd3f135-9978-4184-a9f3-9b20f967a4cf\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1cd3f135-9978-4184-a9f3-9b20f967a4cf\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1cd3f135-9978-4184-a9f3-9b20f967a4cf\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1cd3f135-9978-4184-a9f3-9b20f967a4cf\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d128b75-89c5-40e4-bce2-13269e94eba6\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d128b75-89c5-40e4-bce2-13269e94eba6\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d128b75-89c5-40e4-bce2-13269e94eba6\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d128b75-89c5-40e4-bce2-13269e94eba6\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d4191d9-a4f4-4f06-8608-b4c6b97a4e91\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d4191d9-a4f4-4f06-8608-b4c6b97a4e91\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d4191d9-a4f4-4f06-8608-b4c6b97a4e91\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d4191d9-a4f4-4f06-8608-b4c6b97a4e91\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d93f774-cdf1-4d3d-a6d1-a8f1ca093960\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d93f774-cdf1-4d3d-a6d1-a8f1ca093960\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d93f774-cdf1-4d3d-a6d1-a8f1ca093960\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d93f774-cdf1-4d3d-a6d1-a8f1ca093960\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d977531-55c3-4d97-91dc-7bf76a62e566\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d977531-55c3-4d97-91dc-7bf76a62e566\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d977531-55c3-4d97-91dc-7bf76a62e566\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1d977531-55c3-4d97-91dc-7bf76a62e566\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1da4e2b1-ad19-4980-9526-72314cf53988\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1da4e2b1-ad19-4980-9526-72314cf53988\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1da4e2b1-ad19-4980-9526-72314cf53988\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1da4e2b1-ad19-4980-9526-72314cf53988\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1dc9756c-ec43-4a76-acd2-e46637c53e24\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1dc9756c-ec43-4a76-acd2-e46637c53e24\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1dc9756c-ec43-4a76-acd2-e46637c53e24\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1dc9756c-ec43-4a76-acd2-e46637c53e24\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1dcd1819-b824-4d92-9971-cf1c9bad0ecb\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1dcd1819-b824-4d92-9971-cf1c9bad0ecb\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1dcd1819-b824-4d92-9971-cf1c9bad0ecb\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1dcd1819-b824-4d92-9971-cf1c9bad0ecb\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1dfcc7ea-21fd-4c62-9889-947b4b992e9f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1dfcc7ea-21fd-4c62-9889-947b4b992e9f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1dfcc7ea-21fd-4c62-9889-947b4b992e9f\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1dfcc7ea-21fd-4c62-9889-947b4b992e9f\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1e3c3c37-545f-4ff3-b561-198dcb5a84e7\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1e3c3c37-545f-4ff3-b561-198dcb5a84e7\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1e3c3c37-545f-4ff3-b561-198dcb5a84e7\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1e3c3c37-545f-4ff3-b561-198dcb5a84e7\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1e4bd3a6-ff01-4967-8dc2-0bf4d894b76e\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1e4bd3a6-ff01-4967-8dc2-0bf4d894b76e\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1e4bd3a6-ff01-4967-8dc2-0bf4d894b76e\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1e4bd3a6-ff01-4967-8dc2-0bf4d894b76e\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1e4f3f80-ee7d-4eff-8423-9279eae04d0a\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1e4f3f80-ee7d-4eff-8423-9279eae04d0a\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1e4f3f80-ee7d-4eff-8423-9279eae04d0a\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1e4f3f80-ee7d-4eff-8423-9279eae04d0a\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f0a654c-712a-4d31-9240-228cd83732c5\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f0a654c-712a-4d31-9240-228cd83732c5\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f0a654c-712a-4d31-9240-228cd83732c5\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f0a654c-712a-4d31-9240-228cd83732c5\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f0a6bcc-3a48-47e3-9cd1-747370a6e18a\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f0a6bcc-3a48-47e3-9cd1-747370a6e18a\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f0a6bcc-3a48-47e3-9cd1-747370a6e18a\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f0a6bcc-3a48-47e3-9cd1-747370a6e18a\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f11fd22-4cbe-4a5e-81e0-4834427fe7a5\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f11fd22-4cbe-4a5e-81e0-4834427fe7a5\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f11fd22-4cbe-4a5e-81e0-4834427fe7a5\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f11fd22-4cbe-4a5e-81e0-4834427fe7a5\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f28ac63-4937-41b1-bb01-14f6877b0e05\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f28ac63-4937-41b1-bb01-14f6877b0e05\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f28ac63-4937-41b1-bb01-14f6877b0e05\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f28ac63-4937-41b1-bb01-14f6877b0e05\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f60c3d9-3a62-4c7a-955e-11c06c08251c\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f60c3d9-3a62-4c7a-955e-11c06c08251c\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f60c3d9-3a62-4c7a-955e-11c06c08251c\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f60c3d9-3a62-4c7a-955e-11c06c08251c\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f8189f2-0e98-476a-baec-7ffb98377013\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f8189f2-0e98-476a-baec-7ffb98377013\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f8189f2-0e98-476a-baec-7ffb98377013\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1f8189f2-0e98-476a-baec-7ffb98377013\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1fa01f3b-d060-4568-9c6c-6400a0b679f0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1fa01f3b-d060-4568-9c6c-6400a0b679f0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1fa01f3b-d060-4568-9c6c-6400a0b679f0\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1fa01f3b-d060-4568-9c6c-6400a0b679f0\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1fda4a77-0026-42ca-a876-5a67ff515a49\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1fda4a77-0026-42ca-a876-5a67ff515a49\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1fda4a77-0026-42ca-a876-5a67ff515a49\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\1fda4a77-0026-42ca-a876-5a67ff515a49\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\205635ca-6642-4e70-832f-54d24b852402\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\205635ca-6642-4e70-832f-54d24b852402\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\205635ca-6642-4e70-832f-54d24b852402\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\205635ca-6642-4e70-832f-54d24b852402\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\205664e6-92fa-42f0-8926-bd890e48cbbe\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\205664e6-92fa-42f0-8926-bd890e48cbbe\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\205664e6-92fa-42f0-8926-bd890e48cbbe\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\205664e6-92fa-42f0-8926-bd890e48cbbe\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\209e0b13-e522-43ab-9d81-c78e37c16281\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\209e0b13-e522-43ab-9d81-c78e37c16281\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\209e0b13-e522-43ab-9d81-c78e37c16281\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\209e0b13-e522-43ab-9d81-c78e37c16281\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\20a07d3f-b445-4dc0-a2f4-6563c363fa36\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\20a07d3f-b445-4dc0-a2f4-6563c363fa36\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\20a07d3f-b445-4dc0-a2f4-6563c363fa36\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\20a07d3f-b445-4dc0-a2f4-6563c363fa36\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\20b62470-1f64-403d-9e85-5950a280ce24\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\20b62470-1f64-403d-9e85-5950a280ce24\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\20b62470-1f64-403d-9e85-5950a280ce24\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\20b62470-1f64-403d-9e85-5950a280ce24\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\20c3b4ad-9119-4687-bde0-22c3de307a10\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\20c3b4ad-9119-4687-bde0-22c3de307a10\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\20c3b4ad-9119-4687-bde0-22c3de307a10\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\20c3b4ad-9119-4687-bde0-22c3de307a10\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2138e74e-d5ae-488b-bee8-ad796f14ee55\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2138e74e-d5ae-488b-bee8-ad796f14ee55\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
     
  20. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    -ad796f14ee55\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2138e74e-d5ae-488b-bee8-ad796f14ee55\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2249b97b-499d-4795-b5dc-1313e0ee547d\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2249b97b-499d-4795-b5dc-1313e0ee547d\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2249b97b-499d-4795-b5dc-1313e0ee547d\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2249b97b-499d-4795-b5dc-1313e0ee547d\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\228eebf3-b23b-4106-92a2-f493a9393d5b\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\228eebf3-b23b-4106-92a2-f493a9393d5b\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\228eebf3-b23b-4106-92a2-f493a9393d5b\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\228eebf3-b23b-4106-92a2-f493a9393d5b\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\22f9b48d-6d6a-4cc8-b1fc-f263eb465b59\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\22f9b48d-6d6a-4cc8-b1fc-f263eb465b59\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\22f9b48d-6d6a-4cc8-b1fc-f263eb465b59\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\22f9b48d-6d6a-4cc8-b1fc-f263eb465b59\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\23031c7b-0c62-46e6-bce3-4b602e0a83d8\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\23031c7b-0c62-46e6-bce3-4b602e0a83d8\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\23031c7b-0c62-46e6-bce3-4b602e0a83d8\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\23031c7b-0c62-46e6-bce3-4b602e0a83d8\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\233c4d73-4ec1-48c6-8d1c-efec3e2eb3ef\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\233c4d73-4ec1-48c6-8d1c-efec3e2eb3ef\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\233c4d73-4ec1-48c6-8d1c-efec3e2eb3ef\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\233c4d73-4ec1-48c6-8d1c-efec3e2eb3ef\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\23c93b1b-4701-4f35-9a9a-dc05e19ece12\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\23c93b1b-4701-4f35-9a9a-dc05e19ece12\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\23c93b1b-4701-4f35-9a9a-dc05e19ece12\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\23c93b1b-4701-4f35-9a9a-dc05e19ece12\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2415eb40-0f0a-41ca-9937-0ddc951d5ae6\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2415eb40-0f0a-41ca-9937-0ddc951d5ae6\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2415eb40-0f0a-41ca-9937-0ddc951d5ae6\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2415eb40-0f0a-41ca-9937-0ddc951d5ae6\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\243cc76c-d4ba-4458-8f7b-d9f3ac32f49d\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\243cc76c-d4ba-4458-8f7b-d9f3ac32f49d\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\243cc76c-d4ba-4458-8f7b-d9f3ac32f49d\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\243cc76c-d4ba-4458-8f7b-d9f3ac32f49d\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\24c067c6-b74a-4509-bbdb-6f84183d17aa\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\24c067c6-b74a-4509-bbdb-6f84183d17aa\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\24c067c6-b74a-4509-bbdb-6f84183d17aa\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\24c067c6-b74a-4509-bbdb-6f84183d17aa\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\25ee7277-1f6c-41d9-8673-0c84ffdc17a2\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\25ee7277-1f6c-41d9-8673-0c84ffdc17a2\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\25ee7277-1f6c-41d9-8673-0c84ffdc17a2\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\25ee7277-1f6c-41d9-8673-0c84ffdc17a2\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\262c27a2-bbca-4670-93f6-a9f67f497adc\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\262c27a2-bbca-4670-93f6-a9f67f497adc\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\262c27a2-bbca-4670-93f6-a9f67f497adc\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\262c27a2-bbca-4670-93f6-a9f67f497adc\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2644b9d1-62af-4724-89f3-b0b1e567fb2b\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2644b9d1-62af-4724-89f3-b0b1e567fb2b\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2644b9d1-62af-4724-89f3-b0b1e567fb2b\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2644b9d1-62af-4724-89f3-b0b1e567fb2b\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\264e2260-7b46-4a17-9c13-8a09f91e33e0\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\264e2260-7b46-4a17-9c13-8a09f91e33e0\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\264e2260-7b46-4a17-9c13-8a09f91e33e0\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\264e2260-7b46-4a17-9c13-8a09f91e33e0\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\266963c8-7df0-4d15-856e-7348d0275386\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\266963c8-7df0-4d15-856e-7348d0275386\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\266963c8-7df0-4d15-856e-7348d0275386\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\266963c8-7df0-4d15-856e-7348d0275386\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\26f11bb1-2141-45e2-8aa9-8ab9a6596a53\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\26f11bb1-2141-45e2-8aa9-8ab9a6596a53\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\26f11bb1-2141-45e2-8aa9-8ab9a6596a53\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\26f11bb1-2141-45e2-8aa9-8ab9a6596a53\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2723c083-b3b9-42aa-b8f6-299faa18dc52\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2723c083-b3b9-42aa-b8f6-299faa18dc52\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2723c083-b3b9-42aa-b8f6-299faa18dc52\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2723c083-b3b9-42aa-b8f6-299faa18dc52\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27468211-4f3b-4f2c-a5fe-233db79e1ac1\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27468211-4f3b-4f2c-a5fe-233db79e1ac1\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27468211-4f3b-4f2c-a5fe-233db79e1ac1\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27468211-4f3b-4f2c-a5fe-233db79e1ac1\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\278e5993-82c9-43ae-9cff-554b365d68c3\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\278e5993-82c9-43ae-9cff-554b365d68c3\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\278e5993-82c9-43ae-9cff-554b365d68c3\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\278e5993-82c9-43ae-9cff-554b365d68c3\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27c241cc-4f85-4371-86e2-9fd212f8a1dd\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27c241cc-4f85-4371-86e2-9fd212f8a1dd\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27c241cc-4f85-4371-86e2-9fd212f8a1dd\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27c241cc-4f85-4371-86e2-9fd212f8a1dd\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27c7ee3b-def3-4bb9-b598-86f3f2777ae9\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27c7ee3b-def3-4bb9-b598-86f3f2777ae9\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27c7ee3b-def3-4bb9-b598-86f3f2777ae9\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27c7ee3b-def3-4bb9-b598-86f3f2777ae9\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27e28336-bc89-471e-aceb-636a2a065010\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27e28336-bc89-471e-aceb-636a2a065010\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27e28336-bc89-471e-aceb-636a2a065010\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27e28336-bc89-471e-aceb-636a2a065010\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27f2c1f5-0fc2-4472-9fdc-ef994412ca4c\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27f2c1f5-0fc2-4472-9fdc-ef994412ca4c\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27f2c1f5-0fc2-4472-9fdc-ef994412ca4c\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27f2c1f5-0fc2-4472-9fdc-ef994412ca4c\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27f8f205-903a-4b85-a561-6f6744fa0431\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27f8f205-903a-4b85-a561-6f6744fa0431\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27f8f205-903a-4b85-a561-6f6744fa0431\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27f8f205-903a-4b85-a561-6f6744fa0431\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27f938b0-6d5d-4560-a8d1-b4f3a2baae8d\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27f938b0-6d5d-4560-a8d1-b4f3a2baae8d\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27f938b0-6d5d-4560-a8d1-b4f3a2baae8d\DellSignedAppUpdaterRules_dsc\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27f938b0-6d5d-4560-a8d1-b4f3a2baae8d\DellSignedAppUpdaterRules_dsc\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27fb3b3c-23b3-4e28-ab51-eeb3c7b7c75c\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27fb3b3c-23b3-4e28-ab51-eeb3c7b7c75c\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27fb3b3c-23b3-4e28-ab51-eeb3c7b7c75c\au_5899_rules\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\27fb3b3c-23b3-4e28-ab51-eeb3c7b7c75c\au_5899_rules\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\280cb23d-2200-4333-97ba-19caa93092ae\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\280cb23d-2200-4333-97ba-19caa93092ae\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\280cb23d-2200-4333-97ba-19caa93092ae\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\280cb23d-2200-4333-97ba-19caa93092ae\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\281a4f2d-958f-4817-a242-96654010c19b\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\281a4f2d-958f-4817-a242-96654010c19b\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\281a4f2d-958f-4817-a242-96654010c19b\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\281a4f2d-958f-4817-a242-96654010c19b\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\281dea9d-f826-4cef-8036-557b119cfe30\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\281dea9d-f826-4cef-8036-557b119cfe30\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\281dea9d-f826-4cef-8036-557b119cfe30\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\281dea9d-f826-4cef-8036-557b119cfe30\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\282e530c-acf7-4777-b3e4-c0f4618e5180\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\282e530c-acf7-4777-b3e4-c0f4618e5180\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\282e530c-acf7-4777-b3e4-c0f4618e5180\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\282e530c-acf7-4777-b3e4-c0f4618e5180\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28306cec-0e72-4eba-a894-3c3fbe73b08e\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28306cec-0e72-4eba-a894-3c3fbe73b08e\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28306cec-0e72-4eba-a894-3c3fbe73b08e\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28306cec-0e72-4eba-a894-3c3fbe73b08e\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28347c79-120b-48c1-8b73-794d65d0f26f\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28347c79-120b-48c1-8b73-794d65d0f26f\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28347c79-120b-48c1-8b73-794d65d0f26f\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28347c79-120b-48c1-8b73-794d65d0f26f\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\283dcbcd-757f-407b-a435-ab5c3e3cd8cb\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\283dcbcd-757f-407b-a435-ab5c3e3cd8cb\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\283dcbcd-757f-407b-a435-ab5c3e3cd8cb\au_5899_rules\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\283dcbcd-757f-407b-a435-ab5c3e3cd8cb\au_5899_rules\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2872df86-2490-41c5-94b1-89283cb9bdd1\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2872df86-2490-41c5-94b1-89283cb9bdd1\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2872df86-2490-41c5-94b1-89283cb9bdd1\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2872df86-2490-41c5-94b1-89283cb9bdd1\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2883f447-0d0e-40e7-a630-26e3c67d9cf9\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2883f447-0d0e-40e7-a630-26e3c67d9cf9\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2883f447-0d0e-40e7-a630-26e3c67d9cf9\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2883f447-0d0e-40e7-a630-26e3c67d9cf9\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2889f49a-38eb-4c88-890a-fe4531c20fa4\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2889f49a-38eb-4c88-890a-fe4531c20fa4\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2889f49a-38eb-4c88-890a-fe4531c20fa4\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2889f49a-38eb-4c88-890a-fe4531c20fa4\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
     
  21. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    0542add0893\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2890e207-ee45-4461-929b-50542add0893\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2890e207-ee45-4461-929b-50542add0893\au_5899_rules\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2890e207-ee45-4461-929b-50542add0893\au_5899_rules\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2897e62b-92cf-4c8c-b711-ac018d99e52e\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2897e62b-92cf-4c8c-b711-ac018d99e52e\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2897e62b-92cf-4c8c-b711-ac018d99e52e\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\2897e62b-92cf-4c8c-b711-ac018d99e52e\PCDoctor_6219.34_windows_appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28a25fa4-0cc4-4ccf-99b3-290639b2ae62\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28a25fa4-0cc4-4ccf-99b3-290639b2ae62\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28a25fa4-0cc4-4ccf-99b3-290639b2ae62\au_5899_rules\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28a25fa4-0cc4-4ccf-99b3-290639b2ae62\au_5899_rules\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28b72031-a55c-456f-9b82-d24dc602f390\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28b72031-a55c-456f-9b82-d24dc602f390\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28b72031-a55c-456f-9b82-d24dc602f390\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28b72031-a55c-456f-9b82-d24dc602f390\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28b9041d-b84e-488d-b40e-c5fa57026e10\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28b9041d-b84e-488d-b40e-c5fa57026e10\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28b9041d-b84e-488d-b40e-c5fa57026e10\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28b9041d-b84e-488d-b40e-c5fa57026e10\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28d03d2e-6bf3-4f6f-9ad6-9acafba6b896\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28d03d2e-6bf3-4f6f-9ad6-9acafba6b896\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28d03d2e-6bf3-4f6f-9ad6-9acafba6b896\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28d03d2e-6bf3-4f6f-9ad6-9acafba6b896\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28d3399c-e27f-401b-8a86-c3f6b8083b70\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28d3399c-e27f-401b-8a86-c3f6b8083b70\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28d3399c-e27f-401b-8a86-c3f6b8083b70\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28d3399c-e27f-401b-8a86-c3f6b8083b70\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28e66d88-b932-41f5-902f-db7fd47d8211\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28e66d88-b932-41f5-902f-db7fd47d8211\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28e66d88-b932-41f5-902f-db7fd47d8211\appupdaterrules_dell\DECRYPT_INSTRUCTION.HTML Win32/Filecoder.CR trojan
    C:\Users\Deb\AppData\Roaming\PCDr\Update\Rules\28e66d88-b932-41f5-902f-db7fd47d8211\appupdaterrules_dell\DECRYPT_INSTRUCTION.TXT Win32/Filecoder.CR trojan
    C:\Windows\System32\Adobe\Shockwave 12\gt.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
    C:\Windows\SysWOW64\Adobe\Shockwave 12\gt.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application
     
  22. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Re-run Eset.
    Follow my instructions strictly and all threats will be removed by default.
     
  23. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    Well, I again followed your instructions explicitly and ran the scan in Eset. The first time the scan again hung at 49% complete and found 1134 threats. I then rebooted my computer and ran it again. Same thing only 1099 threats. I can assure you I followed your instructions to a tee and cannot figure out why it won't work the way it's supposed to. I know from memory it worked a couple of years ago and the program also indicated that a scan was run in the past. I am open to all of your suggestions. As you know I am using IE so just clicked the link to access the program. I didn't post all of the threats again cause they look to be the same as before though I did save them if you would like them.
     
  24. Kactus

    Kactus TS Rookie Topic Starter Posts: 52

    Just one last thing to be clear, it's obvious that the scan completes but it shows only being 49% completed and then the clock never stops to show complete.
     
  25. Broni

    Broni Malware Annihilator Posts: 52,895   +344

    Let's double check...

    • Download Sophos Free Virus Removal Tool and save it to your desktop
    • Double click the icon and select Run
    • Click Next
    • Select I accept the terms in this license agreement, then click Next twice
    • Click Install
    • Click Finish to launch the program
    • Once the virus database has been updated click Start Scanning
    • If any threats are found click Details, then View log file... (bottom left hand corner)
    • Copy and paste the results in your reply
    • Close the Notepad document, close the Threat Details screen, then click Start cleanup
    • Click Exit to close the program
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...