# Cryptowall virus help



## joshadam84 (Feb 18, 2015)

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows XP Professional, Service Pack 3, 32 bit
Processor: Genuine Intel(R) CPU 2140 @ 1.60GHz, x86 Family 6 Model 15 Stepping 2
Processor Count: 2
RAM: 2046 Mb
Graphics Card: ATI Radeon X1050, 1 Mb
Hard Drives: C: Total - 49999 MB, Free - 15907 MB; E: Total - 39997 MB, Free - 8277 MB; F: Total - 62628 MB, Free - 27931 MB;
Motherboard: Gigabyte Technology Co., Ltd., P35-DS3L
Antivirus: AVG update module, Updated: Yes, On-Demand Scanner: Enabled

Hello! It seems my computer has been infected with the Cryptowall 3.0 virus. I've ran several scanners: AVG, Malwarebytes, Microsoft Safety Scanner, JRT, and Adwcleaner, and when I run the computer on a regular boot-up I still receive the help_decrypt popups. I also have the help_decrypt files all over the various drives. Any help in removing this virus is appreciated. At the moment, I'm not concerned with decrypting any files. I just want the computer to be clean of it. Thank you!


----------



## JSntgRvr (Jul 1, 2003)

Welcome . 

Please download Farbar Recovery Scan Tool and save it to your desktop.

*Note*: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click *Yes* to disclaimer.
Make sure that under *Optional Scans*, there is a checkmark on Addition.txt and Shortcut.
Press *Scan* button.
It will make a log (*FRST.txt*) in the same directory the tool is run. Please copy and paste it to your reply.
The tool will also produce another two logs (*Addition.txt and Shortcut.txt*). Please attach these to your reply.

Once the above has finished, while on FRST, type the following in the edit box on FRST, after "Search:".

*HELP_DECRYPT.**

It then should look like:

*Search: HELP_DECRYPT.**

Click *Search Files* button and post the log (Search.txt) it makes on the USB drive in your next reply.


----------



## joshadam84 (Feb 18, 2015)

Thanks for helping! Here's FRST:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-02-2015 01
Ran by Administrator (administrator) on JOSH-H on 18-02-2015 19:57:42
Running from F:\Documents and Settings\Administrator\My Documents\Downloads
Loaded Profiles: Administrator (Available profiles: Administrator)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English (United States)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) E:\WINDOWS\system32\cmd.exe
() E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe
() E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe
() E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe
() E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe
(Microsoft Corporation) E:\WINDOWS\system32\taskmgr.exe
() E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe
() E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe
(Microsoft Corporation) E:\WINDOWS\system32\netsh.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AVG_UI] => E:\Program Files\AVG\AVG2015\avgui.exe [3674576 2015-01-06] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [Adobe ARM] => E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [StartCCC] => E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2010-02-10] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [MSConfig] => E:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [169984 2008-04-13] (Microsoft Corporation)
HKLM\...\Run: [bdruninstaller] => E:\Program Files\Common Files\Bitdefender\SetupInformation\downloader\setupdownloader.exe [537464 2014-07-07] (Bitdefender)
HKLM\...\Run: [{edfbf0a9-e81f-aeb1-34aa-5458425df3f2}] => E:\Documents and Settings\All Users\Application Data\Microsoft\{edfbf0a9-e81f-aeb1-34aa-5458425df3f2}\{edfbf0a9-e81f-aeb1-34aa-5458425df3f2}.exe [376870 2015-02-18] ()
HKLM\...\Run: [WinampAgent] => E:\Program Files\Winamp\winampa.exe [36352 2007-10-10] ()
HKLM\...\Run: [WiFiCFG.EXE] => E:\Program Files\802.11g USB2.0 adapter\WiFiCFG.EXE [393216 2005-08-03] (Conexant Systems, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => E:\Program Files\Java\jre6\bin\jusched.exe [149280 2009-10-11] (Sun Microsystems, Inc.)
HKLM\...\Run: [RTHDCPL] => E:\WINDOWS\RTHDCPL.EXE [16380416 2007-07-05] (Realtek Semiconductor Corp.)
HKLM\...\Run: [PRISMSVR.EXE] => Prismsvr.exe /apply
HKLM\...\Run: [nmctxth] => E:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe [648504 2008-04-09] (Pure Networks, Inc.)
HKLM\...\Run: [Malwarebytes' Anti-Malware] => "E:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
HKLM\...\Run: [LogitechQuickCamRibbon] => "E:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
HKLM\...\Run: [LELA] => E:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe [131072 2008-05-01] (Linksys LLC - A Division of Cisco Systems)
HKLM\...\Run: [HP Software Update] => E:\Program Files\HP\HP Software Update\HPWuSchd2.exe
HKLM\...\Run: [DivXUpdate] => "E:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
HKLM\...\Run: [CanonSolutionMenu] => E:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-03] (CANON INC.)
HKLM\...\Run: [CanonMyPrinter] => E:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1983816 2009-10-18] (CANON INC.)
HKLM\...\Run: [AppleSyncNotifier] => E:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
HKLM\...\Run: [Anvi Smart Defender] => C:\Anvi Smart Defender\ASDTray.exe
HKLM\...\Run: [Anvi AD Blocker] => "C:\Anvi Smart Defender\toolbox\adblocker\ADBlockerTray.exe" -tray
HKLM\...\Run: [AllShareAgent] => E:\Program Files\Samsung\AllShare\AllShareAgent.exe [285072 2012-03-01] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [Alcmtr] => E:\WINDOWS\ALCMTR.EXE [69632 2005-05-03] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Adobe Reader Speed Launcher] => "E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
HKLM\...\Run: [Ad-Aware Browsing Protection] => "E:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe"
HKLM\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] => E:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation)
HKLM Group Policy restriction on software: E:\Program Files\Trend Micro <====== ATTENTION
HKLM Group Policy restriction on software: E:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION
HKLM Group Policy restriction on software: E:\Program Files\Common Files\Symantec Shared <====== ATTENTION
HKLM Group Policy restriction on software: E:\Program Files\Lavasoft <====== ATTENTION
HKLM Group Policy restriction on software: E:\Program Files\AVG <====== ATTENTION
HKLM Group Policy restriction on software: E:\Program Files\AVG\ <====== ATTENTION
HKLM Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% <====== ATTENTION
HKLM Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%System32\*.exe <====== ATTENTION
HKLM Group Policy restriction on software: %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% <====== ATTENTION
Winlogon\Notify\AtiExtEvent: E:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] fastprox.dll ATTENTION! ====> ZeroAccess?
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 1
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig] <===== ATTENTION
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\Run: [AVG-Secure-Search-Update_0814tb] => E:\Program Files\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2782744 2014-08-27] ()
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\Run: [CCleaner Monitoring] => F:\Program Files\CCleaner\CCleaner.exe [5496600 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\Run: [BluetoothS] => rundll32.exe "%appdata%\BtvStack.dll",BTHF_Register
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\Run: [CryptoUpdate] => E:\WINDOWS\system32\regsvr32.exe /s "E:\Documents and Settings\Administrator\Application Data\Microsoft\Crypto\RSA\cert_v101_0.tpl"
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\Run: [msg] => E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe [205824 2014-03-12] ()
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\Run: [Xvid] => E:\Program Files\Xvid\CheckUpdate.exe
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\Run: [WMPNSCFG] => E:\Program Files\Windows Media Player\WMPNSCFG.exe [204288 2009-01-30] (Microsoft Corporation)
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\Run: [OM_Monitor] => F:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\RunOnce: [Report] => E:\AdwCleaner\AdwCleaner[S2].txt [14448 2015-02-16] ()
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\RunOnce: [CryptoUpdate] => E:\WINDOWS\system32\regsvr32.exe /s "E:\Documents and Settings\Administrator\Application Data\Microsoft\Crypto\RSA\cert_v101_0.tpl"
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\RunOnce: [msg] => E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe [205824 2014-03-12] ()
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\RunOnce: [FlashPlayerUpdate] => E:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_5_502_149_Plugin.exe -update plugin
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\Policies\Explorer: [TaskbarNoNotification] 1
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\Policies\Explorer: [Run] "E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe"
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\MountPoints2: {7d46788d-1616-11e1-b61f-001a4d4fd160} - H:\setup.exe -a
HKU\S-1-5-21-1275210071-764733703-839522115-500\...\Command Processor: "E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe" <===== ATTENTION!
HKU\S-1-5-21-1275210071-764733703-839522115-500\...409d6c4515e9\InprocServer32: [Default-shell32] shell32.dll ATTENTION! ====> ZeroAccess?
HKU\S-1-5-18\...\RunOnce: [FlashPlayerUpdate] => E:\WINDOWS\system32\Macromed\Flash\FlashUtil10w_ActiveX.exe -update activex
HKU\S-1-5-18\...\RunOnce: [adaware] => reg.exe delete "HKCU\Software\AppDataLow\Software\adaware" /f
HKU\S-1-5-18\...\RunOnce: [adaware_XP] => reg.exe delete "HKCU\Software\adaware" /f
Startup: E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\msg.lnk
ShortcutTarget: msg.lnk -> E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe ()
Startup: E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> E:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\OneNote Table Of Contents.onetoc2 ()
Startup: E:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> E:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (No File)
Startup: E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> E:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
Startup: E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
ShortcutTarget: Windows Search.lnk -> E:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)
BootExecute: autocheck autochk * E:\PROGRA~1\AVG\AVG2015\avgrsx.exe /sync /restart

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/?rlz=1V1IPYX
HKU\S-1-5-21-1275210071-764733703-839522115-500\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
SearchScopes: HKU\.DEFAULT -> {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = http://www.google.com/search?ie=utf-8&oe=utf-8&rlz=1V4IPYX&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1275210071-764733703-839522115-500 -> {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = 
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> E:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> E:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> E:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> E:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class -> {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -> E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - E:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM - No Name - {37153479-1976-43c3-a1ee-557513977b64} - No File
Toolbar: HKU\.DEFAULT -> No Name - {37153479-1976-43C3-A1EE-557513977B64} - No File
Toolbar: HKU\.DEFAULT -> Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - E:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKU\.DEFAULT -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
Toolbar: HKU\.DEFAULT -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKU\S-1-5-21-1275210071-764733703-839522115-500 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKU\S-1-5-21-1275210071-764733703-839522115-500 -> Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - E:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKU\S-1-5-21-1275210071-764733703-839522115-500 -> No Name - {37153479-1976-43C3-A1EE-557513977B64} - No File
DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File
Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - E:\Program Files\Common Files\Pure Networks Shared\Platform\puresp3.dll (Pure Networks, Inc.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - E:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{3ED6932D-FAAA-48BE-9F2E-ACA0F7056F89}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{794DA7D9-72DB-4E90-98C1-4B7876DEB208}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{D46E0B0C-D8FC-489E-8B3E-F77D5C25B196}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{D9034B7C-9685-49E6-B0F8-D155458DA4C5}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8
Tcpip\..\Interfaces\{EA9EA4E6-506F-40C9-91C6-973163099B16}: [NameServer] 8.8.8.8,8.8.8.8,8.8.8.8,8.8.8.8

FireFox:
========
FF ProfilePath: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default
FF DefaultSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer -> E:\WINDOWS\system32\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> E:\WINDOWS\system32\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin: @bittorrent.com/BitTorrentDNA -> E:\Program Files\DNA\plugins\npbtdna.dll (BitTorrent, Inc.)
FF Plugin: @canon.com/EPPEX -> E:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> E:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll No File
FF Plugin: @divx.com/DivX Content Upload Plugin,version=1.0.0 -> E:\Program Files\DivX\DivX Content Uploader\npUpload.dll No File
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 -> E:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> E:\Program Files\Yahoo!\Shared\npYState.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> E:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> E:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> E:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> E:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=15.0.6.14 -> e:\program files\real\realplayer\Netscape6\nppl3260.dll No File
FF Plugin: @real.com/nprjplug;version=15.0.6.14 -> e:\program files\real\realplayer\Netscape6\nprjplug.dll No File
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 -> E:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 -> E:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=15.0.6.14 -> e:\program files\real\realplayer\Netscape6\nprpplugin.dll No File
FF Plugin: @videolan.org/vlc,version=2.0.5 -> E:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin: Adobe Reader -> E:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1275210071-764733703-839522115-500: @adobe.com/FlashPlayer -> E:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll No File
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\npdeploytk.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\nprjplug.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\nprpplugin.dll (RealPlayer)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\NPSFDMGR.dll (SpiralFrog Inc.)
FF Plugin ProgramFiles/Appdata: E:\Program Files\mozilla firefox\plugins\npsnapfish.dll ( )
FF Extension: iMacros for Firefox - E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\Extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} [2014-12-17]
FF Extension: Bitdefender QuickScan - E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2015-02-17]
FF Extension: anonymoX - E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\Extensions\[email protected] [2014-09-02]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - E:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - E:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-23]
FF HKLM\...\Firefox\Extensions: [[email protected]] - E:\Program Files\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - E:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009-06-06]
FF HKLM\...\Firefox\Extensions: [{CF02C7A5-1B4A-4327-A2EA-DDB354EF5F13}] - E:\Documents and Settings\Administrator\Local Settings\Application Data\{CF02C7A5-1B4A-4327-A2EA-DDB354EF5F13}
FF Extension: XULRunner - E:\Documents and Settings\Administrator\Local Settings\Application Data\{CF02C7A5-1B4A-4327-A2EA-DDB354EF5F13} [2011-02-06]
FF HKLM\...\Firefox\Extensions: [{0153E448-190B-4987-BDE1-F256CADA672F}] - E:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - E:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012-11-25]

Chrome: 
=======
CHR Profile: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-28]
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2013-10-08]
CHR Extension: (Google Wallet) - E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-09]
CHR HKLM\...\Chrome\Extension: [ghnpfkmgeiojiaheaiefkilmjinpoccb] - E:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ghnpfkmgeiojiaheaiefkilmjinpoccb.crx [Not Found]
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - E:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2012-11-25]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 Ati HotKey Poller; E:\WINDOWS\system32\Ati2evxx.exe [602112 2010-02-10] (ATI Technologies Inc.) [File not signed]
S2 ATI Smart; E:\WINDOWS\system32\ati2sgag.exe [593920 2010-02-10] () [File not signed]
S2 AVGIDSAgent; E:\Program Files\AVG\AVG2015\avgidsagent.exe [3440080 2015-01-06] (AVG Technologies CZ, s.r.o.)
S2 avgwd; E:\Program Files\AVG\AVG2015\avgwdsvc.exe [309232 2015-01-06] (AVG Technologies CZ, s.r.o.)
S4 BITS; C:\WINDOWS\system32\qmgr.dll [77760 2002-12-06] (Microsoft Corporation) [File not signed]
S2 JavaQuickStarterService; E:\Program Files\Java\jre6\bin\jqs.exe [153376 2009-10-11] (Sun Microsystems, Inc.)
S2 LinksysUpdater; E:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [204800 2008-04-18] () [File not signed]
S2 MBAMScheduler; E:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; E:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S2 nmservice; E:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe [648504 2008-04-09] (Pure Networks, Inc.)
S4 OODefragAgent; E:\Program Files\OO Software\Defrag\oodag.exe [2336072 2011-01-25] (O&O Software GmbH)
S2 SamsungAllShareV2.0; E:\Program Files\Samsung\AllShare\AllShareDMS\AllShareDMS.exe [25504 2012-03-02] (Samsung Electronics Co., Ltd.)
S3 SimpleSlideShowServer; E:\Program Files\Samsung\AllShare\AllShareSlideShowService.exe [27584 2012-03-02] (Samsung Electronics Co., Ltd.)
S2 UMVPFSrv; E:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2011-08-19] (Logitech Inc.)
S2 PS3 Media Server; "E:\Program Files\PS3 Media Server-SHB\win32\service\wrapper.exe" -s "E:\Program Files\PS3 Media Server-SHB\win32\service\wrapper.conf"
S4 wuauserv; C:\WINDOWS\system32\wuauserv.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 ati2mtag; E:\WINDOWS\System32\DRIVERS\ati2mtag.sys [3565056 2010-02-11] (ATI Technologies Inc.) [File not signed]
S1 Avgdiskx; E:\WINDOWS\System32\DRIVERS\avgdiskx.sys [121624 2014-06-18] (AVG Technologies CZ, s.r.o.)
S1 AVGIDSDriverl; E:\WINDOWS\System32\DRIVERS\avgidsdriverlx.sys [192792 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; E:\WINDOWS\System32\DRIVERS\avgidshx.sys [154904 2014-11-18] (AVG Technologies CZ, s.r.o.)
S1 AVGIDSShim; E:\WINDOWS\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-18] (AVG Technologies CZ, s.r.o.)
S1 Avgldx86; E:\WINDOWS\System32\DRIVERS\avgldx86.sys [192792 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; E:\WINDOWS\System32\DRIVERS\avglogx.sys [230680 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; E:\WINDOWS\System32\DRIVERS\avgmfx86.sys [98584 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; E:\WINDOWS\System32\DRIVERS\avgrkx86.sys [27416 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; E:\WINDOWS\System32\DRIVERS\avgtdix.sys [200984 2014-10-10] (AVG Technologies CZ, s.r.o.)
R1 avgtp; E:\WINDOWS\system32\drivers\avgtpx86.sys [42784 2014-08-11] (AVG Technologies)
S3 CCDECODE; E:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
R1 cdrbsdrv; E:\WINDOWS\system32\Drivers\cdrbsdrv.sys [13567 2004-03-08] (B.H.A Corporation) [File not signed]
R1 dtsoftbus01; E:\WINDOWS\System32\DRIVERS\dtsoftbus01.sys [232512 2012-01-05] (DT Soft Ltd)
S3 FilterService; E:\WINDOWS\System32\DRIVERS\lvuvcflt.sys [23832 2009-10-07] (Logitech Inc.)
S3 FTDIBUS; E:\WINDOWS\System32\drivers\ftdibus.sys [57536 2008-03-13] (FTDI Ltd.)
S3 gfiark; E:\WINDOWS\System32\drivers\gfiark.sys [43368 2013-05-23] (ThreatTrack Security)
R0 gfibto; E:\WINDOWS\System32\drivers\gfibto.sys [13560 2013-07-03] (GFI Software)
S3 MBAMProtector; E:\WINDOWS\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R0 MBAMSwissArmy; E:\WINDOWS\System32\drivers\MBAMSwissArmy.sys [114904 2015-02-18] (Malwarebytes Corporation)
S2 MDC8021X; E:\WINDOWS\System32\DRIVERS\mdc8021x.sys [15781 2007-11-04] (Meetinghouse Data Communications) [File not signed]
S3 msvad_simple; E:\WINDOWS\System32\drivers\povrtdev.sys [23920 2010-04-29] (MediaMall Technologies, Inc.)
S3 MTK; E:\WINDOWS\System32\Drivers\fide.sys [15271 2003-09-07] (MediaTek Corporation) [File not signed]
S3 NdisIP; E:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
S2 NPF; E:\WINDOWS\system32\drivers\npf.sys [35088 2013-01-17] (CACE Technologies, Inc.)
S3 NuidFltr; E:\WINDOWS\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
S2 pnarp; E:\WINDOWS\System32\DRIVERS\pnarp.sys [23992 2008-04-09] (Pure Networks, Inc.)
S3 PRISM_A02; E:\WINDOWS\System32\DRIVERS\PRISMA02.sys [348640 2005-02-01] (Conexant Systems, Inc.) [File not signed]
S2 purendis; E:\WINDOWS\System32\DRIVERS\purendis.sys [25272 2008-04-09] (Pure Networks, Inc.)
S3 QCDonner; E:\WINDOWS\System32\DRIVERS\OVCD.sys [28032 2001-08-17] (Microsoft Corporation)
S3 Rockusb; E:\WINDOWS\System32\DRIVERS\rockusb.sys [46160 2013-03-12] (Fuzhou Rockchip Electronics Co,Ltd.)
S3 USBIO; E:\WINDOWS\System32\Drivers\usbio.sys [19805 2001-05-07] (Thesycon GmbH, Germany) [File not signed]
S3 XIRLINK; E:\WINDOWS\System32\DRIVERS\ucdnt.sys [728067 2003-05-08] (Xirlink, Inc)
S3 xport360_usb_v2; E:\WINDOWS\System32\Drivers\xport360_usb_v2.sys [29184 2007-02-08] (Thesycon GmbH, Germany) [File not signed]
S3 GEARAspiWDM; System32\Drivers\GEARAspiWDM.sys [X]
S4 IntelIde; No ImagePath
S0 Lbd; system32\DRIVERS\Lbd.sys [X]
S1 mlzmpwhq; \??\E:\WINDOWS\system32\drivers\mlzmpwhq.sys [X]
U5 ScsiPort; E:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
S3 usbbus; system32\DRIVERS\lgusbbus.sys [X]
S3 UsbDiag; system32\DRIVERS\lgusbdiag.sys [X]
S3 USBModem; system32\DRIVERS\lgusbmodem.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-18 19:51 - 2015-02-18 20:01 - 00000000 ____D () E:\Documents and Settings\Administrator\Local Settings\Temp
2015-02-18 19:48 - 2015-02-18 19:49 - 00000004 _____ () E:\Documents and Settings\Administrator\Desktop\test.txt
2015-02-18 19:01 - 2015-02-18 19:01 - 00000686 _____ () E:\Documents and Settings\Administrator\Desktop\Shortcut to Downloads.lnk
2015-02-18 17:57 - 2015-02-18 19:35 - 00000434 ____H () E:\WINDOWS\Tasks\CryptoUpdate.job
2015-02-18 08:27 - 2015-02-18 17:57 - 00128512 _____ (LinerIntersects) E:\Documents and Settings\Administrator\Application Data\svcxdcl32.exe
2015-02-18 07:58 - 2015-02-18 08:00 - 00000153 _____ () E:\Documents and Settings\Administrator\Local Settings\Application Data\svcxdcl32.dat
2015-02-18 07:58 - 2015-02-18 07:58 - 00122368 _____ (PetitionersRavenous) E:\Documents and Settings\Administrator\Local Settings\Application Data\svcxdcl32.exe
2015-02-18 07:36 - 2015-02-18 11:45 - 00008630 _____ () E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.HTML
2015-02-18 07:36 - 2015-02-18 11:45 - 00000292 _____ () E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.URL
2015-02-18 07:35 - 2015-02-18 11:45 - 00004258 _____ () E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.TXT
2015-02-18 04:48 - 2015-02-18 04:48 - 00008722 _____ () E:\HELP_DECRYPT.HTML
2015-02-18 04:48 - 2015-02-18 04:48 - 00008722 _____ () E:\Documents and Settings\HELP_DECRYPT.HTML
2015-02-18 04:48 - 2015-02-18 04:48 - 00008722 _____ () E:\Documents and Settings\Administrator\HELP_DECRYPT.HTML
2015-02-18 04:48 - 2015-02-18 04:48 - 00004304 _____ () E:\HELP_DECRYPT.TXT
2015-02-18 04:48 - 2015-02-18 04:48 - 00004304 _____ () E:\Documents and Settings\HELP_DECRYPT.TXT
2015-02-18 04:48 - 2015-02-18 04:48 - 00004304 _____ () E:\Documents and Settings\Administrator\HELP_DECRYPT.TXT
2015-02-18 04:48 - 2015-02-18 04:48 - 00000304 _____ () E:\HELP_DECRYPT.URL
2015-02-18 04:48 - 2015-02-18 04:48 - 00000304 _____ () E:\Documents and Settings\HELP_DECRYPT.URL
2015-02-18 04:48 - 2015-02-18 04:48 - 00000304 _____ () E:\Documents and Settings\Administrator\HELP_DECRYPT.URL
2015-02-18 04:27 - 2015-02-18 19:45 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\Uvila
2015-02-18 04:27 - 2015-02-18 04:27 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\Iwet
2015-02-17 20:16 - 2015-02-17 20:16 - 00000000 ____D () E:\Program Files\Common Files\Bitdefender
2015-02-17 20:14 - 2015-02-17 20:15 - 00014880 _____ () E:\Report 2015-02-17 20.14.59.txt
2015-02-16 16:26 - 2015-02-18 19:46 - 00001609 _____ () E:\WINDOWS\WindowsUpdate.log
2015-02-16 15:31 - 2015-02-16 15:31 - 00000880 _____ () E:\Documents and Settings\Administrator\Desktop\JRT.txt
2015-02-15 17:21 - 2015-02-18 04:30 - 00000000 ____D () E:\AdwCleaner
2015-02-15 16:40 - 2015-02-18 19:57 - 00000000 ____D () E:\FRST
2015-02-15 15:23 - 2015-02-18 04:34 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\Local Store
2015-02-14 17:32 - 2015-02-15 21:21 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\Ycboi
2015-02-14 17:32 - 2015-02-14 17:37 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\Dafe
2015-02-14 13:32 - 2015-02-15 14:55 - 00000000 ___HD () E:\Documents and Settings\Administrator\Application Data\3D5C0CDA
2015-02-14 13:15 - 2015-02-17 03:31 - 00000000 ____D () E:\WINDOWS\system32\MpEngineStore
2015-02-14 13:09 - 2015-02-14 13:09 - 00000664 _____ () E:\Documents and Settings\Administrator\Local Settings\Application Data\d3d9caps.dat
2015-02-13 23:04 - 2015-02-13 23:14 - 00007052 __RSH () E:\Documents and Settings\All Users\ntuser.pol
2015-02-13 20:03 - 2015-02-13 20:03 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\AVG2015
2015-02-13 19:59 - 2015-02-13 19:59 - 00000702 _____ () E:\Documents and Settings\All Users\Desktop\AVG 2015.lnk
2015-02-13 19:59 - 2015-02-13 19:59 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\TuneUp Software
2015-02-13 19:54 - 2015-02-13 22:49 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\AVG2015
2015-02-13 19:04 - 2015-02-13 20:04 - 00000000 ____D () E:\Documents and Settings\Administrator\Local Settings\Application Data\Avg2015
2015-02-13 19:04 - 2015-02-13 19:04 - 00000000 ____D () E:\Documents and Settings\Administrator\Local Settings\Application Data\MFAData
2015-02-12 23:26 - 2015-02-16 09:46 - 00004000 _____ () E:\Documents and Settings\Administrator\Desktop\avgrep.txt
2015-02-12 22:12 - 2015-02-12 22:12 - 00000000 ____D () E:\Documents and Settings\Administrator\Local Settings\Application Data\PCHealth
2015-02-12 15:01 - 2015-02-12 15:01 - 00008722 _____ () E:\Documents and Settings\NetworkService\Local Settings\HELP_DECRYPT.HTML
2015-02-12 15:01 - 2015-02-12 15:01 - 00008722 _____ () E:\Documents and Settings\NetworkService\Local Settings\Application Data\HELP_DECRYPT.HTML
2015-02-12 15:01 - 2015-02-12 15:01 - 00008722 _____ () E:\Documents and Settings\NetworkService\HELP_DECRYPT.HTML
2015-02-12 15:01 - 2015-02-12 15:01 - 00004304 _____ () E:\Documents and Settings\NetworkService\Local Settings\HELP_DECRYPT.TXT
2015-02-12 15:01 - 2015-02-12 15:01 - 00004304 _____ () E:\Documents and Settings\NetworkService\Local Settings\Application Data\HELP_DECRYPT.TXT
2015-02-12 15:01 - 2015-02-12 15:01 - 00004304 _____ () E:\Documents and Settings\NetworkService\HELP_DECRYPT.TXT
2015-02-12 15:01 - 2015-02-12 15:01 - 00000304 _____ () E:\Documents and Settings\NetworkService\Local Settings\HELP_DECRYPT.URL
2015-02-12 15:01 - 2015-02-12 15:01 - 00000304 _____ () E:\Documents and Settings\NetworkService\Local Settings\Application Data\HELP_DECRYPT.URL
2015-02-12 15:01 - 2015-02-12 15:01 - 00000304 _____ () E:\Documents and Settings\NetworkService\HELP_DECRYPT.URL
2015-02-12 14:58 - 2015-02-12 14:58 - 00008722 _____ () E:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.HTML
2015-02-12 14:58 - 2015-02-12 14:58 - 00008722 _____ () E:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.HTML
2015-02-12 14:58 - 2015-02-12 14:58 - 00008722 _____ () E:\Documents and Settings\LocalService\HELP_DECRYPT.HTML
2015-02-12 14:58 - 2015-02-12 14:58 - 00008722 _____ () E:\Documents and Settings\LocalService\Application Data\HELP_DECRYPT.HTML
2015-02-12 14:58 - 2015-02-12 14:58 - 00004304 _____ () E:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.TXT
2015-02-12 14:58 - 2015-02-12 14:58 - 00004304 _____ () E:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.TXT
2015-02-12 14:58 - 2015-02-12 14:58 - 00004304 _____ () E:\Documents and Settings\LocalService\HELP_DECRYPT.TXT
2015-02-12 14:58 - 2015-02-12 14:58 - 00004304 _____ () E:\Documents and Settings\LocalService\Application Data\HELP_DECRYPT.TXT
2015-02-12 14:58 - 2015-02-12 14:58 - 00000304 _____ () E:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.URL
2015-02-12 14:58 - 2015-02-12 14:58 - 00000304 _____ () E:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.URL
2015-02-12 14:58 - 2015-02-12 14:58 - 00000304 _____ () E:\Documents and Settings\LocalService\HELP_DECRYPT.URL
2015-02-12 14:58 - 2015-02-12 14:58 - 00000304 _____ () E:\Documents and Settings\LocalService\Application Data\HELP_DECRYPT.URL
2015-02-12 14:57 - 2015-02-12 14:57 - 00008722 _____ () E:\Documents and Settings\Default User\HELP_DECRYPT.HTML
2015-02-12 14:57 - 2015-02-12 14:57 - 00008722 _____ () E:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.HTML
2015-02-12 14:57 - 2015-02-12 14:57 - 00008722 _____ () E:\Documents and Settings\All Users\HELP_DECRYPT.HTML
2015-02-12 14:57 - 2015-02-12 14:57 - 00008722 _____ () E:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.HTML
2015-02-12 14:57 - 2015-02-12 14:57 - 00004304 _____ () E:\Documents and Settings\Default User\HELP_DECRYPT.TXT
2015-02-12 14:57 - 2015-02-12 14:57 - 00004304 _____ () E:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.TXT
2015-02-12 14:57 - 2015-02-12 14:57 - 00004304 _____ () E:\Documents and Settings\All Users\HELP_DECRYPT.TXT
2015-02-12 14:57 - 2015-02-12 14:57 - 00004304 _____ () E:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.TXT
2015-02-12 14:57 - 2015-02-12 14:57 - 00000304 _____ () E:\Documents and Settings\Default User\HELP_DECRYPT.URL
2015-02-12 14:57 - 2015-02-12 14:57 - 00000304 _____ () E:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.URL
2015-02-12 14:57 - 2015-02-12 14:57 - 00000304 _____ () E:\Documents and Settings\All Users\HELP_DECRYPT.URL
2015-02-12 14:57 - 2015-02-12 14:57 - 00000304 _____ () E:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.URL
2015-02-12 14:44 - 2015-02-13 22:49 - 00000000 ____D () E:\Documents and Settings\Administrator\Local Settings\Application Data\Offics
2015-02-12 13:52 - 2015-02-12 13:52 - 00008722 _____ () E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.HTML
2015-02-12 13:52 - 2015-02-12 13:52 - 00004304 _____ () E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.TXT
2015-02-12 13:52 - 2015-02-12 13:52 - 00000304 _____ () E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.URL
2015-02-11 23:24 - 2015-02-18 19:58 - 00001324 _____ () E:\WINDOWS\system32\d3d9caps.dat
2015-02-10 18:33 - 2015-02-12 21:09 - 00000000 ____D () E:\WINDOWS\FrameworkUpdate
2015-02-10 18:33 - 2015-02-10 18:33 - 00000480 ____H () E:\Documents and Settings\Administrator\Application Data\麽鎒駓覜
2015-02-09 14:58 - 2015-02-18 04:26 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\QusiXunow
2015-02-05 16:42 - 2015-02-18 19:46 - 00000000 ___HD () E:\Documents and Settings\All Users\Application Data\{B712474C-6F53-4096-9C1A-A588B6FC9726}
2015-02-01 10:33 - 2015-02-11 23:52 - 00000000 ____D () E:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-18 19:50 - 2007-11-01 08:53 - 00638600 _____ () E:\WINDOWS\system32\PerfStringBackup.INI
2015-02-18 19:46 - 2007-11-01 18:35 - 00000000 ____D () E:\WINDOWS\ServicePackFiles
2015-02-18 19:46 - 2007-11-01 16:48 - 00000278 ___SH () E:\Documents and Settings\Administrator\ntuser.ini
2015-02-18 19:46 - 2003-06-20 07:00 - 00013646 _____ () E:\WINDOWS\system32\wpa.dbl
2015-02-18 19:45 - 2003-06-20 07:00 - 00001023 _____ () E:\WINDOWS\win.ini
2015-02-18 19:45 - 2003-06-20 07:00 - 00000264 _____ () E:\WINDOWS\System.ini
2015-02-18 19:08 - 2014-06-28 23:39 - 00114904 _____ (Malwarebytes Corporation) E:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-02-18 04:48 - 2007-11-01 16:48 - 00000000 ____D () E:\Documents and Settings\Administrator
2015-02-18 04:29 - 2014-11-30 08:39 - 00000000 ___HD () E:\$AVG
2015-02-17 20:16 - 2010-11-10 21:17 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\MFAData
2015-02-16 19:46 - 2011-11-11 16:51 - 00000000 ____D () E:\ATI
2015-02-16 15:20 - 2014-06-28 23:37 - 00000000 ____D () E:\Program Files\Malwarebytes Anti-Malware
2015-02-16 07:45 - 2007-11-01 16:53 - 00000000 ____D () E:\WINDOWS\pss
2015-02-15 21:26 - 2014-10-12 13:19 - 00131072 _____ () E:\WINDOWS\system32\config\ACEEvent.evt
2015-02-15 21:26 - 2007-11-01 17:22 - 00000000 __HDC () E:\WINDOWS\$NtUninstallKB914388_0$
2015-02-15 20:16 - 2012-12-20 22:11 - 00000000 __SHD () E:\WINDOWS\CSC
2015-02-15 20:13 - 2008-03-08 20:09 - 00000000 ____D () E:\WINDOWS\Microsoft.NET
2015-02-15 20:01 - 2014-08-27 14:08 - 00000358 _____ () E:\WINDOWS\Tasks\AVG-Secure-Search-Update_0814tb_rmv.job
2015-02-15 20:01 - 2009-12-09 18:20 - 00000236 _____ () E:\WINDOWS\Tasks\OGALogon.job
2015-02-15 20:00 - 2014-08-27 14:08 - 00000358 _____ () E:\WINDOWS\Tasks\AVG-Secure-Search-Update_0814tb_rel.job
2015-02-15 20:00 - 2014-04-01 22:16 - 00000238 _____ () E:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job
2015-02-15 20:00 - 2013-06-03 07:41 - 00000350 _____ () E:\WINDOWS\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2015-02-15 20:00 - 2007-11-01 14:59 - 00000006 ____H () E:\WINDOWS\Tasks\SA.DAT
2015-02-13 23:15 - 2007-11-01 08:48 - 00000000 ____D () E:\WINDOWS\security
2015-02-13 23:02 - 2009-12-09 19:51 - 00000000 ___HD () E:\WINDOWS\system32\GroupPolicy
2015-02-13 21:55 - 2014-05-09 21:32 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\AVG2014
2015-02-13 21:55 - 2008-11-02 11:11 - 00000000 __HDC () E:\WINDOWS\$NtUninstallWIC$
2015-02-13 20:04 - 2009-05-22 22:39 - 00000000 ____D () E:\Program Files\AVG
2015-02-13 20:01 - 2014-04-25 09:04 - 00000000 ____D () E:\Documents and Settings\All Users\Start Menu\Programs\AVG
2015-02-13 18:59 - 2007-11-01 17:23 - 00000000 __HDC () E:\WINDOWS\$NtUninstallKB917422_0$
2015-02-12 23:34 - 2011-02-13 11:18 - 00000000 ____D () E:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
2015-02-12 23:34 - 2007-11-05 19:13 - 00000000 ____D () E:\Documents and Settings\Administrator\Start Menu\Programs\CCleaner
2015-02-12 23:33 - 2011-02-13 11:18 - 00000586 _____ () E:\Documents and Settings\All Users\Desktop\CCleaner.lnk
2015-02-12 23:21 - 2014-06-28 23:38 - 00000777 _____ () E:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
2015-02-12 23:21 - 2014-06-28 23:38 - 00000000 ____D () E:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-12 21:09 - 2007-11-01 18:28 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\Mozilla
2015-02-12 15:01 - 2007-11-01 16:48 - 00000000 __SHD () E:\Documents and Settings\NetworkService
2015-02-12 14:58 - 2010-08-19 21:53 - 00000000 ____D () E:\Documents and Settings\NetworkService\Local Settings\Application Data\Chromium
2015-02-12 14:58 - 2010-08-19 13:56 - 00000000 ____D () E:\Documents and Settings\LocalService\Local Settings\Application Data\Chromium
2015-02-12 14:58 - 2008-03-10 16:08 - 00000000 ____D () E:\Documents and Settings\LocalService\Application Data\Mozilla
2015-02-12 14:58 - 2007-11-01 16:48 - 00000000 __SHD () E:\Documents and Settings\LocalService
2015-02-12 14:57 - 2011-05-22 14:54 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\Skype Extras
2015-02-12 14:57 - 2010-08-31 20:51 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2015-02-12 14:57 - 2010-08-19 14:15 - 00000000 ____D () E:\Documents and Settings\LocalService\Application Data\Adobe
2015-02-12 14:57 - 2009-12-31 21:35 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2015-02-12 14:57 - 2007-11-01 14:58 - 00000000 __SHD () E:\Documents and Settings\All Users\DRM
2015-02-12 14:52 - 2009-01-01 13:05 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\Skype
2015-02-12 14:47 - 2012-01-05 19:15 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\Rosetta Stone
2015-02-12 14:40 - 2012-01-02 15:25 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\Real
2015-02-12 14:40 - 2008-12-25 22:21 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\RocketReader
2015-02-12 14:40 - 2008-11-30 15:43 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\Pure Networks
2015-02-12 14:39 - 2013-09-17 21:21 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\Logitech
2015-02-12 14:39 - 2011-07-04 23:07 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\MediaMall
2015-02-12 14:37 - 2011-03-29 19:20 - 00000000 ___HD () E:\Documents and Settings\All Users\Application Data\CanonBJ
2015-02-12 14:37 - 2010-03-19 18:20 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\LogiShrd
2015-02-12 14:37 - 2009-12-09 21:41 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\Lavasoft
2015-02-12 14:37 - 2009-02-21 19:00 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\D1A5
2015-02-12 14:36 - 2009-10-07 20:12 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\avg9
2015-02-12 14:30 - 2010-08-16 15:45 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\1B109
2015-02-12 14:30 - 2010-06-24 21:13 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\8128
2015-02-12 14:30 - 2010-05-10 20:32 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\1EDA
2015-02-12 14:30 - 2010-05-03 20:44 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\212DE
2015-02-12 14:30 - 2010-04-12 18:44 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\371B5
2015-02-12 14:30 - 2010-01-30 19:10 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\29222
2015-02-12 14:30 - 2010-01-17 03:20 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\1B1A5
2015-02-12 14:30 - 2009-12-19 22:55 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\2D3C8
2015-02-12 14:30 - 2009-07-06 21:21 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\36FA
2015-02-12 14:30 - 2009-04-16 20:43 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\272A3
2015-02-12 14:30 - 2009-03-23 21:52 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\30392
2015-02-12 14:30 - 2008-08-06 20:57 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\Apple Computer
2015-02-12 14:30 - 2007-11-05 19:08 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\AOL OCP
2015-02-12 14:29 - 2013-01-17 18:10 - 00000000 ____D () E:\Documents and Settings\Administrator\Local Settings\Application Data\NETGEARGenie
2015-02-12 14:29 - 2012-01-02 17:33 - 00000000 ____D () E:\Documents and Settings\Administrator\Local Settings\Application Data\Nero
2015-02-12 14:29 - 2010-04-18 19:27 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\1336B
2015-02-12 14:29 - 2009-07-30 16:57 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\11E4
2015-02-12 14:29 - 2007-11-16 16:30 - 00000000 ____D () E:\Documents and Settings\Administrator\Local Settings\Application Data\The Weather Channel
2015-02-12 14:25 - 2011-12-14 18:16 - 00000000 ____D () E:\Documents and Settings\Administrator\Local Settings\Application Data\adaware
2015-02-12 14:25 - 2010-03-19 18:31 - 00000000 ____D () E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd
2015-02-12 14:25 - 2007-11-02 05:58 - 00000000 ____D () E:\Documents and Settings\Administrator\Local Settings\Application Data\Google
2015-02-12 13:52 - 2010-03-19 21:54 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\Skype
2015-02-12 13:52 - 2007-11-12 19:18 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\Winamp
2015-02-12 13:51 - 2012-11-11 11:00 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\Samsung
2015-02-12 13:51 - 2007-11-16 16:29 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\Real
2015-02-12 13:50 - 2007-11-07 17:54 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2
2015-02-12 13:28 - 2011-03-29 19:37 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\Canon
2015-02-12 13:28 - 2007-11-05 20:46 - 00000000 ____D () E:\Documents and Settings\Administrator\Application Data\Adobe
2015-02-11 06:47 - 2010-05-23 20:00 - 00000486 _____ () E:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
2015-02-11 04:23 - 2013-07-21 13:59 - 00000000 ____D () E:\WINDOWS\system32\MRT
2015-02-11 03:32 - 2008-03-14 20:34 - 00000000 ____D () E:\Documents and Settings\All Users\Application Data\Microsoft Help
2015-02-10 19:35 - 2011-09-11 12:42 - 00252288 ____R (Coupons, Inc.) E:\WINDOWS\system32\cpnprt2.cid
2015-02-10 14:17 - 2014-04-01 22:16 - 00000232 _____ () E:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job
2015-02-08 12:00 - 2013-02-27 22:02 - 00000960 _____ () E:\WINDOWS\Tasks\Ad-Aware Antivirus Scheduled Scan.job
2015-02-01 11:51 - 2013-10-30 09:38 - 00000000 ____D () E:\Program Files\Mozilla Maintenance Service
2015-01-29 17:49 - 2007-11-01 17:25 - 113756392 _____ (Microsoft Corporation) E:\WINDOWS\system32\MRT.exe

==================== Files in the root of some directories =======

2013-11-10 23:36 - 2014-06-22 09:04 - 0003728 _____ () E:\Program Files\Mozilla Firefoxavg-secure-search.xml
2008-12-06 16:45 - 2008-12-06 17:28 - 0000084 _____ () E:\Program Files\RobotError.log
2015-02-12 13:52 - 2015-02-12 13:52 - 0008722 _____ () E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.HTML
2015-02-12 13:52 - 2015-02-12 13:52 - 0046037 _____ () E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.PNG
2015-02-12 13:52 - 2015-02-12 13:52 - 0004304 _____ () E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.TXT
2015-02-12 13:52 - 2015-02-12 13:52 - 0000304 _____ () E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.URL
2015-02-18 08:27 - 2015-02-18 17:57 - 0128512 _____ (LinerIntersects) E:\Documents and Settings\Administrator\Application Data\svcxdcl32.exe
2009-04-10 18:26 - 2009-04-10 18:26 - 0001028 _____ () E:\Documents and Settings\Administrator\Application Data\WavCodec.wff
2015-02-10 18:33 - 2015-02-10 18:33 - 0000480 ____H () E:\Documents and Settings\Administrator\Application Data\麽鎒駓覜
2015-02-14 13:09 - 2015-02-14 13:09 - 0000664 _____ () E:\Documents and Settings\Administrator\Local Settings\Application Data\d3d9caps.dat
2008-04-03 13:31 - 2011-09-12 13:58 - 0019968 _____ () E:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-08-16 20:03 - 2012-08-16 20:03 - 0027520 _____ () E:\Documents and Settings\Administrator\Local Settings\Application Data\dt.dat
2008-03-08 20:17 - 2008-03-08 20:17 - 0000136 _____ () E:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat
2009-12-13 12:39 - 2011-10-23 08:28 - 0000000 ____C () E:\Documents and Settings\Administrator\Local Settings\Application Data\prvlcl.dat
2015-02-18 07:58 - 2015-02-18 08:00 - 0000153 _____ () E:\Documents and Settings\Administrator\Local Settings\Application Data\svcxdcl32.dat
2015-02-18 07:58 - 2015-02-18 07:58 - 0122368 _____ (PetitionersRavenous) E:\Documents and Settings\Administrator\Local Settings\Application Data\svcxdcl32.exe
2015-02-12 14:57 - 2015-02-12 14:57 - 0008722 _____ () E:\Documents and Settings\All Users\HELP_DECRYPT.HTML
2015-02-12 14:57 - 2015-02-12 14:57 - 0046037 _____ () E:\Documents and Settings\All Users\HELP_DECRYPT.PNG
2015-02-12 14:57 - 2015-02-12 14:57 - 0004304 _____ () E:\Documents and Settings\All Users\HELP_DECRYPT.TXT
2015-02-12 14:57 - 2015-02-12 14:57 - 0000304 _____ () E:\Documents and Settings\All Users\HELP_DECRYPT.URL

Files to move or delete:
====================
E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

E:\WINDOWS\explorer.exe => File is digitally signed
E:\WINDOWS\system32\winlogon.exe => File is digitally signed
E:\WINDOWS\system32\svchost.exe => File is digitally signed
E:\WINDOWS\system32\services.exe => File is digitally signed
E:\WINDOWS\system32\User32.dll => File is digitally signed
E:\WINDOWS\system32\userinit.exe => File is digitally signed
E:\WINDOWS\system32\rpcss.dll => File is digitally signed
E:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================


----------



## joshadam84 (Feb 18, 2015)

Addition:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 18-02-2015 01
Ran by Administrator at 2015-02-18 20:01:48
Running from F:\Documents and Settings\Administrator\My Documents\Downloads
Boot Mode: Safe Mode (with Networking)
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: AVG update module (Disabled - Up to date) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: AVG Firewall (Disabled) {8decf618-9569-4340-b34a-d78d28969b66}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-1275210071-764733703-839522115-500\...\uTorrent) (Version: 3.4.1.30740 - BitTorrent Inc.)
802.11g USB2.0 adapter (HKLM\...\{5797A1D5-2C08-4FF1-B4B4-EA25760CA543}) (Version: 1.00.0001.1 - WLAN)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.0.3.13070 - Adobe Systems Inc.)
Adobe Flash Player 11 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.7.700.224 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Media Player (HKLM\...\com.adobe.amp.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.)
AMD Catalyst Install Manager (HKLM\...\{23CA9123-B1AA-C4B6-6997-7756BBAEC461}) (Version: 3.0.847.0 - Advanced Micro Devices, Inc.)
Apple Mobile Device Support (HKLM\...\{CACAEB5F-174D-4C7C-AC56-A33289A807CA}) (Version: 3.4.0.25 - Apple Inc.)
Apple Software Update (HKLM\...\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}) (Version: 2.1.1.116 - Apple Inc.)
ATI - Software Uninstall Utility (HKLM\...\All ATI Software) (Version: 6.14.10.1022 - )
ATI AVIVO Codecs (HKLM\...\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}) (Version: 10.0.0.40103 - ATI Technologies Inc.)
ATI Catalyst Control Center (HKLM\...\{055EE59D-217B-43A7-ABFF-507B966405D8}) (Version: 2.010.0210.2338 - )
ATI Display Driver (HKLM\...\ATI Display Driver) (Version: 8.593.100-100210a-095952E-ATI - )
Audio Transcoder (HKLM\...\{0EDB29CF-5FFC-4824-9F13-3D1C4286CA98}_is1) (Version: 2.9 - Digital Music Software)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5646 - AVG Technologies)
AVG 2015 (Version: 15.0.4284 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5646 - AVG Technologies) Hidden
BitTorrent (HKLM\...\BitTorrent) (Version: 7.6.0 - BitTorrent Inc.)
BSR Screen Recorder 6 (HKLM\...\BSRScreenRecorder6) (Version: - )
CameraHelperMsi (Version: 13.30.1395.0 - Logitech) Hidden
Canon Easy-WebPrint EX (HKLM\...\Easy-WebPrint EX) (Version: - )
Canon MP Navigator EX 3.0 (HKLM\...\MP Navigator EX 3.0) (Version: - )
Canon MP250 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP250_series) (Version: - )
Canon MP250 series User Registration (HKLM\...\Canon MP250 series User Registration) (Version: - )
Canon Utilities Easy-PhotoPrint EX (HKLM\...\Easy-PhotoPrint EX) (Version: - )
Canon Utilities My Printer (HKLM\...\CanonMyPrinter) (Version: - )
Canon Utilities Solution Menu (HKLM\...\CanonSolutionMenu) (Version: - )
ccc-core-preinstall (Version: 2010.0210.2339.42455 - ATI) Hidden
ccc-core-static (Version: 2010.0210.2339.42455 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Critical Update for Windows Media Player 11 (KB959772) (HKLM\...\KB959772_WM11) (Version: - Microsoft Corporation)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 4.41.3.0173 - DT Soft Ltd)
dj_sf_software (Version: 90.0.235.000 - Hewlett-Packard) Hidden
erLT (Version: 1.20.138.34 - Logitech, Inc.) Hidden
ESPN Java Check (HKU\S-1-5-21-1275210071-764733703-839522115-500\...\ESPN Java Check) (Version: - ESPN Internet Ventures)
Free WMA to MP3 Converter 1.16 (HKLM\...\Free WMA to MP3 Converter_is1) (Version: - Jodix Technologies Ltd.)
Guru Utility 2.0.2.1 (HKLM\...\Guru Utility_is1) (Version: - Golf Guru)
High Definition Audio Driver Package - KB835221 (HKLM\...\KB835221WXP) (Version: 20040219.000000 - Microsoft Corporation)
HiJackThis (HKLM\...\{45A66726-69BC-466B-A7A4-12FCBA4883D7}) (Version: 1.0.0 - Trend Micro)
iMacros Version 10.0.2.2823 (x86) (HKLM\...\{9C5118F7-E26D-4fc0-B7F4-4A067A0808FA}_is1) (Version: 10.0.2.2823 - Ipswitch, Inc)
ImagXpress (Version: 7.0.74.0 - Nero AG) Hidden
J2SE Runtime Environment 5.0 Update 2 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0150020}) (Version: 1.5.0.20 - Sun Microsystems, Inc.)
Java(TM) 6 Update 17 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216013FF}) (Version: 6.0.170 - Sun Microsystems, Inc.)
Java(TM) 6 Update 3 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160030}) (Version: 1.6.0.30 - Sun Microsystems, Inc.)
Linksys EasyLink Advisor (HKLM\...\InstallShield_{7FE3214C-283E-40C6-A8D5-CB773110090C}) (Version: 3.0.8122.29 - Linksys, Cisco System.)
Linksys EasyLink Advisor (Version: 3.0.8122.29 - Linksys, Cisco System.) Hidden
LiveUpdate (HKLM\...\InstallShield_{BAFA84F8-5A33-4ACD-AD10-58356B27A0F1}) (Version: 1.01 - LiveUpdate)
LiveUpdate (Version: 1.01 - LiveUpdate) Hidden
Logitech Vid (HKLM\...\{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}) (Version: 1.50.1043 - Logitech Inc.)
Logitech Webcam Software (HKLM\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.30 - Logitech Inc.)
Logitech Webcam Software Driver Package (HKLM\...\lvdrivers_12.10) (Version: 12.10.1110 - Logitech Inc.)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2698023) (HKLM\...\M2698023) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2833941) (HKLM\...\M2833941) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version: - )
Microsoft .NET Framework 2.0 Service Pack 2 (HKLM\...\{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}) (Version: 2.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.0 Service Pack 2 (HKLM\...\{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}) (Version: 3.2.30729 - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Compression Client Pack 1.0 for Windows XP (HKLM\...\MSCompPackV1) (Version: 1 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-0013-0000-0000-0000000FF1CE}_BASICR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-0019-0000-0000-0000000FF1CE}_PUBLISHERR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Basic 2007 (HKLM\...\BASICR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM\...\{95120000-0122-0409-0000-0000000FF1CE}) (Version: 12.0.6423.1000 - Microsoft Corporation)
Microsoft Office Professional 2007 (HKLM\...\PROR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Publisher 2007 (HKLM\...\PUBLISHERR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM\...\{90850409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office XP Professional with FrontPage (HKLM\...\{90280409-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft User-Mode Driver Framework Feature Pack 1.0 (HKLM\...\Wudf01000) (Version: - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 35.0 (x86 en-US) (HKLM\...\Mozilla Firefox 35.0 (x86 en-US)) (Version: 35.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 6.0 Parser (KB933579) (HKLM\...\{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}) (Version: 6.10.1200.0 - Microsoft Corporation)
O&O Defrag Free Edition (HKLM\...\{E29CFB36-F070-4612-8DB5-7038161B6294}) (Version: 14.1.431 - O&O Software GmbH)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
Protected Music Converter 1.2 (HKLM\...\Protected Music Converter_is1) (Version: 1.2 - WMA-MP3.com)
Pure Networks Platform (Version: 10.1.8116.1 - Pure Networks) Hidden
QuickTime (HKLM\...\{57752979-A1C9-4C02-856B-FBB27AC4E02C}) (Version: 7.69.80.9 - Apple Inc.)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - )
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Rosetta Stone Version 3 (HKLM\...\{80F7CA44-F3A5-4853-8BA6-DDF57CD4F078}) (Version: 3.4.7.0 - Rosetta Stone Ltd.)
Samsung AllShare (HKLM\...\InstallShield_{DF47ACA3-7C78-4C08-8007-AC682563C9F1}) (Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.)
Samsung AllShare (Version: 2.1.0.12031_10 - Samsung Electronics Co., Ltd.) Hidden
Samsung USB Driver (MCCI 4.34) WHQL v3.0 (HKLM\...\InstallShield_{FAD03728-DA19-4313-959F-872A9C432A86}) (Version: 4.34 - Samsung)
Samsung USB Driver (MCCI 4.34) WHQL v3.0 (Version: 4.34 - Samsung) Hidden
Skins (Version: 2010.0210.2339.42455 - ATI) Hidden
Skype 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Sothink FLV Player (HKLM\...\{CAAB0192-5704-469F-A0BE-2D842D70E93B}_is1) (Version: 2.2 - SourceTec Software Co., LTD)
StreamTorrent 1.0 (HKLM\...\StreamTorrent 1.0) (Version: - )
Switch Sound File Converter (HKLM\...\Switch) (Version: - NCH Software)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
UnloadSupport (Version: 9.0.0 - Hewlett-Packard) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-0013-0000-0000-0000000FF1CE}_BASICR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-0014-0000-0000-0000000FF1CE}_PROR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-0019-0000-0000-0000000FF1CE}_PUBLISHERR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
USB Video Driver (HKLM\...\{2758691A-2CDE-4942-A4AC-0E8F61FE2067}) (Version: 1.00 - EETI)
Veo Advanced Connect (HKLM\...\{C44CB060-2AD1-11D6-BC84-00D0B7E10CD1}) (Version: - )
Visual C++ 2008 x86 Runtime - v9.0.30729.01 (HKLM\...\{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01) (Version: 9.0.30729.01 - Microsoft Corporation)
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
W Photo Studio (HKLM\...\{CBF3C503-946E-45EA-B347-EACC41781989}) (Version: 1.0.0.143 - Walgreens)
WavePad Sound Editor (HKLM\...\WavePad) (Version: - NCH Software)
WebFldrs XP (Version: 9.50.6513 - Microsoft Corporation) Hidden
Winamp (HKLM\...\Winamp) (Version: 5.5 - Nullsoft, Inc)
WinDirStat 1.1.2 (HKU\S-1-5-21-1275210071-764733703-839522115-500\...\WinDirStat) (Version: - )
Windows 7 Upgrade Advisor (HKLM\...\{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}) (Version: 2.0.5000.0 - Microsoft Corporation)
Windows Driver Package - Advanced Micro Devices, Inc. (USB28xxBGA) Media (08/31/2007 5.7.0831.0) (HKLM\...\9722CA1E8F72F362E93CBEC75A707FDABFC8D880) (Version: 08/31/2007 5.7.0831.0 - Advanced Micro Devices, Inc.)
Windows Driver Package - eMPIA Technology Inc, (emAudio) MEDIA (08/31/2007 5.7.0831.0) (HKLM\...\69083DC58646DE46A09847A522A1CC487F918039) (Version: 08/31/2007 5.7.0831.0 - eMPIA Technology Inc,)
Windows Driver Package - FTDI CDM Driver Package (03/13/2008 2.04.06) (HKLM\...\A106663FD3361BDFACB045D83EBA03858EB1E411) (Version: 03/13/2008 2.04.06 - FTDI)
Windows Driver Package - FTDI CDM Driver Package (03/13/2008 2.04.06) (HKLM\...\F2F24872454C7CAEAABD8BB063F70FBEFF01989D) (Version: 03/13/2008 2.04.06 - FTDI)
Windows Genuine Advantage Notifications (KB905474) (HKLM\...\WgaNotify) (Version: 1.9.0040.0 - Microsoft Corporation)
Windows Genuine Advantage Validation Tool (KB892130) (HKLM\...\KB892130) (Version: - Microsoft Corporation)
Windows Imaging Component (HKLM\...\WIC) (Version: 3.0.0.0 - Microsoft Corporation)
Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (HKLM\...\{10A44844-4465-456E-8C97-80BDD4F68845}) (Version: 6.500.3146.0 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{B10914FD-8812-47A4-85A1-50FCDE7F1F33}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Upload Tool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Format 11 runtime (HKLM\...\Windows Media Format Runtime) (Version: - )
Windows Media Player 11 (HKLM\...\Windows Media Player) (Version: - )
Windows Media Player Firefox Plugin (HKLM\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows PowerShell(TM) 1.0 (HKLM\...\KB926139-v2) (Version: 2 - Microsoft Corporation)
Windows Search 4.0 (HKLM\...\KB940157) (Version: 04.00.6001.503 - Microsoft Corporation)
Windows XP Service Pack 3 (HKLM\...\Windows XP Service Pack) (Version: 20080414.031525 - Microsoft Corporation)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - )
Xiph.Org Open Codecs 0.85.17777 (HKLM\...\Open Codecs) (Version: 0.85.17777 - Xiph.Org)
XML Paper Specification Shared Components Pack 1.0 (Version: - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1275210071-764733703-839522115-500_Classes\CLSID\{1DCB3A00-33ED-11D3-8470-00C04F79DBC0}\InprocServer32 -> E:\WINDOWS\system32\WMDMPS.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1275210071-764733703-839522115-500_Classes\CLSID\{97090E2F-3062-4459-855B-014F0D3CDBB1}\InprocServer32 -> E:\Program Files\Windows Desktop Search\deskbar.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1275210071-764733703-839522115-500_Classes\CLSID\{B81719BE-BAEF-4631-9692-F216D41EF50D}\InprocServer32 -> E:\Documents and Settings\All Users\Application Data\{B712474C-6F53-4096-9C1A-A588B6FC9726}\zipfldr.dll (America Online)
CustomCLSID: HKU\S-1-5-21-1275210071-764733703-839522115-500_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 -> E:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

==================== Restore Points =========================

ATTENTION: System Restore is disabled.

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2003-06-20 07:00 - 2009-11-13 22:54 - 00000736 ____A E:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: E:\WINDOWS\Tasks\Ad-Aware Antivirus Scheduled Scan.job => E:\PROGRA~1\AD-AWA~1\AdAwareLauncher.exe
Task: E:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job => E:\Program Files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe
Task: E:\WINDOWS\Tasks\Adobe Flash Player Updater.job => E:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: E:\WINDOWS\Tasks\AppleSoftwareUpdate.job => E:\Program Files\Apple Software Update\SoftwareUpdate.exe
Task: E:\WINDOWS\Tasks\AVG-Secure-Search-Update_0814tb_rel.job => E:\Program Files\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe
Task: E:\WINDOWS\Tasks\AVG-Secure-Search-Update_0814tb_rmv.job => E:\Program Files\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe
Task: E:\WINDOWS\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => E:\WINDOWS\TEMP\{3C6CCA4B-C373-4F8D-97E0-C32DA39AD8B6}.exe <==== ATTENTION
Task: E:\WINDOWS\Tasks\CryptoUpdate.job => E:\WINDOWS\system32\regsvr32.exe
Task: E:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => E:\WINDOWS\system32\xp_eos.exe
Task: E:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => E:\WINDOWS\system32\xp_eos.exe
Task: E:\WINDOWS\Tasks\OGALogon.job => E:\WINDOWS\system32\OGAEXEC.exe
Task: E:\WINDOWS\Tasks\RealUpgradeLogonTaskS-1-5-21-1275210071-764733703-839522115-500.job => E:\Program Files\Real\RealUpgrade\realupgrade.exe
Task: E:\WINDOWS\Tasks\RealUpgradeScheduledTaskS-1-5-21-1275210071-764733703-839522115-500.job => E:\Program Files\Real\RealUpgrade\realupgrade.exe

==================== Loaded Modules (whitelisted) ==============

2008-05-30 23:05 - 2007-09-20 17:34 - 00129024 _____ () E:\Program Files\WinRAR\rarext.dll
2003-06-20 07:00 - 2014-03-12 05:48 - 00205824 ____R () E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: E:\Documents and Settings\All Users\Application Data\TEMP:24051EFF
AlternateDataStreams: E:\Documents and Settings\All Users\Application Data\TEMP:4B7BEAFF
AlternateDataStreams: E:\Documents and Settings\All Users\Application Data\TEMP:723BF4A6
AlternateDataStreams: E:\Documents and Settings\All Users\Application Data\TEMP:C39E55C5

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMSwissArmy => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMSwissArmy => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\UploadMgr => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1275210071-764733703-839522115-500\Control Panel\Desktop\\Wallpaper -> E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
DNS Servers: 8.8.8.8

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.HTML => E:\WINDOWS\pss\HELP_DECRYPT.HTMLStartup
MSCONFIG\startupfolder: E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.PNG => E:\WINDOWS\pss\HELP_DECRYPT.PNGStartup
MSCONFIG\startupfolder: E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.TXT => E:\WINDOWS\pss\HELP_DECRYPT.TXTStartup
MSCONFIG\startupfolder: E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.URL => E:\WINDOWS\pss\HELP_DECRYPT.URLStartup
MSCONFIG\startupfolder: E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^txklyboag.exe => E:\WINDOWS\pss\txklyboag.exeStartup
MSCONFIG\startupfolder: E:^Documents and Settings^All Users^Start Menu^Programs^Startup^BDARemote.lnk => E:\WINDOWS\pss\BDARemote.lnkCommon Startup
MSCONFIG\startupreg: Aim6 => 
MSCONFIG\startupreg: DAEMON Tools Lite => "E:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: DW4 => "E:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
MSCONFIG\startupreg: Integrio Uptime Scout => "E:\Program Files\Integrio Uptime Scout\Scout.exe"
MSCONFIG\startupreg: iTunesHelper => "E:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KernelFaultCheck => %systemroot%\system32\dumprep 0 -k
MSCONFIG\startupreg: Logitech Vid => "E:\Program Files\Logitech\Logitech Vid\Vid.exe" -bootmode
MSCONFIG\startupreg: LWS => E:\Program Files\Logitech\LWS\Webcam Software\LWS.exe -hide
MSCONFIG\startupreg: mckunie => rundll32 "E:\Documents and Settings\Administrator\Local Settings\Application Data\mckunie.dll",mckunie
MSCONFIG\startupreg: Messenger (Yahoo!) => "E:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet
MSCONFIG\startupreg: MSMSGS => "E:\PROGRA~1\MESSEN~1\Msmsgs.exe" /background
MSCONFIG\startupreg: NetworkUpdater => E:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\temp2206694968.exe
MSCONFIG\startupreg: OODefragTray => E:\Program Files\OO Software\Defrag\oodtray.exe
MSCONFIG\startupreg: PlayOn => E:\Program Files\MediaMall\PlayOn.exe
MSCONFIG\startupreg: QuickTime Task => "F:\Program Files\QuickTime\qttask.exe" -atboottime
MSCONFIG\startupreg: QusiXunow => regsvr32.exe "E:\Documents and Settings\All Users\Application Data\QusiXunow\IaycUlkez.cql"
MSCONFIG\startupreg: Skype => "E:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
MSCONFIG\startupreg: SpiralFrog => E:\Program Files\SpiralFrog\Spiralfrog.exe
MSCONFIG\startupreg: Svc2dll => E:\Documents and Settings\Administrator\Application Data\svcxdcl32.exe
MSCONFIG\startupreg: timynay => rundll32 "E:\Documents and Settings\Administrator\Local Settings\Application Data\timynay.dll",timynay
MSCONFIG\startupreg: TkBellExe => "E:\program files\real\realplayer\update\realsched.exe" -osboot
MSCONFIG\startupreg: uTorrent => "E:\Documents and Settings\Administrator\Application Data\uTorrent\uTorrent.exe" /MINIMIZED
MSCONFIG\startupreg: {78E0C144-A42C-5B8B-7953-4044373C80A0} => "E:\Documents and Settings\Administrator\Application Data\Uvila\ofom.exe"

==================== Accounts: =============================

Administrator (S-1-5-21-1275210071-764733703-839522115-500 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator
ASPNET (S-1-5-21-1275210071-764733703-839522115-1003 - Limited - Enabled)
Guest (S-1-5-21-1275210071-764733703-839522115-501 - Limited - Enabled)
HelpAssistant (S-1-5-21-1275210071-764733703-839522115-1000 - Limited - Disabled)
SUPPORT_388945a0 (S-1-5-21-1275210071-764733703-839522115-1002 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: HID Non-User Input Data Filter (KB 911895)
Description: HID Non-User Input Data Filter (KB 911895)
Class Guid: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
Manufacturer: Microsoft
Service: NuidFltr
Problem: : Windows cannot initialize the device driver for this hardware. (Code 37)
Resolution: The driver returned failure from its DriverEntry routine. Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver.

==================== Event log errors: =========================

Application errors:
==================
Error: (02/15/2015 08:02:26 PM) (Source: SamsungAllShareV2.0) (EventID: 0) (User: )
Description: Service cannot be started. System.Runtime.InteropServices.COMException (0x80010002): Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED))
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
at System.Management.ManagementScope.InitializeGuts(Object o)
at System.Management.ManagementScope.Initialize()
at System.Management.ManagementEventWatcher.Initialize()
at System.Management.ManagementEventWatcher.Start()
at AllShareDmsUtil.Manager.AllShareDmsManager.InitEventWatcher()
at AllShareDmsUtil.Manager.AllShareDmsManager.Initialize()
at AllShareDmsUtil.Manager.AllShareDmsManager..ctor()
at AllShareDmsUtil.Manager.AllShareDmsManager.get_Instance()
at AllShareDMS.AllShareDMS.DoStart()
at AllShareDMS.AllShareDMS.OnStart(String[] args)
at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (02/15/2015 07:48:05 PM) (Source: SamsungAllShareV2.0) (EventID: 0) (User: )
Description: Service cannot be started. System.Runtime.InteropServices.COMException (0x80010002): Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED))
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
at System.Management.ManagementScope.InitializeGuts(Object o)
at System.Management.ManagementScope.Initialize()
at System.Management.ManagementEventWatcher.Initialize()
at System.Management.ManagementEventWatcher.Start()
at AllShareDmsUtil.Manager.AllShareDmsManager.InitEventWatcher()
at AllShareDmsUtil.Manager.AllShareDmsManager.Initialize()
at AllShareDmsUtil.Manager.AllShareDmsManager..ctor()
at AllShareDmsUtil.Manager.AllShareDmsManager.get_Instance()
at AllShareDMS.AllShareDMS.DoStart()
at AllShareDMS.AllShareDMS.OnStart(String[] args)
at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (02/15/2015 02:55:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application explorer.exe, version 6.0.2900.5512, faulting module unknown, version 0.0.0.0, fault address 0x04ef9bcc.
Processing media-specific event for [explorer.exe!ws!]

Error: (02/13/2015 04:33:35 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (02/13/2015 04:33:35 AM) (Source: crypt32) (EventID: 11) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (02/12/2015 10:09:49 PM) (Source: SamsungAllShareV2.0) (EventID: 0) (User: )
Description: Service cannot be started. System.Runtime.InteropServices.COMException (0x80010002): Call was canceled by the message filter. (Exception from HRESULT: 0x80010002 (RPC_E_CALL_CANCELED))
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
at System.Management.ManagementScope.InitializeGuts(Object o)
at System.Management.ManagementScope.Initialize()
at System.Management.ManagementEventWatcher.Initialize()
at System.Management.ManagementEventWatcher.Start()
at AllShareDmsUtil.Manager.AllShareDmsManager.InitEventWatcher()
at AllShareDmsUtil.Manager.AllShareDmsManager.Initialize()
at AllShareDmsUtil.Manager.AllShareDmsManager..ctor()
at AllShareDmsUtil.Manager.AllShareDmsManager.get_Instance()
at AllShareDMS.AllShareDMS.DoStart()
at AllShareDMS.AllShareDMS.OnStart(String[] args)
at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Error: (02/12/2015 04:37:52 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application , version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000.
Processing media-specific event for [!ws!]

Error: (02/12/2015 01:26:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application svchost.exe, version 5.1.2600.5512, faulting module unknown, version 0.0.0.0, fault address 0x04ac8bcc.
Processing media-specific event for [svchost.exe!ws!]

Error: (02/11/2015 08:59:20 PM) (Source: ESENT) (EventID: 439) (User: )
Description: wuauclt (8172) Unable to write a shadowed header for file E:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb. Error -1808.

Error: (02/11/2015 08:59:20 PM) (Source: ESENT) (EventID: 488) (User: )
Description: wuauclt (8172) An attempt to create the file "E:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb" failed with system error 112 (0x00000070): "There is not enough space on the disk. ". The create file operation will fail with error -1808 (0xfffff8f0).

System errors:
=============
Error: (02/18/2015 07:48:14 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load: 
Avgdiskx
AVGIDSDriverl
AVGIDSShim
Avgldx86
Fips
intelppm
Lbd

Error: (02/18/2015 07:48:14 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: The AVGIDSAgent service depends on the AVGIDSDriverl service which failed to start because of the following error: 
%%31

Error: (02/18/2015 07:47:04 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (02/18/2015 07:46:13 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (02/18/2015 07:35:07 PM) (Source: DCOM) (EventID: 10010) (User: JOSH-H)
Description: The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

Error: (02/18/2015 07:34:26 PM) (Source: DCOM) (EventID: 10010) (User: JOSH-H)
Description: The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

Error: (02/18/2015 07:33:45 PM) (Source: DCOM) (EventID: 10010) (User: JOSH-H)
Description: The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

Error: (02/18/2015 07:33:04 PM) (Source: DCOM) (EventID: 10010) (User: JOSH-H)
Description: The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

Error: (02/18/2015 07:32:23 PM) (Source: DCOM) (EventID: 10010) (User: JOSH-H)
Description: The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

Error: (02/18/2015 07:31:42 PM) (Source: DCOM) (EventID: 10010) (User: JOSH-H)
Description: The server {0002DF01-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

Microsoft Office Sessions:
=========================
Error: (12/20/2009 02:16:40 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 77623 seconds with 300 seconds of active time. This session ended with a crash.

==================== Memory info ===========================

Processor: Genuine Intel(R) CPU 2140 @ 1.60GHz
Percentage of memory in use: 33%
Total physical RAM: 2046.42 MB
Available physical RAM: 1352.53 MB
Total Pagefile: 4966.36 MB
Available Pagefile: 4374.5 MB
Total Virtual: 2047.88 MB
Available Virtual: 1925.31 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:48.83 GB) (Free:15.53 GB) NTFS ==>[Drive with boot components (Windows XP)]
Drive e: () (Fixed) (Total:39.06 GB) (Free:7.48 GB) NTFS
Drive f: (New Volume) (Fixed) (Total:61.16 GB) (Free:27.27 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 149 GB) (Disk ID: 02CD02CD)
Partition 1: (Active) - (Size=48.8 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=100.2 GB) - (Type=OF Extended)

==================== End Of Log ============================


----------



## joshadam84 (Feb 18, 2015)

Shortcut (1 of 2):

Users shortcut scan result (x86) Version: 18-02-2015 01
Ran by Administrator at 2015-02-18 20:13:57
Running from F:\Documents and Settings\Administrator\My Documents\Downloads
Boot Mode: Safe Mode (with Networking)
==================== Shortcuts =============================
(The entries could be listed to be restored or removed.)

Shortcut: E:\Documents and Settings\Administrator\Start Menu\µTorrent.lnk -> E:\Documents and Settings\Administrator\Application Data\uTorrent\uTorrent.exe (No File)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk -> E:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\WinRAR\Console RAR manual.lnk -> E:\Program Files\WinRAR\Rar.txt ()
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\WinRAR\WinRAR help.lnk -> E:\Program Files\WinRAR\WinRAR.chm ()
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\WinRAR\WinRAR.lnk -> E:\Program Files\WinRAR\WinRAR.exe ()
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\WinDirStat\Help (ENG).lnk -> E:\Program Files\WinDirStat\windirstat.chm ()
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\WinDirStat\Uninstall WinDirStat.lnk -> E:\Program Files\WinDirStat\Uninstall.exe (WDS Team)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\WinDirStat\WinDirStat.lnk -> E:\Program Files\WinDirStat\windirstat.exe (Seifert)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\msg.lnk -> E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe ()
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\HiJackThis\HiJackThis.lnk -> E:\Documents and Settings\Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe (Trend Micro Inc.)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Convar\PC Inspector File Recovery\PC Inspector File Recovery Help.lnk -> E:\Program Files\Convar\PC Inspector File Recovery\help.chm ()
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Convar\PC Inspector File Recovery\PC Inspector File Recovery.lnk -> E:\Program Files\Convar\PC Inspector File Recovery\Filerecovery.exe ()
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Convar\PC Inspector File Recovery\Uninstaller.lnk -> E:\Program Files\Convar\PC Inspector File Recovery\Uninstall.exe ()
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\CCleaner\CCleaner.lnk -> F:\Program Files\CCleaner\CCleaner.exe (Piriform Ltd)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\BSR Screen Recorder 6\BSR Screen Recorder 6.lnk -> C:\Download\BSR Screen Recorder 6\Screen Recorder 6.exe (BSRSoft)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\BSR Screen Recorder 6\Screen Recorder 6 Help.lnk -> C:\Download\BSR Screen Recorder 6\BSR6.chm ()
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\BSR Screen Recorder 6\Uninstall Screen Recorder 6.lnk -> C:\Download\BSR Screen Recorder 6\Uninstall Screen Recorder 6.exe (BSRSoft)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Address Book.lnk -> E:\Program Files\Outlook Express\wab.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Command Prompt.lnk -> E:\WINDOWS\system32\cmd.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Notepad.lnk -> E:\WINDOWS\system32\notepad.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Synchronize.lnk -> E:\WINDOWS\system32\mobsync.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Tour Windows XP.lnk -> E:\WINDOWS\system32\tourstart.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Windows Explorer.lnk -> E:\WINDOWS\explorer.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\System Tools\Syscheck.lnk -> E:\Program Files\Super Yahoo Messenger Archive Decoder\xtrt.exe (No File)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk -> E:\WINDOWS\system32\magnify.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk -> E:\WINDOWS\system32\narrator.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk -> E:\WINDOWS\system32\osk.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Administrator\NetHood\Users on Karenmurray-pc\target.lnk -> \\KARENMURRAY-PC\Users (No File)
Shortcut: E:\Documents and Settings\Administrator\NetHood\IMesh on blumpkin (Josh-h)\target.lnk -> \\JOSH-H\IMesh ()
Shortcut: E:\Documents and Settings\Administrator\NetHood\Converted on blumpkin (Josh-h)\target.lnk -> \\JOSH-H\Converted ()
Shortcut: E:\Documents and Settings\Administrator\Desktop\BSR Screen Recorder 6.lnk -> C:\Download\BSR Screen Recorder 6\Screen Recorder 6.exe (BSRSoft)
Shortcut: E:\Documents and Settings\Administrator\Desktop\Examples.lnk -> F:\Documents and Settings\Administrator\My Documents\iMacros\Examples ()
Shortcut: E:\Documents and Settings\Administrator\Desktop\iMacros 10.lnk -> E:\Program Files\Ipswitch\iMacros\iMacros.exe (Ipswitch, Inc.)
Shortcut: E:\Documents and Settings\Administrator\Desktop\iMacros Batch Sample.lnk -> F:\Documents and Settings\Administrator\My Documents\iMacros\Examples\Batch Files\Example-Batchfile.bat ()
Shortcut: E:\Documents and Settings\Administrator\Desktop\iMacros Scripting Interface Sample.lnk -> F:\Documents and Settings\Administrator\My Documents\iMacros\Examples\Windows Scripting Host\Scripting-Interface-Sample.vbs ()
Shortcut: E:\Documents and Settings\Administrator\Desktop\Internet Explorer.lnk -> E:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Administrator\Desktop\My Documents.lnk -> F:\Documents and Settings\Administrator\My Documents ()
Shortcut: E:\Documents and Settings\Administrator\Desktop\PC Inspector File Recovery.lnk -> E:\Program Files\Convar\PC Inspector File Recovery\Filerecovery.exe ()
Shortcut: E:\Documents and Settings\Administrator\Desktop\Protected Music Converter.lnk -> E:\Program Files\WMA-MP3.com\Protected Music Converter\PMConvert.exe (WMA-MP3.com )
Shortcut: E:\Documents and Settings\Administrator\Desktop\Shortcut to Downloads.lnk -> F:\Documents and Settings\Administrator\My Documents\Downloads ()
Shortcut: E:\Documents and Settings\Administrator\Desktop\Shortcut to RosettaStoneVersion3.lnk -> C:\Program Files\Rosetta Stone\Rosetta Stone Version 3\RosettaStoneVersion3.exe (Multidmedia Limited )
Shortcut: E:\Documents and Settings\Administrator\Desktop\WinDirStat.lnk -> E:\Program Files\WinDirStat\windirstat.exe (Seifert)
Shortcut: E:\Documents and Settings\Administrator\Desktop\µTorrent.lnk -> E:\Documents and Settings\Administrator\Application Data\uTorrent\uTorrent.exe (No File)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\AIM 6.lnk -> E:\Program Files\AIM6\aim6.exe (No File)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Guru Utility.lnk -> E:\Program Files\Golf Guru\GuruUtil.exe (TQI Corporation)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\ImgBurn.lnk -> E:\Program Files\ImgBurn\ImgBurn.exe (No File)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> E:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk -> E:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Samsung AllShare.lnk -> E:\Program Files\Samsung\AllShare\AllShare.exe (Samsung Electronics Co., Ltd.)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Winamp.lnk -> E:\Program Files\Winamp\winamp.exe (Nullsoft)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Yahoo! Messenger.lnk -> E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (No File)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk -> E:\Documents and Settings\Administrator\Application Data\uTorrent\uTorrent.exe (No File)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0001.lnk -> C:\My Pictures\MP Navigator EX\2011_03_29\IMG.pdf (No File)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0002.lnk -> C:\My Pictures\MP Navigator EX\2011_03_29\IMG_0001.pdf (No File)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0003.lnk -> C:\My Pictures\MP Navigator EX\2011_03_29\IMG_0002.pdf (No File)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0004.lnk -> C:\My Pictures\MP Navigator EX\2011_11_11\IMG.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0005.lnk -> C:\My Pictures\MP Navigator EX\2011_12_14\IMG.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0006.lnk -> C:\My Pictures\MP Navigator EX\2012_01_29\IMG.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0007.lnk -> C:\My Pictures\MP Navigator EX\2013_05_30\IMG.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0008.lnk -> C:\My Pictures\MP Navigator EX\2013_05_30\IMG_0001.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0009.lnk -> C:\My Pictures\MP Navigator EX\2013_05_30\IMG_0002.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0010.lnk -> C:\My Pictures\MP Navigator EX\2013_07_21\IMG.jpg (No File)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0011.lnk -> C:\My Pictures\MP Navigator EX\2013_12_08\IMG.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0012.lnk -> C:\My Pictures\MP Navigator EX\2013_12_08\tirepurchase.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0013.lnk -> C:\My Pictures\MP Navigator EX\2013_12_08\tirepurchase2.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0014.lnk -> C:\My Pictures\MP Navigator EX\2014_09_16\IMG.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0015.lnk -> C:\My Pictures\MP Navigator EX\2014_09_16\IMG_0001.jpg ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0016.lnk -> C:\My Pictures\MP Navigator EX\2014_09_16\IMG_0002.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0017.lnk -> C:\My Pictures\MP Navigator EX\2014_09_16\IMG_0003.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0018.lnk -> C:\My Pictures\MP Navigator EX\2015_02_01\IMG_0001.jpg ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0019.lnk -> C:\My Pictures\MP Navigator EX\2015_02_01\IMG_0002.jpg ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\sc\hstr_0020.lnk -> C:\My Pictures\MP Navigator EX\2015_02_03\IMG.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\ml\hstr_0001.lnk -> C:\My Pictures\MP Navigator EX\Mail_20130530\isu transcript.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\ml\hstr_0002.lnk -> C:\My Pictures\MP Navigator EX\Mail_20130530\isu transcript2.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\ml\hstr_0003.lnk -> C:\My Pictures\MP Navigator EX\Mail_20130530\signature.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\ml\hstr_0004.lnk -> C:\My Pictures\MP Navigator EX\Mail_20140916\IMG_0001.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\ml\hstr_0005.lnk -> C:\My Pictures\MP Navigator EX\Mail_20140916\IMG_0002.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\ml\hstr_0006.lnk -> C:\My Pictures\MP Navigator EX\Mail_20140916\IMG_0003.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\ap\hstr_0001.lnk -> C:\My Pictures\MP Navigator EX\2012_01_29\IMG.pdf ()
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\ap\hstr_0002.lnk -> C:\My Pictures\MP Navigator EX\2013_07_21\IMG.jpg (No File)
Shortcut: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\history\ap\hstr_0003.lnk -> C:\My Pictures\MP Navigator EX\2015_02_03\IMG.pdf ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\BitTorrent.lnk -> E:\Program Files\BitTorrent\BitTorrent.exe (BitTorrent, Inc.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Windows Update.lnk -> E:\WINDOWS\system32\wupdmgr.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader XI.lnk -> E:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-AB0000000001}\SC_Reader.ico ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk -> E:\WINDOWS\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\LiveUpdate.lnk -> E:\WINDOWS\Installer\{BAFA84F8-5A33-4ACD-AD10-58356B27A0F1}\_081473F266264A2383533074B6D4A531.exe (InstallShield Software Corp.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft FrontPage.lnk -> E:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\misc.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Word Viewer 2003.lnk -> E:\WINDOWS\Installer\{90850409-6000-11D3-8CFE-0150048383C9}\wrdvicon.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk -> E:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\MSN Explorer.lnk -> E:\Program Files\MSN\MSNCoreFiles\msn6.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Windows 7 Upgrade Advisor.lnk -> E:\Program Files\Microsoft Windows 7 Upgrade Advisor\WindowsUpgradeAdvisor.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Windows Live ID.lnk -> E:\Program Files\Common Files\Microsoft Shared\Windows Live\SIGNINOPTIONS.EXE (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk -> E:\WINDOWS\Installer\{A44413DC-17D5-4F0B-A128-8B590B20323C}\MsblIco.Exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Yahoo! Messenger\Yahoo! Messenger.lnk -> E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\WinRAR\Console RAR manual.lnk -> E:\Program Files\WinRAR\Rar.txt ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\WinRAR\WinRAR help.lnk -> E:\Program Files\WinRAR\WinRAR.chm ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\WinRAR\WinRAR.lnk -> E:\Program Files\WinRAR\WinRAR.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Winamp\Uninstall Winamp.lnk -> E:\Program Files\Winamp\UninstWA.exe (Nullsoft, Inc.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Winamp\What's New.lnk -> E:\Program Files\Winamp\whatsnew.txt ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Winamp\Winamp.lnk -> E:\Program Files\Winamp\winamp.exe (Nullsoft)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\WavePad Sound Editor\WavePad Sound Editor Help.lnk -> E:\Program Files\NCH Swift Sound\WavePad\Help\index.html ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\WavePad Sound Editor\WavePad Sound Editor.lnk -> E:\Program Files\NCH Swift Sound\WavePad\wavepad.exe (NCH Software)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\VideoLAN\Documentation.lnk -> E:\Program Files\VideoLAN\VLC\Documentation.url (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\VideoLAN\Release Notes.lnk -> E:\Program Files\VideoLAN\VLC\NEWS.txt (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\VideoLAN\Reset VLC media player preferences and cache files.lnk -> E:\Program Files\VideoLAN\VLC\vlc.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\VideoLAN\VideoLAN Website.lnk -> E:\Program Files\VideoLAN\VLC\VideoLAN Website.url (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\VideoLAN\VLC media player skinned.lnk -> E:\Program Files\VideoLAN\VLC\vlc.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\VideoLAN\VLC media player.lnk -> E:\Program Files\VideoLAN\VLC\vlc.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\TVAnts\TVAnts Uninstallation.lnk -> E:\Program Files\TVAnts\UNWISE.EXE (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\TVAnts\TVAnts.lnk -> E:\Program Files\TVAnts\Tvants.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk -> E:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\SourceTec\Sothink FLV Player\Sothink FLV Player.lnk -> E:\Program Files\Common Files\SourceTec\Sothink FLV Player\FLVPlayer.exe (SourceTec)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\SourceTec\Sothink FLV Player\Uninstall Sothink FLV Player.lnk -> E:\Program Files\Common Files\SourceTec\Sothink FLV Player\unins000.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Skype\Skype.lnk -> E:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Samsung\AllShare\Samsung AllShare.lnk -> E:\Program Files\Samsung\AllShare\AllShare.exe (Samsung Electronics Co., Ltd.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Rosetta Stone\Rosetta Stone Version 3\Rosetta Stone Version 3.lnk -> E:\WINDOWS\Installer\{80F7CA44-F3A5-4853-8BA6-DDF57CD4F078}\MainIcon.exe (Rosetta Stone Ltd. )
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\RealNetworks\RealPlayer Converter.lnk -> E:\Program Files\Real\RealPlayer\realconverter.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\RealNetworks\RealPlayer Trimmer.lnk -> E:\Program Files\Real\RealPlayer\realtrimmer.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\RealNetworks\RealPlayer.lnk -> E:\Program Files\real\realplayer\realplay.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\QuickTime\About QuickTime.lnk -> E:\WINDOWS\Installer\{57752979-A1C9-4C02-856B-FBB27AC4E02C}\RichText.ico ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\QuickTime\PictureViewer.lnk -> E:\WINDOWS\Installer\{57752979-A1C9-4C02-856B-FBB27AC4E02C}\PictureViewer.ico ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\QuickTime\QuickTime Player.lnk -> E:\WINDOWS\Installer\{57752979-A1C9-4C02-856B-FBB27AC4E02C}\QTPlayer.ico ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Protected Music Converter\Protected Music Converter Help.lnk -> E:\Program Files\WMA-MP3.com\Protected Music Converter\PMConvert.chm ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Protected Music Converter\Protected Music Converter.lnk -> E:\Program Files\WMA-MP3.com\Protected Music Converter\PMConvert.exe (WMA-MP3.com )
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\O&O Software\O&O Defrag\O&O Defrag Help.lnk -> E:\WINDOWS\Installer\{E29CFB36-F070-4612-8DB5-7038161B6294}\NewShortcut24_CD90D8093E744A7ABDA61ACA69A4013E.exe (Acresso Software Inc.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\O&O Software\O&O Defrag\O&O Defrag.lnk -> E:\WINDOWS\Installer\{E29CFB36-F070-4612-8DB5-7038161B6294}\NewShortcut1_D840A6EA92214470BCE0FD7EF9D6C0CF.exe (Acresso Software Inc.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox\Mozilla Firefox.lnk -> E:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Silverlight\Microsoft Silverlight.lnk -> E:\Program Files\Microsoft Silverlight\5.1.30514.0\Silverlight.Configuration.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Tools\Microsoft Clip Organizer.lnk -> E:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\cagicon.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Tools\Microsoft Office Document Imaging.lnk -> E:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\mspicons.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Tools\Microsoft Office Document Scanning.lnk -> E:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\mspicons.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Tools\Microsoft Office XP Language Settings.lnk -> E:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\misc.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office\Microsoft Office Access 2007.lnk -> E:\WINDOWS\Installer\{91120000-0014-0000-0000-0000000FF1CE}\accicons.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office\Microsoft Office Excel 2007.lnk -> E:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office\Microsoft Office OneNote 2007.lnk -> E:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office\Microsoft Office Outlook 2007.lnk -> E:\WINDOWS\Installer\{91120000-0013-0000-0000-0000000FF1CE}\outicon.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office\Microsoft Office PowerPoint 2007.lnk -> E:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office\Microsoft Office Publisher 2007.lnk -> E:\WINDOWS\Installer\{91120000-0014-0000-0000-0000000FF1CE}\pubs.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office\Microsoft Office Word 2007.lnk -> E:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Digital Certificate for VBA Projects.lnk -> E:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Clip Organizer.lnk -> E:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2007 Language Settings.lnk -> E:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Diagnostics.lnk -> E:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Picture Manager.lnk -> E:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware\Malwarebytes Anti-Malware.lnk -> E:\Program Files\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware\Uninstall Malwarebytes Anti-Malware.lnk -> E:\Program Files\Malwarebytes Anti-Malware\unins000.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware\Tools\Malwarebytes Anti-Malware Chameleon.lnk -> E:\Program Files\Malwarebytes Anti-Malware\Chameleon\Windows\chameleon.chm ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Logitech\Logitech Webcam Software.lnk -> E:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\HelpMain\launchershortcut.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Logitech\Logitech Vid\Logitech Vid.lnk -> E:\WINDOWS\Installer\{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}\VidIcon.BA73B1B0_EF22_43B4_9B31_1EC3736CBBD6.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Linksys\Linksys EasyLink Advisor.lnk -> E:\Program Files\Linksys\Linksys EasyLink Advisor\Linksys EasyLink Advisor.exe (Linksys LLC - A Division of Cisco Systems)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\ImgBurn\ImgBurn Read Me.lnk -> E:\Program Files\ImgBurn\ReadMe.txt (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\ImgBurn\ImgBurn.lnk -> E:\Program Files\ImgBurn\ImgBurn.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\ImgBurn\Uninstall.lnk -> E:\Program Files\ImgBurn\uninstall.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\iMacros\Batch Sample.lnk -> F:\Documents and Settings\Administrator\My Documents\iMacros\Examples\Batch Files\Example-Batchfile.bat ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\iMacros\Examples.lnk -> F:\Documents and Settings\Administrator\My Documents\iMacros\Examples ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\iMacros\iMacros 10.lnk -> E:\Program Files\Ipswitch\iMacros\iMacros.exe (Ipswitch, Inc.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\iMacros\iMacros Editor.lnk -> E:\Program Files\Ipswitch\iMacros\iMacrosEditor.exe (Ipswitch, Inc.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\iMacros\Scripting Interface Sample.lnk -> F:\Documents and Settings\Administrator\My Documents\iMacros\Examples\Windows Scripting Host\Scripting-Interface-Sample.vbs ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Golf Guru\Guru Utility.lnk -> E:\Program Files\Golf Guru\GuruUtil.exe (TQI Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Golf Guru\Uninstall Guru Utility.lnk -> E:\Program Files\Golf Guru\unins000.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Games\Freecell.lnk -> E:\WINDOWS\system32\freecell.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Games\Hearts.lnk -> E:\WINDOWS\system32\mshearts.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Games\Internet Backgammon.lnk -> E:\Program Files\MSN Gaming Zone\Windows\bckgzm.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Games\Internet Checkers.lnk -> E:\Program Files\MSN Gaming Zone\Windows\chkrzm.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Games\Internet Hearts.lnk -> E:\Program Files\MSN Gaming Zone\Windows\hrtzzm.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Games\Internet Reversi.lnk -> E:\Program Files\MSN Gaming Zone\Windows\Rvsezm.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Games\Internet Spades.lnk -> E:\Program Files\MSN Gaming Zone\Windows\shvlzm.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Games\Minesweeper.lnk -> E:\WINDOWS\system32\winmine.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Games\Pinball.lnk -> E:\Program Files\Windows NT\Pinball\pinball.exe (Cinematronics)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Games\Solitaire.lnk -> E:\WINDOWS\system32\sol.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Games\Spider Solitaire.lnk -> E:\WINDOWS\system32\spider.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\DAEMON Tools Lite\DAEMON Tools Lite.lnk -> E:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\DAEMON Tools Lite\SPTD Setup.lnk -> E:\Program Files\DAEMON Tools Lite\SPTDinst-x86.exe (Duplex Secure Ltd.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\DAEMON Tools Lite\Uninstall.lnk -> E:\Program Files\DAEMON Tools Lite\uninst.exe (DT Soft Ltd.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\CCleaner\CCleaner.lnk -> F:\Program Files\CCleaner\CCleaner.exe (Piriform Ltd)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Canon Utilities\Solution Menu\Solution Menu Readme.lnk -> E:\Program Files\Canon\SolutionMenu\Readme.txt ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Canon Utilities\Solution Menu\Solution Menu.lnk -> E:\Program Files\Canon\SolutionMenu\CNSLMAIN.EXE (CANON INC.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Canon Utilities\My Printer\My Printer Readme.lnk -> E:\Program Files\Canon\MyPrinter\Readme.txt ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Canon Utilities\MP Navigator EX 3.0\MP Navigator EX 3.0.lnk -> E:\Program Files\Canon\MP Navigator EX 3.0\mpnex30.exe (CANON INC.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Canon Utilities\MP Navigator EX 3.0\MP Navigator EX Readme.lnk -> E:\Program Files\Canon\MP Navigator EX 3.0\Readme.txt ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Canon Utilities\Easy-PhotoPrint EX\Easy-PhotoPrint EX Readme.lnk -> E:\Program Files\Canon\Easy-PhotoPrint EX\Readme.txt ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Canon Utilities\Easy-PhotoPrint EX\Easy-PhotoPrint EX.lnk -> E:\Program Files\Canon\Easy-PhotoPrint EX\CNEZMAIN.EXE (CANON INC.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Canon MP250 series User Registration\User Registration Uninstall.LNK -> E:\Program Files\Canon\IJEREG\MP250 series\UNINST.EXE (CANON INC.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Canon MP250 series User Registration\User Registration.LNK -> E:\Program Files\Canon\IJEREG\MP250 series\IJEREG.exe (CANON INC.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Canon MP250 series Manual\Uninstall.lnk -> E:\Program Files\Canon\IJ Manual\CANON MP250 SERIES\uninstall.exe (CANON INC.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Canon MP250 series\Readme.lnk -> E:\Program Files\CanonBJ\IJPrinter\Canon MP250 series\readme_English.txt ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\AVG\AVG 2015.lnk -> E:\Program Files\AVG\AVG2015\avgui.exe (AVG Technologies CZ, s.r.o.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Audio Transcoder\Audio Transcoder.lnk -> E:\Program Files\AudioTranscoder\Audiotranscoder.exe (Digital Music Software)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Audio Transcoder\Help.lnk -> E:\Program Files\AudioTranscoder\Audiotranscoder.chm ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\AIM\AIM 6.lnk -> E:\Program Files\AIM6\aim6.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\AIM\Uninstall AIM.lnk -> E:\Program Files\AIM6\uninst.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Adobe\Adobe Media Player.lnk -> E:\Program Files\Adobe Media Player\Adobe Media Player.exe ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Component Services.lnk -> E:\WINDOWS\system32\Com\comexp.msc ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Data Sources (ODBC).lnk -> E:\WINDOWS\system32\odbcad32.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Microsoft .NET Framework 1.1 Configuration.lnk -> E:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorcfg.msc ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Microsoft .NET Framework 1.1 Wizards.lnk -> E:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe ( )
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Calculator.lnk -> E:\WINDOWS\system32\calc.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Paint.lnk -> E:\WINDOWS\system32\mspaint.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk -> E:\WINDOWS\system32\mstsc.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Windows Movie Maker.lnk -> E:\Program Files\Movie Maker\moviemk.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\WordPad.lnk -> E:\Program Files\Windows NT\Accessories\wordpad.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Backup.lnk -> E:\WINDOWS\system32\ntbackup.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Character Map.lnk -> E:\WINDOWS\system32\charmap.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Disk Cleanup.lnk -> E:\WINDOWS\system32\cleanmgr.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Disk Defragmenter.lnk -> E:\WINDOWS\system32\dfrg.msc ()
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnk -> E:\WINDOWS\system32\usmt\migwiz.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Scheduled Tasks.lnk -> E:\WINDOWS\explorer.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\System Information.lnk -> E:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\System Restore.lnk -> E:\WINDOWS\system32\Restore\rstrui.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Entertainment\Sound Recorder.lnk -> E:\WINDOWS\system32\sndrec32.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Entertainment\Volume Control.lnk -> E:\WINDOWS\system32\sndvol32.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications\HyperTerminal.lnk -> E:\Program Files\Windows NT\hypertrm.exe (Hilgraeve, Inc.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Accessibility\Accessibility Wizard.lnk -> E:\WINDOWS\system32\accwiz.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\802.11g USB2.0 adapter\802.11g USB2.0 adapter setting.lnk -> E:\Program Files\802.11g USB2.0 adapter\WiFiCfg.exe (Conexant Systems, Inc.)
Shortcut: E:\Documents and Settings\All Users\Start Menu\Programs\802.11g USB2.0 adapter\Uninstall 802.11g USB2.0 adapter.lnk -> E:\Program Files\InstallShield Installation Information\{5797A1D5-2C08-4FF1-B4B4-EA25760CA543}\setup.exe (InstallShield Software Corporation)
Shortcut: E:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk -> E:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe (Adobe Systems Incorporated)
Shortcut: E:\Documents and Settings\All Users\Desktop\AVG 2015.lnk -> E:\Program Files\AVG\AVG2015\avgui.exe (AVG Technologies CZ, s.r.o.)
Shortcut: E:\Documents and Settings\All Users\Desktop\CCleaner.lnk -> F:\Program Files\CCleaner\CCleaner.exe (Piriform Ltd)
Shortcut: E:\Documents and Settings\All Users\Desktop\DAEMON Tools Lite.lnk -> E:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
Shortcut: E:\Documents and Settings\All Users\Desktop\ImgBurn.lnk -> E:\Program Files\ImgBurn\ImgBurn.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Desktop\Logitech Vid.lnk -> E:\Program Files\Logitech\Logitech Vid\Vid.exe (Logitech Inc.)
Shortcut: E:\Documents and Settings\All Users\Desktop\Logitech Webcam Software .lnk -> E:\Program Files\Common Files\LogiShrd\LWSPlugins\LWS\Applets\HelpMain\launchershortcut.exe ()
Shortcut: E:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk -> E:\Program Files\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes Corporation)
Shortcut: E:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk -> E:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
Shortcut: E:\Documents and Settings\All Users\Desktop\O&O Defrag.lnk -> E:\WINDOWS\Installer\{E29CFB36-F070-4612-8DB5-7038161B6294}\NewShortcut11_D840A6EA92214470BCE0FD7EF9D6C0CF.exe (Acresso Software Inc.)
Shortcut: E:\Documents and Settings\All Users\Desktop\Samsung AllShare.lnk -> E:\Program Files\Samsung\AllShare\AllShare.exe (Samsung Electronics Co., Ltd.)
Shortcut: E:\Documents and Settings\All Users\Desktop\VLC media player.lnk -> E:\Program Files\VideoLAN\VLC\vlc.exe (No File)
Shortcut: E:\Documents and Settings\All Users\Desktop\Windows 7 Upgrade Advisor.lnk -> E:\Program Files\Microsoft Windows 7 Upgrade Advisor\WindowsUpgradeAdvisor.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Command Prompt.lnk -> E:\WINDOWS\system32\cmd.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Notepad.lnk -> E:\WINDOWS\system32\notepad.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Synchronize.lnk -> E:\WINDOWS\system32\mobsync.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Tour Windows XP.lnk -> E:\WINDOWS\system32\tourstart.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Windows Explorer.lnk -> E:\WINDOWS\explorer.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Magnifier.lnk -> E:\WINDOWS\system32\magnify.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Narrator.lnk -> E:\WINDOWS\system32\narrator.exe (Microsoft Corporation)
Shortcut: E:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\On-Screen Keyboard.lnk -> E:\WINDOWS\system32\osk.exe (Microsoft Corporation)

ShortcutWithArgument: E:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk -> E:\Program Files\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1
ShortcutWithArgument: E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk -> E:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) -> /tsr
ShortcutWithArgument: E:\Documents and Settings\Administrator\Start Menu\Programs\BSR Screen Recorder 6\Movie Lab.lnk -> C:\Download\BSR Screen Recorder 6\Screen Recorder 6.exe (BSRSoft) -> /movielab
ShortcutWithArgument: E:\Documents and Settings\Administrator\Start Menu\Programs\BSR Screen Recorder 6\Movie Studio.lnk -> C:\Download\BSR Screen Recorder 6\Screen Recorder 6.exe (BSRSoft) -> /moviestudio
ShortcutWithArgument: E:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> E:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> -extoff
ShortcutWithArgument: E:\Documents and Settings\Administrator\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk -> E:\WINDOWS\system32\utilman.exe (Microsoft Corporation) -> /start
ShortcutWithArgument: E:\Documents and Settings\Administrator\SendTo\Skype.lnk -> E:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.) -> /sendto:
ShortcutWithArgument: E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk -> E:\Program Files\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Microsoft Update.lnk -> E:\WINDOWS\system32\rundll32.exe (Microsoft Corporation) -> E:\WINDOWS\system32\muweb.dll,LaunchMUSite
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\New Office Document.lnk -> E:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\misc.exe () -> -n
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Open Office Document.lnk -> E:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\misc.exe () -> -f
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk -> E:\WINDOWS\system32\control.exe (Microsoft Corporation) -> appwiz.cpl,,3
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Windows Search.lnk -> E:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation) -> /launchsearchwindow
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk -> E:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) -> -b -l
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk -> E:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation) -> /startup
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Samsung\AllShare\Uninstall AllShare.lnk -> E:\Program Files\InstallShield Installation Information\{DF47ACA3-7C78-4C08-8007-AC682563C9F1}\setup.exe (Samsung Electronics Co., Ltd. ) -> /removeonly
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\QuickTime\Uninstall QuickTime.lnk -> E:\WINDOWS\system32\msiexec.exe (Microsoft Corporation) -> /i {57752979-A1C9-4C02-856B-FBB27AC4E02C} /qf
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox\Mozilla Firefox (Safe Mode).lnk -> E:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> -safe-mode
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Tools\Activate Product.lnk -> E:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\misc.exe () -> -z
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Tools\Microsoft Office Application Recovery.lnk -> E:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\misc.exe () -> -c
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Tools\Save My Settings Wizard.lnk -> E:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\opwicon.exe () -> /u
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\DivX\DivX Converter\Register Products.lnk -> E:\WINDOWS\system32\rundll32.exe (Microsoft Corporation) -> E:\WINDOWS\system32\dtu100.dll,dtuSerialRunDll B13A7C41581B411290FBC0395694E2A9
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Catalyst Control Center\CCC - Advanced.lnk -> E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.exe (ATI Technologies Inc.) -> Start Dashboard
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Catalyst Control Center\CCC - Wizard.lnk -> E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.exe (ATI Technologies Inc.) -> Start Wizard
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Catalyst Control Center\CCC.lnk -> E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.exe (ATI Technologies Inc.) -> Start CCC
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Catalyst Control Center\Help.lnk -> E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.exe (ATI Technologies Inc.) -> Start Help -help
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Catalyst Control Center\Restart Runtime.lnk -> E:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Advanced Micro Devices Inc.) -> Restart
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Canon Utilities\Solution Menu\Solution Menu Uninstall.lnk -> E:\Program Files\Canon\SolutionMenu\uninst.exe (CANON INC.) -> E:\Program Files\Canon\SolutionMenu\uninst.ini
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Canon Utilities\My Printer\My Printer Uninstall.lnk -> E:\Program Files\Canon\MyPrinter\uninst.exe (CANON INC.) -> E:\Program Files\Canon\MyPrinter\uninst.ini
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Canon Utilities\My Printer\My Printer.lnk -> E:\Program Files\Canon\MyPrinter\BJMYPRT.EXE (CANON INC.) -> /mn
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Canon Utilities\MP Navigator EX 3.0\MP Navigator EX Uninstall.lnk -> E:\Program Files\Canon\MP Navigator EX 3.0\Maint.exe (CANON INC.) -> /UninstallRemove E:\Program Files\Canon\MP Navigator EX 3.0\uninst.ini
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Canon Utilities\Easy-PhotoPrint EX\Easy-PhotoPrint EX Uninstall.lnk -> E:\Program Files\Canon\Easy-PhotoPrint EX\uninst.exe (CANON INC.) -> E:\Program Files\Canon\Easy-PhotoPrint EX\uninst.ini
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Canon MP250 series Manual\Canon MP250 series On-screen Manual.lnk -> E:\Program Files\Canon\IJ Manual\Easy Guide Viewer\cmview.exe (CANON INC.) -> "E:\PROGRAM FILES\Canon\IJ Manual\CANON MP250 SERIES\English\Info.egv"
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Canon MP250 series\MP Drivers Uninstaller.lnk -> E:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP250_series\DelDrv.exe (CANON INC.) -> /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP250_series
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Computer Management.lnk -> E:\WINDOWS\system32\compmgmt.msc () -> /s
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Event Viewer.lnk -> E:\WINDOWS\system32\eventvwr.msc () -> /s
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Local Security Policy.lnk -> E:\WINDOWS\system32\secpol.msc () -> /s
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Performance.lnk -> E:\WINDOWS\system32\perfmon.msc () -> /s
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk -> E:\WINDOWS\system32\services.msc () -> /s
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Scanner and Camera Wizard.lnk -> E:\WINDOWS\system32\wiaacmgr.exe (Microsoft Corporation) -> -SelectDevice
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\System Tools\Activate Windows.lnk -> E:\WINDOWS\system32\oobe\msoobe.exe (Microsoft Corporation) -> /A
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications\Network Connections.lnk -> E:\WINDOWS\explorer.exe (Microsoft Corporation) -> ::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\::{21EC2020-3AEA-1069-A2DD-08002B30309D}\::{7007acc7-3202-11d1-aad2-00805fc1270e}
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications\Network Setup Wizard.lnk -> E:\WINDOWS\system32\rundll32.exe (Microsoft Corporation) -> hnetwiz.dll,HomeNetWizardRunDll
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications\New Connection Wizard.lnk -> E:\WINDOWS\system32\rundll32.exe (Microsoft Corporation) -> netshell.dll,StartNCW
ShortcutWithArgument: E:\Documents and Settings\All Users\Start Menu\Programs\Accessories\Communications\Wireless Network Setup Wizard.lnk -> E:\WINDOWS\system32\rundll32.exe (Microsoft Corporation) -> shell32.dll,Control_RunDLL NetSetup.cpl,@0,WNSW
ShortcutWithArgument: E:\Documents and Settings\Default User\Start Menu\Programs\Remote Assistance.lnk -> E:\WINDOWS\system32\rcimlby.exe (Microsoft Corporation) -> -LaunchRA
ShortcutWithArgument: E:\Documents and Settings\Default User\Start Menu\Programs\Windows Media Player.lnk -> E:\Program Files\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1
ShortcutWithArgument: E:\Documents and Settings\Default User\Start Menu\Programs\Accessories\Accessibility\Utility Manager.lnk -> E:\WINDOWS\system32\utilman.exe (Microsoft Corporation) -> /start
ShortcutWithArgument: E:\Documents and Settings\LocalService\Start Menu\Programs\Windows Media Player.lnk -> E:\Program Files\Windows Media Player\wmplayer.exe (Microsoft Corporation) -> /prefetch:1

InternetURL: E:\Documents and Settings\Administrator\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Start Menu\Programs\CCleaner\CCleaner Homepage.url -> hxxp://www.ccleaner.com/
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\The Weather Channel\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\The Weather Channel\Framework\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\NETGEARGenie\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\NETGEARGenie\pic\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\NETGEARGenie\pic\default\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Nero\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Nero\SharedMediaData\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\9.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\11.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\10.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Mail\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Mail\Sentinel\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Mail\Backup\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Mail\Backup\new\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\DBStore\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\DBStore\Backup\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\DBStore\Backup\new(2)\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\DBStore\Backup\new\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\DBStore\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\DBStore\Backup\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\DBStore\Backup\new(2)\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\DBStore\Backup\new\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\tkmsx25x5eudduxrt1ldlz5hwgtnl3zb0nc2nirbm2wdxm1f0xaaadfa\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\tkmsx25x5eudduxrt1ldlz5hwgtnl3zb0nc2nirbm2wdxm1f0xaaadfa\f\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\qyzgmprsrfvdi1dud3uhxotpjjuckeishl2ttb4tzqqxe1rezlaaaaha\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\qyzgmprsrfvdi1dud3uhxotpjjuckeishl2ttb4tzqqxe1rezlaaaaha\f\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\gx2dtgu0jwm3behddpeqaxumfnjfj0aese4jbh5v112dfe1kacaaaafa\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\gx2dtgu0jwm3behddpeqaxumfnjfj0aese4jbh5v112dfe1kacaaaafa\f\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\bgcduenfjq4yxoyzxbnpzmnre2vbsyux4fgcqsgngulhhfsf45aaaaba\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\bgcduenfjq4yxoyzxbnpzmnre2vbsyux4fgcqsgngulhhfsf45aaaaba\f\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Messenger\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd\Vid\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd\Vid\storage\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd\Vid\storage\https_app.sightspeed.com_0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Google Desktop\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Google Desktop\712c7597ab51\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Sync Data Backup\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_1\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_1\audio\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\adaware\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\adaware\data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Favorites\5501 Idle Creek Ln foreclosure - Google Search.URL -> hxxp://www.google.com/#hl=en&ei=fpmES5GPFI2MswOcp-niDw&sa=X&oi=spellfullpage&resnum=0&ct=result&cd=2&ved=0CAYQvwUoAQ&&q=5501+Idle+Creek+Ln+foreclosure&spell=1&fp=c26c79a56c95bda8
InternetURL: E:\Documents and Settings\Administrator\Favorites\Amazon.com The Best Lifetime Movies .URL -> hxxp://www.amazon.com/The-Best-Lifetime-Movies/lm/3PERD4SMN0WEO/ref=cm_lmt_fvlm_f_1_rlrsrs0
InternetURL: E:\Documents and Settings\Administrator\Favorites\Andy Pratt Statistics - The Baseball Cube.URL -> hxxp://www.thebaseballcube.com/players/P/andy-pratt.shtml
InternetURL: E:\Documents and Settings\Administrator\Favorites\Annuities Income for life - CNNMoney.com.URL -> hxxp://cgi.money.cnn.com/tools/annuities/index.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Apple Chutney Chops - Allrecipes.URL -> hxxp://allrecipes.com/Recipe/Apple-Chutney-Chops/Detail.aspx
InternetURL: E:\Documents and Settings\Administrator\Favorites\AudioVideoSoft.com - Collection of only the best audio converters, rippers, editors, recorders, burners, text to speed solutions, video encoders, decoders, DVD rippers, DVD burners, etc..url -> hxxp://www.audiovideosoft.com
InternetURL: E:\Documents and Settings\Administrator\Favorites\Baseball Cards - Last Name 'S'.URL -> hxxp://www.homeruncards.com/s.htm
InternetURL: E:\Documents and Settings\Administrator\Favorites\Baseball Today Sept 20 - MyP2P Forum.URL -> hxxp://www.myp2pforum.eu/mlb-baseball/27207-baseball-today-sept-20-a.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\BaseballAmerica.com Prospects Ask BA.URL -> hxxp://www.baseballamerica.com/today/askba/262425.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Basic Setup.URL -> hxxp://192.168.1.1/basic.htm
InternetURL: E:\Documents and Settings\Administrator\Favorites\Beacon - Vigo County, IN City of Terre Haute.URL -> hxxp://beacon.schneidercorp.com/Application.aspx?AppID=99&LayerID=962&PageTypeID=4&PageID=611&Q=1357620058&KeyValue=84-07-19-326-012.000-009
InternetURL: E:\Documents and Settings\Administrator\Favorites\Blackboard Academic Suite.URL -> https://blackboard.indwes.edu/webapps/portal/frameset.jsp
InternetURL: E:\Documents and Settings\Administrator\Favorites\Buy original Nintendo 64 Accessories, new and used N64 controllers and Retro System repair parts.URL -> hxxp://www.dkoldies.com/Nintendo-N64-Accessories-s/42.htm
InternetURL: E:\Documents and Settings\Administrator\Favorites\Chicago Cubs - Select Any Player - Youth Pinstripe Replica Jersey.URL -> hxxp://www.fansedge.com/Chicago-Cubs---Select-Any-Player---Youth-Pinstripe-Replica-Jersey_1345380082_PD.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Chicago Cubs Apparel, Cubs Merchandise, Chicago Cubs Clothing, Chicago Cub Jerseys, Gear, Shop, Store, Gifts.URL -> hxxp://www.scoreproshop.com/Chicago-Cubs-Merchandise_1598051240.1.12.6_PG.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Chicago Sports Jerseys - Highest quality jerseys at lowest possible prices!.URL -> hxxp://www.chicagosportsjerseys.com/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Chris Nelson's MLB 2K8 (Xbox 360) Roster Update Thread - ConsoleSports.net.URL -> hxxp://consolesports.net/forums2/index.php?showtopic=3850
InternetURL: E:\Documents and Settings\Administrator\Favorites\Citibank® Commercial Cards.URL -> https://home.cards.citidirect.com/CommercialCard/Cards.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\College Sports on TV.URL -> hxxp://mattsarzsports.com/
InternetURL: E:\Documents and Settings\Administrator\Favorites\CollegeSportsDirect.com#1 Source for College Sports Video & On-Demand Games.URL -> hxxp://www.collegesportsdirect.com/HomePage.dbml
InternetURL: E:\Documents and Settings\Administrator\Favorites\CollegeSportsinfo.com College Sports News, NCAA Message Board Directory, Conference Updates.URL -> hxxp://collegesportsinfo.com/
InternetURL: E:\Documents and Settings\Administrator\Favorites\CollegeSportsInfo.com Conference Realignment Possibilities.URL -> hxxp://collegesportsinfo.com/conference-realignment-grid/
InternetURL: E:\Documents and Settings\Administrator\Favorites\CollegeSportsInfo.com Forums  Index page.URL -> hxxp://collegesportsinfo.com/forum/
InternetURL: E:\Documents and Settings\Administrator\Favorites\CSTV.com #1 in College Sports.URL -> hxxp://www.cstv.com/media/livegame.html?school=okst&sport=&interval=today
InternetURL: E:\Documents and Settings\Administrator\Favorites\cstv.com #1 in College Sports.url -> hxxp://www.cstv.com/media/livegame.html?the_date=2009_11_14
InternetURL: E:\Documents and Settings\Administrator\Favorites\CubWorld.com Chicago Cubs Ronny Cedeno T-Shirts and Jerseys.URL -> hxxp://www.cubworld.com/category/wwa.ronny_cedeno/
InternetURL: E:\Documents and Settings\Administrator\Favorites\DIRECT TV Deals & Special Offers DIRECTTV deals promotions Order DIRECTV Specials - DIRECT SAT TV 800-400-0296.URL -> hxxp://www.directsattv.com/directv/specialoffers.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Ditzler Orchard Hours.URL -> hxxp://www.ditzlerorchard.com/hours.php
InternetURL: E:\Documents and Settings\Administrator\Favorites\Dr. Thom's Groovy Homepage of Peace, Love and Yogurt.URL -> hxxp://www.rose-hulman.edu/~adams1/bereft.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\DraftExpress Stats.URL -> hxxp://www.draftexpress.com/stats.php?sort=&q=&league=NCAA&year=2008%2F09&per=pergame&min=20&stage=all&conference=Independents&pos=all&qual=all
InternetURL: E:\Documents and Settings\Administrator\Favorites\ESPNU.URL -> hxxp://espnu.xosn.com/HomePage.dbml?db_oem_id=5907&FRM_SPORT_KEY=&schid=&frm_month=11&frm_day=12&frm_year=2009
InternetURL: E:\Documents and Settings\Administrator\Favorites\FIFA.com - 2010 FIFA World Cup South Africa matches and results.URL -> hxxp://www.fifa.com/worldcup/preliminaries/matches/index.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Free Watch Football P2P Streaming schedule.URL -> hxxp://www.asiaplatetv.com/football.php
InternetURL: E:\Documents and Settings\Administrator\Favorites\GameFAQs Marvel Ultimate Alliance (X360) Achievement Guide by oldschool312.URL -> hxxp://www.gamefaqs.com/console/xbox360/file/932586/48114
InternetURL: E:\Documents and Settings\Administrator\Favorites\HAP Book Companion.URL -> hxxp://www.ache.org/pubs/hap_companion/book.cfm?pc=WWW1-2070
InternetURL: E:\Documents and Settings\Administrator\Favorites\Home.URL -> hxxp://www.swaneeorchards.com/index.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\How To Change a 4 Prong Electric Dryer Power Cord To A 3 Prong Electric Power Cord How To Articles.URL -> hxxp://www.ezdiyelectricity.com/?p=445
InternetURL: E:\Documents and Settings\Administrator\Favorites\How to Hire a Kitchen Contractor Kitchens Home & Garden Television.URL -> hxxp://www.hgtv.com/kitchens/how-to-hire-a-kitchen-contractor/index.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\How to Stream TVants to your Xbox 360 using TVersity.url -> hxxp://www.techhackz.com/2009/09/how-to-stream-tvants-to-your-xbox-360.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\http www.fansedge.com Info Sizes.aspx.URL -> hxxp://www.fansedge.com/Info/Sizes.aspx
InternetURL: E:\Documents and Settings\Administrator\Favorites\Indiana Drive-ins - IN - Drive-in movies cinemas outdoor theatres of Indiana.URL -> hxxp://www.driveinmovie.com/IN.htm
InternetURL: E:\Documents and Settings\Administrator\Favorites\iPhone, iPad, or iPod is not recognized by Windows due to driver installation issues.url -> hxxp://support.apple.com/kb/ts1538
InternetURL: E:\Documents and Settings\Administrator\Favorites\Justin.tv - Barcaly Sports - Live Streaming Video.URL -> hxxp://www.justin.tv/barcalysports
InternetURL: E:\Documents and Settings\Administrator\Favorites\Kitchens and Interiors Customized Cabinetry Design.URL -> hxxp://www.kitchensandinteriors.org/contact.htm
InternetURL: E:\Documents and Settings\Administrator\Favorites\Live Football Streams Watch Football Live Online.URL -> hxxp://livefootballstreams.co.uk/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Lulu Dusk Bath Rug - Bed Bath & Beyond.URL -> hxxp://www.bedbathandbeyond.ca/product.asp?MC=1&sku=14589473&
InternetURL: E:\Documents and Settings\Administrator\Favorites\Marvel Ultimate Alliance Cheats - Marvel Ultimate Alliance Codes.URL -> hxxp://www.consolecheatcodes.com/psp/marvelultimatealliancecheats.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Marvel Ultimate Alliance wii Cheats - Error.URL -> hxxp://www.errorforum.com/wii-cheats/5793-marvel-ultimate-alliance-wii-cheats.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\MSN.com.url -> hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=IStart
InternetURL: E:\Documents and Settings\Administrator\Favorites\MyCheats Lost Odyssey Walkthrough, Lost Odyssey Guide, Lost Odyssey FAQ.URL -> hxxp://mycheats.1up.com/view/section/3140482/20364/lost_odyssey/xbox_360
InternetURL: E:\Documents and Settings\Administrator\Favorites\P2P Sports Channels - Sopcast TVAnts TVU.url -> hxxp://www.p2psportchannel.com/channel.php
InternetURL: E:\Documents and Settings\Administrator\Favorites\Pajama Channels Launches College Sports Webcast Service Reuters.URL -> hxxp://www.reuters.com/article/pressRelease/idUS142129+09-Jan-2008+BW20080109
InternetURL: E:\Documents and Settings\Administrator\Favorites\Radio Station Guide.url -> hxxp://www.microsoft.com/isapi/redir.dll?prd=windows&sbp=mediaplayer&plcid=&pver=6.1&os=&over=&olcid=&clcid=&ar=Media&sba=RadioBar&o1=&o2=&o3=
InternetURL: E:\Documents and Settings\Administrator\Favorites\Rentals.url -> hxxp://www.pfister-and-co.com/Rentals%202.htm
InternetURL: E:\Documents and Settings\Administrator\Favorites\Residential Properties - First Financial.URL -> hxxp://www.first-online.com/ResidentialDetails.aspx?SaleID=515
InternetURL: E:\Documents and Settings\Administrator\Favorites\Saint Louis Hotel Renaissance Grand & Suites Downtown St. Louis Hotel.URL -> https://www.marriott.com/hotels/travel/stldt-renaissance-st-louis-grand-and-suites-hotel/
InternetURL: E:\Documents and Settings\Administrator\Favorites\SalukiTalk Home.URL -> hxxp://salukitalk.net/st/index.php
InternetURL: E:\Documents and Settings\Administrator\Favorites\Slow Cooker Beef Stew I - Allrecipes.URL -> hxxp://allrecipes.com/Recipe/Slow-Cooker-Beef-Stew-I/Detail.aspx
InternetURL: E:\Documents and Settings\Administrator\Favorites\Smart Finance.URL -> hxxp://smartfinance.swlearning.com/icf/index.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Superior Cabinet and Supply Co. A Full Service, Quality Oriented Kitchen and Bath Design Firm Located in Terre Haute, Indiana (IN).URL -> hxxp://www.superior-cabinet.com/contact.php
InternetURL: E:\Documents and Settings\Administrator\Favorites\The Secret Restaurant Chef - Starbucks.URL -> hxxp://www.copycatrecipesecrets.com/starbucks.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\TVersity Support Forums  View topic - Get video with AC-3 audio going - Step-by-Step Guide.URL -> hxxp://forums.tversity.com/viewtopic.php?t=8168
InternetURL: E:\Documents and Settings\Administrator\Favorites\TV_Vote Best TV Shows of All Time!.URL -> hxxp://www.richlabonte.net/tvvote/nominations.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\UCSC Library - How To Write a Literature Review.URL -> hxxp://library.ucsc.edu/ref/howto/literaturereview.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\watch-movies.net Watch Movies Online For Free Full Movie Downloads.URL -> hxxp://www.watch-movies-links.net/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Yet Another Basketball Blog Printable Brackets (Fall Edition).URL -> hxxp://yetanotherbasketblog.blogspot.com/2009/11/printable-brackets-fall-edition.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\궀&#147;sorted Bookmarks\EIU Career Services.URL -> hxxp://www.eiu.edu/~careers/students/career_network.php
InternetURL: E:\Documents and Settings\Administrator\Favorites\궀&#147;sorted Bookmarks\Facebook Home.URL -> hxxp://www.facebook.com/home.php?#/profile.php?id=12100394&ref=nf
InternetURL: E:\Documents and Settings\Administrator\Favorites\궀&#147;sorted Bookmarks\Mozilla Firefox Start Page.URL -> hxxp://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-USfficial
InternetURL: E:\Documents and Settings\Administrator\Favorites\趀&#147;sorted Bookmarks\EIU Career Services.URL -> hxxp://www.eiu.edu/~careers/students/career_network.php
InternetURL: E:\Documents and Settings\Administrator\Favorites\趀&#147;sorted Bookmarks\Facebook Home.URL -> hxxp://www.facebook.com/home.php?#/profile.php?id=12100394&ref=nf
InternetURL: E:\Documents and Settings\Administrator\Favorites\趀&#147;sorted Bookmarks\Mozilla Firefox Start Page.URL -> hxxp://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-USfficial
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\A V SVIDEO S-VIDEO AUDIO VIDEO RCA AV SWITCHER SELECTOR - eBay (item 330233840284 end time May-05-08 13 49 49 PDT).URL -> hxxp://cgi.ebay.com/A-V-SVIDEO-S-VIDEO-AUDIO-VIDEO-RCA-AV-SWITCHER-SELECTOR_W0QQitemZ330233840284QQihZ014QQcategoryZ294QQssPageNameZWDVWQQrdZ1QQcmdZViewItem
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\Broadcast International - How to Watch FREE.URL -> hxxp://www.bigskytv.org/index.php?option=com_content&task=view&id=16&Itemid=1
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\Chris Nelson's MLB 2K8 (Xbox 360) Roster Update Thread - ConsoleSports.net.URL -> hxxp://consolesports.net/forums2/index.php?showtopic=3850&st=20
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\CR1_Drivers.zip 2007-04-02 software download - Windows - VersionTracker.URL -> hxxp://www.versiontracker.com/dyn/moreinfo/win/138037
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\expunge0204h.pdf (application pdf Object).URL -> hxxp://www.ag.state.il.us/consumers/brochures/expunge0204h.pdf
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\HLN-Horizon League Network Live Video.URL -> hxxp://www.horizonleaguenetwork.tv/live.aspx?ScheduleID=1303
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\HOUSE OF THE DEAD 1.URL -> hxxp://www.arcadeshowroom.com/index.asp?PageAction=VIEWPROD&ProdID=467
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\Illinois Legal Aid How to File for Executive Clemency.URL -> hxxp://www.illinoislegalaid.org/index.cfm?fuseaction=home.dsp_content&contentID=5185
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\Naki AUTOMATIC 6 SYSTEM SELECTOR A V Audio Video Switch - eBay (item 130219692794 end time May-08-08 12 05 25 PDT).URL -> hxxp://cgi.ebay.com/Naki-AUTOMATIC-6-SYSTEM-SELECTOR-A-V-Audio-Video-Switch_W0QQitemZ130219692794QQihZ003QQcategoryZ73390QQssPageNameZWDVWQQrdZ1QQcmdZViewItem
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\New Corp Job Application.URL -> hxxp://www.newhomebasedccr.com./application.asp
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\Prisoner Review Board Executive Clemency or Expungement.URL -> hxxp://www.state.il.us/prb/prbexclemex.htm
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\Samsung HTC 6600 (cant get dobly digital via optical cable) Please Help - AVS Forum.URL -> hxxp://www.avsforum.com/avs-vb/showthread.php?t=1267909
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\Sony Gateway.URL -> hxxp://www.sonycard.sony.com/sonygateway/gateway.aspx?offerlink=5K
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\TWO (2) LITER GLASS BEER BOOT - BEER BOOTS.URL -> hxxp://www.mybeersteins.com/glass-beer-boots.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\Unity  View forum - General.URL -> hxxp://unityguild.com/forums/viewforum.php?f=2&sid=21737977b75de6fd9f6acffb0a36bdc7
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\View topic - Everquest...The Movie UNITY Still the BEST #$^%$ GUILD in PREXUS !!!.URL -> hxxp://www.idvisdesign.com/unity/modules.php?op=modload&name=PNphpBB2&file=viewtopic&p=4478
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\Xbox.com How To - How To Get Original Xbox Game Support for Xbox 360.URL -> hxxp://www.xbox.com/en-us/games/backwardscompatibility.htm#order
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\usajobs\USAJOBS (From Firefox).URL -> hxxp://jobsearch.usajobs.gov/getjob.asp?JobID=56163910&brd=3876&AVSDM=2009%2D02%2D10+17%3A03%3A13&sort=sl&vw=d&Logo=0&FedPub=Y&pg=12&sorder=d&lid=425&lid=18472&lid=18471&FedEmp=N&paygrademin=7&paygrademax=10&ss=0&TabNum=3&rc=3
InternetURL: E:\Documents and Settings\Administrator\Favorites\Random\usajobs\USAJOBS.URL -> hxxp://jobsearch.usajobs.gov/getjob.asp?JobID=78569199&brd=3876&AVSDM=2009%2D03%2D11+08%3A12%3A56&sort=sl&vw=d&Logo=0&FedPub=Y&pg=12&sorder=d&lid=425&lid=18472&lid=18471&FedEmp=N&paygrademin=7&paygrademax=10&ss=0&TabNum=3&rc=5
InternetURL: E:\Documents and Settings\Administrator\Favorites\Photography\1000 Words Photography.URL -> hxxp://www.1000wordsphotography.org/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Photography\Chicago Wedding Photographer, Chicago Wedding Photography,Dayna Schroeder Photography.URL -> hxxp://www.daynaschroeder.com/#
InternetURL: E:\Documents and Settings\Administrator\Favorites\Photography\Chicago Wedding photography - Fred Fox.URL -> hxxp://www.fredfox.com/wed/weddingH.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Photography\Edward Weiland Photography contact 312-543-3775 (From Firefox).URL -> hxxp://www.edwardpics.com/index2.php?v=v1
InternetURL: E:\Documents and Settings\Administrator\Favorites\Photography\Edward Weiland Photography contact 312-543-3775.URL -> hxxp://www.edwardpics.com/#
InternetURL: E:\Documents and Settings\Administrator\Favorites\Photography\FAQ Why Choose SMS Design Photography & Video for your Wedding Videography Serving Chicagoland, Michigan and Destination Weddings Wedding Videographer & Photographer.URL -> hxxp://www.smsdesign-weddingvideo.com/faqvideoquestions.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Photography\Kramer Photographers Wedding Gallery.URL -> hxxp://www.kramerphotographers.com/weddinggallery.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Photography\Michael Anthony Studios.URL -> hxxp://www.michaelanthonystudios.com/wedResources.htm
InternetURL: E:\Documents and Settings\Administrator\Favorites\Photography\Photography by Canapary, Canapary photography.URL -> hxxp://www.canaparyphotography.com/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Photography\Studio One Photography - Chicago, Illinois - Weddings and Portrait Studios.URL -> hxxp://www.studioonenaperville.com/2007/galleries/index.htm
InternetURL: E:\Documents and Settings\Administrator\Favorites\Photography\Wedding Photography Portfolio - Wedding Photographers Chicago, IL.URL -> hxxp://www.georgestreetpv.com/wedding_photography_portfolio.php
InternetURL: E:\Documents and Settings\Administrator\Favorites\Music\Band Or Song Name Mp3 Download.URL -> hxxp://www.mp3raid.com/search/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Music\Carrie Underwood - That's Where It Is.mp3 Download & Play - Free.URL -> hxxp://www.aimini.net/view/?fid=g64wzamLqEkpVnUmY2Sa
InternetURL: E:\Documents and Settings\Administrator\Favorites\Music\Search Results You're the Reason ben Elbows Music Blog Aggregator.URL -> hxxp://elbo.ws/search/?q=You%27re+the+Reason+ben&sort=
InternetURL: E:\Documents and Settings\Administrator\Favorites\Music\Top Classic Oldies.URL -> hxxp://www.arenaproduction.com/Top%20Classic%20Oldies.htm
InternetURL: E:\Documents and Settings\Administrator\Favorites\Music\Watch Movies Online For Free Full Movie Downloads.URL -> hxxp://www.watch-movies.net/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Music\Zamzar - Free online file conversion.URL -> hxxp://www.zamzar.com/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Microsoft Websites\IE Add-on site.url -> hxxp://go.microsoft.com/fwlink/?LinkId=50893
InternetURL: E:\Documents and Settings\Administrator\Favorites\Microsoft Websites\IE site on Microsoft.com.url -> hxxp://go.microsoft.com/fwlink/?linkid=44661
InternetURL: E:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Marketplace.url -> hxxp://go.microsoft.com/fwlink/?linkid=69151
InternetURL: E:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Microsoft At Home.url -> hxxp://go.microsoft.com/fwlink/?linkid=55424
InternetURL: E:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Microsoft At Work.url -> hxxp://go.microsoft.com/fwlink/?linkid=68920
InternetURL: E:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Microsoft Store.url -> hxxp://go.microsoft.com/fwlink/?linkid=140813
InternetURL: E:\Documents and Settings\Administrator\Favorites\Microsoft Websites\Welcome to IE7.url -> hxxp://go.microsoft.com/fwlink/?linkid=68919
InternetURL: E:\Documents and Settings\Administrator\Favorites\Loans\Citibank Citibank student loans, research payment options, and more at Studentloan.com.URL -> https://studentloan.citibank.com/s/slcsite/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Loans\Direct Services Loan.URL -> https://www.dlssonline.com/borrower/BorrowerLogout.jsp
InternetURL: E:\Documents and Settings\Administrator\Favorites\Loans\Financial Aid Review -- JOSH A HUNT.URL -> https://www.nslds.ed.gov/nslds_SA/SaFinShowSummary.do
InternetURL: E:\Documents and Settings\Administrator\Favorites\Loans\My Loan Summary.URL -> https://www.mygreatlakes.org/borrower/loanSummary.page?menuID=loansumm&selected=true
InternetURL: E:\Documents and Settings\Administrator\Favorites\Loans\n e l n e t -.URL -> https://www.nelnet.net/accounts/account.aspx?page=login&type=b&lang=en
InternetURL: E:\Documents and Settings\Administrator\Favorites\Loans\University Accounting Services Site 2 10.100.5.216.URL -> https://www.uasecho.com/login.asp
InternetURL: E:\Documents and Settings\Administrator\Favorites\Links\Dell Community.url -> hxxp://en.community.dell.com/support-forums/software-os/w/microsoft_os/3317.2-3-microsoft-windows-vista-official-iso-download-links-digital-river.aspx
InternetURL: E:\Documents and Settings\Administrator\Favorites\Links\Free Hotmail.url -> hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=hotmail
InternetURL: E:\Documents and Settings\Administrator\Favorites\Links\How to Remove Mystart.incredibar.com ( Mystart by Incredibar Removal Guide)- AnviSoft.url -> hxxp://forums.anvisoft.com/viewtopic-45-2500-0.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Links\Suggested Sites.url -> https://ieonline.microsoft.com/#ieslice
InternetURL: E:\Documents and Settings\Administrator\Favorites\IU Facebook Trivia\06expmbbhistory.pdf (application pdf Object).URL -> hxxp://grfx.cstv.com/photos/schools/ind/sports/m-baskbl/auto_pdf/06expmbbhistory.pdf
InternetURL: E:\Documents and Settings\Administrator\Favorites\IU Facebook Trivia\Hoosier Historia Catching Up With .URL -> hxxp://www.heraldtimesonline.com/sports/hh/cuw/?sid=165
InternetURL: E:\Documents and Settings\Administrator\Favorites\IU Facebook Trivia\Indiana Hoosiers in the NCAA Tournament - Basketball State.URL -> hxxp://www.bbstate.com/school.php?s=IND&a=tournament
InternetURL: E:\Documents and Settings\Administrator\Favorites\IU Facebook Trivia\Indiana Hoosiers men's basketball - Wikipedia, the free encyclopedia.URL -> hxxp://en.wikipedia.org/wiki/Indiana_Hoosiers_men%27s_basketball
InternetURL: E:\Documents and Settings\Administrator\Favorites\IU Facebook Trivia\Inside Indiana Basketball With Kelvin Sampson Starts Monday - .URL -> hxxp://iuhoosiers.cstv.com/sports/m-baskbl/spec-rel/111607aac.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Houses\Indiana Real Estate RE MAX of Indiana.URL -> hxxp://www.findmyindianahome.com/remaxin/?p=findahome.asp&page=search&search=&selected=qck&listing=true&TargetMLS=460&ptd=&mlsnumber=56614&mlsid=460
InternetURL: E:\Documents and Settings\Administrator\Favorites\House\Bridge Loans From the $8000 Tax Credit Home Buyers Can Use $8000 Credit for Down Payment and Closing Costs Suite101.com.URL -> hxxp://personalbudgeting.suite101.com/article.cfm/bridge_loans_from_the_8000_tax_credit
InternetURL: E:\Documents and Settings\Administrator\Favorites\House\IHCDA Home Buyers.URL -> hxxp://www.in.gov/ihcda/2507.htm
InternetURL: E:\Documents and Settings\Administrator\Favorites\House\IHCDA Limits & Lenders.URL -> hxxp://www.in.gov/ihcda/2364.htm
InternetURL: E:\Documents and Settings\Administrator\Favorites\House\Knowledge Factor.URL -> https://ihcda.knowledgefactor.com/login.php
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\Amazon.com Casio Exilim EX-S880 8.1MP Digital Camera with 3x Anti-Shake Optical Zoom (Red) Camera & Photo.URL -> hxxp://www.amazon.com/gp/product/B000UWYKOK/ref=cm_cr_pr_product_top
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\Amazon.com Casio Exilim EX-Z75 7.2MP Digital Camera with 3x Anti Shake Optical Zoom (Pink) Camera & Photo.URL -> hxxp://www.amazon.com/gp/product/B000MXLAHC/ref=cm_cr_pr_product_top
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\Amazon.com Coolpix S700 12.1MP Digital Camera with 3x Optical Zoom with Vibration Reduction (Silver) Camera & Photo.URL -> hxxp://www.amazon.com/gp/product/B000VRR9B0/ref=cm_cr_pr_product_top
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\Amazon.com Nikon Coolpix S51 8.1MP Digital Camera with 3x Optical Vibration Reduction Zoom (Matte Black) Camera & Photo.URL -> hxxp://www.amazon.com/gp/product/B000VD5PEM/ref=cm_cr_pr_product_top
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\Amazon.com Panasonic Lumix DMC-FX33K 8.1MP Digital Camera with 3.6x Wide Angle MEGA Optical Image Stabilized Zoom (Black) Camera & Photo.URL -> hxxp://www.amazon.com/Panasonic-DMC-FX33K-Digital-Optical-Stabilized/dp/B000TM5CY8/ref=sr_1_92?ie=UTF8&s=photo&qid=1203051654&sr=1-92
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\Amazon.com Used and New Gamecube Console Platinum.URL -> hxxp://www.amazon.com/gp/offer-listing/B00006IJJI/sr=8-1/qid=1205084641/ref=olp_pg_new?ie=UTF8&coliid=&startIndex=0&me=&qid=1205084641&sr=8-1&seller=&colid=&condition=new
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\Chicago Cubs Ticketing (From Firefox).URL -> hxxp://frontline.purchasenow3.tickets.com/buy/MLBEventInfo?pid=6336215&roomid=5
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\Chicago Cubs Ticketing.URL -> hxxp://frontline.purchasenow3.tickets.com/buy/MLBEventInfo?pid=6336227&roomid=5
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\CN8 Live!.URL -> hxxp://www.cn8.tv/video/cn8live.asp?lChannelID=604&subhead=#
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\College basketball - Wikipedia, the free encyclopedia.URL -> hxxp://en.wikipedia.org/wiki/College_basketball
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\Indiana State Sycamores Stats - College Basketball - StatSheet.com.URL -> 0
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\NCAA - MyP2P Forum.URL -> hxxp://www.myp2pforum.eu/ncaa/
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\North Carolina A&T Aggies Stats NCAA College Basketball at CBSSports.com.URL -> hxxp://www.sportsline.com/collegebasketball/teams/stats/NCAT
InternetURL: E:\Documents and Settings\Administrator\Favorites\eh\The Sports Network - Men's College Basketball-Colonial Athletic Association.URL -> hxxp://www.sportsnetwork.com/merge/tsnform.aspx?c=sportsnetwork&page=cbask/conf/colonial/leaguesn.aspx?league=Colonial
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Ashcroft & Oak - Guest Services Make a Payment.URL -> https://www.ashcroftandoak.com/payments/default.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Bank of America Home Personal.URL -> https://www.bankofamerica.com/index.jsp
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Best Buy.URL -> hxxp://www.bestbuy.com/site/olspage.jsp?id=pcmcat102500050032&type=category
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Capital One Credit Cards, Home & Auto Loans, Banking, Small Business Credit Card.URL -> hxxp://www.capitalone.com/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Chase Personal Banking Investments Credit Cards Home Auto Commercial Small Business Insurance.URL -> hxxp://www.chase.com/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Citi® Credit Cards, Citibank, Travel Reward Credit Cards, Small Business Credit Cards, Student Credit Cards.URL -> https://www.citicards.com/cards/wv/home.do
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Continue.URL -> https://login.live.com/login.srf?wa...g.microsoft.com/Default.aspx&lc=1033&id=23240
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Credit Card Minimum Payment Calculator.URL -> hxxp://www.csgnetwork.com/creditcardmincalc.html
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\DIRECTV.URL -> hxxp://directv.com/DTVAPP/index.jsp
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Discover Card.URL -> hxxp://www.discovercard.com/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Duke Energy Corporation.URL -> hxxp://www.duke-energy.com/
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Furniture Row Online Customer Care - Signed Off Online Customer Care.URL -> https://www.hrsaccount.com/hrs/ecar...8RzoZ4V3FCrYiIz:12kf0j28q?cmd_Logoff=&org=593
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Gevalia.com - 30 days of free coffee.URL -> hxxp://www.gevalia.com/Gevalia/continuity/enroll/30dayfree.aspx?keycode=118756&isSplit=true
InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Old National Bank Home.URL -> https://www.oldnational.com/


----------



## joshadam84 (Feb 18, 2015)

Shortcut (2 of 2)

InternetURL: E:\Documents and Settings\Administrator\Favorites\Credit Cards Bills\Verizon Wireless.URL -> hxxp://www.verizonwireless.com/b2c/index.html?tab=myaccount&lid=//global//my+account
InternetURL: E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.torconnectpaycom/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Winamp\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Winamp\Plugins\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Winamp\Plugins\ml\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Skype\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Skype\shared_httpfe\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Skype\shared_dynco\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Skype\joshadam84\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Samsung\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Samsung\AllShare\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Samsung\AllShare\DB\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\weather\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\update\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\superpass\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\images\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\dashboard.old\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\dashboard.old\images\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\dashboard\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\dashboard\images\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\RealPlayer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\RealPlayer\device\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\RealPlayer\db\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\RealMediaSDK\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\user\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\user\gallery\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\user\database\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\user\database\biblio\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\iMacros\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\iMacros\Datasources\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\extensions\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\samples\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\samples\Datasources\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Microsoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Microsoft\Document Building Blocks\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Microsoft\Document Building Blocks\1033\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Canon\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\index\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Adobe\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Adobe\Flash Player\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Adobe\Adobe  Media Player\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Adobe\Adobe Media Player\Local Store\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Adobe\Adobe Media Player\Local Store\measurement\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Start Menu\Programs\Protected Music Converter\Order Protected Music Converter Online.url -> https://www.regnow.com/softsell/nph-softsell.cgi?item=5452-7
InternetURL: E:\Documents and Settings\All Users\Start Menu\Programs\Protected Music Converter\Visit Our Website.url -> hxxp://www.wma-mp3.com
InternetURL: E:\Documents and Settings\All Users\Start Menu\Programs\iMacros\Online User Manual.url -> hxxp://wiki.imacros.net/
InternetURL: E:\Documents and Settings\All Users\Start Menu\Programs\iMacros\User Forum.url -> hxxp://forum.imacros.net
InternetURL: E:\Documents and Settings\All Users\Start Menu\Programs\CCleaner\CCleaner Homepage.url -> hxxp://www.piriform.com/ccleaner
InternetURL: E:\Documents and Settings\All Users\Start Menu\Programs\AIM\Visit AIM.com.url -> hxxp://www.aim.com
InternetURL: E:\Documents and Settings\All Users\DRM\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}\x86\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype Extras\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype Extras\Plugins\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype Extras\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\Plugins\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\Apps\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\Apps\login\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\Apps\login\images\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\speech\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\speech\tl-PH\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\speech\es-419\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\languages\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\documentation\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\RocketReader\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\RocketReader\RocketReader\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Real\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Real\RealShare\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Real\RealShare\Flash\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Real\RealPlayer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Pure Networks\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Pure Networks\Platform\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Pure Networks\Log\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Microsoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Microsoft\Media Index\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\MFAData\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\MediaMall\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\MediaMall\MyMedia\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Logitech\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Logitech\LWS\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Logitech\LWS\PrivacyShades\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\LogiShrd\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\LogiShrd\Updater\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\LogiShrd\LQCVFX\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\LogiShrd\LQCVFX\PrivacyShades\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Lavasoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Lavasoft\AntiMalware\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Lavasoft\AntiMalware\Logs\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\D1A5\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\CanonBJ\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon MP250 series Printer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\avg9\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\avg9\scanlogs\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Apple Computer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Apple Computer\iTunes\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Apple Computer\iTunes\SC Info\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\AOL OCP\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\8128\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\371B5\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\36FA\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\30392\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\2D3C8\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\29222\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\272A3\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\212DE\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\1EDA\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\1B1A5\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\1B109\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\1336B\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\11E4\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Default User\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Default User\Application Data\Microsoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\11.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Chromium\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Chromium\User Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Chromium\User Data\Default\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Cookies\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\Mozilla\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\rwggjwwd.default\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\Adobe\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\Adobe\Flash Player\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media Player NSS\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media Player NSS\3.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media Player NSS\3.0\Icon Files\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media\11.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Media Player\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Chromium\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Chromium\User Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Chromium\User Data\Default\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Cookies\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v

==================== End of log =============================


----------



## joshadam84 (Feb 18, 2015)

I'm saving the Search.txt as an attachment if that's ok. If you prefer me to copy/paste it let me know. It's about 35k characters.


----------



## JSntgRvr (Jul 1, 2003)

Download the enclosed file. (see below) Save it in the same location *FRST* is saved. Open FRST as you did before, except that this time around, click on the *Fix* button and wait. The tool will produce a log, *fixlog.txt*. Please post its contents on your next reply.


----------



## joshadam84 (Feb 18, 2015)

The contents were too big. Attached is the fixlog.


----------



## JSntgRvr (Jul 1, 2003)

I see an error when attempting to delete one of these HELP_DECRYPT files. Run the following command to confirm if all have been removed:

Press the Windows Key+R. At the Run command type or copy and paste the following command and click OK.


```
CMD /C Dir /B /S E:\HELP_DECRYPT* >"%Userprofile%\Desktop\Log.txt"
```
It should produce a *log.txt* on your desktop. Once the MSDOS window closes, open this file and post its contents in a reply.

Download the enclosed file. (see below) Save it in the same location *FRST* is saved. Open FRST as you did before, except that this time around, click on the *Fix* button and wait. The tool will produce a log, *fixlog.txt*. Please post its contents on your next reply.


----------



## joshadam84 (Feb 18, 2015)

I tried the command but it's not resulting in anything in the log.txt. I went into cmd to manually type it but it stats /c dir isn't recognizable as a command.


----------



## joshadam84 (Feb 18, 2015)

Fixlog results:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 18-02-2015 01
Ran by Administrator at 2015-02-19 21:40:00 Run:2
Running from F:\Documents and Settings\Administrator\My Documents\Downloads
Loaded Profiles: Administrator (Available profiles: Administrator)
Boot Mode: Safe Mode (with Networking)

==============================================

Content of fixlist:
*****************
Start
InternetURL: E:\Documents and Settings\Administrator\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\The Weather Channel\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\The Weather Channel\Framework\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\NETGEARGenie\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\NETGEARGenie\pic\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\NETGEARGenie\pic\default\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Nero\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Nero\SharedMediaData\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\9.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\11.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\10.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Mail\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Mail\Sentinel\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Mail\Backup\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Mail\Backup\new\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\DBStore\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\DBStore\Backup\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\DBStore\Backup\new(2)\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\DBStore\Backup\new\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\DBStore\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\DBStore\Backup\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\DBStore\Backup\new(2)\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\DBStore\Backup\new\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\HELP_DECRYPT.UR L -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\tkmsx25x5euddux rt1ldlz5hwgtnl3zb0nc2nirbm2wdxm1f0xaaadfa\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\tkmsx25x5euddux rt1ldlz5hwgtnl3zb0nc2nirbm2wdxm1f0xaaadfa\f\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\qyzgmprsrfvdi1d ud3uhxotpjjuckeishl2ttb4tzqqxe1rezlaaaaha\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\qyzgmprsrfvdi1d ud3uhxotpjjuckeishl2ttb4tzqqxe1rezlaaaaha\f\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\gx2dtgu0jwm3beh ddpeqaxumfnjfj0aese4jbh5v112dfe1kacaaaafa\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\gx2dtgu0jwm3beh ddpeqaxumfnjfj0aese4jbh5v112dfe1kacaaaafa\f\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\bgcduenfjq4yxoy zxbnpzmnre2vbsyux4fgcqsgngulhhfsf45aaaaba\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\bgcduenfjq4yxoy zxbnpzmnre2vbsyux4fgcqsgngulhhfsf45aaaaba\f\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Messenger\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd\Vid\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd\Vid\storage\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd\Vid\storage\https_app.sightspeed.com_0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Google Desktop\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Google Desktop\712c7597ab51\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Sync Data Backup\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_1\audio \HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\adaware\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Local Settings\Application Data\adaware\data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.torconnectpaycom/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Winamp\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Winamp\Plugins\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Winamp\Plugins\ml\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Skype\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Skype\shared_httpfe\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Skype\shared_dynco\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Skype\joshadam84\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Samsung\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Samsung\AllShare\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Samsung\AllShare\DB\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\weather\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\update\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\superpass\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\images\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\dashboard.old\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\dashboard.old\images\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\dashboard\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\dashboard\images\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\RealPlayer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\RealPlayer\device\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\RealPlayer\db\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Real\RealMediaSDK\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\user\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\user\gallery\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\user\database\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\user\database\biblio\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\iMacros\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\extensions\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\samples\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\samples\Datasources\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Microsoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Microsoft\Document Building Blocks\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Microsoft\Document Building Blocks\1033\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Canon\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\index\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Adobe\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Adobe\Flash Player\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Adobe\Adobe Media Player\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Adobe\Adobe Media Player\Local Store\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Administrator\Application Data\Adobe\Adobe Media Player\Local Store\measurement\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\DRM\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}\x86\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype Extras\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype Extras\Plugins\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype Extras\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\Plugins\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\HELP_DECRYPT.UR L -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\Apps\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\Apps\login\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Skype\Apps\login\images\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\speech\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\speech\tl-PH\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\speech\es-419\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\languages\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\documentation\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\RocketReader\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\RocketReader\RocketReader\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Real\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Real\RealShare\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Real\RealShare\Flash\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Real\RealPlayer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Pure Networks\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Pure Networks\Platform\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Pure Networks\Log\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Microsoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Microsoft\Media Index\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\MFAData\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\MediaMall\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\MediaMall\MyMedia\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Logitech\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Logitech\LWS\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Logitech\LWS\PrivacyShades\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\LogiShrd\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\LogiShrd\Updater\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\LogiShrd\LQCVFX\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\LogiShrd\LQCVFX\PrivacyShades\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Lavasoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Lavasoft\AntiMalware\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Lavasoft\AntiMalware\Logs\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\D1A5\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\CanonBJ\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon MP250 series Printer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\avg9\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\avg9\scanlogs\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Apple Computer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Apple Computer\iTunes\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\Apple Computer\iTunes\SC Info\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\AOL OCP\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\8128\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\371B5\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\36FA\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\30392\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\2D3C8\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\29222\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\272A3\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\212DE\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\1EDA\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\1B1A5\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\1B109\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\1336B\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\All Users\Application Data\11E4\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Default User\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Default User\Application Data\Microsoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\11.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Chromium\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Chromium\User Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Local Settings\Application Data\Chromium\User Data\Default\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Cookies\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\Mozilla\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\rwggjwwd.default\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\Adobe\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\LocalService\Application Data\Adobe\Flash Player\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media Player NSS\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media Player NSS\3.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media Player NSS\3.0\Icon Files\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media\11.0\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Media Player\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Chromium\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Chromium\User Data\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Local Settings\Application Data\Chromium\User Data\Default\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
InternetURL: E:\Documents and Settings\NetworkService\Cookies\HELP_DECRYPT.URL -> hxxp://paytoc4gtpn5czl2.optionstorpay22.com/16xpN8v
End
*****************

E:\Documents and Settings\Administrator\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\The Weather Channel\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\The Weather Channel\Framework\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\NETGEARGenie\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\NETGEARGenie\pic\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\NETGEARGenie\pic\default\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Nero\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Nero\SharedMediaData\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\9.0\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\11.0\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Media\10.0\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Mail\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Mail\Sentinel\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Mail\Backup\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Mail\Backup\new\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\DBStore\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\DBStore\Backup\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\DBStore\Backup\new(2)\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{b8540743-b505-4b17-9218-025013b803a0}\DBStore\Backup\new\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\DBStore\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\DBStore\Backup\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\DBStore\Backup\new(2)\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows Live Contacts\{338a93e5-8a10-4acb-adb1-68cbf05c1cba}\DBStore\Backup\new\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\HELP_DECRYPT.UR L not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\tkmsx25x5euddux rt1ldlz5hwgtnl3zb0nc2nirbm2wdxm1f0xaaadfa\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\tkmsx25x5euddux rt1ldlz5hwgtnl3zb0nc2nirbm2wdxm1f0xaaadfa\f\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\qyzgmprsrfvdi1d ud3uhxotpjjuckeishl2ttb4tzqqxe1rezlaaaaha\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\qyzgmprsrfvdi1d ud3uhxotpjjuckeishl2ttb4tzqqxe1rezlaaaaha\f\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\gx2dtgu0jwm3beh ddpeqaxumfnjfj0aese4jbh5v112dfe1kacaaaafa\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\gx2dtgu0jwm3beh ddpeqaxumfnjfj0aese4jbh5v112dfe1kacaaaafa\f\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\bgcduenfjq4yxoy zxbnpzmnre2vbsyux4fgcqsgngulhhfsf45aaaaba\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Silverlight\is\rtck5b5c.jec\fk1qwwp1.znx\1\s\bgcduenfjq4yxoy zxbnpzmnre2vbsyux4fgcqsgngulhhfsf45aaaaba\f\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Messenger\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd\Vid\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd\Vid\storage\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\LogiShrd\Vid\storage\https_app.sightspeed.com_0\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Google Desktop\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Google Desktop\712c7597ab51\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Sync Data Backup\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5023_1\audio \HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\databases\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\adaware\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Local Settings\Application Data\adaware\data\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Winamp\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Winamp\Plugins\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Winamp\Plugins\ml\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Skype\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Skype\shared_httpfe\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Skype\shared_dynco\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Skype\joshadam84\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Samsung\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Samsung\AllShare\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Samsung\AllShare\DB\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\Update\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\weather\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\update\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\superpass\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\Update\setup\data\RUP\pages\images\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\dashboard.old\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\dashboard.old\images\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\dashboard\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\rhapsody\dashboard\images\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\RealPlayer\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\RealPlayer\device\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\RealPlayer\db\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Real\RealMediaSDK\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\user\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\user\gallery\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\user\database\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\OpenOffice.org2\user\database\biblio\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\iMacros\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\extensions\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\samples\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\samples\Datasources\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Microsoft\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Microsoft\Document Building Blocks\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Microsoft\Document Building Blocks\1033\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Canon\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Canon\MP Navigator EX V30\index\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Adobe\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Adobe\Flash Player\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Adobe\Adobe Media Player\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Adobe\Adobe Media Player\Local Store\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Administrator\Application Data\Adobe\Adobe Media Player\Local Store\measurement\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\DRM\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}\x86\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Skype Extras\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Skype Extras\Plugins\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Skype Extras\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Skype\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Skype\Plugins\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\HELP_DECRYPT.UR L not found.
E:\Documents and Settings\All Users\Application Data\Skype\Apps\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Skype\Apps\login\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Skype\Apps\login\images\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Rosetta Stone\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\speech\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\speech\tl-PH\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\speech\es-419\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\languages\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Rosetta Stone\Content\documentation\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\RocketReader\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\RocketReader\RocketReader\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Real\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Real\RealShare\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Real\RealShare\Flash\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Real\RealPlayer\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Pure Networks\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Pure Networks\Platform\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Pure Networks\Log\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Microsoft\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Microsoft\Media Index\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\MFAData\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\MediaMall\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\MediaMall\MyMedia\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Logitech\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Logitech\LWS\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Logitech\LWS\PrivacyShades\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\LogiShrd\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\LogiShrd\Updater\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\LogiShrd\LQCVFX\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\LogiShrd\LQCVFX\PrivacyShades\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Lavasoft\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Lavasoft\AntiMalware\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Lavasoft\AntiMalware\Logs\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\D1A5\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\CanonBJ\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\CanonBJ\IJPrinter\CNMWINDOWS\Canon MP250 series Printer\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\avg9\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\avg9\scanlogs\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Apple Computer\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Apple Computer\iTunes\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\Apple Computer\iTunes\SC Info\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\AOL OCP\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\8128\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\371B5\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\36FA\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\30392\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\2D3C8\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\29222\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\272A3\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\212DE\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\1EDA\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\1B1A5\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\1B109\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\1336B\HELP_DECRYPT.URL not found.
E:\Documents and Settings\All Users\Application Data\11E4\HELP_DECRYPT.URL not found.
E:\Documents and Settings\Default User\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Default User\Application Data\Microsoft\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\11.0\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Local Settings\Application Data\Chromium\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Local Settings\Application Data\Chromium\User Data\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Local Settings\Application Data\Chromium\User Data\Default\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Cookies\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Application Data\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Application Data\Mozilla\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Application Data\Mozilla\Firefox\Profiles\rwggjwwd.default\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Application Data\Adobe\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\LocalService\Application Data\Adobe\Flash Player\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Local Settings\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Local Settings\Application Data\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media Player NSS\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media Player NSS\3.0\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media Player NSS\3.0\Icon Files\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows Media\11.0\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Media Player\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Local Settings\Application Data\Chromium\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Local Settings\Application Data\Chromium\User Data\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Local Settings\Application Data\Chromium\User Data\Default\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\NetworkService\Cookies\HELP_DECRYPT.URL => Moved successfully.

==== End of Fixlog 21:40:01 ====


----------



## JSntgRvr (Jul 1, 2003)

Lets confirm.

Download the enclosed file. (see below) Save it in the same location *FRST* is saved. Open FRST as you did before, except that this time around, click on the *Fix* button and wait. The tool will produce a log, *fixlog.txt*. Please post its contents on your next reply.


----------



## joshadam84 (Feb 18, 2015)

Attached is the fixlog!


----------



## JSntgRvr (Jul 1, 2003)

We need to remove the tools we've used during cleaning your machine and the quarantine":


Download Delfix from *here*
Ensure *Remove disinfection tools* is ticked
*Also tick:
*
Create registry backup
Purge system restore










Click *Run*
The program will run for a few moments and then notepad will open with a log. Please paste the log in your next reply








Please download *Malwarebytes Anti-Malware* to your desktop

Double-click *mbam-setup-version.exe* and follow the prompts to install the program.
At the end, be sure a check-mark is placed next to the following:
*Enable free trial of Malwarebytes Anti-Malware Premium*
*Launch Malwarebytes Anti-Malware*

Then click *Finish*.
If an update is found, you will be prompted to download and install the latest version.
Once the program has loaded, select *Scan now*. Or select the *Threat Scan* from the Scan menu.
When the scan is complete , make sure that *everything* is set to "Quarantine", and click *Apply Actions*.
Reboot your computer if prompted.
Extra Note:

*If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.*

The log is available throughout History ->Application logs. Please post it contents in your next reply.


----------



## joshadam84 (Feb 18, 2015)

Delfix:
# DelFix v10.8 - Logfile created 21/02/2015 at 16:12:31
# Updated 29/07/2014 by Xplode
# Username : Administrator - JOSH-H
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)

~ Removing disinfection tools ...

Deleted : E:\FRST
Deleted : E:\AdwCleaner
Deleted : E:\Program Files\Trend Micro\Hijackthis
Deleted : E:\Documents and Settings\Administrator\Desktop\JRT.txt
Deleted : E:\Documents and Settings\Administrator\Desktop\Log.txt
Deleted : F:\Documents and Settings\Administrator\My Documents\Downloads\Addition.txt
Deleted : F:\Documents and Settings\Administrator\My Documents\Downloads\AdwCleaner.exe
Deleted : F:\Documents and Settings\Administrator\My Documents\Downloads\Fixlog.txt
Deleted : F:\Documents and Settings\Administrator\My Documents\Downloads\FRST.exe
Deleted : F:\Documents and Settings\Administrator\My Documents\Downloads\FRST.txt
Deleted : F:\Documents and Settings\Administrator\My Documents\Downloads\JRT.exe
Deleted : F:\Documents and Settings\Administrator\My Documents\Downloads\Search.txt
Deleted : F:\Documents and Settings\Administrator\My Documents\Downloads\Shortcut.txt
Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\HijackThis
Deleted : HKLM\SOFTWARE\AdwCleaner
Deleted : HKLM\SOFTWARE\TrendMicro\Hijackthis

~ Creating registry backup ... OK

~ Cleaning system restore ...


New restore point created !

########## - EOF - ##########


----------



## joshadam84 (Feb 18, 2015)

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2/21/2015
Scan Time: 4:23:23 PM
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.02.21.08
Rootkit Database: v2015.02.20.01
License: Trial
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows XP Service Pack 3
CPU: x86
File System: NTFS
User: Administrator

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 325086
Time Elapsed: 29 min, 31 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 2
Trojan.Agent.EV, HKU\S-1-5-21-1275210071-764733703-839522115-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\CONTROL PANEL\DESKTOP|SCRNSAVE.EXE, "E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe", Quarantined, [16a1ad73494156e030a9535f83800ff1]
Trojan.Agent, HKU\S-1-5-21-1275210071-764733703-839522115-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|Run, "E:\Documents and Settings\Administrator\Application Data\Microsoft\Windows\IEUpdate\msg.exe", Quarantined, [ac0bdd43b6d45dd9300f25867093d030]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 3
Trojan.Agent.0BGen2, E:\Documents and Settings\Administrator\Local Settings\Temp\73.tmp, Quarantined, [2e8927f97b0f8bab390b020b22e01ae6], 
Trojan.FakeMS, E:\Documents and Settings\Administrator\Local Settings\Temp\C3.tmp, Quarantined, [5265c25e6624bb7b55a37da726dc0000], 
Trojan.FakeMS.ED, E:\Documents and Settings\Administrator\Local Settings\Temp\tm6F.tmp, Quarantined, [991e140c5d2dca6cca6046e01ce64fb1],

Physical Sectors: 0
(No malicious items detected)

(end)


----------



## joshadam84 (Feb 18, 2015)

I just ran a normal startup (not safe mode), and it seems like something is still lingering. Malwarebytes continuously blocks the following:

Malicious Website Blocked
91.212.124.167

Also, when I open AVG to update .. the update fails.

Here's a log of the blocked website:

Malwarebytes Anti-Malware
www.malwarebytes.org

Detection, 2/21/2015 12:02:29 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:02:38 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:02:44 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:02:53 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:03:13 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:03:16 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:03:22 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:03:37 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:03:40 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:03:47 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:04:19 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:04:22 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:04:29 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:04:40 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:04:43 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:04:49 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:05:09 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:05:12 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:05:19 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:05:32 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:05:35 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:05:41 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:06:14 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:06:23 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:06:42 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:06:51 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:07:33 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:07:42 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 12:10:00 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 5.149.250.194, 0, Outbound, 
Detection, 2/21/2015 12:10:02 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 5.149.250.194, 0, Outbound, 
Detection, 2/21/2015 12:10:09 AM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 5.149.250.194, 0, Outbound, 
Detection, 2/21/2015 12:12:00 AM, SYSTEM, JOSH-H, Protection, Malware Protection, File, Trojan.Dorkbot.ED, E:\Documents and Settings\Administrator\Local Settings\Temp\9C.tmp, Quarantine, [c2f7ec3499f170c66c259fe83ac7f907]
Protection, 2/21/2015 4:01:28 PM, SYSTEM, JOSH-H, Protection, Malware Protection, Starting, 
Protection, 2/21/2015 4:01:28 PM, SYSTEM, JOSH-H, Protection, Malware Protection, Started, 
Protection, 2/21/2015 4:01:28 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, Starting, 
Protection, 2/21/2015 4:02:55 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, Started, 
Detection, 2/21/2015 4:06:00 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:06:03 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:06:09 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:06:16 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:06:19 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:06:25 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:06:37 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:06:40 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:06:46 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:06:53 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:06:56 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:07:02 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:07:14 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:07:17 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:07:23 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:07:30 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:07:33 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:07:39 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:07:51 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:07:54 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:08:00 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:08:07 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:08:10 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 4:08:16 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Update, 2/21/2015 4:18:48 PM, SYSTEM, JOSH-H, Manual, Remediation Database, 2013.10.16.1, 2014.12.6.1, 
Update, 2/21/2015 4:18:48 PM, SYSTEM, JOSH-H, Manual, Rootkit Database, 2014.11.18.1, 2015.2.20.1, 
Update, 2/21/2015 4:18:56 PM, SYSTEM, JOSH-H, Manual, Malware Database, 2014.11.20.6, 2015.2.21.8, 
Scan, 2/21/2015 4:55:14 PM, SYSTEM, JOSH-H, Manual, Start:2/21/2015 4:23:23 PM, Duration:29 min 31 sec, Threat Scan, Completed, 5 Malware Detections, 0 Non-Malware Detections, 
Protection, 2/21/2015 5:04:53 PM, SYSTEM, JOSH-H, Protection, Malware Protection, Starting, 
Protection, 2/21/2015 5:04:54 PM, SYSTEM, JOSH-H, Protection, Malware Protection, Started, 
Protection, 2/21/2015 5:04:54 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, Starting, 
Protection, 2/21/2015 5:05:39 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, Started, 
Detection, 2/21/2015 5:10:13 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:10:16 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:10:22 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:10:29 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:10:32 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:10:38 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:10:50 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:10:53 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:10:59 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:11:06 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:11:09 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:11:15 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:11:27 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:11:30 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:11:36 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:11:44 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:11:47 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:11:53 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:12:05 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:12:08 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:12:15 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:12:21 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:12:24 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:12:30 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:12:43 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:12:45 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:12:51 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:12:58 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:13:01 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:13:07 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:13:19 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:13:22 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound, 
Detection, 2/21/2015 5:13:28 PM, SYSTEM, JOSH-H, Protection, Malicious Website Protection, IP, 91.212.124.167, 0, Outbound,

(end)


----------



## JSntgRvr (Jul 1, 2003)

Lets empty the temp folders:

Download *TFC by OldTimer* to your desktop

 Please double-click *TFC.exe* to run it. (*Note:* If you are running on Vista, right-click on the file and choose *Run As Administrator*).
It *will close all programs* when run, so make sure you have *saved all your work* before you begin.
Click the *Start* button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. *Let it run uninterrupted to completion*.
Once it's finished it should *reboot your machine*. If it does not, please *manually reboot the machine* yourself to ensure a complete clean.

Run the ESET Online Scanner.
Hold down Control and click on this link to open ESET OnlineScan in a new window.
Click the







button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. *Save* it to your desktop.
Double click on the







icon on your desktop.
Check _"YES, I accept the Terms of Use."_
Click the *Start* button.
Accept any security warnings from your browser.
Under *scan settings*, check _"Scan Archives"_ and _"Remove found threats" _
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click *List Threats*
Click *Export*, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the *Back* button.
Click the *Finish* button.
*NOTE:*Sometimes if ESET finds no infections it will not create a log.


----------



## JSntgRvr (Jul 1, 2003)

In your position I would remove AVG and install *AVAST*. I have had better results.


----------



## joshadam84 (Feb 18, 2015)

JSntgRvr said:


> In your position I would remove AVG and install *AVAST*. I have had better results.


I'll do that. Thank you. I'm still running TFC. It's been running for about 12 hours.. apparently there were a lot of temp files to remove. Hopefully it'll be done soon so I can run ESET next and post the results.


----------



## JSntgRvr (Jul 1, 2003)

:up:


----------



## joshadam84 (Feb 18, 2015)

The scan crashed after being on 97% for nearly 24 hours. I was able to get a log of it though.. and will try to re-run the scan.


----------



## JSntgRvr (Jul 1, 2003)

Those files seems to have re-spawned.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Download the enclosed file. (see below) Save it in the same location FRST is saved. Open FRST as you did before, except that this time around, click on the Fix button and wait. The tool will produce a log, fixlog.txt. Please post its contents on your next reply.


----------



## joshadam84 (Feb 18, 2015)

I had to run FRST in two instances due to a Windows Indexing issue causing the computer to lock up. I'll post both logs.
Thanks again for your help. It's much appreciated!


----------



## JSntgRvr (Jul 1, 2003)

We are receiving he following error:



> The process cannot access the file because it is being used by another process.


That means that one of these processes (Help_Decrypt) still active

Download the enclosed file. (see below) Save it in the same location FRST is saved. Open FRST as you did before, except that this time around, click on the Fix button and wait. The tool will produce a log, fixlog.txt. Please post its contents on your next reply.

Please re-scan with FRST and post its report.


----------



## JSntgRvr (Jul 1, 2003)

Also, lets see if it has reached the registry.

Please download *SystemLook* from one of the links below and save it to your Desktop.

*32 bit Download Mirror #1
32 bit Download Mirror #2*

For 64bit systems, Please download *SystemLook* from the link below and save it to your Desktop.

*64 bit Download Mirror*


Double-click *SystemLook.exe* (or SystemLook_x64.exe) to run the application.
Copy the content of the following quote box into the main textfield:


> :Regfind
> HELP_DECRYPT*



Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

*Note:* The log can also be found on your Desktop entitled *SystemLook.txt*


----------



## joshadam84 (Feb 18, 2015)

Yeah, it popped back up during the initial ESET scan. Here's the new fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 23-02-2015 01
Ran by Administrator at 2015-02-24 16:43:23 Run:5
Running from E:\Documents and Settings\Administrator\Desktop
Loaded Profiles: Administrator (Available profiles: Administrator)
Boot Mode: Safe Mode (with Networking)

==============================================

Content of fixlist:
*****************
Start
CloseProcesses:
CMD: Dir /A "E:\Documents and Settings\Administrator\Application Data"
CMD: Dir /A /B /S E:\HELP_DECRYPT.*
End
*****************

Processes closed successfully.

========= Dir /A "E:\Documents and Settings\Administrator\Application Data" =========

Volume in drive E has no label.
Volume Serial Number is 40D0-4DC0

Directory of E:\Documents and Settings\Administrator\Application Data

02/24/2015 04:22 PM .
02/24/2015 04:22 PM ..
02/15/2015 02:55 PM 3D5C0CDA
11/19/2013 11:26 PM Ad-Aware Antivirus
02/23/2015 05:25 PM Adga
02/19/2015 07:30 PM Adobe
11/05/2007 08:46 PM AdobeUM
07/19/2013 09:28 PM Anvisoft
02/23/2015 05:25 PM Aroceh
10/12/2014 01:19 PM ATI
12/21/2012 08:46 PM AVG
02/13/2015 08:03 PM AVG2015
02/23/2015 05:25 PM Axge
02/23/2015 05:25 PM Azpuf
09/01/2014 03:13 PM BitTorrent
02/23/2015 05:26 PM Boviiq
02/19/2015 07:30 PM Canon
03/29/2011 07:32 PM Canon Easy-WebPrint EX
02/23/2015 05:25 PM Caoxu
02/23/2015 05:25 PM Ciikl
02/23/2015 05:26 PM Cipe
02/14/2015 05:37 PM Dafe
12/01/2008 07:37 PM Datel
02/23/2015 05:26 PM Diceme
02/06/2008 05:41 PM DivX
02/23/2015 05:26 PM Ebzeun
02/23/2015 05:26 PM Efufad
02/23/2015 05:26 PM Ehwoi
02/23/2015 05:26 PM Ekati
02/23/2015 05:25 PM Eqce
02/23/2015 05:25 PM Etem
02/23/2015 05:26 PM Ewacs
02/23/2015 05:25 PM Ewkew
02/23/2015 05:25 PM Ewulh
02/23/2015 05:25 PM Exibp
02/23/2015 05:26 PM Faoluq
02/23/2015 05:26 PM Geosw
02/23/2015 05:25 PM Gixu
01/19/2008 07:11 PM Grisoft
02/23/2015 05:25 PM Guer
02/24/2015 02:53 PM Heny
02/23/2015 05:25 PM Idfub
02/23/2015 05:25 PM Ikda
02/23/2015 05:26 PM Ikta
09/01/2012 08:14 PM ImgBurn
10/12/2014 01:05 PM InstallShield
02/23/2015 05:25 PM Inyp
02/23/2015 05:25 PM Iqyve
02/23/2015 05:26 PM Iricc
02/18/2015 04:27 AM Iwet
02/23/2015 05:26 PM Ixace
12/21/2012 08:47 PM LavasoftStatistics
02/23/2015 05:25 PM Lenu
02/18/2015 04:34 AM Local Store
02/23/2015 05:25 PM Lyeqyc
11/02/2007 04:36 AM Macromedia
06/28/2014 11:38 PM Malwarebytes
02/23/2015 05:26 PM Meuf
02/23/2015 08:01 PM Microsoft
02/23/2015 05:26 PM Mogye
09/10/2010 02:40 PM Moyea
02/24/2015 02:54 PM Mozilla
02/23/2015 05:25 PM Mueny
01/02/2012 05:33 PM Nero
02/23/2015 05:25 PM Obsip
12/11/2009 11:49 PM Office Genuine Advantage
02/19/2015 07:31 PM OpenOffice.org2
02/23/2015 05:25 PM Orava
02/23/2015 05:25 PM Ovho
02/23/2015 05:26 PM Ozexda
02/23/2015 05:25 PM Ozun
02/23/2015 05:26 PM Payfno
02/23/2015 05:25 PM Qami
02/23/2015 05:25 PM Qecov
02/23/2015 05:25 PM Racoil
02/23/2015 07:57 PM Ramu
02/19/2015 07:31 PM Real
02/23/2015 05:26 PM Roloyf
02/19/2015 07:31 PM Samsung
02/23/2015 05:26 PM Siriy
02/23/2015 05:25 PM Sise
02/19/2015 07:31 PM Skype
07/16/2011 02:15 PM skypePM
11/14/2007 07:14 PM Sun
02/22/2015 08:43 PM Syuh
02/13/2015 07:59 PM TuneUp Software
02/23/2015 05:25 PM Ubsaqo
02/23/2015 05:26 PM Ugruax
02/23/2015 05:25 PM Uhrae
02/23/2015 05:26 PM Ukvev
02/19/2015 07:26 PM Ulemin
02/23/2015 05:25 PM Ulwyoz
02/23/2015 05:25 PM Uqid
02/23/2015 05:25 PM Usrod
02/23/2015 05:25 PM Utlai
02/18/2015 07:45 PM Uvila
02/23/2015 05:25 PM Vaeqho
02/23/2015 05:25 PM Viux
04/23/2014 08:43 PM vlc
02/23/2015 05:25 PM Wiaq
02/19/2015 07:31 PM Winamp
05/30/2008 11:05 PM WinRAR
02/23/2015 05:25 PM Wuita
02/23/2015 05:25 PM Xamuk
02/23/2015 05:26 PM Xauhv
02/15/2015 09:21 PM Ycboi
02/23/2015 05:26 PM Ynvii
02/23/2015 05:26 PM Ytvu
02/19/2015 06:26 AM Ziria
0 File(s) 0 bytes
109 Dir(s) 10,658,123,776 bytes free

========= End of CMD: =========

========= Dir /A /B /S E:\HELP_DECRYPT.* =========

E:\HELP_DECRYPT.HTML
E:\HELP_DECRYPT.PNG
E:\HELP_DECRYPT.TXT
E:\HELP_DECRYPT.URL
E:\Documents and Settings\HELP_DECRYPT.HTML
E:\Documents and Settings\HELP_DECRYPT.PNG
E:\Documents and Settings\HELP_DECRYPT.TXT
E:\Documents and Settings\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Recent\HELP_DECRYPT.lnk

========= End of CMD: =========

The system needed a reboot.

==== End of Fixlog 16:45:16 ====


----------



## joshadam84 (Feb 18, 2015)

SystemLook 30.07.11 by jpshortstuff
Log created at 16:53 on 24/02/2015 by Administrator
Administrator - Elevation successful

========== Regfind ==========

Searching for "HELP_DECRYPT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.HTML]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.HTML]
"path"="E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HELP_DECRYPT.HTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.HTML]
"backup"="E:\WINDOWS\pss\HELP_DECRYPT.HTMLStartup"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.HTML]
"command"="E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HELP_DECRYPT.HTML"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.HTML]
"item"="HELP_DECRYPT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.PNG]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.PNG]
"path"="E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HELP_DECRYPT.PNG"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.PNG]
"backup"="E:\WINDOWS\pss\HELP_DECRYPT.PNGStartup"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.PNG]
"command"="E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HELP_DECRYPT.PNG"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.PNG]
"item"="HELP_DECRYPT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.TXT]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.TXT]
"path"="E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HELP_DECRYPT.TXT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.TXT]
"backup"="E:\WINDOWS\pss\HELP_DECRYPT.TXTStartup"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.TXT]
"command"="E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HELP_DECRYPT.TXT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.TXT]
"item"="HELP_DECRYPT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.URL]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.URL]
"path"="E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HELP_DECRYPT.URL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.URL]
"backup"="E:\WINDOWS\pss\HELP_DECRYPT.URLStartup"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.URL]
"command"="E:\Documents and Settings\Administrator\Start Menu\Programs\Startup\HELP_DECRYPT.URL"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\E:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HELP_DECRYPT.URL]
"item"="HELP_DECRYPT"

-= EOF =-


----------



## JSntgRvr (Jul 1, 2003)

Download the enclosed file. (see below) Save it in the same location FRST is saved. Open FRST as you did before, except that this time around, click on the Fix button and wait. The tool will produce a log, fixlog.txt. Please post its contents on your next reply.

Please re-scan with *Malwarebytes* and post its report.


----------



## JSntgRvr (Jul 1, 2003)

See the previous page. Please also re-scan with FRST and post its report.


----------



## joshadam84 (Feb 18, 2015)

Fixlog

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 24-02-2015
Ran by Administrator at 2015-02-24 20:36:20 Run:6
Running from E:\Documents and Settings\Administrator\Desktop
Loaded Profiles: Administrator (Available profiles: Administrator)
Boot Mode: Safe Mode (with Networking)

==============================================

Content of fixlist:
*****************
Start
Folder: "E:\Documents and Settings\Administrator\Application Data\3D5C0CDA" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Aroceh" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Axge" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Azpuf" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Boviiq" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Caoxu" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ciikl" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Cipe" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Dafe" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Datel" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Diceme" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ebzeun" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Efufad" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ehwoi" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ekati" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Eqce" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Etem" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ewacs" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ewkew" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ewulh" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Exibp" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Faoluq" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Geosw" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Gixu" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Guer" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Heny" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Idfub" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ikda" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ikta" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Inyp" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Iqyve" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Iricc" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Iwet" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ixace" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Lenu" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Lyeqyc" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Meuf" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Mogye" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Moyea" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Mueny" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Obsip" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Orava" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ovho" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ozexda" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ozun" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Payfno" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Qami" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Qecov" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Racoil" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ramu" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Roloyf" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Siriy" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Sise" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Syuh" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ubsaqo" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ugruax" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Uhrae" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ukvev" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ulemin" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ulwyoz" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Uqid" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Usrod" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Utlai" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Uvila" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Vaeqho" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Viux" 
Folder: "E:\Documents and Settings\Administrator\Application Data\vlc" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Wiaq" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Wuita" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Xamuk" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Xauhv" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ycboi" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ynvii" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ytvu" 
Folder: "E:\Documents and Settings\Administrator\Application Data\Ziria" 
Reg: Reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder" /f
Reg: Reg add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder" /f
E:\HELP_DECRYPT.HTML
E:\HELP_DECRYPT.PNG
E:\HELP_DECRYPT.TXT
E:\HELP_DECRYPT.URL
E:\Documents and Settings\HELP_DECRYPT.HTML
E:\Documents and Settings\HELP_DECRYPT.PNG
E:\Documents and Settings\HELP_DECRYPT.TXT
E:\Documents and Settings\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECR YPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECR YPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECR YPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECR YPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.HTML
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.PNG
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.TXT
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.URL
E:\Documents and Settings\Administrator\Recent\HELP_DECRYPT.lnk
End
*****************


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\3D5C0CDA" ========================

2015-02-14 13:32 - 2015-02-14 13:32 - 0000136 _____ () E:\Documents and Settings\Administrator\Application Data\3D5C0CDA\grb.dat
2015-02-14 13:32 - 2015-02-14 13:32 - 0000805 _____ () E:\Documents and Settings\Administrator\Application Data\3D5C0CDA\web.dat

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Aroceh" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Aroceh\actya.way

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Axge" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Axge\afsoo.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Azpuf" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Azpuf\soat.acg

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Boviiq" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Boviiq\kinua.exs

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Caoxu" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Caoxu\ixzyy.dee

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ciikl" ========================

2012-12-27 07:02 - 2012-12-27 07:02 - 0231938 _____ () E:\Documents and Settings\Administrator\Application Data\Ciikl\leil.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Cipe" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Cipe\yxiss.yqa

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Dafe" ========================


====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Datel" ========================

2008-12-01 19:37 - 2011-02-02 15:44 - 0000000 ____D () E:\Documents and Settings\Administrator\Application Data\Datel\XPort 360
2008-12-01 19:37 - 2011-02-02 15:22 - 0002640 _____ () E:\Documents and Settings\Administrator\Application Data\Datel\XPort 360\X360.cfg
2011-02-02 15:44 - 2011-02-02 15:44 - 0000000 ____D () E:\Documents and Settings\Administrator\Application Data\Datel\XPort 360\temp

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Diceme" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Diceme\fofi.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ebzeun" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ebzeun\omdoy.ylq

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Efufad" ========================

2010-07-15 02:34 - 2010-07-15 02:34 - 0221184 _____ () E:\Documents and Settings\Administrator\Application Data\Efufad\gebah.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ehwoi" ========================

2011-04-24 18:51 - 2011-04-24 18:51 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ehwoi\goyca.ino

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ekati" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ekati\ammo.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Eqce" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Eqce\zuesq.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Etem" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Etem\mobei.zyd

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ewacs" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ewacs\uxxo.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ewkew" ========================

2008-06-09 13:16 - 2008-06-09 13:16 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ewkew\cuege.mia

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ewulh" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ewulh\beyni.teh

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Exibp" ========================

2008-04-28 12:10 - 2008-04-28 12:10 - 0344064 _____ () E:\Documents and Settings\Administrator\Application Data\Exibp\wadi.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Faoluq" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Faoluq\iniq.yli

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Geosw" ========================

2011-05-09 22:26 - 2011-05-09 22:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Geosw\olimw.axy

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Gixu" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Gixu\ufim.qiz

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Guer" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Guer\uxsis.hia

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Heny" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Heny\evoxi.eps

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Idfub" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Idfub\ikme.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ikda" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ikda\ydodo.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ikta" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ikta\wiufz.fef

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Inyp" ========================

2013-04-25 15:13 - 2013-04-25 15:13 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Inyp\uqid.lyi

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Iqyve" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Iqyve\ebbup.xeu

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Iricc" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Iricc\ankeu.ivu

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Iwet" ========================

2009-03-17 07:27 - 2009-03-17 07:27 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Iwet\ubyk.nor

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ixace" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ixace\otuq.rev

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Lenu" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Lenu\upheo.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Lyeqyc" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Lyeqyc\izaf.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Meuf" ========================

2013-06-19 04:00 - 2013-06-19 04:00 - 0221184 _____ () E:\Documents and Settings\Administrator\Application Data\Meuf\oxav.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Mogye" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Mogye\qoox.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Moyea" ========================

2010-09-10 14:40 - 2010-09-10 14:48 - 0000000 ____D () E:\Documents and Settings\Administrator\Application Data\Moyea\FLV Player
2010-09-10 14:48 - 2010-09-10 14:48 - 0000151 _____ () E:\Documents and Settings\Administrator\Application Data\Moyea\FLV Player\History.xml
2010-09-10 14:48 - 2010-09-10 14:48 - 0000542 _____ () E:\Documents and Settings\Administrator\Application Data\Moyea\FLV Player\Preference.xml
2010-05-10 20:25 - 2010-05-10 20:25 - 0000000 ____D () E:\Documents and Settings\Administrator\Application Data\Moyea\FLV to Video
2010-05-10 20:25 - 2007-06-28 08:23 - 0008044 _____ () E:\Documents and Settings\Administrator\Application Data\Moyea\FLV to Video\CodecProfile.xml

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Mueny" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Mueny\usatb.zos

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Obsip" ========================

2012-02-06 13:31 - 2012-02-06 13:31 - 0344064 _____ () E:\Documents and Settings\Administrator\Application Data\Obsip\ykych.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Orava" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0344064 _____ () E:\Documents and Settings\Administrator\Application Data\Orava\gieve.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ovho" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ovho\ronod.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ozexda" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ozexda\avcy.edf

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ozun" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ozun\evli.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Payfno" ========================

2013-11-19 07:43 - 2013-11-19 07:43 - 0231938 _____ () E:\Documents and Settings\Administrator\Application Data\Payfno\hiap.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Qami" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Qami\acxo.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Qecov" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Qecov\aryxc.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Racoil" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Racoil\tuzao.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ramu" ========================


====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Roloyf" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Roloyf\wausg.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Siriy" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Siriy\hyeh.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Sise" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Sise\xaehz.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Syuh" ========================


====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ubsaqo" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ubsaqo\vydu.hon

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ugruax" ========================

2011-06-25 00:22 - 2011-06-25 00:22 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ugruax\moyw.gum

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Uhrae" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0344064 _____ () E:\Documents and Settings\Administrator\Application Data\Uhrae\doora.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ukvev" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ukvev\vyxu.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ulemin" ========================


====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ulwyoz" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ulwyoz\eqqax.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Uqid" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Uqid\ekums.yne

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Usrod" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Usrod\gemui.rue

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Utlai" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Utlai\ortua.gyi

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Uvila" ========================


====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Vaeqho" ========================

2009-10-25 23:00 - 2009-10-25 23:00 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Vaeqho\ikuwy.hii

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Viux" ========================

2011-02-25 15:15 - 2011-02-25 15:15 - 0231938 _____ () E:\Documents and Settings\Administrator\Application Data\Viux\lina.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\vlc" ========================

2010-08-28 13:09 - 2010-08-28 13:09 - 0941968 _____ () E:\Documents and Settings\Administrator\Application Data\vlc\4bc32a119974d3f814636f8f7f9dc5bc-i686.cache-3
2010-08-22 11:55 - 2014-04-23 20:43 - 0000304 _____ () E:\Documents and Settings\Administrator\Application Data\vlc\ml.xspf
2010-08-22 08:38 - 2014-04-23 20:43 - 0000944 _____ () E:\Documents and Settings\Administrator\Application Data\vlc\vlc-qt-interface.ini
2010-08-22 08:39 - 2014-04-23 20:43 - 0083036 _____ () E:\Documents and Settings\Administrator\Application Data\vlc\vlcrc
2013-09-17 20:59 - 2013-09-17 22:46 - 0000000 ____D () E:\Documents and Settings\Administrator\Application Data\vlc\art

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Wiaq" ========================

2014-03-01 02:26 - 2014-03-01 02:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Wiaq\ysuzi.tiu

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Wuita" ========================

2012-01-06 16:28 - 2012-01-06 16:28 - 0344064 _____ () E:\Documents and Settings\Administrator\Application Data\Wuita\bohya.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Xamuk" ========================

2015-02-23 17:25 - 2015-02-23 17:25 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Xamuk\ozmia.yqi

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Xauhv" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Xauhv\ugbao.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ycboi" ========================


====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ynvii" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ynvii\wiotw.exe

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ytvu" ========================

2015-02-23 17:26 - 2015-02-23 17:26 - 0000000 _____ () E:\Documents and Settings\Administrator\Application Data\Ytvu\rarei.gue

====== End of Folder: ======


========================= Folder: "E:\Documents and Settings\Administrator\Application Data\Ziria" ========================


====== End of Folder: ======


========= Reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder" /f =========


The operation completed successfully


========= End of Reg: =========


========= Reg add "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder" /f =========


The operation completed successfully


========= End of Reg: =========

E:\HELP_DECRYPT.HTML => Moved successfully.
E:\HELP_DECRYPT.PNG => Moved successfully.
E:\HELP_DECRYPT.TXT => Moved successfully.
E:\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\HELP_DECRYPT.HTML => Moved successfully.
E:\Documents and Settings\HELP_DECRYPT.PNG => Moved successfully.
E:\Documents and Settings\HELP_DECRYPT.TXT => Moved successfully.
E:\Documents and Settings\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Administrator\HELP_DECRYPT.HTML => Moved successfully.
E:\Documents and Settings\Administrator\HELP_DECRYPT.PNG => Moved successfully.
E:\Documents and Settings\Administrator\HELP_DECRYPT.TXT => Moved successfully.
E:\Documents and Settings\Administrator\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.HTML => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.PNG => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.TXT => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.HTML => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.PNG => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.TXT => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.HTML => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.PNG => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.TXT => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.HTML => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.PNG => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.TXT => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.HTML => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.PNG => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.TXT => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.HTML => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.PNG => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.TXT => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.URL => Moved successfully.
"E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECR YPT.HTML" => File/Directory not found.
"E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECR YPT.PNG" => File/Directory not found.
"E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECR YPT.TXT" => File/Directory not found.
"E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECR YPT.URL" => File/Directory not found.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.HTML => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.PNG => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.TXT => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.HTML => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.PNG => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.TXT => Moved successfully.
E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.HTML => Moved successfully.
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.PNG => Moved successfully.
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.TXT => Moved successfully.
E:\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.HTML => Moved successfully.
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.PNG => Moved successfully.
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.TXT => Moved successfully.
E:\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.URL => Moved successfully.
E:\Documents and Settings\Administrator\Recent\HELP_DECRYPT.lnk => Moved successfully.

==== End of Fixlog 20:36:23 ====


----------



## joshadam84 (Feb 18, 2015)

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2/24/2015
Scan Time: 8:40:45 PM
Logfile: mbam.txt
Administrator: Yes

Version: 2.00.4.1028
Malware Database: v2015.02.25.01
Rootkit Database: v2015.02.22.01
License: Trial
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows XP Service Pack 3
CPU: x86
File System: NTFS
User: Administrator

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 326318
Time Elapsed: 20 min, 54 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 1
Trojan.Bunitu, E:\Documents and Settings\Administrator\Local Settings\Application Data\kycnage.dll, Delete-on-Reboot, [a4d9b56cf4964aec08349f21a5604bb5],

Registry Keys: 1
Trojan.Bunitu, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\kycnage, Quarantined, [a4d9b56cf4964aec08349f21a5604bb5],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 8
Trojan.Bunitu, E:\Documents and Settings\Administrator\Local Settings\Application Data\kycnage.dll, Delete-on-Reboot, [a4d9b56cf4964aec08349f21a5604bb5], 
Trojan.Zbot, E:\Documents and Settings\Administrator\Application Data\Efufad\gebah.exe, Quarantined, [59242af7098156e04f3862c6da28ce32], 
Trojan.Zbot, E:\Documents and Settings\Administrator\Application Data\Meuf\oxav.exe, Quarantined, [6419b36e4941f2440a7d0b1d5ca69d63], 
Trojan.Crypt, E:\Documents and Settings\All Users\Application Data\QusiXunow\IaycUlkez.cql, Quarantined, [c9b479a80189ac8af2ad9a283dc82fd1], 
Trojan.Agent.B47Gen, E:\Documents and Settings\Administrator\Local Settings\Temp\A355.tmp, Quarantined, [bfbe3ee38dfde254eecf31f7d032e61a], 
Trojan.Agent.ED, E:\Documents and Settings\Administrator\Local Settings\Temp\ADDE.tmp, Quarantined, [f18c948d2268d75ffebe24045ca6659b], 
Trojan.Agent.ED, E:\Documents and Settings\Administrator\Local Settings\Temp\ccudb.dll, Quarantined, [65184cd59befc76f523879af4eb4857b], 
Trojan.Agent.ED, E:\Documents and Settings\Administrator\Local Settings\Temp\VYX6.dll, Quarantined, [1f5e829f28621e1802069854d8293ac6],

Physical Sectors: 0
(No malicious items detected)

(end)


----------



## joshadam84 (Feb 18, 2015)

JSntgRvr said:


> See the previous page. Please also re-scan with FRST and post its report.


FRST scans:


----------



## joshadam84 (Feb 18, 2015)

Also, here's a new Search log for HELP_DECRYPT.*

Farbar Recovery Scan Tool (x86) Version: 24-02-2015
Ran by Administrator at 2015-02-24 22:06:23
Running from E:\Documents and Settings\Administrator\Desktop
Boot Mode: Safe Mode (with Networking)

================== Search Files: "HELP_DECRYPT.*" =============

E:\WINDOWS\pss\HELP_DECRYPT.HTMLStartup
[2015-02-24 16:28][2015-02-24 15:00] 0008630 ____N ()

E:\WINDOWS\pss\HELP_DECRYPT.PNGStartup
[2015-02-24 16:28][2015-02-24 15:00] 0045884 ____N ()

E:\WINDOWS\pss\HELP_DECRYPT.TXTStartup
[2015-02-24 16:28][2015-02-24 15:00] 0004258 ____N ()

E:\WINDOWS\pss\HELP_DECRYPT.URLStartup
[2015-02-24 16:28][2015-02-24 15:00] 0000292 ____N ()

E:\FRST\HELP_DECRYPT.HTML
[2015-02-24 15:00][2015-02-24 15:00] 0008630 ____A ()

E:\FRST\HELP_DECRYPT.PNG
[2015-02-24 15:00][2015-02-24 15:00] 0045884 ____A ()

E:\FRST\HELP_DECRYPT.TXT
[2015-02-24 15:00][2015-02-24 15:00] 0004258 ____A ()

E:\FRST\HELP_DECRYPT.URL
[2015-02-24 15:00][2015-02-24 15:00] 0000292 ____A ()

E:\FRST\Quarantine\E\HELP_DECRYPT.HTML.xBAD
[2015-02-24 15:00][2015-02-24 15:00] 0008630 ____A ()

E:\FRST\Quarantine\E\HELP_DECRYPT.PNG.xBAD
[2015-02-24 15:00][2015-02-24 15:00] 0045884 ____A ()

E:\FRST\Quarantine\E\HELP_DECRYPT.TXT.xBAD
[2015-02-24 15:00][2015-02-24 15:00] 0004258 ____A ()

E:\FRST\Quarantine\E\HELP_DECRYPT.URL.xBAD
[2015-02-24 15:00][2015-02-24 15:00] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\HELP_DECRYPT.HTML.xBAD
[2015-02-24 15:00][2015-02-24 15:00] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\HELP_DECRYPT.PNG.xBAD
[2015-02-24 15:00][2015-02-24 15:00] 0045884 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\HELP_DECRYPT.TXT.xBAD
[2015-02-24 15:00][2015-02-24 15:00] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\HELP_DECRYPT.URL.xBAD
[2015-02-24 15:00][2015-02-24 15:00] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\All Users\HELP_DECRYPT.HTML.xBAD
[2015-02-22 11:41][2015-02-22 11:41] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\All Users\HELP_DECRYPT.PNG.xBAD
[2015-02-22 11:41][2015-02-22 11:41] 0045924 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\All Users\HELP_DECRYPT.TXT.xBAD
[2015-02-22 11:41][2015-02-22 11:41] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\All Users\HELP_DECRYPT.URL.xBAD
[2015-02-22 11:41][2015-02-22 11:41] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\HELP_DECRYPT.HTML.xBAD
[2015-02-24 14:58][2015-02-24 14:58] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\HELP_DECRYPT.PNG.xBAD
[2015-02-24 14:58][2015-02-24 14:58] 0045884 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\HELP_DECRYPT.TXT.xBAD
[2015-02-24 14:58][2015-02-24 14:58] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\HELP_DECRYPT.URL.xBAD
[2015-02-24 14:58][2015-02-24 14:58] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Recent\HELP_DECRYPT.lnk.xBAD
[2015-02-24 16:25][2015-02-24 16:25] 0001086 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.HTML.xBAD
[2015-02-24 15:00][2015-02-24 15:00] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.PNG.xBAD
[2015-02-24 15:00][2015-02-24 15:00] 0045884 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.TXT.xBAD
[2015-02-24 15:00][2015-02-24 15:00] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Desktop\HELP_DECRYPT.URL.xBAD
[2015-02-24 15:00][2015-02-24 15:00] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.HTML.xBAD
[2015-02-24 14:58][2015-02-24 14:58] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.PNG.xBAD
[2015-02-24 14:58][2015-02-24 14:58] 0045884 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.TXT.xBAD
[2015-02-24 14:58][2015-02-24 14:58] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Cookies\HELP_DECRYPT.URL.xBAD
[2015-02-24 14:58][2015-02-24 14:58] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.HTML.xBAD
[2015-02-22 11:26][2015-02-24 14:54] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.PNG.xBAD
[2015-02-22 11:26][2015-02-24 14:54] 0045884 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.TXT.xBAD
[2015-02-22 11:26][2015-02-24 14:54] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\HELP_DECRYPT.URL.xBAD
[2015-02-22 11:26][2015-02-24 14:54] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.HTML.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.PNG.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0045884 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.TXT.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\HELP_DECRYPT.URL.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.HTML.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.PNG.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0045884 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.TXT.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\HELP_DECRYPT.URL.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.HTML.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.PNG.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0045884 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.TXT.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.URL.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.HTML.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.PNG.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0045884 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.TXT.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\HELP_DECRYPT.URL.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.HTML.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.PNG.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0045884 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.TXT.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\HELP_DECRYPT.URL.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.HTML.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.PNG.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0045884 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.TXT.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\HELP_DECRYPT.URL.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0000292 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.HTML.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0008630 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.PNG.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0045884 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.TXT.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0004258 ____A ()

E:\FRST\Quarantine\E\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\moz-safe-about+home\idb\HELP_DECRYPT.URL.xBAD
[2015-02-24 14:54][2015-02-24 14:54] 0000292 ____A ()

E:\FRST\Logs\HELP_DECRYPT.HTML
[2015-02-24 15:00][2015-02-24 15:00] 0008630 ____A ()

E:\FRST\Logs\HELP_DECRYPT.PNG
[2015-02-24 15:00][2015-02-24 15:00] 0045884 ____A ()

E:\FRST\Logs\HELP_DECRYPT.TXT
[2015-02-24 15:00][2015-02-24 15:00] 0004258 ____A ()

E:\FRST\Logs\HELP_DECRYPT.URL
[2015-02-24 15:00][2015-02-24 15:00] 0000292 ____A ()

E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECRYPT.HTML
[2015-02-24 14:54][2015-02-24 14:54] 0008630 ____A ()

E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECRYPT.PNG
[2015-02-24 14:54][2015-02-24 14:54] 0045884 ____A ()

E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECRYPT.TXT
[2015-02-24 14:54][2015-02-24 14:54] 0004258 ____A ()

E:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3i96cuw2.default\storage\persistent\HELP_DECRYPT.URL
[2015-02-24 14:54][2015-02-24 14:54] 0000292 ____A ()

====== End Of Search ======


----------



## JSntgRvr (Jul 1, 2003)

Download the enclosed file. (see below) Save it in the same location FRST is saved. Open FRST as you did before, except that this time around, click on the Fix button and wait. The tool will produce a log, fixlog.txt. Please post its contents on your next reply.

After a restart, re-scan with FRST and post its report.


----------



## joshadam84 (Feb 18, 2015)

After running the fixlist, I rebooted the computer and the HELP_DECRYPT re-spawned again. It encrypted the fixlog after the restart and is once again greatly slowing down the computer. Sorry for all of the ongoing issues! Please advise what you'd like me to do next. If you still want me to run all of the previously mentioned scans again just let me know. Thank you.


----------



## JSntgRvr (Jul 1, 2003)

Re-scan with FRST and post its report.


----------



## joshadam84 (Feb 18, 2015)

Here are the logs.


----------



## JSntgRvr (Jul 1, 2003)

Download the enclosed file. (see below) Save it in the same location FRST is saved. Open FRST as you did before, except that this time around, click on the Fix button and wait. The tool will produce a log, *fixlog.txt*. Please post its contents on your next reply.

After a restart, re-scan with FRST and post its *FRST.txt* report.


----------



## joshadam84 (Feb 18, 2015)

Fixlog is attached.


----------



## JSntgRvr (Jul 1, 2003)

See if those files spawns once again.


----------



## joshadam84 (Feb 18, 2015)

While scanning with FRST, the HELP_DECRYPT came up again. Log was unaffected though.


----------



## JSntgRvr (Jul 1, 2003)

Install *AVAST* as an antivirus and preform a full scan. Remove AVG, then run the AVG removal tool *here* to remove any remnant

Download the enclosed file. (see below) Save it in the same location FRST is saved. Open FRST as you did before, except that this time around, click on the Fix button and wait. The tool will produce a log, *fixlog.txt.* Please post its contents on your next reply.

After a restart, re-scan with FRST and post its *FRST.txt* report.


----------



## joshadam84 (Feb 18, 2015)

Here's the fixlog. Will be scanning again next.


----------



## joshadam84 (Feb 18, 2015)

FRST log


----------



## JSntgRvr (Jul 1, 2003)

There are no HELP_DECRYPT files in the FRST log. Lets give it some time and see if these re-spawn.


----------



## joshadam84 (Feb 18, 2015)

Okay, just let me know when you'd like me to scan again.


----------



## JSntgRvr (Jul 1, 2003)

By this time tomorrow.

Dir /a /s E:\HELP_DECRYPT.*


----------



## joshadam84 (Feb 18, 2015)

JSntgRvr said:


> By this time tomorrow.
> 
> Dir /a /s E:\HELP_DECRYPT.*


Sounds good. If they re-spawn prior to the scan I'll let you know. Otherwise, I'll run the above command tomorrow evening.


----------



## joshadam84 (Feb 18, 2015)

I'm not sure if I'm doing something wrong with the command or what.. but here's the log results:

Volume in drive E has no label.
Volume Serial Number is 40D0-4DC0

Directory of E:\Documents and Settings\Administrator\Recent

02/27/2015 06:59 AM 1,086 HELP_DECRYPT (2).lnk
02/27/2015 06:59 AM 1,091 HELP_DECRYPT (3).lnk
2 File(s) 2,177 bytes

Total Files Listed:
2 File(s) 2,177 bytes
0 Dir(s) 10,653,745,152 bytes free


----------



## joshadam84 (Feb 18, 2015)

I haven't had the ransom files pop up on me since yesterday.. but I know I still see the HELP_DECRYPT files in various folders. I have an F drive and C drive as well if that is material.


----------



## JSntgRvr (Jul 1, 2003)

Lets see if FRST is able to search other drives. Else, I will write a program to check your drives.

Open FRST as you did before.

Type the following in the edit box on FRST, after "Search:".

*HELP_DECRYPT**

It then should look like:

*Search: HELP_DECRYPT**

Click the *Search Files* button and post the log (Search.txt) it will produce in your next reply.


----------



## joshadam84 (Feb 18, 2015)

Here's all that was found:
Farbar Recovery Scan Tool (x86) Version: 29-02-2015
Ran by Administrator at 2015-02-28 18:49:20
Running from E:\Documents and Settings\Administrator\Desktop
Boot Mode: Safe Mode (with Networking)

================== Search Files: "HELP_DECRYPT*" =============

E:\Documents and Settings\Administrator\Recent\HELP_DECRYPT (2).lnk
[2015-02-24 16:26][2015-02-27 06:59] 0001086 ____A ()

E:\Documents and Settings\Administrator\Recent\HELP_DECRYPT (3).lnk
[2015-02-26 22:16][2015-02-27 06:59] 0001091 ____A ()

====== End Of Search ======


----------



## JSntgRvr (Jul 1, 2003)

Download the enclosed file. Save and extract its contents to the desktop. It is a folder containing a batch file. Once extracted, click on the ListDecrypt.bat file. It should take a while as it will be searching your drives. Once done, a log.txt will popup and be saved on the desktop. Please post its content.


----------



## joshadam84 (Feb 18, 2015)

File has too many characters so it is attached.


----------



## JSntgRvr (Jul 1, 2003)

Seems that all documents in all drives were affected.

Download the enclosed file. (see below) Save it in the same location FRST is saved. Open FRST as you did before, except that this time around, click on the Fix button and wait. The tool will produce a log, fixlog.txt. Please post its contents on your next reply.

We will need to wait until tomorrow to run that batch file again


----------



## joshadam84 (Feb 18, 2015)

Just let me know what you'd like me to run and when!


----------



## JSntgRvr (Jul 1, 2003)

As of now there shouldn't be a file HELP_DECRYPT in your computer. Tomorrow, after using the computer for a while, run the batch file again and post the report. If empty, I guess we got him.


----------



## joshadam84 (Feb 18, 2015)

So far, I haven't had any further issues. Is there anything else you'd like me to do?


----------



## JSntgRvr (Jul 1, 2003)

Since these files have not re-spawn, I believe we got him.

We need to remove the tools we've used during cleaning your machine


Download Delfix from *here*
Ensure *Remove disinfection tools* is ticked
*Also tick:
*
Create registry backup
Purge system restore










Click *Run*
Here are some suggestions.


Always keep your *JAVA* updated. Older versions will make your computer vulnerable.

*Windows Updates* - It is *very important* to make sure that both Internet Explorer and Windows are kept current with *the latest critical security patches* from Microsoft. To do this just start *Internet Explorer* and select *Tools > Windows Update*, and follow the online instructions from there.

*ERUNT* (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
For information and great guidelines to follow to prevent future infections you can read * this article * by *Miekiemoes*.

Best wishes!


----------



## joshadam84 (Feb 18, 2015)

Thanks so much for your help. It's very appreciated! .


----------



## JSntgRvr (Jul 1, 2003)

You are welcome.


----------

