Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with Cryptowall virus


  • This topic is locked This topic is locked
7 replies to this topic

#1 Rhinoceros777

Rhinoceros777

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 05 July 2015 - 04:14 PM

I discovered I was infected with a Ransom virus.

Many files were encrypted/infected. To open them, you are supposed to pay a ransom.

In the folders where the encrypted files were, there were two files:

HELP_DECRYPT internet shortcut

HELP_DECRYPT.PNG

I downloaded Spyware Hunter and it seemed to remove the virus.

But, when I tried to add a header to a Word document, I got a message box that said HELP_DECRYPT and that the file cannot be opened. There were no galleries for footers, headers, or page numbers.

I researched and learned to change the Building.Blocks file to Building.Blocks.old and to Repair MS Office, and it rebuilt that file, seeming to fix that problem.

But I also read to do a search for "%appdata%" and I did and it took me to Roaming folder and 2 others. Many subfolders had the to DECRYPT files shown above.

I posted here about some of this and was told that I have a Cryptowall virus and to use the FRST tool, which I did. The two folders it produced are attached below.

I use Windows 7, 64-bit and Office 2007.

 

Any help would be appreciated.

Attached File  Addition.txt   25.66KB   4 downloads

Attached File  FRST.txt   63KB   6 downloads



BC AdBot (Login to Remove)

 


#2 nasdaq

nasdaq

  • Malware Response Team
  • 39,523 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:21 PM

Posted 08 July 2015 - 09:46 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

This is the infection - CryptoWall and HELP_DECRYPT Ransomware Information Guide
http://www.bleepingcomputer.com/virus-removal/cryptowall-ransomware-information

Other than paying the ransom if it's not too late there is nothing we can do to restore your files.
I know one thing I would not trust them.
===

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
 
start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
U2 McMPFSvc; No ImagePath
S3 PCDSRVC{3B54B31B-D06B6431-06020200}_0; \??\c:\program files\dell\supportassist\pcdsrvc_x64.pkms [X]
C:\ProgramData\HELP_DECRYPT.URL
C:\ProgramData\HELP_DECRYPT.PNG
C:\ProgramData\HELP_DECRYPT.URL

End
Save the files as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) please post it to your reply.
===

How is the computer running now?

#3 Rhinoceros777

Rhinoceros777
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 09 July 2015 - 07:30 PM

I ran FRST and it created the attached log.

As for how the computer runs, I think it was pretty much running OK already, after the Spyware Hunter removed the virus. The one issue I had seen was the problem with footers and headers in Word. That seems to be OK now. There are still some files HELP_DECRYPT (internet shortcut) ad HELP_DECRYPT.PNG, found under the AppData folders. That concerns me, but I don't know if they are really an issue. No files seem to be encrypted/infected now.

Any advice is welcome.

Here is the Fixlog.txt file:

 

Fix result of Farbar Recovery Scan Tool (x64) Version:05-07-2015
Ran by My computer at 2015-07-09 00:16:05 Run:2
Running from C:\Users\My computer\Desktop
Loaded Profiles: My computer (Available Profiles: My computer)
Boot Mode: Normal
==============================================

fixlist content:
*****************
start

CreateRestorePoint:
EmptyTemp:
CloseProcesses:

HKLM-x32\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
U2 McMPFSvc; No ImagePath
S3 PCDSRVC{3B54B31B-D06B6431-06020200}_0; \??\c:\program files\dell\supportassist\pcdsrvc_x64.pkms [X]
C:\ProgramData\HELP_DECRYPT.URL
C:\ProgramData\HELP_DECRYPT.PNG
C:\ProgramData\HELP_DECRYPT.URL

End
*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => value not found.
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast => key not found.
HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => key not found.
HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE => key not found.
HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE => key not found.
McMPFSvc => Service could not remove
PCDSRVC{3B54B31B-D06B6431-06020200}_0 => Service not found.
"C:\ProgramData\HELP_DECRYPT.URL" => File/Folder not found.
"C:\ProgramData\HELP_DECRYPT.PNG" => File/Folder not found.
"C:\ProgramData\HELP_DECRYPT.URL" => File/Folder not found.
EmptyTemp: => 7.3 GB temporary data Removed.

The system needed a reboot..

==== End of Fixlog 00:17:08 ====

Attached Files



#4 nasdaq

nasdaq

  • Malware Response Team
  • 39,523 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:21 PM

Posted 10 July 2015 - 08:27 AM

The HELP_DECRYPT.* files are not causing any problems.

I should be able to create a fix to remove them.

Lets find out where they are located.

Please run the Farbar Recovery Scan Tool. Enter HELP_DECRYPT.* in the Search Box and hit the File Search button.
Post the content of the Search.txt in your next reply.

#5 Rhinoceros777

Rhinoceros777
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:21 PM

Posted 10 July 2015 - 11:08 PM

Results of the search, using Farbar tool:

 

Farbar Recovery Scan Tool (x64) Version:05-07-2015
Ran by My computer at 2015-07-10 22:55:27
Running from C:\Users\My computer\Desktop
Boot Mode: Normal

================== Search Files: "HELP_DECRYPT.* " =============

C:\Users\My computer\AppData\Roaming\Sony Corporation\PMB\Uploader\ServiceUploader\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\Sony Corporation\PMB\Uploader\ServiceUploader\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\Sony Corporation\PMB\ActionLog\ContentDatabase\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\Sony Corporation\PMB\ActionLog\ContentDatabase\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\qikdb\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\qikdb\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\storage_db\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\storage_db\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\storage_db\asyncdb\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\storage_db\asyncdb\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\media_cache\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\media_cache\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\media_cache\asyncdb\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\media_cache\asyncdb\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\emo_cache\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\emo_cache\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\eb9dc6c0-306d-44b3-95b9-cbd166803f91\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\eb9dc6c0-306d-44b3-95b9-cbd166803f91\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\eb9dc6c0-306d-44b3-95b9-cbd166803f91\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\eb9dc6c0-306d-44b3-95b9-cbd166803f91\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\de3221af-9cdb-4cb9-afd0-32f7ecb4b84d\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\de3221af-9cdb-4cb9-afd0-32f7ecb4b84d\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\de3221af-9cdb-4cb9-afd0-32f7ecb4b84d\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\de3221af-9cdb-4cb9-afd0-32f7ecb4b84d\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\cbc9e000-10ab-4416-9557-3c0cb7ff5ff5\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\cbc9e000-10ab-4416-9557-3c0cb7ff5ff5\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\cbc9e000-10ab-4416-9557-3c0cb7ff5ff5\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\cbc9e000-10ab-4416-9557-3c0cb7ff5ff5\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c46b7163-e87c-4e3f-b815-4056398286f9\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c46b7163-e87c-4e3f-b815-4056398286f9\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c46b7163-e87c-4e3f-b815-4056398286f9\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c46b7163-e87c-4e3f-b815-4056398286f9\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c04b45c2-3a34-4c52-bd2d-a4193bdea790\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c04b45c2-3a34-4c52-bd2d-a4193bdea790\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c04b45c2-3a34-4c52-bd2d-a4193bdea790\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c04b45c2-3a34-4c52-bd2d-a4193bdea790\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\bddec088-2251-41ad-8462-81eccdb89465\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\bddec088-2251-41ad-8462-81eccdb89465\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\bddec088-2251-41ad-8462-81eccdb89465\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\bddec088-2251-41ad-8462-81eccdb89465\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\ac49e28b-29cb-430e-ad42-b0906e2a1980\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\ac49e28b-29cb-430e-ad42-b0906e2a1980\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\ac49e28b-29cb-430e-ad42-b0906e2a1980\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\ac49e28b-29cb-430e-ad42-b0906e2a1980\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a2d0f86a-d0b0-4481-bf7d-de0adc79dba6\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a2d0f86a-d0b0-4481-bf7d-de0adc79dba6\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a2d0f86a-d0b0-4481-bf7d-de0adc79dba6\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a2d0f86a-d0b0-4481-bf7d-de0adc79dba6\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a007902a-dfde-4c84-b04f-5ffd8524a2be\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a007902a-dfde-4c84-b04f-5ffd8524a2be\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a007902a-dfde-4c84-b04f-5ffd8524a2be\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a007902a-dfde-4c84-b04f-5ffd8524a2be\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9b06f913-5801-49df-9704-e256cacfdb63\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9b06f913-5801-49df-9704-e256cacfdb63\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9b06f913-5801-49df-9704-e256cacfdb63\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9b06f913-5801-49df-9704-e256cacfdb63\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9af34228-8083-491a-9a81-09394bc3a670\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9af34228-8083-491a-9a81-09394bc3a670\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9af34228-8083-491a-9a81-09394bc3a670\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9af34228-8083-491a-9a81-09394bc3a670\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9955706c-0eae-417a-9637-ff0ec0a97934\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9955706c-0eae-417a-9637-ff0ec0a97934\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9955706c-0eae-417a-9637-ff0ec0a97934\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9955706c-0eae-417a-9637-ff0ec0a97934\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\96280a76-1870-4283-918b-7fb9e336e18c\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\96280a76-1870-4283-918b-7fb9e336e18c\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\96280a76-1870-4283-918b-7fb9e336e18c\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\96280a76-1870-4283-918b-7fb9e336e18c\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\8cf30e0f-1dfb-454e-9304-805031ab6a69\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\8cf30e0f-1dfb-454e-9304-805031ab6a69\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\8cf30e0f-1dfb-454e-9304-805031ab6a69\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\8cf30e0f-1dfb-454e-9304-805031ab6a69\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\80723361-dfa8-465c-b5f3-b00f3847b6f2\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\80723361-dfa8-465c-b5f3-b00f3847b6f2\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\80723361-dfa8-465c-b5f3-b00f3847b6f2\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\80723361-dfa8-465c-b5f3-b00f3847b6f2\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\6c07db61-f21d-4152-8735-865419adc54a\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\6c07db61-f21d-4152-8735-865419adc54a\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\6c07db61-f21d-4152-8735-865419adc54a\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\6c07db61-f21d-4152-8735-865419adc54a\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\627cfa7f-8229-47f6-a3a7-495fb56845bf\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\627cfa7f-8229-47f6-a3a7-495fb56845bf\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\627cfa7f-8229-47f6-a3a7-495fb56845bf\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\627cfa7f-8229-47f6-a3a7-495fb56845bf\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\59b30901-38b8-4230-812d-5ba327671948\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\59b30901-38b8-4230-812d-5ba327671948\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\59b30901-38b8-4230-812d-5ba327671948\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\59b30901-38b8-4230-812d-5ba327671948\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\4eac54a9-9214-43e8-81f3-e0321ddf8c22\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\4eac54a9-9214-43e8-81f3-e0321ddf8c22\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\4eac54a9-9214-43e8-81f3-e0321ddf8c22\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\4eac54a9-9214-43e8-81f3-e0321ddf8c22\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c4a8ffb-6174-45f7-9e16-3c587278b94e\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c4a8ffb-6174-45f7-9e16-3c587278b94e\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c4a8ffb-6174-45f7-9e16-3c587278b94e\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c4a8ffb-6174-45f7-9e16-3c587278b94e\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c132a83-13d7-4825-8be0-2335a1e53abe\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c132a83-13d7-4825-8be0-2335a1e53abe\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c132a83-13d7-4825-8be0-2335a1e53abe\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c132a83-13d7-4825-8be0-2335a1e53abe\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\36e6bac4-bdbf-42d7-9b8b-da0304cc3123\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\36e6bac4-bdbf-42d7-9b8b-da0304cc3123\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\36e6bac4-bdbf-42d7-9b8b-da0304cc3123\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:27][2015-06-26 18:27] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\36e6bac4-bdbf-42d7-9b8b-da0304cc3123\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:27][2015-06-26 18:27] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\34938dfc-17a9-44d9-a2ad-dad9ab00d1b8\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\34938dfc-17a9-44d9-a2ad-dad9ab00d1b8\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\34938dfc-17a9-44d9-a2ad-dad9ab00d1b8\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\34938dfc-17a9-44d9-a2ad-dad9ab00d1b8\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2b91b609-db5e-45bc-8d4b-c0898a1ff062\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2b91b609-db5e-45bc-8d4b-c0898a1ff062\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2b91b609-db5e-45bc-8d4b-c0898a1ff062\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2b91b609-db5e-45bc-8d4b-c0898a1ff062\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2ad534ff-0703-4dd0-b08f-3b2dc0a127f6\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2ad534ff-0703-4dd0-b08f-3b2dc0a127f6\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2ad534ff-0703-4dd0-b08f-3b2dc0a127f6\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2ad534ff-0703-4dd0-b08f-3b2dc0a127f6\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2878a653-0b49-4d7c-80d2-f60286d730ec\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2878a653-0b49-4d7c-80d2-f60286d730ec\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2878a653-0b49-4d7c-80d2-f60286d730ec\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2878a653-0b49-4d7c-80d2-f60286d730ec\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\269a429e-91e4-47ea-8379-7fcfd47e836d\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\269a429e-91e4-47ea-8379-7fcfd47e836d\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\269a429e-91e4-47ea-8379-7fcfd47e836d\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\269a429e-91e4-47ea-8379-7fcfd47e836d\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2230854d-55a7-4838-99de-0889c835265d\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2230854d-55a7-4838-99de-0889c835265d\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2230854d-55a7-4838-99de-0889c835265d\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2230854d-55a7-4838-99de-0889c835265d\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\1794097e-faf8-4003-b521-5f9875c59dd1\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\1794097e-faf8-4003-b521-5f9875c59dd1\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\1794097e-faf8-4003-b521-5f9875c59dd1\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\1794097e-faf8-4003-b521-5f9875c59dd1\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\06c95393-8fa4-4258-a916-f2e1134261ff\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\06c95393-8fa4-4258-a916-f2e1134261ff\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\06c95393-8fa4-4258-a916-f2e1134261ff\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\06c95393-8fa4-4258-a916-f2e1134261ff\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\ArcSoft\Rocket Data\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\ArcSoft\Rocket Data\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\ArcSoft\Rocket Data\$RctThumb$\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\ArcSoft\Rocket Data\$RctThumb$\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Roaming\Adobe\Flash Player\AssetCache\2795A6QZ\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Roaming\Adobe\Flash Player\AssetCache\2795A6QZ\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\LocalLow\Adobe\Acrobat\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\LocalLow\Adobe\Acrobat\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\LocalLow\Adobe\Acrobat\11.0\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\LocalLow\Adobe\Acrobat\11.0\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\LocalLow\Adobe\Acrobat\11.0\Search\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\LocalLow\Adobe\Acrobat\11.0\Search\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\VirtualStore\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\VirtualStore\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\VirtualStore\ProgramData\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\VirtualStore\ProgramData\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\VirtualStore\ProgramData\softthinks\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\VirtualStore\ProgramData\softthinks\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft Games\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft Games\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft Games\Solitaire\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft Games\Solitaire\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft Games\FreeCell\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft Games\FreeCell\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\Backup\new\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\Backup\new\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\OIS\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\OIS\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\OIS\thumbnails\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\OIS\thumbnails\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\Media Player\Art Cache\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\Media Player\Art Cache\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\Microsoft\ehome\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\Microsoft\ehome\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\HP\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\HP\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\HP\AtInstall\HELP_DECRYPT.PNG
[2015-06-26 18:26][2015-06-26 18:26] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\HP\AtInstall\HELP_DECRYPT.URL
[2015-06-26 18:26][2015-06-26 18:26] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\ArcSoft\HELP_DECRYPT.PNG
[2015-06-26 18:25][2015-06-26 18:25] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\ArcSoft\HELP_DECRYPT.URL
[2015-06-26 18:25][2015-06-26 18:25] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\Users\My computer\AppData\Local\ArcSoft\Connection Service\HELP_DECRYPT.PNG
[2015-06-26 18:25][2015-06-26 18:25] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\Users\My computer\AppData\Local\ArcSoft\Connection Service\HELP_DECRYPT.URL
[2015-06-26 18:25][2015-06-26 18:25] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\ProgramData\Sony Corporation\HELP_DECRYPT.PNG
[2015-06-26 18:25][2015-06-26 18:25] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\ProgramData\Sony Corporation\HELP_DECRYPT.URL
[2015-06-26 18:25][2015-06-26 18:25] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\ProgramData\Sony Corporation\SOHLib\HELP_DECRYPT.PNG
[2015-06-26 18:25][2015-06-26 18:25] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\ProgramData\Sony Corporation\SOHLib\HELP_DECRYPT.URL
[2015-06-26 18:25][2015-06-26 18:25] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\ProgramData\Sony Corporation\SOHLib\DB\HELP_DECRYPT.PNG
[2015-06-26 18:25][2015-06-26 18:25] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\ProgramData\Sony Corporation\SOHLib\DB\HELP_DECRYPT.URL
[2015-06-26 18:25][2015-06-26 18:25] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.PNG
[2015-06-26 18:25][2015-06-26 18:25] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.URL
[2015-06-26 18:25][2015-06-26 18:25] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\FRST\Quarantine\C\ProgramData\HELP_DECRYPT.PNG.xBAD
[2015-06-26 18:25][2015-06-26 18:25] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\FRST\Quarantine\C\ProgramData\HELP_DECRYPT.URL.xBAD
[2015-06-26 18:25][2015-06-26 18:25] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

C:\$Recycle.Bin\S-1-5-21-1298365283-2315814827-2616718145-1000\HELP_DECRYPT.PNG
[2015-06-26 18:25][2015-06-26 18:25] 0045591 ____A () 8BD65CEEC6900215EF51DC0A0BFB6E78

C:\$Recycle.Bin\S-1-5-21-1298365283-2315814827-2616718145-1000\HELP_DECRYPT.URL
[2015-06-26 18:25][2015-06-26 18:25] 0000284 ____A () 24ABB1B7FF45FFD38DC37C646DCB4EC0

====== End of Search ======

Attached Files



#6 nasdaq

nasdaq

  • Malware Response Team
  • 39,523 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:21 PM

Posted 11 July 2015 - 08:27 AM

Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below.
 
start

CloseProcesses:

C:\Users\My computer\AppData\Roaming\Sony Corporation\PMB\Uploader\ServiceUploader\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\Sony Corporation\PMB\Uploader\ServiceUploader\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\Sony Corporation\PMB\ActionLog\ContentDatabase\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\Sony Corporation\PMB\ActionLog\ContentDatabase\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\qikdb\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\qikdb\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\storage_db\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\storage_db\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\storage_db\asyncdb\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\storage_db\asyncdb\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\media_cache\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\media_cache\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\media_cache\asyncdb\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\media_cache\asyncdb\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\emo_cache\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\emo_cache\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\Skype\fgsltw77\media_messaging\emo_cache\asyncdb\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\eb9dc6c0-306d-44b3-95b9-cbd166803f91\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\eb9dc6c0-306d-44b3-95b9-cbd166803f91\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\eb9dc6c0-306d-44b3-95b9-cbd166803f91\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\eb9dc6c0-306d-44b3-95b9-cbd166803f91\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\de3221af-9cdb-4cb9-afd0-32f7ecb4b84d\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\de3221af-9cdb-4cb9-afd0-32f7ecb4b84d\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\de3221af-9cdb-4cb9-afd0-32f7ecb4b84d\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\de3221af-9cdb-4cb9-afd0-32f7ecb4b84d\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\cbc9e000-10ab-4416-9557-3c0cb7ff5ff5\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\cbc9e000-10ab-4416-9557-3c0cb7ff5ff5\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\cbc9e000-10ab-4416-9557-3c0cb7ff5ff5\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\cbc9e000-10ab-4416-9557-3c0cb7ff5ff5\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c46b7163-e87c-4e3f-b815-4056398286f9\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c46b7163-e87c-4e3f-b815-4056398286f9\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c46b7163-e87c-4e3f-b815-4056398286f9\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c46b7163-e87c-4e3f-b815-4056398286f9\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c04b45c2-3a34-4c52-bd2d-a4193bdea790\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c04b45c2-3a34-4c52-bd2d-a4193bdea790\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c04b45c2-3a34-4c52-bd2d-a4193bdea790\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\c04b45c2-3a34-4c52-bd2d-a4193bdea790\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\bddec088-2251-41ad-8462-81eccdb89465\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\bddec088-2251-41ad-8462-81eccdb89465\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\bddec088-2251-41ad-8462-81eccdb89465\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\bddec088-2251-41ad-8462-81eccdb89465\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\ac49e28b-29cb-430e-ad42-b0906e2a1980\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\ac49e28b-29cb-430e-ad42-b0906e2a1980\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\ac49e28b-29cb-430e-ad42-b0906e2a1980\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\ac49e28b-29cb-430e-ad42-b0906e2a1980\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a2d0f86a-d0b0-4481-bf7d-de0adc79dba6\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a2d0f86a-d0b0-4481-bf7d-de0adc79dba6\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a2d0f86a-d0b0-4481-bf7d-de0adc79dba6\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a2d0f86a-d0b0-4481-bf7d-de0adc79dba6\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a007902a-dfde-4c84-b04f-5ffd8524a2be\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a007902a-dfde-4c84-b04f-5ffd8524a2be\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a007902a-dfde-4c84-b04f-5ffd8524a2be\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\a007902a-dfde-4c84-b04f-5ffd8524a2be\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9b06f913-5801-49df-9704-e256cacfdb63\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9b06f913-5801-49df-9704-e256cacfdb63\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9b06f913-5801-49df-9704-e256cacfdb63\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9b06f913-5801-49df-9704-e256cacfdb63\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9af34228-8083-491a-9a81-09394bc3a670\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9af34228-8083-491a-9a81-09394bc3a670\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9af34228-8083-491a-9a81-09394bc3a670\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9af34228-8083-491a-9a81-09394bc3a670\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9955706c-0eae-417a-9637-ff0ec0a97934\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9955706c-0eae-417a-9637-ff0ec0a97934\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9955706c-0eae-417a-9637-ff0ec0a97934\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\9955706c-0eae-417a-9637-ff0ec0a97934\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\96280a76-1870-4283-918b-7fb9e336e18c\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\96280a76-1870-4283-918b-7fb9e336e18c\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\96280a76-1870-4283-918b-7fb9e336e18c\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\96280a76-1870-4283-918b-7fb9e336e18c\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\8cf30e0f-1dfb-454e-9304-805031ab6a69\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\8cf30e0f-1dfb-454e-9304-805031ab6a69\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\8cf30e0f-1dfb-454e-9304-805031ab6a69\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\8cf30e0f-1dfb-454e-9304-805031ab6a69\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\80723361-dfa8-465c-b5f3-b00f3847b6f2\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\80723361-dfa8-465c-b5f3-b00f3847b6f2\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\80723361-dfa8-465c-b5f3-b00f3847b6f2\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\80723361-dfa8-465c-b5f3-b00f3847b6f2\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\6c07db61-f21d-4152-8735-865419adc54a\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\6c07db61-f21d-4152-8735-865419adc54a\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\6c07db61-f21d-4152-8735-865419adc54a\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\6c07db61-f21d-4152-8735-865419adc54a\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\627cfa7f-8229-47f6-a3a7-495fb56845bf\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\627cfa7f-8229-47f6-a3a7-495fb56845bf\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\627cfa7f-8229-47f6-a3a7-495fb56845bf\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\627cfa7f-8229-47f6-a3a7-495fb56845bf\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\59b30901-38b8-4230-812d-5ba327671948\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\59b30901-38b8-4230-812d-5ba327671948\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\59b30901-38b8-4230-812d-5ba327671948\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\59b30901-38b8-4230-812d-5ba327671948\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\4eac54a9-9214-43e8-81f3-e0321ddf8c22\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\4eac54a9-9214-43e8-81f3-e0321ddf8c22\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\4eac54a9-9214-43e8-81f3-e0321ddf8c22\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\4eac54a9-9214-43e8-81f3-e0321ddf8c22\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c4a8ffb-6174-45f7-9e16-3c587278b94e\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c4a8ffb-6174-45f7-9e16-3c587278b94e\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c4a8ffb-6174-45f7-9e16-3c587278b94e\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c4a8ffb-6174-45f7-9e16-3c587278b94e\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c132a83-13d7-4825-8be0-2335a1e53abe\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c132a83-13d7-4825-8be0-2335a1e53abe\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c132a83-13d7-4825-8be0-2335a1e53abe\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\3c132a83-13d7-4825-8be0-2335a1e53abe\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\36e6bac4-bdbf-42d7-9b8b-da0304cc3123\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\36e6bac4-bdbf-42d7-9b8b-da0304cc3123\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\36e6bac4-bdbf-42d7-9b8b-da0304cc3123\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\36e6bac4-bdbf-42d7-9b8b-da0304cc3123\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\34938dfc-17a9-44d9-a2ad-dad9ab00d1b8\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\34938dfc-17a9-44d9-a2ad-dad9ab00d1b8\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\34938dfc-17a9-44d9-a2ad-dad9ab00d1b8\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\34938dfc-17a9-44d9-a2ad-dad9ab00d1b8\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2b91b609-db5e-45bc-8d4b-c0898a1ff062\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2b91b609-db5e-45bc-8d4b-c0898a1ff062\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2b91b609-db5e-45bc-8d4b-c0898a1ff062\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2b91b609-db5e-45bc-8d4b-c0898a1ff062\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2ad534ff-0703-4dd0-b08f-3b2dc0a127f6\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2ad534ff-0703-4dd0-b08f-3b2dc0a127f6\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2ad534ff-0703-4dd0-b08f-3b2dc0a127f6\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2ad534ff-0703-4dd0-b08f-3b2dc0a127f6\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2878a653-0b49-4d7c-80d2-f60286d730ec\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2878a653-0b49-4d7c-80d2-f60286d730ec\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2878a653-0b49-4d7c-80d2-f60286d730ec\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2878a653-0b49-4d7c-80d2-f60286d730ec\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\269a429e-91e4-47ea-8379-7fcfd47e836d\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\269a429e-91e4-47ea-8379-7fcfd47e836d\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\269a429e-91e4-47ea-8379-7fcfd47e836d\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\269a429e-91e4-47ea-8379-7fcfd47e836d\PCDoctor_6584.01_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2230854d-55a7-4838-99de-0889c835265d\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2230854d-55a7-4838-99de-0889c835265d\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2230854d-55a7-4838-99de-0889c835265d\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\2230854d-55a7-4838-99de-0889c835265d\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\1794097e-faf8-4003-b521-5f9875c59dd1\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\1794097e-faf8-4003-b521-5f9875c59dd1\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\1794097e-faf8-4003-b521-5f9875c59dd1\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\1794097e-faf8-4003-b521-5f9875c59dd1\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\06c95393-8fa4-4258-a916-f2e1134261ff\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\06c95393-8fa4-4258-a916-f2e1134261ff\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\06c95393-8fa4-4258-a916-f2e1134261ff\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\PCDr\Update\Rules\06c95393-8fa4-4258-a916-f2e1134261ff\withSigneddll-PCDoctor_6422.40_windows_appupdaterrules_dell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\ArcSoft\Rocket Data\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\ArcSoft\Rocket Data\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\ArcSoft\Rocket Data\$RctThumb$\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\ArcSoft\Rocket Data\$RctThumb$\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\Adobe\Flash Player\AssetCache\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Roaming\Adobe\Flash Player\AssetCache\2795A6QZ\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Roaming\Adobe\Flash Player\AssetCache\2795A6QZ\HELP_DECRYPT.URL
C:\Users\My computer\AppData\LocalLow\Adobe\Acrobat\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\LocalLow\Adobe\Acrobat\HELP_DECRYPT.URL
C:\Users\My computer\AppData\LocalLow\Adobe\Acrobat\11.0\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\LocalLow\Adobe\Acrobat\11.0\HELP_DECRYPT.URL
C:\Users\My computer\AppData\LocalLow\Adobe\Acrobat\11.0\Search\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\LocalLow\Adobe\Acrobat\11.0\Search\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\VirtualStore\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\VirtualStore\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\VirtualStore\ProgramData\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\VirtualStore\ProgramData\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\VirtualStore\ProgramData\softthinks\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\VirtualStore\ProgramData\softthinks\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft Games\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft Games\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft Games\Solitaire\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft Games\Solitaire\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft Games\FreeCell\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft Games\FreeCell\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\Windows Media\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\Windows Media\12.0\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\Stationery\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\Backup\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\Backup\new\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\Windows Mail\Backup\new\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\OIS\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\OIS\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\OIS\thumbnails\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\OIS\thumbnails\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\Media Player\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\Media Player\Art Cache\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\Media Player\Art Cache\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\Media Player\Art Cache\LocalMLS\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\Internet Explorer\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\Microsoft\ehome\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\Microsoft\ehome\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\HP\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\HP\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\HP\AtInstall\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\HP\AtInstall\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\ArcSoft\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\ArcSoft\HELP_DECRYPT.URL
C:\Users\My computer\AppData\Local\ArcSoft\Connection Service\HELP_DECRYPT.PNG
C:\Users\My computer\AppData\Local\ArcSoft\Connection Service\HELP_DECRYPT.URL
C:\ProgramData\Sony Corporation\HELP_DECRYPT.PNG
C:\ProgramData\Sony Corporation\HELP_DECRYPT.URL
C:\ProgramData\Sony Corporation\SOHLib\HELP_DECRYPT.PNG
C:\ProgramData\Sony Corporation\SOHLib\HELP_DECRYPT.URL
C:\ProgramData\Sony Corporation\SOHLib\DB\HELP_DECRYPT.PNG
C:\ProgramData\Sony Corporation\SOHLib\DB\HELP_DECRYPT.URL
C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.PNG
C:\ProgramData\Microsoft\RAC\PublishedData\HELP_DECRYPT.URL
C:\FRST\Quarantine\C\ProgramData\HELP_DECRYPT.PNG.xBAD
C:\FRST\Quarantine\C\ProgramData\HELP_DECRYPT.URL.xBAD
C:\$Recycle.Bin\S-1-5-21-1298365283-2315814827-2616718145-1000\HELP_DECRYPT.PNG
C:\$Recycle.Bin\S-1-5-21-1298365283-2315814827-2616718145-1000\HELP_DECRYPT.URL
CreateRestorePoint:
EmptyTemp:

End
Save the files as fixlist.txt in the same folder where the Farbar tool is running from.
The location is listed in the 3rd line of the Farbar log you have submitted.

Run FRST and click Fix only once and wait.

Restart the computer normally to reset the registry.

The tool will create a log (Fixlog.txt) I do not need to see the content of the file if all when well.
===

#7 nasdaq

nasdaq

  • Malware Response Team
  • 39,523 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:21 PM

Posted 17 July 2015 - 07:22 AM

If all is well.

To learn more about how to protect yourself while on the internet read this little guide best security practices keep safe.
http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/
===

#8 nasdaq

nasdaq

  • Malware Response Team
  • 39,523 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:05:21 PM

Posted 23 July 2015 - 08:18 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users