This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

SUPER slow PC Usage - Maybe Malware [Solved]

55 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

cmd.exe and msiexec.exe are running pretty high, maybe a windows issue. I see cmd.exe running multiple times ??

 

You never answered what i asked about CryptoWall

 

Prior to this happening, have you installed or uninstalled any new software or hardware ??

 

Lets see if cmd.exe is infected

 

You need to enable windows to show all files and folders, instructions Here
 
Go to VirusTotal and submit these files for analysis, just use CHOOSE FILE  and then Scan It, if it says this file has been checked before, have them recheck it. When the scan is done just copy and paste the link back to this forum for me to see.
 
C:\Windows\System32\cmd.exe <—This file
 
If the site is busy you can try this one
 
 
===============================================
 

I would like you to run Malwarebytes Anti Rootkit and if it finds nothing wrong than I will have you post in our windows forum for help

 

 

Please download Malwarebytes Anti-Rootkit from Here
  1. Unzip the contents to a folder in a convenient location.
  2. Open the folder where the contents were unzipped and run mbar.exe
  3. Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  4. Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  5. Wait while the system shuts down and the cleanup process is performed.
  6. Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  7. When done, please post the two logs produced they will be in the MBAR folder… mbar-log.txt and system-log.txt
  8. I mean I will post this now because I might l lose the link when the PC reboots for the MBAR scan, which found nothing and gave me no log.

    Everything is still super slow.   No software or hardware was install, just one day I went to my PC and it was SUPER SLOW.

    It might be best to show it to your Windows guys, ti's almost impossible to get around on this PC due to it being so slow (imagine waiting 2 minutes to open a folder and 2 minutes to close it, or a start menu only popping up after 2 minutes, then 2 minutes for the programs slider to open)

    In Safe Mode with Networking it was just as slow, I am convinced that sometimes is making all my running files work at the max, it's not just CMD.exe, it jumps from one file to the next, you see it in real time in Task Manager (Sometimes it's CTFmon, then it jumps to Explorer being the drain, then CMD)

     

    It's really stressful after 3 days

    You have to understand that I am not sitting in a chair next to you looking at your computer, I am most likely thousands of miles away from you, your my eyes and ears as to whats going on and if you dont answer my questions it just makes helping you almost impossible. I asked you twice if Cryptowall was present ????????????????????????????????

     

    With all the scans we have run, not looking at a rootkit that can really slow down your system , you still have windows XP that was discontinued by Microsoft so with no further windows updates its leaving your system very insecure and accessible to infections

     

    If your system still has XP, its most likely and old system and you would be better off thinking about getting a new computer or upgrading to Windows 7

     

    At this point I think your issues are either software or hardware related, as an example, last year i installed Zone Alarm firewall on one of my laptops, it made my system so slow I could hardly use it, uninstalled Zone Alarm and everything came back to normal , just saying its either a program you installed that slowing down your system or it could be a failed hardware device like maybe bad memory

     

    Post in out windows forum for help, maybe they can go through your installed programs and find the culprit of check your hardware for problems

     

    http://forums.whatthetech.com/index.php?showforum=119

    Sorry about that, just been really tough trying to navigate this computer at this speed

     

    What is Cryptowall?   I seemed to have missed this.

    From your FRST log

     

    ==================== One Month Created Files and Folders ========
     
    (If an entry is included in the fixlist, the file\folder will be moved.)
     
    2015-05-14 19:01 - 2015-05-14 19:03 - 00029428 _____ () C:\Documents and Settings\Protoman\Desktop\FRST.txt
    2015-05-14 19:00 - 2015-05-14 19:01 - 00000000 ____D () C:\FRST
    2015-05-14 18:49 - 2015-05-14 18:52 - 01145856 _____ (Farbar) C:\Documents and Settings\Protoman\Desktop\FRST.exe
    2015-05-14 18:45 - 2015-05-14 18:45 - 00001844 _____ () C:\Documents and Settings\Protoman\Desktop\aswMBR.txt
    2015-05-14 18:45 - 2015-05-14 18:45 - 00000512 _____ () C:\Documents and Settings\Protoman\Desktop\MBR.dat
    2015-05-14 18:17 - 2015-05-14 18:26 - 05198336 _____ (AVAST Software) C:\Documents and Settings\Protoman\Desktop\aswMBR.exe
    2015-05-14 00:22 - 2015-05-14 00:42 - 00020048 _____ () C:\Documents and Settings\Protoman\Desktop\post.txt
    2015-05-13 22:46 - 2015-05-13 22:46 - 00000777 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
    2015-05-13 22:31 - 2015-05-13 22:31 - 00009140 _____ () C:\Documents and Settings\Protoman\Desktop\AdwCleaner[S4].txt
    2015-05-13 20:11 - 2015-05-13 20:11 - 00000000 ____D () C:\RegBackup
    2015-05-13 19:12 - 2015-05-14 09:48 - 00049282 _____ (Apple Inc.) C:\Documents and Settings\Protoman\Application Data\LJ0HQ4jZkqah9l1-V7TLO5ox9rbPwEM-gfbXZ3ANJpWCwGQ-dwJ43CuXHqcmEbi.exe
    2015-05-13 18:49 - 2015-05-13 18:49 - 00000335 _____ () C:\Documents and Settings\Protoman\Application Data\8178audayu1bjiao
    2015-05-13 18:34 - 2015-05-13 22:23 - 00000000 ____D () C:\AdwCleaner
    2015-05-13 16:42 - 2015-05-13 16:42 - 00049284 _____ (Apple Inc.) C:\Documents and Settings\Protoman\Application Data\5xsKoHcXkdIeQR8-QTC0OYZAbf1cXqG-SI504jKzGAbJRhy-X8gWkRs5dDqTpHN.exe
    2015-05-13 14:32 - 2015-05-13 14:32 - 00043520 _____ () C:\Documents and Settings\Protoman\Application Data\mimetype
    2015-05-13 08:37 - 2015-05-14 16:54 - 00000386 _____ () C:\WINDOWS\Tasks\{A2944C8B-360D-FF6A-8DBE-13FC19E5146B}.job
    2015-05-13 08:37 - 2015-05-13 08:37 - 00000000 ___HD () C:\Documents and Settings\Protoman\Application Data\xILFsyyS
    2015-05-13 06:36 - 2015-05-13 14:31 - 00008620 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.HTML
    2015-05-13 06:36 - 2015-05-13 14:31 - 00004250 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.TXT
    2015-05-13 06:36 - 2015-05-13 14:31 - 00000292 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.URL
    2015-05-13 06:07 - 2015-05-13 06:07 - 00008620 _____ () C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.HTML
    2015-05-13 06:07 - 2015-05-13 06:07 - 00008620 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.HTML
    2015-05-13 06:07 - 2015-05-13 06:07 - 00008620 _____ () C:\Documents and Settings\LocalService\HELP_DECRYPT.HTML
    2015-05-13 06:07 - 2015-05-13 06:07 - 00004250 _____ () C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.TXT
    2015-05-13 06:07 - 2015-05-13 06:07 - 00004250 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.TXT
    2015-05-13 06:07 - 2015-05-13 06:07 - 00004250 _____ () C:\Documents and Settings\LocalService\HELP_DECRYPT.TXT
    2015-05-13 06:07 - 2015-05-13 06:07 - 00000292 _____ () C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.URL
    2015-05-13 06:07 - 2015-05-13 06:07 - 00000292 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.URL
    2015-05-13 06:07 - 2015-05-13 06:07 - 00000292 _____ () C:\Documents and Settings\LocalService\HELP_DECRYPT.URL
    2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT.HTML
    2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT.HTML
    2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\Default User\HELP_DECRYPT.HTML
    2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.HTML
    2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.HTML
    2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.HTML
    2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT.TXT
    2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT.TXT
    2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\Default User\HELP_DECRYPT.TXT
    2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.TXT
    2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.TXT
    2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.TXT
    2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT.URL
    2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT.URL
    2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\Default User\HELP_DECRYPT.URL
    2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.URL
    2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.URL
    2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.URL
    2015-05-13 05:59 - 2015-05-14 00:16 - 00000000 ____D () C:\Documents and Settings\Protoman\Local Settings\Application Data\xgniwe
    2015-05-13 05:58 - 2015-05-13 05:58 - 00000000 ___HD () C:\5281a4a3
    2015-05-13 02:54 - 2015-05-13 14:14 - 00065536 _____ () C:\WINDOWS\system32\config\Spybot -.evt
    2015-05-13 02:23 - 2015-05-13 02:23 - 00001842 _____ () C:\Documents and Settings\All Users\Start Menu\Programs\Spybot-S&D Start Center.lnk
    2015-05-13 02:17 - 2015-05-13 02:51 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy 2
    2015-05-13 02:17 - 2013-09-20 10:49 - 00018968 _____ (Safer Networking Limited) C:\WINDOWS\system32\sdnclean.exe
    2015-05-12 19:48 - 2015-05-12 19:48 - 00000000 ____D () C:\Documents and Settings\Protoman\Local Settings\Application Data\Macromedia
    2015-04-22 08:25 - 2015-04-22 08:25 - 09189321 _____ () C:\Documents and Settings\Protoman\Desktop\SKRILLEX - Slats slats slats.mp4
    2015-04-22 05:47 - 2015-04-22 05:47 - 00000000 ____D () C:\Program Files\Mozilla Firefox
    2015-04-18 17:58 - 2015-04-18 18:30 - 621004800 _____ () C:\Documents and Settings\Protoman\My Documents\RIDfixit.mpg
    2015-04-17 01:59 - 2015-04-17 01:59 - 00000000 ____D () C:\Program Files\7-Zip
    2015-04-17 01:59 - 2015-04-17 01:59 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip

    Lets try removing them

     

     
    I am attaching a FIXLIST file, you need to download it to your desktop where you now have FRST or the fix wont work, use your mouse to drag FIXLIST right next to FRST, either above or below it but not right on top of it, after its downloaded open up FRST and click on FIX (Not Scan) it wont take long, after your computer reboots you will find a FIXLOG file on your desktop, post it please and let me know if there has been any improvement with your system.

    Attachments:

    Still runs slow

     

    Here is the log

     

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 16-05-2015 02
    Ran by [removed] at 2015-05-16 23:46:21 Run:3
    Running from C:\Documents and Settings\[removed]\Desktop
    [removed]
    Boot Mode: Normal
     
    ==============================================
     
    Content of fixlist:
    *****************
    Start
    CloseProcesses:
    CreateRestorePoint: 
    2015-05-13 06:36 - 2015-05-13 14:31 - 00008620 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.HTML
    2015-05-13 06:36 - 2015-05-13 14:31 - 00004250 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.TXT
    2015-05-13 06:36 - 2015-05-13 14:31 - 00000292 _____ () C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.URL
    2015-05-13 06:07 - 2015-05-13 06:07 - 00008620 _____ () C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.HTML
    2015-05-13 06:07 - 2015-05-13 06:07 - 00008620 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.HTML
    2015-05-13 06:07 - 2015-05-13 06:07 - 00008620 _____ () C:\Documents and Settings\LocalService\HELP_DECRYPT.HTML
    2015-05-13 06:07 - 2015-05-13 06:07 - 00004250 _____ () C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.TXT
    2015-05-13 06:07 - 2015-05-13 06:07 - 00004250 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.TXT
    2015-05-13 06:07 - 2015-05-13 06:07 - 00004250 _____ () C:\Documents and Settings\LocalService\HELP_DECRYPT.TXT
    2015-05-13 06:07 - 2015-05-13 06:07 - 00000292 _____ () C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.URL
    2015-05-13 06:07 - 2015-05-13 06:07 - 00000292 _____ () C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.URL
    2015-05-13 06:07 - 2015-05-13 06:07 - 00000292 _____ () C:\Documents and Settings\LocalService\HELP_DECRYPT.URL
    2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT.HTML
    2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT.HTML
    2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\Default User\HELP_DECRYPT.HTML
    2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.HTML
    2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.HTML
    2015-05-13 06:06 - 2015-05-13 06:06 - 00008620 _____ () C:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.HTML
    2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT.TXT
    2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT.TXT
    2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\Default User\HELP_DECRYPT.TXT
    2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.TXT
    2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.TXT
    2015-05-13 06:06 - 2015-05-13 06:06 - 00004250 _____ () C:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.TXT
    2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT.URL
    2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT.URL
    2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\Default User\HELP_DECRYPT.URL
    2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.URL
    2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\All Users\HELP_DECRYPT.URL
    2015-05-13 06:06 - 2015-05-13 06:06 - 00000292 _____ () C:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.URL
    2015-05-13 05:59 - 2015-05-14 00:16 - 00000000 ____D () C:\Documents and Settings\Protoman\Local Settings\Application Data\xgniwe
    CMD: ipconfig /flushdns
    Hosts:
    EmptyTemp:
    End
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
    *****************
     
    Processes closed successfully.
    Restore point was successfully created.
    C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.HTML => Moved successfully.
    C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.TXT => Moved successfully.
    C:\Documents and Settings\Protoman\Application Data\HELP_DECRYPT.URL => Moved successfully.
    C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.HTML => Moved successfully.
    C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.HTML => Moved successfully.
    C:\Documents and Settings\LocalService\HELP_DECRYPT.HTML => Moved successfully.
    C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.TXT => Moved successfully.
    C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.TXT => Moved successfully.
    C:\Documents and Settings\LocalService\HELP_DECRYPT.TXT => Moved successfully.
    C:\Documents and Settings\LocalService\Local Settings\HELP_DECRYPT.URL => Moved successfully.
    C:\Documents and Settings\LocalService\Local Settings\Application Data\HELP_DECRYPT.URL => Moved successfully.
    C:\Documents and Settings\LocalService\HELP_DECRYPT.URL => Moved successfully.
    C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT.HTML => Moved successfully.
    C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT.HTML => Moved successfully.
    C:\Documents and Settings\Default User\HELP_DECRYPT.HTML => Moved successfully.
    C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.HTML => Moved successfully.
    C:\Documents and Settings\All Users\HELP_DECRYPT.HTML => Moved successfully.
    C:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.HTML => Moved successfully.
    C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT.TXT => Moved successfully.
    C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT.TXT => Moved successfully.
    C:\Documents and Settings\Default User\HELP_DECRYPT.TXT => Moved successfully.
    C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.TXT => Moved successfully.
    C:\Documents and Settings\All Users\HELP_DECRYPT.TXT => Moved successfully.
    C:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.TXT => Moved successfully.
    C:\Documents and Settings\Default User\Local Settings\HELP_DECRYPT.URL => Moved successfully.
    C:\Documents and Settings\Default User\Local Settings\Application Data\HELP_DECRYPT.URL => Moved successfully.
    C:\Documents and Settings\Default User\HELP_DECRYPT.URL => Moved successfully.
    C:\Documents and Settings\Default User\Application Data\HELP_DECRYPT.URL => Moved successfully.
    C:\Documents and Settings\All Users\HELP_DECRYPT.URL => Moved successfully.
    C:\Documents and Settings\All Users\Application Data\HELP_DECRYPT.URL => Moved successfully.
    C:\Documents and Settings\Protoman\Local Settings\Application Data\xgniwe => Moved successfully.
     
    =========  ipconfig /flushdns =========
     
     
     
    Windows IP Configuration
     
     
     
    Successfully flushed the DNS Resolver Cache.
     
     
    ========= End of CMD: =========
     
    C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
    Hosts was reset successfully.

    Before you post in the windows forum, lets run a free online virus scanner

     

     
    ESET Online Scanner
    I'd like us to scan your machine with ESET OnlineScan
     
    *Note
    It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
    Please don't go surfing while your resident protection is disabled!
    Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.
     
    1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    2. ESET OnlineScan
    3. Click the [external image: esetOnline.png] button.
    4. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      1. Click on [external image: esetSmartInstall.png] to download the ESET Smart Installer. Save it to your desktop.
      2. Double click on the [external image: esetSmartInstallDesktopIcon.png] icon on your desktop.
      3. Check [external image: esetAcceptTerms.png]
      4. Click the [external image: esetStart.png] button.
      5. Accept any security warnings from your browser.
      6. Check [external image: esetScanArchives.png]
      7. Make sure that the option "Remove found threats" is Unchecked
      8. Push the Start button.
      9. ESET will then download updates for itself, install itself, and begin
      10. scanning your computer. Please be patient as this can take some time.
      11. When the scan completes, push [external image: esetListThreats.png]
      12. Push [external image: esetExport.png], and save the file to your desktop using a unique name, such as
      13. ESETScan. Include the contents of this report in your next reply.
      14. Push the [external image: esetBack.png] button.
      15. Push [external image: esetFinish.png]
      16. Please make sure you include the following items in your next post:
        The log that was produced after running ESET Online Scanner.

        Forgot to add before you run ESET, lets remove a few things it will help speed up the scan

         

        Double click on AdwCleaner.exe to run the tool again.
        •  
        • Click on the Uninstall button.
        • Click Yes when asked are you sure you want to uninstall.
        • Both AdwCleaner.exe, its folder and all logs will be removed.
         
         
         
         
         
        Then open up Malwarebytes and on the Dashboard go to History > Quarantine and delete everything in Quarantine
        C:\5281a4a3\5281a4a3.exe a variant of Win32/Kryptik.DHZA trojan
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\content.js JS/Chromex.Agent.L trojan
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\lsdb.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\sQsMUGrP6.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\content.js JS/Chromex.Agent.L trojan
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\lsdb.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\sQsMUGrP6.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\All Users\Application Data\Adobe\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Adobe\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Adobe\Updater\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Adobe\Updater\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Adobe\Updater\Certs\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Adobe\Updater\Certs\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\BFTS_BBC2683C\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\BFTS_BBC2683C\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\localStorage\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\toaster\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\toaster\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\toaster\aol.activeupdate\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\toaster\aol.activeupdate\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\toaster\aol.activeupdate\ActiveUpdate\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\toaster\aol.activeupdate\ActiveUpdate\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\toaster\aol.activeupdate\ActiveUpdate\en-US\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\toaster\aol.activeupdate\ActiveUpdate\en-US\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Azureus\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Azureus\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\BlueStacksSetup\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\BlueStacksSetup\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\BlueStacksSetup\Images\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\BlueStacksSetup\Images\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\dynamic\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\dynamic\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\dynamic\english\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\dynamic\english\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\dynamic\english\dv-entertainment\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\dynamic\english\dv-entertainment\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\dynamic\english\dv-entertainment\images\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\dynamic\english\dv-entertainment\images\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\dynamic\english\dv-entertainment\images\products\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\dynamic\english\dv-entertainment\images\products\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\english\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\english\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\english\dv-entertainment\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\english\dv-entertainment\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\english\dv-entertainment\images\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\english\dv-entertainment\images\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\english\dv-entertainment\images\products\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\english\dv-entertainment\images\products\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\english\dv-entertainment\update-img\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\CyberLink\PowerDVD\HTML\english\dv-entertainment\update-img\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\GridinSoft\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\GridinSoft\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\GridinSoft\Trojan Killer\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\GridinSoft\Trojan Killer\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\GridinSoft\Trojan Killer\database\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\GridinSoft\Trojan Killer\database\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\InstallMate\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\InstallMate\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\InstallMate\{96293FDA-018A-438D-A166-49A84DCA1D2C}\Custom.dll Win32/InstalleRex.M potentially unwanted application
        C:\Documents and Settings\All Users\Application Data\InstallMate\{96293FDA-018A-438D-A166-49A84DCA1D2C}\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\InstallMate\{96293FDA-018A-438D-A166-49A84DCA1D2C}\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Lavasoft\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Lavasoft\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware 2007\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware 2007\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Quarantine\QUAR1.39001 Win32/Adware.Virtumonde.NEO application
        C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes Anti-Malware\Quarantine\QUAR1.96604 a variant of Win32/Adware.Virtumonde.NDM application
        C:\Documents and Settings\All Users\Application Data\Metacafe\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Metacafe\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Metacafe\Incoming\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Metacafe\Incoming\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Metacafe\Lock\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Metacafe\Lock\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Skype\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Skype\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Skype\Plugins\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Skype\Plugins\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\Local Cache\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\Local Cache\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Logs\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Quarantine\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Quarantine\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\ASPNET\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\content.js JS/Chromex.Agent.L trojan
        C:\Documents and Settings\ASPNET\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\lsdb.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\ASPNET\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\sQsMUGrP6.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\content.js JS/Chromex.Agent.L trojan
        C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\lsdb.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\ASPNET\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\sQsMUGrP6.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\Default User\Application Data\Microsoft\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Default User\Application Data\Microsoft\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Default User\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Windows Media\9.0\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Default User\Templates\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Default User\Templates\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\content.js JS/Chromex.Agent.L trojan
        C:\Documents and Settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\lsdb.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\Guest\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\sQsMUGrP6.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\content.js JS/Chromex.Agent.L trojan
        C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\lsdb.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\Guest\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\sQsMUGrP6.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\content.js JS/Chromex.Agent.L trojan
        C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\lsdb.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Comodo\Dragon\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\sQsMUGrP6.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\content.js JS/Chromex.Agent.L trojan
        C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\lsdb.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\HelpAssistant\Local Settings\Application Data\Google\Chrome SxS\User Data\Default\Extensions\ohiglaclimobdhachnepggmhcefbefjb\5.14\sQsMUGrP6.js JS/Kryptik.ATB trojan
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\11.0\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\11.0\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows Media\9.0\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\.SunDownloadManager\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\.SunDownloadManager\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\acccore\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\acccore\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\acccore\nss\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\acccore\nss\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Acrobat\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Acrobat\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Acrobat\10.0\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Acrobat\10.0\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Acrobat\7.0\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Acrobat\7.0\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Acrobat\7.0\Messages\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Acrobat\7.0\Messages\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Acrobat\7.0\Messages\ENU\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Acrobat\7.0\Messages\ENU\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Acrobat\7.0\Updater\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Acrobat\7.0\Updater\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Flash Player\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Flash Player\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Flash Player\AssetCache\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Flash Player\AssetCache\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Flash Player\AssetCache\NJPTVTQR\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Flash Player\AssetCache\NJPTVTQR\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Flash Player\AssetCache\ZA9LHWNN\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Flash Player\AssetCache\ZA9LHWNN\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Photoshop Album\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Photoshop Album\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Photoshop Album\3.0\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Adobe\Photoshop Album\3.0\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Ahead\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Ahead\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Ahead\NeroVision\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Ahead\NeroVision\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Azureus\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Azureus\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Azureus\active\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Azureus\active\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Azureus\plugins\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Azureus\plugins\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Azureus\plugins\azupnpav\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Azureus\plugins\azupnpav\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\com.adobe.downloadassistant.AdobeDownloadAssistant\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\com.adobe.downloadassistant.AdobeDownloadAssistant\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\com.adobe.downloadassistant.AdobeDownloadAssistant\Local Store\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\com.adobe.downloadassistant.AdobeDownloadAssistant\Local Store\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerDirector\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerDirector\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerDirector\8.0\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerDirector\8.0\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerDirector\8.0\ShadowEditFiles\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerDirector\8.0\ShadowEditFiles\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerDirector\8.0\WaveForms\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerDirector\8.0\WaveForms\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerProducer\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerProducer\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerProducer\2.0  Gold\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerProducer\2.0  Gold\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerProducer\2.0  Gold\Custom\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerProducer\2.0  Gold\Custom\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerProducer\2.0  Gold\Custom\Background\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\CyberLink\PowerProducer\2.0  Gold\Custom\Background\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Facebook\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Facebook\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\Configuration\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\Configuration\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\Configuration\Content\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\Configuration\Content\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\Configuration\Content\Welcome\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\Configuration\Content\Welcome\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\Configuration\Content\Welcome\Flash\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\Configuration\Content\Welcome\Flash\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\Configuration\Menus\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\Configuration\Menus\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\Configuration\Menus\Custom Sets\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Dreamweaver 8\Configuration\Menus\Custom Sets\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\AnswersPanel\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\AnswersPanel\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Components\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Components\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\HTML\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\HTML\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\HTML\Learning Extensions Srvr Files\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\HTML\Learning Extensions Srvr Files\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Libraries\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Libraries\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\Ads\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\Ads\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\Broadcast\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\Broadcast\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\Menus\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\Menus\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\MobileDevices\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\MobileDevices\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\PhotoSlideshow\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\PhotoSlideshow\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\Presentation\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\Presentation\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\Quiz\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\Templates\Quiz\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\WindowSWF\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\WindowSWF\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\WindowSWF\sitespring\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Flash MX\Configuration\WindowSWF\sitespring\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Shockwave Player\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Shockwave Player\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Shockwave Player\Prefs\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Shockwave Player\Prefs\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Shockwave Player\Prefs\443PEFV6\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Macromedia\Shockwave Player\Prefs\443PEFV6\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\MetaCafe\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\MetaCafe\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Microsoft\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Microsoft\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Microsoft\Internet Explorer\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Crash Reports\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Crash Reports\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Crash Reports\submitted\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Crash Reports\submitted\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}\widgets\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}\widgets\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\google_safebrowsing\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\google_safebrowsing\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\sessionstore-backups\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\sessionstore-backups\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\http+++otakumode.com\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\http+++otakumode.com\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\http+++otakumode.com\idb\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\http+++otakumode.com\idb\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\http+++videogames.desktopnexus.com\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\http+++videogames.desktopnexus.com\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\http+++videogames.desktopnexus.com\idb\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\http+++videogames.desktopnexus.com\idb\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\http+++www.walmart.ca\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\http+++www.walmart.ca\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\http+++www.walmart.ca\idb\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\http+++www.walmart.ca\idb\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\https+++drive.google.com\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\https+++drive.google.com\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\https+++drive.google.com\idb\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\https+++drive.google.com\idb\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\https+++twitter.com\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\https+++twitter.com\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\https+++twitter.com\idb\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Mozilla\Firefox\Profiles\0aghlp78.default\storage\default\https+++twitter.com\idb\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Real\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Real\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Real\RealMediaSDK\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Real\RealMediaSDK\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Real\RealPlayer\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Real\RealPlayer\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Real\RealPlayer\db\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Real\RealPlayer\db\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Runaware\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Runaware\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Runaware\TestDrive Wizard\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Runaware\TestDrive Wizard\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Runaware\TestDrive Wizard\resource\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Runaware\TestDrive Wizard\resource\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Runaware\TestDrive Wizard\resource\en\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Runaware\TestDrive Wizard\resource\en\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Skype\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Skype\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Skype\My Skype Received Files\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Skype\My Skype Received Files\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Skype\protomanxred\HELP_DECRYPT.HTML Win32/Filecoder.CR trojan
        C:\Documents and Settings\Protoman\Application Data\Skype\protomanxred\HELP_DECRYPT.TXT Win32/Filecoder.CR trojan

        Ask AI

        AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

        Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI