[VX2] Marche à suivre pour le virer?!!!

Résolu
PaX2k5 Messages postés 23 Statut Membre -  
 hacker84 -
Bonjour ,

J'ai un gros problème avec probablement une variante de vx2 !

Ad-aware m'a détecté la présence de vx2 qu'il n'arrive pas à supprimer...

j'ai téléchargé le vx2cleaner de ad-aware pour m'en débarasser mais ce dernier ne trouve rien (trouvez l erreur??!!) alors que c'est la version 2.0

j'ai aussi essayé avec spybot mais ca foire aussi

Je suis assez désespéré vu que ca fait 2 jours que je tente des trucs qui foirent et pour finir j'avance nul part !!!

Si quelqu'un pouvait m'aider svp!!

je vous remercie vivement !!!

43 réponses

  • 1
  • 2
  • 3
Résumé de la discussion

Une variante de VX2 est signalée comme résistante à la suppression par Ad-Aware, malgré l’usage du VX2cleaner et des scans avec Spybot, l’utilisateur décrivant deux jours d’essais infructueux. Plusieurs réponses évoquent des signes d’infection persistante: clés Winlogon Notify, DPF et Dlls injectés, des éléments potentiellement malveillants dans system32 et des outils comme Ewido et le scan en ligne. Des échanges détaillent l’analyse des rapports générés par des outils comme L2MFIX, qui liste des valeurs Winlogon et des CLSID suspects, et proposent des nettoyeurs de registre ou cookies tel RegCleaner et Cleanup40. En cas de persistance, le fil montre que l’utilisateur partage des captures et des logs pour clarifier l’étendue de l’infection et évaluer les prochaines étapes.

Généré automatiquement par IA
sur la base des meilleures réponses
  1. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut !

    marche à suivre :

    PROCEDURE DETAILLEE :

    Télécharger l2mfix.exe sur

    http://www.downloads.subratam.org/l2mfix.exe

    *Phase 1:
    - Quitter le net, le navigateur, et toutes autres fenêtres d'applications ;
    - Dézipper l2mfix.exe sur le bureau ;
    - Dans le dossier du programme, double-cliquer sur l2mfix.bat ;
    - Choisir OPTION 1 (Run find log) et valider par la touche [Entrée] ;
    => Un rapport sera généré dans le Bloc-notes, se reconnecter pour le poster au forum.

    bon courage, @+

    *** Les Amis c'est comme Les étoiles, On ne Les vois pas Toujour, mais on Sait qu'ils sont la... *
    0
  2. PaX2k5 Messages postés 23 Statut Membre
     
    Merci pour ta réponse rapide !!!

    Voici le log du programme :

    L2MFIX find log 010406
    These are the registry keys present
    **********************************************************************************
    Winlogon/notify:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Internet Settings]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\dDd8thk.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\lv2609fse.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    **********************************************************************************
    useragent:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    "{2480FDAE-3E6E-5D3E-D461-34849D19485A}"=""

    **********************************************************************************
    Shell Extension key:
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
    "{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
    "{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
    "{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
    "{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
    "{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
    "{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
    "{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
    "{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
    "{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
    "{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
    "{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
    "{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
    "{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
    "{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
    "{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
    "{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
    "{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
    "{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
    "{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
    "{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
    "{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
    "{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
    "{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
    "{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
    "{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
    "{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
    "{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
    "{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
    "{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
    "{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
    "{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
    "{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
    "{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
    "{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
    "{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
    "{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
    "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
    "{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
    "{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
    "{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
    "{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
    "{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
    "{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
    "{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
    "{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
    "{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
    "{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
    "{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
    "{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
    "{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
    "{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
    "{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
    "{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
    "{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
    "{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
    "{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
    "{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
    "{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
    "{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
    "{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
    "{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
    "{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
    "{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
    "{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
    "{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
    "{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
    "{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
    "{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
    "{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
    "{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
    "{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
    "{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
    "{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
    "{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
    "{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
    "{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
    "{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
    "{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
    "{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
    "{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
    "{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
    "{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
    "{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
    "{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
    "{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
    "{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
    "{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
    "{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
    "{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
    "{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
    "{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
    "{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
    "{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
    "{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
    "{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
    "{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
    "{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
    "{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
    "{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
    "{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
    "{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
    "{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
    "{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
    "{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
    "{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
    "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
    "{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
    "{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
    "{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
    "{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
    "{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
    "{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
    "{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
    "{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
    "{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
    "{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
    "{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
    "{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
    "{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
    "{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
    "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
    "{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
    "{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
    "{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
    "{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
    "{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
    "{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
    "{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
    "{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
    "{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
    "{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
    "{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
    "{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
    "{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
    "{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
    "{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
    "{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
    "{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
    "{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
    "{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
    "{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
    "{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
    "{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
    "{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
    "{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
    "{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
    "{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
    "{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
    "{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
    "{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
    "{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
    "{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
    "{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
    "{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
    "{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
    "{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
    "{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
    "{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
    "{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
    "{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
    "{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
    "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
    "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
    "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
    "{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
    "{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
    "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
    "{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF}"="iTunes"
    "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
    "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
    "{57C51AF9-DEF7-11D3-A801-00C04F163490}"="Ghost Shell Extension"
    "{AB77609F-2178-4E6F-9C4B-44AC179D937A}"="aý Context Menu Shell Extension"
    "{1CE8B2C9-EAEF-43fc-8218-F092E4F94A47}"="Notepad++ Shell Extension"
    "{52B87208-9CCF-42C9-B88E-069281105805}"="Trojan Remover Shell Extension"
    "{9F52549D-E266-4A6B-8023-96B328B5D6BE}"=""
    "{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
    "{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"
    "{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
    "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
    "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
    "{8DACAA10-1545-4302-8A77-1F0B0794F884}"=""
    "{1A4E25E1-91E6-43CC-ABE4-6F8B136BA079}"=""
    "{27C664D4-8DA4-44B7-BB5A-DA59A80C3E40}"=""
    "{43B46448-74ED-4DED-BA29-EDAD3F318DCF}"=""
    "{A7F887AC-DF64-4802-B04D-70FC50E35230}"=""
    "{514CEDD0-AA0A-4C3C-91BF-1DAE5D6C0567}"=""
    "{E77D313E-9FEF-43CC-9DA3-46052B383727}"=""
    "{0C40AB91-7097-4C44-B146-CC8BD5233B12}"=""
    "{95979D90-0704-4BB9-B910-F75E6E80A47C}"=""
    "{8990A1FA-9F1E-477E-BE14-BCDFC4CFAD94}"=""
    "{A1A7759C-C601-4A04-B75D-4062D7614273}"=""

    **********************************************************************************
    HKEY ROOT CLASSIDS:
    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{9F52549D-E266-4A6B-8023-96B328B5D6BE}]
    @=""
    "IDEx"="ADDR"

    [HKEY_CLASSES_ROOT\CLSID\{9F52549D-E266-4A6B-8023-96B328B5D6BE}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{9F52549D-E266-4A6B-8023-96B328B5D6BE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{9F52549D-E266-4A6B-8023-96B328B5D6BE}\InprocServer32]
    @="C:\\WINDOWS\\system32\\nzmctray.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{8DACAA10-1545-4302-8A77-1F0B0794F884}]
    @=""
    "IDEx"="ADDR"

    [HKEY_CLASSES_ROOT\CLSID\{8DACAA10-1545-4302-8A77-1F0B0794F884}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{8DACAA10-1545-4302-8A77-1F0B0794F884}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{8DACAA10-1545-4302-8A77-1F0B0794F884}\InprocServer32]
    @="C:\\WINDOWS\\system32\\aMaamon.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{1A4E25E1-91E6-43CC-ABE4-6F8B136BA079}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{1A4E25E1-91E6-43CC-ABE4-6F8B136BA079}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{1A4E25E1-91E6-43CC-ABE4-6F8B136BA079}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{1A4E25E1-91E6-43CC-ABE4-6F8B136BA079}\InprocServer32]
    @="C:\\WINDOWS\\system32\\mIg_hook.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{43B46448-74ED-4DED-BA29-EDAD3F318DCF}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{43B46448-74ED-4DED-BA29-EDAD3F318DCF}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{43B46448-74ED-4DED-BA29-EDAD3F318DCF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{43B46448-74ED-4DED-BA29-EDAD3F318DCF}\InprocServer32]
    @="C:\\WINDOWS\\system32\\ihmpagnt.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{A7F887AC-DF64-4802-B04D-70FC50E35230}]
    @=""
    "IDEx"="AD"

    [HKEY_CLASSES_ROOT\CLSID\{A7F887AC-DF64-4802-B04D-70FC50E35230}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A7F887AC-DF64-4802-B04D-70FC50E35230}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A7F887AC-DF64-4802-B04D-70FC50E35230}\InprocServer32]
    @="C:\\WINDOWS\\system32\\myxdm.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{514CEDD0-AA0A-4C3C-91BF-1DAE5D6C0567}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{514CEDD0-AA0A-4C3C-91BF-1DAE5D6C0567}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{514CEDD0-AA0A-4C3C-91BF-1DAE5D6C0567}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{514CEDD0-AA0A-4C3C-91BF-1DAE5D6C0567}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{E77D313E-9FEF-43CC-9DA3-46052B383727}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E77D313E-9FEF-43CC-9DA3-46052B383727}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E77D313E-9FEF-43CC-9DA3-46052B383727}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E77D313E-9FEF-43CC-9DA3-46052B383727}\InprocServer32]
    @="C:\\WINDOWS\\system32\\ilss.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{0C40AB91-7097-4C44-B146-CC8BD5233B12}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{0C40AB91-7097-4C44-B146-CC8BD5233B12}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{0C40AB91-7097-4C44-B146-CC8BD5233B12}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{0C40AB91-7097-4C44-B146-CC8BD5233B12}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{95979D90-0704-4BB9-B910-F75E6E80A47C}]
    @=""
    "IDEx"="AD"

    [HKEY_CLASSES_ROOT\CLSID\{95979D90-0704-4BB9-B910-F75E6E80A47C}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{95979D90-0704-4BB9-B910-F75E6E80A47C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{95979D90-0704-4BB9-B910-F75E6E80A47C}\InprocServer32]
    @="C:\\WINDOWS\\system32\\umrvpa.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{8990A1FA-9F1E-477E-BE14-BCDFC4CFAD94}]
    @=""
    "IDEx"="AD"

    [HKEY_CLASSES_ROOT\CLSID\{8990A1FA-9F1E-477E-BE14-BCDFC4CFAD94}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{8990A1FA-9F1E-477E-BE14-BCDFC4CFAD94}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{8990A1FA-9F1E-477E-BE14-BCDFC4CFAD94}\InprocServer32]
    @="C:\\WINDOWS\\system32\\wgw32.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{A1A7759C-C601-4A04-B75D-4062D7614273}]
    @=""
    "IDEx"="ADDR"

    [HKEY_CLASSES_ROOT\CLSID\{A1A7759C-C601-4A04-B75D-4062D7614273}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A1A7759C-C601-4A04-B75D-4062D7614273}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A1A7759C-C601-4A04-B75D-4062D7614273}\InprocServer32]
    @="C:\\WINDOWS\\system32\\dDd8thk.dll"
    "ThreadingModel"="Apartment"

    **********************************************************************************
    Files Found are not all bad files:

    C:\WINDOWS\SYSTEM32\
    ddd8thk.dll Mon 6 Mar 2006 22:22:58 A.... 234.272 228,78 K
    hr4u05~1.dll Mon 6 Mar 2006 19:17:12 ..S.R 236.778 231,23 K
    l04q0a~1.dll Mon 6 Mar 2006 18:20:12 ..S.R 236.373 230,83 K
    mlmtapi.dll Mon 6 Mar 2006 21:46:54 A.... 234.272 228,78 K
    msgplu~1.dll Tue 20 Dec 2005 23:52:40 A.... 58.952 57,57 K
    nv4_disp.dll Sat 10 Dec 2005 3:06:00 A.... 3.955.456 3,77 M
    nvapi.dll Sat 10 Dec 2005 3:06:00 A.... 110.592 108,00 K
    nvcod.dll Sat 10 Dec 2005 3:06:00 A.... 35.840 35,00 K
    nvcodins.dll Sat 10 Dec 2005 3:06:00 A.... 35.840 35,00 K
    nvcpl.dll Sat 10 Dec 2005 3:06:00 A.... 7.311.360 6,97 M
    nvhwvid.dll Sat 10 Dec 2005 3:06:00 A.... 573.440 560,00 K
    nview.dll Sat 10 Dec 2005 3:06:00 A.... 1.466.368 1,40 M
    nvmccs.dll Sat 10 Dec 2005 3:06:00 A.... 229.376 224,00 K
    nvmccsrs.dll Sat 10 Dec 2005 3:06:00 A.... 45.056 44,00 K
    nvmctray.dll Sat 10 Dec 2005 3:06:00 A.... 86.016 84,00 K
    nvnt4cpl.dll Sat 10 Dec 2005 3:06:00 A.... 286.720 280,00 K
    nvoglnt.dll Sat 10 Dec 2005 3:06:00 A.... 5.402.624 5,15 M
    nvrsar.dll Sat 10 Dec 2005 3:06:00 A.... 319.488 312,00 K
    nvrscs.dll Sat 10 Dec 2005 3:06:00 A.... 241.664 236,00 K
    nvrsda.dll Sat 10 Dec 2005 3:06:00 A.... 245.760 240,00 K
    nvrsde.dll Sat 10 Dec 2005 3:06:00 A.... 270.336 264,00 K
    nvrsel.dll Sat 10 Dec 2005 3:06:00 A.... 274.432 268,00 K
    nvrseng.dll Sat 10 Dec 2005 3:06:00 A.... 241.664 236,00 K
    nvrses.dll Sat 10 Dec 2005 3:06:00 A.... 274.432 268,00 K
    nvrsesm.dll Sat 10 Dec 2005 3:06:00 A.... 266.240 260,00 K
    nvrsfi.dll Sat 10 Dec 2005 3:06:00 A.... 241.664 236,00 K
    nvrsfr.dll Sat 10 Dec 2005 3:06:00 A.... 278.528 272,00 K
    nvrshe.dll Sat 10 Dec 2005 3:06:00 A.... 319.488 312,00 K
    nvrshu.dll Sat 10 Dec 2005 3:06:00 A.... 253.952 248,00 K
    nvrsit.dll Sat 10 Dec 2005 3:06:00 A.... 274.432 268,00 K
    nvrsja.dll Sat 10 Dec 2005 3:06:00 A.... 258.048 252,00 K
    nvrsko.dll Sat 10 Dec 2005 3:06:00 A.... 253.952 248,00 K
    nvrsnl.dll Sat 10 Dec 2005 3:06:00 A.... 266.240 260,00 K
    nvrsno.dll Sat 10 Dec 2005 3:06:00 A.... 249.856 244,00 K
    nvrspl.dll Sat 10 Dec 2005 3:06:00 A.... 249.856 244,00 K
    nvrspt.dll Sat 10 Dec 2005 3:06:00 A.... 266.240 260,00 K
    nvrsptb.dll Sat 10 Dec 2005 3:06:00 A.... 262.144 256,00 K
    nvrsru.dll Sat 10 Dec 2005 3:06:00 A.... 262.144 256,00 K
    nvrssk.dll Sat 10 Dec 2005 3:06:00 A.... 249.856 244,00 K
    nvrssl.dll Sat 10 Dec 2005 3:06:00 A.... 249.856 244,00 K
    nvrssv.dll Sat 10 Dec 2005 3:06:00 A.... 245.760 240,00 K
    nvrstr.dll Sat 10 Dec 2005 3:06:00 A.... 249.856 244,00 K
    nvrszhc.dll Sat 10 Dec 2005 3:06:00 A.... 217.088 212,00 K
    nvrszht.dll Sat 10 Dec 2005 3:06:00 A.... 118.784 116,00 K
    nvshell.dll Sat 10 Dec 2005 3:06:00 A.... 466.944 456,00 K
    nvwddi.dll Sat 10 Dec 2005 3:06:00 A.... 81.920 80,00 K
    nvwdmcpl.dll Sat 10 Dec 2005 3:06:00 A.... 1.662.976 1,59 M
    nvwimg.dll Sat 10 Dec 2005 3:06:00 A.... 1.019.904 996,00 K
    nvwrsar.dll Sat 10 Dec 2005 3:06:00 A.... 282.624 276,00 K
    nvwrscs.dll Sat 10 Dec 2005 3:06:00 A.... 286.720 280,00 K
    nvwrsda.dll Sat 10 Dec 2005 3:06:00 A.... 294.912 288,00 K
    nvwrsde.dll Sat 10 Dec 2005 3:06:00 A.... 311.296 304,00 K
    nvwrsel.dll Sat 10 Dec 2005 3:06:00 A.... 335.872 328,00 K
    nvwrseng.dll Sat 10 Dec 2005 3:06:00 A.... 286.720 280,00 K
    nvwrses.dll Sat 10 Dec 2005 3:06:00 A.... 335.872 328,00 K
    nvwrsesm.dll Sat 10 Dec 2005 3:06:00 A.... 327.680 320,00 K
    nvwrsfi.dll Sat 10 Dec 2005 3:06:00 A.... 303.104 296,00 K
    nvwrsfr.dll Sat 10 Dec 2005 3:06:00 A.... 327.680 320,00 K
    nvwrshe.dll Sat 10 Dec 2005 3:06:00 A.... 278.528 272,00 K
    nvwrshu.dll Sat 10 Dec 2005 3:06:00 A.... 315.392 308,00 K
    nvwrsit.dll Sat 10 Dec 2005 3:06:00 A.... 323.584 316,00 K
    nvwrsja.dll Sat 10 Dec 2005 3:06:00 A.... 212.992 208,00 K
    nvwrsko.dll Sat 10 Dec 2005 3:06:00 A.... 196.608 192,00 K
    nvwrsnl.dll Sat 10 Dec 2005 3:06:00 A.... 319.488 312,00 K
    nvwrsno.dll Sat 10 Dec 2005 3:06:00 A.... 299.008 292,00 K
    nvwrspl.dll Sat 10 Dec 2005 3:06:00 A.... 294.912 288,00 K
    nvwrspt.dll Sat 10 Dec 2005 3:06:00 A.... 323.584 316,00 K
    nvwrsptb.dll Sat 10 Dec 2005 3:06:00 A.... 319.488 312,00 K
    nvwrsru.dll Sat 10 Dec 2005 3:06:00 A.... 315.392 308,00 K
    nvwrssk.dll Sat 10 Dec 2005 3:06:00 A.... 299.008 292,00 K
    nvwrssl.dll Sat 10 Dec 2005 3:06:00 A.... 303.104 296,00 K
    nvwrssv.dll Sat 10 Dec 2005 3:06:00 A.... 294.912 288,00 K
    nvwrstr.dll Sat 10 Dec 2005 3:06:00 A.... 303.104 296,00 K
    nvwrszhc.dll Sat 10 Dec 2005 3:06:00 A.... 163.840 160,00 K
    nvwrszht.dll Sat 10 Dec 2005 3:06:00 A.... 167.936 164,00 K
    o0pq0a~1.dll Mon 6 Mar 2006 0:31:06 ..S.R 234.842 229,34 K
    r6r6lg~1.dll Mon 6 Mar 2006 16:30:10 ..S.R 235.968 230,44 K
    s32evnt1.dll Tue 3 Jan 2006 15:31:44 A.... 91.904 89,75 K
    sirenacm.dll Wed 14 Dec 2005 9:24:42 A.... 118.784 116,00 K
    slobject.dll Mon 6 Mar 2006 19:14:54 ..S.R 235.833 230,30 K
    xvidcore.dll Fri 30 Dec 2005 20:10:30 A.... 761.856 744,00 K
    xvidvfw.dll Fri 30 Dec 2005 20:18:26 A.... 180.224 176,00 K

    82 items found: 82 files (5 H/S), 0 directories.
    Total of file sizes: 40.355.610 bytes 38,48 M
    Locate .tmp files:

    C:\WINDOWS\SYSTEM32\
    atmtdd~1.tmp Mon 6 Mar 2006 22:21:00 A.... 0 0,00 K
    trj_nt~1.tmp Sun 5 Mar 2006 22:24:16 A.... 1.896 1,85 K

    2 items found: 2 files, 0 directories.
    Total of file sizes: 1.896 bytes 1,85 K
    **********************************************************************************
    Directory Listing of system files:
    Le volume dans le lecteur C n'a pas de nom.
    Le num‚ro de s‚rie du volume est 089D-8963

    R‚pertoire de C:\WINDOWS\System32

    06/03/2006 21:21 <REP> dllcache
    06/03/2006 19:17 236.778 hr4u05h9e.dll
    06/03/2006 19:14 235.833 slobject.dll
    06/03/2006 18:20 236.373 l04q0ah5ed4.dll
    06/03/2006 16:30 235.968 r6r6lg9s16.dll
    06/03/2006 00:31 234.842 o0pq0a75ed.dll
    04/03/2006 18:22 244.738 netdrvr.exe
    21/11/2005 18:51 32 {4B072BFF-A231-4CF8-B7D7-0A7581662F89}.dat
    21/11/2005 18:50 32 {6BE0515B-34B2-43C4-9851-4FBCD0FF869D}.dat
    21/11/2005 18:49 32 {612BCE90-4EA9-4BF1-834D-1F16621B3CCE}.dat
    21/11/2005 18:48 32 {201BF7E7-1C1D-475F-98A1-4B26C6B4A2C9}.dat
    21/11/2005 18:48 32 {4DAC141E-E6E4-4E55-9B16-AD555BABC450}.dat
    21/11/2005 18:48 32 {4E8BDCCE-F376-43B1-B2B8-CD7590BC98D9}.dat
    21/11/2005 18:47 32 {A889C4B2-BC6E-4652-81CA-8E268402ADD1}.dat
    28/10/2005 16:28 <REP> Microsoft
    13 fichier(s) 1.424.756 octets
    2 R‚p(s) 17.477.324.800 octets libres
    0
  3. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Re !

    ok ! :-)

    maintenant :

    *Phase 2 :

    - Quitter le net, le navigateur, et toutes autres fenêtres d'applications ;
    - Double-cliquer sur l2mfix.bat ;
    - Choisir OPTION 2 (Run fix) et valider par la touche [Entrée] ;
    - A l'invite, appuyer sur une touche du clavier pour redémarrer le PC ;
    => Au redémarrage, le nettoyage de L2mFix se poursuit, puis génère le résultat du nettoyage en ouvrant le Bloc-notes ; se reconnecter pour le poster au forum.

    bon courage, @+
    0
  4. PaX2k5 Messages postés 23 Statut Membre
     
    Encore merci pour le temps que tu m'accordes

    Voila , j'ai suivi à la lettre les différentes étapes.
    Voici le rapport du programme (un peu long , déso)

    L2mfix 010406
    Creating Account.
    La commande s'est termin‚e correctement.

    Adding Administrative privleges.
    Checking for L2MFix account(0=no 1=yes):
    1
    Granting SeDebugPrivilege to L2MFIX ... successful

    Running From:
    C:\WINDOWS\system32

    Killing Processes!

    Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
    Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
    Killing PID 616 'smss.exe'

    Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
    Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killing PID 864 'winlogon.exe'
    Killi
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. PaX2k5 Messages postés 23 Statut Membre
     
    [suite]

    Killing PID 864 'winlogon.exe'

    Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
    Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
    Killing PID 4020 'explorer.exe'
    Killing PID 4020 'explorer.exe'

    Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
    Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
    Error, Cannot find a process with an image name of rundll32.exe
    Restoring Sedebugprivilege:
    Granting SeDebugPrivilege to Administrateurs ... successful

    Scanning First Pass. Please Wait!

    First Pass Completed

    Second Pass Scanning

    Second pass Completed!
    1 fichier(s) copi‚(s).
    1 fichier(s) copi‚(s).
    1 fichier(s) copi‚(s).
    1 fichier(s) copi‚(s).
    1 fichier(s) copi‚(s).
    1 fichier(s) copi‚(s).
    1 fichier(s) copi‚(s).
    Deleting: C:\WINDOWS\system32\dDd8thk.dll
    Successfully Deleted: C:\WINDOWS\system32\dDd8thk.dll
    Deleting: C:\WINDOWS\system32\hr4u05h9e.dll
    Successfully Deleted: C:\WINDOWS\system32\hr4u05h9e.dll
    Deleting: C:\WINDOWS\system32\l04q0ah5ed4.dll
    Successfully Deleted: C:\WINDOWS\system32\l04q0ah5ed4.dll
    Deleting: C:\WINDOWS\system32\mlmtapi.dll
    Successfully Deleted: C:\WINDOWS\system32\mlmtapi.dll
    Deleting: C:\WINDOWS\system32\o0pq0a75ed.dll
    Successfully Deleted: C:\WINDOWS\system32\o0pq0a75ed.dll
    Deleting: C:\WINDOWS\system32\r6r6lg9s16.dll
    Successfully Deleted: C:\WINDOWS\system32\r6r6lg9s16.dll
    Deleting: C:\WINDOWS\system32\slobject.dll
    Successfully Deleted: C:\WINDOWS\system32\slobject.dll

    msg11?.dll
    0 fichier(s) copi‚(s).

    Restoring Windows Update Certificates.:

    The following Is the Current Export of the Winlogon notify key:
    ****************************************************************************
    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
    6c,00,00,00
    "Logoff"="ChainWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    "Asynchronous"=dword:00000000
    "Impersonate"=dword:00000000
    "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Logoff"="CryptnetWlxLogoffEvent"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    "DLLName"="cscdll.dll"
    "Logon"="WinlogonLogonEvent"
    "Logoff"="WinlogonLogoffEvent"
    "ScreenSaver"="WinlogonScreenSaverEvent"
    "Startup"="WinlogonStartupEvent"
    "Shutdown"="WinlogonShutdownEvent"
    "StartShell"="WinlogonStartShellEvent"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Internet Settings]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\dDd8thk.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MCD]
    "Asynchronous"=dword:00000000
    "DllName"="C:\\WINDOWS\\system32\\lv2609fse.dll"
    "Impersonate"=dword:00000000
    "Logon"="WinLogon"
    "Logoff"="WinLogoff"
    "Shutdown"="WinShutdown"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    "DLLName"="wlnotify.dll"
    "Logon"="SCardStartCertProp"
    "Logoff"="SCardStopCertProp"
    "Lock"="SCardSuspendCertProp"
    "Unlock"="SCardResumeCertProp"
    "Enabled"=dword:00000001
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate"=dword:00000000
    "StartShell"="SchedStartShell"
    "Logoff"="SchedEventLogOff"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    "Logoff"="WLEventLogoff"
    "Impersonate"=dword:00000000
    "Asynchronous"=dword:00000001
    "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    "DLLName"="WlNotify.dll"
    "Lock"="SensLockEvent"
    "Logon"="SensLogonEvent"
    "Logoff"="SensLogoffEvent"
    "Safe"=dword:00000001
    "MaxWait"=dword:00000258
    "StartScreenSaver"="SensStartScreenSaverEvent"
    "StopScreenSaver"="SensStopScreenSaverEvent"
    "Startup"="SensStartupEvent"
    "Shutdown"="SensShutdownEvent"
    "StartShell"="SensStartShellEvent"
    "PostShell"="SensPostShellEvent"
    "Disconnect"="SensDisconnectEvent"
    "Reconnect"="SensReconnectEvent"
    "Unlock"="SensUnlockEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    "Asynchronous"=dword:00000000
    "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
    6c,00,6c,00,00,00
    "Impersonate"=dword:00000000
    "Logoff"="TSEventLogoff"
    "Logon"="TSEventLogon"
    "PostShell"="TSEventPostShell"
    "Shutdown"="TSEventShutdown"
    "StartShell"="TSEventStartShell"
    "Startup"="TSEventStartup"
    "MaxWait"=dword:00000258
    "Reconnect"="TSEventReconnect"
    "Disconnect"="TSEventDisconnect"

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    "DLLName"="wlnotify.dll"
    "Logon"="RegisterTicketExpiredNotificationEvent"
    "Logoff"="UnregisterTicketExpiredNotificationEvent"
    "Impersonate"=dword:00000001
    "Asynchronous"=dword:00000001

    The following are the files found:
    ****************************************************************************
    C:\WINDOWS\system32\dDd8thk.dll
    C:\WINDOWS\system32\hr4u05h9e.dll
    C:\WINDOWS\system32\l04q0ah5ed4.dll
    C:\WINDOWS\system32\mlmtapi.dll
    C:\WINDOWS\system32\o0pq0a75ed.dll
    C:\WINDOWS\system32\r6r6lg9s16.dll
    C:\WINDOWS\system32\slobject.dll

    Registry Entries that were Deleted:
    Please verify that the listing looks ok.
    If there was something deleted wrongly there are backups in the backreg folder.
    ****************************************************************************
    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{9F52549D-E266-4A6B-8023-96B328B5D6BE}]
    @=""
    "IDEx"="ADDR"

    [HKEY_CLASSES_ROOT\CLSID\{9F52549D-E266-4A6B-8023-96B328B5D6BE}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{9F52549D-E266-4A6B-8023-96B328B5D6BE}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{9F52549D-E266-4A6B-8023-96B328B5D6BE}\InprocServer32]
    @="C:\\WINDOWS\\system32\\nzmctray.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{8DACAA10-1545-4302-8A77-1F0B0794F884}]
    @=""
    "IDEx"="ADDR"

    [HKEY_CLASSES_ROOT\CLSID\{8DACAA10-1545-4302-8A77-1F0B0794F884}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{8DACAA10-1545-4302-8A77-1F0B0794F884}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{8DACAA10-1545-4302-8A77-1F0B0794F884}\InprocServer32]
    @="C:\\WINDOWS\\system32\\aMaamon.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{1A4E25E1-91E6-43CC-ABE4-6F8B136BA079}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{1A4E25E1-91E6-43CC-ABE4-6F8B136BA079}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{1A4E25E1-91E6-43CC-ABE4-6F8B136BA079}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{1A4E25E1-91E6-43CC-ABE4-6F8B136BA079}\InprocServer32]
    @="C:\\WINDOWS\\system32\\mIg_hook.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{43B46448-74ED-4DED-BA29-EDAD3F318DCF}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{43B46448-74ED-4DED-BA29-EDAD3F318DCF}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{43B46448-74ED-4DED-BA29-EDAD3F318DCF}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{43B46448-74ED-4DED-BA29-EDAD3F318DCF}\InprocServer32]
    @="C:\\WINDOWS\\system32\\ihmpagnt.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{A7F887AC-DF64-4802-B04D-70FC50E35230}]
    @=""
    "IDEx"="AD"

    [HKEY_CLASSES_ROOT\CLSID\{A7F887AC-DF64-4802-B04D-70FC50E35230}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A7F887AC-DF64-4802-B04D-70FC50E35230}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A7F887AC-DF64-4802-B04D-70FC50E35230}\InprocServer32]
    @="C:\\WINDOWS\\system32\\myxdm.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{514CEDD0-AA0A-4C3C-91BF-1DAE5D6C0567}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{514CEDD0-AA0A-4C3C-91BF-1DAE5D6C0567}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{514CEDD0-AA0A-4C3C-91BF-1DAE5D6C0567}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{514CEDD0-AA0A-4C3C-91BF-1DAE5D6C0567}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{E77D313E-9FEF-43CC-9DA3-46052B383727}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E77D313E-9FEF-43CC-9DA3-46052B383727}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E77D313E-9FEF-43CC-9DA3-46052B383727}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{E77D313E-9FEF-43CC-9DA3-46052B383727}\InprocServer32]
    @="C:\\WINDOWS\\system32\\ilss.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{0C40AB91-7097-4C44-B146-CC8BD5233B12}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{0C40AB91-7097-4C44-B146-CC8BD5233B12}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{0C40AB91-7097-4C44-B146-CC8BD5233B12}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{0C40AB91-7097-4C44-B146-CC8BD5233B12}\InprocServer32]
    @="C:\\WINDOWS\\system32\\guard.tmp"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{95979D90-0704-4BB9-B910-F75E6E80A47C}]
    @=""
    "IDEx"="AD"

    [HKEY_CLASSES_ROOT\CLSID\{95979D90-0704-4BB9-B910-F75E6E80A47C}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{95979D90-0704-4BB9-B910-F75E6E80A47C}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{95979D90-0704-4BB9-B910-F75E6E80A47C}\InprocServer32]
    @="C:\\WINDOWS\\system32\\umrvpa.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{8990A1FA-9F1E-477E-BE14-BCDFC4CFAD94}]
    @=""
    "IDEx"="AD"

    [HKEY_CLASSES_ROOT\CLSID\{8990A1FA-9F1E-477E-BE14-BCDFC4CFAD94}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{8990A1FA-9F1E-477E-BE14-BCDFC4CFAD94}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{8990A1FA-9F1E-477E-BE14-BCDFC4CFAD94}\InprocServer32]
    @="C:\\WINDOWS\\system32\\wgw32.dll"
    "ThreadingModel"="Apartment"

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOT\CLSID\{A1A7759C-C601-4A04-B75D-4062D7614273}]
    @=""
    "IDEx"="ADDR"

    [HKEY_CLASSES_ROOT\CLSID\{A1A7759C-C601-4A04-B75D-4062D7614273}\Implemented Categories]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A1A7759C-C601-4A04-B75D-4062D7614273}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
    @=""

    [HKEY_CLASSES_ROOT\CLSID\{A1A7759C-C601-4A04-B75D-4062D7614273}\InprocServer32]
    @="C:\\WINDOWS\\system32\\dDd8thk.dll"
    "ThreadingModel"="Apartment"

    REGEDIT4

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
    "{9F52549D-E266-4A6B-8023-96B328B5D6BE}"=-
    "{8DACAA10-1545-4302-8A77-1F0B0794F884}"=-
    "{1A4E25E1-91E6-43CC-ABE4-6F8B136BA079}"=-
    "{27C664D4-8DA4-44B7-BB5A-DA59A80C3E40}"=-
    "{43B46448-74ED-4DED-BA29-EDAD3F318DCF}"=-
    "{A7F887AC-DF64-4802-B04D-70FC50E35230}"=-
    "{514CEDD0-AA0A-4C3C-91BF-1DAE5D6C0567}"=-
    "{E77D313E-9FEF-43CC-9DA3-46052B383727}"=-
    "{0C40AB91-7097-4C44-B146-CC8BD5233B12}"=-
    "{95979D90-0704-4BB9-B910-F75E6E80A47C}"=-
    "{8990A1FA-9F1E-477E-BE14-BCDFC4CFAD94}"=-
    "{A1A7759C-C601-4A04-B75D-4062D7614273}"=-
    [-HKEY_CLASSES_ROOT\CLSID\{9F52549D-E266-4A6B-8023-96B328B5D6BE}]
    [-HKEY_CLASSES_ROOT\CLSID\{8DACAA10-1545-4302-8A77-1F0B0794F884}]
    [-HKEY_CLASSES_ROOT\CLSID\{1A4E25E1-91E6-43CC-ABE4-6F8B136BA079}]
    [-HKEY_CLASSES_ROOT\CLSID\{27C664D4-8DA4-44B7-BB5A-DA59A80C3E40}]
    [-HKEY_CLASSES_ROOT\CLSID\{43B46448-74ED-4DED-BA29-EDAD3F318DCF}]
    [-HKEY_CLASSES_ROOT\CLSID\{A7F887AC-DF64-4802-B04D-70FC50E35230}]
    [-HKEY_CLASSES_ROOT\CLSID\{514CEDD0-AA0A-4C3C-91BF-1DAE5D6C0567}]
    [-HKEY_CLASSES_ROOT\CLSID\{E77D313E-9FEF-43CC-9DA3-46052B383727}]
    [-HKEY_CLASSES_ROOT\CLSID\{0C40AB91-7097-4C44-B146-CC8BD5233B12}]
    [-HKEY_CLASSES_ROOT\CLSID\{95979D90-0704-4BB9-B910-F75E6E80A47C}]
    [-HKEY_CLASSES_ROOT\CLSID\{8990A1FA-9F1E-477E-BE14-BCDFC4CFAD94}]
    [-HKEY_CLASSES_ROOT\CLSID\{A1A7759C-C601-4A04-B75D-4062D7614273}]
    REGEDIT4

    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
    ****************************************************************************
    Desktop.ini Contents:
    ****************************************************************************

    ****************************************************************************
    Checking for L2MFix account(0=no 1=yes):
    0
    Zipping up files for submission:
    adding: dlls/dDd8thk.dll (164 bytes security) (deflated 4%)
    adding: dlls/hr4u05h9e.dll (164 bytes security) (deflated 5%)
    adding: dlls/l04q0ah5ed4.dll (164 bytes security) (deflated 5%)
    adding: dlls/mlmtapi.dll (164 bytes security) (deflated 4%)
    adding: dlls/o0pq0a75ed.dll (164 bytes security) (deflated 5%)
    adding: dlls/r6r6lg9s16.dll (164 bytes security) (deflated 5%)
    adding: dlls/slobject.dll (164 bytes security) (deflated 5%)
    adding: backregs/0C40AB91-7097-4C44-B146-CC8BD5233B12.reg (188 bytes security) (deflated 70%)
    adding: backregs/1A4E25E1-91E6-43CC-ABE4-6F8B136BA079.reg (188 bytes security) (deflated 69%)
    adding: backregs/43B46448-74ED-4DED-BA29-EDAD3F318DCF.reg (188 bytes security) (deflated 70%)
    adding: backregs/514CEDD0-AA0A-4C3C-91BF-1DAE5D6C0567.reg (188 bytes security) (deflated 70%)
    adding: backregs/8990A1FA-9F1E-477E-BE14-BCDFC4CFAD94.reg (188 bytes security) (deflated 69%)
    adding: backregs/8DACAA10-1545-4302-8A77-1F0B0794F884.reg (188 bytes security) (deflated 69%)
    adding: backregs/95979D90-0704-4BB9-B910-F75E6E80A47C.reg (188 bytes security) (deflated 69%)
    adding: backregs/9F52549D-E266-4A6B-8023-96B328B5D6BE.reg (188 bytes security) (deflated 69%)
    adding: backregs/A1A7759C-C601-4A04-B75D-4062D7614273.reg (188 bytes security) (deflated 69%)
    adding: backregs/A7F887AC-DF64-4802-B04D-70FC50E35230.reg (188 bytes security) (deflated 69%)
    adding: backregs/E77D313E-9FEF-43CC-9DA3-46052B383727.reg (188 bytes security) (deflated 70%)
    adding: backregs/notibac.reg (164 bytes security) (deflated 76%)
    adding: backregs/shell.reg (164 bytes security) (deflated 73%)
    0
  7. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Re !

    ça marche !

    maintenant : pti nettoyage en profondeur !!!

    télécharge ceux-ci ( si ce n'est pas déjà fait ! )

    Ad-Aware (gratuit) :
    http://telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/11643.html

    Le patch en Français pour Ad-Aware (gratuit) :
    http://telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/25543.html

    Spybot (gratuit) :
    http://telecharger.01net.com/windows/Internet/internet_utlitaire/fiches/26157.html

    Petite démo pour comprendre l'utilisation (merci à Ballatrap, le concepteur) :

    http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

    a-squared
    http://www.emsisoft.net/fr/software/download/

    ewido (dowload)
    http://www.ewido.net/fr/download/

    ¤Télécharger CleanUp40 (qui élimine les fichiers temporaires + cookies) sur ce lien : http://pageperso.aol.fr/Balltrap34/CleanUp40.exe

    démo : http://pageperso.aol.fr/balltrap34/democleanup.htm

    Telecharge et installe ceci, dans la colonne de gauche clique sur "erreurs" coche toute les cases, puis clique en bas sur "chercher des erreurs" une fois finit, clique sur "reparer les erreurs" et tu aura un message pour sauvegarder ta base de registre tu dis "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs

    Télécharge CCLEANER et nettoie ton PC avec : http://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

    Tutorial là : http://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

    Telecharge et installe ceci, dans la colonne de gauche clique sur "erreurs" coche toute les cases, puis clique en bas sur "chercher des erreurs" une fois finit, clique sur "reparer les erreurs" et tu aura un message pour sauvegarder ta base de registre tu dis "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs

    mets tout à jour, lance tous les scan

    ensuite :

    scan en ligne
    http://www.bitdefender.fr/bd/site/search.php#
    colle rapport entier ( s'il y a quelque chose )

    bon courage, @+

    0
  8. PaX2k5 Messages postés 23 Statut Membre
     
    Merci Beaucoup pour le mal que tu te donnes pour mon problème !

    Bon apparamment la , j'ai du boulot :P

    Je vais m'y mettre directement afin que ca soit terminé pour dans quelques heures :)

    Encore merci
    0
  9. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Re !

    contente de te preter main forte :-)

    moi je vais pas faire de vieux os : alors à demain !

    precise ou en sont tes soucis après cela

    bonne fin de soirée

    @+
    0
  10. PaX2k5 Messages postés 23 Statut Membre
     
    Me revoila :):)

    Bon , hier j'en ai eu jusque 3h du mat' avec tous les scans mais j'ai pas eu le temps de faire le scan en ligne...

    Bref , Donc tantot j'ai lancé le scan en ligne qui m'a trouvé des trojans mais tout a coup paf : blue screen de windows... donc le scan n'a pas terminé

    revenons sur VX2 : je pense qu'il a disparu :):)
    Je viens de faire un scan avec adaware et il ne le trouve pas , cependant j'ai encore un ptit truc assez menacant (degré de menace 10 sur une echelle de 1 a 10 :P )

    Je te met le screen du scan pour que tu vois un peu plus clair

    URL : >>>>> http://membres.lycos.fr/heympact77/virus.GIF <<<

    Voila , je vais essayer de régler le prob.

    Sinon j'ai une petite question :

    Lorsque tu m as demandé d'installer l2mfix.exe , pourquoi j'ai pas pu directement faire "run fix"??

    ca aurait pu faire tout planter? :P

    Merci !!
    0
  11. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Salut !

    1) Bon , hier j'en ai eu jusque 3h du mat'

    aïe !!! il fallait laisser ... lol !

    2) Je te met le screen du scan pour que tu vois un peu plus clair

    ptite question pour verifié : une fois arriver à cet ecran : tu coche bien toutes les cases pour les supprmier ???

    3) Sinon j'ai une petite question :

    Lorsque tu m as demandé d'installer l2mfix.exe , pourquoi j'ai pas pu directement faire "run fix"??

    ca aurait pu faire tout planter? :P

    non pas du tout, la première phase consistait à determiner ce qui était infecté et à que point c' étais infecté ... une sorte de repère pour nous ...

    4) 1) Désactiver la Restauration du système

    *Cliquez sur le bouton Démarrer.
    *Cliquez avec le bouton droit de la souris sur Poste de travail puis cliquez sur Propriétés.
    *Dans l'onglet Restauration du système, sélectionnez l'option Désactiver la Restauration du système ou Désactiver la Restauration du système sur tous les lecteurs

    5) scan en ligne
    http://www.bitdefender.fr/bd/site/search.php#
    colle rapport entier ( s'il y a quelque chose )

    dis nous où en sont tes soucis ?

    @+
    0
  12. PaX2k5 Messages postés 23 Statut Membre
     
    D'accord .

    Par contre pour le scan en ligne , chaque fois que j'arrive vers la fin je me prend l'écran bleu... encore un fichier suspect surement.

    ce qui est dommage c'est que ad aware me vire tout sauf un seul fichier ... surement que ce fichier régénere tous les autres donc en gros c'est un cercle vicieux..

    je devrais peut-etre essayer de faire ca en mode sans échec
    0
  13. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Re !

    ok !

    alors fais les scans avec les utilitaires en mode sans echec mais pour le scan en ligne ça va pas être possible : il y a pas accée au net

    tiens moi au courant

    @+
    0
  14. PaX2k5 Messages postés 23 Statut Membre
     
    Oki :)

    Bon , le(s) fichier(s) qu'il n'arrive pas a deleter sont :

    asappsrv.dll , j'espere que c'est pas une métastase de ce vx2 :/

    Merci encore :D
    0
  15. aranjuez31 Messages postés 8161 Date d'inscription   Statut Contributeur 354
     
    bjr
    un hijack svp
    on tourne en rond ici
    0
  16. PaX2k5 Messages postés 23 Statut Membre
     
    Bonjour , voici l'episode 3 :P

    Bon , voila un log hijackthis après un adaware .

    Logfile of HijackThis v1.99.1
    Scan saved at 18:39:42, on 8/03/2006
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    C:\WINDOWS\System32\vmnat.exe
    C:\WINDOWS\System32\vmnetdhcp.exe
    C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
    C:\WINDOWS\System32\CTHELPER.EXE
    C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
    C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
    C:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Documents and Settings\Mathieu\Bureau\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ccApp] C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
    O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Fichiers communs\Symantec Shared\ccRegVfy.exe
    O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe
    O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Fichiers communs\Symantec Shared\Security Center\UsrPrmpt.exe
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [keyboard] C:\\keyboard1.exe
    O4 - HKLM\..\Run: [gimmysmileys] C:\\gimmysmileys1.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [mousepad] C:\\mousepad1.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Windows Workstation Service] wor.exe
    O4 - HKCU\..\RunServices: [Windows Workstation Service] wor.exe
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135619855242
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{1DA6237B-47C1-4051-A8A2-1623FA51DBBC}: NameServer = 192.168.0.1
    O17 - HKLM\System\CCS\Services\Tcpip\..\{D9CD8D90-1EB8-4A13-8926-E5710E132C18}: NameServer = 195.238.2.22 195.238.2.21
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - AppInit_DLLs: MsgPlusLoader.dll
    O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\dDd8thk.dll (file missing)
    O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\lv2609fse.dll (file missing)
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TWF0dA\command.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: GhostStartService - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\GHOSTS~2.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    O23 - Service: NetDDE Server (NetDDEsrv) - Unknown owner - C:\WINDOWS\System32\netddesrv.exe (file missing)
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
    O23 - Service: NetLimiter (nlsvc) - Unknown owner - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe (file missing)
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O23 - Service: Network DRV (NTDRV) - Unknown owner - C:\WINDOWS\system32\netdrvr.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Center\SymWSC.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\System32\vmnetdhcp.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\System32\vmnat.exe
    O23 - Service: Microsoft Windows Update Service (Windows Update Service) - Unknown owner - C:\WINDOWS\services.exe (file missing)
    0
  17. aranjuez31 Messages postés 8161 Date d'inscription   Statut Contributeur 354
     
    re
    1/ version obsoléte deInternExplorer, faire màj

    2/ pas service de pack qui améliore la sécurité, c est ahurissant !

    3/ utilisation de pregrammes dangereux, voire inutiles
    on régle ce blem d abord

    déma+exécuter+tape services.msc

    dans le déroulant tu cherches successivement et désactives les prog suivants :

    - O23 - Service: Microsoft Windows Update Service (Windows Update Service) - Unknown owner - C:\WINDOWS\services.exe (file missing)
    - O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TWF0dA\command.exe
    - O23 - Service: NetDDE Server (NetDDEsrv) - Unknown owner - C:\WINDOWS\System32\netddesrv.exe (file missing)
    - O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
    - O23 - Service: NetLimiter (nlsvc) - Unknown owner - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe (file missing)
    - O23 - Service: Network DRV (NTDRV) - Unknown owner - C:\WINDOWS\system32\netdrvr.exe (file missing)

    4/ ouvre hijack
    fixe ceci
    - O23 - Service: Microsoft Windows Update Service (Windows Update Service) - Unknown owner - C:\WINDOWS\services.exe (file missing)
    - O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TWF0dA\command.exe
    - O23 - Service: NetDDE Server (NetDDEsrv) - Unknown owner - C:\WINDOWS\System32\netddesrv.exe (file missing)
    - O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
    - O23 - Service: NetLimiter (nlsvc) - Unknown owner - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe (file missing)
    - O23 - Service: Network DRV (NTDRV) - Unknown owner - C:\WINDOWS\system32\netdrvr.exe (file missing)

    5/ l'apéro m appelle
    suite vers 23 h
    le tps que j étudie le restant du log
    je vois d ailleurs d autres lignes à fixer
    patience
    -
    0
  18. PaX2k5 Messages postés 23 Statut Membre
     
    Okay :):)

    C'est vrai qu'avec hijackthis ca fait peur quand on voit les trucs qui foirent !!

    Merci pour les conseils :) et bon apéro !!
    0
  19. green day Messages postés 26374 Date d'inscription   Statut Modérateur, Contributeur sécurité Dernière intervention   2 166
     
    Bonsoir à vous !

    ==> je te laisse entre les mains d'Arenjuez !

    bon courage, @+
    0
  20. PaX2k5 Messages postés 23 Statut Membre
     
    Oki green day !

    Merci pour ton aide en tout cas !!!

    Bonne soirée

    Je dois y aller , retour demain vers 16h !
    0
  21. aranjuez31 Messages postés 8161 Date d'inscription   Statut Contributeur 354
     
    re
    on continue la chasse

    fixons aussi

    O20 - AppInit_DLLs: MsgPlusLoader.dll

    O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\dDd8thk.dll (file missing)

    O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\lv2609fse.dll (file missing)

    ttes les 016 et toujours

    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by103fd.bay103.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135619855242
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

    une merde
    O4 - HKLM\..\Run: [gimmysmileys] C:\\gimmysmileys1.exe
    =======
    bcp de choses inutiles au run pourraient être supprimées ds la vision d une optimisation, mais ......... ya du monde ds la salle d attente
    pour T clean, à moins d avoir un vice caché
    pour cela un rapport d ewido + un rapport du online de bitdef
    enfin à toi de juger ?

    0
  • 1
  • 2
  • 3

Discussions similaires

Problème colissimo suivi
Kim -
contrariness -

1 réponse
Polarsteps
goya09 -
goya09 -

2 réponses
colis prêt à être expédiée depuis 9 jours !
Bobdurochelot -
lolo3402 -

4 réponses
suivi colis La Poste
ju228 -
tanteelise -

14 réponses
Dh gate suivi de colis problème
Mims99000 -
Mims99000 -

1 réponse