[Virus] Il m'empeche d'ouvrir des pages web
Résolu
salut a tous, alors voila mon pc est infecté de virus ( suite a une désactivation du pare-feu d'xp) et j'ai fait un log via hijackthis pour éssayer de les trouver mais je ne comprends pas trop ce log.Pouvez-vous m'aider ?
Voici le log :
Logfile of HijackThis v1.99.1
Scan saved at 10:12:11, on 04/04/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\j2re1.4.2_09\bin\jusched.exe
C:\Program Files\Fichiers
communs\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\ATI Technologies\ATI Control
Panel\atiptaxx.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\System32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\update\wuauclt.exe
C:\WINDOWS\system32\winscntrl.exe
C:\WINDOWS\system32\wumd.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Documents and
Settings\franck\Bureau\hijackthis\HijackThis.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
R0 - HKCU\Software\Microsoft\Internet
Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet
Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook:
{1A03F196-9617-4CA0-842B-A83CEECB022B} - - (no
file)
O2 - BHO: (no name) -
{20D57A66-F7DF-467d-907B-9B7F4A118AB7} -
C:\WINDOWS\system32\pmnlm.dll
O3 - Toolbar: &Radio -
{8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google -
{2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avast!]
C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program
Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\j2re1.4.2_09\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program
Files\Fichiers
communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LVCOMSX]
C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program
Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [lich] lich.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program
Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI
Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Microsoft (R) Windows Update
Service] C:\WINDOWS\update\wuauclt.exe
O4 - HKLM\..\Run: [chat] winhost32.exe
O4 - HKLM\..\RunServices: [lfqmoj_[Pbnzkt]
C:\WINDOWS\System32\kruychkma.exe
O4 - HKCU\..\Run: [chat] winhost32.exe
O4 - HKCU\..\Run: [Cars] "C:\Program
Files\ptas\lras.exe" -vt yazb
O4 - Global Startup: Microsoft Office.lnk =
C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Traduire à partir
de l'anglais - res://c:\program
files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées -
res://c:\program
files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires -
res://c:\program
files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google -
res://c:\program
files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page
actuelle disponible dans le cache Google -
res://c:\program
files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program
Files\Java\j2re1.4.2_09\bin\npjpi142_09.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program
Files\Java\j2re1.4.2_09\bin\npjpi142_09.dll
O9 - Extra button: Spyware Doctor -
{2D663D1A-8670-49D9-A1A5-4C56B4E14E84} -
C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: SoftSearch -
{5D602A21-B929-11d7-A5D3-005022E14DE2} -
http://softsearch.ru (file missing)
O9 - Extra button: (no name) -
{9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -
http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine Advantage Validation Tool) -
http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B}
(Minesweeper Flags Class) -
http://messenger.zone.msn.com/binary/MineSweeper.c
ab31267.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61}
(HouseCall Control) -
http://a840.g.akamai.net/7/840/537/2005111401/hous
ecall.trendmicro.com/housecall/xscan53.cab
O17 -
HKLM\System\CCS\Services\Tcpip\..\{37F51055-C1FE-4
8AC-A4BB-3AA71C6ACD34}: NameServer = 86.64.145.142
84.103.237.142
O18 - Protocol: msnim -
{828030A1-22C1-4009-854F-8E305202313F} -
"C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs:
C:\WINDOWS\System32\wmfhotfix.dll
O20 - Winlogon Notify: pmnlm -
C:\WINDOWS\SYSTEM32\pmnlm.dll
O20 - Winlogon Notify: SharedDLLs -
C:\WINDOWS\system32\dnnu0159e.dll
O20 - Winlogon Notify: WRNotifier -
C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: avast! iAVS4 Control Service
(aswUpdSv) - Unknown owner - C:\Program
Files\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI
Technologies Inc. -
C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner -
C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner -
C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner
- C:\Program Files\Avast4\ashMaiSv.exe" /service
(file missing)
O23 - Service: avast! Web Scanner - Unknown owner
- C:\Program Files\Avast4\ashWebSv.exe" /service
(file missing)
O23 - Service: ewido security suite control -
ewido networks - C:\Program Files\ewido
anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido
networks - C:\Program Files\ewido
anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager
(IDriverT) - Macrovision Corporation - C:\Program
Files\Fichiers
communs\InstallShield\Driver\11\Intel
32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH -
C:\WINDOWS\System32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0
(experimental) (rpcapd) - Unknown owner -
%ProgramFiles%\WinPcap\rpcapd.exe" -d -f
"%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper)
- PC Tools Research Pty Ltd - C:\Program
Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine
(svcWRSSSDK) - Webroot Software, Inc. - C:\Program
Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Windows Update Manager
(UpdateManager) - Unknown owner -
C:\WINDOWS\update\updmgr.exe (file missing)
O23 - Service: Windows Update Service (UpdateSvc)
- Unknown owner - C:\WINDOWS\update\wuauclt.exe
O23 - Service: wins(WINS) (wins) - Unknown owner -
C:\WINDOWS\system32\winscntrl.exe (file missing)
O23 - Service: Windows User Mode Drivers (WUMD) -
Unknown owner - C:\WINDOWS\system32\wumd.exe (file
missing)
Voici le log :
Logfile of HijackThis v1.99.1
Scan saved at 10:12:11, on 04/04/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\j2re1.4.2_09\bin\jusched.exe
C:\Program Files\Fichiers
communs\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\ATI Technologies\ATI Control
Panel\atiptaxx.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\System32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\update\wuauclt.exe
C:\WINDOWS\system32\winscntrl.exe
C:\WINDOWS\system32\wumd.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Documents and
Settings\franck\Bureau\hijackthis\HijackThis.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
R0 - HKCU\Software\Microsoft\Internet
Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet
Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook:
{1A03F196-9617-4CA0-842B-A83CEECB022B} - - (no
file)
O2 - BHO: (no name) -
{20D57A66-F7DF-467d-907B-9B7F4A118AB7} -
C:\WINDOWS\system32\pmnlm.dll
O3 - Toolbar: &Radio -
{8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google -
{2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avast!]
C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program
Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program
Files\Java\j2re1.4.2_09\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program
Files\Fichiers
communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LVCOMSX]
C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program
Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [lich] lich.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program
Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI
Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Microsoft (R) Windows Update
Service] C:\WINDOWS\update\wuauclt.exe
O4 - HKLM\..\Run: [chat] winhost32.exe
O4 - HKLM\..\RunServices: [lfqmoj_[Pbnzkt]
C:\WINDOWS\System32\kruychkma.exe
O4 - HKCU\..\Run: [chat] winhost32.exe
O4 - HKCU\..\Run: [Cars] "C:\Program
Files\ptas\lras.exe" -vt yazb
O4 - Global Startup: Microsoft Office.lnk =
C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Traduire à partir
de l'anglais - res://c:\program
files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées -
res://c:\program
files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires -
res://c:\program
files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google -
res://c:\program
files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page
actuelle disponible dans le cache Google -
res://c:\program
files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program
Files\Java\j2re1.4.2_09\bin\npjpi142_09.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program
Files\Java\j2re1.4.2_09\bin\npjpi142_09.dll
O9 - Extra button: Spyware Doctor -
{2D663D1A-8670-49D9-A1A5-4C56B4E14E84} -
C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: SoftSearch -
{5D602A21-B929-11d7-A5D3-005022E14DE2} -
http://softsearch.ru (file missing)
O9 - Extra button: (no name) -
{9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94}
(PCPitstop Utility) -
http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700}
(Windows Genuine Advantage Validation Tool) -
http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B}
(Minesweeper Flags Class) -
http://messenger.zone.msn.com/binary/MineSweeper.c
ab31267.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61}
(HouseCall Control) -
http://a840.g.akamai.net/7/840/537/2005111401/hous
ecall.trendmicro.com/housecall/xscan53.cab
O17 -
HKLM\System\CCS\Services\Tcpip\..\{37F51055-C1FE-4
8AC-A4BB-3AA71C6ACD34}: NameServer = 86.64.145.142
84.103.237.142
O18 - Protocol: msnim -
{828030A1-22C1-4009-854F-8E305202313F} -
"C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs:
C:\WINDOWS\System32\wmfhotfix.dll
O20 - Winlogon Notify: pmnlm -
C:\WINDOWS\SYSTEM32\pmnlm.dll
O20 - Winlogon Notify: SharedDLLs -
C:\WINDOWS\system32\dnnu0159e.dll
O20 - Winlogon Notify: WRNotifier -
C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: avast! iAVS4 Control Service
(aswUpdSv) - Unknown owner - C:\Program
Files\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI
Technologies Inc. -
C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner -
C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner -
C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner
- C:\Program Files\Avast4\ashMaiSv.exe" /service
(file missing)
O23 - Service: avast! Web Scanner - Unknown owner
- C:\Program Files\Avast4\ashWebSv.exe" /service
(file missing)
O23 - Service: ewido security suite control -
ewido networks - C:\Program Files\ewido
anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido
networks - C:\Program Files\ewido
anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager
(IDriverT) - Macrovision Corporation - C:\Program
Files\Fichiers
communs\InstallShield\Driver\11\Intel
32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH -
C:\WINDOWS\System32\oodag.exe
O23 - Service: Remote Packet Capture Protocol v.0
(experimental) (rpcapd) - Unknown owner -
%ProgramFiles%\WinPcap\rpcapd.exe" -d -f
"%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper)
- PC Tools Research Pty Ltd - C:\Program
Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine
(svcWRSSSDK) - Webroot Software, Inc. - C:\Program
Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Windows Update Manager
(UpdateManager) - Unknown owner -
C:\WINDOWS\update\updmgr.exe (file missing)
O23 - Service: Windows Update Service (UpdateSvc)
- Unknown owner - C:\WINDOWS\update\wuauclt.exe
O23 - Service: wins(WINS) (wins) - Unknown owner -
C:\WINDOWS\system32\winscntrl.exe (file missing)
O23 - Service: Windows User Mode Drivers (WUMD) -
Unknown owner - C:\WINDOWS\system32\wumd.exe (file
missing)
27 réponses
Résumé de la discussion
Un utilisateur signale une infection sous Windows XP après la désactivation du pare-feu et joint un log HijackThis détaillant de nombreuses entrées et processus potentiellement malveillants. Les éléments suspects apparaissent dans les sections Run, HKLM et O4, avec des modules et services inconnus ou obsolètes, tels que MessengerPlus, RealUpdate et divers processus vidéo ou sécurité. Les conseils de nettoyage recommandent de supprimer les applications indésirables, de désactiver certains services et d’effectuer des scans externes via SmitfraudFix, Ewido et un antivirus en ligne. En plus, il est utile de vérifier les entrées O16 et les scripts de mise à jour, et de sauvegarder les données critiques avant toute opération pour prévenir une réinfection et sécuriser le système.
-
Contributeurhasta luego , amigo
-
Non aucune question mais un GRAND merci de t'etre décarcassé pour moi , ça fait plaisir de voir des gens serviables sur les forums
Encore merci et @+ -
Contributeurbjr
je ne vois pas de logiciels malicieux
O&O Defrag Professional Edition - celui-ci fait double emploi avec le défragmenteur de Windows - à toi de voir si tu veux faire de la place sur ton ordi en le désinstallant
il m'arrive qques fois de ne pas pouvoir faire le scan online
j 'essaie à un autre moment
et cela fonctionne
d autres questions ?
-
Ad-Aware SE Personal
Adobe Download Manager 2.0 (Supprimer uniquement)
Adobe Reader 7.0.5 - Français
Archiveur WinRAR
ASIO4ALL v2
AT&T Labs' Natural Voices - Juliette 16k 1.4 (Desktop)
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
ATT Natural Voices 1_4 Engine and Crystal16
ATT Natural Voices version 1_4 Mike16
Audacity 1.2.4
CleanUp!
dBpowerAMP AAC (AACEnc CLI)
dBpowerAMP Music Converter
dBpowerAMP WMA V9.1 Codec
Digital Camera Driver
DivX
DivX Player
eEye Digital Security JScript Patch
ewido anti-malware
Final Fantasy VII
Final Fantasy VII XP Patch
FL Studio 5
FlashFXP v3
Google Toolbar for Internet Explorer
HijackThis 1.99.1
Hitman Pro
HLSW v1.0.0.47
ID3-TagIT 3
Java 2 Runtime Environment, SE v1.4.2_09
Kit de connexion ADSL
L&H TTS3000 Français
Lecteur Windows Media 10
LGP Details Property Sheet
Little Fighter 2 v1.9
Logitech Print Service
Logitech QuickCam
Macromedia Flash Player 8
MAGIX music maker 6ème génération
MAIET Gunz
Maya44 USB ASIO driver
MEDA MP3 Splitter 2.5
MediaTickets by OIN
Messenger Plus! 3
Microsoft .NET Framework 1.1
Microsoft Reader
Microsoft Reader Text-to-Speech pour le français
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft Word 2002
mIRC
MSN Messenger 7.5
Nero 6 Ultra Edition
Nvu 1.0
O&O Defrag Professional Edition
oggcodecs 0.69.8924
PhotoFiltre
Pocket Killbox 2.0.0.175
Programme de gestion Camera de Logitech®
QuickTime
RealPlayer
Realtek AC'97 Audio
SHOUTcast DNAS (remove only)
SHOUTcast Source DSP 1.9.0 (remove only)
Skype 2.0
SoulSeek Client 156c
Spy Sweeper
Spybot - Search & Destroy 1.4
Spyware Doctor 3.5
SpywareBlaster v3.5.1
Steam(TM)
StuffPlug-NG (Messenger Plus! Plugins)
Sunbelt Kerio Personal Firewall
TeamSpeak 2 RC2
TextAloud MP3
VideoLAN VLC media player 0.8.4a
Virtual DJ - Atomix Productions
Winamp (remove only)
Windows Media Format Runtime
WinPcap 3.1
XBC 5.1
YAMAHA SoftSynthesizer S-YXG70 -
Contributeurbsr
bizarre
arrives-tu à scanner avec ton antivir ?
montre moi tes progr
HijackThis -> Open the misc tools sections -> open Uninstall manager -> clique sur "Save list" -> enregistre le fichier -> fais-en un copier/coller ici.
-
Je n'arrive plus a lancer n'importe quel scan online, car le lien permettant de le lancer ne se lance pas , et j'ai remarqué en bas a gauche de la fenetre de internet explorer il y'a un petit triangle jaune avec écrit "erreur sur la page" et quand je clique 2 fois dessus, ya un message indiquant ceci:
Ligne: 209
Car: 1
Erreur : Objet Attendu
Code: 0
URL : Http://www.bitdefender.fr/scan/license.hp
Donc je ne sais pas si j'ai "déréglé" quelque chose mais je n'arrive pas a utiliser un antivirus online, donc je te met que le rapport de EWIDO
---------------------------------------------------------
ewido anti-malware - Rapport de scan
---------------------------------------------------------
+ Créé le: 10:03:53, 06/04/2006
+ Somme de contrôle: 109AB27A
+ Résultats du scan:
Pas de fichiers infectés trouvés!
::Fin du rapport -
Contributeurre
un truc encore à propos ligne
O23 - Service: Windows Update Service (UpdateSvc) - Unknown owner - C:\WINDOWS\update\wuauclt.exe (file missing)
touche windows+r
tape services.msc & OK
recherche dans le déroulant
- Windows Update Service (UpdateSvc)
et désactive ce programme
================
pour optimiser fixons qques autres lignes , via hijack :
si encore apparente
O23 - Service: Windows Update Service (UpdateSvc) - Unknown owner - C:\WINDOWS\update\wuauclt.exe (file missing)
+
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
+
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
=====
je ne vois plus de code malicieux , sauf erreur de ma part
===========
vérifions tout de même
1/ scan et rapport de Ewido
2/ scan online de bit defender et rapport
===========
précise tes blems encore en cours
======
verifie ds la barre des tâches que kerio (par un clic droit sur l' icône ) soit actif
-
Logfile of HijackThis v1.99.1
Scan saved at 20:40:53, on 05/04/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\franck\Bureau\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: {1A03F196-9617-4CA0-842B-A83CEECB022B} - - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - Global Startup: eEye JScript Patch Checker.lnk = C:\Program Files\eEye Digital Security\Jscript Patch\jscriptpatchchecker.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_09\bin\npjpi142_09.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_09\bin\npjpi142_09.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: SoftSearch - {5D602A21-B929-11d7-A5D3-005022E14DE2} - http://softsearch.ru (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O17 - HKLM\System\CCS\Services\Tcpip\..\{37F51055-C1FE-48AC-A4BB-3AA71C6ACD34}: NameServer = 80.118.192.112 80.118.196.42
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Windows Update Service (UpdateSvc) - Unknown owner - C:\WINDOWS\update\wuauclt.exe (file missing) -
Contributeurre
bon ,on va ce dont je ne trouve aucune légitimité
cela a trait à ces 2 lignes :
O4 - HKLM\..\RunServices: [lfqmoj_[Pbnzkt] C:\WINDOWS\System32\kruychkma.exe
O4 - HKCU\..\Run: [Cars] "C:\Program Files\ptas\lras.exe" -vt yazb
======
1/ déconnecte toi du net
2/ mets toi en mode sans échec
3/ fais apparaître dossiers cachés de cette façon
Clic sur Démarrer/Panneau de Configuration/Options des dossiers/Affichage :
Coche Afficher les dossiers cachés
Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
Décoche "Masquer les extensions dont le type est connu"
Puis fais «OK» pour valider les changements.
Et appliquer
4/ va dans ajout/suppr
recherche progr "Cars" ou "ptas"
desinstalle si tu trouves
5/ouvre hijack
fixe les 2 threads :
O4 - HKLM\..\RunServices: [lfqmoj_[Pbnzkt] C:\WINDOWS\System32\kruychkma.exe
O4 - HKCU\..\Run: [Cars] "C:\Program Files\ptas\lras.exe" -vt yazb
6/ déma+poste de travail+HDD(C)
va dans
C:\Program Files\ptas\lras.exe" -vt yazb
recherche et supprime
- lras.exe
va dans
C:\WINDOWS\System32\kruychkma.exe
recherche et supprime
- kruychkma.exe
si tu ne trouves pas :
déma+"rechercher" tour à tour
- lras.exe
- kruychkma.exe
que tu dois supprimer
7/ important
- faire fonctionner cleanup40
- scan avec Ewido, détruire tt ce qu il trouve
- vider poubelle
8/ne pas oublier de refaire le chemin de 3/ en sens inverse pour remasquer les dossiers cachés
9/ redémarre en mode normal
10/ remets un nouveau hijack
-
non , je ne me souviens pas avoir téléchargé un des ceux 2 logiciels...
-
non , je ne me souviens pas avoir téléchargé un des ceux 2 logiciels...
-
Contributeurre
ouvre ton hijack
fixe lignes suivantes :
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
+
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
+
ya encore 2 lignes que je dois vérifier car inconnues
as-tu un log nommé "cars" ou "ptas" que tu aurais téléchargé ?
-
Contributeurhello
c est ce qu il me semblait
insuffisant
celui de wind n est qu un joujou
donc au boulot
tu vas en mettre un vrai
ensuite tu désactivera le p-f wind
telech kerio gratos
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
lis son tuto
https://kerio.probb.fr/
-
ben je ne sais pas si c'est un pare-feu mais j'utilisais la protection résidente de AVAST! et le pare-feu de windows xp
-
Contributeurre
=====
le copié/collé suivant est la fin de l option 1
R‚pertoire de C:\WINDOWS\System32
04/04/2006 19:24 235ÿ642 apferror.dll
04/04/2006 19:24 236ÿ205 fp6q03j5e.dll
04/04/2006 15:03 <REP> dllcache
02/04/2006 18:46 <REP> Microsoft
08/02/2006 13:27 13ÿ560 KGyGaAvL.sys
3 fichier(s) 485ÿ407 octets
2 R‚p(s) 17ÿ223ÿ020ÿ544 octets libres
c est la partie qui "parle" pour moi
=================
donc c est l équivalent de l option 2 qu il me faut
ah non , pas la peine je vois que cela a fonctionné sur le rapport hijack
========
ouvre donc hijack et fixe
O20 - Winlogon Notify: Control Panel - C:\WINDOWS\system32\en82l1lo1.dll (file missing)
O20 - Winlogon Notify: pmnlm - pmnlm.dll (file missing)
O20 - Winlogon Notify: Uninstall - C:\WINDOWS\system32\mcdxmlc.dll (file missing)
=========
sorry mais je ne vois plus l écran
dodo pour ma pomme
je regarderai en détail au tideuj
======
ah question demeurée sans réponse
e ne vois pas ton pare-feu
quel est -il ???
============= -
Mince j'avait pas vu que le log était aussi long, je te le remet mais en supprimant toutes les Killing PID 780 'winlogon.exe' inutiles (y'en avait plein !)
------------------------------------------------------------------------
L2mfix 032106
Creating Account.
La commande s'est termin‚e correctement.
Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful
Running From:
C:\WINDOWS\system32
Killing Processes!
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 676 'smss.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 780 'winlogon.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1656 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Error, Cannot find a process with an image name of rundll32.exe
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrateurs ... successful
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
Restoring Windows Update Certificates.:
The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Control Panel]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\en82l1lo1.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnlm]
"Asynchronous"=dword:00000001
"DllName"="pmnlm.dll"
"Impersonate"=dword:00000000
"Logon"="Logon"
"Logoff"="Logoff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Uninstall]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\mcdxmlc.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"
The following are the files found:
****************************************************************************
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
****************************************************************************
Desktop.ini Contents:
****************************************************************************
****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
adding: dlls/fp6q03j5e.dll (164 bytes security) (deflated 5%)
adding: dlls/mcdxmlc.dll (164 bytes security) (deflated 5%)
adding: backregs/F81A20FF-832E-4F59-B23B-C2174207CC6E.reg (212 bytes security) (deflated 70%)
adding: backregs/notibac.reg (164 bytes security) (deflated 88%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)
----------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 21:35:27, on 04/04/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\franck\Bureau\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: {1A03F196-9617-4CA0-842B-A83CEECB022B} - - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [lfqmoj_[Pbnzkt] C:\WINDOWS\System32\kruychkma.exe
O4 - HKCU\..\Run: [Cars] "C:\Program Files\ptas\lras.exe" -vt yazb
O4 - Global Startup: eEye JScript Patch Checker.lnk = C:\Program Files\eEye Digital Security\Jscript Patch\jscriptpatchchecker.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_09\bin\npjpi142_09.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_09\bin\npjpi142_09.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: SoftSearch - {5D602A21-B929-11d7-A5D3-005022E14DE2} - http://softsearch.ru (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{37F51055-C1FE-48AC-A4BB-3AA71C6ACD34}: NameServer = 80.118.192.112 80.118.196.42
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: C:\WINDOWS\System32\wmfhotfix.dll
O20 - Winlogon Notify: Control Panel - C:\WINDOWS\system32\en82l1lo1.dll (file missing)
O20 - Winlogon Notify: pmnlm - pmnlm.dll (file missing)
O20 - Winlogon Notify: Uninstall - C:\WINDOWS\system32\mcdxmlc.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Windows Update Service (UpdateSvc) - Unknown owner - C:\WINDOWS\update\wuauclt.exe (file missing) -
L2mfix 032106
Creating Account.
La commande s'est termin‚e correctement.
Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful
Running From:
C:\WINDOWS\system32
Killing Processes!
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 676 'smss.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'winlogon.exe'
Killing PID 780 'w -
Contributeuryoupi
ya une saloperie
donc fais la suite
5. Fermes toutes tes fenêtres windows
6. Relances l2mfix.bat et sélectionne l'option #2
7. l'ordi va redémarrer automatiquement sinon le faire manuellement
8. Recopie le log et colle-le à nouveau sur forum
9. Remets un rapport hijack
=========
ouf , ai mérité un 2ém apéro -
voila j'ai fait tout ce que tu m'a dit a part quelques exceptions que je doit te communiquer:
-je n'ai pas trouvé dans hijackthis :O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
-je n'ai pas réussi a supprimer C:\WINDOWS\system32\mcdxmlc.dll car windows me dit qu'il est utilisé
-Je n'ai pas trouvé les fichiers: Winhost32.exe et lich.exe sur mon pc
-Les 4 programmes :-O&O Defrag - O&O Software GmbH,wins(WINS) (wins),Windows Update Manager (UpdateManager),Windows User Mode Drivers (WUMD) étaient déjà désactivé mais j'ai modifié le démarrage de service ( auto,manu et désactivé) j'ai choisi Désactivé.
Voici le log de l2mfix:
L2MFIX find log 032106
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
"DLLName"="Ati2evxx.dll"
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000001
"Lock"="AtiLockEvent"
"Logoff"="AtiLogoffEvent"
"Logon"="AtiLogonEvent"
"Disconnect"="AtiDisConnectEvent"
"Reconnect"="AtiReConnectEvent"
"Safe"=dword:00000000
"Shutdown"="AtiShutdownEvent"
"StartScreenSaver"="AtiStartScreenSaverEvent"
"StartShell"="AtiStartShellEvent"
"Startup"="AtiStartupEvent"
"StopScreenSaver"="AtiStopScreenSaverEvent"
"Unlock"="AtiUnLockEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Control Panel]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\en82l1lo1.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnlm]
"Asynchronous"=dword:00000001
"DllName"="pmnlm.dll"
"Impersonate"=dword:00000000
"Logon"="Logon"
"Logoff"="Logoff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Uninstall]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\mcdxmlc.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WRNotifier]
"Asynchronous"=dword:00000000
"DllName"="WRLogonNTF.dll"
"Impersonate"=dword:00000001
"Lock"="WRLock"
"StartScreenSaver"="WRStartScreenSaver"
"StartShell"="WRStartShell"
"Startup"="WRStartup"
"StopScreenSaver"="WRStopScreenSaver"
"Unlock"="WRUnlock"
"Shutdown"="WRShutdown"
"Logoff"="WRLogoff"
"Logon"="WRLogon"
**********************************************************************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{80699D1C-9FD0-DCE9-8977-C667589C04EA}"=""
**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Extension de la page de propri‚t‚s de mise … jour automatique"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
"{32683183-48a0-441b-a342-7c2a440a9478}"="Media Band"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
"{E0E11A09-5CB8-4B6C-8332-E00720A168F2}"="Analyseur de la barre d'adresses"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{472083B0-C522-11CF-8763-00608CC02F24}"="avast"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player"
"{FED7043D-346A-414D-ACD7-550D052499A7}"="dBpowerAMP Music Converter 1"
"{2C49B5D0-ACE7-4D17-9DF0-A254A6C5A0C5}"="dBpowerAMP Music Converter"
"{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}"="Mes photos Logitech"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"MP3-Info extension"="{448f4a40-2602-11d1-b4c0-080000051171}"
"{BA9E2365-8724-47B7-AEC3-137D7C212AB9}"=""
"{F81A20FF-832E-4F59-B23B-C2174207CC6E}"=""
**********************************************************************************
HKEY ROOT CLASSIDS:
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\CLSID\{F81A20FF-832E-4F59-B23B-C2174207CC6E}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F81A20FF-832E-4F59-B23B-C2174207CC6E}\Implemented Categories]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F81A20FF-832E-4F59-B23B-C2174207CC6E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\CLSID\{F81A20FF-832E-4F59-B23B-C2174207CC6E}\InprocServer32]
@="C:\\WINDOWS\\system32\\apferror.dll"
"ThreadingModel"="Apartment"
**********************************************************************************
Files Found are not all bad files:
C:\WINDOWS\SYSTEM32\
apferror.dll Tue 4 Apr 2006 19:24:48 ..S.R 235 642 230,12 K
ati2cqag.dll Wed 22 Feb 2006 5:04:50 A.... 258 048 252,00 K
ati2dvag.dll Wed 22 Feb 2006 5:46:48 A.... 256 512 250,50 K
ati2edxx.dll Wed 22 Feb 2006 5:40:42 A.... 40 960 40,00 K
ati2evxx.dll Wed 22 Feb 2006 5:40:30 A.... 61 440 60,00 K
ati3duag.dll Wed 22 Feb 2006 5:30:46 A.... 2 636 672 2,51 M
atiddc.dll Wed 22 Feb 2006 5:38:50 A.... 53 248 52,00 K
atidemgr.dll Wed 22 Feb 2006 4:21:36 A.... 282 624 276,00 K
atiiiexx.dll Wed 22 Feb 2006 5:20:06 A.... 307 200 300,00 K
atikvmag.dll Wed 22 Feb 2006 5:11:02 A.... 151 552 148,00 K
atioglx1.dll Wed 22 Feb 2006 5:27:14 A.... 6 684 672 6,38 M
atioglxx.dll Wed 22 Feb 2006 5:11:14 A.... 5 124 096 4,89 M
atipdlxx.dll Wed 22 Feb 2006 5:41:10 A.... 114 688 112,00 K
atitvo32.dll Wed 22 Feb 2006 5:10:22 A.... 17 408 17,00 K
ativvaxx.dll Wed 22 Feb 2006 5:24:30 A.... 860 480 840,31 K
fp6q03~1.dll Tue 4 Apr 2006 19:24:48 ..S.R 236 205 230,67 K
mcdxmlc.dll Tue 4 Apr 2006 11:51:58 ..... 235 642 230,12 K
oemdspif.dll Wed 22 Feb 2006 5:40:56 A.... 77 824 76,00 K
wbhelp2.dll Sat 14 Jan 2006 14:36:58 A.... 50 688 49,50 K
19 items found: 19 files (2 H/S), 0 directories.
Total of file sizes: 17 685 601 bytes 16,86 M
Locate .tmp files:
No matches found.
**********************************************************************************
Directory Listing of system files:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est C0C2-2091
R‚pertoire de C:\WINDOWS\System32
04/04/2006 19:24 235ÿ642 apferror.dll
04/04/2006 19:24 236ÿ205 fp6q03j5e.dll
04/04/2006 15:03 <REP> dllcache
02/04/2006 18:46 <REP> Microsoft
08/02/2006 13:27 13ÿ560 KGyGaAvL.sys
3 fichier(s) 485ÿ407 octets
2 R‚p(s) 17ÿ223ÿ020ÿ544 octets libres -
Contributeurre
ai des doutes sur les 020
donc fais ceci
Installer L2mfix là (nettoie ligne O20 de Hijackthis)
http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe
http://users.skynet.be/BernieClub/tools.html
1. extraire le fichier sur le bureau
2. désactiver l'antivirus (car process est détecté faussement comme virus malware par certains antivirus)
3. lancer l2mfix.bat et sélectionner l'option #1 et faire Enter pour faire apparaître le log (cela prend qqs minutes)
4. Copie le log et colle sur forum
=====
attendre que j ai lu avant de continuer
car peut-être inutile
===============
5. Fermes toutes tes fenêtres windows
6. Relances l2mfix.bat et sélectionne l'option #2
7. l'ordi va redémarrer automatiquement sinon le faire manuellement
8. Recopie le log et colle-le à nouveau sur forum
9. Remets un rapport hijack
=========
ouf , ai mérité l'apéro !!
- 1
- 2
Suivant
