[XP] Fenetre MS DOS 16bits indesirable Résolu

Question

Salut

Voila mon probleme.

Depuis une semaine une fenetre s'affiche :
- une avec ecran noir c:\Windows\temp\h91746.exe
- une autre m'indiquant une erreur :
Sous Systeme MS DOS 16 Bits
c:\Windows\temp\h91746.exe
Le processeur NTVDM a rencontré une instuction non autorisée.
CS:0f2f IP:01d4 OP:63 68 65 2f 31 Choississez "fermer" pour mettre fin a l'application.
2 choix possible : Fermer ou ignorer

De plus des fenetres publicitaires "s'approprient" mon ecran.

J'ai fais plusieurs recherche de virus avec Norton , A2 , Ad Aware, Spybot. Cela me detecte plein de fichiers malveillants mais la fenetre revient a chaque fois.

Le fichier "h91746.exe" ne peut pas etre supprimé en Mode normal , je l'ai donc supprimé en mode sans echec mais il est revenu.
Si quelqu'un as une idée , merci ! :)

Suite au message de Michel LATOUFFE, j'ai deplacé mon post au bon endroit .
je fais les tests et je collerai les résultats. :)

bernie61 · Answer

helloapplique smitfrauFixhttp://users.skynet.be/BernieClub/index.html#frauet passes ensuite Ewido antitrojana+

Onizuka63 · Answer

Me voila !Donc voici les resultats des tests:Ewido: ewido anti-malware - Rapport de scan--------------------------------------------------------- + Créé le:		 11:26  -=On!ZùK@=-, 15/04/2006 + Somme de contrôle:	E936F1F4 + Résultats du scan:	HKLM\SOFTWARE\PVM -> Adware.Hotsurprise : Nettoyer et sauvegarder	HKU\S-1-5-21-861567501-688789844-725345543-1003\Software\PVM -> Adware.Hotsurprise : Nettoyer et sauvegarder	[932] C:\WINDOWS\system32\winbug32.dll -> Trojan.Agent.qt : Nettoyer et sauvegarder	[1676] C:\WINDOWS\ICROSO~1.NET\winspool.exe -> Downloader.PurityScan.w : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@247realmedia[1].txt -> TrackingCookie.247realmedia : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@advertising[1].txt -> TrackingCookie.Advertising : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@aolfr.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@c.goclick[2].txt -> TrackingCookie.Goclick : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@install.bestoffersnetworks[2].txt -> TrackingCookie.Bestoffersnetworks : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@msninvite.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@paypopup[1].txt -> TrackingCookie.Paypopup : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@weborama[2].txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@wreport.weborama[2].txt -> TrackingCookie.Weborama : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@www.popuptraffic[2].txt -> TrackingCookie.Popuptraffic : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@yadro[2].txt -> TrackingCookie.Yadro : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Cookies\onizuka63@zedo[1].txt -> TrackingCookie.Zedo : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Local Settings\Temporary Internet Files\Content.IE5\3FDMVUGT\srvunh[1].exe -> Trojan.Dialer.oy : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Local Settings\Temporary Internet Files\Content.IE5\6EV3LOR3dgUS2404[1].exe -> Downloader.Small.ayl : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Local Settings\Temporary Internet Files\Content.IE5\96IMVU6T\srvdnh[1].exe -> Trojan.Dialer.oy : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Local Settings\Temporary Internet Files\Content.IE5\WR4NUJ8L\srvdum[1].exe -> Trojan.Dialer.oy : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Local Settings\Temporary Internet Files\Content.IE5\WR4NUJ8L\srvrbz[1].exe -> Trojan.Dialer.oy : Nettoyer et sauvegarder	C:\Documents and Settings\Onizuka63\Local Settings\Temporary Internet Files\Content.IE5\WR4NUJ8L\srvwpl[1].exe -> Trojan.Dialer.oy : Nettoyer et sauvegarder	C:\Program Files\&#1040;ppPatch
&#959;tepad.exe -> Adware.PurityScan : Nettoyer et sauvegarder	C:\WINDOWS\system32\dfrgsrv.exe -> Trojan.Small : Nettoyer et sauvegarder	C:\WINDOWS\system32\winbug32.dll -> Trojan.Agent.qt : Nettoyer et sauvegarder	C:\WINDOWS\Temp\agbpnbmd.exe -> Trojan.Dialer.ay : Nettoyer et sauvegarder	C:\WINDOWS\Temp\aomelnnd.exe -> Trojan.Dialer.ay : Nettoyer et sauvegarder	C:\WINDOWS\Temp\cbjfohnd.exe -> Trojan.Dialer.ay : Nettoyer et sauvegarder	C:\WINDOWS\Temp\cgfakind.exe -> Trojan.Dialer.ay : Nettoyer et sauvegarder	C:\WINDOWS\Temp\efboeknd.exe -> Trojan.Dialer.ay : Nettoyer et sauvegarder	C:\WINDOWS\Temp\ffjbdamd.exe -> Trojan.Dialer.ay : Nettoyer et sauvegarder	C:\WINDOWS\Temp\hilkhfnd.exe -> Trojan.Dialer.ay : Nettoyer et sauvegarder	C:\WINDOWS\Temp\ifmkmmnd.exe -> Trojan.Dialer.ay : Nettoyer et sauvegarder	C:\WINDOWS\Temp\kbbjjcmd.exe -> Trojan.Dialer.ay : Nettoyer et sauvegarder	C:\WINDOWS\Temp\lciialnd.exe -> Trojan.Dialer.ay : Nettoyer et sauvegarder	C:\WINDOWS\Temp\mbehhpnd.exe -> Trojan.Dialer.ay : Nettoyer et sauvegarder	C:\WINDOWS\Temp
naecgnd.exe -> Trojan.Dialer.ay : Nettoyer et sauvegarder	C:\WINDOWS\Temp\win15.tmp.exe -> Trojan.Dialer.oy : Nettoyer et sauvegarder	C:\WINDOWS\Temp\win2B.tmp.exe -> Trojan.Dialer.oy : Nettoyer et sauvegarder	C:\WINDOWS\Temp\win4.tmp.exe -> Trojan.Dialer.oy : Nettoyer et sauvegarder	C:\WINDOWS\Temp\winB.tmp.exe -> Trojan.Dialer.oy : Nettoyer et sauvegarder	C:\WINDOWS\&#1052;icrosoft.NET\winspool.exe -> Downloader.PurityScan.w : Nettoyer et sauvegarder::Fin du rapportBitDefender:  BitDefender Online Scanner  Scan report generated at: Sat, Apr 15, 2006 - 13:11:56 Scan path: A:\;C:\;E:\;F:\;  Statistics Time 01:37:09 Files 552928 Folders 3319 Boot Sectors 2 Archives 26409 Packed Files 44049      Results Identified Viruses  15 Infected Files  105 Suspect Files  0 Warnings 0 Disinfected 0 Deleted Files 150      Engines Info Virus Definitions 369945 Engine build AVCORE v1.0 (build 2292) (i386) (Mar 3 2005 11:57:29) Scan plugins 13 Archive plugins 39 Unpack plugins 4 E-mail plugins 6 System plugins 1      Scan Settings First Action Disinfect Second Action Delete Heuristics Yes Enable Warnings Yes Scanned Extensions *; Exclude Extensions   Scan Emails Yes Scan Archives Yes Scan Packed Yes Scan Files Yes Scan Boot Yes        Scanned File  Status C:\Documents and Settings\Onizuka63\Local Settings\Temp\svshost.exe Infected with: Trojan.Dropper.Vb.KK C:\Documents and Settings\Onizuka63\Local Settings\Temp\svshost.exe Disinfection failed C:\Documents and Settings\Onizuka63\Local Settings\Temp\svshost.exe Deleted C:\Documents and Settings\Onizuka63\Local Settings\Temporary Internet Files\Content.IE5\1DL2FJTY\support[1].htm Infected with: Exploit.Html.Codebase.Exec.Gen C:\Documents and Settings\Onizuka63\Local Settings\Temporary Internet Files\Content.IE5\1DL2FJTY\support[1].htm Disinfection failed C:\Documents and Settings\Onizuka63\Local Settings\Temporary Internet Files\Content.IE5\1DL2FJTY\support[1].htm Deleted C:\Documents and Settings\Onizuka63\Local Settings\Temporary Internet Files\Content.IE5\6EV3LOR3\srvxvc[1].exe Infected with: Trojan.Dialer.OY C:\Documents and Settings\Onizuka63\Local Settings\Temporary Internet Files\Content.IE5\6EV3LOR3\srvxvc[1].exe Disinfection failed C:\Documents and Settings\Onizuka63\Local Settings\Temporary Internet Files\Content.IE5\6EV3LOR3\srvxvc[1].exe Deleted C:\Program Files\Norton AntiVirus\Quarantine\0585312A.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\0585312A.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\0585312A.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\058C5611.exe=>(Quarantine-2) Infected with: Trojan.Dropper.Insta.A C:\Program Files\Norton AntiVirus\Quarantine\058C5611.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\058C5611.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\1DD56908.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\1DD56908.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\1DD56908.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\218C1612.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\218C1612.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\218C1612.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\2190400E.exe=>(Quarantine-2) Infected with: Trojan.Dialer.LO C:\Program Files\Norton AntiVirus\Quarantine\2190400E.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\2190400E.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\23D91784.exe=>(Quarantine-2) Infected with: Trojan.PurityScan.AT C:\Program Files\Norton AntiVirus\Quarantine\23D91784.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\23D91784.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\23DD4180.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\23DD4180.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\23DD4180.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\23E06B7C.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\23E06B7C.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\23E06B7C.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\27070DB0.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\27070DB0.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\27070DB0.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\298424FE.exe=>(Quarantine-2) Infected with: Trojan.Dialer.LO C:\Program Files\Norton AntiVirus\Quarantine\298424FE.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\298424FE.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\2B3F1CA0.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\2B3F1CA0.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\2B3F1CA0.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\2BD31C74.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\2BD31C74.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\2BD31C74.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\2C6920E1.exe=>(Quarantine-2) Infected with: Trojan.Downloader.Small.ON C:\Program Files\Norton AntiVirus\Quarantine\2C6920E1.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\2C6920E1.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\397811CA.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\397811CA.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\397811CA.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\4505492F.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\4505492F.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\4505492F.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\45A0065B.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\45A0065B.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\45A0065B.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\460F2EE6.exe=>(Quarantine-2) Infected with: Trojan.Downloader.FLQ C:\Program Files\Norton AntiVirus\Quarantine\460F2EE6.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\460F2EE6.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\47B95457.exe=>(Quarantine-2) Infected with: Trojan.Downloader.Small.ON C:\Program Files\Norton AntiVirus\Quarantine\47B95457.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\47B95457.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\4E3D73C0.exe=>(Quarantine-2) Infected with: Trojan.Downloader.Small.ON C:\Program Files\Norton AntiVirus\Quarantine\4E3D73C0.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\4E3D73C0.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\4F521D07.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\4F521D07.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\4F521D07.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\6275666E.tmp=>(Quarantine-2) Infected with: Trojan.Dropper.Insta.A C:\Program Files\Norton AntiVirus\Quarantine\6275666E.tmp=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\6275666E.tmp=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\639D4708.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\639D4708.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\639D4708.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\63BC46FF.exe=>(Quarantine-2) Infected with: Trojan.Downloader.Purityscan.BT C:\Program Files\Norton AntiVirus\Quarantine\63BC46FF.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\63BC46FF.exe=>(Quarantine-2) Deleted C:\Program Files\Norton AntiVirus\Quarantine\65933FAA.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\Program Files\Norton AntiVirus\Quarantine\65933FAA.exe=>(Quarantine-2) Disinfection failed C:\Program Files\Norton AntiVirus\Quarantine\65933FAA.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP141\A0047083.exe Infected with: Trojan.Downloader.Small.AYL C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP141\A0047083.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP141\A0047136.exe Infected with: Trojan.Downloader.Small.AYL C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP141\A0047136.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP142\A0047357.exe Infected with: Trojan.Downloader.Purityscan.W C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP142\A0047357.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP142\A0047357.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP142\A0047369.exe Infected with: Trojan.Downloader.Small.AYL C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP142\A0047369.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047535.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047535.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047535.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047536.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047536.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047536.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047537.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047537.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047537.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047538.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047538.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047538.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047539.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047539.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047539.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047540.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047540.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047540.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047541.exe Infected with: Trojan.Downloader.Small.AYL C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047541.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047545.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047545.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047545.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047546.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047546.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP143\A0047546.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP144\A0047668.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP144\A0047668.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP144\A0047668.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP144\A0047669.exe Infected with: Trojan.Downloader.Purityscan.W C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP144\A0047669.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP144\A0047669.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP144\A0047672.exe Infected with: Trojan.Downloader.Purityscan.BE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP144\A0047672.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP144\A0047672.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP144\A0047686.exe Infected with: Trojan.Downloader.Small.AYL C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP144\A0047686.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047750.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047750.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047750.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047751.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047751.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047751.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047752.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047752.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047752.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047753.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047753.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047753.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047754.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047754.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047754.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047755.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047755.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047755.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047756.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047756.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047756.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047757.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047757.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047757.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047759.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047759.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047759.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047760.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047760.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047760.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047761.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047761.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047761.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047762.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047762.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047762.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047763.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047763.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047763.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047764.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047764.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047764.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047765.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047765.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047765.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047766.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047766.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047766.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047767.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047767.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047767.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047768.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047768.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047768.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047769.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047769.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047769.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047770.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047770.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047770.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047771.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047771.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047771.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047772.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047772.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047772.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047773.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047773.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047773.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047774.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047774.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047774.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047775.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047775.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047775.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047776.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047776.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047776.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047777.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047777.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047777.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047778.exe Infected with: Trojan.Startpage.EX C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047778.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047778.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047779.exe Infected with: Trojan.Dialer.OY C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047779.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047779.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047780.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047780.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047780.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047781.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047781.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047781.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047782.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047782.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047782.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047783.exe Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047783.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047783.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047822.exe Infected with: Trojan.Dropper.Vb.KK C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047822.exe Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047822.exe Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047982.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047982.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047982.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047983.exe=>(Quarantine-2) Infected with: Trojan.Dropper.Insta.A C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047983.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047983.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047984.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047984.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047984.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047985.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047985.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047985.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047986.exe=>(Quarantine-2) Infected with: Trojan.Dialer.LO C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047986.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047986.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047987.exe=>(Quarantine-2) Infected with: Trojan.PurityScan.AT C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047987.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047987.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047988.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047988.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047988.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047989.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047989.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047989.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047990.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047990.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047990.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047991.exe=>(Quarantine-2) Infected with: Trojan.Dialer.LO C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047991.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047991.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047992.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047992.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047992.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047993.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047993.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047993.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047994.exe=>(Quarantine-2) Infected with: Trojan.Downloader.Small.ON C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047994.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047994.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047995.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047995.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047995.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047996.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047996.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047996.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047997.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047997.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047997.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047998.exe=>(Quarantine-2) Infected with: Trojan.Downloader.FLQ C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047998.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047998.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047999.exe=>(Quarantine-2) Infected with: Trojan.Downloader.Small.ON C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047999.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0047999.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048000.exe=>(Quarantine-2) Infected with: Trojan.Downloader.Small.ON C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048000.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048000.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048001.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048001.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048001.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048002.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048002.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048002.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048003.exe=>(Quarantine-2) Infected with: Trojan.Downloader.Purityscan.BT C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048003.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048003.exe=>(Quarantine-2) Deleted C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048004.exe=>(Quarantine-2) Infected with: Trojan.Dialer.EE C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048004.exe=>(Quarantine-2) Disinfection failed C:\System Volume Information\_restore{E8006C91-8EBA-407D-A9F5-C18270AD5137}\RP145\A0048004.exe=>(Quarantine-2) Deleted C:\WINDOWS\system32\__delete_on_reboot__winbug32.dll Infected with: Trojan.Agent.QT C:\WINDOWS\system32\__delete_on_reboot__winbug32.dll Disinfection failed C:\WINDOWS\system32\__delete_on_reboot__winbug32.dll Delete failed C:\WINDOWS\Temp\win35.tmp.exe Infected with: Trojan.Dialer.OY C:\WINDOWS\Temp\win35.tmp.exe Disinfection failed C:\WINDOWS\Temp\win35.tmp.exe Delete failed C:\WINDOWS\winres.dll Infected with: Trojan.Startpage.EX C:\WINDOWS\winres.dll Disinfection failed C:\WINDOWS\winres.dll Deleted C:\WINDOWS\ICROSO~1.NET\__delete_on_reboot__winspool.exe Infected with: Trojan.PurityScan.AT C:\WINDOWS\ICROSO~1.NET\__delete_on_reboot__winspool.exe Disinfection failed C:\WINDOWS\ICROSO~1.NET\__delete_on_reboot__winspool.exe Deleted HiJackThis:Logfile of HijackThis v1.99.1Scan saved at  13:35 , on 15/04/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\DAEMON Tools\daemon.exeC:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exeC:\Program Files\Analog Devices\SoundMAX\Smax4.exeC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\pctspk.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeC:\Program Files\Wireless\Client Manager\CMags.EXEC:\WINDOWS\system32\wdfmgr.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exeC:\WINDOWS\system32\HPZipm12.exeC:\WINDOWS\System32\alg.exeC:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\MSN Messenger\msnmsgr.exeC:\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=sslR1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.comR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.comR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exeO4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /trayO4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.0 RC 15.8\RivaTuner.exe" /SO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStartO4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"O4 - HKCU\..\Run: [Noes] "C:\WINDOWS\ICROSO~1.NET\winspool.exe" -vt yazrO4 - HKCU\..\Run: [Wcwk] C:\Program Files\?ppPatch
?tepad.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: hp psc 1000 series.lnk = ?O4 - Global Startup: hpoddt01.exe.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Wireless Client Manager.lnk = ?O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1162O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: winbug32 - winbug32.dll (file missing)O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeVoila... j'espere que ce que j'ai fait est ok .Merci pour vos reponses

bernie61 · Answer

retu as fais le smitfrauFix??déjà pas mal nettoyé, ok,passes aussi procédure l2mfixhttp://users.skynet.be/BernieClub/index.html#l2mfixa+

Onizuka63 · Answer

SmitFraudFix v2.29Rapport fait à 14:56:02,68, 15/04/2006Executé à partir de C:\Documents and Settings\Onizuka63\Bureau\SmitfraudFix\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» C:\»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32C:\WINDOWS\system32\amcompat.tlb PRESENT !C:\WINDOWS\system32
scompat.tlb PRESENT !»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Onizuka63\Application Data»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Onizuka63\Favoris»»»»»»»»»»»»»»»»»»»»»»»» Bureau»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]"Source"="About:Home""SubscribedURL"="About:Home""FriendlyName"="Ma page d'accueil" »»»»»»»»»»»»»»»»»»»»»»»» SharedtaskschedulerSrchSTS.exe by S!RiSearch SharedTaskScheduler's .dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pré-chargeur Browseui"[HKEY_CLASSES_ROOT\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]@="%SystemRoot%\system32\browseui.dll"[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]@="%SystemRoot%\system32\browseui.dll"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Démon de cache des catégories de composant"[HKEY_CLASSES_ROOT\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]@="%SystemRoot%\system32\browseui.dll"[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]@="%SystemRoot%\system32\browseui.dll"»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll»»»»»»»»»»»»»»»»»»»»»»»» Fin

bernie61 · Answer

reok et la suite de smitfrau... option 2puis l2mfixa+

Onizuka63 · Answer

Alors rapport Highjackthis : Logfile of HijackThis v1.99.1Scan saved at  15:16 , on 15/04/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\pctspk.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\system32\wdfmgr.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\DAEMON Tools\daemon.exeC:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exeC:\Program Files\Analog Devices\SoundMAX\Smax4.exeC:\WINDOWS\System32\alg.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\a-squared\a2guard.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exeC:\WINDOWS\system32\HPZipm12.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\Wireless\Client Manager\CMags.EXEC:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exeC:\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blankR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=sslR1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.comR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.comR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exeO4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /trayO4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.0 RC 15.8\RivaTuner.exe" /SO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStartO4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"O4 - HKCU\..\Run: [Noes] "C:\WINDOWS\ICROSO~1.NET\winspool.exe" -vt yazrO4 - HKCU\..\Run: [Wcwk] C:\Program Files\?ppPatch
?tepad.exeO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: hp psc 1000 series.lnk = ?O4 - Global Startup: hpoddt01.exe.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Wireless Client Manager.lnk = ?O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cabO16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cabO16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1162O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cabO16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cabO16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: winbug32 - winbug32.dll (file missing)O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeRapport Smitfrau option 2 :SmitFraudFix v2.29Rapport fait à 15:09:41,98, 15/04/2006Executé à partir de C:\Documents and Settings\Onizuka63\Mes documents\SmitfraudFix\SmitfraudFixOS: Microsoft Windows XP [version 5.1.2600]»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectésC:\WINDOWS\system32\amcompat.tlb suppriméC:\WINDOWS\system32
scompat.tlb supprimé»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre Nettoyage terminé. »»»»»»»»»»»»»»»»»»»»»»»» FinLe reste arrive...

Onizuka63 · Answer

L2MFIX find log 032106
These are the registry keys present
**********************************************************************************
Winlogon/notify:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winbug32]
"Asynchronous"=dword:00000001
"DllName"="winbug32.dll"
"Impersonate"=dword:00000000
"Startup"="EvtStartup"
"Shutdown"="EvtShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

**********************************************************************************
useragent:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

**********************************************************************************
Shell Extension key:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
"{00022613-0000-0000-C000-000000000046}"="Feuille de propri‚t‚s du fichier multim‚dia"
"{176d6597-26d3-11d1-b350-080036a75b03}"="Gestion de scanneur ICM"
"{1F2E5C40-9550-11CE-99D2-00AA006E086C}"="Page de s‚curit‚ NTFS"
"{3EA48300-8CF6-101B-84FB-666CCB9BCD32}"="Page des propri‚t‚s de OLE DocFile"
"{40dd6e20-7c17-11ce-a804-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{41E300E0-78B6-11ce-849B-444553540000}"="PlusPack CPL Extension"
"{42071712-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Carte du Panneau de configuration"
"{42071713-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage cran du Panneau de configuration"
"{42071714-76d4-11d1-8b24-00a0c9068ff3}"="Extension Affichage Panorama du Panneau de configuration"
"{4E40F770-369C-11d0-8922-00A024AB2DBB}"="Page de s‚curit‚ DS"
"{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"="Page de compatibilit‚"
"{56117100-C0CD-101B-81E2-00AA004AE837}"="Gestionnaire de donn‚es endommag‚es de l'environnement"
"{59099400-57FF-11CE-BD94-0020AF85B590}"="Extension copie de disquette"
"{59be4990-f85c-11ce-aff7-00aa003ca9f6}"="Extensions de l'environnement pour les objets r‚seau de Microsoft Windows"
"{5DB2625A-54DF-11D0-B6C4-0800091AA605}"="Gestion d'‚cran ICM"
"{675F097E-4C4D-11D0-B6C1-0800091AA605}"="Gestion d'imprimante ICM"
"{764BF0E1-F219-11ce-972D-00AA00A14F56}"="Extensions de l'environnement de compression de fichiers"
"{77597368-7b15-11d0-a0c2-080036af3f03}"="Extension de l'environnement d'imprimante Web"
"{7988B573-EC89-11cf-9C00-00AA00A14F56}"="Disk Quota UI"
"{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA}"="Menu contextuel de cryptage"
"{85BBD920-42A0-1069-A2E4-08002B30309D}"="Porte-documents"
"{88895560-9AA2-1069-930E-00AA0030EBC8}"="Extension ic“ne HyperTerminal"
"{BD84B380-8CA2-1069-AB1D-08000948F534}"="Fonts"
"{DBCE2480-C732-101B-BE72-BA78E9AD5B27}"="Profil ICC"
"{F37C5810-4D3F-11d0-B4BF-00AA00BBB723}"="Page de s‚curit‚ des imprimantes"
"{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}"="Extensions de l'environnement pour le partage"
"{f92e8c40-3d33-11d2-b1aa-080036a75b03}"="Display TroubleShoot CPL Extension"
"{7444C717-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie PKO"
"{7444C719-39BF-11D1-8CD9-00C04FC29D45}"="Extension de cryptographie Sign"
"{7007ACC7-3202-11D1-AAD2-00805FC1270E}"="Connexions r‚seau"
"{992CFFA0-F557-101A-88EC-00DD010CCC48}"="Connexions r‚seau"
"{E211B736-43FD-11D1-9EFB-0000F8757FCD}"="&Scanneurs et appareils photo"
"{FB0C9C8A-6C50-11D1-9F1D-0000F8757FCD}"="&Scanneurs et appareils photo"
"{905667aa-acd6-11d2-8080-00805f6596d2}"="&Scanneurs et appareils photo"
"{3F953603-1008-4f6e-A73A-04AAC7A992F1}"="&Scanneurs et appareils photo"
"{83bbcbf3-b28a-4919-a5aa-73027445d672}"="&Scanneurs et appareils photo"
"{F0152790-D56E-4445-850E-4F3117DB740C}"="Remote Sessions CPL Extension"
"{60254CA5-953B-11CF-8C96-00AA00B8708C}"="Extensions de l'interpr‚teur de commandes pour l'environnement d'ex‚cution de scripts Windows"
"{2206CDB2-19C1-11D1-89E0-00C04FD7A829}"="Liaison de donn‚es Microsoft"
"{DD2110F0-9EEF-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Icon Handler"
"{797F1E90-9EDD-11cf-8D8E-00AA0060F5BF}"="Tasks Folder Shell Extension"
"{D6277990-4C6A-11CF-8D87-00AA0060F5BF}"="Tƒches planifi‚es"
"{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults"
"{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension"
"{0DF44EAA-FF21-4412-828E-260A8728E7F1}"="Barre des tƒches et menu D‚marrer"
"{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}"="Rechercher"
"{2559a1f1-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}"="Aide et support"
"{2559a1f3-21d7-11d4-bdaf-00c04f60b9f0}"="Ex‚cuter..."
"{2559a1f4-21d7-11d4-bdaf-00c04f60b9f0}"="Internet"
"{2559a1f5-21d7-11d4-bdaf-00c04f60b9f0}"="Courrier ‚lectronique"
"{D20EA4E1-3957-11d2-A40B-0C5020524152}"="Polices"
"{D20EA4E1-3957-11d2-A40B-0C5020524153}"="Outils d'administration"
"{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Page de propri‚t‚s des versions pr‚c‚dentes"
"{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Versions pr‚c‚dentes"
"{875CB1A1-0F29-45de-A1AE-CFB4950D0B78}"="Audio Media Properties Handler"
"{40C3D757-D6E4-4b49-BB41-0E5BBEA28817}"="Video Media Properties Handler"
"{E4B29F9D-D390-480b-92FD-7DDB47101D71}"="Wav Properties Handler"
"{87D62D94-71B3-4b9a-9489-5FE6850DC73E}"="Avi Properties Handler"
"{A6FD9E45-6E44-43f9-8644-08598F5A74D9}"="Midi Properties Handler"
"{c5a40261-cd64-4ccf-84cb-c394da41d590}"="Video Thumbnail Extractor"
"{5E6AB780-7743-11CF-A12B-00AA004AE837}"="Barre d'outils Internet Microsoft"
"{22BF0C20-6DA7-11D0-B373-00A0C9034938}"="tat du t‚l‚chargement"
"{91EA3F8B-C99B-11d0-9815-00C04FD91972}"="Dossier Bureau ‚tendu"
"{6413BA2C-B461-11d1-A18A-080036B11A03}"="Dossier du shell augment‚"
"{F61FFEC1-754F-11d0-80CA-00AA005B4383}"="BandProxy"
"{7BA4C742-9E81-11CF-99D3-00AA004AE837}"="Bande du navigateur Microsoft"
"{30D02401-6A81-11d0-8274-00C04FD5AE38}"="Bande de recherche"
"{169A0691-8DF9-11d1-A1C4-00C04FD75D13}"="Volet int‚gr‚ de recherche"
"{07798131-AF23-11d1-9111-00A0C98BA67D}"="Recherche Web"
"{AF4F6510-F982-11d0-8595-00AA004CD6D8}"="Utilitaire des options de l'arborescence du Registre"
"{01E04581-4EEE-11d0-BFE9-00AA005B4383}"="&Adresse"
"{A08C11D2-A228-11d0-825B-00AA005B4383}"="BoŒte d'entr‚e de l'adresse"
"{00BB2763-6A77-11D0-A535-00C04FD7D062}"="Saisie semi-automatique Microsoft"
"{7376D660-C583-11d0-A3A5-00C04FD706EC}"="TridentImageExtractor"
"{6756A641-DE71-11d0-831B-00AA005B4383}"="Liste de saisie semi-automatique MRU"
"{6935DB93-21E8-4ccc-BEB9-9FE3C77A297A}"="Liste de saisie semi-automatique personnalis‚e MRU"
"{7e653215-fa25-46bd-a339-34a2790f3cb7}"="Accessible"
"{acf35015-526e-4230-9596-becbe19f0ac9}"="Barre de progrŠs auto-ouvrante"
"{00BB2764-6A77-11D0-A535-00C04FD7D062}"="Liste de saisie semi-automatique de l'historique Microsoft"
"{03C036F1-A186-11D0-824A-00AA005B4383}"="Liste de saisie semi-automatique du dossier Shell Microsoft"
"{00BB2765-6A77-11D0-A535-00C04FD7D062}"="Conteneur de la liste de saisie semi-automatique multiple Microsoft"
"{ECD4FC4E-521C-11D0-B792-00A0C90312E1}"="Menu Site de bandes"
"{3CCF8A41-5C85-11d0-9796-00AA00B90ADF}"="Shell DeskBarApp"
"{ECD4FC4C-521C-11D0-B792-00A0C90312E1}"="Barre du Bureau"
"{ECD4FC4D-521C-11D0-B792-00A0C90312E1}"="Shell Rebar BandSite"
"{DD313E04-FEFF-11d1-8ECD-0000F87A470C}"="Assistance utilisateur"
"{EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}"="ParamŠtres du dossier global"
"{EFA24E61-B078-11d0-89E4-00C04FC9E26E}"="Favorites Band"
"{0A89A860-D7B1-11CE-8350-444553540000}"="Shell Automation Inproc Service"
"{E7E4BC40-E76A-11CE-A9BB-00AA004AE837}"="Shell DocObject Viewer"
"{A5E46E3A-8849-11D1-9D8C-00C04FC99D61}"="Microsoft Browser Architecture"
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"="InternetShortcut"
"{3C374A40-BAE4-11CF-BF7D-00AA006946EE}"="Microsoft Url History Service"
"{FF393560-C2A7-11CF-BFF4-444553540000}"="Historique"
"{7BD29E00-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{7BD29E01-76C1-11CF-9DD0-00A0C9034933}"="Temporary Internet Files"
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"="Microsoft Url Search Hook"
"{A2B0DD40-CC59-11d0-A3A5-00C04FD706EC}"="Image de d‚marrage de la Suite IE4"
"{67EA19A0-CCEF-11d0-8024-00C04FD75D13}"="CDF Extension Copy Hook"
"{131A6951-7F78-11D0-A979-00C04FD705A2}"="ISFBand OC"
"{9461b922-3c5a-11d2-bf8b-00c04fb93661}"="Search Assistant OC"
"{3DC7A020-0ACD-11CF-A9BB-00AA004AE837}"="Internet"
"{871C5380-42A0-1069-A2EA-08002B30309D}"="Internet Name Space"
"{EFA24E64-B078-11d0-89E4-00C04FC9E26E}"="Explorer Band"
"{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}"="Sendmail service"
"{88C6C381-2E85-11D0-94DE-444553540000}"="Dossier ActiveX Cache"
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"="WebCheck"
"{ABBE31D0-6DAE-11D0-BECA-00C04FD940BE}"="Subscription Mgr"
"{F5175861-2688-11d0-9C5E-00AA00A45957}"="Dossier Inscription"
"{08165EA0-E946-11CF-9C87-00AA005127ED}"="WebCheckWebCrawler"
"{E3A8BDE6-ABCE-11d0-BC4B-00C04FD929DB}"="WebCheckChannelAgent"
"{E8BB6DC0-6B4E-11d0-92DB-00A0C90C2BD7}"="TrayAgent"
"{7D559C10-9FE9-11d0-93F7-00AA0059CE02}"="Code Download Agent"
"{E6CC6978-6B6E-11D0-BECA-00C04FD940BE}"="ConnectionAgent"
"{D8BD2030-6FC9-11D0-864F-00AA006809D9}"="PostAgent"
"{7FC0B86E-5FA7-11d1-BC7C-00C04FD929DB}"="WebCheck SyncMgr Handler"
"{352EC2B7-8B9A-11D1-B8AE-006008059382}"="Gestionnaire d'applications d'environnement"
"{0B124F8F-91F0-11D1-B8B5-006008059382}"="num‚rateur d'applications install‚es"
"{CFCCC7A0-A282-11D1-9082-006008059382}"="Publication d'application Darwin"
"{e84fda7c-1d6a-45f6-b725-cb260c236066}"="Shell Image Verbs"
"{66e4e4fb-f385-4dd0-8d74-a2efd1bc6178}"="Shell Image Data Factory"
"{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}"="Autoplay for SlideShow"
"{3F30C968-480A-4C6C-862D-EFC0897BB84B}"="Extracteur de miniatures de fichier + GDI"
"{9DBD2C50-62AD-11d0-B806-00C04FD706EC}"="Gestionnaire de miniatures - Informations de r‚sum‚ (DOCFILES)"
"{EAB841A0-9550-11cf-8C16-00805F1408F3}"="Extracteur de miniatures HTML"
"{eb9b1153-3b57-4e68-959a-a3266bc3d7fe}"="Shell Image Property Handler"
"{CC6EEFFB-43F6-46c5-9619-51D571967F7D}"="Assistant Publication de sites Web"
"{add36aa8-751a-4579-a266-d66f5202ccbb}"="Commande d'impressions via le Web"
"{6b33163c-76a5-4b6c-bf21-45de9cd503a1}"="Objet Assistant de publication Shell"
"{58f1f272-9240-4f51-b6d4-fd63d1618591}"="Assistant Obtenir une identit‚ Passport"
"{7A9D77BD-5403-11d2-8785-2E0420524153}"="Comptes d'utilisateurs"
"{BD472F60-27FA-11cf-B8B4-444553540000}"="Compressed (zipped) Folder Right Drag Handler"
"{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}"="Compressed (zipped) Folder SendTo Target"
"{f39a0dc0-9cc8-11d0-a599-00c04fd64433}"="Fichier de chaŒne"
"{f3aa0dc0-9cc8-11d0-a599-00c04fd64434}"="Raccourci de chaŒne"
"{f3ba0dc0-9cc8-11d0-a599-00c04fd64435}"="Channel Handler Object"
"{f3da0dc0-9cc8-11d0-a599-00c04fd64437}"="Channel Menu"
"{f3ea0dc0-9cc8-11d0-a599-00c04fd64438}"="Channel Properties"
"{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder"
"{63da6ec0-2e98-11cf-8d82-444553540000}"="FTP Folders Webview"
"{883373C3-BF89-11D1-BE35-080036B11A03}"="Microsoft DocProp Shell Ext"
"{A9CF0EAE-901A-4739-A481-E35B73E47F6D}"="Microsoft DocProp Inplace Edit Box Control"
"{8EE97210-FD1F-4B19-91DA-67914005F020}"="Microsoft DocProp Inplace ML Edit Box Control"
"{0EEA25CC-4362-4A12-850B-86EE61B0D3EB}"="Microsoft DocProp Inplace Droplist Combo Control"
"{6A205B57-2567-4A2C-B881-F787FAB579A3}"="Microsoft DocProp Inplace Calendar Control"
"{28F8A4AC-BBB3-4D9B-B177-82BFC914FA33}"="Microsoft DocProp Inplace Time Control"
"{8A23E65E-31C2-11d0-891C-00A024AB2DBB}"="Directory Query UI"
"{9E51E0D0-6E0F-11d2-9601-00C04FA31A86}"="Shell properties for a DS object"
"{163FDC20-2ABC-11d0-88F0-00A024AB2DBB}"="Directory Object Find"
"{F020E586-5264-11d1-A532-0000F8757D7E}"="Directory Start/Search Find"
"{0D45D530-764B-11d0-A1CA-00AA00C16E65}"="Directory Property UI"
"{62AE1F9A-126A-11D0-A14B-0800361B1103}"="Directory Context Menu Verbs"
"{ECF03A33-103D-11d2-854D-006008059367}"="MyDocs Copy Hook"
"{ECF03A32-103D-11d2-854D-006008059367}"="MyDocs Drop Target"
"{4a7ded0a-ad25-11d0-98a8-0800361b1103}"="MyDocs Properties"
"{750fdf0e-2a26-11d1-a3ea-080036587f03}"="Offline Files Menu"
"{10CFC467-4392-11d2-8DB4-00C04FA31A66}"="Offline Files Folder Options"
"{AFDB1F70-2A4C-11d2-9039-00C04F8EEB3E}"="Dossier Fichiers hors connexion"
"{143A62C8-C33B-11D1-84FE-00C04FA34A14}"="Microsoft Agent Character Property Sheet Handler"
"{ECCDF543-45CC-11CE-B9BF-0080C87CDBA6}"="DfsShell"
"{60fd46de-f830-4894-a628-6fa81bc0190d}"="%DESC_PublishDropTarget%"
"{7A80E4A8-8005-11D2-BCF8-00C04F72C717}"="MMC Icon Handler"
"{0CD7A5C0-9F37-11CE-AE65-08002B2E1262}"=".CAB file viewer"
"{32714800-2E5F-11d0-8B85-00AA0044F941}"="Des &personnes..."
"{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler"
"{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler"
"{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler"
"{A70C977A-BF00-412C-90B7-034C51DA2439}"="NvCpl DesktopContext Class"
"{1CDB2949-8F65-4355-8456-263E7C208A5D}"="Desktop Explorer"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}"="Desktop Explorer Menu"
"{1E9B04FB-F9E5-4718-997B-B8DA88302A48}"="nView Desktop Context Menu"
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}"="WinRAR shell extension"
"{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices"
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu"
"{BDEADF00-C265-11D0-BCED-00A0C90AB50F}"="Dossiers Web"
"{0006F045-0000-0000-C000-000000000046}"="Microsoft Outlook Custom Icon Handler"
"{42042206-2D85-11D3-8CFF-005004838597}"="Microsoft Office HTML Icon Handler"
"{1EBC3533-B289-409F-9924-B84B3F0717D2}"="AceFTP Context Menu Shell Extension"
"{21569614-B795-46b1-85F4-E737A8DC09AD}"="Shell Search Band"
"{2AA59FC0-31E8-42DA-9D3C-E9A52953853B}"="CopyToCD shell extension"
"{FFB699E0-306A-11d3-8BD1-00104B6F7516}"="Play on my TV helper"

**********************************************************************************
HKEY ROOT CLASSIDS:
**********************************************************************************
Files Found are not all bad files:

C:\WINDOWS\SYSTEM32\
browseui.dll Sat 4 Mar 2006 5:34:58 A.... 1 023 488 999,50 K
cdfview.dll Sat 4 Mar 2006 5:34:58 A.... 152 064 148,50 K
cygwin1.dll Fri 14 Apr 2006 22:59:26 A.... 1 126 281 1,07 M
cygz.dll Fri 14 Apr 2006 22:59:26 A.... 35 328 34,50 K
danim.dll Sat 4 Mar 2006 5:34:58 A.... 1 056 768 1,01 M
dxtrans.dll Sat 4 Mar 2006 5:34:58 A.... 205 312 200,50 K
extmgr.dll Sat 4 Mar 2006 5:34:58 A.... 55 808 54,50 K
ff_vfw.dll Fri 27 Jan 2006 15:36:06 A.... 6 144 6,00 K
iepeers.dll Sat 4 Mar 2006 5:34:58 A.... 251 392 245,50 K
inetcomm.dll Fri 17 Mar 2006 11:11:46 A.... 679 424 663,50 K
inseng.dll Sat 4 Mar 2006 5:34:58 A.... 96 768 94,50 K
lame_enc.dll Fri 14 Apr 2006 23:25:00 A.... 237 568 232,00 K
mshtml.dll Thu 23 Mar 2006 22:35:42 A.... 3 074 560 2,93 M
mshtmled.dll Sat 4 Mar 2006 5:35:00 A.... 448 512 438,00 K
msrating.dll Sat 4 Mar 2006 5:35:00 A.... 146 432 143,00 K
mstime.dll Sat 4 Mar 2006 5:35:02 A.... 532 480 520,00 K
pngfilt.dll Sat 4 Mar 2006 5:35:02 A.... 39 424 38,50 K
shdocvw.dll Thu 30 Mar 2006 11:26:12 A.... 1 492 992 1,42 M
shell32.dll Fri 17 Mar 2006 6:07:40 A.... 8 508 416 8,11 M
shlwapi.dll Sat 4 Mar 2006 5:35:02 A.... 474 624 463,50 K
urlmon.dll Sat 18 Mar 2006 13:09:54 A.... 615 424 601,00 K
wininet.dll Sat 4 Mar 2006 5:35:02 A.... 662 528 647,00 K
wmp.dll Fri 10 Mar 2006 6:09:14 A.... 5 533 696 5,28 M
x264vfw.dll Wed 8 Feb 2006 17:31:12 A.... 454 162 443,52 K
xpsp3res.dll Thu 30 Mar 2006 3:16:46 A.... 17 920 17,50 K

25 items found: 25 files, 0 directories.
Total of file sizes: 26 927 515 bytes 25,68 M
Locate .tmp files:

No matches found.
**********************************************************************************
Directory Listing of system files:
Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est D81A-DF92

R‚pertoire de C:\WINDOWS\System32

14/04/2006 23:30 -=On!Z—K@=- 12ÿ208 KGyGaAvL.sys
12/04/2006 17:46 -=On!Z—K@=- <REP> dllcache
28/11/2005 20:38 -=On!Z—K@=- <REP> Microsoft
1 fichier(s) 12ÿ208 octets
2 R‚p(s) 18ÿ942ÿ226ÿ432 octets libres

bernie61 · Answer

reil faudra passer aussi par http://users.skynet.be/BernieClub/index.html#lspexplorercar tu es infecté par LOP (www.prosearching.com  = lop.com)a+

Onizuka63 · Answer

L2mfix 032106
Creating Account.
Le compte existe d‚j….

Vous obtiendrez une aide suppl‚mentaire en entrant NET HELPMSG 2224.

Adding Administrative privleges.
Checking for L2MFix account(0=no 1=yes):
1
Granting SeDebugPrivilege to L2MFIX ... successful

Running From:
C:\WINDOWS\system32

Killing Processes!

Running From:
C:\WINDOWS\system32

Killing Processes!

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 668 'smss.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'winlogon.exe'
Killing PID 920 'win

Onizuka63 · Answer

Voila le dernier demandé... LSP Explorer export.Created on:15/04/2006 15:49:12---------------------------------------------Layered Service Providers    MSAFD Tcpip [TCP/IP]    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1001   Address Family : internetwork: UDP, TCP, etc.   Provider : {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}   Service Flags 1 : $00020066    XP1_GUARANTEED_DELIVERY   XP1_GUARANTEED_ORDER   XP1_GRACEFUL_CLOSE   XP1_EXPEDITED_DATA   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000008    PFL_MATCHES_PROTOCOL_ZERO  Maximum Message Size : $00000000   Security Sheme : 0   Byte Order : Big Endian   Protocol : 6   Protocol MaxOffset : $00000000   Min Socket Address : $00000010   Max Socket Address : $00000010   Socket Type : Stream   Protocol Chain length : 1    Protocol Chain Entry (0) : 0 MSAFD Tcpip [UDP/IP]    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1002   Address Family : internetwork: UDP, TCP, etc.   Provider : {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}   Service Flags 1 : $00020609    XP1_CONNECTIONLESS   XP1_MESSAGE_ORIENTED   XP1_SUPPORT_BROADCAST   XP1_SUPPORT_BROADCAST   XP1_SUPPORT_MULTIPOINT   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000008    PFL_MATCHES_PROTOCOL_ZERO  Maximum Message Size : $0000FFBB   Security Sheme : 0   Byte Order : Big Endian   Protocol : 17   Protocol MaxOffset : $00000000   Min Socket Address : $00000010   Max Socket Address : $00000010   Socket Type : Datagram   Protocol Chain length : 1    Protocol Chain Entry (0) : 0 MSAFD Tcpip [RAW/IP]    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1003   Address Family : internetwork: UDP, TCP, etc.   Provider : {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}   Service Flags 1 : $00020609    XP1_CONNECTIONLESS   XP1_MESSAGE_ORIENTED   XP1_SUPPORT_BROADCAST   XP1_SUPPORT_BROADCAST   XP1_SUPPORT_MULTIPOINT   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $0000000C    PFL_HIDDEN   PFL_MATCHES_PROTOCOL_ZERO  Maximum Message Size : $0000FFBB   Security Sheme : 0   Byte Order : Big Endian   Protocol : 0   Protocol MaxOffset : $000000FF   Min Socket Address : $00000010   Max Socket Address : $00000010   Socket Type : Unknown   Protocol Chain length : 1    Protocol Chain Entry (0) : 0 RSVP UDP Service Provider    Filename : C:\WINDOWS\system32\rsvpsp.dll    Legal copyright :   Microsoft Corporation. All rights reserved.   Company name : Microsoft Corporation   File desicription : Microsoft Windows Rsvp 1.0 Service Provider   File version : 5.1.2600.0 (xpclient.010817-1148)   Internal name : rsvpsp.dll   Original filename : rsvpsp.dll   Product name : Microsoft  Windows  Operating System   Product version : 5.1.2600.0  Version  : 6   Catalog Entry : 1004   Address Family : internetwork: UDP, TCP, etc.   Provider : {9D60A9E0-337A-11D0-BD88-0000C082E69A}   Service Flags 1 : $00022609    XP1_CONNECTIONLESS   XP1_MESSAGE_ORIENTED   XP1_SUPPORT_BROADCAST   XP1_SUPPORT_BROADCAST   XP1_SUPPORT_MULTIPOINT   XP1_QOS_SUPPORTED   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000008    PFL_MATCHES_PROTOCOL_ZERO  Maximum Message Size : $0000FFBB   Security Sheme : 0   Byte Order : Big Endian   Protocol : 17   Protocol MaxOffset : $00000000   Min Socket Address : $00000010   Max Socket Address : $00000010   Socket Type : Datagram   Protocol Chain length : 1    Protocol Chain Entry (0) : 87881860 RSVP TCP Service Provider    Filename : C:\WINDOWS\system32\rsvpsp.dll    Legal copyright :   Microsoft Corporation. All rights reserved.   Company name : Microsoft Corporation   File desicription : Microsoft Windows Rsvp 1.0 Service Provider   File version : 5.1.2600.0 (xpclient.010817-1148)   Internal name : rsvpsp.dll   Original filename : rsvpsp.dll   Product name : Microsoft  Windows  Operating System   Product version : 5.1.2600.0  Version  : 6   Catalog Entry : 1005   Address Family : internetwork: UDP, TCP, etc.   Provider : {9D60A9E0-337A-11D0-BD88-0000C082E69A}   Service Flags 1 : $00022066    XP1_GUARANTEED_DELIVERY   XP1_GUARANTEED_ORDER   XP1_GRACEFUL_CLOSE   XP1_EXPEDITED_DATA   XP1_QOS_SUPPORTED   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000008    PFL_MATCHES_PROTOCOL_ZERO  Maximum Message Size : $00000000   Security Sheme : 0   Byte Order : Big Endian   Protocol : 6   Protocol MaxOffset : $00000000   Min Socket Address : $00000010   Max Socket Address : $00000010   Socket Type : Stream   Protocol Chain length : 1    Protocol Chain Entry (0) : 1835400 MSAFD NetBIOS [\Device\NetBT_Tcpip_{284ACCBD-D3B7-43AD-9E8B-8BA3642336CF}] SEQPACKET 4    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1046   Address Family : NetBios-style addresses   Provider : {8D5F1830-C273-11CF-95C8-00805F48A192}   Service Flags 1 : $0002000E    XP1_GUARANTEED_DELIVERY   XP1_GUARANTEED_ORDER   XP1_MESSAGE_ORIENTED   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000000   Maximum Message Size : $0000FA00   Security Sheme : 0   Byte Order : Big Endian   Protocol : -4   Protocol MaxOffset : $00000000   Min Socket Address : $00000014   Max Socket Address : $00000014   Socket Type : Unknown   Protocol Chain length : 1    Protocol Chain Entry (0) : 0 MSAFD NetBIOS [\Device\NetBT_Tcpip_{284ACCBD-D3B7-43AD-9E8B-8BA3642336CF}] DATAGRAM 4    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1047   Address Family : NetBios-style addresses   Provider : {8D5F1830-C273-11CF-95C8-00805F48A192}   Service Flags 1 : $00020209    XP1_CONNECTIONLESS   XP1_MESSAGE_ORIENTED   XP1_SUPPORT_BROADCAST   XP1_SUPPORT_BROADCAST   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000000   Maximum Message Size : $0000FA00   Security Sheme : 0   Byte Order : Big Endian   Protocol : -4   Protocol MaxOffset : $00000000   Min Socket Address : $00000014   Max Socket Address : $00000014   Socket Type : Datagram   Protocol Chain length : 1    Protocol Chain Entry (0) : 0 MSAFD NetBIOS [\Device\NetBT_Tcpip_{0E53C8FE-44D2-467F-80C4-8574FF8CE8B9}] SEQPACKET 3    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1048   Address Family : NetBios-style addresses   Provider : {8D5F1830-C273-11CF-95C8-00805F48A192}   Service Flags 1 : $0002000E    XP1_GUARANTEED_DELIVERY   XP1_GUARANTEED_ORDER   XP1_MESSAGE_ORIENTED   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000000   Maximum Message Size : $0000FA00   Security Sheme : 0   Byte Order : Big Endian   Protocol : -3   Protocol MaxOffset : $00000000   Min Socket Address : $00000014   Max Socket Address : $00000014   Socket Type : Unknown   Protocol Chain length : 1    Protocol Chain Entry (0) : 0 MSAFD NetBIOS [\Device\NetBT_Tcpip_{0E53C8FE-44D2-467F-80C4-8574FF8CE8B9}] DATAGRAM 3    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1049   Address Family : NetBios-style addresses   Provider : {8D5F1830-C273-11CF-95C8-00805F48A192}   Service Flags 1 : $00020209    XP1_CONNECTIONLESS   XP1_MESSAGE_ORIENTED   XP1_SUPPORT_BROADCAST   XP1_SUPPORT_BROADCAST   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000000   Maximum Message Size : $0000FA00   Security Sheme : 0   Byte Order : Big Endian   Protocol : -3   Protocol MaxOffset : $00000000   Min Socket Address : $00000014   Max Socket Address : $00000014   Socket Type : Datagram   Protocol Chain length : 1    Protocol Chain Entry (0) : 0 MSAFD NetBIOS [\Device\NetBT_Tcpip_{77FEBB28-2F29-4FFF-B728-49564485983B}] SEQPACKET 0    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1050   Address Family : NetBios-style addresses   Provider : {8D5F1830-C273-11CF-95C8-00805F48A192}   Service Flags 1 : $0002000E    XP1_GUARANTEED_DELIVERY   XP1_GUARANTEED_ORDER   XP1_MESSAGE_ORIENTED   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000008    PFL_MATCHES_PROTOCOL_ZERO  Maximum Message Size : $0000FA00   Security Sheme : 0   Byte Order : Big Endian   Protocol : -2147483648   Protocol MaxOffset : $00000000   Min Socket Address : $00000014   Max Socket Address : $00000014   Socket Type : Unknown   Protocol Chain length : 1    Protocol Chain Entry (0) : 0 MSAFD NetBIOS [\Device\NetBT_Tcpip_{77FEBB28-2F29-4FFF-B728-49564485983B}] DATAGRAM 0    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1051   Address Family : NetBios-style addresses   Provider : {8D5F1830-C273-11CF-95C8-00805F48A192}   Service Flags 1 : $00020209    XP1_CONNECTIONLESS   XP1_MESSAGE_ORIENTED   XP1_SUPPORT_BROADCAST   XP1_SUPPORT_BROADCAST   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000008    PFL_MATCHES_PROTOCOL_ZERO  Maximum Message Size : $0000FA00   Security Sheme : 0   Byte Order : Big Endian   Protocol : -2147483648   Protocol MaxOffset : $00000000   Min Socket Address : $00000014   Max Socket Address : $00000014   Socket Type : Datagram   Protocol Chain length : 1    Protocol Chain Entry (0) : 0 MSAFD NetBIOS [\Device\NetBT_Tcpip_{417C75DE-E3A7-4DD6-BB06-07460DFC3080}] SEQPACKET 1    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1052   Address Family : NetBios-style addresses   Provider : {8D5F1830-C273-11CF-95C8-00805F48A192}   Service Flags 1 : $0002000E    XP1_GUARANTEED_DELIVERY   XP1_GUARANTEED_ORDER   XP1_MESSAGE_ORIENTED   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000000   Maximum Message Size : $0000FA00   Security Sheme : 0   Byte Order : Big Endian   Protocol : -1   Protocol MaxOffset : $00000000   Min Socket Address : $00000014   Max Socket Address : $00000014   Socket Type : Unknown   Protocol Chain length : 1    Protocol Chain Entry (0) : 0 MSAFD NetBIOS [\Device\NetBT_Tcpip_{417C75DE-E3A7-4DD6-BB06-07460DFC3080}] DATAGRAM 1    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1053   Address Family : NetBios-style addresses   Provider : {8D5F1830-C273-11CF-95C8-00805F48A192}   Service Flags 1 : $00020209    XP1_CONNECTIONLESS   XP1_MESSAGE_ORIENTED   XP1_SUPPORT_BROADCAST   XP1_SUPPORT_BROADCAST   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000000   Maximum Message Size : $0000FA00   Security Sheme : 0   Byte Order : Big Endian   Protocol : -1   Protocol MaxOffset : $00000000   Min Socket Address : $00000014   Max Socket Address : $00000014   Socket Type : Datagram   Protocol Chain length : 1    Protocol Chain Entry (0) : 0 MSAFD NetBIOS [\Device\NetBT_Tcpip_{DE364666-7F09-4F4E-B7D9-FFE74A4F2BE1}] SEQPACKET 2    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1054   Address Family : NetBios-style addresses   Provider : {8D5F1830-C273-11CF-95C8-00805F48A192}   Service Flags 1 : $0002000E    XP1_GUARANTEED_DELIVERY   XP1_GUARANTEED_ORDER   XP1_MESSAGE_ORIENTED   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000000   Maximum Message Size : $0000FA00   Security Sheme : 0   Byte Order : Big Endian   Protocol : -2   Protocol MaxOffset : $00000000   Min Socket Address : $00000014   Max Socket Address : $00000014   Socket Type : Unknown   Protocol Chain length : 1    Protocol Chain Entry (0) : 0 MSAFD NetBIOS [\Device\NetBT_Tcpip_{DE364666-7F09-4F4E-B7D9-FFE74A4F2BE1}] DATAGRAM 2    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  Version  : 2   Catalog Entry : 1055   Address Family : NetBios-style addresses   Provider : {8D5F1830-C273-11CF-95C8-00805F48A192}   Service Flags 1 : $00020209    XP1_CONNECTIONLESS   XP1_MESSAGE_ORIENTED   XP1_SUPPORT_BROADCAST   XP1_SUPPORT_BROADCAST   XP1_IFS_HANDLES  Service Flags 2 : $00000000   Service Flags 3 : $00000000   Service Flags 4 : $00000000   Provider Flags : $00000000   Maximum Message Size : $0000FA00   Security Sheme : 0   Byte Order : Big Endian   Protocol : -2   Protocol MaxOffset : $00000000   Min Socket Address : $00000014   Max Socket Address : $00000014   Socket Type : Datagram   Protocol Chain length : 1    Protocol Chain Entry (0) : 0Name Space Providers    Description : TCP/IP    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  NameSpace : NS_DNS   Active : Yes   Protocol Version : 0   Provider : {22059D40-7E9E-11CF-AE5A-00AA00A7112B}  Description : NTDS    Filename : C:\WINDOWS\system32\winrnr.dll    Legal copyright :   Microsoft Corporation. All rights reserved.   Company name : Microsoft Corporation   File desicription : LDAP RnR Provider DLL   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : winrnr   Original filename : winrnr   Product name : Microsoft  Windows  Operating System   Product version : 5.1.2600.2180  NameSpace : NS_NTDS   Active : Yes   Protocol Version : 0   Provider : {3B2637EE-E580-11CF-A555-00C04FD8D4AC}  Description : Espace de noms NLA (Network Location Awareness)    Filename : C:\WINDOWS\system32\mswsock.dll    Legal copyright :   Microsoft Corporation. Tous droits r serv s.   Company name : Microsoft Corporation   File desicription : Fournisseur de service Sockets 2.0 de Microsoft Windows   File version : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)   Internal name : mswsock.dll   Original filename : mswsock.dll   Product name : Syst me d'exploitation Microsoft  Windows    Product version : 5.1.2600.2180  NameSpace : Unknown   Active : Yes   Protocol Version : 0   Provider : {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83}

Onizuka63 · Answer

Desolé je n'avais pas vu que la fin du rapport de L2MFIX n'etait pas apparu....
Voila la suite :

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 1824 'explorer.exe'
Killing PID 1824 'explorer.exe'

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.org
Killing PID 2976 'rundll32.exe'
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrateurs ... successful

Scanning First Pass. Please Wait!

First Pass Completed

Second Pass Scanning

Second pass Completed!

Restoring Windows Update Certificates.:

The following Is the Current Export of the Winlogon notify key:
****************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\
6c,00,00,00
"Logoff"="ChainWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogoffEvent"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\
6c,00,6c,00,00,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winbug32]
"Asynchronous"=dword:00000001
"DllName"="winbug32.dll"
"Impersonate"=dword:00000000
"Startup"="EvtStartup"
"Shutdown"="EvtShutdown"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001

The following are the files found:
****************************************************************************

Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
****************************************************************************
REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""
****************************************************************************
Desktop.ini Contents:
****************************************************************************

****************************************************************************
Checking for L2MFix account(0=no 1=yes):
0
Zipping up files for submission:
zip warning: name not matched: dlls\*.*

zip error: Nothing to do! (backup.zip)
adding: backregs/notibac.reg (164 bytes security) (deflated 87%)
adding: backregs/shell.reg (164 bytes security) (deflated 73%)

Voila j'espere que tout est la ! :)

bernie61 · Answer

re0. Installe ce nettoyeur CCLEANER https://www.ccleaner.com/   ou lien direct là http://www.filehippo.com/download_ccleaner.html  (la flèche)Tutorial là https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.phpensuite*Configure ton ordi  pour tous scan à exécuter complétement, il faut pouvoir scanner tous les dossiers caché et système donc faire :Démarrer/PanneauConfiguration/OptionsDossiers /ongletAffichage et là cocher les lignes- afficher les fichiers et dossier cachés- afficher contenu dossier systèmedécocher- masquer fichiers protégés du dossier systèmePuis cliquer APPLIQUER à TOUS les Dossiers2. Relances Hijackthis et coche (puis FIX)R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = prosearching.com    >> toutes lignes R1 et R0 avec ce prosearching.comO4 - HKCU\..\Run: [Noes] "C:\WINDOWS\ICROSO~1.NET\winspool.exe" -vt yazrO4 - HKCU\..\Run: [Wcwk] C:\Program Files\?ppPatch
?tepad.exeO9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1162 O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.inoculer.com/antivirus/Msie/bitdefender.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab3. Effacer ces programmes .EXE et .DLL( et à la fin vider la corbeille)C:\WINDOWS\ICROSO~1.NET\     > le répertoireC:\Program Files\?ppPatch\   > le répertoire5. vider les répertoires temps et la corbeille, en lançant Ccleanera+

Onizuka63 · Answer

Salut ! Voila j'ai fais les demarches indiquées ci dessus.Par contre je n'ai pas trouvé :O4 - HKCU\..\Run: [Noes] "C:\WINDOWS\ICROSO~1.NET\winspool.exe" -vt yazr O4 - HKCU\..\Run: [Wcwk] C:\Program Files\?ppPatch
?tepad.exe C:\WINDOWS\ICROSO~1.NET\ > le répertoire Voila , sinon tout a l'air de fonctionner ,je n'ai plus de fanetre intempestive. :)Je mets mon dernier rapport de HT : Logfile of HijackThis v1.99.1Scan saved at  20:29 , on 17/04/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeC:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeC:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\ewido anti-malware\ewidoctrl.exeC:\Program Files\ewido anti-malware\ewidoguard.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeC:\WINDOWS\system32
vsvc32.exeC:\WINDOWS\system32\pctspk.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\system32\wdfmgr.exeC:\WINDOWS\System32\alg.exeC:\Program Files\Fichiers communs\Symantec Shared\ccApp.exeC:\Program Files\MessengerPlus! 3\MsgPlus.exeC:\Program Files\DAEMON Tools\daemon.exeC:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exeC:\Program Files\Analog Devices\SoundMAX\Smax4.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\Microsoft ActiveSync\WCESCOMM.EXEC:\Program Files\MSN Messenger\msnmsgr.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\a-squared\a2guard.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exeC:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exeC:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exeC:\Program Files\Wireless\Client Manager\CMags.EXEC:\Program Files\MSN Messenger\msnmsgr.exeC:\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=sslR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = LiensO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /ConsumerO4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exeO4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /trayO4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.0 RC 15.8\RivaTuner.exe" /SO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStartO4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"O4 - HKCU\..\Run: [a-squared] "C:\Program Files\a-squared\a2guard.exe"O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: hp psc 1000 series.lnk = ?O4 - Global Startup: hpoddt01.exe.lnk = ?O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Wireless Client Manager.lnk = ?O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)O20 - Winlogon Notify: winbug32 - winbug32.dll (file missing)O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exeO23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exeO23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exeO23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeO23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exeO23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exeVoila j'espere qui tout est bon cette fois .Merci a toi Bernie61 ! ;)

bernie61 · Answer

reok pour moi, juste celle-ci à ocher et FIX avec hijackthisO20 - Winlogon Notify: winbug32 - winbug32.dll (file missing)bon surf a+

Onizuka63 · Answer

Merci a toi Bernie61 @++

[XP] Fenetre MS DOS 16bits indesirable

15 réponses

Discussions similaires

Newsletters