What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Browser, Internet connection, and Applications Hijacke

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My compuer recently lost control of my internet connection, browser, and applications at the same time that a Spyware Guard 2008 kept poping up and installing at the same time as a security center warning kept displaying warnings. As I cannot install new applications I have to use an older version of Hijackthis as programs I try to run just hang in the task manager. Hope you can help:

Scan saved at 7:53:26 PM, on 12/26/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\HJTInstall.exe
C:\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twext.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [com.codeode.cactusspamfilter] "C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe" -minimized
O4 - HKCU\..\Run: [ImpulseFastStart] "D:\Program Files\Stardock\Impulse\Impulse.exe" /fastload
O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\CHRISR~1\LOCALS~1\Temp\csrssc.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: ieModule - {63E4F44A-2968-4C31-A3DF-6931633BC463} - C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll
O21 - SSODL: InternetConnection - {45DC33C5-0195-43EF-9C41-84098F66C4A3} - C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\rshkmpsptw.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Unknown owner - C:\Program Files\Canon\CAL\CALMAIN.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)
Post #2
Please keep in mind that I am somewhat limited as to what I can run as most things just seem to hang. Tried a bunch of times to delete all instances of this Spyware Guard from drive and registry but they coming back every few minutes.
Post #3
hello

Looking at your system now, one or more of the identified infections is a backdoor Trojan.

If this computer is ever used for on-line banking, I suggest you do the following immediately:

1. Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

2. From a clean computer, change ALL your on-line passwords for email, for banks, financial accounts, PayPal, eBay, on-line companies, any on-line forums or groups you belong to.

Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.



Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum.
Post #4
OK, so I couldnt run SDFix as it would just hang. I checked and saw the SDFix folder on my drive. I followed the instructions and then realized at the end that this was a very old version of SDFix. I then just ran SDFix on my other computer and copied the folder over to my computer and reran it. It did state if found a rootkit however the Spyware Guard 2008 still loads on boot (but my internet now seems to run). I will post both SDFix logs starting with the outdated version:

Outdated SDFix log:


SDFix: Version 1.83

Run by [removed]
Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:




Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'
Killing PID 268 'winlogon.exe'


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…

Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\LOCALS~1\TEMPOR~1\CONTENT.IE5\0PZCDTXV\LIRFCT~1.HTM - Deleted
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM~1\LOCALS~1\TEMPOR~1\CONTENT.IE5\EXY8LPW9\VFOPP_~1.HTM - Deleted
C:\755681~1 - Deleted
C:\WINDOWS\system32\crypts.dll - Deleted



Removing Temp Files

ADS Check:

Checking if ADS is attached to system32 Folder
C:\WINDOWS\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.



Final Check:

Remaining Services:
——————



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\Common Files\\AOL\\1156129707\\ee\\aolsoftware.exe"="C:\\Program Files\\Common Files\\AOL\\1156129707\\ee\\aolsoftware.exe:*:Enabled:AOL Services"
"C:\\Program Files\\Common Files\\AOL\\1156129707\\ee\\aim6.exe"="C:\\Program Files\\Common Files\\AOL\\1156129707\\ee\\aim6.exe:*:Enabled:AIM"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"="D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe:*:Enabled:Neverwinter Nights 2 Main"
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"="D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe:*:Enabled:Neverwinter Nights 2 AMD"
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"="D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe:*:Enabled:Neverwinter Nights 2 Updater"
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"="D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe:*:Enabled:Neverwinter Nights 2 Server"
"D:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="D:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"D:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="D:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"D:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="D:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"D:\\Matrix Games\\UFO Extraterrestrials\\TrueUpdate.exe"="D:\\Matrix Games\\UFO Extraterrestrials\\TrueUpdate.exe:*:Enabled:TrueUpdate 2.0 Client"
"D:\\Program Files\\LimeWire\\LimeWire.exe"="D:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"D:\\Program Files\\Steam\\Steam.exe"="D:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam Client"
"C:\\Program Files\\Roxio\\Digital Home 9\\RoxioUPnPRenderer9.exe"="C:\\Program Files\\Roxio\\Digital Home 9\\RoxioUPnPRenderer9.exe:*:Enabled:RoxioUPnPRenderer9"
"C:\\Documents and Settings\\Chris Raymond\\My Documents\\Games\\WRE54GSetupWizard2.1.1.8\\WRE54GSetupWizard2.1.1.8\\Setup.exe"="C:\\Documents and Settings\\Chris Raymond\\My Documents\\Games\\WRE54GSetupWizard2.1.1.8\\WRE54GSetupWizard2.1.1.8\\Setup.exe:*:Enabled:Setup"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Roxio\\Digital Home 9\\RoxioUPnPRenderer9.exe"="C:\\Program Files\\Roxio\\Digital Home 9\\RoxioUPnPRenderer9.exe:*:Enabled:RoxioUPnPRenderer9"


Remaining Files:
—————

Backups Folder: - C:\SDFix\backups\backups.zip

Checking For Files with Hidden Attributes:

C:\Documents and Settings\Chris Raymond\LMShared\Dream Aquarium XP_Vista Screensaver\DreamXP.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
C:\Documents and Settings\Chris Raymond\Application Data\Roxio\Dragon\3.x\DiscInfoCache\LITE-ON_DVDRW_SOHW-1693S_KS0A_000_DICV018_DRGV9010000.TMP
C:\Documents and Settings\Chris Raymond\Application Data\Roxio\Dragon\3.x\DiscInfoCache\ZR4405G_IHC180P_2.0B_200_DICV018_DRGV9010000.TMP

Finished


New Version:


SDFix: Version 1.240
Run by [removed] on Sat 12/27/2008 at 12:39 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\Documents and Settings\LocalService\Application Data\twain_32\user.ds - Deleted
C:\Documents and Settings\NetworkService\Application Data\twain_32\user.ds - Deleted
C:\WINDOWS\system32\ClickToFindandFixErrors_RON.ico - Deleted
C:\WINDOWS\system32\TDSSxbad.dll - Deleted
C:\WINDOWS\system32\TDSSdirj.dat - Deleted
C:\WINDOWS\system32\TDSSfyaa.log - Deleted
C:\WINDOWS\system32\twain_32\local.ds - Deleted
C:\WINDOWS\system32\twain_32\user.ds - Deleted
C:\WINDOWS\system32\twext.exe - Deleted


Could Not Remove C:\WINDOWS\system32\TDSSkfrm.dll
Could Not Remove C:\WINDOWS\system32\TDSSjrlv.dll
Could Not Remove C:\WINDOWS\system32\TDSSfcof.dll
Could Not Remove C:\WINDOWS\system32\TDSSxnaq.dll

Folder C:\Documents and Settings\LocalService\Application Data\twain_32 - Removed
Folder C:\Documents and Settings\NetworkService\Application Data\twain_32 - Removed
Folder C:\Program Files\WinAble - Removed
Folder C:\WINDOWS\system32\twain_32 - Removed


Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-27 12:53:04
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden services & system hive …

disk error: C:\WINDOWS\system32\config\system, 0
scanning hidden registry entries …

disk error: C:\WINDOWS\system32\config\software, 0
disk error: C:\Documents and Settings\Chris Raymond\ntuser.dat, 0
scanning hidden files …

disk error: C:\WINDOWS\

please note that you need administrator rights to perform deep scan

Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplica

tions\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common

Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\Common Files\\AOL\\1156129707\\ee\\aolsoftware.exe"="C:\\Program Files\\Common

Files\\AOL\\1156129707\\ee\\aolsoftware.exe:*:Enabled:AOL Services"
"C:\\Program Files\\Common Files\\AOL\\1156129707\\ee\\aim6.exe"="C:\\Program Files\\Common

Files\\AOL\\1156129707\\ee\\aim6.exe:*:Enabled:AIM"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"="D:\\Program Files\\Atari\\Neverwinter Nights

2\\nwn2main.exe:*:Enabled:Neverwinter Nights 2 Main"
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"="D:\\Program Files\\Atari\\Neverwinter Nights

2\\nwn2main_amdxp.exe:*:Enabled:Neverwinter Nights 2 AMD"
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"="D:\\Program Files\\Atari\\Neverwinter Nights

2\\nwupdate.exe:*:Enabled:Neverwinter Nights 2 Updater"
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"="D:\\Program Files\\Atari\\Neverwinter Nights

2\\nwn2server.exe:*:Enabled:Neverwinter Nights 2 Server"
"D:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="D:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"D:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="D:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"D:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="D:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"D:\\Matrix Games\\UFO Extraterrestrials\\TrueUpdate.exe"="D:\\Matrix Games\\UFO

Extraterrestrials\\TrueUpdate.exe:*:Enabled:TrueUpdate 2.0 Client"
"D:\\Program Files\\LimeWire\\LimeWire.exe"="D:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"D:\\Program Files\\Steam\\Steam.exe"="D:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam Client"
"C:\\Program Files\\Roxio\\Digital Home 9\\RoxioUPnPRenderer9.exe"="C:\\Program Files\\Roxio\\Digital Home

9\\RoxioUPnPRenderer9.exe:*:Enabled:RoxioUPnPRenderer9"
"C:\\Documents and Settings\\Chris Raymond\\My

Documents\\Games\\WRE54GSetupWizard2.1.1.8\\WRE54GSetupWizard2.1.1.8\\Setup.exe"="C:\\Documents and Settings\\Chris

Raymond\\My Documents\\Games\\WRE54GSetupWizard2.1.1.8\\WRE54GSetupWizard2.1.1.8\\Setup.exe:*:Enabled:Setup"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplicati

ons\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Roxio\\Digital Home 9\\RoxioUPnPRenderer9.exe"="C:\\Program Files\\Roxio\\Digital Home

9\\RoxioUPnPRenderer9.exe:*:Enabled:RoxioUPnPRenderer9"

Remaining Files :

C:\WINDOWS\system32\TDSSkfrm.dll Found
C:\WINDOWS\system32\TDSSjrlv.dll Found
C:\WINDOWS\system32\TDSSfcof.dll Found
C:\WINDOWS\system32\TDSSxnaq.dll Found

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sun 13 Apr 2008 1,695,232 ..SH. — "C:\Program Files\Messenger\msmsgs.exe"
Tue 10 Jul 2007 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 28 Nov 2007 7,113,293 ..SH. — "C:\Documents and Settings\Chris Raymond\LMShared\Dream Aquarium XP_Vista

Screensaver\DreamXP.exe"
Sun 14 Dec 2008 1,714 …HR — "C:\Documents and Settings\Chris Raymond\Application

Data\SecuROM\UserData\securom_v7_01.bak"
Thu 20 Sep 2007 4,282 A.SH. — "C:\Documents and Settings\Chris Raymond\Application

Data\Roxio\Dragon\3.x\DiscInfoCache\LITE-ON_DVDRW_SOHW-1693S_KS0A_000_DICV018_DRGV9010000.TMP"
Thu 20 Sep 2007 2,198 A.SH. — "C:\Documents and Settings\Chris Raymond\Application

Data\Roxio\Dragon\3.x\DiscInfoCache\ZR4405G_IHC180P_2.0B_200_DICV018_DRGV9010000.TMP"


Finished!
Post #5
Make sure wordwrap is off

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.
Post #8
Same thing, I click it and my computer sounds like it is running for a few seconds and then nothing. It just appears as an active process in my task manager. This is the same thing that happened with SDFix that I had to extract on another PC and copy the folder over.
Post #9
Delete it and try this

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**
  • If you are using Firefox, make sure that your download settings are as follows:
    • Tools->Options->Main tab
    • Set to "Always ask me where to Save the files".
  • During the download, rename Combofix to Combo-Fix as follows:

    [external image: Posted Image]

    [external image: Posted Image]

  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    ———————————————————–

    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      ———————————————————–

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

    ———————————————————–

  • Double click on combo-Fix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**
Post #10
ok, that worked. Combo Fix log and new Hijackthis:

ComboFix 08-12-26.03 - Chris Raymond 2008-12-27 15:12:20.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2668 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll
c:\documents and settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\moduleie.dll
c:\documents and settings\Chris Raymond\Application Data\ICROSO~1
c:\program files\Spyware Guard 2008
c:\program files\Spyware Guard 2008\conf.cfg
c:\program files\Spyware Guard 2008\mbase.vdb
c:\program files\Spyware Guard 2008\quarantine.vdb
c:\program files\Spyware Guard 2008\queue.vdb
c:\program files\Spyware Guard 2008\spywareguard.exe
c:\program files\Spyware Guard 2008\uninstall.exe
c:\program files\Spyware Guard 2008\vbase.vdb
c:\windows\ggghkj.ini
c:\windows\hhjknn.ini
c:\windows\reged.exe
c:\windows\spoolsystem.exe
c:\windows\sys.com
c:\windows\syscert.exe
c:\windows\sysexplorer.exe
c:\windows\system32\drivers\TDSSrftc.sys
c:\windows\system32\jkse73hedfdgf.dll
c:\windows\system32\TDSSdirj.dat
c:\windows\system32\TDSSfcof.dll
c:\windows\system32\TDSSfyaa.log
c:\windows\system32\TDSSjrlv.dll
c:\windows\system32\TDSSkfrm.dll
c:\windows\system32\TDSSxbad.dll
c:\windows\system32\TDSSxnaq.dll
c:\windows\system32\winscenter.exe
c:\windows\vmreg.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_TDSSserv.sys
——-\Legacy_TDSSserv.sys


((((((((((((((((((((((((( Files Created from 2008-11-27 to 2008-12-27 )))))))))))))))))))))))))))))))
.

2008-12-27 12:37 . 2008-12-27 12:37 578,560 –a–c— c:\windows\system32\dllcache\user32.dll
2008-12-27 12:31 . 2008-12-27 12:32 d——– c:\windows\ERUNT
2008-12-27 12:29 . 2008-12-27 12:53 d——– C:\SDFix
2008-12-26 19:51 . 2008-12-26 18:53 812,344 –a—— C:\HJTInstall.exe
2008-12-26 15:54 . 2008-12-26 15:54 d——– C:\VundoFix Backups
2008-12-25 18:02 . 2008-12-25 18:02 d——– c:\documents and settings\All Users\Application Data\CrucialSoft Ltd
2008-12-25 18:02 . 2008-12-27 15:14 112,364 –a—— c:\windows\system32\drivers\c551d4ff.sys
2008-12-25 18:02 . 2008-12-25 18:02 81,931 –a—— C:\uyrte.exe
2008-12-25 18:01 . 2008-12-25 18:01 43,008 –a—— C:\wxqe.exe
2008-12-15 19:02 . 2008-12-15 19:02 d——– c:\program files\Hmonitor
2008-12-15 19:02 . 2008-11-12 17:47 10,536 –a—— c:\windows\system32\drivers\Hmonitor.sys
2008-12-11 22:43 . 2008-12-11 22:43 d——– c:\program files\K-Lite Codec Pack
2008-12-11 22:43 . 2007-09-04 11:56 164,352 –a—— c:\windows\system32\unrar.dll
2008-12-01 21:46 . 2008-12-01 21:46 d——– c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-26 19:32 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-15 23:55 ——— d—–w c:\program files\DivX
2008-12-11 19:51 ——— d—–w c:\program files\SUPERAntiSpyware
2008-12-11 19:33 ——— d—–w c:\program files\Java
2008-11-28 18:58 33,568 —-a-w c:\documents and settings\Chris Raymond\Application Data\GDIPFONTCACHEV1.DAT
2008-11-26 21:24 ——— d—–w c:\program files\iTunes
2008-11-26 21:24 ——— d—–w c:\program files\iPod
2008-11-26 21:24 ——— d—–w c:\program files\Common Files\Apple
2008-11-26 21:24 ——— d—–w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-26 21:23 ——— d—–w c:\program files\QuickTime
2008-11-26 02:47 ——— d—–w c:\documents and settings\Chris Raymond\Application Data\uTorrent
2008-11-21 00:02 ——— d—–w c:\program files\LineupDominator
2008-11-17 04:51 ——— d—–w c:\program files\Full Tilt Poker
2008-10-31 21:57 ——— d—–w c:\documents and settings\All Users\Application Data\Fallout3
2008-10-31 21:55 ——— d—–w c:\program files\MSBuild
2008-10-31 21:53 ——— d—–w c:\program files\Reference Assemblies
2008-10-31 21:50 107,888 —-a-w c:\windows\system32\CmdLineExt.dll
2008-10-23 12:36 286,720 —-a-w c:\windows\system32\gdi32.dll
2008-10-16 20:38 826,368 —-a-w c:\windows\system32\wininet.dll
2008-10-16 19:13 202,776 —-a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 —-a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 —-a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 —-a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 —-a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 —-a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 —-a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 —-a-w c:\windows\system32\wups.dll
2008-10-08 13:36 453,152 —-a-w c:\windows\system32\NVUNINST.EXE
2008-10-03 10:02 247,326 —-a-w c:\windows\system32\strmdll.dll
2006-08-21 03:40 1 —-a-w c:\documents and settings\Chris Raymond\SI.bin
2008-05-12 16:40 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008051220080513\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208]
"com.codeode.cactusspamfilter"="c:\program files\Cactus Spam Filter 2.13\cactusspamfilter.exe" [2006-04-30 749568]
"ImpulseFastStart"="d:\program files\Stardock\Impulse\Impulse.exe" [2008-09-11 1680696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2006-11-06 200704]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-08 13582336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MS AntiSpyware 2009"="c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe" [2008-12-25 1122304]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-10-17 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-11 14:51 352256 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
–a—— 2008-08-14 16:15 2407184 c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvcpldaemon]
–a—— 2008-10-08 14:52 13582336 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvmediacenter]
–a—— 2008-10-08 14:52 86016 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-11-04 10:30 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-06-10 04:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra—— 2006-03-30 15:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2008-10-08 14:52 1630208 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=
"d:\\Matrix Games\\UFO Extraterrestrials\\TrueUpdate.exe"=
"d:\\Program Files\\LimeWire\\LimeWire.exe"=
"d:\\Program Files\\Steam\\Steam.exe"=
"c:\\Documents and Settings\\Chris Raymond\\My Documents\\Games\\WRE54GSetupWizard2.1.1.8\\WRE54GSetupWizard2.1.1.8\\Setup.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-05-24 97928]
R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2006-10-10 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2007-02-27 55024]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-05-24 231704]
S3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2006-02-16 4096]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - g:\autorun\autorun.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-spywareguard - c:\program files\Spyware Guard 2008\spywareguard.exe
HKU-Default-Run-xsjfn83jkemfofght - c:\windows\TEMP\winlogin.exe
MSConfigStartUp-InfoData - c:\windows\jkhggg.dll


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000

c:\windows\Downloaded Program Files\sysreqlab3.dll - O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E}
hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
c:\windows\Downloaded Program Files\SysReqLab3.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-27 15:14:18
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TDSSserv.sys]
"imagepath"="\systemroot\system32\drivers\TDSSrftc.sys"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\c551d4ff]
"ImagePath"="\SystemRoot\System32\drivers\c551d4ff.sys"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(616)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
Completion time: 2008-12-27 15:15:13
ComboFix-quarantined-files.txt 2008-12-27 20:15:05

Pre-Run: 13,502,742,528 bytes free
Post-Run: 13,717,655,552 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

211 — E O F — 2008-12-19 00:18:31


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:18:03 PM, on 12/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [com.codeode.cactusspamfilter] "C:\Program Files\Cactus Spam Filter 2.13\cactusspamfilter.exe" -minimized
O4 - HKCU\..\Run: [ImpulseFastStart] "D:\Program Files\Stardock\Impulse\Impulse.exe" /fastload
O4 - HKUS\.DEFAULT\..\Run: [MS AntiSpyware 2009] "C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe" /autorun (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Unknown owner - C:\Program Files\Canon\CAL\CALMAIN.exe (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

–
End of file - 7972 bytes
Post #11
hello

Please download the OTMoveIt3 by OldTimer or from here.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
explorer.exe

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



Open notepad and copy/paste the text in the quotebox below into it:
http://forums.whatthetech.com/Browser_Internet_connection_Applications_Hijacked_t98314.html#entry513166

Collect::
c:\windows\system32\drivers\c551d4ff.sys
C:\uyrte.exe
C:\wxqe.exe

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\TDSSserv.sys]
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\c551d4ff]

Driver::
TDSSserv
c551d4ff

KillAll::

Suspect::
Save this as CFScript.txt


[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.
  • A browser will open.
  • Simply follow the instructions to copy/paste/send the requested file.
Post #12
ComboFix Log and Moveit Log, Movit said it was going to reboot but never did, I restarted it manually and then it picked up after reboot and generated the log.

ComboFix 08-12-26.03 - Chris Raymond 2008-12-27 15:34:23.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2653 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Chris Raymond\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\uyrte.exe
c:\windows\system32\drivers\c551d4ff.sys
C:\wxqe.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_c551d4ff


((((((((((((((((((((((((( Files Created from 2008-11-27 to 2008-12-27 )))))))))))))))))))))))))))))))
.

2008-12-27 15:26 . 2008-12-27 15:26 d——– C:\_OTMoveIt
2008-12-27 12:37 . 2008-12-27 12:37 578,560 –a–c— c:\windows\system32\dllcache\user32.dll
2008-12-27 12:31 . 2008-12-27 12:32 d——– c:\windows\ERUNT
2008-12-27 12:29 . 2008-12-27 12:53 d——– C:\SDFix
2008-12-26 19:51 . 2008-12-26 18:53 812,344 –a—— C:\HJTInstall.exe
2008-12-26 15:54 . 2008-12-26 15:54 d——– C:\VundoFix Backups
2008-12-25 18:02 . 2008-12-25 18:02 d——– c:\documents and settings\All Users\Application Data\CrucialSoft Ltd
2008-12-15 19:02 . 2008-12-15 19:02 d——– c:\program files\Hmonitor
2008-12-15 19:02 . 2008-11-12 17:47 10,536 –a—— c:\windows\system32\drivers\Hmonitor.sys
2008-12-11 22:43 . 2008-12-11 22:43 d——– c:\program files\K-Lite Codec Pack
2008-12-11 22:43 . 2007-09-04 11:56 164,352 –a—— c:\windows\system32\unrar.dll
2008-12-01 21:46 . 2008-12-01 21:46 d——– c:\program files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-26 19:32 ——— d–h–w c:\program files\InstallShield Installation Information
2008-12-15 23:55 ——— d—–w c:\program files\DivX
2008-12-11 19:51 ——— d—–w c:\program files\SUPERAntiSpyware
2008-12-11 19:33 ——— d—–w c:\program files\Java
2008-11-28 18:58 33,568 —-a-w c:\documents and settings\Chris Raymond\Application Data\GDIPFONTCACHEV1.DAT
2008-11-26 21:24 ——— d—–w c:\program files\iTunes
2008-11-26 21:24 ——— d—–w c:\program files\iPod
2008-11-26 21:24 ——— d—–w c:\program files\Common Files\Apple
2008-11-26 21:24 ——— d—–w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-26 21:23 ——— d—–w c:\program files\QuickTime
2008-11-26 02:47 ——— d—–w c:\documents and settings\Chris Raymond\Application Data\uTorrent
2008-11-21 00:02 ——— d—–w c:\program files\LineupDominator
2008-11-17 04:51 ——— d—–w c:\program files\Full Tilt Poker
2008-10-31 21:57 ——— d—–w c:\documents and settings\All Users\Application Data\Fallout3
2008-10-31 21:55 ——— d—–w c:\program files\MSBuild
2008-10-31 21:53 ——— d—–w c:\program files\Reference Assemblies
2006-08-21 03:40 1 —-a-w c:\documents and settings\Chris Raymond\SI.bin
2008-05-12 16:40 32,768 –sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008051220080513\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-12-27_15.14.45.64 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 01:02:28 163,328 —-a-w c:\windows\ERDNT\subs\ERDNT.EXE
- 2008-12-11 19:24:58 158,752 —-a-w c:\windows\system32\FNTCACHE.DAT
+ 2008-12-27 20:36:53 158,752 —-a-w c:\windows\system32\FNTCACHE.DAT
+ 2008-07-26 12:25:24 109,080 —-a-w c:\windows\temp\logishrd\LVPrcInj01.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-06-01 94208]
"com.codeode.cactusspamfilter"="c:\program files\Cactus Spam Filter 2.13\cactusspamfilter.exe" [2006-04-30 749568]
"ImpulseFastStart"="d:\program files\Stardock\Impulse\Impulse.exe" [2008-09-11 1680696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2006-11-06 200704]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-27 1261336]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-08 13582336]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MS AntiSpyware 2009"="c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe" [2008-12-25 1122304]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-10-17 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-11 14:51 352256 c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
–a—— 2008-08-14 16:15 2407184 c:\program files\Logitech\QuickCam\Quickcam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvcpldaemon]
–a—— 2008-10-08 14:52 13582336 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvmediacenter]
–a—— 2008-10-08 14:52 86016 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-11-04 10:30 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-06-10 04:27 144784 c:\program files\Java\jre1.6.0_07\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
-ra—— 2006-03-30 15:45 313472 c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2008-10-08 14:52 1630208 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=
"d:\\Matrix Games\\UFO Extraterrestrials\\TrueUpdate.exe"=
"d:\\Program Files\\LimeWire\\LimeWire.exe"=
"d:\\Program Files\\Steam\\Steam.exe"=
"c:\\Documents and Settings\\Chris Raymond\\My Documents\\Games\\WRE54GSetupWizard2.1.1.8\\WRE54GSetupWizard2.1.1.8\\Setup.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-05-24 97928]
R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2006-10-10 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2007-02-27 55024]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-05-24 231704]
S3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2006-02-16 4096]
.
Contents of the 'Scheduled Tasks' folder

2008-12-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\Office10\EXCEL.EXE/3000

c:\windows\Downloaded Program Files\sysreqlab3.dll - O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E}
hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
c:\windows\Downloaded Program Files\SysReqLab3.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-27 15:37:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(604)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
c:\program files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
c:\program files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-12-27 15:40:16 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-27 20:40:13
ComboFix2.txt 2008-12-27 20:15:14

Pre-Run: 13,698,011,136 bytes free
Post-Run: 13,580,877,824 bytes free

181 — E O F — 2008-12-19 00:18:31

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\CHRISR~1\LOCALS~1\Temp\History\History.IE5\MSHist012008122720081228\index.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\CHRISR~1\LOCALS~1\Temp\~DFCC0.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\CHRISR~1\LOCALS~1\Temp\~DFCCD.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12272008_152638

Files moved on Reboot…
C:\DOCUME~1\CHRISR~1\LOCALS~1\Temp\History\History.IE5\MSHist012008122720081228\index.dat moved successfully.
File C:\DOCUME~1\CHRISR~1\LOCALS~1\Temp\~DFCC0.tmp not found!
File C:\DOCUME~1\CHRISR~1\LOCALS~1\Temp\~DFCCD.tmp not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
Post #13
hello

Please download ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.




Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






Go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
Post #14
Malwarebytes and Kaspersky Logs: Malwarebytes' Anti-Malware 1.31 Database version: 1556 Windows 5.1.2600 Service Pack 3 12/27/2008 3:54:06 PM mbam-log-2008-12-27 (15-54-06).txt Scan type: Quick Scan Objects scanned: 53340 Time elapsed: 2 minute(s), 39 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 5 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 7 Files Infected: 8 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\Interface\{006c2f9b-122d-438f-bac0-de3c620d2ec6} (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{010653e4-75ec-4d9b-ae49-f64fc810770d} (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{01417316-4620-43c7-b635-f4f381596978} (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Spyware Guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{45dc33c5-0195-43ef-9c41-84098f66c4a3} (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ms antispyware 2009 (Rogue.MSAntivirus) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Documents and Settings\Chris Raymond\Start Menu\Programs\Spyware Guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009 (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\BASE (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\DELETED (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\SAVED (Rogue.Multiple) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe (Rogue.MSAntivirus) -> Quarantined and deleted successfully. C:\WINDOWS\system32\mlljj.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris Raymond\Start Menu\Programs\Spyware Guard 2008\Spyware Guard 2008.lnk (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris Raymond\Start Menu\Programs\Spyware Guard 2008\Uninstall.lnk (Rogue.SpywareGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20081225180253170.log (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Microsoft\Protect\svhost.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Microsoft\Protect\track.sys (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\rshkmpsptw.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. ——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Saturday, December 27, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, December 27, 2008 17:31:12 Records in database: 1521283 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan statistics: Files scanned: 64569 Threat name: 8 Infected objects: 17 Suspicious objects: 0 Duration of the scan: 01:13:15 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\c551d4ff.sys.vir Infected: Rootkit.Win32.Pakes.gi 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_c551d4ff_.sys.zip Infected: Rootkit.Win32.Pakes.gi 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\__.zip Infected: Backdoor.Win32.TDSS.bkw 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSfcof.dll.vir Infected: Backdoor.Win32.TDSS.atb 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSjrlv.dll.vir Infected: Backdoor.Win32.TDSS.asz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSkfrm.dll.vir Infected: Backdoor.Win32.TDSS.blh 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\TDSSxnaq.dll.vir Infected: Trojan.Win32.Agent.arvz 1 C:\Qoobox\Quarantine\[4]-[removed] Infected: Trojan.Win32.Agent.babd 1 C:\Qoobox\Quarantine\[4]-[removed] Infected: Rootkit.Win32.Pakes.gi 1 C:\SDFix\backups\catchme.zip Infected: Backdoor.Win32.TDSS.blh 2 C:\SDFix\backups\catchme.zip Infected: Backdoor.Win32.TDSS.asz 1 C:\SDFix\backups\catchme.zip Infected: Backdoor.Win32.TDSS.atb 1 C:\SDFix\backups\catchme.zip Infected: Trojan.Win32.Agent.arvz 1 C:\SDFix\backups\catchme.zip Infected: Backdoor.Win32.TDSS.bkw 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0DW6MWIJ\aasuper0[1].htm Infected: Trojan.Win32.Agent.babc 1 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\EXY8LPW9\aasuper2[1].htm Infected: Trojan.Win32.Agent.babd 1 The selected area was scanned.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI