unable to remove Troj_agent.fz
Hi,
I have a pc which is infected with the above virus, problem is its part of mfcdoc.dll which is part of the winlogon service, how can i get rid of it (the virus that is) :)
I have a pc which is infected with the above virus, problem is its part of mfcdoc.dll which is part of the winlogon service, how can i get rid of it (the virus that is) :)
ASKER
sorry XP professional, Is it possible to fix remotely via Network streaming?
ASKER
have tried latest trend office scan eng and ptn, and house call with no luck
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Yes, thats right - I'm looking at it now.
RF
RF
I don't see much of anything wrong in your log file - a 02 entry (we'll deal with that later) -
the one entry I'm wondering about is:
O20 - Winlogon Notify: mfcdoc - C:\WINDOWS\repair\mfcdoc.d
Let's try this -
Make sure "Show all Files and Folders", including hidden and system, is enabled.
Download L2mfix from one of these two locations:
http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe
Save the file to your desktop and double click "l2mfix.exe".
Click the "Install" button to extract the files and follow the prompts -
then open the newly added l2mfix folder on your desktop.
Double click "l2mfix.bat" and select option #1 for "Run Find Log" by typing 1 and then pressing enter.
This will scan your computer and it may appear nothing is happening -
then, after a minute or 2 (the time varies), notepad will open with a log.
Copy the contents of that log and paste it into this thread.
->-> IMPORTANT: <-<-
DO NOT run option #2 OR any other files in the l2mfix folder -
until you are asked to do so!
RF
the one entry I'm wondering about is:
O20 - Winlogon Notify: mfcdoc - C:\WINDOWS\repair\mfcdoc.d
Let's try this -
Make sure "Show all Files and Folders", including hidden and system, is enabled.
Download L2mfix from one of these two locations:
http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe
Save the file to your desktop and double click "l2mfix.exe".
Click the "Install" button to extract the files and follow the prompts -
then open the newly added l2mfix folder on your desktop.
Double click "l2mfix.bat" and select option #1 for "Run Find Log" by typing 1 and then pressing enter.
This will scan your computer and it may appear nothing is happening -
then, after a minute or 2 (the time varies), notepad will open with a log.
Copy the contents of that log and paste it into this thread.
->-> IMPORTANT: <-<-
DO NOT run option #2 OR any other files in the l2mfix folder -
until you are asked to do so!
RF
ASKER
L2MFIX find log 1.03
These are the registry keys present
**************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Softwa
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"Impersonate"=dword:000000
"DllName"=hex(2):63,00,72,
6c,00,00,00
"Logoff"="ChainWlxLogoffEv
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"Impersonate"=dword:000000
"DllName"=hex(2):63,00,72,
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogof
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEven
"Logoff"="WinlogonLogoffEv
"ScreenSaver"="WinlogonScr
"Startup"="WinlogonStartup
"Shutdown"="WinlogonShutdo
"StartShell"="WinlogonStar
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"DllName"="C:\\WINDOWS\\re
"Impersonate"=dword:000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertPro
"Logoff"="SCardStopCertPro
"Lock"="SCardSuspendCertPr
"Unlock"="SCardResumeCertP
"Enabled"=dword:00000001
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"DllName"=hex(2):77,00,6c,
6c,00,6c,00,00,00
"Impersonate"=dword:000000
"StartShell"="SchedStartSh
"Logoff"="SchedEventLogOff
[HKEY_LOCAL_MACHINE\Softwa
"Logoff"="WLEventLogoff"
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
"DllName"=hex(2):73,00,63,
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensSt
"StopScreenSaver"="SensSto
"Startup"="SensStartupEven
"Shutdown"="SensShutdownEv
"StartShell"="SensStartShe
"PostShell"="SensPostShell
"Disconnect"="SensDisconne
"Reconnect"="SensReconnect
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"DllName"=hex(2):77,00,6c,
6c,00,6c,00,00,00
"Impersonate"=dword:000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostSh
"Shutdown"="TSEventShutdow
"StartShell"="TSEventStart
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconn
"Disconnect"="TSEventDisco
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExp
"Logoff"="UnregisterTicket
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
**************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWA
"SV1"=""
**************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWA
"{00022613-0000-0000-C000-
"{176d6597-26d3-11d1-b350-
"{1F2E5C40-9550-11CE-99D2-
"{3EA48300-8CF6-101B-84FB-
"{40dd6e20-7c17-11ce-a804-
"{41E300E0-78B6-11ce-849B-
"{42071712-76d4-11d1-8b24-
"{42071713-76d4-11d1-8b24-
"{42071714-76d4-11d1-8b24-
"{4E40F770-369C-11d0-8922-
"{513D916F-2A8E-4F51-AEAB-
"{56117100-C0CD-101B-81E2-
"{59099400-57FF-11CE-BD94-
"{59be4990-f85c-11ce-aff7-
"{5DB2625A-54DF-11D0-B6C4-
"{675F097E-4C4D-11D0-B6C1-
"{764BF0E1-F219-11ce-972D-
"{77597368-7b15-11d0-a0c2-
"{7988B573-EC89-11cf-9C00-
"{853FE2B1-B769-11d0-9C4E-
"{85BBD920-42A0-1069-A2E4-
"{88895560-9AA2-1069-930E-
"{BD84B380-8CA2-1069-AB1D-
"{DBCE2480-C732-101B-BE72-
"{F37C5810-4D3F-11d0-B4BF-
"{f81e9010-6ea4-11ce-a7ff-
"{f92e8c40-3d33-11d2-b1aa-
"{7444C717-39BF-11D1-8CD9-
"{7444C719-39BF-11D1-8CD9-
"{7007ACC7-3202-11D1-AAD2-
"{992CFFA0-F557-101A-88EC-
"{E211B736-43FD-11D1-9EFB-
"{FB0C9C8A-6C50-11D1-9F1D-
"{905667aa-acd6-11d2-8080-
"{3F953603-1008-4f6e-A73A-
"{83bbcbf3-b28a-4919-a5aa-
"{F0152790-D56E-4445-850E-
"{5F327514-6C5E-4d60-8F16-
"{60254CA5-953B-11CF-8C96-
"{2206CDB2-19C1-11D1-89E0-
"{DD2110F0-9EEF-11cf-8D8E-
"{797F1E90-9EDD-11cf-8D8E-
"{D6277990-4C6A-11CF-8D87-
"{0DF44EAA-FF21-4412-828E-
"{2559a1f0-21d7-11d4-bdaf-
"{2559a1f1-21d7-11d4-bdaf-
"{2559a1f2-21d7-11d4-bdaf-
"{2559a1f3-21d7-11d4-bdaf-
"{2559a1f4-21d7-11d4-bdaf-
"{2559a1f5-21d7-11d4-bdaf-
"{D20EA4E1-3957-11d2-A40B-
"{D20EA4E1-3957-11d2-A40B-
"{875CB1A1-0F29-45de-A1AE-
"{40C3D757-D6E4-4b49-BB41-
"{E4B29F9D-D390-480b-92FD-
"{87D62D94-71B3-4b9a-9489-
"{A6FD9E45-6E44-43f9-8644-
"{c5a40261-cd64-4ccf-84cb-
"{5E6AB780-7743-11CF-A12B-
"{22BF0C20-6DA7-11D0-B373-
"{91EA3F8B-C99B-11d0-9815-
"{6413BA2C-B461-11d1-A18A-
"{F61FFEC1-754F-11d0-80CA-
"{7BA4C742-9E81-11CF-99D3-
"{30D02401-6A81-11d0-8274-
"{32683183-48a0-441b-a342-
"{169A0691-8DF9-11d1-A1C4-
"{07798131-AF23-11d1-9111-
"{AF4F6510-F982-11d0-8595-
"{01E04581-4EEE-11d0-BFE9-
"{A08C11D2-A228-11d0-825B-
"{00BB2763-6A77-11D0-A535-
"{7376D660-C583-11d0-A3A5-
"{6756A641-DE71-11d0-831B-
"{6935DB93-21E8-4ccc-BEB9-
"{7e653215-fa25-46bd-a339-
"{acf35015-526e-4230-9596-
"{E0E11A09-5CB8-4B6C-8332-
"{00BB2764-6A77-11D0-A535-
"{03C036F1-A186-11D0-824A-
"{00BB2765-6A77-11D0-A535-
"{ECD4FC4E-521C-11D0-B792-
"{3CCF8A41-5C85-11d0-9796-
"{ECD4FC4C-521C-11D0-B792-
"{ECD4FC4D-521C-11D0-B792-
"{DD313E04-FEFF-11d1-8ECD-
"{EF8AD2D1-AE36-11D1-B2D2-
"{EFA24E61-B078-11d0-89E4-
"{0A89A860-D7B1-11CE-8350-
"{E7E4BC40-E76A-11CE-A9BB-
"{A5E46E3A-8849-11D1-9D8C-
"{FBF23B40-E3F0-101B-8488-
"{3C374A40-BAE4-11CF-BF7D-
"{FF393560-C2A7-11CF-BFF4-
"{7BD29E00-76C1-11CF-9DD0-
"{7BD29E01-76C1-11CF-9DD0-
"{CFBFAE00-17A6-11D0-99CB-
"{A2B0DD40-CC59-11d0-A3A5-
"{67EA19A0-CCEF-11d0-8024-
"{131A6951-7F78-11D0-A979-
"{9461b922-3c5a-11d2-bf8b-
"{3DC7A020-0ACD-11CF-A9BB-
"{871C5380-42A0-1069-A2EA-
"{EFA24E64-B078-11d0-89E4-
"{9E56BE60-C50F-11CF-9A2C-
"{9E56BE61-C50F-11CF-9A2C-
"{88C6C381-2E85-11D0-94DE-
"{E6FB5E20-DE35-11CF-9C87-
"{ABBE31D0-6DAE-11D0-BECA-
"{F5175861-2688-11d0-9C5E-
"{08165EA0-E946-11CF-9C87-
"{E3A8BDE6-ABCE-11d0-BC4B-
"{E8BB6DC0-6B4E-11d0-92DB-
"{7D559C10-9FE9-11d0-93F7-
"{E6CC6978-6B6E-11D0-BECA-
"{D8BD2030-6FC9-11D0-864F-
"{7FC0B86E-5FA7-11d1-BC7C-
"{352EC2B7-8B9A-11D1-B8AE-
"{0B124F8F-91F0-11D1-B8B5-
"{CFCCC7A0-A282-11D1-9082-
"{e84fda7c-1d6a-45f6-b725-
"{66e4e4fb-f385-4dd0-8d74-
"{3F30C968-480A-4C6C-862D-
"{9DBD2C50-62AD-11d0-B806-
"{EAB841A0-9550-11cf-8C16-
"{eb9b1153-3b57-4e68-959a-
"{CC6EEFFB-43F6-46c5-9619-
"{add36aa8-751a-4579-a266-
"{6b33163c-76a5-4b6c-bf21-
"{58f1f272-9240-4f51-b6d4-
"{7A9D77BD-5403-11d2-8785-
"{BD472F60-27FA-11cf-B8B4-
"{888DCA60-FC0A-11CF-8F0F-
"{f39a0dc0-9cc8-11d0-a599-
"{f3aa0dc0-9cc8-11d0-a599-
"{f3ba0dc0-9cc8-11d0-a599-
"{f3da0dc0-9cc8-11d0-a599-
"{f3ea0dc0-9cc8-11d0-a599-
"{63da6ec0-2e98-11cf-8d82-
"{883373C3-BF89-11D1-BE35-
"{A9CF0EAE-901A-4739-A481-
"{8EE97210-FD1F-4B19-91DA-
"{0EEA25CC-4362-4A12-850B-
"{6A205B57-2567-4A2C-B881-
"{28F8A4AC-BBB3-4D9B-B177-
"{8A23E65E-31C2-11d0-891C-
"{9E51E0D0-6E0F-11d2-9601-
"{163FDC20-2ABC-11d0-88F0-
"{F020E586-5264-11d1-A532-
"{0D45D530-764B-11d0-A1CA-
"{62AE1F9A-126A-11D0-A14B-
"{ECF03A33-103D-11d2-854D-
"{ECF03A32-103D-11d2-854D-
"{4a7ded0a-ad25-11d0-98a8-
"{750fdf0e-2a26-11d1-a3ea-
"{10CFC467-4392-11d2-8DB4-
"{AFDB1F70-2A4C-11d2-9039-
"{143A62C8-C33B-11D1-84FE-
"{ECCDF543-45CC-11CE-B9BF-
"{60fd46de-f830-4894-a628-
"{7A80E4A8-8005-11D2-BCF8-
"{0CD7A5C0-9F37-11CE-AE65-
"{32714800-2E5F-11d0-8B85-
"{8DD448E6-C188-4aed-AF92-
"{CE3FB1D1-02AE-4a5f-A6E9-
"{F1B9284F-E9DC-4e68-9D7E-
"{40E85620-3DCB-11D3-8A0D-
"{BDEADF00-C265-11D0-BCED-
"{00020D75-0000-0000-C000-
"{0006F045-0000-0000-C000-
"{42042206-2D85-11D3-8CFF-
"{2559a1f7-21d7-11d4-bdaf-
"{596AB062-B4D2-4215-9F74-
"{9DB7A13C-F208-4981-8353-
"{692F0339-CBAA-47e6-B5B5-
"{e57ce731-33e8-4c51-8354-
"{640167b4-59b0-47a6-b335-
"{cc86590a-b60a-48e6-996b-
**************************
HKEY ROOT CLASSIDS:
**************************
Files Found are not all bad files:
C:\WINDOWS\SYSTEM32\
authz.dll Wed 2 Mar 2005 19:09:30 A.... 56,832 55.50 K
browseui.dll Thu 10 Mar 2005 9:02:34 A.... 1,016,832 993.00 K
cdfview.dll Thu 10 Mar 2005 9:02:34 A.... 151,040 147.50 K
iepeers.dll Thu 10 Mar 2005 9:02:34 A.... 250,880 245.00 K
inseng.dll Thu 10 Mar 2005 9:02:34 A.... 96,256 94.00 K
mshtml.dll Thu 10 Mar 2005 9:02:34 A.... 3,010,560 2.87 M
msi.dll Mon 21 Mar 2005 15:00:20 A.... 2,890,240 2.75 M
msihnd.dll Mon 21 Mar 2005 15:00:22 A.... 271,360 265.00 K
msimsg.dll Mon 21 Mar 2005 15:00:22 A.... 884,736 864.00 K
msisip.dll Mon 21 Mar 2005 15:00:22 A.... 15,360 15.00 K
msrating.dll Thu 10 Mar 2005 9:02:34 A.... 146,432 143.00 K
shdocvw.dll Thu 10 Mar 2005 9:02:34 A.... 1,483,264 1.41 M
shell32.dll Tue 1 Mar 2005 0:11:18 A.... 8,450,048 8.06 M
shlwapi.dll Thu 10 Mar 2005 9:02:34 A.... 473,600 462.50 K
spmsg.dll Thu 24 Feb 2005 19:35:06 ..... 14,048 13.72 K
urlmon.dll Thu 10 Mar 2005 9:02:36 A.... 607,744 593.50 K
user32.dll Wed 2 Mar 2005 19:09:30 A.... 577,024 563.50 K
wininet.dll Thu 10 Mar 2005 9:02:36 A.... 656,896 641.50 K
winsrv.dll Wed 2 Mar 2005 19:09:30 A.... 291,328 284.50 K
19 items found: 19 files, 0 directories.
Total of file sizes: 21,344,480 bytes 20.36 M
Locate .tmp files:
No matches found.
**************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 7594-4EC0
Directory of C:\WINDOWS\System32
18/05/2005 12:14 4,096 psc.exe
19/04/2005 20:39 <DIR> dllcache
05/07/2004 22:57 <DIR> Microsoft
1 File(s) 4,096 bytes
2 Dir(s) 1,931,616,256 bytes free
These are the registry keys present
**************************
Winlogon/notify:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Softwa
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"Impersonate"=dword:000000
"DllName"=hex(2):63,00,72,
6c,00,00,00
"Logoff"="ChainWlxLogoffEv
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"Impersonate"=dword:000000
"DllName"=hex(2):63,00,72,
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogof
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEven
"Logoff"="WinlogonLogoffEv
"ScreenSaver"="WinlogonScr
"Startup"="WinlogonStartup
"Shutdown"="WinlogonShutdo
"StartShell"="WinlogonStar
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"DllName"="C:\\WINDOWS\\re
"Impersonate"=dword:000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertPro
"Logoff"="SCardStopCertPro
"Lock"="SCardSuspendCertPr
"Unlock"="SCardResumeCertP
"Enabled"=dword:00000001
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"DllName"=hex(2):77,00,6c,
6c,00,6c,00,00,00
"Impersonate"=dword:000000
"StartShell"="SchedStartSh
"Logoff"="SchedEventLogOff
[HKEY_LOCAL_MACHINE\Softwa
"Logoff"="WLEventLogoff"
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
"DllName"=hex(2):73,00,63,
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensSt
"StopScreenSaver"="SensSto
"Startup"="SensStartupEven
"Shutdown"="SensShutdownEv
"StartShell"="SensStartShe
"PostShell"="SensPostShell
"Disconnect"="SensDisconne
"Reconnect"="SensReconnect
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"DllName"=hex(2):77,00,6c,
6c,00,6c,00,00,00
"Impersonate"=dword:000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostSh
"Shutdown"="TSEventShutdow
"StartShell"="TSEventStart
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconn
"Disconnect"="TSEventDisco
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExp
"Logoff"="UnregisterTicket
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
**************************
useragent:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWA
"SV1"=""
**************************
Shell Extension key:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWA
"{00022613-0000-0000-C000-
"{176d6597-26d3-11d1-b350-
"{1F2E5C40-9550-11CE-99D2-
"{3EA48300-8CF6-101B-84FB-
"{40dd6e20-7c17-11ce-a804-
"{41E300E0-78B6-11ce-849B-
"{42071712-76d4-11d1-8b24-
"{42071713-76d4-11d1-8b24-
"{42071714-76d4-11d1-8b24-
"{4E40F770-369C-11d0-8922-
"{513D916F-2A8E-4F51-AEAB-
"{56117100-C0CD-101B-81E2-
"{59099400-57FF-11CE-BD94-
"{59be4990-f85c-11ce-aff7-
"{5DB2625A-54DF-11D0-B6C4-
"{675F097E-4C4D-11D0-B6C1-
"{764BF0E1-F219-11ce-972D-
"{77597368-7b15-11d0-a0c2-
"{7988B573-EC89-11cf-9C00-
"{853FE2B1-B769-11d0-9C4E-
"{85BBD920-42A0-1069-A2E4-
"{88895560-9AA2-1069-930E-
"{BD84B380-8CA2-1069-AB1D-
"{DBCE2480-C732-101B-BE72-
"{F37C5810-4D3F-11d0-B4BF-
"{f81e9010-6ea4-11ce-a7ff-
"{f92e8c40-3d33-11d2-b1aa-
"{7444C717-39BF-11D1-8CD9-
"{7444C719-39BF-11D1-8CD9-
"{7007ACC7-3202-11D1-AAD2-
"{992CFFA0-F557-101A-88EC-
"{E211B736-43FD-11D1-9EFB-
"{FB0C9C8A-6C50-11D1-9F1D-
"{905667aa-acd6-11d2-8080-
"{3F953603-1008-4f6e-A73A-
"{83bbcbf3-b28a-4919-a5aa-
"{F0152790-D56E-4445-850E-
"{5F327514-6C5E-4d60-8F16-
"{60254CA5-953B-11CF-8C96-
"{2206CDB2-19C1-11D1-89E0-
"{DD2110F0-9EEF-11cf-8D8E-
"{797F1E90-9EDD-11cf-8D8E-
"{D6277990-4C6A-11CF-8D87-
"{0DF44EAA-FF21-4412-828E-
"{2559a1f0-21d7-11d4-bdaf-
"{2559a1f1-21d7-11d4-bdaf-
"{2559a1f2-21d7-11d4-bdaf-
"{2559a1f3-21d7-11d4-bdaf-
"{2559a1f4-21d7-11d4-bdaf-
"{2559a1f5-21d7-11d4-bdaf-
"{D20EA4E1-3957-11d2-A40B-
"{D20EA4E1-3957-11d2-A40B-
"{875CB1A1-0F29-45de-A1AE-
"{40C3D757-D6E4-4b49-BB41-
"{E4B29F9D-D390-480b-92FD-
"{87D62D94-71B3-4b9a-9489-
"{A6FD9E45-6E44-43f9-8644-
"{c5a40261-cd64-4ccf-84cb-
"{5E6AB780-7743-11CF-A12B-
"{22BF0C20-6DA7-11D0-B373-
"{91EA3F8B-C99B-11d0-9815-
"{6413BA2C-B461-11d1-A18A-
"{F61FFEC1-754F-11d0-80CA-
"{7BA4C742-9E81-11CF-99D3-
"{30D02401-6A81-11d0-8274-
"{32683183-48a0-441b-a342-
"{169A0691-8DF9-11d1-A1C4-
"{07798131-AF23-11d1-9111-
"{AF4F6510-F982-11d0-8595-
"{01E04581-4EEE-11d0-BFE9-
"{A08C11D2-A228-11d0-825B-
"{00BB2763-6A77-11D0-A535-
"{7376D660-C583-11d0-A3A5-
"{6756A641-DE71-11d0-831B-
"{6935DB93-21E8-4ccc-BEB9-
"{7e653215-fa25-46bd-a339-
"{acf35015-526e-4230-9596-
"{E0E11A09-5CB8-4B6C-8332-
"{00BB2764-6A77-11D0-A535-
"{03C036F1-A186-11D0-824A-
"{00BB2765-6A77-11D0-A535-
"{ECD4FC4E-521C-11D0-B792-
"{3CCF8A41-5C85-11d0-9796-
"{ECD4FC4C-521C-11D0-B792-
"{ECD4FC4D-521C-11D0-B792-
"{DD313E04-FEFF-11d1-8ECD-
"{EF8AD2D1-AE36-11D1-B2D2-
"{EFA24E61-B078-11d0-89E4-
"{0A89A860-D7B1-11CE-8350-
"{E7E4BC40-E76A-11CE-A9BB-
"{A5E46E3A-8849-11D1-9D8C-
"{FBF23B40-E3F0-101B-8488-
"{3C374A40-BAE4-11CF-BF7D-
"{FF393560-C2A7-11CF-BFF4-
"{7BD29E00-76C1-11CF-9DD0-
"{7BD29E01-76C1-11CF-9DD0-
"{CFBFAE00-17A6-11D0-99CB-
"{A2B0DD40-CC59-11d0-A3A5-
"{67EA19A0-CCEF-11d0-8024-
"{131A6951-7F78-11D0-A979-
"{9461b922-3c5a-11d2-bf8b-
"{3DC7A020-0ACD-11CF-A9BB-
"{871C5380-42A0-1069-A2EA-
"{EFA24E64-B078-11d0-89E4-
"{9E56BE60-C50F-11CF-9A2C-
"{9E56BE61-C50F-11CF-9A2C-
"{88C6C381-2E85-11D0-94DE-
"{E6FB5E20-DE35-11CF-9C87-
"{ABBE31D0-6DAE-11D0-BECA-
"{F5175861-2688-11d0-9C5E-
"{08165EA0-E946-11CF-9C87-
"{E3A8BDE6-ABCE-11d0-BC4B-
"{E8BB6DC0-6B4E-11d0-92DB-
"{7D559C10-9FE9-11d0-93F7-
"{E6CC6978-6B6E-11D0-BECA-
"{D8BD2030-6FC9-11D0-864F-
"{7FC0B86E-5FA7-11d1-BC7C-
"{352EC2B7-8B9A-11D1-B8AE-
"{0B124F8F-91F0-11D1-B8B5-
"{CFCCC7A0-A282-11D1-9082-
"{e84fda7c-1d6a-45f6-b725-
"{66e4e4fb-f385-4dd0-8d74-
"{3F30C968-480A-4C6C-862D-
"{9DBD2C50-62AD-11d0-B806-
"{EAB841A0-9550-11cf-8C16-
"{eb9b1153-3b57-4e68-959a-
"{CC6EEFFB-43F6-46c5-9619-
"{add36aa8-751a-4579-a266-
"{6b33163c-76a5-4b6c-bf21-
"{58f1f272-9240-4f51-b6d4-
"{7A9D77BD-5403-11d2-8785-
"{BD472F60-27FA-11cf-B8B4-
"{888DCA60-FC0A-11CF-8F0F-
"{f39a0dc0-9cc8-11d0-a599-
"{f3aa0dc0-9cc8-11d0-a599-
"{f3ba0dc0-9cc8-11d0-a599-
"{f3da0dc0-9cc8-11d0-a599-
"{f3ea0dc0-9cc8-11d0-a599-
"{63da6ec0-2e98-11cf-8d82-
"{883373C3-BF89-11D1-BE35-
"{A9CF0EAE-901A-4739-A481-
"{8EE97210-FD1F-4B19-91DA-
"{0EEA25CC-4362-4A12-850B-
"{6A205B57-2567-4A2C-B881-
"{28F8A4AC-BBB3-4D9B-B177-
"{8A23E65E-31C2-11d0-891C-
"{9E51E0D0-6E0F-11d2-9601-
"{163FDC20-2ABC-11d0-88F0-
"{F020E586-5264-11d1-A532-
"{0D45D530-764B-11d0-A1CA-
"{62AE1F9A-126A-11D0-A14B-
"{ECF03A33-103D-11d2-854D-
"{ECF03A32-103D-11d2-854D-
"{4a7ded0a-ad25-11d0-98a8-
"{750fdf0e-2a26-11d1-a3ea-
"{10CFC467-4392-11d2-8DB4-
"{AFDB1F70-2A4C-11d2-9039-
"{143A62C8-C33B-11D1-84FE-
"{ECCDF543-45CC-11CE-B9BF-
"{60fd46de-f830-4894-a628-
"{7A80E4A8-8005-11D2-BCF8-
"{0CD7A5C0-9F37-11CE-AE65-
"{32714800-2E5F-11d0-8B85-
"{8DD448E6-C188-4aed-AF92-
"{CE3FB1D1-02AE-4a5f-A6E9-
"{F1B9284F-E9DC-4e68-9D7E-
"{40E85620-3DCB-11D3-8A0D-
"{BDEADF00-C265-11D0-BCED-
"{00020D75-0000-0000-C000-
"{0006F045-0000-0000-C000-
"{42042206-2D85-11D3-8CFF-
"{2559a1f7-21d7-11d4-bdaf-
"{596AB062-B4D2-4215-9F74-
"{9DB7A13C-F208-4981-8353-
"{692F0339-CBAA-47e6-B5B5-
"{e57ce731-33e8-4c51-8354-
"{640167b4-59b0-47a6-b335-
"{cc86590a-b60a-48e6-996b-
**************************
HKEY ROOT CLASSIDS:
**************************
Files Found are not all bad files:
C:\WINDOWS\SYSTEM32\
authz.dll Wed 2 Mar 2005 19:09:30 A.... 56,832 55.50 K
browseui.dll Thu 10 Mar 2005 9:02:34 A.... 1,016,832 993.00 K
cdfview.dll Thu 10 Mar 2005 9:02:34 A.... 151,040 147.50 K
iepeers.dll Thu 10 Mar 2005 9:02:34 A.... 250,880 245.00 K
inseng.dll Thu 10 Mar 2005 9:02:34 A.... 96,256 94.00 K
mshtml.dll Thu 10 Mar 2005 9:02:34 A.... 3,010,560 2.87 M
msi.dll Mon 21 Mar 2005 15:00:20 A.... 2,890,240 2.75 M
msihnd.dll Mon 21 Mar 2005 15:00:22 A.... 271,360 265.00 K
msimsg.dll Mon 21 Mar 2005 15:00:22 A.... 884,736 864.00 K
msisip.dll Mon 21 Mar 2005 15:00:22 A.... 15,360 15.00 K
msrating.dll Thu 10 Mar 2005 9:02:34 A.... 146,432 143.00 K
shdocvw.dll Thu 10 Mar 2005 9:02:34 A.... 1,483,264 1.41 M
shell32.dll Tue 1 Mar 2005 0:11:18 A.... 8,450,048 8.06 M
shlwapi.dll Thu 10 Mar 2005 9:02:34 A.... 473,600 462.50 K
spmsg.dll Thu 24 Feb 2005 19:35:06 ..... 14,048 13.72 K
urlmon.dll Thu 10 Mar 2005 9:02:36 A.... 607,744 593.50 K
user32.dll Wed 2 Mar 2005 19:09:30 A.... 577,024 563.50 K
wininet.dll Thu 10 Mar 2005 9:02:36 A.... 656,896 641.50 K
winsrv.dll Wed 2 Mar 2005 19:09:30 A.... 291,328 284.50 K
19 items found: 19 files, 0 directories.
Total of file sizes: 21,344,480 bytes 20.36 M
Locate .tmp files:
No matches found.
**************************
Directory Listing of system files:
Volume in drive C has no label.
Volume Serial Number is 7594-4EC0
Directory of C:\WINDOWS\System32
18/05/2005 12:14 4,096 psc.exe
19/04/2005 20:39 <DIR> dllcache
05/07/2004 22:57 <DIR> Microsoft
1 File(s) 4,096 bytes
2 Dir(s) 1,931,616,256 bytes free
Navigate to this file:
C:\WINDOWS\repair\mfcdoc.d
Check it's properties.
Let me know what they are.
It's very unusual to see a "Winlogon" entry running from the "repair" folder -
let me know what other files are in there - the "repair" folder.
RF
C:\WINDOWS\repair\mfcdoc.d
Check it's properties.
Let me know what they are.
It's very unusual to see a "Winlogon" entry running from the "repair" folder -
let me know what other files are in there - the "repair" folder.
RF
ASKER
autoexec.nt
codcfm.bak1
codcfm.bak2
codcfm.ini
config.nt
default
DS_SAM
DS_SECURITY
DS_SOFTWARE
mfcdoc.dll
moveonb.exe
ntuser.dat
sam
secsetup.inf
security
setup.log
software
system.bak
zap.exe
codcfm.bak1
codcfm.bak2
codcfm.ini
config.nt
default
DS_SAM
DS_SECURITY
DS_SOFTWARE
mfcdoc.dll
moveonb.exe
ntuser.dat
sam
secsetup.inf
security
setup.log
software
system.bak
zap.exe
Check the properties on:
moveonb.exe
mfcdoc.dll
zap.exe
codcfm.ini
Let me know what they are.
RF
moveonb.exe
mfcdoc.dll
zap.exe
codcfm.ini
Let me know what they are.
RF
ASKER
moveonb.exe and zap.exe was my attempt to kill the winlogon service.
mfcdoc.dll Unknown application
codcfm.ini opens with note pad and is hidden
mfcdoc.dll Unknown application
codcfm.ini opens with note pad and is hidden
Can you open codcfm.ini in Notepad and copy and paste the contents back here.
ASKER
âpRÓ Š ` ê ê ê
" " «b Íc ác ác ác 4 d d d d !d Ï694ÄdŠ8¨²v4ec0V/Pv4ec0[
WYwUB QC\VZq_EUWa7/cL
K[ ]L\@AJGLXQMJN
X]PXGDGCME@UQG KBRR\LDGMLJ@V JRiW[ e HCJF@\FMGS Oo;Em H WRMINDPXFW? TZTIOKlI E^Klk i A G\SQ BUVUVGZ\hK _ZH 9\L @QCKXM 8nhILKBRR\LDGMLT[[A? TZTIOKlI @ ]DBojC>J F UOE \[AQQC lVVYIKIk
E MLF@\FML^Klk i A G\SQ BUXF^FMUhK _ZH 9\L EHQKTHDH_ BojC>J F UOE UkXX@YDAXh ]J hZ HHULVDIHU
Nbj8HM FQHG ODVCPG@? TZeA e HCJFIXEUAGIXE[L^Klk i A G\SQ BUY_YiW[ e HMEL MUUF\UF l e R \SRQM BSF H@PT Nbj8HM FQHG OQMZWhM h KK LKGRWJQU Xkh
U[Q_Q _EQJ FS BojC>J F UOE ]VOVZhKBJ hZ I LJ@P[GQS_i hZYRY]_ GXG]G X QOo;Em H WRMINQZTC[Z9MSXiA_M
TD HVLngiN KQS @OU G_ZeW
M h E DKMHoFIXGk AKTJk[ \VFMZU
Nbj8HM FQHG O \kZ[YM iHLKABPKMHoFIXGk AKTJk[JLngiN KQS @OU
lQ\IOKlI EXkid IGJEP^QLA NX[X9MVEH 9\L EHUELEUD<DRGTG Xkid IGJEP^QLA NX[X9MSXiA_M iHLKAKDLQF QGFf@QC BojC>J F UOE BPZJh l@RIOKlI G BT]MQFLngiN KQS @OUZRPOQG9MSXXD M?K ULF Oo;Em H WRMINQD^SQQCkZ[hK
Nbj8HM FQHG O_ZOeW
M h EDEE 8nhILKBRR\LDGMLTM@hKUC
M h EF@\FMXkid IGJEP^QLA N[AM9MSXXD M?KEAXkid IGJEP^QLA NZ]FYCVP@M9MSXXD M?KGQS_BojC>J F UOE ^RAeW
M h EFBojC>J F UOE ^YiW[ e HCJABPKM 8nhILKBRR\LDGMLVVYQI
M h E\P@C[LngiN KQS @OW
@BF\FB ? TZTIOKlI EBNBojC>J F UOE BV\^GX DkVFSM iHLERG@ O>=j D MUPPADKHKTCJh ]J hZ DLQF ^Klk i A G\SQ BPQD^X\h ]J hZ ^\MC
T
Nbj8HM FQHG O
^XVZX Uk]QIKIk
E MERG@HCA BojC>J F UOE YEPZ@\ lVVYIKIk
E I
Nbj8HM FQHG O_Mi[F e HCJCRTKW\Xkid IGJEP^QLA N][S
\RiW[ e HCJFIH_CL^Klk i A G\SQ BP[EGiW[ e HCJ[
Nbj8HM FQHG OEPFM[F ? TZTIOKlI G BT]Oo;Em H WRMINUVGM\X [kWQ@M iHLLngiN KQS @OQIkZ[YM iHLKCX\WWXU@ZKPGQC\M
^TYLPQ BSFEGU
D[P @QK 9\Klk i A G\SQ BQVlVVhM h E FV]ZESPN[FLDTM]@ LF@\FMW? W h 8nhILKBRR\LDGMLPWS] iW[ e HCJA
Nbj8HM FQHG O YY\VZG9MSXXD M?KGQS_jJ@F W
Nbj8HM FQHG O S^A\h ]J hZ H_C
Nbj8HM FQHG O
^STK@]UDiW[ e HCJ[RLOo;Em H WRMINV^[]]U9M^RAD M?KEA I
Nbj8HM FQHG O
BRWXXX9MTRH 9\L H O>=j D MUPPADKHKQG\QR TkZ[YM iHLERG@ O>=j D MUPPADKHKQG\QG FRiW[ e HCJA
Nbj8HM FQHG ODXGeW
M 9\L ^@kI@ZKPGXJL RLO^N Lkid IGJEP^QLA N^]@
? TZTIOKlI EBNBojC>J F UOE _TYPW_9MSXXD M?KGQS_BojC>J F UOE __\Ih ]J hZ FZ O>=j D MUPPADKHK_TURhKRVLeW
M h E\P@C[LngiN KQS @O\lVVYIKIk
E D
Nbj8HM FQHG O VXFIUW ? TZTIOKlI GKDWHEJLngiN KQS @O]
\[T^QhK _ZH 9\L HFMXkid IGJEP^QLA NPC[ ? TZTIOKlI G BT]_[FXkid IGJEP^QLA NPLE
S\iW[ e HCJABPKM 8nhILKBRR\LDGML_ZDQ UNiW[ e HCJCRTKW\B^[^ O>=j D MUPPADKHK\TW[[UkZ[YM
? TZeA e HCJC^A\GQS_DLQF ^Klk i A G\SQ B_X D@Z\Q ? SPD M?KEA I
Nbj8HM FQHG O
^\OeW
M h ECPKY 8nhILKBRR\LDGMLYV[_Q
M h E\P@ O>=j D MUPPADKHK[ZV_GBCiW[9M
E ^Klk i A G\SQ BXM CkZ[YM iHLKABPKMHAKRMk_ GXG]G Xkid IGJEP^QLA NUMW
lQ\IOKlI UELEDGJLngiN KQS @OX _DiW[9ME\H 9\L EA IKEJP Xkid IGJEP^QLA NTUYlVVYIKIk
E UELOo;Em H WRMIN]VFMQF9MSXXD M?KE 8nhILKBRR\LDGMLX\SU lVVYIKIlNbj8HM FQHG OWVB\VhK _ZH hZkid IGJEP^QLA NTQF ZP]W[9MSXXD M?KGQS_A\L@Xkid IGJEP^QLA NTQ@ BVBUQF9MSXXD M?KE 8nhILKBRR\LDGMLXVZP
UVGZ\hK _ZH 9\L HAQLngiN KQS @OY
CCPKh ]J hZ DOo;Em H WRMIN]D[eW
M h EFBojC>J F UOE CYiPQM iHLLngiN KQS @OYlPJIOKlI EXkid IGJEP^QLA NTGZ9MCRH 9\L H O>=j D MUPPADKHKZFWh l@RIOKlI EXkid IGJEP^QLA N^h^kZ[YL BFQDTSih MJ F UOE UVGZ\hKCYiW[ EPJAX o C>A
Nbj8HM FQHG OCRTKW\9MSXXD M?K G BT]_[FChDEUG:@FIXGk
Nbj8HM FQHG OC^XVZhK _ZH 9\L EHL^[IA@I@ZKP Xkid IGJEP^QLA NWQ@ QGPeW
M h EF@\FMXkid IGJEP^QLA NWQLWkZ[YM iHLUVGZ\ 8nhILKBRR\LDGML[VF@BY
E I@ZKPGXkid IGJEP^QLA NIUS UR^\FhK _ZH 9\L JQU X
Nbj8HM FQHG OYTP^FUUEiW[ e HCJVXGTk_ GXG] O>=j D MUPPADKHKDPXFWRiW[ e HCJABPKM 8nhILKBRR\LDGMLF\UF [^[^h ]J hZ ^\MC
T
Nbj8HM FQHG OQEVQFQ\CiZQ e HCJCPKYHJLngiN KQS @OG
_BBXZZ? TZTIOKlI C
TDBojC>J F UOE ET]\ZhK _ZH 9\L H O>=j D MUPPADKHKD@IQFWRFeW
M h E [EW Xkid IGJEP^QLA NJAF UR^\FhK _ZH 9\L JQU X
Nbj8HM FQHG OBPPMh ]J hZ SPQXK K P I@ZKPGXkid IGJEP^QLA NMQWQER\@hK _ZH 9\L HAQLngiN KQS @O@ ]ViW[ e HCJkFAd O>=j D MUPPADKHKC\Z_QQDA\FhK _ZH 9\L RQM BSBojC>J F UOE YDVXX]M h E\P@ O>=j D MUPPADKHKC\JWU
YCH 9\L RQMXkid IGJEP^QLA NM]G\^iW[9ME\H 9\L HAQLngiN KQS @O@RXSPZP9MSXXD M?K@QC
Nbj8HM FQHG O
BP\U][9MYCH 9\L HG 8nhILKBRR\LDGMLBXXYD
E MQKCIHB
@ BojC>J F UOE UVGZ\ XXZW[ DPXFWMl
iDXkid IGJEP^QLA NU[[? TZTIOKlI EXkid IGJEP^QLA NQ[@ DkZ[YM iHLERG@ O>=j D MUPPADKHKDPXFW? TZTIOKlI EXkid IGJEP^QLA NVZQ _\iW[ e HCJG
Nbj8HM FQHG OC^[\GG9MSXXD M?KEA I
Nbj8HM FQHG O^kZ[YM iHLDCBojC>J F UOE ID\T[Z9MSXXD M?KE@Xkid IGJEP^QLA N\D]
_YFeW
M h EDPXFW<CCGPZSXkid IGJEP^QLA NJ\[UEJQU XkZZQ? TZTIOKlI EXkid IGJEP^QLA NZ]@ UVGZ\hK _ZH 9\L N\QLngiN KQS @OZYX[XXhK YCLJQU XkZ[YM iHLERG@ O>=j D MUPPADKHKRCP@Q9MSXXD M?K_Q _EQJ O>=j D MUPPADKHKP\_@G9MSXXD M?KEA I
Nbj8HM FQHG OQGiW[ e HCJABPKM 8nhILKBRR\LDGMLFZ]Fl
E ^Klk i A G\SQ BUX QkZ[YM iHLLngiN KQS @OV [RY\MhKTBH 9\L RQM BSFOo;Em H WRMINWXZ^XQ9MSXXD M?KE 8nhIL _GAP[ZGZJ]@ ^EVDAA VVAZA DF B^A@UAJHB_Q _EQJg BT]GAWXZ^XQGACRTKW\KQ
F\UF ZFWW
BNC \DPXFWMSXXG BT]JW[ TZT^XZ]XQK _ZGQS_\VU MSXXG BT] G @YTOW
PXFWM\NVVG ]NCCKYEF\UF TZTG QEVQW
BNC QTAJQU X[\@GG@JX[ XVVYGG@JQQUR^W[A^
JQU XVVYGIDPXFWM]NBXM ]NQVKC\Z[YGAG@BFQBR
^P][Y
^DEVZG
TZTGLV[S TZT FFKW\K _ZVXUQ\WP ] WPTV NCCKUDA@R] TZTGENFG XVVYGG@JQU XVFJ]G^CWQ@GAG@BUXF^
XJLY MR[ZNGQS_Z[YGAG@BP[Y
^SZ[YGAG@BCQ BVBUZ BNCGRWJQU XVVYGG@_QUBRQFQ\C
^SZ[YGACRTKW\WRZWGUV
BNCKUR^ W
BNC
]GYPW
@JGQS_Z[YGARRFMG BT]WWGACRTKW\ TZT ]V\W\[MSXXUCV]Z TZTG[\C@
C^A\G ]JQU XVEAZ TZTGF\UF BRFU@ ]NCCKRF\UF QDFPG@DVVYGG@JAFIDV
JNRQM BSFd[@vQJWAPZVSX ADPXFWMIV]V[ ]JQU XXJZ ]NCCK_[F\UF TZTQEVQGW
DVVYGQYZVPX MSXXG BT]QV TZTQEVQ _G[XB ]\UF [LZ[GK _ZCCMC^GJQU XVVYGG@ UUVGZ\ ]NCCKHVVMGQS_WQ@GAG@
S_Z[YGAG@BGQ CRPRW
\JRDPXFWMSXXSM
DRZ[YGACRTKW\KDVGM]AMSX
^SAQQC C^A\M[URQW[A@BNRUR
@^Y\W
RU[V Q\WPQMSXXG BT]W[DDLJ@Q TZTG\JQU XVVYGG@^Q@ EYQW[A@BNC SETNX DNCCKI@P[GQS_Z[YGAG
XJTM]NF\UF TZTGBQMD TZTGWUUN YYQW[ADPXFWQPPWWGACR
^QZKYU
_YZ[YGA[STMG BT]YMIVVYGG@JQQMS
^PWQ@GAG@BUX
W_A@GQS_Z[YGACRTKW\KQE
TZTGMIGZK _ZGQS_WQ@ QGPW[A@BNYCQ\WP ]NCCWMCRPR ]NCCKYZEU] ]LGG BT]W[AUPJ@QEVQWA
TZT@D [] _VVYGG@WQC @D\MQGK _ZGQS_TIA TVVYGG@JQU XEPJX@K _ZCCMJQU XVFJ]G^CZ[YGAG@BGAUN
W_AJQU XVVYG^P\WQDVVQUF TZT DPXFWAB\KQ ]PYUCAKUR
SZEW[AMUPBAPKW
T]GKUAPWAQKUCUPK_B
S\WQ@GAQSF\FB D]XFQBRZWX] TZT^DWM _EZ[YGAGRWIPDKQCZKW
VVAZMUO\MQL QYR\W
WXZZ VVGTU VQOQF
C^[^W
FKUQAPW[AXTJW DETUF \ZP]]UK _ZUPMS[\Z_U^CFW[A@
BNC @BEIQFMSXXUMDET_R]@
T]GU[Z[YGA@XELD^
QVVYGTDJDQ
V^VI[DK _ZUYUTURA
_YZ[YGAZC]\PQ YYZ^@TM^RA] ZUGUZP]]UK _Z]GSVXGU ]RQPU ]I[DCT]X
YTFW[A^F^ K QDTUQY YVZ[YGAYDR CVY\YQ
QVVYGTD]QU U[E\F ]SYQ
QU@@ DWQ@GASQZ[ZKC[]NGAQS
BNCQQSPWQ \XG\F ]PWWK
^CPUX]F[\@GUS\XRDT
TUYXG@ TZTG@QGFRGM]G WVVYGRVF\K _ZCCM^RMMUSK _ZCCMQSCW@TMSXXWQMJR
Z[^Q GTJG@
CX[W[ABFFPKQ_ZVW
@JRTMIV]V[RMSXXF NTQ[[K _ZAGKLX\[
CVVYGG@DU _G@IW
QVCZ QSFUURCTG\QZFRGJW
BNCKQNEVDAMSXXG FRXXW QVVYGG@ZX_QMSXXC
EKQB GGZIG ]I[DKYEVAW
BNCKUDT]BQYD\WS ]JC DRGI[X TZTB\U@BU@^W
BNCC_ZV@QMSXXWK QDTUQY YVZ[YGAS CQP
MSXXC GT@D[@VVYG
]VR\G ^M\W[AVQJCQSZVFQ
UVVYGS\P MR^OV^RGJP
C^C UGXBQ DVVYG S[\Z_GYYRW^R YPMGIUM @BEW[ADE@FV^VTUFDG
_PWY YVZ^@TM^RAY YVXPF _[C\F ]XPGK]Y\W[A_AMDUS RQ^QVVYGQY[\FGK_CP
_Y_LZW
_YZ[YGAEDXFPKQ_ZVW
_PYQ T_M DNCCK\XB^[ ][UZ BPZQNDET_R]MSXXUU
T]GOMYWM^RA[S
[X\W
BNCTXZKW
SXPQRXMX KQER\@Z TZTGPTUFDZTRQFMSXX
_I Z[YGAQSF F UY@\Z TC[[UVQJW
BNCQQSPW ^APK@QMSXXR YAXFS ^RAW[AVQJP UTADF
YPLZQAVS_]X DR]@]BAZ[YGAVVQU[ YLZBPPMZQMSXXW
S\U]ZIYPKSMK _ZCCMQSFKBQK _Z@F D@[X] VQPKW
\TUS MQCQT@ ]NCCK
^Q\W]@ NQSFW[A@BNV S[\AW
EXMD
EGZ[YGAS[\Z_]MWXWQ@K _ZCCMVQI[C TZT ^[J]SUOEKQGMSXXU G[ D^ZWG ]HB\[V^Y\u!0ozj`GUV
VKXB^FPSZK _ZUVMWTRUY
YPMU^U]V\ZQA~[
^QZJDU TZTR SQZTPZ [X[T]GBVI@R TZTWSWP
C^ZWU] BFW[A ] T[ [\@GTCRTKW\K _ZuPK_BWUQW
S\WQ@GAqSF\FBK
^CPKZQERYW[Av^XDDKXR
tID UY@W[AuTWGQ ^[MQF DQ@\X ]{]PDBQQZMSXXw
BVVZG BEZ[YGAtTYZ[FMBGAJZ qK_ SVYWFPK _Z|[SPZZUV YPM+DUGVUPCCZ[YGAcZT
CVVYG0@VEIC^BZ[YGAhO
^CPKZQMSXXUYAPUX DF\FB TZT D^C\Y TZTT^VM]B UT]W[X
YRFZQAVQ]FQ ]XP[ _ZMVUMSXXU_GE\F
DUYXNQK _ZUP QEZ[YGAQSFUP QEZ[YGAQSFUP ]^Z[YGAQSFWQ BVYTQP @FU _ZMVUMSXXU ^[MQF DZI@]
JRGW[AVQJ[UEZI@]
JRGW[AVQJB Q TVUCPF@EYQVW
T]G KYEALYA _VVYGTDPKBKRVA\G ]XP@ D^VJW
T]@F [RG TUUZ[YGAQSC\F@ YYRXSQ TZTUYAWR TZT _\PXPU MSXXUMYZR_UFMSXXU@
TUD\MCRTKW\C^FMUZM^
TID UY@GD TRGXZ TJG]QYAWR TZTUY@\YQ
QVVYGIUU[DK _ZVMSXXVCXYV]QD
W\X@KRRAMQF DRGWQ@K _ZVQ DPXFWCD\J@U YPM PTM[FK _ZVSWMWVAVF ][]DXGW[AU\]@LMG_
WVA\W\ VCBXFQK _ZV] [ZIW
WPGT[ DZUA@ ^DZ[YGAR[@\\U^ZP]]UK _ZVF \^TW@P YCTUW
WK[CB@\JQ ][AZU@TKQ ]ZUDCPK]ZBYPMW
VWQ BVYTQP @FWK_E[VSFXVVYG \N[ZK _ZW KQOF\FB WVVYG X@GQS_Z[YGASVQJ[XKYV
UD\@WK _ZWQ BVYTQP @FW ZLJQU XVVYG VPTMC CRTKW\K _ZW\ [^[WX [VYZ\Q TZT BXXPAYKXR[LW
VS@KUCWX ^PPMUC U\CYT^ R] ^XBW[ATYPW_S_PTM ]ZX]HU@Z_GK _ZWZM W
VWGY ]Z[WQ^YZUGMSXXW
U\^ZDQDPJW
VVZR PGXZPBRPM]ZBVVM]B MSXXW
DR[MPXUTKW
VVZ@ EVYJQU XVVYG _EEWR TZT EGZWGDXGW[ATGG@
GZIADHTDW[CK _ZWFVVYG BXFJF[ CG\_PQVVYG C]V@V TZT TL][[MSXXW CBX]ZHUT]W[AT@J@JRD
QX@U_EXV] ASPU@UKTEZXF ]]]FKPW[AS\KQWMC^
^\X[
EGZ[YGATXBWX[ ]][C _VQUV DRGPZ@ ^RAW[ASZNZX
TWVZN MSXXP
^[ZXP\[PMDF
VDZ_@ ]][C _VQRQ QYRW[ASZNZX
TRPSUS_FVR@BRZ[YGAT
TBQQZMSXXP
^[ZXPKRRAMQF DRGWQ@K _ZPM MF^GMAYTXZ[YGATN[XY]MXX
P_W _YZ[YGAUGFPX[ MCRTKW\C^FMUZM^RAQ BRFJRQVVYGJF\UF YYRW[AROLXUK _ZR] F@PW_K _ZR] _[Z^MY[\BQ_YPZQA
TZT_UTU@[
RVGW[APYVVU UUF\UF TZTQYQJ@F D^[MQF D^C\W
RJS_EZ[YGAWC^U@
TZT\GTMG BT]W[A_\MGQR@P[W
]VYQK
GX[W[A_ZMVUMSXX]H_X
BVVYG
UGYLS] MSXX]DYPMW
\TUS MY\TS ]PYU ^X^RU TZT QPPJV
J^Z[YGAYZT^QGKQCZKW
\TSVTZ[YGAYZRY QVVYG
]P[UZ BDMZ\U UVVYG
]PU[DK _Z]YQEXW[A^XIFQYX
^CPKZQN_GAPY] BVVYG
@R[]PQDAVFYKYM]D C^RQ@ ]PF[ MG_PWA ]SUBQEZ^@TM^RA^C
BVVYG SSPZYW ]ZU@]M^RA^U[TGK _[APP DSWP N^ZF^
D^QZQA]VTGTXZKW
_Z[Z^C[ZGTM^RA^ GYYVUP SVS@KUC^Q ^\P@W[\@G YTDW^R YPMYYQJQ@K ZCZQA]E\P[\XT]^
D^QW[A]EP[X T_M DSC] ]RQPU DWQ@GA[KYYFX[MSX
Y\UPKXR[LW
YPWQ U]V@V TZT
CCFUP QEZ[YGA\XZR@
QNZ[YGA\XZRY MSXXX
TZTW^VWR TZTY[OLK STUDKQCZKW
XXF_KPW[AZTJ@QM]
XXLQ TZTT^TUXUCZ[YGA]RQP
XPZPD^Z[YGA]XCPQGHD
XJB] TVYR TYPYU ET^JW
XMK \^XXLV [DZ[YGA]NPC[ MSXXY QY\ZVA_YZ[YGA]NF\UF ^XBW[AZLNQVQEVQW
[\@D^XBW[AYPMDU VQPKG DWQ@QEVQG[ TZT G[\@GYTA\W\ D@ZK_GK _ZZ[ @[\@GC\LD
DBFXW
[JVZ CA Z]MGEDXXF_ YYRW[AXS_QF
D^XPNQMSXX[WVF\UF TZT
Y@IPU YPM
R^A\LD BRGW[AGTK@Z C]V@V TZTIGPK@Q TZT X^O@FMF^GMAYTXZ[YGA@[@
ETU ^RAW[AGG\P]YAPJQU XVVYGB^V\VU YCZ[YGA@E\OUW MF^GMAYTXZ[YGA@E\CQY X^[\SUDPC[ MSXXD ]XF\[QEZ[YGA@EZJQU X^[^W
ELB DUTKW
DLQF MYYV[_ TZTWDPKBQMWVAVF ]KQD
DDQ[@BVVYGUGZK@GK VQPK[D
]^O\F ]KQGDD]UGQEZ[YGABRF
GJDG BT]W[ADXVQUE\W@QUC
EGXPGK _ZGV
]JVBMSXXGYGAJQFB
FRTULK _ZGQS_^U@
TZTQEVQ] \BRPZ ]JQU X\N[ZK _ZGQS_TMG BT]W[CK _ZGQS_AFQ TRGW[ADPXFWQ ^U[[@VVYGUVGZ\US TZTQEVQUG
CCTW@ _YZ[YGACRTKW\C^FMUZM^
F\UF GRW W
F\Z@]X[]D C^RQ@ DJQFB\I]Z
W_AZQAD]XZSYK _ZG]
\VGJ]ZUDZ[YGAC^[XRQ
RVGW[ADZXDUOTW[A
FIUC DVVYG@RP]VUM]NBXM ]JDAY\OLK SJDC D_PKC^BZ[YGACGB\V UY@W[ADE@CUXRYIZ FHC] TZTG^G\]H_X^LD ]JFWM\XEW[ADFSU BVVYGCUTZ_AMWVAVF ]J@Y[YPUZYP\MUXK _ZG@YTRVVYGDXE
@^[J]S YPMUYVD ]JAD GRWJQU XVVYGID@IPU PGXZPBRPM]ZBVVM]B MSXXG EGQX@QK
UGYLS] MSXX@_VVYGTZLW[A
^\\WSY YVWQ@GAD_\WG@\T[Q@B
DV[PAYKXR[LW
AV[XB\X[
EGZ[YGADXZUVUQ ^U[[@VVYG_XYM]DMXXA
S\FW[ACZMUX\XVP@MK _Z@DCAVD]CVVYG@S
TAVD]CVVYG@EPI[FMD
AKUW
^PJD]BUTP@ ]MFUYYR@\TRG][C _VQJW
AKUR
S_Z^W
AKUZ D[]QBKHZWGBV[JW@ MFOWWGADE\Z_X MWVAVF ]MGDYPMW
AJS_EZ[YGADDFUXUC
@IPU DAVD @BEUPN^XBW[ABE]U@ MD_@WPQ_@[U[U TZTTVA\GC\AVD YPMC[CVVYG@STMQGKUD^
CPDBZO\
RVGW[AA\IR]O\
RVGW[AA\IR]C\[Q
[DZ[YGAFZT]Y] MSXXB@RQUF_AP]W
CMFU A\K@A^SZW[A@TIRQV
TZTRBQQZMSXXC @]\ZAK@RP]QFM^RAC @SESU BVVYGV^MW[A@]\ZAHTA
^PPZR
MSXXC^BXPB D^FPZSK _ZC\ EEVDANQSFW[A@]\ZAK _ZC\ EDPXFWMSXXC^BFQ[DHTAPK
^PZQZQ[Z[YGAG_PWAG @EVDCVVYGXR[LG\
DEXWQK _ZC\ ED]VD UY@W[A@B ] \BRPZ ]NCK
UGYLS] MSXXC ^PIXA
^VVYGGSPQD W^[W[A@BNUSTXJW
BNCVTZ[YGAG@B URWQ@GAG@BY QDPXFWMSXXC F\UF TZTGTXPW
TZTGT[Q@B^[MQF DVVYGG@XW@ UTUQFNCRGOQFK _ZCCMQTAPBQHQOZ[YGAG@
UDWQ@GAG@BUP QEZ[YGAG@BUPSC\ZG ]NCCKTCZT] ]NCCKYZQVXXMSXXC V\TD\ [VVYGG@XXQ TZTGTUXU ECF\UF YYRW[A@BNU XNE\FX [DZ[YGAG@BUX
W_A@GQS_Z[YGAG@BUXUC
DVYW[A@BNV GDPK@[
RVGW[A@BNV GDPKC] TZTGWLXX @EZVRG
DVVYGG@[AZU@TKQ ]NCCK UYAKUXT^TCGGAG@BWX ^PPMUC U\CGVU]WQV^[]Z[MSXX
[F@ZWK _ZCCMSZFZ BNCCWQ@GAG@BW[D
TZTGQXG\BVVYGG@
Q^[] _\@IW
BNC QCPJW
BNC @ZZ[YGAG@BQNHUVGZ\] TZTGSPZPHE^VRW
BNC
^SZU[S MSXXC Q@WCQBXQLW@MSXXC PTM[FK _ZCCMWVAVFUUEAPG] YYSVFYYX[WQ@ B\Z[YGAG@BSU BTZKD[D^ZWW
BNCD@PX@\ SVFMW
BNC
WVA\W\ VCBXFQK _ZCCMWX[WUG BT]W[A@BNS^SFMFQ YYA\FUYAPW[A@BNSQ
BNC RBXW[A@BN] UE[\@
D^XPNQMSXXC ^EPZG XCZ[YGAG@B]D C^RQ@ DNCCK
GX[W[A@BN_QYZWW
BNC
^\FM[M
TZTGYV[_H_ST@W
BNC _\TQ ]NCCK_X^ YQTMSXXC [ZV_VVYGG@U[[Q]R
TZTGYVDK _ZCCM\XC\@FV^VW[A@
BNCCDT^QV QSVXG@ YPMGXPZPD^Z[YGAG@B
^PZ[YGAG@BYM^^V[A@ ^VVYGG@TMDEYPLD ]NCCKIDPXFWMSXXC ZLJQU XYZNW
BNCGRWJQU XVVYGG@WQ@\YZNW
BNC DGTU[RBDWQ@GAG@BZQU
DVVYGG@WQC ^\[VCGK _ZCCM^^VMQWUCBVF_MSXX
BNCRAVGF[BFK _ZCCMCRTKW\WS VVYGG@JQU XVFJ]G^CWQ@GAG@BGQS_
Q[\@GG@M[D [DZ[YGAG@B@[\APU[W IVVYGG@MDGTSZKSGG
BNCRDPZAF \RGMW
BNC UY@W[A@BNC^BZ[YKTPP
TZTGBVFXN@XGMUXK _ZCCMIXZ^QQK _ZCCMJRFMMR TVVYGG@CGQS_AV[XB
TZTGU[DK _ZCCQ UGVCG DXZUVUMSXXC\X[
EGZ[YGAHVQJ[UEZI@]
JRGW[AOT]G[K VQPK[D
]^O\F ]AUP XS_QF
D^XPNQMSXXLHZ_RQ @C\T]N TZT CVU]YRBVRG ]AVGK _T^MU] QD]W[AO\TUS XS_QF
D^XPNQMSXXL@^A\F ]AX] XS_QF
D^XPNQMSXXL CQMSXXLCRTKW\KQ[T
MTXG BT]SU BVVYGQ_ZVRQVVYG_X
RVGW[AJH96594uH
r7594uH
r7594 }m`d_L XWXXPQZWQ@JY |`13
VVU ENTTZ 6594t]c0759475944ec0
" " «b Íc ác ác ác 4 d d d d !d Ï694ÄdŠ8¨²v4ec0V/Pv4ec0[
WYwUB QC\VZq_EUWa7/cL
K[ ]L\@AJGLXQMJN
X]PXGDGCME@UQG KBRR\LDGMLJ@V JRiW[ e HCJF@\FMGS Oo;Em H WRMINDPXFW? TZTIOKlI E^Klk i A G\SQ BUVUVGZ\hK _ZH 9\L @QCKXM 8nhILKBRR\LDGMLT[[A? TZTIOKlI @ ]DBojC>J F UOE \[AQQC lVVYIKIk
E MLF@\FML^Klk i A G\SQ BUXF^FMUhK _ZH 9\L EHQKTHDH_ BojC>J F UOE UkXX@YDAXh ]J hZ HHULVDIHU
Nbj8HM FQHG ODVCPG@? TZeA e HCJFIXEUAGIXE[L^Klk i A G\SQ BUY_YiW[ e HMEL MUUF\UF l e R \SRQM BSF H@PT Nbj8HM FQHG OQMZWhM h KK LKGRWJQU Xkh
U[Q_Q _EQJ FS BojC>J F UOE ]VOVZhKBJ hZ I LJ@P[GQS_i hZYRY]_ GXG]G X QOo;Em H WRMINQZTC[Z9MSXiA_M
TD HVLngiN KQS @OU G_ZeW
M h E DKMHoFIXGk AKTJk[ \VFMZU
Nbj8HM FQHG O \kZ[YM iHLKABPKMHoFIXGk AKTJk[JLngiN KQS @OU
lQ\IOKlI EXkid IGJEP^QLA NX[X9MVEH 9\L EHUELEUD<DRGTG Xkid IGJEP^QLA NX[X9MSXiA_M iHLKAKDLQF QGFf@QC BojC>J F UOE BPZJh l@RIOKlI G BT]MQFLngiN KQS @OUZRPOQG9MSXXD M?K ULF Oo;Em H WRMINQD^SQQCkZ[hK
Nbj8HM FQHG O_ZOeW
M h EDEE 8nhILKBRR\LDGMLTM@hKUC
M h EF@\FMXkid IGJEP^QLA N[AM9MSXXD M?KEAXkid IGJEP^QLA NZ]FYCVP@M9MSXXD M?KGQS_BojC>J F UOE ^RAeW
M h EFBojC>J F UOE ^YiW[ e HCJABPKM 8nhILKBRR\LDGMLVVYQI
M h E\P@C[LngiN KQS @OW
@BF\FB ? TZTIOKlI EBNBojC>J F UOE BV\^GX DkVFSM iHLERG@ O>=j D MUPPADKHKTCJh ]J hZ DLQF ^Klk i A G\SQ BPQD^X\h ]J hZ ^\MC
T
Nbj8HM FQHG O
^XVZX Uk]QIKIk
E MERG@HCA BojC>J F UOE YEPZ@\ lVVYIKIk
E I
Nbj8HM FQHG O_Mi[F e HCJCRTKW\Xkid IGJEP^QLA N][S
\RiW[ e HCJFIH_CL^Klk i A G\SQ BP[EGiW[ e HCJ[
Nbj8HM FQHG OEPFM[F ? TZTIOKlI G BT]Oo;Em H WRMINUVGM\X [kWQ@M iHLLngiN KQS @OQIkZ[YM iHLKCX\WWXU@ZKPGQC\M
^TYLPQ BSFEGU
D[P @QK 9\Klk i A G\SQ BQVlVVhM h E FV]ZESPN[FLDTM]@ LF@\FMW? W h 8nhILKBRR\LDGMLPWS] iW[ e HCJA
Nbj8HM FQHG O YY\VZG9MSXXD M?KGQS_jJ@F W
Nbj8HM FQHG O S^A\h ]J hZ H_C
Nbj8HM FQHG O
^STK@]UDiW[ e HCJ[RLOo;Em H WRMINV^[]]U9M^RAD M?KEA I
Nbj8HM FQHG O
BRWXXX9MTRH 9\L H O>=j D MUPPADKHKQG\QR TkZ[YM iHLERG@ O>=j D MUPPADKHKQG\QG FRiW[ e HCJA
Nbj8HM FQHG ODXGeW
M 9\L ^@kI@ZKPGXJL RLO^N Lkid IGJEP^QLA N^]@
? TZTIOKlI EBNBojC>J F UOE _TYPW_9MSXXD M?KGQS_BojC>J F UOE __\Ih ]J hZ FZ O>=j D MUPPADKHK_TURhKRVLeW
M h E\P@C[LngiN KQS @O\lVVYIKIk
E D
Nbj8HM FQHG O VXFIUW ? TZTIOKlI GKDWHEJLngiN KQS @O]
\[T^QhK _ZH 9\L HFMXkid IGJEP^QLA NPC[ ? TZTIOKlI G BT]_[FXkid IGJEP^QLA NPLE
S\iW[ e HCJABPKM 8nhILKBRR\LDGML_ZDQ UNiW[ e HCJCRTKW\B^[^ O>=j D MUPPADKHK\TW[[UkZ[YM
? TZeA e HCJC^A\GQS_DLQF ^Klk i A G\SQ B_X D@Z\Q ? SPD M?KEA I
Nbj8HM FQHG O
^\OeW
M h ECPKY 8nhILKBRR\LDGMLYV[_Q
M h E\P@ O>=j D MUPPADKHK[ZV_GBCiW[9M
E ^Klk i A G\SQ BXM CkZ[YM iHLKABPKMHAKRMk_ GXG]G Xkid IGJEP^QLA NUMW
lQ\IOKlI UELEDGJLngiN KQS @OX _DiW[9ME\H 9\L EA IKEJP Xkid IGJEP^QLA NTUYlVVYIKIk
E UELOo;Em H WRMIN]VFMQF9MSXXD M?KE 8nhILKBRR\LDGMLX\SU lVVYIKIlNbj8HM FQHG OWVB\VhK _ZH hZkid IGJEP^QLA NTQF ZP]W[9MSXXD M?KGQS_A\L@Xkid IGJEP^QLA NTQ@ BVBUQF9MSXXD M?KE 8nhILKBRR\LDGMLXVZP
UVGZ\hK _ZH 9\L HAQLngiN KQS @OY
CCPKh ]J hZ DOo;Em H WRMIN]D[eW
M h EFBojC>J F UOE CYiPQM iHLLngiN KQS @OYlPJIOKlI EXkid IGJEP^QLA NTGZ9MCRH 9\L H O>=j D MUPPADKHKZFWh l@RIOKlI EXkid IGJEP^QLA N^h^kZ[YL BFQDTSih MJ F UOE UVGZ\hKCYiW[ EPJAX o C>A
Nbj8HM FQHG OCRTKW\9MSXXD M?K G BT]_[FChDEUG:@FIXGk
Nbj8HM FQHG OC^XVZhK _ZH 9\L EHL^[IA@I@ZKP Xkid IGJEP^QLA NWQ@ QGPeW
M h EF@\FMXkid IGJEP^QLA NWQLWkZ[YM iHLUVGZ\ 8nhILKBRR\LDGML[VF@BY
E I@ZKPGXkid IGJEP^QLA NIUS UR^\FhK _ZH 9\L JQU X
Nbj8HM FQHG OYTP^FUUEiW[ e HCJVXGTk_ GXG] O>=j D MUPPADKHKDPXFWRiW[ e HCJABPKM 8nhILKBRR\LDGMLF\UF [^[^h ]J hZ ^\MC
T
Nbj8HM FQHG OQEVQFQ\CiZQ e HCJCPKYHJLngiN KQS @OG
_BBXZZ? TZTIOKlI C
TDBojC>J F UOE ET]\ZhK _ZH 9\L H O>=j D MUPPADKHKD@IQFWRFeW
M h E [EW Xkid IGJEP^QLA NJAF UR^\FhK _ZH 9\L JQU X
Nbj8HM FQHG OBPPMh ]J hZ SPQXK K P I@ZKPGXkid IGJEP^QLA NMQWQER\@hK _ZH 9\L HAQLngiN KQS @O@ ]ViW[ e HCJkFAd O>=j D MUPPADKHKC\Z_QQDA\FhK _ZH 9\L RQM BSBojC>J F UOE YDVXX]M h E\P@ O>=j D MUPPADKHKC\JWU
YCH 9\L RQMXkid IGJEP^QLA NM]G\^iW[9ME\H 9\L HAQLngiN KQS @O@RXSPZP9MSXXD M?K@QC
Nbj8HM FQHG O
BP\U][9MYCH 9\L HG 8nhILKBRR\LDGMLBXXYD
E MQKCIHB
@ BojC>J F UOE UVGZ\ XXZW[ DPXFWMl
iDXkid IGJEP^QLA NU[[? TZTIOKlI EXkid IGJEP^QLA NQ[@ DkZ[YM iHLERG@ O>=j D MUPPADKHKDPXFW? TZTIOKlI EXkid IGJEP^QLA NVZQ _\iW[ e HCJG
Nbj8HM FQHG OC^[\GG9MSXXD M?KEA I
Nbj8HM FQHG O^kZ[YM iHLDCBojC>J F UOE ID\T[Z9MSXXD M?KE@Xkid IGJEP^QLA N\D]
_YFeW
M h EDPXFW<CCGPZSXkid IGJEP^QLA NJ\[UEJQU XkZZQ? TZTIOKlI EXkid IGJEP^QLA NZ]@ UVGZ\hK _ZH 9\L N\QLngiN KQS @OZYX[XXhK YCLJQU XkZ[YM iHLERG@ O>=j D MUPPADKHKRCP@Q9MSXXD M?K_Q _EQJ O>=j D MUPPADKHKP\_@G9MSXXD M?KEA I
Nbj8HM FQHG OQGiW[ e HCJABPKM 8nhILKBRR\LDGMLFZ]Fl
E ^Klk i A G\SQ BUX QkZ[YM iHLLngiN KQS @OV [RY\MhKTBH 9\L RQM BSFOo;Em H WRMINWXZ^XQ9MSXXD M?KE 8nhIL _GAP[ZGZJ]@ ^EVDAA VVAZA DF B^A@UAJHB_Q _EQJg BT]GAWXZ^XQGACRTKW\KQ
F\UF ZFWW
BNC \DPXFWMSXXG BT]JW[ TZT^XZ]XQK _ZGQS_\VU MSXXG BT] G @YTOW
PXFWM\NVVG ]NCCKYEF\UF TZTG QEVQW
BNC QTAJQU X[\@GG@JX[ XVVYGG@JQQUR^W[A^
JQU XVVYGIDPXFWM]NBXM ]NQVKC\Z[YGAG@BFQBR
^P][Y
^DEVZG
TZTGLV[S TZT FFKW\K _ZVXUQ\WP ] WPTV NCCKUDA@R] TZTGENFG XVVYGG@JQU XVFJ]G^CWQ@GAG@BUXF^
XJLY MR[ZNGQS_Z[YGAG@BP[Y
^SZ[YGAG@BCQ BVBUZ BNCGRWJQU XVVYGG@_QUBRQFQ\C
^SZ[YGACRTKW\WRZWGUV
BNCKUR^ W
BNC
]GYPW
@JGQS_Z[YGARRFMG BT]WWGACRTKW\ TZT ]V\W\[MSXXUCV]Z TZTG[\C@
C^A\G ]JQU XVEAZ TZTGF\UF BRFU@ ]NCCKRF\UF QDFPG@DVVYGG@JAFIDV
JNRQM BSFd[@vQJWAPZVSX ADPXFWMIV]V[ ]JQU XXJZ ]NCCK_[F\UF TZTQEVQGW
DVVYGQYZVPX MSXXG BT]QV TZTQEVQ _G[XB ]\UF [LZ[GK _ZCCMC^GJQU XVVYGG@ UUVGZ\ ]NCCKHVVMGQS_WQ@GAG@
S_Z[YGAG@BGQ CRPRW
\JRDPXFWMSXXSM
DRZ[YGACRTKW\KDVGM]AMSX
^SAQQC C^A\M[URQW[A@BNRUR
@^Y\W
RU[V Q\WPQMSXXG BT]W[DDLJ@Q TZTG\JQU XVVYGG@^Q@ EYQW[A@BNC SETNX DNCCKI@P[GQS_Z[YGAG
XJTM]NF\UF TZTGBQMD TZTGWUUN YYQW[ADPXFWQPPWWGACR
^QZKYU
_YZ[YGA[STMG BT]YMIVVYGG@JQQMS
^PWQ@GAG@BUX
W_A@GQS_Z[YGACRTKW\KQE
TZTGMIGZK _ZGQS_WQ@ QGPW[A@BNYCQ\WP ]NCCWMCRPR ]NCCKYZEU] ]LGG BT]W[AUPJ@QEVQWA
TZT@D [] _VVYGG@WQC @D\MQGK _ZGQS_TIA TVVYGG@JQU XEPJX@K _ZCCMJQU XVFJ]G^CZ[YGAG@BGAUN
W_AJQU XVVYG^P\WQDVVQUF TZT DPXFWAB\KQ ]PYUCAKUR
SZEW[AMUPBAPKW
T]GKUAPWAQKUCUPK_B
S\WQ@GAQSF\FB D]XFQBRZWX] TZT^DWM _EZ[YGAGRWIPDKQCZKW
VVAZMUO\MQL QYR\W
WXZZ VVGTU VQOQF
C^[^W
FKUQAPW[AXTJW DETUF \ZP]]UK _ZUPMS[\Z_U^CFW[A@
BNC @BEIQFMSXXUMDET_R]@
T]GU[Z[YGA@XELD^
QVVYGTDJDQ
V^VI[DK _ZUYUTURA
_YZ[YGAZC]\PQ YYZ^@TM^RA] ZUGUZP]]UK _Z]GSVXGU ]RQPU ]I[DCT]X
YTFW[A^F^ K QDTUQY YVZ[YGAYDR CVY\YQ
QVVYGTD]QU U[E\F ]SYQ
QU@@ DWQ@GASQZ[ZKC[]NGAQS
BNCQQSPWQ \XG\F ]PWWK
^CPUX]F[\@GUS\XRDT
TUYXG@ TZTG@QGFRGM]G WVVYGRVF\K _ZCCM^RMMUSK _ZCCMQSCW@TMSXXWQMJR
Z[^Q GTJG@
CX[W[ABFFPKQ_ZVW
@JRTMIV]V[RMSXXF NTQ[[K _ZAGKLX\[
CVVYGG@DU _G@IW
QVCZ QSFUURCTG\QZFRGJW
BNCKQNEVDAMSXXG FRXXW QVVYGG@ZX_QMSXXC
EKQB GGZIG ]I[DKYEVAW
BNCKUDT]BQYD\WS ]JC DRGI[X TZTB\U@BU@^W
BNCC_ZV@QMSXXWK QDTUQY YVZ[YGAS CQP
MSXXC GT@D[@VVYG
]VR\G ^M\W[AVQJCQSZVFQ
UVVYGS\P MR^OV^RGJP
C^C UGXBQ DVVYG S[\Z_GYYRW^R YPMGIUM @BEW[ADE@FV^VTUFDG
_PWY YVZ^@TM^RAY YVXPF _[C\F ]XPGK]Y\W[A_AMDUS RQ^QVVYGQY[\FGK_CP
_Y_LZW
_YZ[YGAEDXFPKQ_ZVW
_PYQ T_M DNCCK\XB^[ ][UZ BPZQNDET_R]MSXXUU
T]GOMYWM^RA[S
[X\W
BNCTXZKW
SXPQRXMX KQER\@Z TZTGPTUFDZTRQFMSXX
_I Z[YGAQSF F UY@\Z TC[[UVQJW
BNCQQSPW ^APK@QMSXXR YAXFS ^RAW[AVQJP UTADF
YPLZQAVS_]X DR]@]BAZ[YGAVVQU[ YLZBPPMZQMSXXW
S\U]ZIYPKSMK _ZCCMQSFKBQK _Z@F D@[X] VQPKW
\TUS MQCQT@ ]NCCK
^Q\W]@ NQSFW[A@BNV S[\AW
EXMD
EGZ[YGAS[\Z_]MWXWQ@K _ZCCMVQI[C TZT ^[J]SUOEKQGMSXXU G[ D^ZWG ]HB\[V^Y\u!0ozj`GUV
VKXB^FPSZK _ZUVMWTRUY
YPMU^U]V\ZQA~[
^QZJDU TZTR SQZTPZ [X[T]GBVI@R TZTWSWP
C^ZWU] BFW[A ] T[ [\@GTCRTKW\K _ZuPK_BWUQW
S\WQ@GAqSF\FBK
^CPKZQERYW[Av^XDDKXR
tID UY@W[AuTWGQ ^[MQF DQ@\X ]{]PDBQQZMSXXw
BVVZG BEZ[YGAtTYZ[FMBGAJZ qK_ SVYWFPK _Z|[SPZZUV YPM+DUGVUPCCZ[YGAcZT
CVVYG0@VEIC^BZ[YGAhO
^CPKZQMSXXUYAPUX DF\FB TZT D^C\Y TZTT^VM]B UT]W[X
YRFZQAVQ]FQ ]XP[ _ZMVUMSXXU_GE\F
DUYXNQK _ZUP QEZ[YGAQSFUP QEZ[YGAQSFUP ]^Z[YGAQSFWQ BVYTQP @FU _ZMVUMSXXU ^[MQF DZI@]
JRGW[AVQJ[UEZI@]
JRGW[AVQJB Q TVUCPF@EYQVW
T]G KYEALYA _VVYGTDPKBKRVA\G ]XP@ D^VJW
T]@F [RG TUUZ[YGAQSC\F@ YYRXSQ TZTUYAWR TZT _\PXPU MSXXUMYZR_UFMSXXU@
TUD\MCRTKW\C^FMUZM^
TID UY@GD TRGXZ TJG]QYAWR TZTUY@\YQ
QVVYGIUU[DK _ZVMSXXVCXYV]QD
W\X@KRRAMQF DRGWQ@K _ZVQ DPXFWCD\J@U YPM PTM[FK _ZVSWMWVAVF ][]DXGW[AU\]@LMG_
WVA\W\ VCBXFQK _ZV] [ZIW
WPGT[ DZUA@ ^DZ[YGAR[@\\U^ZP]]UK _ZVF \^TW@P YCTUW
WK[CB@\JQ ][AZU@TKQ ]ZUDCPK]ZBYPMW
VWQ BVYTQP @FWK_E[VSFXVVYG \N[ZK _ZW KQOF\FB WVVYG X@GQS_Z[YGASVQJ[XKYV
UD\@WK _ZWQ BVYTQP @FW ZLJQU XVVYG VPTMC CRTKW\K _ZW\ [^[WX [VYZ\Q TZT BXXPAYKXR[LW
VS@KUCWX ^PPMUC U\CYT^ R] ^XBW[ATYPW_S_PTM ]ZX]HU@Z_GK _ZWZM W
VWGY ]Z[WQ^YZUGMSXXW
U\^ZDQDPJW
VVZR PGXZPBRPM]ZBVVM]B MSXXW
DR[MPXUTKW
VVZ@ EVYJQU XVVYG _EEWR TZT EGZWGDXGW[ATGG@
GZIADHTDW[CK _ZWFVVYG BXFJF[ CG\_PQVVYG C]V@V TZT TL][[MSXXW CBX]ZHUT]W[AT@J@JRD
QX@U_EXV] ASPU@UKTEZXF ]]]FKPW[AS\KQWMC^
^\X[
EGZ[YGATXBWX[ ]][C _VQUV DRGPZ@ ^RAW[ASZNZX
TWVZN MSXXP
^[ZXP\[PMDF
VDZ_@ ]][C _VQRQ QYRW[ASZNZX
TRPSUS_FVR@BRZ[YGAT
TBQQZMSXXP
^[ZXPKRRAMQF DRGWQ@K _ZPM MF^GMAYTXZ[YGATN[XY]MXX
P_W _YZ[YGAUGFPX[ MCRTKW\C^FMUZM^RAQ BRFJRQVVYGJF\UF YYRW[AROLXUK _ZR] F@PW_K _ZR] _[Z^MY[\BQ_YPZQA
TZT_UTU@[
RVGW[APYVVU UUF\UF TZTQYQJ@F D^[MQF D^C\W
RJS_EZ[YGAWC^U@
TZT\GTMG BT]W[A_\MGQR@P[W
]VYQK
GX[W[A_ZMVUMSXX]H_X
BVVYG
UGYLS] MSXX]DYPMW
\TUS MY\TS ]PYU ^X^RU TZT QPPJV
J^Z[YGAYZT^QGKQCZKW
\TSVTZ[YGAYZRY QVVYG
]P[UZ BDMZ\U UVVYG
]PU[DK _Z]YQEXW[A^XIFQYX
^CPKZQN_GAPY] BVVYG
@R[]PQDAVFYKYM]D C^RQ@ ]PF[ MG_PWA ]SUBQEZ^@TM^RA^C
BVVYG SSPZYW ]ZU@]M^RA^U[TGK _[APP DSWP N^ZF^
D^QZQA]VTGTXZKW
_Z[Z^C[ZGTM^RA^ GYYVUP SVS@KUC^Q ^\P@W[\@G YTDW^R YPMYYQJQ@K ZCZQA]E\P[\XT]^
D^QW[A]EP[X T_M DSC] ]RQPU DWQ@GA[KYYFX[MSX
Y\UPKXR[LW
YPWQ U]V@V TZT
CCFUP QEZ[YGA\XZR@
QNZ[YGA\XZRY MSXXX
TZTW^VWR TZTY[OLK STUDKQCZKW
XXF_KPW[AZTJ@QM]
XXLQ TZTT^TUXUCZ[YGA]RQP
XPZPD^Z[YGA]XCPQGHD
XJB] TVYR TYPYU ET^JW
XMK \^XXLV [DZ[YGA]NPC[ MSXXY QY\ZVA_YZ[YGA]NF\UF ^XBW[AZLNQVQEVQW
[\@D^XBW[AYPMDU VQPKG DWQ@QEVQG[ TZT G[\@GYTA\W\ D@ZK_GK _ZZ[ @[\@GC\LD
DBFXW
[JVZ CA Z]MGEDXXF_ YYRW[AXS_QF
D^XPNQMSXX[WVF\UF TZT
Y@IPU YPM
R^A\LD BRGW[AGTK@Z C]V@V TZTIGPK@Q TZT X^O@FMF^GMAYTXZ[YGA@[@
ETU ^RAW[AGG\P]YAPJQU XVVYGB^V\VU YCZ[YGA@E\OUW MF^GMAYTXZ[YGA@E\CQY X^[\SUDPC[ MSXXD ]XF\[QEZ[YGA@EZJQU X^[^W
ELB DUTKW
DLQF MYYV[_ TZTWDPKBQMWVAVF ]KQD
DDQ[@BVVYGUGZK@GK VQPK[D
]^O\F ]KQGDD]UGQEZ[YGABRF
GJDG BT]W[ADXVQUE\W@QUC
EGXPGK _ZGV
]JVBMSXXGYGAJQFB
FRTULK _ZGQS_^U@
TZTQEVQ] \BRPZ ]JQU X\N[ZK _ZGQS_TMG BT]W[CK _ZGQS_AFQ TRGW[ADPXFWQ ^U[[@VVYGUVGZ\US TZTQEVQUG
CCTW@ _YZ[YGACRTKW\C^FMUZM^
F\UF GRW W
F\Z@]X[]D C^RQ@ DJQFB\I]Z
W_AZQAD]XZSYK _ZG]
\VGJ]ZUDZ[YGAC^[XRQ
RVGW[ADZXDUOTW[A
FIUC DVVYG@RP]VUM]NBXM ]JDAY\OLK SJDC D_PKC^BZ[YGACGB\V UY@W[ADE@CUXRYIZ FHC] TZTG^G\]H_X^LD ]JFWM\XEW[ADFSU BVVYGCUTZ_AMWVAVF ]J@Y[YPUZYP\MUXK _ZG@YTRVVYGDXE
@^[J]S YPMUYVD ]JAD GRWJQU XVVYGID@IPU PGXZPBRPM]ZBVVM]B MSXXG EGQX@QK
UGYLS] MSXX@_VVYGTZLW[A
^\\WSY YVWQ@GAD_\WG@\T[Q@B
DV[PAYKXR[LW
AV[XB\X[
EGZ[YGADXZUVUQ ^U[[@VVYG_XYM]DMXXA
S\FW[ACZMUX\XVP@MK _Z@DCAVD]CVVYG@S
TAVD]CVVYG@EPI[FMD
AKUW
^PJD]BUTP@ ]MFUYYR@\TRG][C _VQJW
AKUR
S_Z^W
AKUZ D[]QBKHZWGBV[JW@ MFOWWGADE\Z_X MWVAVF ]MGDYPMW
AJS_EZ[YGADDFUXUC
@IPU DAVD @BEUPN^XBW[ABE]U@ MD_@WPQ_@[U[U TZTTVA\GC\AVD YPMC[CVVYG@STMQGKUD^
CPDBZO\
RVGW[AA\IR]O\
RVGW[AA\IR]C\[Q
[DZ[YGAFZT]Y] MSXXB@RQUF_AP]W
CMFU A\K@A^SZW[A@TIRQV
TZTRBQQZMSXXC @]\ZAK@RP]QFM^RAC @SESU BVVYGV^MW[A@]\ZAHTA
^PPZR
MSXXC^BXPB D^FPZSK _ZC\ EEVDANQSFW[A@]\ZAK _ZC\ EDPXFWMSXXC^BFQ[DHTAPK
^PZQZQ[Z[YGAG_PWAG @EVDCVVYGXR[LG\
DEXWQK _ZC\ ED]VD UY@W[A@B ] \BRPZ ]NCK
UGYLS] MSXXC ^PIXA
^VVYGGSPQD W^[W[A@BNUSTXJW
BNCVTZ[YGAG@B URWQ@GAG@BY QDPXFWMSXXC F\UF TZTGTXPW
TZTGT[Q@B^[MQF DVVYGG@XW@ UTUQFNCRGOQFK _ZCCMQTAPBQHQOZ[YGAG@
UDWQ@GAG@BUP QEZ[YGAG@BUPSC\ZG ]NCCKTCZT] ]NCCKYZQVXXMSXXC V\TD\ [VVYGG@XXQ TZTGTUXU ECF\UF YYRW[A@BNU XNE\FX [DZ[YGAG@BUX
W_A@GQS_Z[YGAG@BUXUC
DVYW[A@BNV GDPK@[
RVGW[A@BNV GDPKC] TZTGWLXX @EZVRG
DVVYGG@[AZU@TKQ ]NCCK UYAKUXT^TCGGAG@BWX ^PPMUC U\CGVU]WQV^[]Z[MSXX
[F@ZWK _ZCCMSZFZ BNCCWQ@GAG@BW[D
TZTGQXG\BVVYGG@
Q^[] _\@IW
BNC QCPJW
BNC @ZZ[YGAG@BQNHUVGZ\] TZTGSPZPHE^VRW
BNC
^SZU[S MSXXC Q@WCQBXQLW@MSXXC PTM[FK _ZCCMWVAVFUUEAPG] YYSVFYYX[WQ@ B\Z[YGAG@BSU BTZKD[D^ZWW
BNCD@PX@\ SVFMW
BNC
WVA\W\ VCBXFQK _ZCCMWX[WUG BT]W[A@BNS^SFMFQ YYA\FUYAPW[A@BNSQ
BNC RBXW[A@BN] UE[\@
D^XPNQMSXXC ^EPZG XCZ[YGAG@B]D C^RQ@ DNCCK
GX[W[A@BN_QYZWW
BNC
^\FM[M
TZTGYV[_H_ST@W
BNC _\TQ ]NCCK_X^ YQTMSXXC [ZV_VVYGG@U[[Q]R
TZTGYVDK _ZCCM\XC\@FV^VW[A@
BNCCDT^QV QSVXG@ YPMGXPZPD^Z[YGAG@B
^PZ[YGAG@BYM^^V[A@ ^VVYGG@TMDEYPLD ]NCCKIDPXFWMSXXC ZLJQU XYZNW
BNCGRWJQU XVVYGG@WQ@\YZNW
BNC DGTU[RBDWQ@GAG@BZQU
DVVYGG@WQC ^\[VCGK _ZCCM^^VMQWUCBVF_MSXX
BNCRAVGF[BFK _ZCCMCRTKW\WS VVYGG@JQU XVFJ]G^CWQ@GAG@BGQS_
Q[\@GG@M[D [DZ[YGAG@B@[\APU[W IVVYGG@MDGTSZKSGG
BNCRDPZAF \RGMW
BNC UY@W[A@BNC^BZ[YKTPP
TZTGBVFXN@XGMUXK _ZCCMIXZ^QQK _ZCCMJRFMMR TVVYGG@CGQS_AV[XB
TZTGU[DK _ZCCQ UGVCG DXZUVUMSXXC\X[
EGZ[YGAHVQJ[UEZI@]
JRGW[AOT]G[K VQPK[D
]^O\F ]AUP XS_QF
D^XPNQMSXXLHZ_RQ @C\T]N TZT CVU]YRBVRG ]AVGK _T^MU] QD]W[AO\TUS XS_QF
D^XPNQMSXXL@^A\F ]AX] XS_QF
D^XPNQMSXXL CQMSXXLCRTKW\KQ[T
MTXG BT]SU BVVYGQ_ZVRQVVYG_X
RVGW[AJH96594uH
r7594uH
r7594 }m`d_L XWXXPQZWQ@JY |`13
VVU ENTTZ 6594t]c0759475944ec0
ASKER
useful isn't it!!!!
Before we do anything else - do this:
From the l2mfix folder on your desktop,
double click l2mfix.bat and select option # 2 for "Run Fix" by typing 2 and then pressing enter,
then press any key to reboot your computer.
After a reboot, your desktop and icons will appear, then disappear (this is normal).
L2mfix will continue to scan your computer and when it's finished, notepad will open with a log.
The log should be in the same folder as l2mfix.
Copy the contents of that log and paste it back into this thread.
Then download and run TDS-3 Trojan Scan (free 30 day trial).
http://tds.diamondcs.com.au/
Update before you run it.
We'll see what it comes up with - make a note of all files it shows up as bad.
I hesitate to try and remove this manually -
I don't like the fact that it appears to have "winlogon" hooked.
RF
From the l2mfix folder on your desktop,
double click l2mfix.bat and select option # 2 for "Run Fix" by typing 2 and then pressing enter,
then press any key to reboot your computer.
After a reboot, your desktop and icons will appear, then disappear (this is normal).
L2mfix will continue to scan your computer and when it's finished, notepad will open with a log.
The log should be in the same folder as l2mfix.
Copy the contents of that log and paste it back into this thread.
Then download and run TDS-3 Trojan Scan (free 30 day trial).
http://tds.diamondcs.com.au/
Update before you run it.
We'll see what it comes up with - make a note of all files it shows up as bad.
I hesitate to try and remove this manually -
I don't like the fact that it appears to have "winlogon" hooked.
RF
ASKER
L2Mfix 1.03
Running From:
C:\Documents and Settings\2care\Desktop\l2m
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Wi
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access Everyone
(IO) ALLOW Full access Everyone
Setting registry permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry
Registry Permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Wi
(CI) DENY --C------- BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access Everyone
(IO) ALLOW Full access Everyone
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting up for Reboot
Starting Reboot!
C:\Documents and Settings\2care\Desktop\l2m
System Rebooted!
Running From:
C:\Documents and Settings\2care\Desktop\l2m
killing explorer and rundll32.exe
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.
Killing PID 1548 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.
Error, Cannot find a process with an image name of rundll32.exe
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
Zipping up files for submission:
adding: clear.reg (164 bytes security) (deflated 2%)
adding: echo.reg (164 bytes security) (deflated 9%)
adding: direct.txt (164 bytes security) (stored 0%)
adding: lo2.txt (164 bytes security) (deflated 71%)
adding: readme.txt (164 bytes security) (deflated 49%)
adding: test.txt (164 bytes security) (stored 0%)
adding: test2.txt (164 bytes security) (stored 0%)
adding: test3.txt (164 bytes security) (stored 0%)
adding: test5.txt (164 bytes security) (stored 0%)
adding: backregs/shell.reg (164 bytes security) (deflated 74%)
Restoring Registry Permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Revoking access for predefined group "Administrators"
Warning (option /rga:(ci)) - There is no ACE to remove!
Registry permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Wi
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access Everyone
(IO) ALLOW Full access Everyone
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful
The following Is the Current Export of the Winlogon notify key:
**************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Softwa
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"Impersonate"=dword:000000
"DllName"=hex(2):63,00,72,
6c,00,00,00
"Logoff"="ChainWlxLogoffEv
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"Impersonate"=dword:000000
"DllName"=hex(2):63,00,72,
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogof
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEven
"Logoff"="WinlogonLogoffEv
"ScreenSaver"="WinlogonScr
"Startup"="WinlogonStartup
"Shutdown"="WinlogonShutdo
"StartShell"="WinlogonStar
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"DllName"="C:\\WINDOWS\\re
"Impersonate"=dword:000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertPro
"Logoff"="SCardStopCertPro
"Lock"="SCardSuspendCertPr
"Unlock"="SCardResumeCertP
"Enabled"=dword:00000001
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"DllName"=hex(2):77,00,6c,
6c,00,6c,00,00,00
"Impersonate"=dword:000000
"StartShell"="SchedStartSh
"Logoff"="SchedEventLogOff
[HKEY_LOCAL_MACHINE\Softwa
"Logoff"="WLEventLogoff"
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
"DllName"=hex(2):73,00,63,
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensSt
"StopScreenSaver"="SensSto
"Startup"="SensStartupEven
"Shutdown"="SensShutdownEv
"StartShell"="SensStartShe
"PostShell"="SensPostShell
"Disconnect"="SensDisconne
"Reconnect"="SensReconnect
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"DllName"=hex(2):77,00,6c,
6c,00,6c,00,00,00
"Impersonate"=dword:000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostSh
"Shutdown"="TSEventShutdow
"StartShell"="TSEventStart
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconn
"Disconnect"="TSEventDisco
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExp
"Logoff"="UnregisterTicket
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
The following are the files found:
**************************
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
**************************
REGEDIT4
[HKEY_LOCAL_MACHINE\Softwa
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTW
[HKEY_LOCAL_MACHINE\SOFTWA
"SV1"=""
**************************
Desktop.ini Contents:
**************************
**************************
Running From:
C:\Documents and Settings\2care\Desktop\l2m
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Wi
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access Everyone
(IO) ALLOW Full access Everyone
Setting registry permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Denying C(CI) access for predefined group "Administrators"
- adding new ACCESS DENY entry
Registry Permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Wi
(CI) DENY --C------- BUILTIN\Administrators
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access Everyone
(IO) ALLOW Full access Everyone
(ID-NI) ALLOW Read BUILTIN\Users
(ID-IO) ALLOW Read BUILTIN\Users
(ID-NI) ALLOW Read BUILTIN\Power Users
(ID-IO) ALLOW Read BUILTIN\Power Users
(ID-NI) ALLOW Full access BUILTIN\Administrators
(ID-IO) ALLOW Full access BUILTIN\Administrators
(ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
(ID-IO) ALLOW Full access CREATOR OWNER
Setting up for Reboot
Starting Reboot!
C:\Documents and Settings\2care\Desktop\l2m
System Rebooted!
Running From:
C:\Documents and Settings\2care\Desktop\l2m
killing explorer and rundll32.exe
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.
Killing PID 1548 'explorer.exe'
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright(C) 2002-2003 Craig.Peacock@beyondlogic.
Error, Cannot find a process with an image name of rundll32.exe
Scanning First Pass. Please Wait!
First Pass Completed
Second Pass Scanning
Second pass Completed!
Zipping up files for submission:
adding: clear.reg (164 bytes security) (deflated 2%)
adding: echo.reg (164 bytes security) (deflated 9%)
adding: direct.txt (164 bytes security) (stored 0%)
adding: lo2.txt (164 bytes security) (deflated 71%)
adding: readme.txt (164 bytes security) (deflated 49%)
adding: test.txt (164 bytes security) (stored 0%)
adding: test2.txt (164 bytes security) (stored 0%)
adding: test3.txt (164 bytes security) (stored 0%)
adding: test5.txt (164 bytes security) (stored 0%)
adding: backregs/shell.reg (164 bytes security) (deflated 74%)
Restoring Registry Permissions:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Revoking access for predefined group "Administrators"
Warning (option /rga:(ci)) - There is no ACE to remove!
Registry permissions set too:
RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
This program is Freeware, use it on your own risk!
Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Wi
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access NT AUTHORITY\SYSTEM
(IO) ALLOW Full access NT AUTHORITY\SYSTEM
(NI) ALLOW Full access Everyone
(IO) ALLOW Full access Everyone
Restoring Sedebugprivilege:
Granting SeDebugPrivilege to Administrators ... successful
The following Is the Current Export of the Winlogon notify key:
**************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\Softwa
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"Impersonate"=dword:000000
"DllName"=hex(2):63,00,72,
6c,00,00,00
"Logoff"="ChainWlxLogoffEv
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"Impersonate"=dword:000000
"DllName"=hex(2):63,00,72,
6c,00,6c,00,00,00
"Logoff"="CryptnetWlxLogof
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEven
"Logoff"="WinlogonLogoffEv
"ScreenSaver"="WinlogonScr
"Startup"="WinlogonStartup
"Shutdown"="WinlogonShutdo
"StartShell"="WinlogonStar
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"DllName"="C:\\WINDOWS\\re
"Impersonate"=dword:000000
"Startup"="SysLogon"
"Logoff"="SysLogoff"
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertPro
"Logoff"="SCardStopCertPro
"Lock"="SCardSuspendCertPr
"Unlock"="SCardResumeCertP
"Enabled"=dword:00000001
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"DllName"=hex(2):77,00,6c,
6c,00,6c,00,00,00
"Impersonate"=dword:000000
"StartShell"="SchedStartSh
"Logoff"="SchedEventLogOff
[HKEY_LOCAL_MACHINE\Softwa
"Logoff"="WLEventLogoff"
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
"DllName"=hex(2):73,00,63,
6c,00,6c,00,00,00
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensSt
"StopScreenSaver"="SensSto
"Startup"="SensStartupEven
"Shutdown"="SensShutdownEv
"StartShell"="SensStartShe
"PostShell"="SensPostShell
"Disconnect"="SensDisconne
"Reconnect"="SensReconnect
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
[HKEY_LOCAL_MACHINE\Softwa
"Asynchronous"=dword:00000
"DllName"=hex(2):77,00,6c,
6c,00,6c,00,00,00
"Impersonate"=dword:000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostSh
"Shutdown"="TSEventShutdow
"StartShell"="TSEventStart
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconn
"Disconnect"="TSEventDisco
[HKEY_LOCAL_MACHINE\Softwa
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExp
"Logoff"="UnregisterTicket
"Impersonate"=dword:000000
"Asynchronous"=dword:00000
The following are the files found:
**************************
Registry Entries that were Deleted:
Please verify that the listing looks ok.
If there was something deleted wrongly there are backups in the backreg folder.
**************************
REGEDIT4
[HKEY_LOCAL_MACHINE\Softwa
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTW
[HKEY_LOCAL_MACHINE\SOFTWA
"SV1"=""
**************************
Desktop.ini Contents:
**************************
**************************
Hi!
Did you try running TDS-3?
What were it's results?
RF
Did you try running TDS-3?
What were it's results?
RF
ASKER
What if i boot into safe mode and remove mfcdoc.dll? is it a important file?
Here's info on how to use TDS-3:
http://tds.diamondcs.com.au/index.php?page=easytouse
And, here's how to update it if you are not registered (trial version users):
http://tds.diamondcs.com.au/index.php?page=update
http://tds.diamondcs.com.au/index.php?page=easytouse
And, here's how to update it if you are not registered (trial version users):
http://tds.diamondcs.com.au/index.php?page=update
ASKER
ok i updated TDS did a full system scan found about +-15 alarms, deleted 3 definite problems the rest were all possible problems, none of them seemed related to the winlogon
or mfcdoc.dll or troj_agent.fz
or mfcdoc.dll or troj_agent.fz
Well, that mfcdoc.dll file does not appear to be a valid Windows file.
Yes, you could try going into "Safe" mode and delete it -
or use Killbox in safe mode to get rid of it.
RF
Yes, you could try going into "Safe" mode and delete it -
or use Killbox in safe mode to get rid of it.
RF
XP Home - Pro - Win 2000 - 98 - ME
RF