Advertisement - Your Ad Here!

Trojan.Vundo Removal Process

December 20, 2007 – 10:36 pm
Advertisement - Your Ad Here!

Trojan.Vundo Explanation

Trojan.Vundo is a new warning message that introduced by a rogue anti-spyware program, IE Defender, which is a form of fake malicious software engineered by Internet hackers. It is a variant of Trojan.Win32 or Trojan.Win32.agent.akk. “Your browser was infected by Trojan.Vundo” critical system error message might appears in your screen.

Trojan.Vundo is not a virus by itself, but it is part of a fake anti-spyware program. Do NOT purchase Trojan.Vundo-related software under any circumstances since it is a fake anti-spyware software.

Are you getting popups from Trojan.Vundo? Have you identified that you have Trojan.Vundo installed on your computer? Do you wish to remove Trojan.Vundo completely from your computer?

Why should you remove Trojan.Vundo?

If Trojan.Vundo resides on your computer, it can potentially damage your personal files or you may end up losing data stored on your system. Research has shown that Trojan.Vundo may have the ability to make your computer vulnerable to remote attacks which could result, initially, in loss of money, possibly identity theft, and, eventually, a painstaking Trojan.Vundo removal process.

How can you manually remove Trojan.Vundo

Manual removal of Trojan.Vundo may not be for everyone. Each manual Trojan.Vundo removal step must be followed delicately to completely remove all related files and registry entries from your computer. If you are unsure or have doubts about editing your system registry, then we recommend that you use the automatic Trojan.Vundo removal process.

Trojan.Vundo can be removed manually by following the steps below.

  1. With all programs closed, click the Start Menu and go to the Control Panel.
  2. Locate the Add/Remove Programs icon and double click it.
  3. Locate Trojan.Vundo in the list of programs. If you find it, select it and remove it. If you cannot find Trojan.Vundo, you can continue to step 5.
  4. Restart your computer.
  5. Close all open programs and windows on your desktop.
  6. Open your registry editor (regedit) program by going to Start Menu, type in regedit, and click OK.
  7. Find all of the following registry entries and delete them. If you do not know how to do this, then you can read how to edit the registry in Windows.

    f12aa50a-a033-4dd6-a337-9d31d83212f2
    92a44a16-c56a-4506-b5cd-6fe05bdbe182
    C26C8718-0A81-40EA-917B-9DFC4D658D2E
    AFDC8AEF-C140-474C-8699-8E48ED08F39E
    BDD8F083-948A-422E-8479-F4F213052EB3
    d66130df-9e6b-460b-8a81-81360a258c61
    47E827B6-4B2F-4053-BEAA-72EB1FB1D6FF
    510ae5d1-bb8b-4f53-8c4b-b3cca7a49707
    F13B1B98-4B6F-488C-B9F2-0FF39284FA00
    677980DC-F409-4E28-82DA-F0ED21D12104
    364cf69c-babb-4259-8bbf-9146fae0e7b7
    52CC18CF-8BC9-434E-9885-7A8DC2F49E49
    51E30BDC-0E41-4AED-8FBE-7813CB42497B
    402f36c6-7287-4663-8622-f0c1ba50d006
    581be782-64c8-4434-a150-3c28747f2abd
    5FCB5CD8-F7BD-4A71-A870-6B80DE1DC857
    610F87CB-9244-6179-D493-1006C8942C74
    C87AEA51-C5B8-4BAD-813B-033EBA98954B
    5867BD51-2C0B-4160-9B9E-0C1D09298758
    73D7D3A8-0F2E-45B1-9707-CE9800E4B221
    41FED73A-D04E-459C-90FE-BA391B6E4686
    f74500d4-08ce-4540-8a4b-437363cad2e3
    09774FB9-5E42-4E4C-9AB6-BF6C44CE2D0B
    1681D529-6349-4E24-9DA4-5F03F57017B4
    4C8323C4-0A72-43F8-97F4-8758AC3ACEC1
    85cb731b-2c29-4df2-a96a-a6937615c835
    43808857-f1dc-4ad0-a297-f2ff73db231e
    209fe39f-f920-487d-8a03-08665e1917b5
    06eab316-1ffb-4bfd-918e-5a5734cac4b4
    2a4fde06-bd26-42d6-aaaf-6cd99101dfc2
    77882e8d-c577-4f9e-a7ee-42c482469138
    SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SSODL
    2abd72d5-4608-4021-b4f2-679f67a138cb
    3d274a38-8da7-4436-830e-aa050cb17956
    50b47919-84fd-43a1-99df-2c250ebadade
    9b6f444d-2fe2-43f8-914f-a27ee28cd186
    8f0dd6fd-26e3-4818-9ccd-14cd8307d19b
    52611dcb-31fb-497f-bf8e-601e7e3db05a
    1f07048a-2ea6-41a2-afcb-6c2683eb45eb
    e9ef6899-d5f4-445e-9e06-ba83a4778a88
    0eba758c-683a-4624-a0c2-d92b9a0ed77c
    891c320f-99c2-4eb0-afb9-533a30fccace
    25dffe66-19d5-4458-9e42-f2d1841dde38
    afc58b78-b9c8-4d20-85fd-3095ebe440b5
    e8757561-ae14-48bc-b32c-91417e43769c
    e83f8a85-a8a2-409c-8413-b2a1425d825a
    c01ad25c-88b8-4d6c-8879-38899e5ec942
    563d41d6-ddc0-4b0b-9ef2-f78baffb294a
    f4919ac8-3c38-4b0c-8cb6-dcdec4e26b11
    b90f60ab-09d4-437b-bbff-e9687e6181bc
    0ff836b8-0146-49ac-9a70-368e77ed9317
    c43f3d3b-ff9a-471b-ad76-ddc20b55d19a
    42db6d2a-639d-41d5-bbbd-abd97c935fbf
    9d7a2fa1-4cf5-40dc-b20a-5563a7353029
    0ff5853b-27d4-48d5-9854-712da770d6fc
    a4455958-433d-4469-b7a0-f74b40b516af
    43bf3165-3053-40c9-88d6-0c6d277f2ee4
    047f1c56-f276-42f0-9041-6e0d6f8e88a1
    f1396ac6-bd77-4cdf-bf21-cd9d10153237
    9d1a49c9-463f-44a6-919b-d12a8a3bc27f
    26119cbf-0e94-4b15-81cc-760062fa9bc5
    a363fcea-9a76-438f-be09-8b125701ad00
    22e66c85-3e0a-421a-bdf3-5705b1d0f0ff
    0ca3e289-b2a2-4ca3-b7db-64c0100d8f43
    bd54d58a-c7b1-42b1-89e5-3e6dfa75576d
    35fbbf9f-d478-4c9b-af75-dcb3622ff5dd
    87118a32-f0f9-4161-b83b-2699e2c6bea0
    fcee61e3-60c2-4930-9061-298a916d6f10
    8b3d9a33-9bee-441e-9d4c-c7759376245e
    1009ee21-bb0c-4675-bf9e-09bed0fdf9a5
    513B2FB3-DEF2-4326-92BF-E932D55B47DE
    16e3ac44-be1d-4e1c-aa9e-0dcc29885757
    69e4695d-c184-462c-a7aa-4d417855102e
    891254bf-5711-41c1-b5cc-bc3b6f768c64
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wvUlmKCs
    740BFA3E-1507-4F96-8954-D0D24FC72386
    e64d249a-50e7-459e-8088-dea8dde354c4
    3258EFEB-5E44-4441-9A3E-676E6671A9E0
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C
    73259091-9574-4ED8-A40F-7F65AFC28634
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\C16CDB5C-2468-4116-AD60-868CA1368FA1
    C16CDB5C-2468-4116-AD60-868CA1368FA1
    C8EDE367-6748-4AA0-AED9-DBD3853413C5
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbXRHbab
    5D752307-7E86-4C30-BFA2-CB517D4D4975
    6E068E05-74AE-42D5-AA9D-694A709750AB
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\A14FB995-D8AC-494B-A6D3-ADC04028F281
    A14FB995-D8AC-494B-A6D3-ADC04028F281
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\48F2A76C-BCC4-4D15-97AC-2C78BC84CB45
    48F2A76C-BCC4-4D15-97AC-2C78BC84CB45
    1CF662BF-4AFD-4778-8306-1F0EB8284EBB
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\F1C5B241-BFBE-4CFC-99A4-76823ADF23F6
    6B566B65-9908-455A-BD18-E0A95232C1D3
    11672574-3bc3-4486-aab6-e8924e835cbf
    82C83B8D-BF1C-4AFC-9789-3756E67BC8B4
    F5F015D8-AC73-4AB8-A99F-503479159097
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\BE0FF150-C7FC-4E37-8F92-4E9AF1389238
    001B255D-6631-4385-AB92-0F48FAEF5003
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\eccaaadaeda
    AA9B2A35-386E-4F4E-8039-B3FD71ED5699
    869B20A6-AADA-477D-BE23-68A966B1183D
    3FECA576-7AD2-4E11-A6AD-6B59D4FB5DB9
    B3905215-7592-484E-9C37-9AD384F79B14
    FCD62A22-2652-410D-9BB7-60AF6EFB06B6
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxywVLCs
    SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\mgsvflkw
    C58F8B70-0D9D-4B4F-A0E9-43E9C19BAD9C
    1c72f7d4-a286-4b60-bdad-438982fbb771
    E2F8F7C7-954D-4336-BA99-27BFBEB73DAF
    9abb719e-1dd1-11b2-ac9c-8f026e140a60
    a7293982-1dd1-11b2-8a34-94155e49565c
    f9ce5ac2-1dd1-11b2-8c7a-8a5883bd5ab2
    77ba6a56-1dd2-11b2-be9c-f1c9200382ff
    000287F3-FF10-4EB4-B87E-72A2A2C4AE0F
    E9383002-FC55-4330-B9C9-67E03BC5C840
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\wvuspmj
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\pjqsvhhy
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\krinzofe
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\bwqluyf
    3254E4F5-B513-4EAD-AD0C-2ADAF77C5B9C
    01511845-38C0-4ACD-9833-E41994556299
    06cb95b2-1dd2-11b2-896c-f1b954c81abe
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\zvxnccqe
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\winwil32
    63BEE4F3-24BF-45A5-851E-0261FA69401E
    2BD4E5F9-2095-4C67-8520-2ED10DBB8FC4
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ztakalwa
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rqrqpmj
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\xrmuxeol
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\awturrq
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\urqqrqo
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\awtutuv
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\taqwmpvn
    89A1E40D-0254-4F99-B9AE-B60A2D8754A9
    A898D887-10D8-4B6D-94AC-E81C817A96F9
    8F54B7F9-E577-4241-A503-9EEAC25AAD31
    E5E2071A-9B98-4FE4-8162-19D63DFA3CF3
    3EFA0DF2-C335-4596-883D-E602E566D613
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\cbxwwwx
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\xhoflbmk
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\gebcyxx
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\qomnnop
    4C870860-767E-4A1A-911A-97D06D6261AF
    B920151E-CDD2-44DA-BE9E-595733D68F8C
    D6218BEA-A57A-4CFC-A33E-3CDCF84F855D
    A051B1FF-8D7E-418B-AABE-4FF82F4280A2
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ftyacdhh
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\eylddqpy
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\lwaazqwd
    A10C2BE4-6B30-4898-A7EE-DBB825E188D2
    F20C4B44-0FF5-4BFF-9012-62CCEAD5BE47
    6E058763-AD18-45D0-8A9E-25470E16FC1D
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\iifdeby
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\qomklml
    DA1931D6-0FF2-4897-9CCE-F31A2B551D7A
    6DF46812-90AA-460D-8D25-60A3CEF2E16D
    7709DBFC-E5B6-409A-8E3A-967A239BCADA
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\fhletmxb
    07141F2F-58D3-46A6-878D-2E6343AE8095
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\bodalstl
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\urqommj
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\fccbyww
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ssqrqpm
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\vsolgacd
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\khfdecc
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\hgghhij
    B45D3C6F-AE03-44FE-AA32-4E44936D4CC4
    74F46EFD-3B44-4ED6-A6AD-572F1A5DA455
    B66A3EED-E871-4448-BAA4-6A79AAEF8709
    AD54E657-E632-4952-A9B1-EA03D7B6FBAD
    2B54B435-9BB5-4351-8685-077CC2EAC0E4
    5171d01b-bba9-4211-8145-94b0246a9dec
    8781AE16-E4CF-40CF-B2F1-F4EB5BEF83B5
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rylzrjuf
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\fcyyvtt
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\iastikab
    3C1B748F-69CA-4DE8-8DCC-CF257C48EBBE
    6A719349-BDF5-4268-9019-4ACA0C2562D2
    749C5F73-3ADE-4D6D-8C31-AE6FFF8A97A2
    67021700-A997-4F38-B052-6B81BCFF3518
    0A03A342-1B1F-4531-AEB2-899B52DC7F5E
    F8F1F42E-6F5F-48A0-A86A-4818517F5E00
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\uavyuzcx
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\xeonnoua
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\jkklmmk
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\zayqdctt
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rorsupft
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\bjmkqdgm
    2F02D978-0FF6-80F7-60BB-0426224AB7B3
    D32C55FD-3342-4D62-A3B3-3F3AA302460A
    2B3CF38E-7433-46B3-9C04-DEA9E0EFD98A
    89262587-5E0B-43A0-B7B6-7E7841A546CB
    4CB8F4B4-5F66-4D9E-BC3B-184596A58824
    1C1DD717-53B2-485E-A17B-C9977C205E10
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\qommjif
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\wxzdkala
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ebpiyopd
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\csnennod
    380D13B7-ABBC-4326-B2CD-9E5051DBA600
    D92781DB-2E57-4BCB-B16F-72ACF862B6D8
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\yayxxwt
    56BD7B5B-A7C0-4C87-8219-5261F1691F75
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rqromnn
    480598DD-AE28-48B7-82F7-6ADDA1AA6B66
    CB2F43F7-458C-4413-8BB9-C0A338F64BE9
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\gebbabx
    D5075462-6801-4A68-A3AB-F3D75BD1680E
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__c00FB6CB
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\nnnmklm
    E64F0381-0053-4842-B3E5-08F6C4A0AEB6
    C2EF0F81-5644-4CA7-8F22-7B02C9CD3EF3
    733E9132-53CA-4C97-9AC9-145C4502FA20
    FD696D1C-85B0-43B4-AA7A-9371714AA031
    BFCF5680-5EA7-4C81-9747-E35CE66FE0A0
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\cmdmant
    24305829-84D3-4BA3-87EB-F2A92FA82465
    4AA49418-D47E-47EB-AAD9-3FA5155F3025
    8E0D74EA-4936-4F34-81B0-ACED06924E3E
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\gebaxyv
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\jkkli
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\pmkhf
    4F35D0B2-52B4-428C-9FA9-077CE3749E82
    A0DDAF45-C2EC-8A8B-711F-1C2EB19B42D6
    bdff8b81-a18f-4335-bca4-93683f311194
    7FD5BC21-AE40-440D-88E3-F87EAC86E463
    08AD8730-E5CB-4160-ADB8-BD79B033BF67
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ljhgh
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\sstts
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ljjijhe
    090C291A-554F-48CC-A421-8A2C4C9B69FD
    ADCD30FF-0119-4906-8A8B-D52D1EED044B
    00000000-0000-49CE-94E7-EC60B0BBF963
    BE5E19A9-B603-4EA2-D3B0-D78C306860BD
    7538C899-7C24-2FAA-28D6-24879B82BCCD
    DB02206E-91D4-C101-FE7F-B9C9DFB16EC4
    E4EEFFED-93CD-4CF0-A0F3-50D139121FEE
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\mllmk
    65469B42-777B-460E-8C9B-BAFF77B93AA2
    4D84F974-1E73-43E3-8546-C452C2961C90
    76566429-209F-41A6-9525-2096B8EA2F35
    C7217D1B-CCAB-905E-81AA-E3ABAD755396
    0AA9EAF3-2766-4736-F5A4-9DF952035508
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\opnmnmn
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\tuvvtqn
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\nnnkjjh
    4288DC98-140C-1A8F-2907-39B60D49A4C1
    19DCF9BF-467C-3FF7-2971-3EB60841F39D
    458DF0BF-432A-3CF8-2F71-3EB60841F1CF
    48C5E15B-0782-4322-BF84-8BCA892C24AF
    d3fdf9f9-160c-45ec-ab16-716a7c9b4d5f
    6B81AFEF-6808-3FFD-2903-34B60E4BF1C3
    E9BD0828-1FD9-410C-A50F-43EBE65D310F
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ssqqnll
    5119A15D-835D-4AB6-BB5E-613CF01B26E4
    3964D8D6-86D0-493A-B460-A805B5401114
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\awttuur
    6ef83dda-6817-45eb-9d43-a9c28860eb09
    25FC7698-69F1-431A-9224-98B22EB921D7
    2B4F0678-0CB9-CAF2-BB6F-2EFA13B81B0B
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\vturr
    14F909CC-A2AB-4A10-89E5-4C296596064F
    AD931317-E4F5-49B1-B04F-441A4B6A982A
    6236DFD9-DF64-4D7B-B5A1-875492709431
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\geeba
    7570DE33-4F46-439F-90BD-3946D0FAE8A2
    8E8B3A06-986E-498E-91D9-4FAE77635CC0
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\vtsts
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\jkkji
    52DDD24C-45D6-4E47-83C0-5D50A00DAFB5
    825E917D-04F1-447A-8213-3701F6C8A7B3
    D75D6A7D-9EF5-4FB5-B9D3-A88E32EC08DE
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\geedd
    5791B322-3E4C-4DD4-B731-A7F6FC5B548D
    D5E3966F-2820-49DC-87DF-B0B92F7973B7
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\jkhhi
    D37F315E-EE0A-49B3-9B04-A190298BBE75
    SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\xxywtrs
    65810E43-2B5E-4AF6-8AAB-43143E270988
    5ADF3862-9E2E-4ad3-86F7-4510E6550CD0
    4FE8A666-40D2-4A06-A338-6EE341C8FFB9
    950E1E39-86DF-A75B-8A0E-FEADA99026C1
    95591C64-DE8C-F35C-8A0E-FEADA99029C4
    B6C621ED-821B-4311-4EF1-ACA0C115E707
    SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\nnnki
    Software\Microsoft\Internet Explorer\URLSearchHooks\B6C621ED-821B-4311-4EF1-ACA0C115E707
    824E0DBE-E388-4060-A356-7ECFE158E098
    F693441D-D984-4053-B9F7-236CEC3E95EA
    SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\fccccca
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\vtuvttt
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rsvsqbbj
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\opnnljg
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\puvpbml
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\nnnki
    CACA7731-9C77-464A-B1B7-462281DD8164
    C75F164E-DB8F-F324-DC7C-FFADD8E72990
    E12BFF69-38A7-406e-A8EF-2738107A7831
    7FB6297A-4D96-4A5D-87AF-DE48B2EB5ECE
    92A444D2-F945-4dd9-89A1-896A6C2D8D22
    8071E65A-3F56-4426-8372-8667CD213057
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\nnnlljh
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ddabx
    80440127-2315-4464-88B9-7ACB72F43ADB
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcya
    99B4ED66-CE07-4517-9FCB-E8AF1C9AA24C
    D278AB78-308B-472C-BEDD-5078B3F29ECB
    A5BF49A2-94F1-42BD-F434-3604812C807D
    dd02a4eb-4afd-4d60-99d8-e67f964ca813
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\92a44a16-c56a-4506-b5cd-6fe05bdbe182
    45F159FE-4A25-4FB5-8534-0D892944A71E
    4EE2F753-DD53-4FD6-A4A7-D77E46B682FE
    67DAF2C9-E1C7-4F39-8D31-308033BF783A
    7406b8d3-0dfe-45a2-8a6a-d1de720afcc1
    1BE27C5F-EB98-4204-B28A-FBFBFC00DC5A
    3404392b-b246-469c-9f14-34ddf0db2207
    9EE7369A-04FE-4BCE-B3B1-B419D3DE29CB
    EE624203-C5E2-4C61-B398-BA58F0B923C2
    1a1dd693-30a9-47c4-b5ae-d12e05ed66f1
    B2B4ADCA-8F2E-4C3F-A3B5-DC222D9B5D99
    2bc001c5-63f1-46ff-9138-2ec687eda471
    95e1c610-3681-43cc-87a4-5cb151c0ea31
    d83d605f-417b-431d-945c-0ce9012fa282
    be479701-7f21-4aad-a9a7-4623b44f44ec
    bcdad886-d2a2-4cf0-a1d8-da007a530515
    d9ef81f4-7ef4-45e3-9dce-0165deb28940
    aa3bda04-1ae6-4efc-94ee-5f883d27fb48
    af6a817c-7ccf-42f4-a83e-7659bd31c3fb
    F1A8A148-946D-489D-84F6-8828E7FC734D
    787F4D1C-ABE9-46C3-83A2-719188E67DF1
    81B490DC-4797-43A1-EB9B-0CAC5A81A184
    D737EAAF-46F1-464B-857F-E735C20940FF
    ac533c43-15b6-4558-a49d-359ea0009766
    a7eec32d-e547-4c8d-944d-896f64ef40dd
    f193e7a0-5b75-40b3-9c3c-87d1790dd331
    f4620b3e-ee2d-4c6f-beb9-436b84fd12e6
    c1c00227-aac1-4d6f-8df5-e107abbf7c4f
    43098141-41a6-424c-b7cb-bd291645024b
    3015f7d3-1436-413d-8245-96305912b317
    3388065e-ef3b-46d4-b1d5-4421fc78cbb9
    285d8b6d-72c8-4780-9b7f-a1c26abe5ecd
    dee82ddc-dc92-4822-8ac9-ed36069e6a99
    553304b6-0cd7-4ebc-bd1e-c95293e0328d
    363053eb-caf9-4452-b4ad-a86784041522
    5f4e877e-0655-4562-9b68-962fa2ec65e8
    91c4be93-f806-4638-ac4b-4e12a6d03971
    53f772aa-d755-47ee-927d-68de51b5c342
    7bb93cf3-a949-4568-b4f1-44dfcee5809a
    943e81fe-cf16-44fd-a110-147ccd15d787
    d0361b5d-0389-4d30-956a-479e51aaf898
    9eac3552-6fec-4c32-8e63-47cc703e4aa0
    264d654f-9340-4454-8cb3-d1aedd35f1ca
    246da71f-2824-4c86-a696-b68bbd77d944
    7bb7dab5-9edc-46d0-99bc-7725abc64a4a
    f29653b2-ee3c-4479-9617-fccd7705a345
    d855ef83-be76-4994-8e2b-de5b5737165b
    c0532ae0-db00-4194-bb73-7cf47fb99e11
    d12ed761-857c-47e9-ae46-7a78a3d823af
    4c149740-5ad4-4b2f-b012-2e23c943b2ea
    a25fbbe4-cc4f-422e-97cf-d7b2f45eb80d
    ca416e34-d167-46b1-afcb-d7e4c1ae2aab
    ae68e7a8-7671-4cfb-9157-ff2ee50d4607
    9dcec47a-5f88-4202-a3a0-2bd360c37fb1
    608bb3c2-1579-4e64-9beb-5448b0823409
    f0bcc332-858f-4c76-aaac-f106a435b945
    d64ac1a2-36cc-440c-aa73-9b2efda64211
    f24f9154-a0fc-48e6-9562-41ceb82c1cf9
    f1f35495-99dc-490a-882d-517ad6e9d7ec
    ead2d5e5-bf66-4080-b34e-fcce8c2eaa74
    e95752bf-b63c-4d62-994c-e1b8947990b2
    39273a67-8e7d-46c9-a8d3-00744b179625
    30591944-ba46-4a43-9299-5574d633ec9b
    77AB5974-55A3-4737-9FD5-B93C64307F78
    068b416b-2040-44fa-9134-952797aa7fe0
    9ad39313-0868-41df-adfd-7b2ba4cc3d4f
    47660e6a-0f31-4e00-8c4b-1d7b709fc9d2
    d0bdd0f2-f9d9-44c3-aa4b-24d5fe57a6a6
    7C60A2D4-A863-4A3C-8376-289C96C1D31B
    2fbe21fe-edca-4f61-a24a-c0218a4d05f6
    da6fd163-7caf-4cd3-92df-d44da7f6b5e0
    9731dab0-eef2-4573-849f-7e21426d0c01
    a84461c7-5960-4084-b1f6-5e52014b8778
    4441FD6E-20BD-415A-AFFD-F340FBF50949
    7b039acb-7399-4bfe-bc79-662df9625789
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\khfFuVoN
    AD2605AB-4BFF-4A71-9723-4E6D914322E7
    1D3E0364-A660-41C6-B487-B39791ED2344
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\byXroNET
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\4910234A-B457-4278-90D2-0CE778675E25
    4777353E-D7D1-4D47-9300-9D790FEBE87B
    4910234A-B457-4278-90D2-0CE778675E25
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\C7BBDD18-4BD1-416D-877A-4EDB566A0054
    C7BBDD18-4BD1-416D-877A-4EDB566A0054
    76CFB752-E1B5-45E5-871F-E696B997FFB1
    91B0A470-7C46-3176-933C-A2CBDE1AA86A
    40B725ED-5416-45C8-93CF-3139FF5B7BCE
    17D81C1E-8AB5-488D-8076-F1B68A4F46BF
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mlJYOeby
    B1AD2294-FA98-4F5D-BB37-3D6358E3654E
    76427AE7-326F-46D9-BFEF-82A7B4EA0F04
    4d08d6e2-87d2-4d64-9501-1f3b12cd73ec
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\06EEE729-30EC-4480-A5D2-89BB99A618FA
    06EEE729-30EC-4480-A5D2-89BB99A618FA
    32A75D52-5C2C-4D52-8107-1239F8F791E0
    be0ff150-c7fc-4e37-8f92-4e9af1389238
    38EB1D16-1DEB-487F-9475-7E60AC6EF2F9
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcARhhG
    2AB7F6FF-BA11-4E38-93A4-2BFB4548ED0E
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yayvtsp
    10768A5A-1487-4BFB-88EB-3F4E25B8FF1B
    447BF67B-B45B-4E1E-A96E-B9E52E926622
    6D7EFB4A-B28C-4180-829F-02FF49EFF080
    065D18AA-672D-4E0D-AA98-92D881268208
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\8E1BFC0E-8AD2-424D-AC8A-06038481516E
    8E1BFC0E-8AD2-424D-AC8A-06038481516E
    A91487FA-31A2-49A0-8BA2-931C58DCD755
    C43DC856-D3DC-4358-AB56-8C3481B2C3E1
    123095C6-2759-7BFD-5715-5200BAC981EC
    81bdcc2c-1dd2-11b2-bef9-869dfe07a259
    6713CECA-0D7B-0BD8-0615-2B00BFC6DA9B
    6836C59E-760A-0FAB-0062-2F00CBC1DABB
    CF3FC4E8-8132-4D99-B43D-AEC175D64E8B
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\yayyxwx
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\wrjovplq
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\pfnfltdi
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\hgcxdlpq
    2860C741-8F63-45DA-B029-2B4B148AC499
    C68FC8E5-0F46-4F1E-B230-4C03F62587B2
    5C29455E-B755-4543-B8FF-D53CFF8E3E80
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\mljigde
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\dmlesbru
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\itjfwopq
    E85C5BFA-513B-4CCD-881F-C3FC663A1159
    2B0B59B4-55A3-4737-9FD5-B93C6430BF75
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ozknxdys
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\qommnno
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ogsibyqs
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\wjxneuyg
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\tuvstqo
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\wvurrrp
    D2A4BE0B-E77D-4C50-B385-52118845571C
    ECF608B9-C532-4A4C-B6DA-BD718520DF0E
    6AB9E1E8-217E-41FA-8BB0-3E2C3833151E
    DB7BDD90-1654-4A64-8709-63FC34AD187D
    9241CF3E-3F78-45A9-B209-A70A86C80B80
    8E288A58-A281-4F4B-94FD-7E5FBDF0131C
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ieztvzeh
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\khfghgd
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\gebaaay
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\fccayaw
    F47C69F6-2E84-4842-93F4-F3AF84C27C99
    BFC38CAA-B75F-4548-8C52-3FE62A5D27D9
    54EB2D7C-7F1F-4599-9061-62560963238E
    68244B6F-27F5-4146-AEDD-3A5C01BF644D
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ujtfbbfq
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\xxyvtqq
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\jkkifdb
    3612CFD6-AA95-42F9-96D5-54D83826F3E6
    D999BF5D-338F-4EF9-B481-5BC1FA6C979B
    ED1A0815-9115-482B-905C-A999ED8B3083
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ssqqrsq
    062CD169-6E71-4FB4-960A-C585C4CDE783
    BF0BD437-99CE-4113-8579-6C1C051C5A8C
    2CAFE6DF-6335-44CC-BE42-61CD0CE3169D
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ydaegfxl
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\qazhuubo
    5D1AAE84-D493-4643-A9AA-05BFFB966891
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\urqnoli
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ssqpnno
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\owpuhsdx
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ddcdddd
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\eaiacjho
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rjxxzdvx
    C3B01F48-65D0-41E2-B2FE-B3921EF4D670
    DB0B918E-A0A8-482B-8D75-A682816B0C7B
    65E51A23-8533-493D-B7D9-6AB30CAAECB9
    01FECB87-DC11-4FEE-AF80-5AA8C3528F02
    0718E50A-7C52-443D-BCAA-B732C28CC3C5
    108DF8B8-8844-4791-9E69-887B39E0E7C8
    0C3210B4-B044-47C2-B7EA-09FB149FB3EF
    246D6B04-AFD7-4CBD-B258-F29513926487
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ssqnopm
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ljjkkii
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\pmnlm
    962A129F-7863-46DE-AEDE-C476B81F19E8
    6B3FC73E-98A7-4523-A321-B423423F3E91
    5E1E1531-83E1-44A4-AE96-BD069C23B65A
    CEFCEFDE-9AA2-4431-A2C9-21DC2D181F1F
    CC8C6790-AFAE-490C-9043-3DB17569A12D
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\oaexziml
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\nncgxrrj
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\pzcmwxce
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\nvxhekik
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\querdcco
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\qommkjh
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rwerwbqw
    530D1017-9C95-48C8-A45D-6FB1B8E5222E
    91CAA3BA-D619-4FF1-85D3-AEB85892CE38
    BB1ADE36-3DB5-418F-B091-7F27DCA566BF
    EB6EE81E-A2E8-4788-805A-962854AC210D
    C59A461E-C61B-43B9-BDC6-422C83E8C2C5
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\fztikbtt
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\juqbfrmx
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\wvuvstr
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rlzcuhbp
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\yayxwtt
    191B41CC-795A-4133-834A-B29406A05C54
    16594D07-61F8-4026-8122-927AB2154E7A
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\nnnmnmj
    820A2C8D-DFC0-4A9F-B3CA-4410CA4F7C04
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\cbxuspn
    3A113A77-F330-23E6-F468-0891816CEC35
    7370309E-11ED-4EBF-AFCC-5104AA6F3E77
    7058EBD2-CE4F-489D-B1F4-526FB625707E
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\byxyaax
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\mljjj
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\mljjg
    EDA4EECA-6938-40ec-A076-3DEAEC1448D7
    10DA5298-EB22-424C-BC8A-AB13992B7CF6
    032C966A-FED3-4AB5-8218-9073EFA01B50
    b97dc824-676b-42d9-822b-b7549cd88eec
    2C2A8088-8FEC-4F7F-8679-4E204DEA7802
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\WMVime
    560EA5A2-4B1D-4697-87E4-EF424968366F
    42ed34b4-0033-4fdd-a8f6-625e6f5fe14c
    9E5DFCB2-28A9-4E9E-8FA9-BA0253BD1E88
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\nnnnm
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\byxwtqn
    C862D99E-BF28-4AD7-A00F-FA89B4FC4E95
    B9C6A67D-68CD-6519-E85D-3676616A5695
    6FFEF91B-5B27-4A61-57B5-F3B6435DA6A1
    5ce554dd-6085-4754-bf7a-52c4c50f3454
    c44c43c9-e209-4270-9971-8e375fbe3715
    4C1A4E0D-AAD7-451C-8AD2-68165155A906
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\opnkkif
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\cleogwgxcnaf
    55431DD1-8795-4AF3-8FA0-D645DF7910D4
    B38C4489-128B-4C8F-F2A3-E60039BA32AB
    C02A1139-D0A3-A42E-8A0F-F8ADACBD75E7
    3215C5A7-E8A8-4466-85C5-1B2E0197DA76
    0038C8EA-7C57-26DC-28D2-5387EB81BCCB
    4EFF4B2F-E564-2FB2-8751-66557C832912
    05B955B0-2764-4C73-A75E-73311884FE88
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\winxvk32
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\cbxwxxw
    3B5BF20A-C232-4A69-AB52-2899637F8BD3
    F7F1C148-CC11-43D3-A21D-C93325AE7C09
    5929A514-32FE-4AA4-AFB6-9C2350F71C8A
    041FC263-A01B-4ECF-8F3A-E66E65453076
    9F6ECE66-0015-48BC-99C7-43CF73E5C302
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\jkkll
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\awtqr
    5F40AC94-06EF-4C0E-B3E0-C8225D74B1E6
    93C6313C-9DB4-4694-8BD0-E378C573A9AD
    420C4981-32CC-AF09-C412-03797A5A3F37
    638FD296-7AA7-46CA-ACAC-B673215D0707
    8BF884A4-CF81-4E00-B7C1-076FCE6CFDD7
    FD3D23D0-03F8-4578-638E-F19D03050D34
    1480645F-8501-4CFD-9AAB-14121D46B917
    0EE33F3A-4118-4AE6-AD54-44448EF13628
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ddayx
    8DDE6FDB-5AD7-4877-897F-2D2700A9521E
    9724D3EF-A78A-444E-892B-90BBBC50C8A8
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\mljge
    28CC9559-F90D-48E9-9D72-ADEA1AA53C73
    CF46BFB3-2ACC-441b-B82B-36B9562C7FF1
    71973D60-D22E-4916-8A3C-FC10F912C6AE
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\opnno
    BAEA325E-DD9F-406D-91C3-C8AB7EF894B1
    8AF776A7-8B8F-46D4-B3A8-613AD42BFC76
    DCD53738-C4F9-414A-A03C-C7405A4AC844
    2AD2E0B1-7B40-41A8-9380-E7972D4A23AD
    111889C3-412E-4CC6-A232-F0C8A8ABA74D
    938A8A03-A938-4019-B764-03FF8D167D79
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\mllji
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\efcaxxv
    F388B5B1-6EB5-45F0-B686-A592EDF76BDE
    4541ED2B-F053-452F-9B3B-A7A1512C391F
    CBC76B8E-6977-4B2A-BAE3-D6A1230EBEE3
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\mlljj
    1894E2F3-D9F4-4D45-99A1-B437990FF678
    6B690ACD-9479-4C41-8A2D-D6083F650E81
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\awtsr
    196C0D26-1EC2-426F-8E7D-2DF9D319F959
    SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\hgggdef
    6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\mlljg
    030a5aa7-0fc5-44f3-9d2b-633df2f70b7e
    C85195D8-8617-4CD3-815E-DBF7D2701A66
    B8645816-40A9-4704-B552-99DD71ED339E
    SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\exe2mat
    SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\urqrsst
    30C4896B-16F8-6B20-AA3B-6DE33E91A99E
    B6286914-F3DE-DA5E-DD7C-89ADDA972590
    C9D17810-A56A-420B-A048-B2702795B772
    6E245D87-17DC-4AF5-BCD5-7C29CEAF0EE1
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\eacqeifv
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ssqqnli
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\wiwkhora
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\urqrsst
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rqrsr
    F3A8B186-CC1C-427E-872F-7AE3846A6328
    A2773D79-407A-492D-4284-72B95903E43F
    D2B650D8-E766-4B1F-B57F-DEEF0DD988EB
    61D438E6-E51A-4BE5-A762-F4B6B228C57e
    08C134D3-087C-4139-A98C-3A078358DFDE
    205E43A8-B456-4EE1-37FB-0539E29D0D3A
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\jkklj
    D66BD90F-5308-42CE-A46D-C4EC1C0D59C3
    5BC3F7B1-F693-4DFC-870E-D30B5DB8B557
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\FE84C866-4F86-446D-8AFB-1438164EC1F9
    FE84C866-4F86-446D-8AFB-1438164EC1F9
    086f7b54-2ca1-4f41-beee-2dfd4e43c750
    d8955356-3a35-406c-82af-855581e3ea84
    123b62fe-b732-4f2b-9113-be756ab2afb2
    49B63F51-4116-4BF7-A2CD-EE58F776AF07
    09B8AE72-F5F0-4BFE-A2CE-B295D03ED34E
    0843B602-E7DF-43D4-A68A-CD57AA7504BA
    860c4e26-db26-4403-9a50-5fd883d8249b
    56090098-FA5F-48E0-8734-F2A008100528
    6247ddc8-4f63-40dd-93ef-80db93dc859c
    287F4B2E-CE09-433F-A114-756EA51CD91A
    b42cd578-fedc-4295-8191-a688d8d82c6c
    053ac7af-552e-456f-82ea-0652739f25dd
    2236d1ca-6b18-4c56-b402-d45d812c4187
    87d0d4c2-102f-4982-8abb-51605a7887fc
    43a7cc74-42e8-4b0c-8985-817513e9f31e
    310CEF0B-1E4E-44FE-BB3E-E2DA4BC8CF91
    F72B91F1-5293-4AE9-8750-22E6A56EEDC0
    48ae78c4-2ec2-4cb9-9d92-bc729a49718a
    A98B74B3-3120-4334-9549-E52C99EB2DAF
    c381fe4c-b490-42a4-ab37-1512e4acbfa7
    BB9EE723-262E-4F2C-83C2-DD4DAB4DCBF5
    281C27E9-237D-4350-8D50-F634B8F8DDE8
    BD696A13-BF3C-4670-A866-310A52269967
    A3678D24-E087-48E3-8FB3-4C5881ED31C8
    7586c36f-457d-4cf8-bc89-6c03194e3fc9
    ab996a84-af98-4b05-8c79-73c8598b2b17
    741d0aef-379a-4ad7-b709-8d98b819ac8e
    15fd3f1e-8cd9-49c9-9a48-bd526406013c
    a005a01e-4264-4556-8265-59eea976413c
    1c6f3f56-93de-4001-9f5c-68e9d04e0057
    09F781D4-E8A0-49F4-B79F-5B45D1CE36E8
    2827ed1b-02ce-4f3b-85cc-ebe3af97d223
    e32261a7-d22a-4071-ad3d-1ad8a66cebec
    499c3957-0ff7-4c93-9caa-55fd63b1a8f0
    c3a20490-f3e4-4ddb-8501-ff2fe09e0dde
    b4b39df7-1928-4da1-b7b9-b00275658db4
    d38964f3-f428-4b76-acd5-2b2622335e0d
    abd164fa-704b-4011-9183-adcd0bc8bab0
    a7f93670-27a0-49e0-a12e-ede30df650c8
    01361d4d-d6b8-4f27-8527-48ca412720ae
    155625f5-a35c-42e6-96d5-99d548d6797d
    51a57a07-c1bf-4877-a2b3-1f26530a95c7
    dbe6c44e-b3ed-49ff-920f-94190eeaaaeb
    671dc693-9656-4c4f-8a7c-a1d1a7861342
    302b6dce-37c9-426c-b0b5-f68fd341b48a
    b23a4150-035f-474f-b33b-3854e0b8237e
    e3010c7b-9134-4c04-b1bc-57d78d4dbdb3
    9eeacec0-a34e-4751-9e5b-07aef1ed4e76
    9a0028ec-b06d-4540-853f-74acdb941b00
    5f769cef-faa2-4c75-8525-098bc87a95ad
    87d9d76c-cd44-4f7d-b356-12a91dd833ce
    4811b7af-8ed2-4209-8820-6808c47fc500
    58d4b470-f1e9-44e7-b762-32692a71a3a5
    663206bb-94db-4b43-b745-33b382d0997e
    04bceb43-cc12-4d33-bfbd-063ad455230a
    cf2849c2-8bb0-4724-9f51-c6cec6d4eb9e
    5d5e2df6-1f26-4e42-824e-d66a09287f74
    afab2356-17a7-4a29-a416-6bbacc30d762
    97c5721f-21e1-496c-bb8f-6e592faee5ab
    2c8ad03f-2aad-4702-94a2-152cc218b535
    121b875c-70a2-42d8-b396-5fdd45f5afdc
    dc940b4b-2c8f-4b12-9441-de261ebfb6fa
    2e55f7ca-fb6a-4340-bb18-5ffb0bf8dbd0
    f10c8c26-253c-4e67-92cb-fd3d620c5579
    49147bc3-3966-4c94-8ce0-36f719170626
    97afd20f-6fdb-4af3-831e-4dadf5a2d9c6
    d4b20e15-8731-429a-90c7-92a4dd962ca0
    865b1f8f-f5bc-4313-8389-a97b5b0e0ddc
    39417b03-8147-4c22-8977-77634089d243
    c59e1ed6-1eb1-4da6-a89f-d83085289e53
    326f9a10-f698-4e60-8939-68006e133594
    4C9F275D-E5A1-42CF-8D49-FAA172843319
    dbd8c097-bbe9-4361-b0e4-a1c293cadc2d
    251d4b32-50d3-4d2d-9c61-1e0c6fbdd731
    052C73FC-1453-4BC3-89FF-4158B6D9B24A
    F4A62EDA-2222-4D69-AE48-A865593FEB78
    0CC1928C-9A81-4FE4-8B7C-C8C4A645D4BC
    Microsoft\Windows\CurrentVersion\Ext\Stats\6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C
    58e51c56-e7bd-46c3-ad5a-be04ae1bda0d
    db5a474a-12a0-4d26-a1fc-a7ea8ef94edc
    F5734812-E6A1-8833-ECA9-949B5B8A88BF
    B1A27F25-D236-43A3-940C-96CFD325D366
    8BFBD67C-3AF5-4954-A8F7-B15C96B1086B
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkJbbAp
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\76CFB752-E1B5-45E5-871F-E696B997FFB1
    65207959-504A-497C-9B64-F25C39F04635
    1B5FEF9D-92A7-42DF-A6A1-3BC7EF9904A5
    B9B5B133-7A48-4E14-A432-0E725005E6D3
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\iifgfCsP
    9BEA3041-ED41-47D9-80C1-6656905B956C
    SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\1CF662BF-4AFD-4778-8306-1F0EB8284EBB
    68F90619-EDBB-4C1A-A7D6-924D3C1BFD19
    F1C5B241-BFBE-4CFC-99A4-76823ADF23F6
    ecf3cd40-71b4-413a-892e-d819f2e25891
    6096A343-7549-42BC-957B-819E21924C19
    AD91194F-AB20-432C-9508-E8BA30DB5427
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xxywXpPG
    352917C1-0ACF-4C21-8529-E063E4860CC5
    1B3017A4-4565-4EE0-8224-0FB2066662E9
    BD55E693-059F-4788-9C79-5D40456AAEE4
    662B53D6-6ACB-4F72-8AB7-A9D7EAA90C24
    5921B813-D618-4654-8FD0-CF37DC273A65
    C9F21B49-89EE-4A93-A6F9-442F688FA854
    14136DCD-4E72-4967-BB1C-E381CCC335DC
    253E5A3D-720A-422D-9FAC-BF06DDC44555
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\gebaxwvu
    software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\1C72F7D4-A286-4B60-BDAD-438982FBB771
    bf3e55f9-f03d-4c7f-9dc7-89f65ddfb88b
    6F5F722F-7CFB-4EC3-A768-2662D76A631E
    161d60a2-1dd2-11b2-87c1-f6c93922752e
    bd53b9d8-1dd1-11b2-9ee3-cbc2ae6b0e8f
    a1b80fe2-1dd1-11b2-bd56-bb1fe2415393
    876bfa56-1dd2-11b2-89c6-a60e220ef84b
    687cd16a-1dd2-11b2-b39c-b9b8aae1254a
    0B8754A6-AC9F-4CE6-8298-A30C1ACCD4BC
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\wvuvurr
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ublshlvk
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\mljijij
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\cbxwuuv
    C74CE574-7D5F-4FAA-A252-C1D87AA512F0
    FB0F6ED3-CCCC-43D6-93CC-B6640C453400
    66EBCCD7-783D-48FA-8E37-DB59D0B77E5E
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\kfwgkzyx
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\lteisuzy
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\zfaerlkw
    22F773E6-E972-4E8A-B5EA-403BA0C8F546
    6982EC57-5BAD-4300-820E-DC73BCB01141
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\vtutqpp
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\zklovapm
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ddcbcby
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\sfbjbxov
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rqrsqnm
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\fcccbcb
    6828492E-317A-4370-997F-AB8BAB991FE9
    4EF7575B-E2D5-4218-9597-967648BD7055
    08D2EB38-852C-425E-84B0-DE7BB88F4994
    34E897AB-1249-4738-BEC6-07DC6991056E
    0B91AB75-98F5-49A0-A212-65F9FD23AD2F
    C6C6E6BD-4633-4BDA-B404-220FFDC03FCF
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ssqonmn
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\sgacevxj
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ftymduim
    C036F8D1-C70C-4D5B-8229-401E524CAE41
    6FD739FD-7DF2-4F05-9E5E-95CBF8C74ACE
    da8d8464-d8f4-4703-a395-fb7ccb81b20a
    E2160F14-7BD5-43C9-914B-9A054C0DC4E7
    C93C8D80-E9B5-489D-A9FC-EA187DBB53EA
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\cbxuust
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\qomjgfe
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\cbxvuts
    95FDA6B1-88E2-492F-BAFC-0A80D55A0096
    DC2F0E9C-6AAB-45E1-BBF9-DA5E2283D633
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\wvurpmn
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\hgghfee
    E1759A31-E627-4758-9562-6899DF36C9C2
    A4C0B04C-CF51-4F3A-A4C0-F287F96ED843
    2B3CBDC2-8AB6-45B1-B59E-7B0DEE595917
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\dfibnfix
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\npdndtvx
    18084522-3E4E-40FC-8C0F-9862B9B18D56
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\pnajgzkh
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\phkwmpwa
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\orswycpc
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\cbxyaaa
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\vtusppn
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\wvuvwxu
    DA87F8BA-611E-4968-A28A-00965C676292
    A7F095C0-879F-4C6C-BA3C-20CA307536DF
    BEE116D9-9ACB-4372-B290-13FBF470FE09
    F45997BD-9BF0-4F37-B24C-A939D02A8289
    3515AEFC-7F45-49A5-A36C-324D1A980303
    C89AB55F-EECF-4B6A-9B91-D37AD3AA687D
    96f5e3fc-3223-4962-81f6-47bd25b1eebf
    FA16FE06-B462-470E-9653-79C54B1871FF
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\fccddeb
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\jkklk
    B285004D-6D02-4212-91FC-B8F47B68C254
    B3E45A9B-7756-46A2-AB14-90175CD374F9
    93BDD117-36FC-4B45-97BB-5E502D02926A
    EBFDC3B9-7913-4F4D-AC17-8FAE4E98536B
    C620AF6E-C3F0-4EC0-AE8A-A4BE9247C4A9
    E1D1E0E9-14C0-45E9-9D5E-6BFC54A710F8
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\hggghec
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\fccbcab
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ncvouqpo
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\uaidqfmh
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\pmnllii
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\nojyusse
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\hggdaxy
    4A54500A-65FE-4F4A-B860-20EAE2F577F9
    DBE56A70-7840-46FD-92CC-373841095C5E
    50922B45-2CA1-4DC8-AAD6-7C051E0D1EC2
    2855B33C-C8C5-423C-AF1A-46828A99028F
    99E7A3C6-5DD3-4CEF-8B40-9E74A6DD48D1
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\awvvs
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ftcuxbuv
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\edvzvuaf
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ddcyyax
    0202D603-ACCD-4792-9668-B6D08BE685FF
    38EEA34B-D600-4CDF-95B0-E215D0A75645
    178D4E6A-BA5A-4ECB-8521-F7B8393FDB97
    0D5216FC-D813-4AA5-A62B-AB14528E648F
    A11303B0-01AF-47AA-A52E-5BE8D5082DE4
    EEE7178C-BBC3-4153-9DDE-CD0E9AB1B5B6
    5C367187-583A-48AA-BF45-54F3F79900DA
    86882CA4-BE70-4BCE-AEA5-CF40EB8E0BC3
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\winrge32
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\rqoon
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\vturonn
    5D56CE55-E2B7-4A45-8772-C4C4B4A117E0
    47766192-A277-4B09-9345-91E3C2C307B5
    475A682E-95D1-4C83-8074-C8A50A2DD806
    774F12CD-B572-4E9F-916B-07987FAFC709
    23C986DC-468B-4F3C-83E3-E12E62096BC1
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\efcbcca
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\yayxyvs
    17CE0F46-5ABC-44AB-9C26-DACDBC7F2202
    22F58391-22CD-450C-8801-CD261055D743
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\wvuvurs
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\iifcdec
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\pmnmnkk
    457D9E4F-B401-4D63-8BB4-84DA3FE45A76
    B8027A42-5256-4DC8-AB22-29A11B5CFB87
    EFB335B3-4477-444F-ACDF-40749EEC1214
    fcbc7003-d2c5-4c54-8883-a37a5274b491
    801A8B93-C02C-4DC9-9B5C-0935F082ABE2
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\awtttrs
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\gebya
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\awvvv
    EFB668E3-CE89-4C37-90D3-6B8015023461
    3496D13A-609A-407B-B181-8F47B4F28AE9
    52FC53E8-A88C-4E83-902B-3B25E82C25BA
    E9502F6A-EDAD-B421-DCDE-E2ABAE7007C1
    A10E9134-7A86-7D07-879C-70A2A8873BC4
    47AB4627-B164-79B1-8751-66557C81721F
    1481B40D-5498-4C48-998C-8B2E7A91B1A3
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\opnkkhe
    BD722B6C-C8A8-9052-89A9-95ABD97505C2
    ABCDECF0-4B15-11D1-ABED-709549C10000
    f1aef5bf-e28c-46ea-8a6a-02b359992636
    B94E7558-F092-44F7-7793-AFEBA7A3AFB9
    98527F3A-C7AA-C65C-8DAE-E5ABA37505E0
    C84D8A0A-E708-42B6-90CA-9C30956A87C6
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ddayv
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\xxywxxu
    5769af75-7eb1-4a08-b2bc-dba70f49e127
    065b6a69-b140-46ac-94f2-a73fcd4cf615
    3AA15550-DE7E-7515-21E5-007B746C9458
    DF721733-FB8A-4246-A761-9BFA26024350
    A1F1814D-29CB-4D75-AAE1-826629868B5c
    6DB762BC-9CD8-4B41-B71D-E9FC45E804C0
    C09EE577-2F97-4FF5-8546-55D04AB5D51A
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ddcyw
    C6039E6C-BDE9-4de5-BB40-768CAA584FDC
    D6AD3E06-2452-4C46-9A4F-B12785494ED4
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\Comxio
    FCEDDC12-AD36-618C-314C-CDBDAC64353B
    E0446678-7BCB-CB48-15A5-9AF3F8424DC8
    BEDF6603-74F5-47E2-A0D6-432AADDF8E33
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\qomjhef
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ssqpn
    B2CF7EB6-AC9F-4271-B617-37254382BE23
    C551E325-A8A7-4C6A-953C-BDC9F50E8769
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\geeda
    FBFAACF5-6030-4546-A53A-67089889DEEC
    89400652-7E4E-403B-9627-70C64A666602
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\awvvw
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ddcyx
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\pmkkh
    03031274-3FE9-4D6C-9321-88CE43A77011
    066A2CDC-319E-4460-BA45-C24562CD51AA
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ddcyv
    F832AB93-CE96-4942-A4A0-3B9BC84CB000
    0DE0897E-C059-486D-A430-A8A7C1A8F85D
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\awtqp
    CE484558-67B5-4CDD-9E36-C89F712A7B11
    SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\jkhig
    SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ddcya
    7BEC18B9-8655-46A0-8846-AF8CEB584743
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\jkkljih
    2497288a-b7fd-495e-9c51-3dd8e0e6bb48
    D34F415F-4FBD-44FE-B33F-1C600EA608D9
    ae6320f6-c9a4-4161-a31b-93fd86e7f53e
    SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ssqppon
    SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\CamONE
    6193D86A-14F9-3820-F63B-6DE33E91F393
    D4BCE88F-BDC2-4918-A08C-691B01A29E2c
    2A84A58D-D320-43CD-9324-B75E33FFEC31
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ssqro
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\mljgg
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\ddccc
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\urqqrpq
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\winjyg32
    4B646AFB-9341-4330-8FD1-C32485AEE619
    D4E53F11-607A-4604-ABBD-9453B1C4B11D
    9AE48F2D-C3E1-4D0C-9039-702E096067B3
    F530463F-AF4B-475C-B85D-45BDC8118B92
    B0978C0F-D09E-46A6-A476-8B1942422D3B
    B41B2107-A8AE-42D4-852B-8651DAF6B42D
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awtqn
    MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\igfxcui
    67C55A8D-E808-4caa-9EA7-F77102DE0BB6
    Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\opnmjge
    589ADE73-E50F-4B96-979F-059B725B4D94
    2B4DE197-A0A6-4BBB-A819-241BDA8C658C

  8. You may need to return to this removal process for removing Trojan.Vundo. You can do this easily by bookmarking or adding a favorite to this page by clicking here. If you are using the FireFox web browser you can press the keys Ctrl and D simultaneously to bookmark this page.

    Image 1. Bookmark PCHubs removal process

    bookmark-add-favorite

  9. Delete all of the following files that are associated with Trojan.Vundo from your computer.

    maweyeri.dll
    yujukaku.dll
    nagomone.dll
    sedutodo.dll
    pofegohu.dll
    bokiluve.dll
    sewepedo.dll
    zywmdime.dll
    viyezoya.dll
    zevafubi.dll
    zefumiwu.dll
    kuzogago.dll
    nudeleze.dll
    rikojine.dll
    muzurimo.dll
    borababu.dll
    madubiha.dll
    wobowedi.dll
    petolahu.dll
    kahasuha.dll
    luravufa.dll
    weredaho.dll
    yatewefa.dll
    rejipupo.dll
    mofohupu.dll
    roruhore.dll
    rahobofo.dll
    yewiluyo.dll
    kawenola.dll
    ripodefe.dll
    dogejuhu.dll
    lotakine.dll
    hemetepe.dll
    arnobs.dll
    jutizowi.dll
    nldfmtapxvt.dll
    ssqrp.dll
    sstqp.dll
    mljijij.dll
    winwil32.dll
    mljigde.dll
    urqqrqo.dll
    rqrsqnm.dll
    pmnnn.dll
    awtutuv.dll
    qomnnop.dll
    efccy.dll
    gebcyxx.dll
    cbxuust.dll
    awvtr.dll
    geedd.dll-removed_skip
    iifdeby.dll
    jkhfg.dll
    vtstu.dll
    urqnoli.dll
    ddcyy.dll
    khfdecc.dll
    awtss.dll
    pmnnmll.dll
    xxwwv.dll
    ljjkkii.dll
    pmkjg.dll
    ybkjufcz
    kjdsrngn.exe
    fccbcab.dll
    urqom.dll
    vtuuu.dll
    abypofwh.dll
    winshow.exe
    ativtmx.dll
    wvuvstr.dll
    kodsrngs.exe
    mljgd.dll
    geedc.dll
    msvb.dll
    rqromnn.dll
    dkteodwx.dll
    Microsft Windows Adapter
    rqoon.dll
    vturonn.dll
    pmnll.dll
    09-93-30-07-ZN
    pmkjj.dll
    SearchIndexer
    explorei.exe
    c0nime.exe
    iexp1ore.exe
    efcbcca.dll
    yayxyvs.dll
    MsIMMs32
    AVPSrv.exe
    mppds
    ssqpo.dll
    lldsrngp.exe
    nnnnm.dll
    byxwtqn.dll
    33-38-81-17-ZN
    6B95DB4F
    werweb.dll
    gebya.dll
    vtr351.dll
    qvc.dll
    MSOffice
    opnkkhe.dll
    dexplore.exe
    jaen.dll
    jkkll.dll
    ddayv.dll
    nnnkjjh.dll
    uzvdfo
    fwfu
    ddcyw.dll
    ZN
    __c00AD7E3.dat
    nyanxrux.dll
    fajsudvq.dll
    awttuur.dll
    MemoryManager
    ssqpn.dll
    msdsregm.exe
    geeba.dll
    awvvw.dll
    jkkji.dll
    tmp5B.tmp.exe
    ddcyv.dll
    HPDirecter.dll
    B9-92-26-69-ZN
    jkhhi.dll
    B5-54-43-3D-ZN
    Uninstall_CToolbar
    mlljg.dll
    sdkvu32.dll
    j7251636
    Xri
    mlwfltyj.dll
    j9221031
    Roogpcg
    nnnki.dll
    rqrsr.dll
    eacqeifv.dll
    ssqqnli.dll
    wiwkhora.dll
    anti4[1].exe
    awtqn.dll
    ddabx.dll
    aycdd.bak1
    ddcya.dll
    dafumumu.dll
    fubatuzo.dll
    bidubiti.dll
    ledamine.dll
    zimuworo.dll
    yebineza.dll
    besigaza.dll
    hafasego.dll
    ziyewila.dll
    naluwota.dll
    vuhugeya.dll
    hovogove.dll
    pamuyomi.dll
    yohajizi.dll
    lumuheze.dll
    royetuki.dll
    sizulase.dll
    testabd.dll
    fabireze.dll
    hajiruno.dll
    wudepuve.dll
    ragehage.dll
    kefuzego.dll
    damopore.dll
    bugudesi.dll
    madipoha.dll
    tazamuto.dll
    hupetetu.dll
    pakiguwu.dll
    yobuwiji.dll
    keradebu.dll
    kadageko.dll
    mebarepo.dll
    emqsys.dll
    nzngrd.dll
    kutihfgl.dll
    qopoo.dll
    drnpfdxkvw.dll
    Tapicfg.exe
    gebcy.dll
    vtuvv.dll
    vtutr.dll
    tuvstqo.dll
    rqrqpmj.dll
    pmkhh.dll
    awturrq.dll
    fccayaw.dll
    vturq.dll
    tmp2E.tmp.dll
    awvvt.dll
    cbxvuts.dll
    awtss.dll-removed_skip
    ssqqrsq.dll
    geede.dll
    cbxyaaa.dll
    fccbyww.dll
    gebyy.dll
    jkhhh.dll
    geedb.dll
    jkkjj.dll
    fccddeb.dll
    pmkhi.dll
    Microsft Windows Adapter 5.1.3013
    epmbkfcz
    ssttu.dll
    jkklmmk.dll
    pmnllii.dll
    qommkjh.dll
    abypofwh
    jkhff.dll
    ntspkmxl.dll
    yayxwtt.dll
    yayxxwt.dll
    ddcyyax.dll
    FC-CD-D6-62-ZN
    alertic.exe
    cbxuspn.dll
    bufj.exe
    kpdsrngj.exe
    byxyaax.dll
    mljjj.dll
    xxwtr.dll
    rqrqrro.dll
    sstqo.dll
    zt.exe
    exp10rer.exe
    iexp10re.exe
    Rav.exe
    WMVime.dll
    msccrt
    Kvsc3.exe
    AVPSrv
    Bat Wave Base Dale
    pmnmnkk.dll
    hgdcb.dll
    iifcdec.dll
    AC-CA-A5-5A-ZN
    sgohslhh
    E5-56-67-7A-ZN
    awtttrs.dll
    sstts.dll
    ssqrrpo.dll
    hokeno83122.dll
    62-24-47-7E-ZN
    mllmk.dll
    lsdsrngr.exe
    cbxwxxw.dll
    opnmnmn.dll
    awtqr.dll
    Dklvf
    tejetun
    diclwdyA
    ssqqnll.dll
    bwtwhehq.exe
    j0221833.dll
    d3971.dll
    ddayx.dll
    mljge.dll
    vturr.dll
    dwdsregt.exe
    26-60-05-56-ZN
    rkqqm.exe
    vtsts.dll
    efcaxxv.dll
    modsregn.exe
    mlljj.dll
    wpwhvthn.dll
    jkhig.dll
    awtqp.dll
    xxywtrs.dll
    lolgrmra.exe
    exe2mat.dll
    cygdwrso.dll
    mjdsregl.exe
    mjdsregs.exe
    ApachInc
    Qgh
    sstqn.dll
    cdi.dll
    ssqro.dll
    mljgg.dll
    ddccc.dll
    urqqrpq.dll
    jkkjk.dll
    jkklj.dll
    PrintDrive
    sony[1].exe
    zafedeho.dll
    lutazipu.dll
    zivahesu.dll
    bajibuli.dll
    gitoribo.dll
    setunude.dll
    kabujupe.dll
    herugife.dll
    veyevida.dll
    nunayeta.dll
    mohasobi.dll
    tukuhegu.dll
    norupeze.dll
    forukabe.dll
    kozezupo.dll
    zasulege.dll
    nezovefo.dll
    knpcoq.dll
    dadirova.dll
    lekefoji.dll
    mezinoma.dll
    fopijunu.dll
    ganafihe.dll
    goralaro.dll
    komabagi.dll
    zifewiba.dll
    raziwanu.dll
    wibovaha.dll
    mibevilo.dll
    vakemuna.dll
    nuvameje.dll
    gopuvuja.dll
    zikedama.dll
    kugnlc.dll
    farakive.dll
    hhhhae.dll
    khfdc.dll
    khfee.dll
    vtutq.dll
    awvtt.dll
    ssttt.dll
    vtutqpp.dll
    ssqpm.dll
    qommnno.dll
    awvvu.dll
    gebaaay.dll
    cbxwwwx.dll
    khfghgd.dll
    ddaby.dll
    hgddc.dll
    Microsoft Windows Adapter 5.1.3214
    wvurpmn.dll
    qomklml.dll
    fhletmxb.dll
    ssqrq.dll
    vtsqo.dll
    vtusppn.dll
    urqnlmm.dll
    ddcdbab.dll
    websrc32.dll
    awtqo.dll
    mlljk.dll
    17-79-92-28-ZN
    buvwfklw
    hggghec.dll
    jkhfd.dll
    sstuu.dll
    hggdaxy.dll
    A0-08-87-75-ZN
    qommjif.dll
    gebyw.dll
    winshow
    awvvs.dll
    nnnmnmj.dll
    sysdx.dll
    adsldpbj.dll
    gebbabx.dll
    ddcyvtq.dll
    swinqldt.exe
    ktasr.dll
    nnnmklm.dll
    mljjg.dll
    jkkjg.dll
    pmnlm.dll
    winlog0n.exe
    1explore.exe
    crasos.exe
    msgcom.dll
    tmpB4.tmp.dll
    MsIMMs32.exe
    Kvsc3
    mppds.exe
    ownsuser
    pmkhf.dll
    byxyvsp.dll
    jkkli.dll
    horymywe
    zzb
    mevega
    ljhgh.dll
    awvvv.dll
    ljjijhe.dll
    vtr357.dll
    57-72-28-83-ZN
    winxvk32.dll
    vtr431.dll
    D6-6B-BA-A5-ZN
    tuvvtqn.dll
    xxywxxu.dll
    rs2R3ph
    pfrnnzxA
    74-49-9C-CD-ZN
    TISKY009.exe
    gnwcpvqe.dll
    naswxyyx.dll
    Comxio.dll
    kyicrnmi.dll
    j0221833
    opnno.dll
    FA-AA-A9-90-ZN
    geeda.dll
    rkqq
    mllji.dll
    pmkkh.dll
    B1-1B-B5-58-ZN
    geedd.dll
    mndsregp.exe
    awtsr.dll
    63-31-1E-E8-ZN
    winnbl32.dll
    jkkljih.dll
    ssqppon.dll
    j7251636.dll
    9B-B6-64-4C-ZN
    32-2B-B3-32-ZN
    j9221031.dll
    Sen
    urqrsst.dll
    lavuk.dll
    vtuvttt.dll
    rsvsqbbj.dll
    opnnljg.dll
    puvpbml.dll
    gebyv.dll
    igfxsrvc.dll
    aycdd.ini
    opnmjge.dll

    If you need a better understanding on how to search for these files then you can read how to find and search for files and folders here.

    If you have issues deleting any of the previously listed files that are associated with Trojan.Vundo, you can try rebooting your computer into safe mode. Booting into safe mode may allow certain malicious files to be deleted. If you are wondering how to boot into safe mode, you can read our process for starting a computer in safe mode here.

    Image 2. Select “Safe Mode with Networking”

    safe-mode

  10. After locating and deleting the previous files you must remove all directories associated with Trojan.Vundo by going to the C:\ProgramFiles\Trojan.Vundo folder, select it, and delete it. In some cases you may not be able to find this directory. You can still continue to the next step.

  11. Restart your computer. You do not need to boot into safe mode at this point. You should have removed Trojan.Vundo completely from your computer. If you find that Trojan.Vundo is still on your computer, you can repeat the steps again or go to the automatic Trojan.Vundo removal process.

Automatically Remove Trojan.Vundo

Automatically remove Trojan.Vundo for free. Free automatic Trojan.Vundo removal process.

Do you wish to automatically remove Trojan.Vundo from your computer? Are you looking for a free method to remove Trojan.Vundo from your computer? If so, you can utilize the free automatic Trojan.Vundo removal process below. Each step is designed to aid in the use of the program SmitfraudFix, which is a free tool created by S!Ri to remove parasites such as Trojan.Vundo. Just so you know there’s no guarantee that SmitfraudFix or any other spyware remover will remove Trojan.Vundo completely. These instructions are provided as a guide and are to be used at your own risk.

  1. Download the SmitfraudFix tool to your computer by using our free download link here. Save the downloaded file to your desktop.

    Image 1. Save SmitfraudFix.exe

    save-SmitfraudFix

  2. Restart your computer into safe mode. Safe mode will allow malicious files that are normally loaded into memory to be easily deleted by the SmitfraudFix program. Do you want to learn how to boot into safe mode? If so, you can follow our process on how to boot into safe mode here.

  3. After booting into safe mode, double-click on the SmitfraudFix.exe icon that should be located on your desktop. Follow the on-screen instructions. Option number 2 should be selected once the program starts.

    Image 2. Click on SmitfraudFix.exe icon

    SmitfraudFix-icon

  4. After SmitfraudFix performs the initial removal processes it will ask you “Do you want to clean the registry?” Select Y for yes.

    Image 3. For “Do you want to clean the registry?,” select Y for yes

    SmitfraudFix-registry-clean-y

  5. Once SmitfraudFix has finished the registry clean you can restart your computer now.
  6. Trojan.Vundo should be removed from your computer. If not, you can start the automatic removal process over. It may take more than one try in some rare cases.

There’s no guarantee that SmitfraudFix will remove all files due to the complex nature of new spyware files that are ever-changing. If necessary, you may need to get help from a person who knows about computer and spyware.

(Disclaimers: These instructions are provided to you for free and to be used at your own risk. The free removal process for Trojan.Vundo is not guaranteed to work in all circumstances. We are not responsible for any damages.)

  1. 3 Responses to “Trojan.Vundo Removal Process”

  2. I can’t seem to get rid of one of the Vundo files. The file reads tkkhcnju.dll and even the lastest virus & engine of McAfee doesn’t clean it. Any suggestions?

    By Andy on Jan 24, 2008

  3. Thankew very much

    By Fahad Hameed on Feb 12, 2008

  4. On step 8 it says.. find and delete.. then 9 says rename the files.. which one am I supposed to do? delete them.. or rename them then delete them?

    By Nicole on Apr 16, 2008

Post a Comment

*
To prove you're a person (not a spam script), type the security word shown in the picture.
Anti-Spam Image