"ITBarLayout"=hex:11,00,00,00,5c,00,00,00,00,00,00,00,34,00,00,00,1f,00,00,00,56,00,00,00,01,00,00,00,20,07,00,00,a0,0f,00,00,05,00,00,00,62,05,00,00,26,00,00,00,02,00,00,00,21,07,00,00,a0,0f,00,00,04,00,00,00,21,01,00,00,a0,0f,00,00,03,00,00,00,20,03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00"{01E04581-4EEE-11D0-BFE9-00AA005B4383}"=hex:81,45,e0,01,ee,4e,d0,11,bf,e9,00,aa,00,5b,43,83,10,00,00,00,00,00,00,00,01,e0,32,f4,01,00,00,00"{0E5CBF21-D15F-11D0-8301-00AA005B4383}"=hex:21,bf,5c,0e,5f,d1,d0,11,83,01,00,aa,00,5b,43,83,22,00,1c,00,08,00,00,00,06,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,4c,00,00,00,01,14,02,00,00,00,00,00,c0,00,00,00,00,00,00,46,81,00,00,00,10,00,00,00,a0,8f,ff,ba,9d,d4,c6,01,00,9e,02,bb,9d,d4,c6,01,a0,8f,ff,ba,9d,d4,c6,01,00,00,00,00,00,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,5d,01,14,00,1f,50,e0,4f,d0,20,ea,3a,69,10,a2,d8,08,00,2b,30,30,9d,19,00,2f,43,3a,5c,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,5c,00,31,00,00,00,00,00,3a,31,09,3c,10,00,44,4f,43,55,4d,45,7e,31,00,00,44,00,03,00,04,00,ef,be,3a,31,9c,36,2a,35,f7,29,14,00,00,00,44,00,6f,00,63,00,75,00,6d,00,65,00,6e,00,74,00,73,00,20,00,61,00,6e,00,64,00,20,00,53,00,65,00,74,00,74,00,69,00,6e,00,67,00,73,00,00,00,18,00,4c,00,31,00,00,00,00,00,2a,35,cb,2e,16,00,4e,45,54,57,4f,52,7e,31,00,00,34,00,03,00,04,00,ef,be,3a,31,11,39,2a,35,cb,2e,14,00,00,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,53,00,65,00,72,00,76,00,69,00,63,00,65,00,00,00,18,00,56,00,31,00,00,00,00,00,2a,35,cb,2e,11,00,46,41,56,4f,52,49,7e,31,00,00,3e,00,03,00,04,00,ef,be,2a,35,cb,2e,2a,35,cb,2e,14,00,28,00,46,00,61,00,76,00,6f,00,72,00,69,00,74,00,65,00,73,00,00,00,40,73,68,65,6c,6c,33,32,2e,64,6c,6c,2c,2d,31,32,36,39,33,00,18,00,30,00,35,00,00,00,00,00,2a,35,f1,2e,10,00,fe,94,a5,63,00,00,1c,00,03,00,04,00,ef,be,2a,35,f1,2e,2a,35,f1,2e,14,00,00,00,fe,94,a5,63,00,00,14,00,00,00,60,00,00,00,03,00,00,a0,58,00,00,00,00,00,00,00,6c,69,6e,62,61,6f,68,65,00,00,00,00,00,00,00,00,1e,8c,63,4d,34,72,b3,48,8a,de,83,67,8f,38,be,10,b1,a9,fd,89,90,40,db,11,b2,29,00,d0,59,c0,b8,59,1e,8c,63,4d,34,72,b3,48,8a,de,83,67,8f,38,be,10,b1,a9,fd,89,90,40,db,11,b2,29,00,d0,59,c0,b8,59,00,00,00,00
    5、在HKEY_USERS.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CabinetState
    添加："Settings"=hex:0c，00，02，00，0a，01，ef，75，60，00，00，00
    6、在HKEY_USERS.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\ExtStats
    添加：
    {0055C089-8582-441B-A0BF-17B458C2A3A8}
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
    {92780B25-18CC-41C8-B9BE-3C9C571A8263}
    {AE7CD045-E861-484F-8273-0445EE161910}
    {DEDEB80D-FA35-45D9-9460-4983E5A8AFE6}
    {FB5F1910-F110-11D2-BB9E-00C04F795683}
    7、在HKEY_USERS.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MenuOrder\\Favorites\\链接
    添加："Order"=hex:08，00，00，00，02，00，00，00，0c，00，00，00，01，00，00，00，00，00，00，00
    三、进行上述观察后，重启系统。
    重启后，卡巴斯基报警（我的卡巴斯基为启动加载）：发现灰鸽子。但卡巴斯基仅仅将c:windowswinlogon.dll删除；c:windowswinlogon.exe和c:windowswinlogonKey.dll卡巴斯基并不报毒。汗！！卡巴斯基越来越不争气了另外发现其winlogonKey.log文件。文件内容为：
    #？》。？：4？74;
    四、查杀流程：
    1、打开注册表编辑器，展开HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services
    删除灰鸽子的服务项：winlogon.exe
    2、重启系统。用IceSword找到并删除鸽子释放的那三个文件。
    4、清理注册表（删除鸽子添加的注册表项）。
    五、查杀方法：安全模式下操作
    删除文件
    C:Downloads
    C:WINDOWSsystem32AddrConfig.bin
    C:WINDOWSsystem32oobedata
    C:WINDOWSsystem32wbemddes
    C:WINDOWSsystem32wbemkbd101ab.dll
    C:WINDOWSsystem32wbemSysOption.bin
    C:WINDOWSsystem32wbemwinlogon.exe
    删除注册表
    HKCRCLSID{881F6F06-4620-4070-AD05-BD77D4C56661}
    HKCRInterface{468262B9-8400-4A49-B2E5-CE8550EB1347}
    HKCRTypeLib{F63B08CD-3645-474F-8872-BA4293251FF9}1.0
    HKCRVCFIWZDY32.VCFIWZDY
    HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsListC:WINDOWSSystem32WBEMwinlogon.exe
    HKCUSoftwareMicrosoftMediaPlayerPlayerExtensions
    重启回正常模式即可。
    以上便是手动清除winlogon.exe电脑病毒的详细操作，由于操作起来步骤比较多，所以用户在操作的时候一定要注意，不要删除错了注册表，以免影响到其它功能无法正常使用。
     30. 人生百味，酸甜苦辣都要尝遍。失恋只是其中一味，再苦有黄连苦么？你一辈子吃几次黄莲？人到了一定年龄风花雪月就自动免疫，趁着还有感觉为什么不体验一下悲悲戚戚？
        电脑感染上winlogon.exe病毒了怎么办？按图鸟语一落千丈花香索骥19. 春花的世界似乎离我渐远了，那种悠然的岁月也向我挥手作别。而今而后，我只能生活在你的世界里，守着你的摇篮，等待你的学步，直到你走出我的视线。44. We did so well that we were invited to share our idea and experience with all the students of our school.（2016. 北京）195.细雨鱼儿出，微风燕子斜。《水槛遣心二首》之一    试灯夜初晴大弦嘈嘈如急雨，小弦切切如私语。winlogon.exe,winlogon.exe是什么,winlogon.exe病毒It has taken a long time to convince the public that free enterprise does not mean that a company should be free to pollute the air, foul the rivers, and destroy the forests.