Проблем с локал диск c

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

19 април 201016 г.

Чакаме логовете от сканирането с АВЗ..!

19 април 201016 г.

Автор

А да забравих сега ще ги дам.

Заповядай.

Редактирано 19 април 201016 г. от danielbonev (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

19 април 201016 г.

Изключете интернет,антивирусната си програма и защитната си стена.

AVZ, меню "Файл -- Выполнить скрипт" -- Копирате долунаписания скрипт-- Натиснете бутон "Запустить".

begin

SearchRootkit(true, true);

SetAVZGuardStatus(True);

ClearQuarantine;

StopService('KLIF');

StopService('kl1');

StopService('FDCENT');

  QuarantineFile('C:\WINDOWS\system32\pavcpl.cpl','');

  QuarantineFile('C:\WINDOWS\system32\DRIVERS\klif.sys','');

  QuarantineFile('C:\WINDOWS\system32\drivers\kl1.sys','');

  QuarantineFile('C:\WINDOWS\system32\drivers\FDCENT.SYS','');

   DeleteFile('C:\WINDOWS\system32\drivers\kl1.sys');

   DeleteFile('C:\WINDOWS\system32\DRIVERS\klif.sys');

   DeleteFile('C:\WINDOWS\system32\pavcpl.cpl');

  RegKeyParamDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls','PavCPL');

BC_ImportALL;

ExecuteSysClean;

BC_Activate;

RebootWindows(true);

end.

След изпълнение на скрипта компютъра ви ще се рестартира. След рестарта изпълнете следния скрипт:

begin

CreateQurantineArchive(GetAVZDirectory+'quarantine .zip');

end.

В резултат на изпълнение на втория скрипт ще се сформира quarantine.zip (карантина).Отправете получения файл quarantine.zip от инсталационната папка на AVZ, на [email protected]

19 април 201016 г.

Автор

Готово.Испратих ти e-mail.

1

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

19 април 201016 г.

Получих карантината и я изпратих за анализ....след изпълнение на последния скрипт какво е състоянието на системата?

19 април 201016 г.

Автор

Същата работа както преди.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

19 април 201016 г.

Докато чакаме да се върне резултата направете следното:

- изтеглете TFC - Temp File Cleaner by OldTimer и направете почистване с него

- почистете си декстопа от излишни или ненужни неща

- направете дефрагментация на локален диск ''C''.

Изпратихме три файла за анализ.Ето резултата:

Здравствуйте,

FDCENT.SYS, newdll.dll

Вредоносный код в файлах не обнаружен.

HFFKbd.dll - not-a-virus:Monitor.Win32.KeyLogger.aaw

Это - потенциально опасное ПО. Детектирование файла будет добавлено в следующее обновление.

19 април 201016 г.

Автор

Ок

Редактирано 19 април 201016 г. от danielbonev (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

19 април 201016 г.

Деинсталирйте Hide Files and Folders по стандартния начин..!

20 април 201016 г.

Автор

Аз такава програма нямам.

Дефрегментирах с Diskeeper.

20 април 201016 г.

Автор

И пак като цакна с десен бутон забива и трябва да го рестартирам.Ех защо така става да му се невиди?

Редактирано 20 април 201016 г. от danielbonev (преглед на промените)

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

20 април 201016 г.

Съжалявам.но съм на работа!Утре ще пиша!!!

20 април 201016 г.

Автор

Ок.Много ви благодаря.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

21 април 201016 г.

Изключете интернет,антивирусната си програма и защитната си стена.

AVZ, меню "Файл -- Выполнить скрипт" -- Копирате долунаписания скрипт-- Натиснете бутон "Запустить".

begin

SearchRootkit(true, true);

SetAVZGuardStatus(True);

ClearQuarantine;

StopService('FDCENT');

 QuarantineFile('C:\WINDOWS\hffext\HFFKbd.dll','');

 QuarantineFile('C:\WINDOWS\hffext\HFFExt.dll','');

 QuarantineFile('C:\WINDOWS\system32\drivers\FDCENT.SYS','');

  DeleteFile('C:\WINDOWS\system32\drivers\FDCENT.SYS');

  DelCLSID('{25F156F9-028E-4E95-B02B-9CCB8CC55C5E}');

  DeleteFileMask('C:\WINDOWS\hffext', '*.*', true);

  DeleteDirectory('C:\WINDOWS\hffext');

 BC_ImportDeletedList;

 ExecuteSysClean;

 BC_DeleteSvc('FDCENT');

 BC_Activate;

RebootWindows(true);

end.

След изпълнение на скрипта компютъра ви ще се рестартира.

Изгответе нови логове с АВЗ...?!?

Какво става с проблема.....как е системата?

1

21 април 201016 г.

Автор

Същата работа.Тя попринцип не забива действа си.Обаче нали ви казвам като цдакна с десен ботон на мишката варху който и да е локал диск забива и трябва рестарт.Мен ми е ясно няма да се оправи.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

21 април 201016 г.

Проблема ви определено не е причинен от зловреден софтуер!

....и все пак..... изтеглете RSIT или от тук.Стартирате програмата , избирате проверка за последните три месеца и натискате продължи.Ще се генерират два лога log.txt и info.txt.Прикрепете ги в следващото си съобщение

1

22 април 201016 г.

Автор

info.txt logfile of random's system information tool 1.06 2010-04-22 13:18:21

======Uninstall list======

-->MsiExec /X{1C4551A6-4743-4093-91E4-1477CD655043}

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

µTorrent-->"C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL

3D Инструктор-->"C:\Program Files\3D Инструктор\unins000.exe"

AbiWord 2.8.4-->C:\Program Files\AbiWord\UninstallAbiWord2.exe

Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}

Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}

Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}

Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}

Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}

Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}

Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}

Adobe Color Common Settings-->MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}

Adobe Color EU Extra Settings-->MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}

Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}

Adobe Color NA Recommended Settings-->MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}

Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}

Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}

Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}

Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe

Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}

Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}

Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}

Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}

Adobe Photoshop CS3-->MsiExec.exe /I{3D7E3EC9-46CF-4359-9289-39CE01DFB82F}

Adobe Reader 9 Lite-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A90000000001}

Adobe Setup-->MsiExec.exe /I{FF11004C-F42A-4A31-9BCF-7F5C8FDBE53C}

Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}

Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}

Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}

Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}

Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}

Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}

Advertising Center-->MsiExec.exe /X{b2ec4a38-b545-4a00-8214-13fe0e915e6d}

Ashampoo Burning Studio 9.10-->"C:\Program Files\Ashampoo\Ashampoo Burning Studio 9\unins000.exe"

Ashampoo Slideshow Studio HD 1.0.3-->"C:\Program Files\Ashampoo\Ashampoo Slideshow Studio HD\unins000.exe"

Ashampoo WinOptimizer 6.30-->"C:\Program Files\Ashampoo\Ashampoo WinOptimizer 6\unins000.exe"

Ask Toolbar-->MsiExec.exe /I{86D4B82A-ABED-442A-BE86-96357B70F4FE}

Ask Toolbar-->rundll32 C:\PROGRA~1\AskTBar\bar\1.bin\AskTBar.dll,O

Call of Duty® 2-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\Intel 32\IDriver.exe /M{D0A05794-48C2-4424-A15A-9F20FCFDD374} /l2057

Camtasia Studio 6-->MsiExec.exe /I{49253DE2-FC99-4BE3-99A4-DAB01A8E6088}

Combined Community Codec Pack 2008-01-24-->"C:\Program Files\Combined Community Codec Pack\unins000.exe"

CS 1.6 COOL EDiTiON-->"C:\WINDOWS\CS 1.6 COOL EDiTiON\uninstall.exe" "/U:C:\Program Files\CS 1.6 COOL EDiTiON\Uninstall\uninstall.xml"

Diskeeper 2008 Pro Premier-->MsiExec.exe /X{67A48ED5-0B6A-470A-995C-B8F1942E8AB9}

DolbyFiles-->MsiExec.exe /X{b1adf008-e898-4fe2-8a1f-690d9a06acaf}

DVD X Player 4.0 Professional-->"C:\Program Files\DVD X Studios\DVD X Player 4.0 Professional\unins000.exe"

Farm Vet-->"C:\Program Files\Legacy Interactive\Farm Vet\Uninstall_Farm Vet\Uninstall Farm Vet.exe"

FlexType 2K-->C:\WINDOWS\Datecs\SXUNINST.EXE

Flock (2.5.6)-->C:\Program Files\Flock\uninstall\helper.exe

Ford Racing 2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\Intel 32\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{797E03F8-C8A0-47ED-AA9F-D7076276E491}\setup.exe"

FormatFactory 2.20-->C:\Program Files\FreeTime\FormatFactory\uninst.exe

Free Sound Recorder-->C:\PROGRA~1\FREESO~1\UNWISE.EXE C:\PROGRA~1\FREESO~1\INSTALL.LOG

Free_Lunch_Design Toolbar-->C:\PROGRA~1\Free_Lunch_Design\UNWISE.EXE /U C:\PROGRA~1\Free_Lunch_Design\INSTALL.LOG

GameSpy Arcade-->C:\PROGRA~1\GameSpy Arcade\UNWISE.EXE C:\PROGRA~1\GameSpy Arcade\INSTALL.LOG

GOM Player-->"C:\Program Files\GRETECH\GomPlayer\Uninstall.exe"

Haali Media Splitter-->"C:\Program Files\Haali\MatroskaSplitter\uninstall.exe"

HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall

Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"

Hotfix for Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"

Hotfix for Windows XP (KB979306)-->"C:\WINDOWS\$NtUninstallKB979306$\spuninst\spuninst.exe"

Ink Components-->"C:\Documents and Settings\All Users\Application Data\{02C45027-B817-41FE-A000-2799C43CEF41}\TabletComponents.exe" REMOVE=TRUE MODIFY=FALSE

IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe

Java 6 Update 16-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216016FF}

Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"

Mario Forever-->C:\Buziol Games\Mario Forever\Odinstaluj.exe

Menu Templates - Starter Kit-->MsiExec.exe /X{b78120a0-cf84-4366-a393-4d0a59bc546c}

Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"

Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}

mIRC-->"C:\Documents and Settings\Anii\My Documents\Изтегляния\feshan^models mirc\mirc feshan^models.exe" -uninstall

Movie Templates - Starter Kit-->MsiExec.exe /X{e498385e-1c51-459a-b45f-1721e37aa1a0}

Mozilla Firefox (3.5.9)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe

MP3 To Ringtone Gold 6.0-->"C:\Program Files\AnMing\unins000.exe"

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}

Nero BurnRights-->MsiExec.exe /X{7829db6f-a066-4e40-8912-cb07887c20bb}

Nero ControlCenter-->MsiExec.exe /X{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}

Nero CoverDesigner-->MsiExec.exe /X{62ac81f6-bdd3-4110-9d36-3e9eaab40999}

Nero DiscSpeed-->MsiExec.exe /X{869200db-287a-4dc0-b02b-2b6787fbcd4c}

Nero DriveSpeed-->MsiExec.exe /X{33cf58f5-48d8-4575-83d6-96f574e4d83a}

Nero InfoTool-->MsiExec.exe /X{fbcdfd61-7dcf-4e71-9226-873ba0053139}

Nero Installer-->MsiExec.exe /X{e8a80433-302b-4ff1-815d-fcc8eac482ff}

Nero Live-->MsiExec.exe /X{df6a95f5-adc1-406a-bdc6-2aa7cc0182aa}

Nero PhotoSnap-->MsiExec.exe /X{9e82b934-9a25-445b-b8df-8012808074ac}

Nero Recode-->MsiExec.exe /X{359cfc0a-beb1-440d-95ba-cf63a86da34f}

Nero Rescue Agent-->MsiExec.exe /X{368ba326-73ad-4351-84ed-3c0a7a52cc53}

Nero ShowTime-->MsiExec.exe /X{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}

Nero StartSmart-->MsiExec.exe /X{7748ac8c-18e3-43bb-959b-088faea16fb2}

Nero Vision-->MsiExec.exe /X{43e39830-1826-415d-8bae-86845787b54b}

Nero WaveEditor-->MsiExec.exe /X{a209525b-3377-43f4-b886-32f6b6e7356f}

NeroBurningROM-->MsiExec.exe /X{d025a639-b9c9-417d-8531-208859000af8}

NeroExpress-->MsiExec.exe /X{595a3116-40bb-4e0f-a2e8-d7951da56270}

NeroLiveGadget-->MsiExec.exe /X{9e9fdde6-2c26-492a-85a0-05646b3f2795}

neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}

NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI

NVIDIA PhysX-->MsiExec.exe /X{1C4551A6-4743-4093-91E4-1477CD655043}

PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}

Project64 1.6-->MsiExec.exe /X{9559F7CA-5E34-4237-A2D9-D856464AD727}

Ranch Rush 1.00-->C:\Documents and Settings\Anii\Desktop\Ranch Rush\Uninstall.exe

RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|12.0

RealUpgrade 1.0-->MsiExec.exe /I{F4F4F84E-804F-4E9A-84D7-C34283F0088F}

SCAR Demo-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\Professional\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{84146EF9-4DCB-4321-89AE-EA38956F5FC7}\Setup.exe" -l0x9

Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"

Security Update for Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"

Security Update for Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"

Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9L$\spuninst\spuninst.exe"

Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"

Security Update for Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"

Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"

Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"

Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"

Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"

Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"

Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"

Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"

Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"

Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"

Security Update for Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"

Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"

Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"

Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"

Security Update for Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"

Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"

Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"

Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"

Security Update for Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"

Security Update for Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"

Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"

Security Update for Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"

Security Update for Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"

Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"

Security Update for Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971468)-->"C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"

Security Update for Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"

Security Update for Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"

Security Update for Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"

Security Update for Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"

Security Update for Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"

Security Update for Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"

Security Update for Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975560)-->"C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975561)-->"C:\WINDOWS\$NtUninstallKB975561$\spuninst\spuninst.exe"

Security Update for Windows XP (KB975713)-->"C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.exe"

Security Update for Windows XP (KB976325)-->"C:\WINDOWS\$NtUninstallKB976325$\spuninst\spuninst.exe"

Security Update for Windows XP (KB977165)-->"C:\WINDOWS\$NtUninstallKB977165$\spuninst\spuninst.exe"

Security Update for Windows XP (KB977816)-->"C:\WINDOWS\$NtUninstallKB977816$\spuninst\spuninst.exe"

Security Update for Windows XP (KB977914)-->"C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.exe"

Security Update for Windows XP (KB978037)-->"C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.exe"

Security Update for Windows XP (KB978251)-->"C:\WINDOWS\$NtUninstallKB978251$\spuninst\spuninst.exe"

Security Update for Windows XP (KB978262)-->"C:\WINDOWS\$NtUninstallKB978262$\spuninst\spuninst.exe"

Security Update for Windows XP (KB978338)-->"C:\WINDOWS\$NtUninstallKB978338$\spuninst\spuninst.exe"

Security Update for Windows XP (KB978601)-->"C:\WINDOWS\$NtUninstallKB978601$\spuninst\spuninst.exe"

Security Update for Windows XP (KB978706)-->"C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.exe"

Security Update for Windows XP (KB979309)-->"C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.exe"

Security Update for Windows XP (KB979683)-->"C:\WINDOWS\$NtUninstallKB979683$\spuninst\spuninst.exe"

Security Update for Windows XP (KB980232)-->"C:\WINDOWS\$NtUninstallKB980232$\spuninst\spuninst.exe"

Security Update for Windows XP (KB981349)-->"C:\WINDOWS\$NtUninstallKB981349$\spuninst\spuninst.exe"

Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}

SopCast 2.0.4-->C:\Program Files\SopCast\uninst.exe

SoundTrax-->MsiExec.exe /X{c5a7cb6c-e76d-408f-ba0e-85605420fe9d}

The KMPlayer (remove only)-->"C:\Program Files\The KMPlayer\uninstall.exe"

Uniblue RegistryBooster 2010-->"C:\Program Files\Uniblue\RegistryBooster 2010\unins000.exe"

Update for Windows Media Player 10 (KB926251)-->"C:\WINDOWS\$NtUninstallKB926251$\spuninst\spuninst.exe"

Update for Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"

Update for Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"

Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"

Update for Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"

Update for Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"

Update for Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"

Update for Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"

Update for Windows XP (KB978207)-->"C:\WINDOWS\$NtUninstallKB978207$\spuninst\spuninst.exe"

Update for Windows XP (KB980182)-->"C:\WINDOWS\$NtUninstallKB980182$\spuninst\spuninst.exe"

VIA Platform Device Manager-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}

Vtune 7.5-->"C:\Program Files\Vtune\unins000.exe"

Web Page Maker V2-->"C:\Program Files\Web Page Maker V2\unins000.exe"

Winamp-->"C:\Program Files\Winamp\UninstWA.exe"

WinAVI Video Converter 9.0-->"C:\WINDOWS\WinAVI Video Converter 9.0\uninstall.exe" "/U:C:\Program Files\WinAVI Video Converter 9.0\Uninstall\uninstall.xml"

Windows Bulgarian Interface Pack-->MsiExec.exe /X{C408D81A-CB17-4CDF-98AF-2E64036B3F32}

Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"

WinPcap 3.0-->"C:\Program Files\WinPcap\Uninstall.exe" "C:\Program Files\WinPcap\install.log"

WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

Xfire (remove only)-->"C:\Program Files\Xfire\uninst.exe"

=====HijackThis Backups=====

O1 - Hosts: 66.98.148.65 auto.search.msn.es [2010-04-18]

O24 - Desktop Component 0: (no name) - http://static1.nanoset.net/assets/images/header/bg.jpg [2010-04-18]

O1 - Hosts: 66.98.148.65 auto.search.msn.com [2010-04-18]

O3 - Toolbar: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\tbFre1.dll [2010-04-18]

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file) [2010-04-18]

R3 - URLSearchHook: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\tbFre1.dll [2010-04-18]

======Security center information======

AV: avast! Internet Security (outdated)

FW: avast! Internet Security

======System event log======

Computer Name: ANI

Event Code: 7009

Message: Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.

Record Number: 21126

Source Name: Service Control Manager

Time Written: 20100328015904.000000+120

Event Type: error

User:

Computer Name: ANI

Event Code: 7026

Message: The following boot-start or system-start driver(s) failed to load:

kl1

KLIF

ShldDrv

Record Number: 21120

Source Name: Service Control Manager

Time Written: 20100328015729.000000+120

Event Type: error

User:

Computer Name: ANI

Event Code: 7000

Message: The Panda Process Protection Service service failed to start due to the following error:

The system cannot find the path specified.

Record Number: 21118

Source Name: Service Control Manager

Time Written: 20100328015653.000000+120

Event Type: error

User:

Computer Name: ANI

Event Code: 7000

Message: The Panda Process Protection Driver service failed to start due to the following error:

The system cannot find the file specified.

Record Number: 21117

Source Name: Service Control Manager

Time Written: 20100328015653.000000+120

Event Type: error

User:

Computer Name: ANI

Event Code: 7000

Message: The Cardex service failed to start due to the following error:

Cannot create a file when that file already exists.

Record Number: 21105

Source Name: Service Control Manager

Time Written: 20100328005757.000000+120

Event Type: error

User:

=====Application event log=====

Computer Name: ANI

Event Code: 1517

Message: Windows записа системния регистър на потребител ANI\Anii, докато някое приложение или услуга все още използваше системния регистър по време на излизането. Паметта, използвана от системния регистър на потребителя, не е освободена. Системният регистър ще бъде затворен, когато вече не се използва.

Това често е предизвикано от услуги, които се изпълняват като потребителски акаунт, опитайте да конфигурирате услугите, така че да се изпълняват или в LocalService, или в NetworkService акаунт.

Record Number: 159

Source Name: Userenv

Time Written: 20090927022129.000000+180

Event Type: warning

User: NT AUTHORITY\SYSTEM

Computer Name: ANI

Event Code: 1002

Message: Hanging application winamp.exe, version 5.5.4.2165, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 157

Source Name: Application Hang

Time Written: 20090926215812.000000+180

Event Type: error

User:

Computer Name: ANI

Event Code: 1517

Message: Windows записа системния регистър на потребител ANI\Anii, докато някое приложение или услуга все още използваше системния регистър по време на излизането. Паметта, използвана от системния регистър на потребителя, не е освободена. Системният регистър ще бъде затворен, когато вече не се използва.

Това често е предизвикано от услуги, които се изпълняват като потребителски акаунт, опитайте да конфигурирате услугите, така че да се изпълняват или в LocalService, или в NetworkService акаунт.

Record Number: 152

Source Name: Userenv

Time Written: 20090925184742.000000+180

Event Type: warning

User: NT AUTHORITY\SYSTEM

Computer Name: ANI

Event Code: 1002

Message: Hanging application winamp.exe, version 5.5.4.2165, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Record Number: 151

Source Name: Application Hang

Time Written: 20090925183433.000000+180

Event Type: error

User:

Computer Name: ANI

Event Code: 1000

Message: Faulting application neroexpress.exe, version 9.4.13.100, faulting module nemetadata.dll, version 6.3.2.15, fault address 0x00073522.

Record Number: 149

Source Name: Application Error

Time Written: 20090925181116.000000+180

Event Type: error

User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe

"Path"=%SYSTEMROOT%\SYSTEM32;%SYSTEMROOT%;%SYSTEMROOT%\SYSTEM32\WBEM;C:\PROGRA~1\DISKEE~1\DISKEE~1\

"windir"=%SystemRoot%

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"PROCESSOR_ARCHITECTURE"=x86

"PROCESSOR_LEVEL"=16

"PROCESSOR_IDENTIFIER"=x86 Family 16 Model 6 Stepping 2, AuthenticAMD

"PROCESSOR_REVISION"=0602

"NUMBER_OF_PROCESSORS"=2

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------