elizamoscow

Uprzejmie sie przypominam :-)

Wszystko przygotowane i ponizej link do obu: http://goo.gl/OxK28G Bardzo dziekuje, Marek

Droga Picasso, Sterowniki stare oraz znowu nowe etc... nic nie pomoga ale stara kopia uruchamia sie w awaryjnym bez problemu wiec zastanawiam sie czy nie mozna jakos tego porownac i naprawic. I tylko Ty mi zostalas ! Blagam prosze na kolanach, Marek

helpen aub

Dziekuje uprzejmie za kolejna podpowiedz. Drivery aktualizuje na biezaca wiec zainstalowane sa najnowsze. Jednakze sprawdze ostatnia dzialajaca kopie hdd i wersje drv kontrolera dysku na niej i moze zrobie roll back albo poszukam starszych wersji. Czy ewentualnie mozna to jeszcze rozpracowac na inne sposoby jako ze jest mi bardzo potrzebny awaryjny? Pozdrawiam, M.

Dziekuje Bardzo, W zalaczeniu link do pliku lista.reg http://goo.gl/9hOmj5 Droga Picasso zycze Tobie wymarzonego Nowego Roku !!! M.

Dziekuje - jasne rozumiem. Znalazlem dzisiaj taki wpis w Logach z konsoli Event Viewer ale nie wiem czy to ma jakis zwiazek Event Type: Warning Event Source: ACPIEC Event Category: None Event ID: 3 Date: 09/12/2013 Time: 16:13:00 User: N/A Computer: IBM Description: \Device\ACPIEC: The embedded controller (EC) hardware returned data when none was requested. This may indicate that the BIOS is incorectly trying to access the EC without syncronizing with the OS. The data is being ignored. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 00680000 00be0001 00000000 80050003 0010: 00000000 00000000 00000000 00000000 0020: 00000000 00000000 00369e99 000c2c20 0030: 00400110 00070060 8d480050 00070070 0040: 00120810 00070080 00400810 00070060 0050: ffff0050 00070070 00140010 00070080 0060: 00150010 000d2c20 003f0110 00070060 0070: 99790050 00080070 00140810 00080080 0080: 00410810 00070060 97560050 00070070 Pozdrawiam, M Logi z konsoli Event Viewer+SYSTEM.txt

Droga Picasso, Kopia zawiera tylko std. upd. microsoftu i innych programow - a cala reszta jest bez zmian gdyz nie dokonywalem powaznych zmian. Wiec w zwiazku z powyzszym zrobie skan FRST kopii i moze to pomoze odnalesc problem z awaryjnym albo sterownikiem Dziekuje bardzo ! M.

Droga Picaso, Dziekuje za wszystkie informacje i rady. Ponizej zamieszczam odpowiedzi na Twoje pytania Tak ale zaden z punktow nie zadzialal. kilka miesiecy temu mialem Virusa ZeroAccess ale sie go pozbylem i wszystko dzialalo bez problemu wlacznie z awaryjnym - jednoczesnie nie zmienialem hardwaru a soft to tylko upd z microsoft oraz zawsze po wszelkich upd wchodzilem do awaryjnego bo taki mialem nawyk. ​Wiec teoretycznie powinienem to zauwazyc jako ze wchodzilem do awaryjnego srednio raz na tydzien. Po infekcji policyjnej jeszcze przed KIS wszedlem do awaryjnego( pierwsze posuniecie w celu rozwiazania problemu) i zobaczylem piekny blue screen dopiero potem usunalem virusa. Co narzedzia KIS wyciely nie wiem gdyz mam zainstalowana juz wersje KIS 2014( na drugiej partycji pod Vista x 64) Tak to prawda mam zainstalowane Acronnis i Paragon ale sluzylo to tylko i wylacznie do utworzenia plyty startowej tych programow w celu backupu hdd poza tym nie mialem potrzeby zeby te programy uruchamiac z pod win. Lekarstwo podalem ale nie pomoglo. ALE znalazlem lustrzana kopie z przed okolo 12 miesciecy (z dzialajacy awaryjny) wiec moze zrobie skan FRST i wysle dla porowniania. NA obu dyskach mam tez druga partycie z Vista x 64 wiec moge tez cos podmienic recznie ewentualnie oraz zrobilem lustro obecnego ssd wiec mozna hardcorowo experymentowac ;-) Ponizej link do zrzutu : https://www.dropbox.com/s/nm297lulm8cykn6/Minidump.zip JESTES WIELKA i bardzo dziekuje jeszcze raz ! M. Fixlog.txt

BARDZO DZIEKUJE ! i juz zabieram sie ponownie jako ze dopiero wrocilem z urlopu. EDIT: Droga Picasso, Zgodnie z Twoimi instrukcjami dolaczam wszystkie trzy pliki. Pozdrawiam, Marek Fixlog.txt FRST.txt Addition.txt

Tak mi zalecila Picasso wiec pewnie jest cos na rzeczy. Tak czy inaczej czekam na jej dalsze podpowiedzi :-)

Mialem na mysli tylko to ze skan z zewnatrz moze jest lepszy niz ten z windowsa :-)

Droga Jessi, Wszystkie wpisy sa w rejestrze. Moze problem tkwi w raporcie i to tez to ze skanowalem z poziomu windows. Nie moge sciagnac z linkow polecanych przez Picasso gdyz nie mieszkam w PL moze Ty masz jakis inny link dzialajacy pod reka z winre? Dziekuje Marek

Droga Jessi, Dziekuje bardzo za odpowiedz. Infekcje sam wyczyscilem ale po tym nie moge wejsc w tryb awaryjny ktory jest dla mnie wyjatkowo wazny. Pozdrawiam, Marek P.S. Mam nadzieje ze Picasso wszystko dobrze sie ulozy.

Droga Picasso, Nie bylem w stanie sciagnac plyty z podanej strony gdyz mieszkam poza pl - aczkolwiek jezeli jest to niezbedne i jedyne rozwiazanie to przeszukam internet jeszcze raz. Ponizej jest skan wykonany z poziomu Windowsa: Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-10-2013 Ran by Himalaya (administrator) on IBM on 30-10-2013 15:59:46 Running from C:\Documents and Settings\Himalaya\Desktop\vir Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US) Internet Explorer Version 8 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe (Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe (Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Lenovo Group Limited) C:\WINDOWS\system32\IPSSVC.EXE (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe (Lenovo ) C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\esinter\Bin\eservutil.exe (Apple Computer, Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe (Lenovo.) C:\Program Files\ThinkPad\Utilities\DOZESVC.EXE (Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (OptionNV) C:\WINDOWS\system32\gtdetectsc.exe () C:\Documents and Settings\All Users\Application Data\DatacardService\HWDeviceService.exe (InterVideo) C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jqs.exe (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Nikon Corporation) C:\Program Files\Nikon\Wireless Connecting Utility\NkPtpEnum.exe (Nikon Corporation) C:\Program Files\Nikon\Wireless Transmitter Utility\NkVBus\NkPtpEnum.exe (Nalpeiron Ltd.) C:\WINDOWS\system32\nlssrv32.exe () C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe (Raxco Software, Inc.) C:\Program Files\Raxco\PerfectDisk\PDAgent.exe () C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE () C:\WINDOWS\system32\PSIService.exe (Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe () C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe (Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe (Wacom Technology, Corp.) C:\WINDOWS\system32\Wacom_Tablet.exe (Lenovo Group Limited) C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe () C:\WINDOWS\system32\TpKmpSVC.exe () C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe () C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe (IBM) C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe () C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe (Lenovo ) C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo Group Limited) C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE (Lenovo Group Limited) c:\program files\lenovo\system update\suservice.exe (Lenovo ) C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe (Wacom Technology, Corp.) C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe (Symantec Corporation) C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (Wacom Technology, Corp.) C:\WINDOWS\system32\Wacom_Tablet.exe (Lenovo Group Ltd.) C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe (Lenovo.) C:\WINDOWS\system32\TpShocks.exe (Lenovo Group Limited) C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe (Lenovo Group Limited) C:\Program Files\Lenovo\AwayTask\AwaySch.EXE (Symantec Corporation) C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Lenovo Group Limited) C:\PROGRA~1\THINKV~2\PrdCtr\LPMLCHK.exe (Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe (Sonix) C:\WINDOWS\vsnp2std.exe (Lenovo Group Limited) C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe (Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Acronis) C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acresso Software Inc.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (Lenovo Group Limited) C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited) C:\PROGRA~1\ThinkPad\UTILIT~1\SCHTASK.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Akamai Technologies, Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Akamai\netsession_win.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\WMPNSCFG.exe () C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe (Akamai Technologies, Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Akamai\netsession_win.exe (Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe (Lenovo Group Limited) C:\Program Files\Lenovo\Zoom\TpScrex.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Microsoft Corporation) C:\WINDOWS\system32\WISPTIS.EXE (Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe () C:\tpfancontrol\fancontrol.exe (RealNetworks, Inc.) C:\program files\real\realplayer\update\realsched.exe (Google Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Documents and Settings\Himalaya\Local Settings\Application Data\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [PWRMGRTR] - rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor HKLM\...\Run: [bLOG] - rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog HKLM\...\Run: [synTPLpr] - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [134896 2013-05-29] (Synaptics Incorporated) HKLM\...\Run: [EZEJMNAP] - C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe [256576 2009-12-01] (Lenovo Group Ltd.) HKLM\...\Run: [TpShocks] - C:\Windows\system32\TpShocks.exe [338216 2013-06-20] (Lenovo.) HKLM\...\Run: [TP4EX] - C:\Windows\system32\tp4ex.exe [65536 2005-10-17] (Lenovo Group Limited) HKLM\...\Run: [soundMAX] - C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [716800 2005-05-06] (Analog Devices, Inc.) HKLM\...\Run: [LPManager] - C:\PROGRA~1\THINKV~2\PrdCtr\LPMGR.exe [185688 2009-07-23] (Lenovo Group Limited) HKLM\...\Run: [iSUSPM Startup] - C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup HKLM\...\Run: [iSUSScheduler] - "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start HKLM\...\Run: [AwaySch] - C:\Program Files\Lenovo\AwayTask\AwaySch.EXE [91688 2006-11-07] (Lenovo Group Limited) HKLM\...\Run: [ccApp] - C:\Program Files\Common Files\Symantec Shared\ccApp.exe [115560 2010-05-06] (Symantec Corporation) HKLM\...\Run: [NBKeyScan] - "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" HKLM\...\Run: [LPMailChecker] - C:\PROGRA~1\THINKV~2\PrdCtr\LPMLCHK.exe [124248 2009-07-23] (Lenovo Group Limited) HKLM\...\Run: [soundMAXPnP] - C:\Program Files\Analog Devices\Core\smax4pnp.exe [925696 2005-05-20] (Analog Devices, Inc.) HKLM\...\Run: [snp2std] - C:\WINDOWS\vsnp2std.exe [675840 2006-09-15] (Sonix) HKLM\...\Run: [TPFNF7] - C:\PROGRA~1\Lenovo\NPDIRECT\TPFNF7SP.exe [62312 2010-03-26] (Lenovo Group Limited) HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [624056 2011-08-30] (Adobe Systems Inc.) HKLM\...\Run: [Adobe_ID0EYTHM] - C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE [1884160 2007-03-20] (Adobe Systems Incorporated) HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe [140568 2007-10-30] (Acronis) HKLM\...\Run: [Kernel and Hardware Abstraction Layer] - C:\Windows\KHALMNPR.EXE [76304 2008-02-29] (Logitech, Inc.) HKLM\...\Run: [EPSON PictureMate 500] - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9TE.EXE [98304 2004-10-17] (SEIKO EPSON CORPORATION) HKLM\...\Run: [NBHGui] - "C:\Program Files\Nero\Nero 9\InCD\NBHGui.exe" HKLM\...\Run: [startCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2009-09-29] (Advanced Micro Devices, Inc.) HKLM\...\Run: [AMSG] - C:\PROGRA~1\THINKV~2\AMSG\Amsg.exe [436800 2009-09-03] (LENOVO) HKLM\...\Run: [LENOVO.TPFNF6R] - C:\Program Files\Lenovo\HOTKEY\TPFNF6R.exe HKLM\...\Run: [switchBoard] - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM\...\Run: [LenovoAutoScrollUtility] - C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe [43960 2010-04-01] (Lenovo Group Limited) HKLM\...\Run: [intelZeroConfig] - C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe [1407248 2011-06-22] (Intel® Corporation) HKLM\...\Run: [TVT Scheduler Proxy] - C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe [487424 2008-05-14] (Lenovo Group Limited) HKLM\...\Run: [NSU_agent] - C:\Program Files\Nokia\Nokia Software Updater\nsu3ui_agent.exe [190768 2012-02-28] () HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.) HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\qttask.exe [421888 2012-10-25] (Apple Inc.) HKLM\...\Run: [TkBellExe] - C:\program files\real\realplayer\update\realsched.exe [295072 2012-12-25] (RealNetworks, Inc.) HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2379504 2013-05-29] (Synaptics Incorporated) HKLM\...\Run: [TPKMAPHELPER] - C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe [868352 2007-01-09] (Lenovo) HKLM\...\Run: [TPHOTKEY] - C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe [68976 2008-09-30] (Lenovo Group Limited) Winlogon\Notify\ACNotify: C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll (Lenovo ) Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll (ATI Technologies Inc.) Winlogon\Notify\AwayNotify: C:\Program Files\Lenovo\AwayTask\AwayNotify.dll (Lenovo Group Limited) Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.) Winlogon\Notify\tpfnf2: C:\Program Files\Lenovo\HOTKEY\notifyf2.dll () Winlogon\Notify\tphotkey: C:\Program Files\Lenovo\HOTKEY\tphklock.dll (Lenovo Group Limited) HKLM\...\Policies\Explorer: [NoCDBurning] 0 HKCU\...\Run: [Akamai NetSession Interface] - C:\Documents and Settings\Himalaya\Local Settings\Application Data\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.) HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [204288 2006-10-18] (Microsoft Corporation) HKCU\...\Run: [TPKMAPMN] - C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe [49152 2007-09-21] () HKCU\...\Run: [Google Update] - C:\Documents and Settings\Himalaya\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [136176 2011-06-03] (Google Inc.) MountPoints2: {3a22e5f8-8158-11df-9816-0018de9d29e2} - "F:\WD SmartWare.exe" autoplay=true MountPoints2: {41157d1e-f945-11e1-b331-005056c00008} - E:\HTC_Sync_Manager_PC.exe MountPoints2: {41157d22-f945-11e1-b331-005056c00008} - E:\HTC_Sync_Manager_PC.exe MountPoints2: {4ee2e3b7-2e1b-11e1-a4cc-005056c00008} - E:\AutoRun.exe MountPoints2: {4ee2e3ba-2e1b-11e1-a4cc-005056c00008} - E:\AutoRun.exe MountPoints2: {4ee2e3bc-2e1b-11e1-a4cc-005056c00008} - E:\AutoRun.exe MountPoints2: {5d06abb4-a466-11de-963a-0018de9d29e2} - E:\Launcher.exe MountPoints2: {645b9789-c044-11df-bfd1-0018de9d29e2} - E:\Launcher.exe MountPoints2: {6c25ecd6-839a-11df-981e-0018de9d29e2} - E:\AutoRun.exe MountPoints2: {6c25ecd7-839a-11df-981e-0018de9d29e2} - E:\AutoRun.exe MountPoints2: {7afdf126-0824-11e2-b354-005056c00008} - I:\AutoRun.exe MountPoints2: {7afdf12a-0824-11e2-b354-005056c00008} - E:\AutoRun.exe MountPoints2: {86bf96b4-4da1-11e2-b3f0-005056c00008} - G:\HTC_Sync_Manager_PC.exe MountPoints2: {a39b60be-08fb-11e2-b356-005056c00008} - E:\AutoRun.exe MountPoints2: {bd603406-55e9-11df-97de-0018de9d29e2} - E:\LaunchU3.exe -a MountPoints2: {d18947a2-3654-11de-94de-0018de9d29e2} - E:\AutoRun.exe MountPoints2: {d18947a6-3654-11de-94de-0018de9d29e2} - E:\AutoRun.exe HKU\Administrator\...\RunOnce: [NeroHomeFirstStart] - "C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe" HKU\Default User\...\RunOnce: [NeroHomeFirstStart] - "C:\Program Files\Common Files\Nero\Lib\NMFirstStart.exe" Lsa: [Authentication Packages] msv1_0 relog_ap Lsa: [Notification Packages] scecli ACGina psqlpwd ACGina ACGina BootExecute: autocheck PDBoot.exeautocheck PDBoot.exeautocheck pdboot.exeautocheck autochk * ========================== Services (Whitelisted) ================= R2 6to4; C:\Windows\System32\6to4svc.dll [100864 2010-02-12] (Microsoft Corporation) S4 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) S4 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [427288 2007-10-30] (Acronis) R2 ADExchange; C:\Program Files\Common Files\ArcSoft\esinter\Bin\eservutil.exe [39528 2011-09-16] (ArcSoft Inc.) S3 Adobe Version Cue CS3; C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe [153792 2007-03-20] (Adobe Systems Incorporated) S4 APC UPS Service; C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe [176193 2005-12-12] (American Power Conversion Corporation) S4 ATMsrvc; C:\Windows\System32\ATMsrvc.exe [15360 2000-05-24] (Adobe Systems Incorporated) R2 ccEvtMgr; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108392 2010-05-06] (Symantec Corporation) R2 ccSetMgr; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [108392 2010-05-06] (Symantec Corporation) R2 Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [2162512 2011-09-12] (Diskeeper Corporation) S3 Droppix Service; C:\Program Files\Common Files\Droppix\DxService.exe [151552 2008-02-01] (Droppix) R2 EpsonBidirectionalService; C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) R2 gtdetectsc; C:\WINDOWS\system32\gtdetectsc.exe [122880 2006-09-28] (OptionNV) S4 HTCMonitorService; C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2012-12-12] (Nero AG) R2 HWDeviceService.exe; C:\Documents and Settings\All Users\Application Data\DatacardService\HWDeviceService.exe [271712 2011-03-14] () R2 IPSSVC; C:\Windows\system32\IPSSVC.EXE [108080 2007-01-30] (Lenovo Group Limited) S3 LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [3093880 2010-02-17] (Symantec Corporation) R2 NkPtpEnum; C:\Program Files\Nikon\Wireless Connecting Utility\NkPtpip.dll [71168 2004-12-13] (Nikon Corporation) R2 NkPtpEnumWT3; C:\Program Files\Nikon\Wireless Transmitter Utility\NkVBus\NkPtpip.dll [76288 2012-02-20] (Nikon Corporation) S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] () S4 Paragon System Backup Service; C:\Program Files\Paragon Software\System Backup 2010\program\dbhservice.exe [109072 2010-01-11] (Paragon Software Group) R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () R2 PDAgent; C:\Program Files\Raxco\PerfectDisk\PDAgent.exe [1359224 2012-05-24] (Raxco Software, Inc.) S3 PDEngine; C:\Program Files\Common Files\Raxco\Shared\PDEngine.exe [2129272 2012-05-24] (Raxco Software, Inc.) S4 PLAY ONLINE. RunOuc; C:\Program Files\PLAY ONLINE\UpdateDog\ouc.exe [246112 2012-09-26] () R2 Power Manager DBC Service; C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [1645568 2013-01-11] () R2 ProtexisLicensing; C:\WINDOWS\system32\PSIService.exe [177704 2007-06-05] () R2 PwmEWSvc; C:\Program Files\ThinkPad\Utilities\PWMEWSVC.EXE [1663272 2013-01-11] (Lenovo Group Limited) S4 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] () S3 S24EventMonitor; C:\Program Files\Intel\WiFi\bin\S24EvMon.exe [882960 2011-06-22] (Intel® Corporation) S4 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2009\RpcAgentSrv.exe [98488 2008-09-01] (SiSoftware) R2 ScsiAccess; C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe [186760 2011-09-28] () R2 SmcService; C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe [1831928 2009-11-09] (Symantec Corporation) S4 SNAC; C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE [357704 2010-07-01] (Symantec Corporation) S3 SonicStage Back-End Service; C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe [112184 2007-02-05] (Sony Corporation) S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation) S3 SSScsiSV; C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe [75320 2007-02-05] (Sony Corporation) R2 SUService; c:\program files\lenovo\system update\suservice.exe [28672 2013-07-10] (Lenovo Group Limited) R2 Symantec AntiVirus; C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe [1775344 2009-11-10] (Symantec Corporation) R2 TabletServiceWacom; C:\WINDOWS\system32\Wacom_Tablet.exe [4463400 2009-11-24] (Wacom Technology, Corp.) S4 TPFanControl; C:\tpfancontrol\fancontrol.exe [154112 2008-01-11] () R2 TpKmpSVC; C:\WINDOWS\system32\TpKmpSVC.exe [32768 2006-06-29] () S4 TryAndDecideService; C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe [492720 2007-10-30] () R2 TSSCoreService; C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe [722232 2007-08-03] (IBM) R2 TVT Backup Protection Service; C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [520192 2008-05-14] () S4 TVT Scheduler; C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe [1155072 2008-08-20] (Lenovo Group Limited) S4 VMAuthdService; C:\Program Files\VMware\VMware Workstation\vmware-authd.exe [113264 2011-03-25] (VMware, Inc.) S4 VMnetDHCP; C:\WINDOWS\system32\vmnetdhcp.exe [334448 2011-03-25] (VMware, Inc.) S4 VMUSBArbService; C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe [539248 2011-03-25] (VMware, Inc.) S4 VMware NAT Service; C:\WINDOWS\system32\vmnat.exe [404080 2011-03-25] (VMware, Inc.) S3 WLANKEEPER; C:\Program Files\Intel\WiFi\bin\WLKeeper.exe [370960 2011-06-22] (Intel® Corporation) R2 JavaQuickStarterService; "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" S3 PsaSrv; C:\WINDOWS\system32\PsaSrv.exe [x] S3 UBKZGGXENAA; C:\DOCUME~1\Himalaya\LOCALS~1\Temp\UBKZGGXENAA.exe [x] S4 ufad-ws60; "C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe" -d "C:\Program Files\VMware\VMware Workstation\\" -s ufad-p2v.xml ==================== Drivers (Whitelisted) ==================== S4 abp480n5; C:\Windows\system32\DRIVERS\ABP480N5.SYS [23552 2001-08-17] (Microsoft Corporation) S3 ac97intc; C:\Windows\System32\drivers\ac97intc.sys [96256 2001-08-17] (Intel Corporation) R3 AEAudioService; C:\Windows\System32\drivers\AEAudio.sys [93952 2006-08-07] (Andrea Electronics Corporation) R1 ANC; C:\Windows\System32\drivers\ANC.SYS [11520 2012-09-07] (IBM Corp.) R2 Aspi32; C:\Windows\System32\Drivers\Aspi32.sys [25244 1999-09-10] (Adaptec) R3 atmeltpm; C:\Windows\System32\DRIVERS\atmeltpm.sys [15872 2005-05-17] (Atmel, Inc.) R3 b57w2k; C:\Windows\System32\DRIVERS\b57xp32.sys [161792 2007-05-02] (Broadcom Corporation) S3 BSWinDvr; C:\Program Files\ThinkPad\BiosSettingsWindows\BSWinDvr.sys [8192 2011-07-11] (Lenovo) S3 btaudio; C:\Windows\System32\drivers\btaudio.sys [534568 2009-02-16] (Broadcom Corporation.) R3 BTDriver; C:\Windows\System32\DRIVERS\btport.sys [37160 2009-02-16] (Broadcom Corporation.) R3 BTKRNL; C:\Windows\System32\DRIVERS\btkrnl.sys [991784 2009-02-16] (Broadcom Corporation.) S3 BTWDNDIS; C:\Windows\System32\DRIVERS\btwdndis.sys [156816 2009-02-16] (Broadcom Corporation.) S3 BTWUSB; C:\Windows\System32\Drivers\btwusb.sys [47272 2009-02-16] (Broadcom Corporation.) S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation) S3 COH_Mon; C:\WINDOWS\system32\Drivers\COH_Mon.sys [23888 2008-07-30] (Symantec Corporation) S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] () R2 DefragFS; C:\Windows\System32\Drivers\DefragFS.sys [138768 2011-12-02] (Raxco Software, Inc.) R3 DKRtWrt; C:\Windows\System32\DRIVERS\DKRtWrt.sys [38608 2011-02-14] (Diskeeper Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2013-08-27] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [108120 2013-09-16] (Symantec Corporation) S3 FNETTBOH; C:\Windows\System32\drivers\FNETTBOH.SYS [23680 2009-05-12] (FNet Co., Ltd.) R1 FNETURPX; C:\Windows\System32\drivers\FNETURPX.SYS [7936 2009-05-12] (FNet Co., Ltd.) R2 hcmon; C:\WINDOWS\system32\drivers\hcmon.sys [32368 2011-03-25] (VMware, Inc.) R0 hotcore3; C:\Windows\System32\drivers\hotcore3.sys [40560 2010-09-15] (Paragon Software Group) S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2007-03-08] (HP) S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2007-03-08] (HP) S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2007-03-08] (HP) S3 HSFHWAZL; C:\Windows\System32\DRIVERS\HSFHWAZL.sys [217016 2010-06-02] (Conexant Systems, Inc.) S3 HSF_DPV; C:\Windows\System32\DRIVERS\HSF_DPV.sys [993464 2010-06-02] (Conexant Systems, Inc.) S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [89856 2012-09-26] (Huawei Technologies Co., Ltd.) S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [66688 2012-09-26] (Huawei Technologies Co., Ltd.) S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [26624 2012-09-26] (Huawei Technologies Co., Ltd.) S3 hwdatacard; C:\Windows\System32\DRIVERS\ewusbmdm.sys [65152 2006-06-27] (QUALCOMM Incorporated) R1 IBMTPCHK; C:\WINDOWS\system32\Drivers\IBMBLDID.sys [4224 2012-09-07] () R3 Iviaspi; C:\Windows\System32\drivers\iviaspi.sys [10368 2005-09-20] (InterVideo, Inc.) R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28944 2008-02-29] (Logitech, Inc.) S3 MotDev; C:\Windows\System32\DRIVERS\motodrv.sys [42752 2009-05-08] (Motorola Inc) S3 MSIRCOMM; C:\Windows\System32\DRIVERS\MSIRCOMM.sys [22016 2008-04-13] (Microsoft Corporation) R3 NAVENG; C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20131028.003\NAVENG.SYS [93272 2013-09-16] (Symantec Corporation) R3 NAVEX15; C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20131028.003\NAVEX15.SYS [1612376 2013-09-16] (Symantec Corporation) S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation) S3 NETw3x32; C:\Windows\System32\DRIVERS\NETw3x32.sys [1709696 2006-09-27] (Intel® Corporation) S3 NETw4x32; C:\Windows\System32\DRIVERS\NETw4x32.sys [2236544 2007-11-26] (Intel Corporation) S3 NETw5x32; C:\Windows\System32\DRIVERS\NETw5x32.sys [5977216 2009-09-15] (Intel Corporation) R3 NETwLx32; C:\Windows\System32\DRIVERS\NETwLx32.sys [6609920 2010-10-07] (Intel Corporation) S3 NinjaUSB; C:\Windows\System32\drivers\NinjaUSB.sys [24704 2010-09-06] () R3 odysseyIM4; C:\Windows\System32\DRIVERS\odysseyIM4.sys [173056 2005-06-10] (Funk Software, Inc.) R3 PCASp50; C:\Windows\System32\drivers\PCASp50.sys [27072 2007-06-14] (Printing Communications Assoc., Inc. (PCAUSA)) R2 PDFSFilter; C:\Windows\System32\DRIVERS\PDFsFilter.sys [68464 2012-05-10] (Raxco Software, Inc.) R2 pmem; C:\WINDOWS\System32\drivers\pmemnt.sys [7012 2008-09-20] (Microsoft Corporation) R1 PQNTDrv; C:\Windows\System32\Drivers\PQNTDrv.sys [4228 2003-03-14] (PowerQuest Corporation) R2 PROCDD; C:\Windows\System32\DRIVERS\PROCDD.SYS [12080 2006-11-06] (Lenovo Group Limited) R3 Rasirda; C:\Windows\System32\DRIVERS\rasirda.sys [19584 2001-08-17] (Microsoft Corporation) R2 s24trans; C:\Windows\System32\DRIVERS\s24trans.sys [13952 2010-05-19] (Intel Corporation) S3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2009\WNt500x86\Sandra.sys [21920 2008-07-29] (SiSoftware) R1 Smapint; C:\Windows\System32\drivers\Smapint.sys [14848 2006-10-02] (Microsoft Corporation) R3 SNP2STD; C:\Windows\System32\DRIVERS\snp2sxp.sys [12039680 2007-06-14] () S3 SONYPVU1; C:\Windows\System32\DRIVERS\SONYPVU1.SYS [7552 2001-08-17] (Sony Corporation) R1 SPBBCDrv; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys [421424 2009-12-18] (Symantec Corporation) S3 Spyder3; C:\Windows\System32\DRIVERS\Spyder3.sys [12288 2008-09-08] () R1 SRTSP; C:\Windows\System32\Drivers\SRTSP.SYS [283184 2010-03-08] (Symantec Corporation) S3 SRTSPL; C:\Windows\System32\Drivers\SRTSPL.SYS [320944 2010-03-08] (Symantec Corporation) R1 SRTSPX; C:\Windows\System32\Drivers\SRTSPX.SYS [43696 2010-03-08] (Symantec Corporation) R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT.SYS [125488 2011-12-23] (Symantec Corporation) R3 SYMREDRV; C:\Windows\System32\Drivers\SYMREDRV.SYS [26416 2009-09-03] (Symantec Corporation) R1 SYMTDI; C:\Windows\System32\Drivers\SYMTDI.SYS [188080 2009-09-03] (Symantec Corporation) R1 Tcpip6; C:\Windows\System32\DRIVERS\tcpip6.sys [226880 2010-02-11] (Microsoft Corporation) R0 tdrpman; C:\Windows\System32\DRIVERS\tdrpman.sys [368544 2008-10-02] (Acronis) R1 TDSMAPI; C:\Windows\System32\drivers\TDSMAPI.SYS [9343 2006-10-02] () R3 Teefer2; C:\Windows\System32\DRIVERS\teefer2.sys [67472 2009-12-28] (Symantec Corporation) R2 tifsfilter; C:\Windows\System32\DRIVERS\tifsfilt.sys [44384 2008-10-02] (Acronis) R1 TPHKDRV; C:\Windows\System32\DRIVERS\TPHKDRV.sys [17844 2008-05-12] (Lenovo Group Limited) R1 TPPWRIF; C:\Windows\System32\drivers\Tppwrif.sys [13936 2013-01-11] (Lenovo Group Limited) R1 TSMAPIP; C:\Windows\System32\drivers\TSMAPIP.SYS [4608 2010-03-26] () R1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [32352 2007-03-29] (Windows ® 2000 DDK provider) R1 Uim_IM; C:\Windows\System32\Drivers\Uim_IM.sys [131456 2007-03-29] (Paragon) R3 VBus; C:\Windows\System32\DRIVERS\NkVBus.sys [17344 2012-02-20] (Nikon Corporation) R1 VD_FileDisk; C:\Windows\System32\Drivers\VD_FileDisk.sys [15872 2006-01-13] (Flint Incorporation) R3 vmkbd; C:\WINDOWS\system32\drivers\VMkbd.sys [24688 2011-03-25] (VMware, Inc.) R1 vmm; C:\WINDOWS\system32\Drivers\vmm.sys [229224 2011-05-10] (Microsoft Corporation) R3 VMnetAdapter; C:\Windows\System32\DRIVERS\vmnetadapter.sys [16560 2011-03-25] (VMware, Inc.) R2 VMnetBridge; C:\Windows\System32\DRIVERS\vmnetbridge.sys [32752 2011-03-25] (VMware, Inc.) R2 VMnetuserif; C:\WINDOWS\system32\drivers\vmnetuserif.sys [26352 2011-03-25] (VMware, Inc.) R2 vmx86; C:\WINDOWS\system32\Drivers\vmx86.sys [854256 2011-03-25] (VMware, Inc.) R2 vstor2-ws60; C:\Program Files\VMware\VMware Workstation\vstor2-ws60.sys [22448 2010-08-19] (VMware, Inc.) R1 WPS; C:\WINDOWS\system32\drivers\wpsdrvnt.sys [42312 2009-11-09] (Symantec Corporation) S3 WpsHelper; C:\WINDOWS\system32\drivers\WpsHelper.sys [174056 2012-09-30] (Symantec Corporation) S3 cpu; \??\C:\cpu.sys [x] S2 cpudriver; \??\C:\Program Files\Temporary\cpu.sys [x] S3 HTCAND32; System32\Drivers\ANDROIDUSB.sys [x] S2 P1C1394; \SystemRoot\System32\Drivers\p1c1394.sys [x] U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation) U5 TMUSB; C:\Windows\System32\DRIVERS\TMUSBXP.SYS [49408 2012-09-11] (Seiko Epson Corporation) S3 TVTPktFilter; system32\DRIVERS\tvtpktfilter.sys [x] S4 vsdatant; a [x] S3 xp; \??\C:\Documents and Settings\Himalaya\xp.sys [x] ==================== NetSvcs (Whitelisted) =================== Some content of TEMP: ==================== C:\Documents and Settings\Himalaya\Local Settings\Temp\vcredist_x86.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ Z loga wycialem rzeczy niepotrzebne np . sciezki do dobrze mi znanych i zbytecznych smieci (pulpit etc..) Pozdrawiam serdecznie, Marek

Droga Picasso, Prosze napisz czy na tym etapie oprocz FRST poinienem uzyc ewentualnie jeszcze inne narzedzia do wygenerowania raportu? Pozdrawiam, Marek

Droga Picasso, Dziekuje za odpowiedz, Zaden z trybow awaryjnych w tym z wierszem polecen tez nie dziala. Zabieram sie do skanu za pomaca FRST i dam znac po skanowaniu. Pozdrawiam, Marek

Szanowni Panstwo, Mam zainstalowana legalna wersje Windows XP pro Sp3 EN Po zainfekowaniu virusem Metropolitan Police ktory zostal usuniety KIS 2013 nie dziala Tryb Awaryjny Punkty przywracania systemu nie zadzialy Plyta instalacyjna z Windowsem i tryb recovery tez nic nie daly. Prosze bardzo uprzejmie o pomoc Pozdrawiam, Eliza