hammerman

1. В заглавието на темата да е упомената думата RQ или Търся. Тема без RQ или Търся в заглавието си се трие. Здравейте! Трябва ми програма за "лекуване на папки". Пълна папка с информация и не ми я отваря по никакъв начин , пробвах и с Knoppix не става.... Моля за помощ!

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:00:32, on 22.3.2009 г. Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\igfxtray.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\PROGRA~1\AVG\AVG8\avgnsx.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\AVG\AVG8\avgcsrvx.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Vania\Desktop\New Folder (2)\post.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.bg/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [skyTel] SkyTel.EXE O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O17 - HKLM\System\CCS\Services\Tcpip\..\{61BD9FF6-E00B-40BA-82D1-64F279E6544C}: NameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{61BD9FF6-E00B-40BA-82D1-64F279E6544C}: NameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{61BD9FF6-E00B-40BA-82D1-64F279E6544C}: NameServer = 192.168.1.1 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- End of file - 5247 bytes

Malwarebytes' Anti-Malware 1.34 Database version: 1886 Windows 5.1.2600 Service Pack 2 22.3.2009 г. 22:52:08 mbam-log-2009-03-22 (22-52-08).txt Scan type: Full Scan (C:\|G:\|) Objects scanned: 73664 Time elapsed: 12 minute(s), 25 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

ComboFix 09-03-19.02 - Vania 2009-03-22 22:13:21.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1251.1.1033.18.503.96 [GMT 2:00] Running from: c:\documents and settings\Vania\Desktop\ComboFix.exe AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\x64 G:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2009-02-22 to 2009-03-22 ))))))))))))))))))))))))))))))) . 2009-03-22 22:03 . 2009-03-22 22:03 <DIR> d-------- C:\hgjghj 2009-03-22 20:46 . 2009-03-22 20:46 <DIR> d-------- c:\documents and settings\Vania\temp 2009-03-22 20:46 . 2009-03-22 20:46 <DIR> d-------- c:\documents and settings\Vania\Application Data\TeamViewer 2009-03-22 19:50 . 2009-03-22 19:50 <DIR> d-------- c:\program files\Disk Heal 2009-03-22 18:50 . 2009-03-22 18:51 <DIR> d-------- c:\documents and settings\Vania\Application Data\Nero 2009-03-22 13:44 . 2009-03-22 13:44 <DIR> d-------- c:\program files\AskTBar 2009-03-22 13:42 . 2009-03-22 13:42 <DIR> d-------- c:\program files\Windows Sidebar 2009-03-22 13:24 . 2009-03-22 13:44 <DIR> d-------- c:\program files\Nero 2009-03-22 13:23 . 2009-03-22 14:04 <DIR> d-------- c:\program files\Common Files\Nero 2009-03-22 13:23 . 2009-03-22 13:34 <DIR> d-------- c:\documents and settings\All Users\Application Data\Nero 2009-03-22 03:31 . 2004-08-03 23:08 26,496 --a--c--- c:\windows\system32\dllcache\usbstor.sys 2009-03-21 04:26 . 2009-03-21 04:29 <DIR> d-------- c:\program files\The KMPlayer 2009-03-15 10:38 . 2009-03-15 10:44 <DIR> d-------- c:\documents and settings\Vania\Application Data\Media Player Classic 2009-03-07 12:01 . 2009-03-22 12:15 <DIR> d--h----- C:\$AVG8.VAULT$ 2009-03-07 02:18 . 2009-03-07 02:18 <DIR> d-------- c:\program files\uTorrent 2009-03-07 02:18 . 2009-03-22 21:39 <DIR> d-------- c:\documents and settings\Vania\Application Data\uTorrent 2009-03-06 20:13 . 2009-03-06 20:13 0 --a------ c:\windows\nsreg.dat 2009-03-04 21:10 . 2009-03-22 20:12 <DIR> d-------- c:\documents and settings\Vania\Application Data\skypePM 2009-03-04 21:10 . 2009-03-04 21:10 56 --ah----- c:\windows\system32\ezsidmv.dat 2009-03-04 21:08 . 2009-03-04 21:08 <DIR> dr------- c:\program files\Skype 2009-03-04 21:08 . 2009-03-04 21:08 <DIR> d-------- c:\program files\Common Files\Skype 2009-03-04 21:08 . 2009-03-22 21:24 <DIR> d-------- c:\documents and settings\Vania\Application Data\Skype 2009-03-04 21:08 . 2009-03-04 21:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\Skype 2009-03-04 00:05 . 2009-03-04 00:05 940,794 --a------ c:\windows\system32\LoopyMusic.wav 2009-03-04 00:05 . 2009-03-04 00:05 146,650 --a------ c:\windows\system32\BuzzingBee.wav . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-03 16:55 --------- d-----w c:\documents and settings\Vania\Application Data\AVGTOOLBAR 2009-03-03 16:53 325,640 ----a-w c:\windows\system32\drivers\avgldx86.sys 2009-03-03 16:53 107,912 ----a-w c:\windows\system32\drivers\avgtdix.sys 2009-03-03 16:53 10,520 ----a-w c:\windows\system32\avgrsstx.dll 2009-03-03 16:53 --------- d-----w c:\program files\AVG 2009-03-03 16:53 --------- d-----w c:\documents and settings\All Users\Application Data\avg8 2009-03-03 15:58 --------- d-----w c:\program files\Google 2009-03-03 15:46 --------- d--h--w c:\program files\InstallShield Installation Information 2009-03-03 15:46 --------- d-----w c:\program files\Realtek 2009-03-03 15:45 9,709,568 ----a-w c:\windows\RTLCPL.exe 2009-03-03 15:45 86,016 ----a-w c:\windows\SoundMan.exe 2009-03-03 15:45 69,632 ----a-w c:\windows\Alcmtr.exe 2009-03-03 15:45 499,712 ----a-w c:\windows\RtlExUpd.dll 2009-03-03 15:45 49,152 ----a-w c:\windows\system32\ChCfg.exe 2009-03-03 15:45 4,381,184 ----a-w c:\windows\system32\drivers\RtkHDAud.Sys 2009-03-03 15:45 364,544 ----a-w c:\windows\RtlUpd.exe 2009-03-03 15:45 2,879,488 ----a-w c:\windows\SkyTel.exe 2009-03-03 15:45 2,808,832 ----a-w c:\windows\alcwzrd.exe 2009-03-03 15:45 2,155,008 ----a-w c:\windows\MicCal.exe 2009-03-03 15:45 16,264,192 ----a-w c:\windows\RTHDCPL.exe 2009-03-03 15:45 --------- d-----w c:\program files\Common Files\InstallShield 2009-03-03 15:36 --------- d-----w c:\program files\Intel 2009-03-03 15:07 --------- d-----w c:\program files\microsoft frontpage . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{9CB65206-89C4-402c-BA80-02D8C59F9B1D}"= "c:\program files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL" [2009-03-22 57344] [HKEY_CLASSES_ROOT\clsid\{9cb65206-89c4-402c-ba80-02d8c59f9b1d}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-17 68856] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-01-29 23975720] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-03 131072] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-03 163840] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-03-03 135168] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-03 1932568] "RTHDCPL"="RTHDCPL.EXE" [2009-03-03 c:\windows\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2009-03-03 c:\windows\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-03-03 18:53 10520 c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-03-03 325640] R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-03-03 107912] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-03-03 908056] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-03 298264] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.bg/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s TCP: {61BD9FF6-E00B-40BA-82D1-64F279E6544C} = 192.168.1.1 FF - ProfilePath - c:\documents and settings\Vania\Application Data\Mozilla\Firefox\Profiles\cijfd5am.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-22 22:14:34 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2009-03-22 22:15:19 ComboFix-quarantined-files.txt 2009-03-22 20:15:15 Pre-Run: 18 997 919 744 bytes free Post-Run: 24,623,677,440 bytes free 129

Здравейте! Преди време бях хванал едни вируси в системните файлове на дяловете. Качих си файловете на един външен хард и направих фул формат на диска. Всичко се оправи и т.н. , но днес реших да си върна файловете и да изчистя другия хард каквото има там. Антивирусната (AVG free) ми засече че има вируси , същите тези , които бях качил с файловете и харда откачи когато цъкам в папката където е информацията не ми я отваря дава ми Acces denied и ми показва , че е празна , а като цъкна на самия хард ми показва че от 465 disk space са свободни само 409 - точно толкова колкото е информацията.. Тя е адски важна за мен и ако някой ми помогне да си я върна ще съм много благодарен. Това са някакви вируси , които ти скапват експлорера на самия дял попринцип и само фул формат ги оправя , не мога да си позволя да го направя , защото там има около 30 ГБ снимки , които ги няма никъде другаде и просто ще съм съкрушен ако не мога да си го оправя.. Сега ще дърпам няко й bootable linux да пробвам с него дали ще стане , обаче нз.. Пробвах да чекна диска един час го чаках на първа фаза , завърши я и накрая ми каза че нищо не е направил скапания уиндоус.. с ХР съм. Благодаря предварително !