Witam, kilka dni temu komputer zaczął pracować bardzo głośno. Po sprawdzeniu procesów, okazało się że całe dostępne zasoby procesora zabiera proces systemsvr.exe znajdujący się w folderze appdata\acrobat. Po wyłączeniu procesu, zorientowałem się że cześć plików została zaszyfrowana. Nie są one jednak potrzebne. Natomiast część plików które nie zostały zaszyfrowane (2 foldery, około 200GB danych) chciałbym odratować. Czy możliwe aby wirus szyfrujący przeniósł się na inne komputery w sieci? Chwilowo został odcięty od sieci. Czy z logów można wywnioskować kiedy został zarażony?
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-09-2017
Ran by Administrator (11-09-2017 16:14:07)
Running from C:\Users\Administrator\Desktop
Windows Server 2012 R2 Foundation (X64) (2014-09-09 15:29:31)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1033256238-1554936966-1759224977-500 - Administrator - Enabled) = & gt; C:\Users\Administrator
Dominika (S-1-5-21-1033256238-1554936966-1759224977-1015 - Limited - Enabled) = & gt; C:\Users\Dominika
dysk (S-1-5-21-1033256238-1554936966-1759224977-1007 - Limited - Enabled) = & gt; C:\Users\dysk
ftp_user (S-1-5-21-1033256238-1554936966-1759224977-1010 - Limited - Enabled)
Guest (S-1-5-21-1033256238-1554936966-1759224977-501 - Limited - Disabled)
Kambit (S-1-5-21-1033256238-1554936966-1759224977-1014 - Administrator - Enabled) = & gt; C:\Users\Kambit.IK-SERVER
Softlex_FTP (S-1-5-21-1033256238-1554936966-1759224977-1006 - Limited - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
==================== Installed Programs ======================
(Only the adware programs with " Hidden " flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Cobian Backup 11 Gravity (HKLM-x32\...\CobBackup11) (Version: - )
ESET Endpoint Security (HKLM\...\{F0E6B843-3DE9-464A-81D7-397406466719}) (Version: 6.1.2222.1 - ESET, spol. s r.o.)
ESET Rogue Detection Sensor (HKLM\...\{DC8A819A-F370-4711-BE89-390B37F69C18}) (Version: 1.0.817.0 - ESET, spol. s r.o.)
ExpressProfiler 2.0.5329.21147 (HKLM-x32\...\{E53179F0-9FB7-4A55-A714-DED17E4B4EC5}) (Version: 2.0.5329.21147 - SQL Code Guard Team)
FileZilla Client 3.8.1 (HKLM-x32\...\FileZilla Client) (Version: 3.8.1 - Tim Kosse)
FUJITSU Software ServerView Agents x64 Edition (HKLM\...\{572D6CC6-5879-4494-9862-8E7449F96211}) (Version: 7.20.22 - Fujitsu Technology Solutions)
FUJITSU Software ServerView PrimeUp (HKLM-x32\...\{27C68762-BDBB-4F16-BE4F-E455CFFF9129}) (Version: 1.17.03 - Fujitsu Technology Solutions)
Fujitsu Software ServerView RAID Manager (HKLM\...\{9D90A4D6-A532-4133-85CE-BE0D2230C7FE}) (Version: 6.1.4 - Fujitsu Technology Solutions)
GDR 2218 for SQL Server 2012 (KB2716442) (64-bit) (HKLM\...\KB2716442) (Version: 11.0.2218.0 - Microsoft Corporation)
GDR 2269 for SQL Server 2014 (KB3045324) (64-bit) (HKLM\...\KB3045324) (Version: 12.0.2269.0 - Microsoft Corporation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 60.0.3112.113 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.5 - Google Inc.) Hidden
HD Tune 2.55 (HKLM-x32\...\HD Tune_is1) (Version: - EFD Software)
Hotfix 2569 for SQL Server 2014 (KB3158271) (64-bit) (HKLM\...\KB3158271) (Version: 12.0.2569.0 - Microsoft Corporation)
Intel(R) Network Connections 20.0.10.0 (HKLM\...\PROSetDX) (Version: 20.0.10.0 - Intel)
Java 8 Update 77 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218077F0}) (Version: 8.0.770.3 - Oracle Corporation)
Java 8 Update 91 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218091F0}) (Version: 8.0.910.14 - Oracle Corporation)
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Access database engine 2010 (English) (HKLM-x32\...\{90140000-00D1-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Help Viewer 1.1 (HKLM\...\Microsoft Help Viewer 1.1) (Version: 1.1.40219 - Microsoft Corporation)
Microsoft ODBC Driver 11 for SQL Server (HKLM\...\{A106FA6F-E94C-44C9-8A0F-C34BD82C9FE6}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft Report Viewer 2012 Runtime (HKLM-x32\...\{9CCE40CE-A9E6-4916-8729-B008558EEF3F}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft Report Viewer 2014 Runtime (HKLM-x32\...\{327E9C0D-1687-414F-923E-F5979E549548}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Management Objects (HKLM-x32\...\{83F2B8F4-5CF3-4BE9-9772-9543EAE4AC5F}) (Version: 10.51.2500.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Setup Support Files (HKLM\...\{6292D514-17A4-403F-98F9-E150F10C043D}) (Version: 10.3.5500.0 - Microsoft Corporation)
Microsoft SQL Server 2012 (64-bit) (HKLM\...\Microsoft SQL Server SQLServer2012) (Version: - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework (HKLM\...\{A007BD05-ECFD-4F64-89F6-7E95F91F0DFB}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (HKLM-x32\...\{DA1C1761-5F4F-4332-AB9D-29EDF3F8EA0A}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (x64) (HKLM\...\{FA0A244E-F3C2-4589-B42A-3D522DE79A42}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client (HKLM\...\{E2D10175-7411-4EA5-8E32-FA21262B435D}) (Version: 11.2.5592.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Setup (English) (HKLM\...\{8CB0713F-CFE0-445D-BCB2-538465860E1A}) (Version: 11.1.3128.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL Compiler Service (HKLM\...\{03A2AE02-CBC9-4746-A376-0F7BF6AF5F39}) (Version: 11.0.2218.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL ScriptDom (HKLM\...\{0E8670B8-3965-4930-ADA6-570348B67153}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 T-SQL Language Service (HKLM\...\{CC8B009A-98C9-497F-99AF-CEBE35D8C0CF}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2014 (64-bit) (HKLM\...\Microsoft SQL Server SQLServer2014) (Version: - Microsoft Corporation)
Microsoft SQL Server 2014 Policies (HKLM-x32\...\{1C30FE7E-8A8C-4492-89D6-10CB20C3B0EB}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 RS Add-in for SharePoint (HKLM\...\{FCF3BEA6-401C-444E-8910-A1AE3F2EBA1D}) (Version: 12.0.2569.0 - Microsoft Corporation)
Microsoft SQL Server 2014 Setup (English) (HKLM\...\{92FBD63F-918C-4465-A283-957B15042D80}) (Version: 12.0.2569.0 - Microsoft Corporation)
Microsoft SQL Server 2014 Transact-SQL Compiler Service (HKLM\...\{E76CDA08-0F96-44FD-A0FD-C07F6CAF19E0}) (Version: 12.0.2569.0 - Microsoft Corporation)
Microsoft SQL Server 2014 Transact-SQL ScriptDom (HKLM\...\{2C8240B9-2142-4A0E-9678-7F3C678E34C6}) (Version: 12.0.2569.0 - Microsoft Corporation)
Microsoft SQL Server Data Tools – Database Projects – Web installer entry point (HKLM-x32\...\{F3BBC56F-2282-4464-952F-A89772181F30}) (Version: 10.3.20116.0 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM-x32\...\{C3F6F200-6D7B-4879-B9EE-700C0CE1FCDA}) (Version: 10.51.2500.0 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2012 (HKLM-x32\...\{E2082604-4BA5-44BB-BBFB-AF0F3CB8C6AB}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2012 (x64) (HKLM\...\{F1949145-EB64-4DE7-9D81-E6D27937146C}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft System CLR Types for SQL Server 2014 (HKLM\...\{CCA90A36-FA50-42CF-BA7D-44AD6EC27F10}) (Version: 12.0.2569.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 (HKLM-x32\...\{B7E38540-E355-3503-AFD7-635B2F2F76E1}) (Version: 9.0.30729.4974 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219 (HKLM-x32\...\{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Shell (Integrated) - ENU (HKLM-x32\...\{012D26C3-E12A-3BDA-8ECE-DF14E721A507}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Shell (Isolated) - ENU (HKLM-x32\...\{D64B6984-242F-32BC-B008-752806E5FC44}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications Design-Time 3.0 (HKLM-x32\...\{5A03C202-08B4-3F1D-9A60-A4F53EF1B636}) (Version: 10.0.40220 - Microsoft Corporation)
Microsoft Visual Studio Tools for Applications x86 Runtime 3.0 (HKLM-x32\...\{191A6F65-6878-398D-A272-EF011B80F371}) (Version: 10.0.40220 - Microsoft Corporation)
Microsoft VSS Writer for SQL Server 2014 (HKLM\...\{366CD715-2FF4-40B4-A8B4-A05E5D21A945}) (Version: 12.0.2000.8 - Microsoft Corporation)
Mozilla Firefox 55.0.3 (x86 pl) (HKLM-x32\...\Mozilla Firefox 55.0.3 (x86 pl)) (Version: 55.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 55.0.3.6445 - Mozilla)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.1 - Notepad++ Team)
Openfire 4.1.0 (HKLM-x32\...\6886-9911-0474-3571) (Version: 4.1.0 - Ignite Realtime RTC Community)
Prerequisites for SSDT (HKLM-x32\...\{9169C939-ED01-446A-BD0C-29873BAF4E48}) (Version: 11.0.2100.60 - Microsoft Corporation)
SQL Server 2012 BI Development Studio (HKLM\...\{656E214E-B73F-458C-AD64-ED316F008207}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 BI Development Studio (HKLM\...\{EE1B54D1-BFBC-4C19-8D66-E0AF3E967896}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Common Files (HKLM\...\{1D411379-9CE0-4B13-A19B-72D3222DD620}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Common Files (HKLM\...\{202AAF1F-69AA-442A-B59F-6B54B1AD07C6}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Database Engine Services (HKLM\...\{18B2A97C-92C3-4AC7-BE72-F823E0BC895B}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Database Engine Services (HKLM\...\{84FBCA4A-D650-4B0D-8094-EC0671FA9B91}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Database Engine Shared (HKLM\...\{54FF8FAB-DE27-4187-82F1-EBAE6AEE869A}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Database Engine Shared (HKLM\...\{6603C2CE-3C54-4F1D-92F9-8390CD4CCCA8}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Documentation Components (HKLM\...\{7272DF1C-2F88-43AC-A481-84DD67DF9746}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Documentation Components (HKLM\...\{B3192F55-2CE8-4C8E-9E40-D3B4998276B2}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Documentation Components (HKLM\...\{CECA0188-BD7A-43EF-B1F7-DDF719099C46}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Full text search (HKLM\...\{34A7A77A-A23D-44ED-B3B6-EC8198BE2622}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Management Studio (HKLM\...\{26BFF1F1-5C03-4C55-9C7C-FD65889AFA70}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Management Studio (HKLM\...\{A7037EB2-F953-4B12-B843-195F4D988DA1}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Reporting Services (HKLM\...\{DCCB1789-1DA0-4E3A-A52F-7815B602CC98}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 Reporting Services (HKLM\...\{FCD81E1A-6ED6-4F19-A572-82FFE102654E}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2012 SQL Data Quality Common (HKLM\...\{D307B5CF-D1F0-48A4-8DA3-54765F535208}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
SQL Server 2014 Analysis Services (HKLM\...\{7719CC19-87C5-4CCC-AF97-13AB9918828C}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Analysis Services (HKLM\...\{A0BC3D94-FB5E-40E3-9881-3B308CC8346B}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Client Tools (HKLM\...\{2BA1811B-44C0-4C50-8C5A-CE68AB25ED71}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Client Tools (HKLM\...\{B5ECFA5C-AC4F-45A4-A12E-A76ABDD9CCBA}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Common Files (HKLM\...\{BD1CD96B-FE4B-4EAE-83D4-6EF55AB5779C}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Common Files (HKLM\...\{F7012F84-80F5-4C25-852E-B1BA03276FE6}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Data quality client (HKLM\...\{1B61E3E0-7021-47ED-8733-927A31300AE4}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Data quality client (HKLM\...\{DCE60088-65B7-4873-957A-08017D343E9A}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Data quality service (HKLM\...\{15A85908-CFA6-43D8-840D-8E7CB4B8BD92}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Data quality service (HKLM\...\{175C8B58-EDA6-4F24-9863-A8D4F58C290A}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Data quality service (HKLM\...\{4A4904EA-34A2-4FF6-BEEB-E25F76F6AE06}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Data quality service (HKLM\...\{DEE226D7-D7DA-4413-918E-1E0398BB5125}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Database Engine Services (HKLM\...\{0E4525B4-8B3D-429D-A283-2D6F9583EC5A}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Database Engine Services (HKLM\...\{8B9312D8-1BDB-4A44-A52F-4AB73BD300FD}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Database Engine Services (HKLM\...\{C8511A82-E9FD-4B6D-B1B2-378589D2B48A}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Database Engine Services (HKLM\...\{D45C3EC4-282E-4798-98C7-E7BF2362F04E}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Database Engine Shared (HKLM\...\{ACC530B8-B6B4-40D6-B59B-152468CF47D0}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Database Engine Shared (HKLM\...\{D1B847A9-B06B-4264-9EF0-78E6E1571E65}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Distributed Replay (HKLM\...\{2D77A365-F019-4EED-BA58-6389CFD73C9D}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Distributed Replay (HKLM\...\{357D53BA-8B5D-4E72-9636-A82E0B1A72D4}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Distributed Replay (HKLM\...\{3D327420-2E9F-4F56-8B15-C2FE5ADE85BF}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Distributed Replay (HKLM\...\{B5D457CD-3E1A-4D6C-8D16-6030E88DAF35}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Documentation Components (HKLM\...\{1D01EDF6-7E93-4FEE-AA09-C5669511100C}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Documentation Components (HKLM\...\{5EACF47D-EB70-4FE0-83DE-9FD9693C24B9}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Documentation Components (HKLM\...\{832D6A7D-13F7-42CB-9AC6-5859800269AE}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Full text search (HKLM\...\{1730CE17-D019-43A8-AB52-A4B8FF9A23B9}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Full text search (HKLM\...\{FD534AFE-661C-4DD1-A93B-8F9D027C216F}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Integration Services (HKLM\...\{0FB14E21-7A42-4CD0-8D5C-028B2ACD29E6}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Integration Services (HKLM\...\{327B1B40-2434-4DC5-9D4D-B9B24D4B2EDE}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Management Studio (HKLM\...\{75A54138-3B98-4705-92E4-F619825B121F}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Management Studio (HKLM\...\{839EF29A-3055-43DC-ADCE-8E84893798D5}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Reporting Services (HKLM\...\{4CC3B4AF-9DDB-44F4-84FC-99F293F1EE4A}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 Reporting Services (HKLM\...\{B2922C79-2BB2-4B6C-990F-012702035FAF}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 RS_SharePoint_SharedService (HKLM\...\{50663FF0-DF81-4DDC-BED0-F92E31488301}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server 2014 SQL Data Quality Common (HKLM\...\{2D95D8C0-0DC4-44A6-A729-1E2388D2C03E}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
SQL Server Browser for SQL Server 2014 (HKLM-x32\...\{3204DE95-97D2-4261-A286-98A262E171D4}) (Version: 12.0.2000.8 - Microsoft Corporation)
Sql Server Customer Experience Improvement Program (HKLM\...\{6476DB81-F263-4C04-8574-AAD31136C304}) (Version: 12.0.2000.8 - Microsoft Corporation) Hidden
Sql Server Customer Experience Improvement Program (HKLM\...\{BED1EA3D-592D-4305-9D1F-20F03726EFC1}) (Version: 11.0.2100.60 - Microsoft Corporation) Hidden
VC_CRT_x64 (HKLM\...\{54F2237F-018C-483B-8884-9FC0D88840C3}) (Version: 1.02.0000 - Intel Corporation) Hidden
Visual Studio 2010 Prerequisites - English (HKLM\...\{662014D2-0450-37ED-ABAE-157C88127BEB}) (Version: 10.0.40219 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ContextMenuHandlers1: [7-Zip] - & gt; {23170F69-40C1-278A-1000-000100020000} = & gt; C:\Program Files\7-Zip\7-zip.dll [2010-11-18] (Igor Pavlov)
ContextMenuHandlers1: [ANotepad++64] - & gt; {B298D29A-A6ED-11DE-BA8C-A68E55D89593} = & gt; C:\Program Files (x86)\Notepad++\NppShell_05.dll [2012-06-18] ()
ContextMenuHandlers1: [ESET Smart Security - Context Menu Shell Extension] - & gt; {B089FE88-FB52-11D3-BDF1-0050DA34150D} = & gt; C:\Program Files\ESET\ESET Endpoint Security\shellExt.dll [2015-02-16] (ESET)
ContextMenuHandlers2: [ESET Smart Security - Context Menu Shell Extension] - & gt; {B089FE88-FB52-11D3-BDF1-0050DA34150D} = & gt; C:\Program Files\ESET\ESET Endpoint Security\shellExt.dll [2015-02-16] (ESET)
ContextMenuHandlers4: [7-Zip] - & gt; {23170F69-40C1-278A-1000-000100020000} = & gt; C:\Program Files\7-Zip\7-zip.dll [2010-11-18] (Igor Pavlov)
ContextMenuHandlers6: [ESET Smart Security - Context Menu Shell Extension] - & gt; {B089FE88-FB52-11D3-BDF1-0050DA34150D} = & gt; C:\Program Files\ESET\ESET Endpoint Security\shellExt.dll [2015-02-16] (ESET)
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0CB11CDD-73A4-4FDC-AC51-D83839F0494E} - System32\Tasks\softlex_jobs_EPU = & gt; " C:\Program Files\Internet Explorer\iexplore.exe " hxxp://localhost/JOBS/Jobs.ashx?JobName=EPUGetData
Task: {22F8933B-6077-471D-A4C3-56C7647164AD} - System32\Tasks\Microsoft\Windows\Server Manager\CleanupOldPerfLogs = & gt; %systemroot%\system32\cscript.exe /B /nologo %systemroot%\system32\calluxxprovider.vbs $(Arg0) $(Arg1) $(Arg2)
Task: {6506F90D-9F1C-458E-BEC1-033712876CD0} - System32\Tasks\GoogleUpdateTaskMachineUA = & gt; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-10] (Google Inc.)
Task: {651FF2A7-84D4-4AE6-9231-BB0411D3A64F} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerCeipAssistant = & gt; C:\Windows\system32\ceipdata.exe [2013-08-22] (Microsoft Corporation)
Task: {679FFA07-6313-4E99-ACB3-9066CE884EC3} - System32\Tasks\Ikredytowe_jobs_agregacja = & gt; " C:\Program Files\Internet Explorer\iexplore.exe " hxxp://localhost/JOBS/Jobs.ashx?JobName=TempTablesClearZleceniaAgregacja & FirmIdent=ikredytowe
Task: {6F587640-2885-44C9-8ADB-1E25D701A657} - System32\Tasks\Ikredytowe_jobs_kolejka = & gt; " C:\Program Files\Internet Explorer\iexplore.exe " localhost/JOBS/Jobs.ashx?JobName=RunQueue & FirmIdent=Ikredytowe
Task: {787E2442-1350-4D4B-B3DF-F73EDF626879} - System32\Tasks\Microsoft\Windows\PLA\Server Manager Performance Monitor = & gt; %systemroot%\system32\rundll32.exe %systemroot%\system32\pla.dll,PlaHost " Server Manager Performance Monitor " " $(Arg0) "
Task: {8011A8FD-9476-42C2-8B43-5F20DADE5C27} - System32\Tasks\Microsoft\Windows\Software Inventory Logging\Configuration = & gt; %systemroot%\system32\cmd.exe /d /c %systemroot%\system32\silcollector.cmd configure
Task: {81F89F7A-7E77-4E44-9E57-8A73F45055D5} - System32\Tasks\IE zamkniecie = & gt; D:\!!!Softlex\Aplikacja\Ikredytowe.softlex.pl\Admin\KillIE.bat [2016-02-18] () & lt; ==== ATTENTION
Task: {9536335E-476B-42F7-8624-2308CA0F222B} - System32\Tasks\Microsoft\Windows\Server Manager\ServerManager = & gt; C:\Windows\system32\ServerManagerLauncher.exe [2013-08-22] (Microsoft Corporation)
Task: {9969DBC4-C860-487D-B19E-A1A56C3C9650} - System32\Tasks\Ikredytowe_jobs_KopiaBazyDanych = & gt; E:\KopiaBazyDanychSoftlex\kopia.bat & lt; ==== ATTENTION
Task: {AECDE870-1CBB-4549-B11F-79328B0DF156} - System32\Tasks\GoogleUpdateTaskMachineCore = & gt; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-10] (Google Inc.)
Task: {B12C59DA-8F3A-4DEB-A4BF-D6DEC9E48686} - System32\Tasks\BIGklient = & gt; C:\Users\Kambit\Desktop\BIG_klient\Start.bat [2016-04-05] () & lt; ==== ATTENTION
Task: {CC419AA4-EDCF-4D2E-BF53-41AD9FDF2E4D} - System32\Tasks\Microsoft\Windows\Software Inventory Logging\Collection = & gt; %systemroot%\system32\cmd.exe /d /c %systemroot%\system32\silcollector.cmd publish
Task: {D2D3A566-80C3-4E57-8E7C-C2A2E2B08809} - System32\Tasks\Ikredytowe_jobs = & gt; " C:\Program Files\Internet Explorer\iexplore.exe " hxxp://localhost/Jobs/Jobs.ashx?JobName=RunReminds & FirmIdent=Ikredytowe
Task: {E409EF28-BFCF-4AD4-A643-929568E19C27} - System32\Tasks\Ikredytowe_jobs_rebuildIndex = & gt; " C:\Program Files\Internet Explorer\iexplore.exe " hxxp://localhost/JOBS/Jobs.ashx?JobName=RebuildDefragIndex & FirmIdent=Ikredytowe
Task: {F06B3DE1-8726-4986-B953-47B034C0ECD6} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB = & gt; C:\Windows\system32\MRT.exe [2017-09-07] (Microsoft Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2017-09-11 14:02 - 2017-09-11 13:54 - 158001800 _____ () C:\Users\Administrator\Desktop\7wkdhskr.exe
2017-09-11 16:04 - 2017-09-11 16:04 - 002376976 _____ () c:\users\administrator\appdata\local\temp\1\B65DB47E-75F10588-133595FC-EFE4C794\JFduJViCgnvGDY7.exe
2017-09-11 16:04 - 2017-09-11 16:04 - 007495400 _____ () c:\users\administrator\appdata\local\temp\1\B65DB47E-75F10588-133595FC-EFE4C794\89DfImiQKYYYreq.exe
2017-09-11 16:04 - 2017-09-11 16:04 - 000705808 _____ () c:\users\administrator\appdata\local\temp\1\B65DB47E-75F10588-133595FC-EFE4C794\jTrTskmgZmEGZ.exe
2016-12-21 18:51 - 2016-09-19 12:20 - 000134656 _____ () C:\Program Files (x86)\Openfire\.install4j\i4jinst.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The " AlternateShell " will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1033256238-1554936966-1759224977-500\Control Panel\Desktop\\Wallpaper - & gt; C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: Media is not connected to internet.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System = & gt; (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SCW-Allow-Inbound-Access-To-ScsHost-TCP-RPC] = & gt; (Allow) %systemroot%\system32\scshost.exe
FirewallRules: [SCW-Allow-Inbound-Access-To-ScsHost-TCP-RPC-EndPointMapper] = & gt; (Allow) %systemroot%\system32\scshost.exe
FirewallRules: [ComPlusRemoteAdministration-DCOM-In] = & gt; (Allow) %systemroot%\system32\dllhost.exe
FirewallRules: [SNMP-In-UDP] = & gt; (Allow) %SystemRoot%\system32\snmp.exe
FirewallRules: [SNMP-Out-UDP] = & gt; (Allow) %SystemRoot%\system32\snmp.exe
FirewallRules: [SNMP-In-UDP-NoScope] = & gt; (Allow) %SystemRoot%\system32\snmp.exe
FirewallRules: [SNMP-Out-UDP-NoScope] = & gt; (Allow) %SystemRoot%\system32\snmp.exe
FirewallRules: [{EE142700-3054-44E8-AB15-9EDF8F9173D4}] = & gt; (Allow) LPort=21
FirewallRules: [{FB52120E-01DF-485D-879B-A0B9470FB4B7}] = & gt; (Allow) LPort=21
FirewallRules: [{B924C437-2A38-4FB8-8389-8EC174497766}] = & gt; (Allow) LPort=80
FirewallRules: [{B0BEE280-C7B1-496E-A1D8-45FFCE05106A}] = & gt; (Allow) LPort=80
FirewallRules: [{6CF082CF-012E-43DE-8668-0287E2FF1E06}] = & gt; (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{DE2EC632-2842-42C3-A963-A21C5DAF561E}] = & gt; (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{93BE8BC2-B111-4C01-A3A6-172640D76F3B}] = & gt; (Allow) LPort=7443
FirewallRules: [{5ECF4AF7-B67A-44BC-B079-FCBBC229C173}] = & gt; (Allow) LPort=2222
FirewallRules: [{C933C5B3-1CDA-431E-895C-089B30AB3E75}] = & gt; (Allow) LPort=2223
FirewallRules: [{1787DF5F-0A3B-4864-8310-4C4D0D383CEA}] = & gt; (Allow) LPort=443
FirewallRules: [WindowsServerBackup-wbengine-In-TCP-NoScope] = & gt; (Allow) %systemroot%\system32\wbengine.exe
FirewallRules: [{FF6571F7-42F0-477B-AA23-A9191BCB4F09}] = & gt; (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{1B1488DF-D1B3-44C0-8475-DAE526320060}] = & gt; (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A5BD841C-DECF-4254-9F90-155EBA82DAAC}] = & gt; (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Restore Points =========================
ATTENTION: System Restore is disabled
Check " winmgmt " service or repair WMI.
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (09/11/2017 04:05:24 PM) (Source: ServerView Agents) (EventID: 12500) (User: )
Description: Upper critical threshold exceeded at server IK-SERVER. The parameter storageRead with value 18213 exceeded upper critical threshold 10000.
Error: (09/11/2017 04:05:24 PM) (Source: ServerView Agents) (EventID: 12500) (User: )
Description: Upper critical threshold exceeded at server IK-SERVER. The parameter storageTotal with value 22488 exceeded upper critical threshold 20000.
Error: (09/11/2017 04:05:24 PM) (Source: ServerView Server Control) (EventID: 0) (User: )
Description: Event: The parameter storageRead with value 18213 exceeded the upper critical threshold 10000
Error: (09/11/2017 04:05:24 PM) (Source: ServerView Server Control) (EventID: 0) (User: )
Description: Event: The parameter storageTotal with value 22488 exceeded the upper critical threshold 20000
Error: (09/11/2017 03:44:41 PM) (Source: ServerView Server Control) (EventID: 0) (User: )
Description: EM_UPDATE: ServerView Update Management: Update of repository (C:\Program Files\Fujitsu\ServerView Suite\Agents\Server Control\Data\EM_UPDATE\UpdateRepository) from web server failed, ret=-10
Error: (09/11/2017 03:44:41 PM) (Source: ServerView Server Control) (EventID: 0) (User: )
Description: EM_UPDATE: ServerView Update Management: Tree version on Download server could not be determined!
Error: (09/11/2017 02:25:23 PM) (Source: ServerView Agents) (EventID: 12502) (User: )
Description: Upper warning threshold exceeded at server IK-SERVER. The parameter storageRead with value 7783 exceeded upper warning threshold 7000.
Error: (09/11/2017 02:10:23 PM) (Source: ServerView Agents) (EventID: 12502) (User: )
Description: Upper warning threshold exceeded at server IK-SERVER. The parameter storageRead with value 9381 exceeded upper warning threshold 7000.
Error: (09/11/2017 01:45:22 PM) (Source: ServerView Agents) (EventID: 12502) (User: )
Description: Upper warning threshold exceeded at server IK-SERVER. The parameter storageUsage.G:\ with value 90 exceeded upper warning threshold 80.
Error: (09/11/2017 01:45:22 PM) (Source: ServerView Agents) (EventID: 12502) (User: )
Description: Upper warning threshold exceeded at server IK-SERVER. The parameter storageUsage.E:\ with value 86 exceeded upper warning threshold 80.
System errors:
=============
Error: (09/11/2017 01:37:59 PM) (Source: SNMP) (EventID: 1500) (User: )
Description: The SNMP Service encountered an error while accessing the registry key SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration.
Error: (09/07/2017 03:55:47 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID
{D63B10C5-BB46-4990-A94F-E40B9D520160}
and APPID
{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
Error: (09/07/2017 03:43:36 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 1203.
Error: (09/07/2017 03:43:36 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 1203.
Error: (09/07/2017 03:15:16 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80246013: May, 2017 Security and Quality Rollup for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2 on Windows 8.1 and Windows Server 2012 R2 for x64 (KB4019114).
Error: (09/07/2017 02:37:03 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 1203.
Error: (09/07/2017 02:37:03 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 1203.
Error: (09/07/2017 09:53:54 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 1203.
Error: (09/07/2017 09:53:54 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 1203.
Error: (09/07/2017 09:46:46 AM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)
Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 10. The Windows SChannel error state is 1203.
CodeIntegrity:
===================================
Date: 2017-09-11 13:44:43.954
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume3\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2017-09-11 13:44:43.029
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume3\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2017-09-11 13:40:33.077
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume3\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2017-09-11 13:40:32.533
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume3\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2017-07-17 15:39:49.721
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume3\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2017-07-17 15:39:48.895
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume3\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2017-07-17 15:27:52.731
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume3\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2017-07-17 15:27:52.360
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume3\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2016-12-20 16:16:26.618
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume3\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
Date: 2016-12-20 16:16:26.253
Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume3\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll that did not meet the Microsoft signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Xeon(R) CPU E3-1220 V2 @ 3.10GHz
Percentage of memory in use: 32%
Total physical RAM: 16351.77 MB
Available physical RAM: 11019.38 MB
Total Virtual: 18783.77 MB
Available Virtual: 12814.02 MB
==================== Drives ================================
Drive c: (SYSTEM) (Fixed) (Total:243.8 GB) (Free:169.56 GB) NTFS
Drive d: (Database) (Fixed) (Total:952.87 GB) (Free:556.28 GB) NTFS
Drive e: (STORAGE) (Fixed) (Total:490.94 GB) (Free:69.33 GB) NTFS
Drive g: (DATABASE) (Fixed) (Total:195.31 GB) (Free:19.76 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 952.9 GB) (Disk ID: FF7B8B3D)
Partition 1: (Not Active) - (Size=952.9 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 930.4 GB) (Disk ID: FF16B218)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=243.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=195.3 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=490.9 GB) - (Type=07 NTFS)
==================== End of Addition.txt ============================