Newsgroup: it.comp.sicurezza.windows
Titolo: aiuto per win xp

Ieri pomeriggio mentre il portatile era accesso, ma non ci stavo lavorando,
si è verificato un errore irreversibile dopodichè si è spento e riacceso
senza nessun mio intervento. All'accensione dovendo aprire dei file di word
mi sono accorto che questi non contenevano i miei dati, ma bensì dei
caratteri incomprensibili. Ho controllato anche i file di excel e anche
questi non contenevano più i miei dati, ma bensì dei caratteri
incomprensibili (tipo quadratini vuoti) e delle righe che qui sotto riporto:
SMSS:PFILE: Created descriptor for `%wZ' (`%wZ')
parsing specified failedSMSS:PFILE: SmpParseCommandLine(%wZ) failed with
status %X
SMSS:PFILE: Paging file specifier `%wZ'
SMSS:PFILE: Too many paging files specified - %d
SMSS:PFILE: Created volume descriptor for`%wZ'
SMSS:PFILE: Query volume `%wZ' (handle %p) for size failed with status %X
SMSS:PFILE: Failed to allocate a volume descriptor (%u bytes)
SMSS:PFILE: Volume `%wZ' (%X) cannot store a paging file
SMSS:PFILE: Query volume `%wZ' (handle %p) for device info failed with
status %X
SMSS:PFILE: Open volume `%wZ' failed with status %X
\??\A:\SMSS:PFILE: Query(ProcessDeviceMap) failed with status %X
SMSS:PFILE: NtCreatePagingFile (%wZ, %I64X, %I64X) succeeded.
successSMSS:PFILE: NtCreatePagingFile (%wZ, %I64X, %I64X) failed with %X
failedSMSS:PFILE: Trimmed size of `%wZ' to maximum allowed
SMSS:PFILE: Validating sizes for `%wZ' %I64X %I64X
SMSS:PFILE: Failed to delete page file `%wZ' (status %X)
SMSS:PFILE: Deleted stale paging file - %wZ
SMSS:PFILE: Failed to open for deletion page file `%wZ' (status %X)
SMSS:PFILE: Failed query for size potential pagefile `%wZ' with status %X
SMSS:PFILE: Trying to get size for `%wZ'
SMSS:PFILE: Querying volume `%wZ' for free space
SMSS:PFILE: unexpected exception %X with record %p
SMSS:PFILE: Failing for min %I64X, max %I64X, real min %I64X
SMSS:PFILE: min %I64X, max %I64X, real min %I64X
SMSS:PFILE: Free space on volume `%wC' is %I64X
SMSS:PFILE: Detected size %I64X for future paging file `%wZ'
SMSS:PFILE: Skipping crash dump checking for `%wZ' on non boot volume `%wC'
SMSS:PFILE: Failed to query free space for boot volume `%wC'
SMSS:PFILE: Checking for crash dump in `%wZ' on boot volume
SMSS:PFILE: No volume descriptor for `%wZ'
SMSS:PFILE: NtQuerySystemInformation failed with %x
\??\?:\pagefile.sysSMSS:PFILE: Creating emergency paging file.
SMSS:PFILE: Creating a normal paging file (`%wZ')
SMSS:PFILE: Trying lower sizes for (`%wZ')
SMSS:PFILE: Creating a system managed paging file (`%wZ')
SMSS:PFILE: Failed to create volume descriptors (status %X)
SMSS:PFILE: No paging file was requested
Ì@XHë@XHOverwriteMiniDumpDir%s\MinidumpDumpFile%s\MEMORY.DMP\Registry\Machin
e\System\CurrentControlSet\Control\CrashControl%s\%s%4.4x.tmpDUMPTempDestina
tion\Registry\Machine\System\CurrentControlSet\Control\CrashControl\MachineC
rashExecuteKmodeOptionalDebugWindowsRequiredSubSystemsEnvironmentKnownDllsDO
S Devices?:\pagefile.sysPagingFilesMemory
ManagementExcludeFromKnownDllsPendingFileRenameOperations2PendingFileRenameO
perationsSetupExecuteautocheck \SystemRoot\Windows\System32\AutoChk.exe
*BootExecute\Windows\RPC
ControlObjectDirectoriesAllowProtectedRenamesProtectionModesosSOSSystemStart
Options\Registry\Machine\System\CurrentControlSet\ControlMINIMALNETWORKDSREP
AIRSAFEBOOT_OPTIONOptionValue\Registry\Machine\System\CurrentControlSet\Cont
rol\Safeboot\OptionNUMBER_OF_PROCESSORS%04x%02xModel %c, Pass
%uPROCESSOR_REVISIONPROCESSOR_IDENTIFIER,
%wsVendorIdentifierIdentifier\Registry\Machine\Hardware\Description\System\C
entralProcessor\0%uPROCESSOR_LEVELx86MIPSALPHAPPCIA64ALPHA64UnknownPROCESSOR
_ARCHITECTUREWindows_NTOS\Registry\Machine\System\CurrentControlSet\Control\
Session
Manager\Environment\??ntdll.dllKnownDllPath\Registry\Machine\System\CurrentC
ontrolSet\Control\Session
Manager\SFCCommonProgramFilesProgramFilesCommonFilesDirProgramFilesDirSfcGet
Filessfcfiles.dll\Windows\RPC
ControlDllDirectoryPathPosixSingleInstance.exe\system32; %wZ program not
found - skipping AUTOCHECK
BootDir\Registry\Machine\Software\Microsoft\Windows\CurrentVersion\SetupSymb
olicLinkSystemPartition\Registry\Machine\System\Setup\KnownDllsDebuggerwinlo
gon.exedebug\SessionsSMSS: !!! MiniNT Boot !!!
\Registry\Machine\System\CurrentControlSet\Control\MiniNTautocheckasyncÿÿÿÿÜ
?XHë?XH\Device\VolumesSafeForWriteAccess\SmApiPortOS2POSIXNT-Session
ManagerSMSS!INITDBGSMÿÿÿÿZ?XHc?XHSMSS: Unable to keep track of session ID --
no memory available
SmExecPgm: NtDuplicateObject (Thread) Failed %lx
SmExecPgm: NtDuplicateObject (Process) Failed %lx
SmExecPgm: NtOpenProcess Failed %lx
Unhandled Exception in Session ManagerWindows Logon ProcessWindows
SubSystem-g -x ntsd -d ntsd -p -1 -d Session Manager
InitializationÿÿÿÿÁ XHÎ XHSMSS: SmpStartCsr, SmpExecuteInitialCommand
Failed. Status=%x
SMSS: SmpStartCsr, SmpLoadSubSystemsForMuSession Failed. Status=%x
Stessa cosa è successa con tutti i file di word ed excel contenuti nella
directory "Documenti", non si è salvato nulla!
Oltre ai file con estensione doc e xls, sono stati colpiti anche quelli con
estensione mp3.
L'antivirus ultima versione ed aggiornato recentemente, non ha rilevato
nulla.
Volevo sapere cosa ha provocato tutto questo casino e se era possibile
recuperare i documenti.

recuperare i documenti.
Se e' il Klez, temo proprio di no (a meno di spendere milioni, e non lo
sto dicendo in senso metaforico).
Leonardo

 e se era possibile recuperare i documenti.
spendendo un bel po' soldi, si.

*IGNORE THREAD*
Corsaro Grigio