Virus: programmes disparus et disque C vide Fermé

Question

Bonjour, 

Hier soir j'ai été infecté par un virus, une sorte de faux antivirus qui m'affichait plein d'erreurs, et ce virus a fait redémarrer mon PC et depuis, il n'y a plus rien sur le bureau, ni dans "tous les programmes", ni sur le disque C. En fait tout est encore présent je pense mais tout ça ne s'affiche plus. Que faire?

Ce matin j'ai fait tourné malwarebyte et antivir, ils ont détecté quelques trucs que j'ai supprimés, mais mon disque C semble toujours vide et mes programmes ne sont pas accessibles.

Merci d'avance pour vos conseils!

Configuration: Windows 7 / Internet Explorer 8.0

gen-hackman · Answer

salut

desactive ton antivirus
desactive Windows defender si présent
desactive ton pare-feu

Ferme toutes tes appilications en cours

telecharge et enregistre ceci sur ton bureau :

Pre_Scan

s'il n'est pas sur ton bureau coupe-le de ton dossier telechargements et colle-le sur ton bureau

Avertissement: Il y aura une extinction courte du bureau --> pas de panique. 

une fois telechargé lance-le , laisse faire le scan jusqu'à l'apparition de "Pre_scan.txt" sur le bureau.

si l'outil detecte un proxy et que tu n'en as pas installé clique sur "supprimer le proxy"

si l'outil semble ne pas avoir fonctionné renomme-le winlogon , ou change son extension en .com ou .scr

 Il se peut que l'outil soit un peu long sur la reattribution des fichiers tout depend combien tu en as , laisse-le travailler 

Poste Pre_Scan.txt qui apparaitra sur le bureau en fin de scan

&#9654&#9654&#9654 NE LE POSTE PAS SUR LE FORUM (il est trop long)

clique sur ce lien : http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier ci-dessus.

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cjge368/cijSKAP5fU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

cutter4 · Answer

Hello,

Comment je désactive windows defender et le pare feu?

cutter4

gen-hackman · Answer

dans le panneau de configuration

cutter4 · Answer

Le programme a cessé de fonctionner, maintenant tout est noir je ne sais plus faire grand chose (via ctrl alt delete je peux encore aller dans le gestionnaire des taches). Que faire???

gen-hackman · Answer

onglet fichier | nouvelle tache  puis tape explorer et valide 
G3?-?@¢??@?......Concepteur de List_Kill'em...Pre_Scan....MBR_Repair....

cutter4 · Answer

Ok, quelle est la suite?

gen-hackman · Answer

poste C:\Pre_scan.txt

cutter4 · Answer

Voilà le lien: 

http://www.cijoint.fr/cjlink.php?file=cj201106/cijcWLLzu8.txt

gen-hackman · Answer

tu es bien sur d'avoir fermé le parapluie d'avira ?

cutter4 · Answer

oui, le parapluie est fermé, il est noté "inactive"

gen-hackman · Answer

ok reessaie de le faire tourner en mode sans echec

ginogame · Answer

Bonjour a vous,
Tout d'abord un grand merci à gen-hackman car visiblement ta soluce est parfaite, tout a réapparu chez moi qui ai le même probleme. Le programme a fonctionné pour ma part. Merci aussi à Cutter4 pour avec posé la question correspondant à mon probleme.
Encore bravo à gen-hackman, ton programme est super!!!
Dernière petite chose, après le retour à la normale, faut il faire autre chose?

cutter4 · Answer

Pour moi le problème est toujours là.

Voilà le rapport: 

http://www.cijoint.fr/cjlink.php?file=cj201106/cijFMTRlqc.txt 

PS: j'ai du redémarrer pour poster car j'avais mis le mode sans échec sans prise en charge réseau

ginogame · Answer

sous seven, clic droit "executer en tant qu'admin"?

cutter4 · Answer

on va d'abord voir ce que gen-hackman pense du rapport ;-)

ginogame · Answer

Ben, si tu as le controle des comptes sous 7, il est possible que le prog n'ai pas les droits, d'après ce que j'ai vu dans le rapport, le programme echoue sur une supression de fichier, donc j'essaierais de le lancer en tant qu'admin, ça coute rien. Enfin, ce n'est qu'une suggestion...

cutter4 · Answer

ok je vais essayer ça, merci

cutter4 · Answer

il a de nouveau cessé de fonctionner (c'était pas en mode sans échec mais ici j'avais démarré l'application comme administrateur).

http://www.cijoint.fr/cjlink.php?file=cj201106/cijvPfFE33.txt

ginogame · Answer

Oula, méchante la vilaine bébête...
Tout est revenu ok mais...
Je me dis je vais telecharger Malware'byte histoire de faire un pti controle. 
1er lien donné par google sur clubic, je clic et me retrouve phishé sur un site bidon "malware'sbyte2011", dans le doute j'essaye, on me demande durant l'installation d'envoyer un sms vers un numero suremement surtaxé...Mmmm, je sais pas si ça sent pas le format tout ça!!!

Bonne chance à toi Cutter

cutter4 · Answer

quelqu'un a une autre solution que le format? ...

gen-hackman · Answer

si tu es si pressé que ca effectivement tu peux formater ca prend deux heures

cutter4 · Answer

je préférerais éviter le formatage. je ne suis pas pressé outre-mesure. tu as regardé au dernier rapport? Peut-être dois-je ouvrir en tant qu'administrateur en mode sans échec?

merci pour tes conseils

cutter4 · Answer

J'ai réessayé en mode sans échec, en tant qu'administrateur. Quand le programme a fini de tourner ça donne quoi normalement? Moi ça devient tout noir.

Quoi qu'il en soit, voilà le dernier rapport:

http://www.cijoint.fr/cjlink.php?file=cj201106/cijXq9Ivi7.txt

gen-hackman · Answer

&#9654 Télécharge ici : USBFIX sur ton bureau 

branche tous tes periphériques sans les ouvrir

/!\ Désactive provisoirement et seulement le temps de l'utilisation d'USBFIX, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil.

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

sur l'icône Usbfix située sur ton Bureau.
Sur la page, clique sur le bouton :

&#9654 choisi l option Suppression

&#9654 UsbFix scannera ton pc , laisse travailler l outil.

&#9654 Ensuite post le rapport UsbFix.txt qui apparaitra avec le bureau .

&#9654 Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

cutter4 · Answer

Voilà, c'est fait:

############################## | UsbFix 7.046 | [Suppression]

Utilisateur: Thomas (Administrateur) # THOMAS-PC [ASUSTeK Computer Inc. K61IC]
Mis à jour le 23/05/2011 par TeamXscript
Lancé à 13:16:55 | 03/06/2011
Site Web: http://www.teamxscript.org
Submit your sample: http://www.teamxscript.org/Upload.php
Contact: TeamXscript.ElDesaparecido@gmail.com

CPU: Pentium(R) Dual-Core CPU T4400 @ 2.20GHz
CPU 2: Pentium(R) Dual-Core CPU T4400 @ 2.20GHz
Microsoft Windows 7 Édition Familiale Premium  (6.1.7600 64-Bit) # 
Internet Explorer 8.0.7600.16385

Pare-feu Windows: Désactivé /!\
RAM -> 4095 Mo 
C:\ (%systemdrive%) -> Disque fixe # 75 Go (15 Go libre(s) - 20%) [OS] # NTFS
D:\ -> Disque fixe # 209 Go (148 Go libre(s) - 71%) [DATA] # NTFS
E:\ -> CD-ROM
F:\ -> CD-ROM
G:\ -> CD-ROM
H:\ -> Disque amovible # 2 Go (1 Go libre(s) - 62%) [] # FAT

################## | Éléments infectieux |


Supprimé! C:\$RECYCLE.BIN\S-1-5-21-4156842296-3248408016-3408404871-1001
Supprimé! D:\$RECYCLE.BIN\S-1-5-21-4156842296-3248408016-3408404871-1001
Supprimé! D:\$RECYCLE.BIN\S-1-5-21-4156842296-3248408016-3408404871-500
Non supprimé ! G:\autorun.inf
Supprimé! H:\autorun.inf

################## | Registre |

Supprimé! HKLM\software\microsoft\windows nt\currentversion\winlogon|Taskman

################## | Mountpoints2 |

Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\F
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{16df750d-d4b0-11df-902a-e0cb4e5b54ca}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{a2b2d645-6801-11e0-a896-e0cb4e5b54ca}
Supprimé! HKCU\.\.\.\.\Explorer\MountPoints2\{f9a34bcb-f32d-11de-8c31-806e6f6e6963}

################## | Listing |

[03/06/2011 - 13:25:16 | SHD ] 	C:\$Recycle.Bin
[15/06/2009 - 13:11:59 | N | 54] 	C:\AdobeReader.log
[21/03/2010 - 14:45:16 | D ] 	C:\asus.dat
[29/07/2009 - 08:03:34 | SHD ] 	C:\Boot
[14/07/2009 - 03:38:58 | RASH | 383562] 	C:\bootmgr
[29/07/2009 - 08:03:37 | RASH | 8192] 	C:\BOOTSECT.BAK
[27/12/2009 - 23:36:25 | N | 12902] 	C:\devlist.txt
[14/07/2009 - 07:08:56 | SHD ] 	C:\Documents and Settings
[27/12/2009 - 23:36:25 | N | 9] 	C:\Finish.log
[03/06/2011 - 12:19:12 | ASH | 3220647936] 	C:\hiberfil.sys
[27/12/2009 - 23:24:19 | N | 743154] 	C:\inject.log.txt
[10/11/2009 - 04:24:27 | N | 1048576] 	C:\K61IC.BIN
[24/11/2009 - 10:19:26 | N | 19] 	C:\K61IC_K70IC_WIN7.40
[10/11/2009 - 04:24:27 | N | 1048576] 	C:\K70IC.BIN
[18/05/2011 - 21:50:18 | D ] 	C:\KEY
[03/06/2011 - 12:41:04 | D ] 	C:\Kill'em
[27/12/2009 - 22:38:11 | RHD ] 	C:\MSOCache
[02/07/2009 - 09:17:15 | N | 37] 	C:\Nero.Log
[12/06/2009 - 03:32:00 | N | 57] 	C:\OFFICE2007_L.TXT
[03/06/2011 - 12:19:15 | ASH | 4294201344] 	C:\pagefile.sys
[27/12/2009 - 08:52:54 | N | 146] 	C:\Pass.txt
[10/11/2009 - 05:02:05 | N | 196] 	C:\Patch_Win7.log
[14/07/2009 - 05:20:08 | D ] 	C:\PerfLogs
[03/06/2011 - 12:38:46 | N | 53109] 	C:\Pre_Scan.txt
[02/06/2011 - 14:40:09 | D ] 	C:\Program Files
[14/05/2011 - 11:43:56 | D ] 	C:\Program Files (x86)
[03/06/2011 - 09:59:29 | HD ] 	C:\ProgramData
[21/03/2010 - 14:24:34 | SHD ] 	C:\Recovery
[24/11/2009 - 10:19:26 | N | 14] 	C:\RECOVERY.DAT
[27/12/2009 - 23:28:57 | N | 3240] 	C:\RHDSetup.log
[27/12/2009 - 23:32:42 | N | 90] 	C:\setup.log
[14/05/2006 - 10:22:24 | N | 5] 	C:\store.log
[27/12/2009 - 22:51:41 | N | 170] 	C:\SumHidd.txt
[27/12/2009 - 22:50:10 | N | 98] 	C:\SumOS.txt
[03/06/2011 - 08:49:37 | SHD ] 	C:\System Volume Information
[02/06/2011 - 11:09:12 | D ] 	C:\Tarte
[27/12/2009 - 23:23:24 | D ] 	C:\Temp
[03/06/2011 - 13:25:17 | D ] 	C:\UsbFix
[03/06/2011 - 13:16:56 | A | 3590] 	C:\UsbFix.txt
[21/03/2010 - 14:25:55 | D ] 	C:\Users
[16/09/2009 - 20:04:46 | N | 24] 	C:\v82.txt
[08/05/2011 - 19:18:28 | D ] 	C:\Windows
[03/06/2011 - 13:25:16 | SHD ] 	D:\$RECYCLE.BIN
[17/11/2010 - 23:31:31 | D ] 	D:\d71a44cbe338292f8accaaaa227acd06
[02/02/2011 - 23:16:48 | N | 7734208] 	D:\mbam-setup-1.50.1.1100.exe
[27/12/2009 - 22:26:02 | SHD ] 	D:\System Volume Information
[17/04/2011 - 16:14:56 | D ] 	D:\THOMAS
[28/06/2007 - 15:21:08 | R | 277] 	G:\autorun.inf
[29/08/2007 - 13:29:54 | R | 1131832] 	G:\LaunchU3.exe
[29/08/2007 - 13:30:54 | R | 4654626] 	G:\LaunchPad.zip
[24/02/2011 - 18:31:18 | D ] 	H:\Exercices
[24/02/2011 - 18:34:02 | D ] 	H:\Cours
[03/03/2011 - 20:04:32 | D ] 	H:\SQL
[17/02/2011 - 18:26:04 | D ] 	H:
otepad2
[17/02/2011 - 18:26:04 | D ] 	H:\xampp
[14/05/2008 - 19:26:10 | N | 11283395] 	H:\movamp.zip
[24/11/2010 - 08:30:44 | N | 4527640] 	H:
pp.5.8.5.Installer.exe
[20/12/2010 - 20:23:32 | N | 1015869] 	H:\unlocker_unlocker_1.9.0_32_bits_francais_20237.exe
[10/02/2011 - 18:18:28 | N | 16573] 	H:\Journal_WEBDY_2010-11.docx
[04/08/2004 - 14:00:00 | N | 180224] 	H:\win32spr.dll
[05/05/2011 - 18:14:28 | N | 1620] 	H:\BOOTEX.LOG
[24/02/2011 - 21:14:20 | D ] 	H:\Scores
[05/05/2011 - 18:20:36 | D ] 	H:\joomla
[10/03/2010 - 19:28:34 | D ] 	H:\Docs
[13/11/2009 - 15:26:10 | HD ] 	H:\System

################## | Vaccin |

C:\Autorun.inf -> Vaccin créé par UsbFix (TeamXscript)
D:\Autorun.inf -> Vaccin créé par UsbFix (TeamXscript)
G:\Autorun.inf -> Vaccin créé par Panda USB Vaccine
H:\Autorun.inf -> Vaccin créé par UsbFix (TeamXscript)

################## | Upload |

Veuillez envoyer le fichier: C:\UsbFix_Upload_Me_THOMAS-PC.zip
http://www.teamxscript.org/Upload.php
Merci de votre contribution.

################## | E.O.F |

gen-hackman · Answer

peux-tu me dire ce qu il y la dedans ?

H:\System

cutter4 · Answer

Je n'en ai aucune idée. H c'est ma clé usb mais je ne vois pas de dossier "system" quand je l'ouvre...

gen-hackman · Answer

faut afficher les fichiers cachés tu sais faire ?

cutter4 · Answer

il y a un dossier "Apps" avec deux fichiers xml dedans : LPDB et LPGDB

gen-hackman · Answer

ils sont lourds ces fichiers ?

cutter4 · Answer

1ko chacun

gen-hackman · Answer

Fais analyser le(s) fichier(s) suivants sur Virustotal :

Virus Total

    clique sur "Parcourir" et trouve puis selectionne ce(s) fichier(s) :

les deux fichiers un pâr un

    * Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
    * Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
    * Lorsque l'analyse est terminée colle le lien de(s)( la) page(s)  dans ta prochaine réponse.

cutter4 · Answer

Apparemment il n'y a rien:

http://www.virustotal.com/file-scan/report.html?id=63108c1a9e3e85c73f4fe2917faea654781200f4d55e4018d595587ad4540b96-1307115635

http://www.virustotal.com/file-scan/report.html?id=813b82b8f61180e9cd51ada5abca1a5a42a4587f3fb2957307f56e8b496a91d0-1307116023

gen-hackman · Answer

dis m'en plus sur la clé ?

cutter4 · Answer

C'est une sandisk de 2 giga. je sais pas pourquoi mais elle s'ouvre sur deux disques : sur le disque H je retrouve les données, sur le disque G il est marqué U3 system (5,57 Mo, 0 octet de libre). J'en connais pas + sur la clé, c'est à ma copine mais ce sont des données à moi.

gen-hackman · Answer

vire tes données , formate-la entierement , puis remets-y tes données

cutter4 · Answer

c'est fait, quelle est la suite?

gen-hackman · Answer

&#9654 Télécharge ZHPDiag (de Nicolas Coolman) 

ou :ZHPDiag

&#9654 Enregistre le sur ton Bureau.

Une fois le téléchargement achevé, 

&#9654 lance ZHPDiag.exe et clique sur Unzip dans la fenêtre qui s'ouvre.

&#9654 Clique sur le tournevis puis sur Tous pour cocher toutes les cases des options.

&#9654 Clique sur la loupe pour lancer l'analyse.

A la fin de l'analyse, 

&#9654 clique sur l'appareil photo et enregistre le rapport sur ton Bureau.

Pour me le transmettre clique sur ce lien :

http://www.cijoint.fr/

&#9654 Clique sur Parcourir et cherche le fichier C:\Documents and settings\le_nom_de_ta_session\.ZHPDiag.txt

&#9654 Clique sur Ouvrir.

&#9654 Clique sur "Cliquez ici pour déposer le fichier".

Un lien de cette forme :

http://www.cijoint.fr/cjlink.php?file=cj200905/cib7SU.txt

est ajouté dans la page.

&#9654 Copie ce lien dans ta réponse.

cutter4 · Answer

Voilà, c'est fait:

http://www.cijoint.fr/cjlink.php?file=cj201106/cijiXiUcgX.txt

gen-hackman · Answer

&#9654 Télécharge ici : Ad-remover sur ton bureau : 


&#9654 Déconnecte toi et ferme toutes applications en cours ! 

si tu as XP => double clique
si tu as Vista ou windows 7 => clic droit "executer en tant que...." 

&#9654 sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installation par défaut . 

&#9654 clique le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil .
 
&#9654 Au menu principal choisis "option Nettoyer" et tape sur [entrée] .

&#9654 Laisse travailler l'outil et ne touche à rien ... 

&#9654 Poste le rapport qui apparait à la fin , sur le forum ...

( Le rapport est sauvegardé aussi sous C:\Ad-report.log ) 
( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

cutter4 · Answer

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files (x86)\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 20:14:51 le 03/06/2011, Mode sans echec

Microsoft Windows 7 Édition Familiale Premium   (X64) 
Thomas@THOMAS-PC (ASUSTeK Computer Inc. K61IC) 
 
============== ACTION(S) ==============



(!) -- Fichiers temporaires supprimés.




============== SCAN ADDITIONNEL ==============

**** Internet Explorer Version [8.0.7600.16385] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\SysWOW64\wpcer.exe (x)
HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\SysWOW64\winfxdocobj.exe (x)
HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x)
HKLM_ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} - C:\Windows\system32\TSWbPrxy.exe (x)
BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)

========================================

C:\Program Files (x86)\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files (x86)\Ad-Remover\Backup: 14 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 03/06/2011 20:15:00 (2013 Octet(s)) 

Fin à: 20:16:02, 03/06/2011 
 
============== E.O.F ==============

gen-hackman · Answer

qu'y-a-t-il dans ce txt ?

C:\inject.log.txt

cutter4 · Answer

Ceci:

2009-12-27 13:16:00, Info                  DISM   PID=1536 Scratch directory set to 'X:\windows\TEMP\'. - CDISMManager::put_ScratchDir
2009-12-27 13:16:00, Info                  DISM   PID=1536 Scratch directory set to 's:\sandbox'. - CDISMManager::put_ScratchDir
2009-12-27 13:16:00, Info                  DISM   PID=1536 Successfully loaded the ImageSession at "s:\preload64\qfe\Servicing" - CDISMManager::LoadImageSession
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Found and Initialized the DISM Logger. - CDISMProviderStore::Internal_InitializeLogger
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Failed to get and initialize the PE Provider.  Continuing by assuming that it is not a WinPE image. - CDISMProviderStore::Final_OnConnect
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Finished initializing the Provider Map. - CDISMProviderStore::Final_OnConnect
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Getting Provider DISMLogger - CDISMProviderStore::GetProvider
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Getting Provider DISMLogger - CDISMProviderStore::GetProvider
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:00, Info                  DISM   DISM Manager: PID=1536 Successfully created the local image session and provider store. - CDISMManager::CreateLocalImageSession
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Getting Provider DISMLogger - CDISMProviderStore::GetProvider
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:00, Info                  DISM   DISM.EXE: 
2009-12-27 13:16:00, Info                  DISM   DISM.EXE: <----- Starting Dism.exe session ----->
2009-12-27 13:16:00, Info                  DISM   DISM.EXE: 
2009-12-27 13:16:00, Info                  DISM   DISM.EXE: Host machine information: OS Version=6.1.7600, Running architecture=x86, Number of processors=2
2009-12-27 13:16:00, Info                  DISM   DISM.EXE: Executing command line: s:\preload64\qfe\Servicing\dism.exe  /image:"s:\" /sysdrivedir:"s:\" /scratchdir:"s:\sandbox" /norestart /logpath:"s:\inject.log.txt" /apply-unattend:"s:\Temp\WINDOWS6.1-KB973525-X64.xml"
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Getting the collection of providers from a local provider store type. - CDISMProviderStore::GetProviderCollection
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Loading Provider from location s:\preload64\qfe\Servicing\WimProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Connecting to the provider located at s:\preload64\qfe\Servicing\WimProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Loading Provider from location s:\preload64\qfe\Servicing\FolderProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Connecting to the provider located at s:\preload64\qfe\Servicing\FolderProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Loading Provider from location s:\preload64\qfe\Servicing\CompatProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Connecting to the provider located at s:\preload64\qfe\Servicing\CompatProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:00, Info                  DISM   DISM.EXE: Got the collection of providers. Now enumerating them to build the command table.
2009-12-27 13:16:00, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: WimManager
2009-12-27 13:16:00, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: WimManager.
2009-12-27 13:16:00, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: FolderManager
2009-12-27 13:16:00, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: DISM Log Provider
2009-12-27 13:16:00, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: Compatibility Manager
2009-12-27 13:16:00, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: Compatibility Manager.
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Getting the collection of providers from a local provider store type. - CDISMProviderStore::GetProviderCollection
2009-12-27 13:16:00, Info                  DISM   DISM WIM Provider: PID=1536 [s:\] is not a WIM mount point. - CWimMountedImageInfo::Initialize
2009-12-27 13:16:00, Info                  DISM   DISM Provider Store: PID=1536 Getting the collection of providers from a local provider store type. - CDISMProviderStore::GetProviderCollection
2009-12-27 13:16:00, Info                  DISM   DISM WIM Provider: PID=1536 [s:\] is not a WIM mount point. - CWimMountedImageInfo::Initialize
2009-12-27 13:16:01, Info                  DISM   DISM Manager: PID=1536 Successfully loaded the ImageSession at "s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7" - CDISMManager::LoadImageSession
2009-12-27 13:16:01, Info                  DISM   DISM Image Session: PID=1588 Instantiating the Provider Store. - CDISMImageSession::get_ProviderStore
2009-12-27 13:16:01, Info                  DISM   DISM Provider Store: PID=1588 Initializing a provider store for the IMAGE session type. - CDISMProviderStore::Final_OnConnect
2009-12-27 13:16:01, Info                  DISM   DISM Provider Store: PID=1588 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:01, Info                  DISM   DISM Provider Store: PID=1588 Loading Provider from location s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\OSProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:01, Info                  DISM   DISM Provider Store: PID=1588 Connecting to the provider located at s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\OSProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:01, Info                  DISM   DISM OS Provider: PID=1588 Defaulting SystemPath to s:\ - CDISMOSServiceManager::Final_OnConnect
2009-12-27 13:16:01, Info                  DISM   DISM OS Provider: PID=1588 msxml6.dll was successfully copied to s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\msxml6.dll - CDISMOSServiceManager::RunASICompatibilityShim
2009-12-27 13:16:01, Info                  DISM   DISM OS Provider: PID=1588 msxml6r.dll was successfully copied to s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\msxml6r.dll - CDISMOSServiceManager::RunASICompatibilityShim
2009-12-27 13:16:01, Info                  DISM   DISM OS Provider: PID=1588 Defaulting Windows folder to s:\Windows - CDISMOSServiceManager::Final_OnConnect
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Attempting to initialize the logger from the Image Session. - CDISMProviderStore::Final_OnConnect
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Loading Provider from location s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\LogProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Connecting to the provider located at s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\LogProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Getting Provider OSServices - CDISMProviderStore::GetProvider
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Found and Initialized the DISM Logger. - CDISMProviderStore::Internal_InitializeLogger
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Loading Provider from location s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\PEProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:06, Warning               DISM   DISM Provider Store: PID=1588 Failed to Load the provider: s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\PEProvider.dll. - CDISMProviderStore::Internal_GetProvider(hr:0x8007007e)
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Failed to get and initialize the PE Provider.  Continuing by assuming that it is not a WinPE image. - CDISMProviderStore::Final_OnConnect
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Finished initializing the Provider Map. - CDISMProviderStore::Final_OnConnect
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Getting Provider DISMLogger - CDISMProviderStore::GetProvider
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:06, Info                  DISM   DISM Manager: PID=1536 Image session successfully loaded from the temporary location: s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7 - CDISMManager::CreateImageSession
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Getting Provider OSServices - CDISMProviderStore::GetProvider
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:06, Info                  DISM   DISM OS Provider: PID=1588 Setting SystemPath to s:\ - CDISMOSServiceManager::SetSystemPath
2009-12-27 13:16:06, Info                  CSI    00000001 Shim considered [l:252{126}]"\??\s:\Windows\Servicing\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\pkgmgr.exe" : got STATUS_OBJECT_PATH_NOT_FOUND
2009-12-27 13:16:06, Info                  CSI    00000002 Shim considered [l:246{123}]"\??\s:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\pkgmgr.exe" : got STATUS_SUCCESS
2009-12-27 13:16:06, Info                  DISM   DISM.EXE: Target image information: OS Version=6.1.7600.16385, Image architecture=amd64
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Getting the collection of providers from an image provider store type. - CDISMProviderStore::GetProviderCollection
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Loading Provider from location s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\CbsProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Connecting to the provider located at s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\CbsProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:06, Info                  DISM   DISM Provider Store: PID=1588 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:06, Info                  CSI    00000001 Shim considered [l:252{126}]"\??\s:\Windows\Servicing\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\pkgmgr.exe" : got STATUS_OBJECT_PATH_NOT_FOUND
2009-12-27 13:16:06, Info                  CSI    00000002 Shim considered [l:246{123}]"\??\s:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\pkgmgr.exe" : got STATUS_SUCCESS
2009-12-27 13:16:06, Info                  DISM   DISM Package Manager: PID=1588 Finished initializing the CbsConUI Handler. - CCbsConUIHandler::Initialize
2009-12-27 13:16:06, Info                  CSI    00000001 Shim considered [l:252{126}]"\??\s:\Windows\Servicing\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\pkgmgr.exe" : got STATUS_OBJECT_PATH_NOT_FOUND
2009-12-27 13:16:06, Info                  CSI    00000002 Shim considered [l:246{123}]"\??\s:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\pkgmgr.exe" : got STATUS_SUCCESS
2009-12-27 13:16:06, Info                  CBS    Transactions disabled in registry, continuing without transaction support.
2009-12-27 13:16:06, Info                  CBS    Kernel transactions are disabled, continuing without transaction support.
2009-12-27 13:16:06, Info                  CBS    Failed to find a matching version for servicing stack: s:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\ [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
2009-12-27 13:16:06, Info                  CBS    Failed to find servicing stack directory in online store. [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
2009-12-27 13:16:06, Info                  CBS    Must be doing offline servicing, using stack version from: s:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\cbscore.dll
2009-12-27 13:16:06, Info                  CBS    Loaded Servicing Stack v6.1.7600.16385 with Core: s:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\cbscore.dll
2009-12-27 13:16:06, Info                  CSI    00000001@2009/12/27:21:16:06.584 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x743dd85e @0x746450a4 @0x74621695 @0x746f15fd @0x746f17c4 @0x746d331b)
2009-12-27 13:16:06, Info                  CSI    00000002@2009/12/27:21:16:06.694 WcpInitialize (wcp.dll version 0.0.0.6) called (stack @0x743dd85e @0x74685d11 @0x74682b9e @0x746f15fd @0x746f17c4 @0x746d331b)
2009-12-27 13:16:06, Info                  DISM   DISM Package Manager: PID=1588 Loaded servicing stack for offline use only. - CDISMPackageManager::RefreshInstanceAndLock
2009-12-27 13:16:06, Info                  CBS    Loading offline registry hive: SOFTWARE, into registry key '{bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/SOFTWARE' from path '\?\s:\Windows\System32\config\SOFTWARE'.
2009-12-27 13:16:06, Info                  CBS    Loading offline registry hive: SYSTEM, into registry key '{bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/SYSTEM' from path '\?\s:\Windows\System32\config\SYSTEM'.
2009-12-27 13:16:06, Info                  CBS    Loading offline registry hive: SECURITY, into registry key '{bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/SECURITY' from path '\?\s:\Windows\System32\config\SECURITY'.
2009-12-27 13:16:06, Info                  CBS    Loading offline registry hive: SAM, into registry key '{bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/SAM' from path '\?\s:\Windows\System32\config\SAM'.
2009-12-27 13:16:06, Info                  CBS    Loading offline registry hive: COMPONENTS, into registry key '{bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/COMPONENTS' from path '\?\s:\Windows\System32\config\COMPONENTS'.
2009-12-27 13:16:06, Info                  CBS    Loading offline registry hive: DEFAULT, into registry key '{bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/DEFAULT' from path '\?\s:\Windows\System32\config\DEFAULT'.
2009-12-27 13:16:06, Info                  CBS    Loading offline registry hive: ntuser.dat, into registry key '{bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Users/default/ntuser.dat' from path '\?\s:\Users\default
tuser.dat'.
2009-12-27 13:16:06, Info                  CBS    Loading offline registry hive: schema.dat, into registry key '{bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/system32/smi/store/Machine/schema.dat' from path '\?\s:\Windows\system32\smi\store\Machine\schema.dat'.
2009-12-27 13:16:07, Info                  CBS    Offline image is: writeable
2009-12-27 13:16:07, Info                  CSI    00000003 CSI Store 2601320 (0x0027b168) initialized
2009-12-27 13:16:07, Info                  CBS    Session: 1588_1664936 initialized by client DISM Package Manager Provider.
2009-12-27 13:16:07, Info                  DISM   DISM Package Manager: PID=1588 Loaded servicing stack for offline use only. - CDISMPackageManager::RefreshInstanceAndLock
2009-12-27 13:16:07, Info                  DISM   DISM Package Manager: PID=1588 Loaded servicing stack for online use only. - CDISMPackageManager::RefreshInstanceAndLock
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Loading Provider from location s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\MsiProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Connecting to the provider located at s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\MsiProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Loading Provider from location s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\IntlProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Connecting to the provider located at s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\IntlProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Loading Provider from location s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\DmiProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Connecting to the provider located at s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\DmiProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:07, Info                  CSI    00000001 Shim considered [l:252{126}]"\??\s:\Windows\Servicing\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\pkgmgr.exe" : got STATUS_OBJECT_PATH_NOT_FOUND
2009-12-27 13:16:07, Info                  CSI    00000002 Shim considered [l:246{123}]"\??\s:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\pkgmgr.exe" : got STATUS_SUCCESS
2009-12-27 13:16:07, Info                  DISM   DISM OS Provider: PID=1588 Get the registry path to the SOFTWARE hive located at s:\Windows\system32\config\SOFTWARE and determine if it is loaded. - CDISMOSServiceManager::DetermineBootDrive
2009-12-27 13:16:07, Info                  DISM   DISM Driver Manager: PID=1588 Further logs for driver related operations can be found in the target operating system at %WINDIR%\inf\setupapi.offline.log - CDriverManager::Initialize
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Loading Provider from location s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\UnattendProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Connecting to the provider located at s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\UnattendProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Loading Provider from location s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\SmiProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Connecting to the provider located at s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\SmiProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Provider has not previously been encountered.  Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Loading Provider from location s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\TransmogProvider.dll - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Connecting to the provider located at s:\sandbox\FC0BBDAD-B5ED-48F0-846A-3FE6D67F77D7\TransmogProvider.dll. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Encountered a servicing provider, performing additional servicing initializations. - CDISMProviderStore::Internal_LoadProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Getting Provider DISM Package Manager - CDISMProviderStore::GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Getting Provider DISM Unattend Manager - CDISMProviderStore::GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Got the collection of providers. Now enumerating them to build the command table.
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: DISM Package Manager
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: DISM Package Manager.
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: OSServices
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: MsiManager
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: MsiManager.
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: IntlManager
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: IntlManager.
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: DriverManager
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: DriverManager.
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: DISM Unattend Manager
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: DISM Unattend Manager.
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: DISM Log Provider
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: SmiManager
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Attempting to add the commands from provider: Edition Manager
2009-12-27 13:16:07, Info                  DISM   DISM Transmog Provider: PID=1588 Current image session is [OFFLINE] - CTransmogManager::GetMode
2009-12-27 13:16:07, Info                  DISM   DISM.EXE: Succesfully registered commands for the provider: Edition Manager.
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Getting Provider DISM Unattend Manager - CDISMProviderStore::GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Getting Provider DISM Package Manager - CDISMProviderStore::GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Provider Store: PID=1588 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:16:07, Info                  DISM   DISM Package Manager: PID=1588 Attempting install from source location [%configsetroot%\Windows6.1-KB973525-x64.CAB]. Full path [s:\Temp\Windows6.1-KB973525-x64.CAB]. - CPackageManagerUnattendHandler::Internal_InstallPackageFromSource
2009-12-27 13:16:07, Info                  DPX    Started DPX phase: Resume and Download Job
2009-12-27 13:16:07, Info                  DPX    Started DPX phase: Apply Deltas Provided In File
2009-12-27 13:16:07, Info                  DPX    Ended DPX phase: Apply Deltas Provided In File
2009-12-27 13:16:07, Info                  DPX    Started DPX phase: Apply Deltas Provided In File
2009-12-27 13:16:07, Info                  DPX    Ended DPX phase: Apply Deltas Provided In File
2009-12-27 13:16:07, Info                  DPX    Ended DPX phase: Resume and Download Job
2009-12-27 13:16:07, Info                  CBS    Opened cabinet package, package directory: s:\Temp\, sandbox location: \?\s:\sandbox\A3ED67B6-0381-4C9D-9BAD-933AFF8DBDD0\, cabinet location: \?\s:\Temp\Windows6.1-KB973525-x64.CAB, manifest location: \?\s:\sandbox\A3ED67B6-0381-4C9D-9BAD-933AFF8DBDD0\update.mum
2009-12-27 13:16:07, Info                  DPX    Started DPX phase: Resume and Download Job
2009-12-27 13:16:07, Info                  DPX    Started DPX phase: Apply Deltas Provided In File
2009-12-27 13:16:07, Info                  DPX    Ended DPX phase: Apply Deltas Provided In File
2009-12-27 13:16:07, Info                  DPX    Ended DPX phase: Resume and Download Job
2009-12-27 13:16:07, Info                  DISM   DISM Package Manager: PID=1588 No selectable features found. - CPackageManagerUnattendHandler::Internal_UnattendQueueSelectFeatures
2009-12-27 13:16:07, Info                  DISM   DISM Package Manager: PID=1588 Initiating Changes on Package with values: 4, 7 - CDISMPackage::Internal_ChangePackageState
2009-12-27 13:16:07, Info                  CBS    Appl: detect Parent, Package: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Parent: Microsoft-Windows-Killbits-Package~31bf3856ad364e35~amd64~~8.0.7600.16385, Disposition = Detect, VersionComp: EQ, ServiceComp: EQ, BuildComp: EQ, DistributionComp: GE, RevisionComp: GE, Exist: present
2009-12-27 13:16:07, Info                  CBS    Appl: detectParent: package: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, parent found: Microsoft-Windows-Killbits-Package~31bf3856ad364e35~amd64~~8.0.7600.16385, state: Installed
2009-12-27 13:16:07, Info                  CBS    Appl: detect Parent, Package: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, disposition state from detectParent: Installed
2009-12-27 13:16:07, Info                  CBS    Appl: Evaluating package applicability for package Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, applicable state: Installed
2009-12-27 13:16:07, Info                  CBS    Blocked system sleep; prior state: 0x80000000
2009-12-27 13:16:07, Info                  CBS    Exec: Processing started.  Client: DISM Package Manager Provider, Session: 1588_1664936, Package: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3
2009-12-27 13:16:07, Info                  CBS    Exec: Using execution sequence: 34
2009-12-27 13:16:07, Info                  CBS    Disabling LKG boot option
2009-12-27 13:16:07, Info                  CBS    Appl: detect Parent, Package: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Parent: Microsoft-Windows-Killbits-Package~31bf3856ad364e35~amd64~~8.0.7600.16385, Disposition = Detect, VersionComp: EQ, ServiceComp: EQ, BuildComp: EQ, DistributionComp: GE, RevisionComp: GE, Exist: present
2009-12-27 13:16:07, Info                  CBS    Appl: detectParent: package: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, parent found: Microsoft-Windows-Killbits-Package~31bf3856ad364e35~amd64~~8.0.7600.16385, state: Installed
2009-12-27 13:16:07, Info                  CBS    Appl: detect Parent, Package: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, disposition state from detectParent: Installed
2009-12-27 13:16:07, Info                  CBS    Appl: Evaluating package applicability for package Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, applicable state: Installed
2009-12-27 13:16:07, Info                  DPX    Started DPX phase: Resume and Download Job
2009-12-27 13:16:07, Info                  DPX    Started DPX phase: Apply Deltas Provided In File
2009-12-27 13:16:08, Info                  DPX    Ended DPX phase: Apply Deltas Provided In File
2009-12-27 13:16:08, Info                  DPX    Ended DPX phase: Resume and Download Job
2009-12-27 13:16:08, Info                  CBS    Extracting all files from cabinet \?\s:\Temp\Windows6.1-KB973525-x64.CAB
2009-12-27 13:16:08, Info                  CBS    Plan: Package: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, current: Absent, pending: Default, start: Absent, applicable: Installed, targeted: Installed, limit: Installed
2009-12-27 13:16:08, Info                  CBS    Plan: Package: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-4_neutral_PACKAGE, current: Absent, pending: Default, start: Absent, applicable: Installed, targeted: Installed, limit: Installed, selected: Default
2009-12-27 13:16:08, Info                  CBS    Appl: detect Parent, Package: Package_for_KB973525_RTM~31bf3856ad364e35~amd64~~6.1.1.3, Parent: Microsoft-Windows-Killbits-Package~31bf3856ad364e35~amd64~~8.0.7600.16385, Disposition = Detect, VersionComp: EQ, ServiceComp: EQ, BuildComp: EQ, DistributionComp: GE, RevisionComp: GE, Exist: present
2009-12-27 13:16:08, Info                  CBS    Appl: detectParent: package: Package_for_KB973525_RTM~31bf3856ad364e35~amd64~~6.1.1.3, parent found: Microsoft-Windows-Killbits-Package~31bf3856ad364e35~amd64~~8.0.7600.16385, state: Installed
2009-12-27 13:16:08, Info                  CBS    Appl: detect Parent, Package: Package_for_KB973525_RTM~31bf3856ad364e35~amd64~~6.1.1.3, disposition state from detectParent: Installed
2009-12-27 13:16:08, Info                  CBS    Appl: Evaluating package applicability for package Package_for_KB973525_RTM~31bf3856ad364e35~amd64~~6.1.1.3, applicable state: Installed
2009-12-27 13:16:08, Info                  CBS    Plan: Package: Package_for_KB973525_RTM~31bf3856ad364e35~amd64~~6.1.1.3, current: Absent, pending: Default, start: Absent, applicable: Installed, targeted: Installed, limit: Installed
2009-12-27 13:16:08, Info                  CBS    Plan: Package: Package_for_KB973525_RTM~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-3_neutral_PACKAGE, current: Absent, pending: Default, start: Absent, applicable: Installed, targeted: Installed, limit: Installed, selected: Default
2009-12-27 13:16:08, Info                  CBS    Appl: detect Parent, Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Parent: Microsoft-Windows-Killbits-Package~31bf3856ad364e35~amd64~~8.0.7600.16385, Disposition = Detect, VersionComp: EQ, ServiceComp: EQ, BuildComp: EQ, DistributionComp: GE, RevisionComp: GE, Exist: present
2009-12-27 13:16:08, Info                  CBS    Appl: detectParent: package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, parent found: Microsoft-Windows-Killbits-Package~31bf3856ad364e35~amd64~~8.0.7600.16385, state: Installed
2009-12-27 13:16:08, Info                  CBS    Appl: detect Parent, Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, disposition state from detectParent: Installed
2009-12-27 13:16:08, Info                  CBS    Appl: Evaluating package applicability for package Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, applicable state: Installed
2009-12-27 13:16:08, Info                  CBS    Plan: Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, current: Absent, pending: Default, start: Absent, applicable: Installed, targeted: Installed, limit: Installed
2009-12-27 13:16:08, Info                  CSI    00000004 Transaction merge required, do-not-merge flag passed.
2009-12-27 13:16:08, Info                  CSI    00000005@2009/12/27:21:16:08.035 CSI Transaction @0x28e280 initialized for deployment engine {d16d444c-56d8-11d5-882d-0080c847b195} with flags 00000002 and client id [19]"TI5.1588_1664936:1/"

2009-12-27 13:16:11, Info                  CSI    00000006@2009/12/27:21:16:11.467 CSI Transaction @0x28e280 destroyed
2009-12-27 13:16:11, Info                  CBS    Appl: Selfupdate, Component: amd64_microsoft-windows-activexcompat_31bf3856ad364e35_0.0.0.0_none_76422fde04163860 (8.0.7600.20529), elevation:2, lower version revision holder: 8.0.7600.16385
2009-12-27 13:16:11, Info                  CBS    Applicability(ComponentAnalyzerEvaluateSelfUpdate): Component: amd64_microsoft-windows-activexcompat_31bf3856ad364e35_8.0.7600.20529_none_6dc756ecad2ae4bf, elevate: 2, applicable(true/false): 0
2009-12-27 13:16:11, Info                  CBS    Appl: Selfupdate, Component: x86_microsoft-windows-activexcompat_31bf3856ad364e35_0.0.0.0_none_1a23945a4bb8c72a (8.0.7600.20529), elevation:2, lower version revision holder: 8.0.7600.16385
2009-12-27 13:16:11, Info                  CBS    Applicability(ComponentAnalyzerEvaluateSelfUpdate): Component: x86_microsoft-windows-activexcompat_31bf3856ad364e35_8.0.7600.20529_none_11a8bb68f4cd7389, elevate: 2, applicable(true/false): 0
2009-12-27 13:16:11, Info                  CBS    Appl: SelfUpdate detect, component: amd64_microsoft-windows-activexcompat_31bf3856ad364e35_8.0.7600.20529_none_6dc756ecad2ae4bf, elevation: 2, applicable: 0
2009-12-27 13:16:11, Info                  CBS    Appl: Evaluating applicability block(non detectUpdate part), disposition is: Staged, applicability: NotApplicable, result applicability state: Staged
2009-12-27 13:16:11, Info                  CBS    Appl: Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-1_neutral_LDR, Applicable: NotApplicable, Disposition: Staged
2009-12-27 13:16:11, Info                  CBS    Plan: Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-1_neutral_LDR, current: Absent, pending: Default, start: Absent, applicable: Staged, targeted: Staged, limit: Installed, selected: Default
2009-12-27 13:16:11, Info                  CBS    Appl: Selfupdate, Component: amd64_microsoft-windows-activexcompat_31bf3856ad364e35_0.0.0.0_none_76422fde04163860 (8.0.7600.16424), elevation:2, lower version revision holder: 8.0.7600.16385
2009-12-27 13:16:11, Info                  CBS    Applicability(ComponentAnalyzerEvaluateSelfUpdate): Component: amd64_microsoft-windows-activexcompat_31bf3856ad364e35_8.0.7600.16424_none_6d38b8af9411c642, elevate: 2, applicable(true/false): 1
2009-12-27 13:16:11, Info                  CBS    Appl: SelfUpdate detect, component: amd64_microsoft-windows-activexcompat_31bf3856ad364e35_8.0.7600.16424_none_6d38b8af9411c642, elevation: 2, applicable: 1
2009-12-27 13:16:11, Info                  CBS    Appl: Evaluating applicability block(non detectUpdate part), disposition is: Staged, applicability: Applicable, result applicability state: Installed
2009-12-27 13:16:11, Info                  CBS    Appl: Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-2_neutral_GDR, Applicable: Applicable, Disposition: Installed
2009-12-27 13:16:11, Info                  CBS    Plan: Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-2_neutral_GDR, current: Absent, pending: Default, start: Absent, applicable: Installed, targeted: Installed, limit: Installed, selected: Default
2009-12-27 13:16:11, Info                  CBS    Perf: Resolve chain started.
2009-12-27 13:16:11, Info                  CSI    00000007 Transaction merge required, do-not-merge flag passed.
2009-12-27 13:16:11, Info                  CSI    00000008@2009/12/27:21:16:11.483 CSI Transaction @0x346ac98 initialized for deployment engine {d16d444c-56d8-11d5-882d-0080c847b195} with flags 00000002 and client id [71]"TI1.1588_1664936:2/Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3"

2009-12-27 13:16:11, Info                  CBS    Exec: Resolving Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-1_neutral_LDR
2009-12-27 13:16:11, Info                  CBS    Exec: Resolving Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-1_neutral_LDR, PinDeployment: amd64_ed62f0797bbbcf436b91ca27a64fffe5_31bf3856ad364e35_8.0.7600.20529_none_89a61cfed74fdb36
2009-12-27 13:16:11, Info                  CSI    00000009 Performing 1 operations; 1 are not lock/unlock and follow:
  AddCat (14): flags: 0 catfile: @0x352236c
2009-12-27 13:16:11, Info                  CSI    0000000a Performing 1 operations; 1 are not lock/unlock and follow:
  Stage (1): flags: 8 app: [ed62f0797bbbcf436b91ca27a64fffe5, Version = 8.0.7600.20529, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x3521eec
2009-12-27 13:16:11, Info                  CBS    Exec: Resolving Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-2_neutral_GDR
2009-12-27 13:16:11, Info                  CBS    Exec: Resolving Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-2_neutral_GDR, PinDeployment: amd64_ae6aae0e4bc36eada6d0a15fa7fd68c6_31bf3856ad364e35_8.0.7600.16424_none_59bf4a4f4ffae720
2009-12-27 13:16:11, Info                  CSI    0000000b Performing 1 operations; 1 are not lock/unlock and follow:
  AddCat (14): flags: 0 catfile: @0x35232e4
2009-12-27 13:16:11, Info                  CSI    0000000c Performing 1 operations; 1 are not lock/unlock and follow:
  Stage (1): flags: 8 app: [ae6aae0e4bc36eada6d0a15fa7fd68c6, Version = 8.0.7600.16424, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x35228c4
2009-12-27 13:16:11, Info                  CSI    0000000d Performing 4 operations; 4 are not lock/unlock and follow:
  PrestageComponent (13): flags: 0 app: (null) comp: Microsoft-Windows-ActiveXCompat, Version = 8.0.7600.20529, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
  PrestageComponent (13): flags: 0 app: (null) comp: Microsoft-Windows-ActiveXCompat, Version = 8.0.7600.20529, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
  PrestageComponent (13): flags: 0 app: (null) comp: Microsoft-Windows-ActiveXCompat, Version = 8.0.7600.16424, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
  PrestageComponent (13): flags: 0 app: (null) comp: Microsoft-Windows-ActiveXCompat, Version = 8.0.7600.16424, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral
2009-12-27 13:16:11, Info                  CSI    0000000e Performing 4 operations; 4 are not lock/unlock and follow:
  Stage (1): flags: 8 app: [Microsoft-Windows-ActiveXCompat, Version = 8.0.7600.20529, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x3522954
  Stage (1): flags: 8 app: [Microsoft-Windows-ActiveXCompat, Version = 8.0.7600.20529, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x352290c
  Stage (1): flags: 8 app: [Microsoft-Windows-ActiveXCompat, Version = 8.0.7600.16424, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x352368c
  Stage (1): flags: 8 app: [Microsoft-Windows-ActiveXCompat, Version = 8.0.7600.16424, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) comp: (null) man: @0x35223fc
2009-12-27 13:16:15, Info                  CSI    0000000f Performing 2 operations; 2 are not lock/unlock and follow:
  Pin (3): flags: 0 tlc: [ed62f0797bbbcf436b91ca27a64fffe5, Version = 8.0.7600.20529, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) ref: ( flgs: 00000000 guid: {d16d444c-56d8-11d5-882d-0080c847b195} name: [l:150{75}]"Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3.973525-1_neutral_LDR" ncdata: [l:2{1}]"3") thumbprint: [l:128{64}]"cd32e521e8fff0f8bcb8872d139b4da761b24d51da329492fdb5ce5cd57417d2"
  Pin (3): flags: 0 tlc: [ae6aae0e4bc36eada6d0a15fa7fd68c6, Version = 8.0.7600.16424, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) ref: ( flgs: 00000000 guid: {d16d444c-56d8-11d5-882d-0080c847b195} name: [l:150{75}]"Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3.973525-2_neutral_GDR" ncdata: [l:2{1}]"3") thumbprint: [l:128{64}]"cd32e521e8fff0f8bcb8872d139b4da761b24d51da329492fdb5ce5cd57417d2"
2009-12-27 13:16:15, Info                  CSI    00000010 Component change list: 
2009-12-27 13:16:15, Info                  CSI    00000011 ICSITransaction::Commit calling IStorePendingTransaction::Apply - coldpatching=FALSE applyflags=7
2009-12-27 13:16:16, Info                  CSI    00000012 Begin executing advanced installer phase 50 (0x00000032) index 0 (sequence 0)
    Old component: [l:0]""
    New component: [l:0]""
    Install mode: uninstall
    Installer ID: {51d813ef-83f1-42de-a2ee-89ee4633a7c9}
    Installer name: [25]"RegistryKey SD Applicator"
2009-12-27 13:16:16, Info                  CSI    00000013 End executing advanced installer (sequence 0)
    Completion status: S_OK 

2009-12-27 13:16:16, Info                  CSI    00000014 Begin executing advanced installer phase 50 (0x00000032) index 0 (sequence 0)
    Old component: [l:0]""
    New component: [l:0]""
    Install mode: install
    Installer ID: {51d813ef-83f1-42de-a2ee-89ee4633a7c9}
    Installer name: [25]"RegistryKey SD Applicator"
2009-12-27 13:16:16, Info                  CSI    00000015 End executing advanced installer (sequence 0)
    Completion status: S_OK 

2009-12-27 13:16:16, Info                  CSI    00000016 Begin executing advanced installer phase 50 (0x00000032) index 0 (sequence 0)
    Old component: [l:0]""
    New component: [l:0]""
    Install mode: delta
    Installer ID: {d4486727-4d36-45a5-bc81-b8935aed1429}
    Installer name: [20]"Ngen Service Tickler"
2009-12-27 13:16:16, Info                  CSI    00000017 End executing advanced installer (sequence 0)
    Completion status: S_OK 

2009-12-27 13:16:16, Info                  CSI    00000018@2009/12/27:21:16:16.334 CSI Transaction @0x346ac98 destroyed
2009-12-27 13:16:16, Info                  CBS    Perf: Resolve chain complete.
2009-12-27 13:16:16, Info                  CBS    Perf: Stage chain started.
2009-12-27 13:16:16, Info                  CSI    00000019 Transaction merge required, do-not-merge flag passed.
2009-12-27 13:16:16, Info                  CSI    0000001a@2009/12/27:21:16:16.350 CSI Transaction @0x28ff0e8 initialized for deployment engine {d16d444c-56d8-11d5-882d-0080c847b195} with flags 00000002 and client id [64]"TI2.0_0:0/Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3"

2009-12-27 13:16:16, Info                  CBS    Exec: Staging Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-1_neutral_LDR
2009-12-27 13:16:16, Info                  CBS    Exec: Staging Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-1_neutral_LDR, PinDeployment: amd64_ed62f0797bbbcf436b91ca27a64fffe5_31bf3856ad364e35_8.0.7600.20529_none_89a61cfed74fdb36
2009-12-27 13:16:16, Info                  CBS    Exec: Staging Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-2_neutral_GDR
2009-12-27 13:16:16, Info                  CBS    Exec: Staging Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-2_neutral_GDR, PinDeployment: amd64_ae6aae0e4bc36eada6d0a15fa7fd68c6_31bf3856ad364e35_8.0.7600.16424_none_59bf4a4f4ffae720
2009-12-27 13:16:16, Info                  CSI    0000001b@2009/12/27:21:16:16.366 CSI Transaction @0x28ff0e8 destroyed
2009-12-27 13:16:16, Info                  CSI    0000001c Transaction merge required, do-not-merge flag passed.
2009-12-27 13:16:16, Info                  CSI    0000001d@2009/12/27:21:16:16.381 CSI Transaction @0x28ff0e8 initialized for deployment engine {d16d444c-56d8-11d5-882d-0080c847b195} with flags 00000002 and client id [71]"TI3.1588_1664936:3/Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3"

2009-12-27 13:16:19, Info                  CSI    0000001e@2009/12/27:21:16:19.642 CSI Transaction @0x28ff0e8 destroyed
2009-12-27 13:16:19, Info                  CBS    Perf: Stage chain complete.
2009-12-27 13:16:19, Info                  CBS    Perf: Execute chain started.
2009-12-27 13:16:19, Info                  CBS    Exec: Not trying hotpatching because root package is not hotpatch-aware: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3
2009-12-27 13:16:19, Info                  CSI    0000001f Transaction merge required, do-not-merge flag passed.
2009-12-27 13:16:19, Info                  CSI    00000020@2009/12/27:21:16:19.704 CSI Transaction @0x4893020 initialized for deployment engine {d16d444c-56d8-11d5-882d-0080c847b195} with flags 00000002 and client id [71]"TI4.1588_1664936:4/Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3"

2009-12-27 13:16:22, Info                  CBS    Exec: Installing Package: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3
2009-12-27 13:16:22, Info                  CBS    Exec: Installing Package: Package_for_KB973525_RTM~31bf3856ad364e35~amd64~~6.1.1.3
2009-12-27 13:16:22, Info                  CBS    Exec: Installing Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3
2009-12-27 13:16:22, Info                  CBS    Exec: Skipping Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-1_neutral_LDR because it is already in the correct state.
2009-12-27 13:16:22, Info                  CBS    Exec: Installing Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-2_neutral_GDR
2009-12-27 13:16:22, Info                  CBS    Exec: Installing Package: Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, Update: 973525-2_neutral_GDR, InstallDeployment: amd64_ae6aae0e4bc36eada6d0a15fa7fd68c6_31bf3856ad364e35_8.0.7600.16424_none_59bf4a4f4ffae720
2009-12-27 13:16:22, Info                  CBS    Appl: Selfupdate, Component: x86_microsoft-windows-activexcompat_31bf3856ad364e35_0.0.0.0_none_1a23945a4bb8c72a (8.0.7600.20529), elevation:3, lower version revision holder: 8.0.7600.16424
2009-12-27 13:16:22, Info                  CBS    Appl: Selfupdate, Component: amd64_microsoft-windows-activexcompat_31bf3856ad364e35_0.0.0.0_none_76422fde04163860 (8.0.7600.20529), elevation:3, lower version revision holder: 8.0.7600.16424
2009-12-27 13:16:26, Info                  CSI    00000021 Performing 1 operations; 1 are not lock/unlock and follow:
  Install (5): flags: 0 tlc: [ae6aae0e4bc36eada6d0a15fa7fd68c6, Version = 8.0.7600.16424, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral]) ref: ( flgs: 00000000 guid: {d16d444c-56d8-11d5-882d-0080c847b195} name: [l:150{75}]"Package_1_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3.973525-2_neutral_GDR" ncdata: [l:2{1}]"3") thumbprint: (null)
2009-12-27 13:16:26, Info                  CSI    00000022 Component change list:   { (null) -> 8.0.7600.16424 ae6aae0e4bc36eada6d0a15fa7fd68c6, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral }
  { 8.0.7600.16385 -> 8.0.7600.16424 Microsoft-Windows-ActiveXCompat, pA = PROCESSOR_ARCHITECTURE_AMD64 (9), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral }
  { 8.0.7600.16385 -> 8.0.7600.16424 Microsoft-Windows-ActiveXCompat, pA = PROCESSOR_ARCHITECTURE_INTEL (0), Culture neutral, VersionScope = 1 nonSxS, PublicKeyToken = {l:8 b:31bf3856ad364e35}, Type neutral, TypeName neutral, PublicKey neutral }
2009-12-27 13:19:14, Info                  CSI    00000023 ICSITransaction::Commit calling IStorePendingTransaction::Apply - coldpatching=FALSE applyflags=10 (0x0000000a)
2009-12-27 13:19:16, Info                  CSI    00000024 Begin executing advanced installer phase 50 (0x00000032) index 0 (sequence 0)
    Old component: [l:0]""
    New component: [l:0]""
    Install mode: uninstall
    Installer ID: {51d813ef-83f1-42de-a2ee-89ee4633a7c9}
    Installer name: [25]"RegistryKey SD Applicator"
2009-12-27 13:19:16, Info                  CSI    00000025 End executing advanced installer (sequence 0)
    Completion status: S_OK 

2009-12-27 13:19:16, Info                  CSI    00000026 Begin executing advanced installer phase 50 (0x00000032) index 0 (sequence 0)
    Old component: [l:0]""
    New component: [l:0]""
    Install mode: install
    Installer ID: {51d813ef-83f1-42de-a2ee-89ee4633a7c9}
    Installer name: [25]"RegistryKey SD Applicator"
2009-12-27 13:19:16, Info                  CSI    00000027 End executing advanced installer (sequence 0)
    Completion status: S_OK 

2009-12-27 13:19:16, Info                  CSI    00000028 Begin executing advanced installer phase 50 (0x00000032) index 0 (sequence 0)
    Old component: [l:0]""
    New component: [l:0]""
    Install mode: delta
    Installer ID: {d4486727-4d36-45a5-bc81-b8935aed1429}
    Installer name: [20]"Ngen Service Tickler"
2009-12-27 13:19:16, Info                  CSI    00000029 End executing advanced installer (sequence 0)
    Completion status: S_OK 

2009-12-27 13:19:16, Info                  CBS    Setting ExecuteState key to: CbsExecuteStateResolvePending
2009-12-27 13:19:16, Info                  CBS    Exec: Pended transaction, changes will be applied during startup processing. Scheduled TrustedInstaller for auto-start. [HRESULT = 0x00000000 - S_OK]
2009-12-27 13:19:16, Info                  CSI    0000002a@2009/12/27:21:19:16.436 CSI Transaction @0x4893020 destroyed
2009-12-27 13:19:16, Info                  CBS    Perf: InstallUninstallChain complete.
2009-12-27 13:19:16, Info                  CBS    SQM: Reporting package change for package: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3, current: Absent, pending: Default, start: Absent, applicable: Installed, target: Installed, limit: Installed, hotpatch status: DisabledBecauseNoHotpatchPackagesInitiated, status: 0x0, failure source: Not Applicable, reboot required: True, client id: DISM Package Manager Provider, initiated offline: True, execution sequence: 34, first merged sequence: 2
2009-12-27 13:19:16, Info                  CBS    SQM: Package change report datapoints not populated because SQM is not initialized or not running online.
2009-12-27 13:19:16, Info                  CBS    Restored system sleep block state: 0x80000000
2009-12-27 13:19:16, Info                  CBS    Exec: Processing complete.  Session: 1588_1664936, Package: Package_for_KB973525~31bf3856ad364e35~amd64~~6.1.1.3 [HRESULT = 0x00000000 - S_OK]
2009-12-27 13:19:16, Info                  CBS    Session: 1588_1664936 finalized. Reboot required: no [HRESULT = 0x00000000 - S_OK]
2009-12-27 13:19:16, Info                  CSI    00000001 Shim considered [l:252{126}]"\??\s:\Windows\Servicing\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\pkgmgr.exe" : got STATUS_OBJECT_PATH_NOT_FOUND
2009-12-27 13:19:16, Info                  CSI    00000002 Shim considered [l:246{123}]"\??\s:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\pkgmgr.exe" : got STATUS_SUCCESS
2009-12-27 13:19:16, Info                  DISM   DISM Package Manager: PID=1588 DISM has detected a DISM component change. Requesting a shutdown. - CDISMPackageManager::Internal_Finalize
2009-12-27 13:19:16, Info                  DISM   DISM Image Session: PID=1588 The image session needs to be closed and re-opened before any servicing operations can be performed. - CDISMImageSession::put_ImageState
2009-12-27 13:19:16, Info                  CBS    Unloading offline registry hive: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/SOFTWARE
2009-12-27 13:19:16, Info                  CBS    Failed to unload offline registry: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/SOFTWARE, the client may still need it open. [HRESULT = 0x80070005 - E_ACCESSDENIED]
2009-12-27 13:19:16, Info                  CBS    Unloading offline registry hive: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/SYSTEM
2009-12-27 13:19:16, Info                  CBS    Failed to unload offline registry: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/SYSTEM, the client may still need it open. [HRESULT = 0x80070005 - E_ACCESSDENIED]
2009-12-27 13:19:16, Info                  CBS    Unloading offline registry hive: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/SECURITY
2009-12-27 13:19:16, Info                  CBS    Failed to unload offline registry: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/SECURITY, the client may still need it open. [HRESULT = 0x80070005 - E_ACCESSDENIED]
2009-12-27 13:19:16, Info                  CBS    Unloading offline registry hive: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/SAM
2009-12-27 13:19:16, Info                  CBS    Failed to unload offline registry: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/SAM, the client may still need it open. [HRESULT = 0x80070005 - E_ACCESSDENIED]
2009-12-27 13:19:16, Info                  CBS    Unloading offline registry hive: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/COMPONENTS
2009-12-27 13:19:16, Info                  CBS    Failed to unload offline registry: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/COMPONENTS, the client may still need it open. [HRESULT = 0x80070005 - E_ACCESSDENIED]
2009-12-27 13:19:16, Info                  CBS    Unloading offline registry hive: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/DEFAULT
2009-12-27 13:19:16, Info                  CBS    Failed to unload offline registry: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/System32/config/DEFAULT, the client may still need it open. [HRESULT = 0x80070005 - E_ACCESSDENIED]
2009-12-27 13:19:16, Info                  CBS    Unloading offline registry hive: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Users/default/ntuser.dat
2009-12-27 13:19:16, Info                  CBS    Failed to unload offline registry: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Users/default/ntuser.dat, the client may still need it open. [HRESULT = 0x80070005 - E_ACCESSDENIED]
2009-12-27 13:19:16, Info                  CBS    Unloading offline registry hive: {bf1a281b-ad7b-4476-ac95-f47682990ce7}s:/Windows/system32/smi/store/Machine/schema.dat
2009-12-27 13:19:16, Info                  DISM   DISM Provider Store: PID=1588 Getting Provider SmiManager - CDISMProviderStore::GetProvider
2009-12-27 13:19:16, Info                  DISM   DISM Provider Store: PID=1588 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:19:16, Info                  CSI    00000001 Shim considered [l:252{126}]"\??\s:\Windows\Servicing\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\pkgmgr.exe" : got STATUS_OBJECT_PATH_NOT_FOUND
2009-12-27 13:19:16, Info                  CSI    00000002 Shim considered [l:246{123}]"\??\s:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\pkgmgr.exe" : got STATUS_SUCCESS
2009-12-27 13:19:17, Info                  DISM   DISM Smi Provider: PID=1588 SMI provider selected "offlineServicing" servicing pass. - CSmiWrapper::ApplySettings
2009-12-27 13:19:17, Info                  DISM   DISM Smi Provider: PID=1588 Setttings pass=offlineServicing not found in unattend file.  Not calling into SMI. - CSmiWrapper::ApplySettings
2009-12-27 13:19:17, Info                  DISM   DISM Provider Store: PID=1588 Getting Provider DriverManager - CDISMProviderStore::GetProvider
2009-12-27 13:19:17, Info                  DISM   DISM Provider Store: PID=1588 Provider has previously been initialized.  Returning the existing instance. - CDISMProviderStore::Internal_GetProvider
2009-12-27 13:19:17, Info                  DISM   DISM Driver Manager: PID=1588 ENTER InstallDriversO

gen-hackman · Answer

et bien je ne sais pas du tout ce que c'est

cutter4 · Answer

mais je ne suis pas sur que ça ait un lien avec le virus qui cache mes programmes et les éléments du bureau :-/

gen-hackman · Answer

supprime pre_scan retelecharge-le puis repasse-le 
G3?-?@¢??@?......Concepteur de List_Kill'em...Pre_Scan....MBR_Repair....

cutter4 · Answer

Voilà, cette fois j'ai l'impression qu'il a mieux fonctionné...

http://www.cijoint.fr/cjlink.php?file=cj201106/cijqueQTk9.txt

gen-hackman · Answer

impec refais zhpdiag stp

cutter4 · Answer

Hello,

Voilà ce que donne le dernier zhpdiag:

http://www.cijoint.fr/cjlink.php?file=cj201106/cijMFhSMim.txt

gen-hackman · Answer

repasse ad-remover option nettoyer en mode sans echec stp

cutter4 · Answer

Voilà:

======= RAPPORT D'AD-REMOVER 2.0.0.2,G | UNIQUEMENT XP/VISTA/7 =======

Mis à jour par TeamXscript le 12/04/11
Contact: AdRemover[DOT]contact[AT]gmail[DOT]com
Site web: http://www.teamxscript.org

C:\Program Files (x86)\Ad-Remover\main.exe (CLEAN [1]) -> Lancé à 16:01:30 le 05/06/2011, Mode sans echec

Microsoft Windows 7 Édition Familiale Premium   (X64) 
Thomas@THOMAS-PC (ASUSTeK Computer Inc. K61IC) 
 
============== ACTION(S) ==============



(!) -- Fichiers temporaires supprimés.




============== SCAN ADDITIONNEL ==============

**** Internet Explorer Version [8.0.7600.16385] ****

HKCU_Main|Default_Page_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKCU_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU_Main|Search bar - hxxp://go.microsoft.com/fwlink/?linkid=54896
HKCU_Main|Start Page - hxxp://fr.msn.com/
HKLM_Main|Default_Page_URL - hxxp://go.microsoft.com/fwlink/?LinkId=54896
HKLM_Main|Default_Search_URL - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Search bar - hxxp://search.msn.com/spbasic.htm
HKLM_Main|Search Page - hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM_Main|Start Page - hxxp://fr.msn.com/
HKLM_ElevationPolicy\{07d873dc-b9b9-44f5-af0b-fb59fa54fb7a} - C:\Windows\SysWOW64\wpcer.exe (x)
HKLM_ElevationPolicy\{0a402d70-1f10-4ae7-bec9-286a98240695} - C:\Windows\SysWOW64\winfxdocobj.exe (x)
HKLM_ElevationPolicy\{70f641fd-9ffc-4d5b-a4dc-962af4ed7999} - C:\Program Files (x86)\Internet Explorer\iedw.exe (x)
HKLM_ElevationPolicy\{B43A0C1E-B63F-4691-B68F-CD807A45DA01} - C:\Windows\system32\TSWbPrxy.exe (x)
BHO\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - "Search Helper" (C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll)

========================================

C:\Program Files (x86)\Ad-Remover\Quarantine: 0 Fichier(s)
C:\Program Files (x86)\Ad-Remover\Backup: 14 Fichier(s)

C:\Ad-Report-CLEAN[1].txt - 05/06/2011 16:01:38 (2013 Octet(s)) 

Fin à: 16:02:42, 05/06/2011 
 
============== E.O.F ==============

gen-hackman · Answer

Fais analyser le(s) fichier(s) suivants sur Virustotal : 

Virus Total 

    clique sur "Parcourir" et trouve puis selectionne ce(s) fichier(s) : 

 C:\Tarte\HinataBokko\HinataBokko.exe       
 
    * Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché. 
    * Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page. 
    * Lorsque l'analyse est terminée colle le lien de(s)( la) page(s)  dans ta prochaine réponse. 

========================================== 

sélectionne les lignes ci-dessous et copie les dans le Presse-papier (Ctrl C) 
 
R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1  
O4 - HKLM\..\Wow6432Node\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd (.not file.)  
OPT:O4 - HKLM\..\Wow6432Node\Run: [SunJavaUpdateSched] . (.Sun Microsystems, Inc. - Java Update Scheduler.) -- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 
O42 - Logiciel: Java 6 Update 20 - (.Sun Microsystems, Inc..) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F83216018FF}   
[HKCU\Software\opsmr9ibkfl]       
[HKLM\Software\BrowserChoice]   
C:\ProgramData\lNoEeKc09000       
O53 - SMSR:HKLM\...\startupreg\Adobe Reader Speed Launcher  [Key] . (.Adobe Systems Incorporated - Adobe Acrobat SpeedLauncher.) -- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe   
O61 - LFC:Last File Created 02/06/2011 - 09:36:20 ----- C:\Users\Thomas\AppData\Local\Temp\Low	dn31yvi4pks3n0jt8at7srg44qvg2u01w0p7538wq6   [9312]       
O87 - FAEL: "{A8735C75-3827-4775-992C-75D449445805}" |In - Private - P6 - TRUE | .(...) -- C:\Program Files (x86)\LimeWire\LimeWire.exe (.not file.)  
O87 - FAEL: "{233788E9-1F7B-46CC-8601-80387FBECBD7}" |In - Private - P17 - TRUE | .(...) -- C:\Program Files (x86)\LimeWire\LimeWire.exe (.not file.)   
[HKCR\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}]   
[HKLM\Software\Classes\Wow6432Node\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}]   
[HKLM\Software\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}]     
C:\Users\Thomas\Appdata\Local\Temp\log 

   
Pour Xp : Double clique sur l'icône ZHPFix.exe sur ton Bureau. 

Pour Vista : Clique droit sur l'icône ZHPFix.exe sur ton Bureau, 
puis sélectionne 'Exécuter en tant qu'administrateur'. 

- Clique sur l'icone représentant la lettre H (« coller les lignes Helper »)  
- Les lignes se collent automatiquement dans ZHPFix, sinon colle les lignes  
- Clique sur le bouton « GO » pour lancer le nettoyage, 
- Copie/colle la totalité du rapport dans ta prochaine réponse 
G3?-?@¢??@?......Concepteur de List_Kill'em...Pre_Scan....MBR_Repair....

cutter4 · Answer

Il n'a rien trouvé d'anormal:

http://www.virustotal.com/file-scan/report.html?id=edbe1e297d76686c9447e3fe01ccda1d04752bf4205cd045b9179b162d75670f-1307290544

gen-hackman · Answer

ok c'est à toi ce prog ?

fais la suite aussi :)

cutter4 · Answer

Oui mais je ne sais pas comment le supprimer "proprement" étant donné qu'il n'est pas proposé dans l'ajout/suppression de programme.

Pour la suite:

Rapport de ZHPFix 1.12.3296 par Nicolas Coolman, Update du 04/06/2011
Fichier d'export Registre : C:\ZHPExportRegistry-05-06-2011-19-14-17.txt
Run by Thomas at 05/06/2011 19:14:17
Windows 7 Home Premium Edition, 64-bit  (Build 7600)
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html

========== Logiciel(s) ==========
ABSENT O42 - Logiciel: Java 6 Update 20 - (.Sun Microsystems, Inc..) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F83216018FF}

========== Clé(s) du Registre ==========
SUPPRIME HKCU\Software\opsmr9ibkfl
ERREUR HKLM\Software\BrowserChoice
ERREUR  StartupReg: Adobe Reader Speed Launcher
SUPPRIME HKCR\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
SUPPRIME HKLM\Software\Classes\Wow6432Node\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
SUPPRIME HKLM\Software\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}

========== Valeur(s) du Registre ==========
SUPPRIME RunValue: Setwallpaper
SUPPRIME RunValue: SunJavaUpdateSched
SUPPRIME {A8735C75-3827-4775-992C-75D449445805}
SUPPRIME {233788E9-1F7B-46CC-8601-80387FBECBD7}

========== Elément(s) de donnée du Registre ==========
SUPPRIME R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1

========== Dossier(s) ==========
SUPPRIME c:\programdata\lnoeekc09000
SUPPRIME c:\users	homas\appdata\local	emp\log

========== Fichier(s) ==========
ABSENT File: c:\programdata\setwallpaper.cmd
SUPPRIME c:\program files (x86)\adobeeader 9.0eadereader_sl.exe
SUPPRIME c:\users	homas\appdata\local	emp\low	dn31yvi4pks3n0jt8at7srg44qvg2u01w0p7538wq6


========== Récapitulatif ==========
6 : Clé(s) du Registre
4 : Valeur(s) du Registre
1 : Elément(s) de donnée du Registre
2 : Dossier(s)
3 : Fichier(s)
1 : Logiciel(s)


End of the scan

cutter4 · Answer

Que faire en suite?

gen-hackman · Answer

retour

ok ben si tu veux le virer on va le virer

refais tourner zhpdiag , coche tout au tournevis

cutter4 · Answer

Voilà:

http://www.cijoint.fr/cjlink.php?file=cj201106/cijVYIln2T.txt 

Sinon d'après toi y a encore des bebetes dans mon pc?

cutter4 · Answer

C'est un jeu que j'ai téléchargé mais il ne fonctionne pas. On peut le supprimer aussi.

gen-hackman · Answer

sélectionne les lignes ci-dessous et copie les dans le Presse-papier (Ctrl C)

R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1 
O42 - Logiciel: Java 6 Update 20 - (.Sun Microsystems, Inc..) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F83216018FF}
[HKCU\Software\KEY]      
[HKCU\Software\MERCURE]      
[HKCU\Software\Tarte.ini]      
[HKLM\Software\BrowserChoice]    => Microsoft BrowserChoice  
O43 - CFD: 14/05/2011 - 11:42:48 - [552279865] --H-D- C:\Program Files\MERCURE      

  
Pour Xp : Double clique sur l'icône ZHPFix.exe sur ton Bureau.

Pour Vista : Clique droit sur l'icône ZHPFix.exe sur ton Bureau,
puis sélectionne 'Exécuter en tant qu'administrateur'.

- Clique sur l'icone représentant la lettre H (« coller les lignes Helper ») 
- Les lignes se collent automatiquement dans ZHPFix, sinon colle les lignes 
- Clique sur le bouton « GO » pour lancer le nettoyage,
- Copie/colle la totalité du rapport dans ta prochaine réponse

gab23 · Answer

Salut !
Désolé de vous interrompre mais j'ai exactement le même problème qu'au début du sujet, j'ai suivi ta méthode gen-hackman et mon rapport de pre_scan est là

http://www.cijoint.fr/cjlink.php?file=cj201106/cijYF4BU5P.txt
peux-tu m'aider ?

merci d'avance...

cutter4 · Answer

Voilà le rapport:

Rapport de ZHPFix 1.12.3296 par Nicolas Coolman, Update du 04/06/2011
Fichier d'export Registre : C:\ZHPExportRegistry-06-06-2011-22-24-28.txt
Run by Thomas at 06/06/2011 22:24:28
Windows 7 Home Premium Edition, 64-bit  (Build 7600)
Web site : http://www.premiumorange.com/zeb-help-process/zhpfix.html

========== Logiciel(s) ==========
ABSENT O42 - Logiciel: Java 6 Update 20 - (.Sun Microsystems, Inc..) [HKLM][64Bits] -- {26A24AE4-039D-4CA4-87B4-2F83216018FF}

========== Clé(s) du Registre ==========
SUPPRIME HKCU\Software\KEY
SUPPRIME HKCU\Software\MERCURE
SUPPRIME HKCU\Software\Tarte.ini
ERREUR HKLM\Software\BrowserChoice

========== Elément(s) de donnée du Registre ==========
SUPPRIME R5 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,MigrateProxy = 1

========== Dossier(s) ==========
SUPPRIME C:\Program Files\MERCURE


========== Récapitulatif ==========
4 : Clé(s) du Registre
1 : Elément(s) de donnée du Registre
1 : Dossier(s)
1 : Logiciel(s)


End of the scan

gen-hackman · Answer

supprime le doosier C:\Tarte

comment va le pc ?.

cutter4 · Answer

Re.

Le PC va mieux mais:

j'ai l'impression qu'il manque des icones sur le bureau (des trucs que j'avais au départ, des icones ASUS que je n'ai jamais utilisées mais aussi malwarebytes et sans doute d'autres programmes).

dans "démarrer>programmes", j'ai des dossiers vides (le dossier "programs", le dossier "games, le dossier "avira/avira antivir desktop", etc.).

les programmes récemment ouverts ne s'affichent pas dans le menu "démarrer", sauf les 3 qui étaient ouverts quand le virus a fait foirer le pc (malwarebytes, bloc note et calculatrice).

Une idée de ce qu'il se passe?

gen-hackman · Answer

ou alors ils disparaissent à chaque redemarrage ?

cutter4 · Answer

non non, ils ne s'affichent jamais...

gen-hackman · Answer

alors là je m'avoue vaincu............

Laurent J. · Answer

Bonjour Gen-hackman

Ayant le même souci que mes comparses, et suivant tes conseils réitérés à leur égard, j'ai ouvert un nouveau sujet sur ce même problème avec mon résultat de pré-scan :

https://forums.commentcamarche.net/forum/affich-22425308-pre-scan-a-lire-suite-attaq-windowsxprepair

Merci de tes conseils

Rodge · Answer

Bonjour
J'ai le meme probleme '' programme disparu, disque c vide et plus rien sur le bureau'' sauf que l'orsque je lui dit d'afficher les dossier cacher du systeme, je vois mes dossier mais ils sont transparent 

J'ai fait un scan et voici le resultat: 
http://www.cijoint.fr/cjlink.php?file=cijtMj68JH.txt

merci de votre aide

Rodge

Rodge · Answer

Probleme resolu

webgraphik · Answer

Bonsoir,

Je viens vous voir car je rencontre un problème sur un ordinateur (celui de ma belle mère). J'ai effectué le scan depuis les programmes sont revenus via le menu démarrer lieu où ils avaient disparu ... mais quand je clique dans le disque C c'est toujours pareil.

Aucun fichier ou dossier ne revient.

Voici le lien du fichier TXT réalisé :

http://www.cijoint.fr/cjlink.php?file=cj201109/cijjDBGXWg.txt


Je vous remercie par avance pour votre précieuse aide.

Cordialement,
Webgraphik

nico · Answer

pourquoi effacer mon comment alors que je donne la solution ???? assez bizarre en fait ... comme j ai eu ce virus dernièrement d autres peuvent aussi l avoir ... quelle est votre approche de la résolution de probleme ??? des tonnes de pages qui servent à rien avec des tests dans tous les sens ???? sans donner vraiment de solution et quand on vous la donne vous l'effacez ?????? assez surpris en fait, je revenais pour partager les infos de recovery que javais trouvées, puis je me rends compte que mon mess est effacé ... sympa ca vaut le coup de se casser le cul. allez au plaisir....

Virus: programmes disparus et disque C vide

72 réponses

Discussions similaires