virus bloquant le bureau de mon pc Résolu

Question

Bonjour, 
je vous ecris pour un probleme sur mon pc windows vista
depuis la detection d'un virus, ce matin sur mon pc, il y a juste un ecran bleu qui apparait sur le bureau;
tous les icones ont disparu et je ne peux plus rien faire a partir de cet écran
merci de m aider



Configuration: Windows XP / Firefox 14.0.1

g3n-h@ckm@n · Answer

salut cela fait-il la meme chose en mode sans echec ?

chdu57 · Answer

en mode sans echec avec prise en compte du reseau, cela fonctionne a nouveau

chdu57 · Answer

le programme anty malware s'est lancé et je vois que c'est le virus zeus

g3n-h@ckm@n · Answer

comment tn vois ca ?

chdu57 · Answer

pendant le scan, il m'indique 2 elements detectés, j'ai cliqué dessus pour voir et les faire effacer

g3n-h@ckm@n · Answer

heu...pourquoi t'as pas laissé le boulot finir normalement ?

chdu57 · Answer

car j'avais programmé sur scanne rapide
je viens de le redémarrer en scanne complet , cela va durer au moins une heure

g3n-h@ckm@n · Answer

ok à te lire

chdu57 · Answer

rebonjour,
en mode sans echec cela fontionne, et j'efface mes les infections;
mais lorsque je redemarre en mode normal, a nouveau le meme ecran

g3n-h@ckm@n · Answer

Attention : cet outil peut etre détecté à tort comme virus

tous les processus "non vitaux de windows" vont être coupés , enregistre ton travail.

Désactive toutes tes protections si possible , antivirus , sandbox , etc....

telecharge et enregistre Pre_Scan sur ton bureau :

http://forums-fec.be/gen-hackman/Pre_Scan.exe
http://general-changelog-team.fr/fr/downloads/viewdownload/41-outils-de-gen-hackman/52-pre-scan

Avertissement :Il y aura une extinction du bureau pendant le scan --> pas de panique.

une fois telechargé lance-le , laisse faire le scan jusqu'à l'apparition de "Pre_scan_la_date_et_l'heure.txt" sur le bureau.

si l'outil est relancé plusieurs fois , il te proposera un menu et qu'aucune option n'est demandée, lance l'option "Kill"

si l'outil est bloqué par l'infection utilise cette version avec extension .pif :

http://forums-fec.be/gen-hackman/Pre_Scan.pif

si l'outil detecte un proxy et que tu n'en as pas installé clique sur "supprimer le proxy"

Il se peut qu'une multitude de fenêtres noires clignotent , laisse-le travailler

Poste Pre_Scan_la_date_et_l'heure.txt qui apparaitra sur le bureau en fin de scan


NE LE POSTE PAS SUR LE FORUM !!! (il est trop long)

Heberge le rapport sur http://pjjoint.malekal.com puis donne le lien obtenu en echange sur le forum où tu te fais aider

chdu57 · Answer

Puis je faire ceci en mode sans échec avec prise en charge du réseau ?

chdu57 · Answer

A chaque redemarrage, j'ai le virus ukash qui me demande de payer 100 euros

chdu57 · Answer

lorsque le lance gen hackman, j'ai une fenetre m indiquant
line 9340 [file"c:\USERS\CARLOS\DOWNLOADS\PRE_SCAN.PIF"]

g3n-h@ckm@n · Answer

re

supprime-le retelecharge-le 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

chdu57 · Answer

voila ça a fonctionné

http://pjjoint.malekal.com/files.php?id=20120725_d10b15p10e8d9

g3n-h@ckm@n · Answer

(je vais la virer cette CLSID , elle a rien à faire dans pre_scan...)

bref !!

si presents desinstalle :

* Ask.com/Asktoolbar
* Windows search qu toolbar
* Limewire Toolbar
* Ilivid 

================


@: à L'attention de ceux qui utilisent les switchs de Pre_script :
n'utiliser que les switchs proposés sur la page correspondante :
https://gen-hackman.kanak.fr/

================================

Clique sur ce lien : https://www.cjoint.com/?BGztSkTJfW5

Selectionne tout le texte qui s'y trouve CTRL+A puis CTRL+C ou clic droit/copier

Relance Pre_scan puis choisis l'option "Script"

une page va s'ouvrir

logiquement le texte que tu as sélectionné s'y trouve déjà , donc tu fermes et le programme va travailler.

sinon colle-le (clic droit/coller ou ctrl+V) dans la page vierge.

puis onglet fichier => enregistrer (pas enregistrer sous...) , puis ferme le texte

des fenetres noires risquent de clignoter , c'est normal , c'est le programme qui travaille 

poste Pre_Script.txt qui apparaitra sur le bureau en fin de travail

chdu57 · Answer

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Script | 2.725 ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

carlos : Windows Vista (TM) Home Premium (32 bits)

Switchs : https://gen-hackman.kanak.fr/

Script : 22:24:18

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤¤¤¤¤¤ | Deletion | Drivers | Services

Service : ASWFSBLK Not actif
Service : ASWMONFLT Not actif
Service : ASWRDR Not actif
Service : ASWSP Not actif
Service : ASWTDI Not actif
Service : KWTDIUOB Not actif

Deleted : [HKLM\..\CCS\..\Root\LEGACY_ASWFSBLK]
Deleted : [HKLM\..\CS001\..\Root\LEGACY_ASWFSBLK]
Not Deleted : [HKLM\..\CS002\..\Root\LEGACY_ASWFSBLK]
Deleted : [HKLM\..\CS003\..\Root\LEGACY_ASWFSBLK]
Deleted : [HKLM\..\CCS\..\Root\LEGACY_ASWMONFLT]
Deleted : [HKLM\..\CS001\..\Root\LEGACY_ASWMONFLT]
Not Deleted : [HKLM\..\CS002\..\Root\LEGACY_ASWMONFLT]
Deleted : [HKLM\..\CS003\..\Root\LEGACY_ASWMONFLT]
Deleted : [HKLM\..\CCS\..\Root\LEGACY_ASWRDR]
Deleted : [HKLM\..\CS001\..\Root\LEGACY_ASWRDR]
Not Deleted : [HKLM\..\CS002\..\Root\LEGACY_ASWRDR]
Deleted : [HKLM\..\CS003\..\Root\LEGACY_ASWRDR]
Deleted : [HKLM\..\CCS\..\Root\LEGACY_ASWSP]
Deleted : [HKLM\..\CS001\..\Root\LEGACY_ASWSP]
Not Deleted : [HKLM\..\CS002\..\Root\LEGACY_ASWSP]
Deleted : [HKLM\..\CS003\..\Root\LEGACY_ASWSP]
Deleted : [HKLM\..\CCS\..\Root\LEGACY_ASWTDI]
Deleted : [HKLM\..\CS001\..\Root\LEGACY_ASWTDI]
Not Deleted : [HKLM\..\CS002\..\Root\LEGACY_ASWTDI]
Deleted : [HKLM\..\CS003\..\Root\LEGACY_ASWTDI]
Deleted : [HKLM\..\CCS\..\Root\LEGACY_KWTDIUOB]
Deleted : [HKLM\..\CS001\..\Root\LEGACY_KWTDIUOB]
Not Deleted : [HKLM\..\CS002\..\Root\LEGACY_KWTDIUOB]
Deleted : [HKLM\..\CS003\..\Root\LEGACY_KWTDIUOB]


¤

¤¤¤¤¤¤¤¤¤¤ | Registry Deletions

Key Deleted : HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Adobe Reader Speed Launcher
Value Deleted : [HKU\S-1-5-21-4143669811-1624170986-1111897154-1000\Software\Microsoft\Internet Explorer\URLSearchHooks]:{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Value Deleted : [HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Value Deleted : [HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{D4027C7F-154A-4066-A1AD-4243D8127440}
Value Deleted : [HKLM\Software\Microsoft\Internet Explorer\Toolbar]:{99079a25-328f-4bd4-be04-00955acaa0a7}
Key Deleted : HKU\S-1-5-21-4143669811-1624170986-1111897154-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}
Key Deleted : HKU\S-1-5-21-4143669811-1624170986-1111897154-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}
Key Deleted : HKU\S-1-5-21-4143669811-1624170986-1111897154-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
Key Deleted : HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}   
Key Deleted : HKU\S-1-5-21-4143669811-1624170986-1111897154-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4becf16c-74f0-429b-8d3e-4fba507ac661}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A678196-4396-4BA6-883E-9EAC91820163}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95a4104c-1c49-4c2a-9830-1be0f47e926c}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9da1d2cb-796d-4bec-bbaa-0aa9ccd80e15}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{e5f90a07-7db7-4dcb-bd6d-d3fecd376ca3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fb9e068b-c612-4fa8-bdb9-d728a716a420}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}  
Key Deleted : HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
Key Deleted : HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}    
Key Deleted : HKU\S-1-5-21-4143669811-1624170986-1111897154-1000\Software\Ask.com    
Key Deleted : HKU\S-1-5-21-4143669811-1624170986-1111897154-1000\Software\Datamngr    
Key Deleted : HKU\S-1-5-21-4143669811-1624170986-1111897154-1000\Software\Safer Networking Limited
Key Deleted : HKU\S-1-5-21-4143669811-1624170986-1111897154-1000\Software\SweetIM    
Key Deleted : HKLM\Software\BrowserChoice    
Key Deleted : HKLM\Software\OTMoveIt    
Key Deleted : HKLM\Software\SweetIM    
Value Deleted : [HKLM\SOFTWARE\Microsoft\Security Center\Monitoring]:DisableMonitoring

¤

Folder Deleted : |D| - C:\Users\carlos\AppData\Roaming\Mozilla\Firefox\Profiles\uevvjxtf.default\extensions	oolbar@ask.com
Folder Deleted : |D| - C:\Users\carlos\AppData\Roaming\Mozilla\Firefox\Profiles\uevvjxtf.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
File Deleted :  |A| - C:\Program Files\Mozilla Firefox\searchplugins\Search_Results.xml 
File Deleted :  |A| - C:\Users\carlos\AppData\Roaming\Mozilla\Firefox\Profiles\uevvjxtf.default\searchplugins\askcom.xml     
File Deleted :  |A| - C:\Users\carlos\AppData\Roaming\Mozilla\Firefox\Profiles\uevvjxtf.default\searchplugins\Search_Results.xml 
File Deleted :  |A| - C:\Users\carlos\AppData\Roaming\Mozilla\Firefox\Profiles\uevvjxtf.default\searchplugins\sweetim.xml     
C:\PROGRA~1\BEARSH~1\MediaBar : Not Found !
File Deleted :  |A| - C:\-20070710.log 
Folder Deleted : |D| - C:\6a50ca35d957bc8d8360a0 
Folder Deleted : |D| - C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
C:\Users\carlos\Downloads\iLividSetupV1.exe : Not Found !
File Deleted :  |A| - C:\Users\carlos\Downloads\iMeshV11fr.exe
File Deleted :  |A| - C:\Users\carlos\Downloads\installer_adobe_reader_French.exe 
File Deleted :  |A| - C:\Users\carlos\Downloads\installer_flash_player_French(2).exe 
File Deleted :  |A| - C:\Users\carlos\Downloads\installer_flash_player_French.exe 
File Deleted :  |A| - C:\Users\carlos\Downloads\install_flash_player(2).exe 
File Deleted :  |A| - C:\Users\carlos\Downloads\install_flash_player(3).exe 
File Deleted :  |A| - C:\Users\carlos\Downloads\install_flash_player.exe
File Deleted :  |A| - C:\Users\carlos\Downloads\_PWZ7456.tmp 
File Deleted :  |A| - C:\Users\carlos\AppData\Roaming\-332889227 
Folder Deleted : |D| - C:\Users\carlos\AppData\Roaming\Syxu 
Folder Deleted : |D| - C:\Users\carlos\AppData\Roaming\Uzma 
Folder Deleted : |D| - C:\ProgramData\036DFF980386F8A4BC0B0B9A6C44B161 
Folder Deleted : |D| - C:\ProgramData\gzwuzhfmxqiwyfg 
File Deleted :  |A| - C:\ProgramData
rspsmdrpdrbxco 
Folder Deleted : |D| - C:\Users\carlos\AppData\Local\Ilivid Player     
Folder Deleted : |D| - C:\Program Files\Ask.com     
  : Not Found !

¤¤¤¤¤¤¤¤¤¤ | MBR

Windows Version:		Windows Vista Home Premium Edition
Windows Information:		Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer:	Acer
BIOS Manufacturer:		Phoenix Technologies, LTD
System Manufacturer:		Acer
System Product Name:		Aspire M1610
Logical Drives Mask:		0x000003fc

Analysis of file "C:\Pre_Scan\MBR.bin":
Unknown MBR code

¤


¤¤¤¤¤¤¤¤¤¤ | Nettoyage disque

Nettoyage du disque effectué

¤


Fin : 22:27:54

¤¤¤¤¤¤¤¤¤¤ ( EOF ) ¤¤¤¤¤¤¤¤¤¤

chdu57 · Answer

lorsque je démarre le pc mon antivirus avira m'indique directement un problème

" dans le fichier
C:\windows\system32\services.exe, un virus ou programme indésirable
W32/patched.UB à été trouvé

g3n-h@ckm@n · Answer

/!\ ATTENTION SUIVRE A LA LETTRE CES INDICATIONS/!\ __________________________________________________________ >Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.< >>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<< ===================================================== ▶ Surtout , à l'enregistrement change le nom de Combofix en "cequetuveux" avant qu'il soit enregistré sur ton disque dur clique droit sur ce lien : Combofix =>enregistrer la cible sous....=> sur ton bureau => du nom que tu veux Avant d'utiliser ComboFix : Si tu utilises AVG, IL FAUT IMPERATIVEMENT LE DESINSTALLER avant d'utiliser Combofix car il peut causer des dégâts en interaction avec l'outil pouvant mener à la réinstallation totale du système. La simple désactivation du résident n'est pas suffisante. Télécharge le désinstalleur d'AVG sur ce lien : https://www.avg.com/fr-fr/avg-remover Choisis la version adéquate (32 ou 64 bits)/!\ Les logiciels d'émulation de CD comme Daemon Tools peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement : ▶ Télécharge Defogger (de jpshortstuff) sur ton Bureau ▶ Lance le Une fenêtre apparait : clique sur "Disable" ▶ Fais redémarrer l'ordinateur si l'outil te le demande Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable" _________________________________________________________ >> referme les fenêtres de tous les programmes en cours. >> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, >>la protection en temps réel de ton Antivirus et de tes Antispywares, >>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°° si tu as XP => double clique si tu as Vista ou windows 7 => clic droit "executer en tant que...." sur combofix renommé ¤¤¤¤¤¤¤¤¤¤ LAISSE-LE INSTALLER LA CONSOLE DE RECUPERATION S'IL TE LE DEMANDE ¤¤¤¤¤¤¤¤¤¤ ▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!! ▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. ▶▶ Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message. ▶▶▶ Si, après le redémarrage de votre pc par combofix, vous avez des erreurs "Clé marquée pour suppression" ou des soucis de connexion internet, redémarrez à nouveau votre ordinateur

chdu57 · Answer

J'ai le message
scanneurs en tant reel actifs

antivirus :antivir desktop
antispyware : antivir desktop

comment faire pour les désactiver svp

g3n-h@ckm@n · Answer

bah tu cliques droit dans la barre des taches et tu selectionnes 'desactiver le guard'

chdu57 · Answer

c ce que je fais mais lorsque je lance combofix il me dis qu'il detecte encore antivir actif

g3n-h@ckm@n · Answer

passe outre

chdu57 · Answer

ComboFix 12-07-26.04 - carlos 26/07/2012   0:43.1.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium   6.0.6001.1.1252.33.1036.18.2047.1305 [GMT 2:00]
Lancé depuis: c:\users\carlos\Desktop\ComboFix.exe
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Une copie infectée de c:\windows\system32\Services.exe a été trouvée et désinfectée 
Copie restaurée à partir de - c:\windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe 
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2012-06-25 au 2012-07-25  ))))))))))))))))))))))))))))))))))))
.
.
2012-07-25 22:50 . 2012-07-25 22:53	--------	d-----w-	c:\users\carlos\AppData\Local	emp
2012-07-25 22:50 . 2012-07-25 22:50	--------	d-----w-	c:\users\Public\AppData\Local	emp
2012-07-25 22:50 . 2012-07-25 22:50	--------	d-----w-	c:\users\Default\AppData\Local	emp
2012-07-25 06:16 . 2012-07-25 20:27	--------	d-----w-	C:\Pre_Scan
2012-07-24 15:19 . 2012-07-24 17:27	--------	d-----w-	c:\users\carlos\AppData\Roaming\hellomoto
2012-07-20 11:12 . 2012-06-29 08:44	6891424	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{DD667FEA-C2B4-43D5-98EC-022D20FFBB16}\mpengine.dll
2012-07-16 21:20 . 2012-07-16 21:20	--------	d-----w-	c:\programdata\WindowsSearch
.
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-03 11:46 . 2011-04-28 21:43	22344	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-05-31 10:25 . 2009-10-03 06:48	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-07-19 14:07 . 2012-03-04 08:22	136672	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"UacDisableNotify"= 0 (0x0)
"EnablELUA"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
backup=c:\windows\pss\hpoddt01.exe.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk]
backup=c:\windows\pss\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^carlos^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
backup=c:\windows\pss\OpenOffice.org 2.4.lnk.Startup
backupExtension=.Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Default Manager]
2010-05-10 12:12	439568	----a-w-	c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-16 20:12	3872080	----a-w-	c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-06-20 08:56	4493312	----a-w-	c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2008-01-19 07:33	1233920	----a-w-	c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-06-15 08:45	1826816	----a-w-	c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-01-25 13:41	39408	----a-w-	c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZNsoft Optimizer Xp]
2006-06-23 11:50	393216	----a-w-	c:\program files\ZNsoft Corporation\ZNsoft Optimizer Xp\ZNsoft Xp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun-disabled]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Acer Tour Reminder"=c:\acer\AcerTour\Reminder.exe
"Windows Mobile-based device management"=%windir%\WindowsMobile\wmdSync.exe
"WarReg_PopUp"=c:\acer\WR_PopUp\WarReg_PopUp.exe
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
"PCMMediaSharing"=c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
"eDataSecurity Loader"=c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe
"Acer Empowering Technology Monitor"=c:\acer\Empowering Technology\SysMonitor.exe
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
S0 Achernar;Achernar - SCSI Command Filter Drivers;c:\windows\System32\Drivers\Achernar.sys [x]
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]
S2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
.
.
--- Autres Services/Pilotes en mémoire ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
Contenu du dossier 'Tâches planifiées'
.
2012-07-25 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-11-22 19:06]
.
2012-07-25 c:\windows\Tasks\User_Feed_Synchronization-{7A3DCD9E-D22D-40C6-820E-8B259BC4BE14}.job
- c:\windows\system32\msfeedssync.exe [2011-06-15 04:32]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Rechercher sur le Web - c:\program files\SweetIM\Toolbars\Internet Exploreresources\menuext.html
TCP: DhcpNameServer = 212.27.40.240 212.27.40.241
FF - ProfilePath - c:\users\carlos\AppData\Roaming\Mozilla\Firefox\Profiles\uevvjxtf.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://mail.aol.com/36396-111/aol-6/fr-fr/Suite.aspx|https://www.bienvenue.saxo/fr-fr/welcome/binckbank?seg=binck&refpage=/fr/Login.aspx
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHELINS SUPPRIMES - - - -
.
Toolbar-10 - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
SafeBoot-dmboot.sys
SafeBoot-dmio.sys
SafeBoot-dmload.sys
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-07-26 00:54
Windows 6.0.6001 Service Pack 1 NTFS
.
Recherche de processus cachés ... 
.
Recherche d'éléments en démarrage automatique cachés ... 
.
Recherche de fichiers cachés ... 
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\windows\system32\conime.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\sdclt.exe
.
**************************************************************************
.
Heure de fin: 2012-07-26  01:26:27 - La machine a redémarré
ComboFix-quarantined-files.txt  2012-07-25 23:26
.
Avant-CF: 23 466 610 688 octets libres
Après-CF: 23 305 547 776 octets libres
.
- - End Of File - - FA246D054CAB746CC5D77D9602B0F2CB

g3n-h@ckm@n · Answer

desintalle Spybot search and destroy

supprime Pre_scan retelecharge-le puis refais un scan

chdu57 · Answer

je ne trouve pas Spybot search and destroy

g3n-h@ckm@n · Answer

pas grave la suite

chdu57 · Answer

lorsque j'allume le pc, il y a juste un ecran noir avec les message
verifying DMI pool data

a disk read error occurred
press CTRL + ALT + DEL to restart

chdu57 · Answer

Je viens donc d'effectuer cette opération et donc ensuite il commence a demarrer , un écran noir et la depuis 5 minute mais rien

g3n-h@ckm@n · Answer

t'as pas une clé usb branchée ou un cd dans le lecteur ?

chdu57 · Answer

voila j'ai enlevé un cd de musique du lecteur

chdu57 · Answer

le seul usb branché c'est la clef wifi

g3n-h@ckm@n · Answer

ok il a redemarré ?

chdu57 · Answer

toujours le meme ecran noir

g3n-h@ckm@n · Answer

redemarre avec "derniere bonne configuration connue"

chdu57 · Answer

comment faire

chdu57 · Answer

sa y est c'est en cours de redemarrage avec la derniere bonne configuration connue

chdu57 · Answer

l'ecran reste noir, je vois juste ou se situe la souris avec la fleche sur l ecran

chdu57 · Answer

c en cours

chdu57 · Answer

il vient de finir de tout télécharger et lors du redemarrage c'est a nouveau un écran tout noir

chdu57 · Answer

l ecran reste desesperemment noir

g3n-h@ckm@n · Answer

ok va falloir passer par un live cd...

suis ce tuto :

https://gen-hackman.kanak.fr/

chdu57 · Answer

je ne peux pas j'ai un simple ecran noir sur le pc

g3n-h@ckm@n · Answer

comment tu fais pour me parler ? 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ 
Softonic , 01Net , Telecharger.com => ils pourrissent les programmes !!

chdu57 · Answer

avec mon 2eme pc portable

g3n-h@ckm@n · Answer

ben voilà t'as trouvé avec quoi faire le live cd :)

chdu57 · Answer

l ecran a changer il y a une une erreur de récupération
maintenant il vient de passer en mode de récupération recommandé
a nouveau un écran noir

chdu57 · Answer

mon pc avec probleme est un vista
celui ci est un xp et il n'a pas de lecteur cd

g3n-h@ckm@n · Answer

pas grave en usb

https://gen-hackman.kanak.fr/

chdu57 · Answer

bonsoir,
lorsque je met la clef usb dans le pc malade et que j'essaie de redemarré celui ci, il essai de redemarré en mode normal, le menu SARDU n'apparait pas
il n'y a qu'une page noire à la place du bureau

pour info sur la clef tu m'a fais téléchargé win 7 .
mon pc est un vista
ne serait ce pas cela le probleme.

que puis je faire a nouveau

merci

chdu57 · Answer

Bbonjour,

le pc vient de démarrer et je suis sur mon bureau
normal jusque la
cependant le menu sardu ne s'est pas ouvert

qu'est ce que je fais ensuite STP

g3n-h@ckm@n · Answer

je pense qut tu t'y prends mal et que tu selectionnes pas la clé dans le bios ou que tu memorises pas avec F10

chdu57 · Answer

le dossier sardu ne fait pas 390 MB mais 330,26 mb
est ce normal

g3n-h@ckm@n · Answer

ôui je l'ai allégé ces dernier temps :) des outils n'étaient pas fonctionnels je les ai retirés 
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

chdu57 · Answer

je suis dans les parametre du bios
dois je selectionner boot other device
car je ne vois rien marquer usb

g3n-h@ckm@n · Answer

oui

chdu57 · Answer

que dois je chosir
ls 120
zip 100
usb fdd
usb zip
usb cd rom
lan

chdu57 · Answer

juste au dessus de la ligne 
first boot device

j'ai une ligne 

hard disk boot priority

si je clique dessus, je peux choisir

1. ch2  : hitachi HDS721616PLA38
2. USB-HDD0 : MYSON CS8819A2-108
3. BOOTABLE ADD-IN CARDS

merci de me dire pas a pas ce que je dois faire

g3n-h@ckm@n · Answer

USB-HDD0 : MYSON CS8819A2-108

chdu57 · Answer

il ne m'as toujours pas ouvert le menu sardu
il a redemarré normalement

g3n-h@ckm@n · Answer

alors je sais pas ce que tu as fait

chdu57 · Answer

maintenant que le pc malade refonctionne et que j'ai accès a internet dessus, y a t il un autre moyen pour faire cette opération sans avoir a utiliser la clefs usb ?

g3n-h@ckm@n · Answer

ok repasse ca :

http://forums-fec.be/gen-hackman/Pre_Scan.exe

chdu57 · Answer

a chaque fois que je lance 
http://forums-fec.be/gen-hackman/Pre_Scan.exe

j'ai le message

windows a rencontre un problème et fermera le programme dans 1 minute

g3n-h@ckm@n · Answer

/!\ ATTENTION SUIVRE A LA LETTRE CES INDICATIONS/!\ __________________________________________________________ >Ce logiciel n'est à utiliser que prescrit par un helper qualifié et formé à l'outil.< >>>>>>>Ne pas utiliser en dehors de ce cas de figure : dangereux!<<<<<<<< ===================================================== ▶ Surtout , à l'enregistrement change le nom de Combofix en "cequetuveux" avant qu'il soit enregistré sur ton disque dur clique droit sur ce lien : Combofix =>enregistrer la cible sous....=> sur ton bureau => du nom que tu veux Avant d'utiliser ComboFix : Si tu utilises AVG, IL FAUT IMPERATIVEMENT LE DESINSTALLER avant d'utiliser Combofix car il peut causer des dégâts en interaction avec l'outil pouvant mener à la réinstallation totale du système. La simple désactivation du résident n'est pas suffisante. Télécharge le désinstalleur d'AVG sur ce lien : https://www.avg.com/fr-fr/avg-remover Choisis la version adéquate (32 ou 64 bits)/!\ Les logiciels d'émulation de CD comme Daemon Tools peuvent gêner les outils de désinfection. Utilise Defogger pour les désactiver temporairement : ▶ Télécharge Defogger (de jpshortstuff) sur ton Bureau ▶ Lance le Une fenêtre apparait : clique sur "Disable" ▶ Fais redémarrer l'ordinateur si l'outil te le demande Note : Quand nous aurons terminé la désinfection, tu pourras réactiver ces logiciels en relançant Defogger et en cliquant sur "Re-enable" _________________________________________________________ >> referme les fenêtres de tous les programmes en cours. >> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, >>la protection en temps réel de ton Antivirus et de tes Antispywares, >>qui peuvent gêner fortement la procédure de recherche et de nettoyage de l'outil. °°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°° si tu as XP => double clique si tu as Vista ou windows 7 => clic droit "executer en tant que...." sur combofix renommé ¤¤¤¤¤¤¤¤¤¤ LAISSE-LE INSTALLER LA CONSOLE DE RECUPERATION S'IL TE LE DEMANDE ¤¤¤¤¤¤¤¤¤¤ ▶ !!!!!NE TOUCHE A RIEN PENDANT LE TRAVAIL DE COMBOFIX (SOURIS/CLAVIER.....)!!!!! ▶ n'oublie pas de reactiver la garde de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. ▶▶ Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message. ▶▶▶ Si, après le redémarrage de votre pc par combofix, vous avez des erreurs "Clé marquée pour suppression" ou des soucis de connexion internet, redémarrez à nouveau votre ordinateur

chdu57 · Answer

ComboFix 12-07-29.02 - carlos 30/07/2012   1:55.2.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium   6.0.6001.1.1252.33.1036.18.2047.1151 [GMT 2:00]
Lancé depuis: c:\users\carlos\Desktop\NETT.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Un nouveau point de restauration a été créé
.
.
((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\autorun.ini
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32oboot.exe
.
.
(((((((((((((((((((((((((((((   Fichiers créés du 2012-06-28 au 2012-07-30  ))))))))))))))))))))))))))))))))))))
.
.
2012-07-30 00:03 . 2012-07-30 00:04	--------	d-----w-	c:\users\carlos\AppData\Local	emp
2012-07-30 00:03 . 2012-07-30 00:03	--------	d-----w-	c:\users\Public\AppData\Local	emp
2012-07-30 00:03 . 2012-07-30 00:03	--------	d-----w-	c:\users\Default\AppData\Local	emp
2012-07-25 06:16 . 2012-07-29 23:44	--------	d-----w-	C:\Pre_Scan
2012-07-24 15:19 . 2012-07-24 17:27	--------	d-----w-	c:\users\carlos\AppData\Roaming\hellomoto
2012-07-20 11:12 . 2012-06-29 08:44	6891424	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{DD667FEA-C2B4-43D5-98EC-022D20FFBB16}\mpengine.dll
2012-07-16 21:20 . 2012-07-16 21:20	--------	d-----w-	c:\programdata\WindowsSearch
.
.
.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-03 11:46 . 2011-04-28 21:43	22344	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-05-31 10:25 . 2009-10-03 06:48	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-07-19 14:07 . 2012-03-04 08:22	136672	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"UacDisableNotify"= 0 (0x0)
"EnablELUA"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
backup=c:\windows\pss\hpoddt01.exe.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk]
backup=c:\windows\pss\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^carlos^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk]
backup=c:\windows\pss\OpenOffice.org 2.4.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Default Manager]
2010-05-10 12:12	439568	----a-w-	c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2010-04-16 20:12	3872080	----a-w-	c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]
2007-06-20 08:56	4493312	----a-w-	c:\windows\RtHDVCpl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2008-01-19 07:33	1233920	----a-w-	c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-06-15 08:45	1826816	----a-w-	c:\windows\SkyTel.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-01-25 13:41	39408	----a-w-	c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZNsoft Optimizer Xp]
2006-06-23 11:50	393216	----a-w-	c:\program files\ZNsoft Corporation\ZNsoft Optimizer Xp\ZNsoft Xp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun-disabled]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Acer Tour Reminder"=c:\acer\AcerTour\Reminder.exe
"Windows Mobile-based device management"=%windir%\WindowsMobile\wmdSync.exe
"WarReg_PopUp"=c:\acer\WR_PopUp\WarReg_PopUp.exe
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
"PCMMediaSharing"=c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
"eDataSecurity Loader"=c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe
"Acer Empowering Technology Monitor"=c:\acer\Empowering Technology\SysMonitor.exe
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
S0 Achernar;Achernar - SCSI Command Filter Drivers;c:\windows\System32\Drivers\Achernar.sys [x]
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]
S2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;c:\program files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
Contenu du dossier 'Tâches planifiées'
.
2012-07-29 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-11-22 19:06]
.
2012-07-30 c:\windows\Tasks\User_Feed_Synchronization-{7A3DCD9E-D22D-40C6-820E-8B259BC4BE14}.job
- c:\windows\system32\msfeedssync.exe [2011-06-15 04:32]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Rechercher sur le Web - c:\program files\SweetIM\Toolbars\Internet Exploreresources\menuext.html
TCP: DhcpNameServer = 212.27.40.240 212.27.40.241
FF - ProfilePath - c:\users\carlos\AppData\Roaming\Mozilla\Firefox\Profiles\uevvjxtf.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://mail.aol.com/36396-111/aol-6/fr-fr/Suite.aspx|https://www.bienvenue.saxo/fr-fr/welcome/binckbank?seg=binck&refpage=/fr/Login.aspx
FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-07-30 02:03
Windows 6.0.6001 Service Pack 1 NTFS
.
Recherche de processus cachés ... 
.
Recherche d'éléments en démarrage automatique cachés ... 
.
Recherche de fichiers cachés ... 
.
Scan terminé avec succès
Fichiers cachés: 0
.
**************************************************************************
.
Heure de fin: 2012-07-30  02:32:45
ComboFix-quarantined-files.txt  2012-07-30 00:32
.
Avant-CF: 33 781 620 736 octets libres
Après-CF: 33 750 994 944 octets libres
.
- - End Of File - - 973B017B2511E07C226471FE63DC1EBB

g3n-h@ckm@n · Answer

fermer toutes les fenêtres et applications lors de l'installation et de l'analyse.


&#9654 Télécharge ici :

Malwarebytes  

&#9654 Installe le ( choisis bien "francais" ; ne modifie pas les paramètres d'installe ) et mets le à jour .

relance malwarebytes en suivant scrupuleusement ces consignes :

! Déconnecte toi et ferme toutes applications en cours !

&#9654 Lance Malwarebyte's .

Fais un examen dit "Complet" .

&#9654 Laisse le programme travailler ( et ne rien faire d'autre avec le PC durant le scan ).
&#9654 à la fin tu cliques sur "résultat" .
&#9654 Vérifie que tous les objets infectés soient validés, puis clique sur " suppression " .

&#9654 Note : si il faut redémarrer ton PC pour finir le nettoyage, fais le !


&#9654 Poste le rapport sauvegardé après la suppression des objets infectés (dans l'onglet "rapport/log"de Malwarebytes, le dernier en date)

chdu57 · Answer

je suis entrain de faire le scan malwarebytes
pendant cette opération antivir me prévient que je suis affecté par 
win32/PATCHED.UB

chdu57 · Answer

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Version de la base de données: v2012.07.30.04

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 8.0.6001.19088
carlos :: PC-DE-CARLOS [administrateur]

30/07/2012 09:55:01
mbam-log-2012-07-30 (09-55-01).txt

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Options d'examen activées: Mémoire | Démarrage | Registre | Système de fichiers | Heuristique/Extra | Heuristique/Shuriken | PUP | PUM
Options d'examen désactivées: P2P
Elément(s) analysé(s): 308196
Temps écoulé: 1 heure(s), 5 minute(s), 3 seconde(s)

Processus mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Module(s) mémoire détecté(s): 0
(Aucun élément nuisible détecté)

Clé(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Valeur(s) du Registre détectée(s): 0
(Aucun élément nuisible détecté)

Elément(s) de données du Registre détecté(s): 0
(Aucun élément nuisible détecté)

Dossier(s) détecté(s): 0
(Aucun élément nuisible détecté)

Fichier(s) détecté(s): 2
C:\Users\carlos\Desktop\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Mis en quarantaine et supprimé avec succès.
C:\Users\carlos\Downloads\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Mis en quarantaine et supprimé avec succès.

(fin)

g3n-h@ckm@n · Answer

une question :

tu fais quoi avec le pc pendant la desinfection ?

chdu57 · Answer

rien du tout
c'est l'antivirus qui surveille en continu et qui detecte sa

Clemsouuu · Answer

As tu essayé d'arreter le processus explorer.exe ? (Ctrl + alt + supr )Deja regarde si il est dans la liste. 

Pour cela fait en mode sans echec 

Ctrl + app + suppr 

Ensuite une fenetre s'ouvre et va dans l'onglet processus. 
Regarde si un processus se nomme explorer.exe
Si il existe (normalement oui) clique dessus et clique sur terminer le processus en dessous de la liste.
Dis moi tes observations.

chdu57 · Answer

je viens de réaliser l'opération
ma barre de tache sous le bureau a disparue
à la place il y a juste un bandeau bleu

chdu57 · Answer

mon bureau aussi a disparu
il y a juste une page bleue

g3n-h@ckm@n · Answer

y'a ecrit quoi sur la page bleue ?

chdu57 · Answer

il y a juste la marque du pc écrit   ACER

g3n-h@ckm@n · Answer

ok tu as dit :

pendant cette opération antivir me prévient que je suis affecté par
win32/PATCHED.UB

à quel endroit ?

chdu57 · Answer

c'est une fenetre qui s'ouvre d'antivir et qui m'indique sa
ensuite il me demande si je ve le bloquer et l effacer
je repond oui, il me dis que c'est b on et dès que je rallume le pc sa revient


si je lance un scan complet avec mon antivirus ANTIVIR, il le retouve et le bloque a nouveau

g3n-h@ckm@n · Answer

ca repond pas à ma question

chdu57 · Answer

la fenetre s'ouvre a n importe quel moment pour me dire q'il y  a un programme indésirable
que je sois sur le net ou entrain de d utiliser tes programmes de désinfection mon antivirus scanne et m'indique sa dès qu'il y a une attaque

g3n-h@ckm@n · Answer

ca ne reponds pas à ma question

chdu57 · Answer

quelle est ta question

chdu57 · Answer

tu me demande a quel moment apparait le fait qu'un programme malveillant est détecté

je répond qu'il arrive a n'importe qu'elle moment
une fenetre d'antivir qui est mon antivirus m'indique un programme malveillant qui est WIN32/PATCHED.UB

cette fenetre s'ouvre que je sois entrain d'utiliser pre scan ou que je soit tout simplement sur internet

de plus chaque soir a 23H00
mon antvirus fait un scan complet de mon pc et il trouve ce fichier malveillant

g3n-h@ckm@n · Answer

non je te demande à quel endroit est detectée l infection

chdu57 · Answer

desolé mais je n'en ai aucune idée , rien ne me l'indique

chdu57 · Answer

bonsoir
je pense que le problème vient de

C:\qoobox\quarantine\C\windows\system32\services.exe.vir

g3n-h@ckm@n · Answer

alors c est bon fais le menage :

https://gen-hackman.kanak.fr/#1037

chdu57 · Answer

ok je te remerci du temps passé a m'aider
encore une fois un grand merci

g3n-h@ckm@n · Answer

fais bien tout le final c est important ^^

chdu57 · Answer

bonjour,
je reviens vers toi car mes problemes ont été résolus, cependant depuis tout ça , le petit ventilateur de la carte mère ne s'enclenche plus et mon pc chauffe et fini par se couper
y'a til un paramètre que nous avons touché et que je dois remodifier ?
merci

g3n-h@ckm@n · Answer

mmmm....;peut etre a-t-il grillé le ventilo......

non on a rien touché de ca......

chdu57 · Answer

comment puis je savoir s'il a grillé stp

g3n-h@ckm@n · Answer

ben faudrait le demonter et demander à un reparateur de te le verifier (je pense pas qu il te fasse payer pour ca)

chdu57 · Answer

ok merci

g3n-h@ckm@n · Answer

:)

chdu57 · Answer

rebonjour,

depuis que tu a pris le temps de résoudre mon probleme, je suis parti en vacances et a mon retour, g remarqué que plus aucune mise a jour ne se faisait

peux tu essayer de résoudre mon probleme 

merci

g3n-h@ckm@n · Answer

hello 

le service windows update est-il sur automatique et démarré ? 

(touche windows + R , puis tape : services.msc  )
  
¤¤¤¤¤¤¤¤¤¤ Pre_Scan_Concept ¤¤¤¤¤¤¤¤¤¤

chdu57 · Answer

j'ai le code erreur 80246008 lorsque je lance l'installation des mises a jour

cependant je n'ai pas la ligne  
Service de transfert intelligent en arrière plan ( BITS ) pour voir dans quel état elle est

g3n-h@ckm@n · Answer

dezippe ca et execute le fichier dedans puis redemarre le pc :

http://www.archive-host.com

chdu57 · Answer

merci cela refonctionne , les mises a jour sont entrai de s'installer

chdu57 · Answer

une mise a jour a été installé et pour la 2ème j'ai le code erreur
8007051A

g3n-h@ckm@n · Answer

c'est laquelle de mise à jour ?

chdu57 · Answer

le site microsoft vient de réglé le problème avec l'aide en ligne et elle a été installée

g3n-h@ckm@n · Answer

parfait :)

chdu57 · Answer

bonsoir, ce soir pour une mise a jour j'ai le message d'erreur

80070490
merci de m'aider

g3n-h@ckm@n · Answer

c'est laquelle de mise à jour ? fatiguant de poser  toujours les memes questions !!!

chdu57 · Answer

windows vista service pack 2

g3n-h@ckm@n · Answer

vois avec microsoft

chdu57 · Answer

avec microsoft je n'ai rien trouvé qui réussisse

g3n-h@ckm@n · Answer

essaie en le telechargeant manuellement sur le site de microsoft , en desactivant tes protections , puis en l'executant avec le clic droit "executer en tant qu'administrateur"

chdu57 · Answer

il me marque élément non trouvé
lorsque je vais sur le détail,
j'ai l'erreur 80070490

g3n-h@ckm@n · Answer

quand ca ?

chdu57 · Answer

lorsque j'essais de télécharger le sp2 de windows, juste au moment de l'installation

g3n-h@ckm@n · Answer

t'as pas une protection qui bloque ? sandbox ou autre ?

chdu57 · Answer

non même avec avira déconnecté, j'ai le même message

g3n-h@ckm@n · Answer

telecharge cet outil

http://kb.eset.com/library/ESET/KB%20Team%20Only/Malware/ServicesRepair.exe

lance-le

clique sur yes , puis encore sur yes , le pc va redemarrer

l'outil aura créé un dossier au meme endroit que l'outil du nom de : CC Support 

poste le rapport qui se trouve à l'interieur : CC Support\Logs\SvcRepair.txt

chdu57 · Answer

Log Opened: 2012-09-19 @ 07:17:24 07:17:24 - ----------------- 07:17:24 - | Begin Logging | 07:17:24 - ----------------- 07:17:24 - Fix started on a WIN_VISTA X86 computer 07:17:24 - Prep in progress. Please Wait. 07:17:27 - Prep complete 07:17:27 - Repairing Services Now. Please wait... INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\BFE.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\BITS.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\iphlpsvc.sddl' INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Le fichier spécifié est introuvable. INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\MpsSvc.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\SharedAccess.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\WinDefend.sddl' INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Le fichier spécifié est introuvable. INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\wscsvc.sddl' INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Le fichier spécifié est introuvable. INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\wuauserv.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. 07:17:29 - Services Repair Complete. 07:17:35 - Reboot Initiated Log Opened: 2012-09-19 @ 07:22:19 07:22:19 - ----------------- 07:22:19 - | Begin Logging | 07:22:19 - ----------------- 07:22:19 - Fix started on a WIN_VISTA X86 computer 07:22:19 - Prep in progress. Please Wait. 07:22:22 - Prep complete 07:22:22 - Repairing Services Now. Please wait... INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\BFE.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\BITS.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\iphlpsvc.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\MpsSvc.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\SharedAccess.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Accès refusé. INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Accès refusé. INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Accès refusé. INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Accès refusé. INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Accès refusé. INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Accès refusé. INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Accès refusé. INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Accès refusé. INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\WinDefend.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Accès refusé. INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\wscsvc.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: ERROR: Writing SD to failed with: Accès refusé. INFORMATION: Restoring SD of: SetACL finished successfully. INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore. INFORMATION: Input file for restore operation opened: '.\Vista\wuauserv.sddl' INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: INFORMATION: Restoring SD of: SetACL finished successfully. 07:22:23 - Services Repair Complete. 07:22:43 - Reboot Skipped

g3n-h@ckm@n · Answer

fallait faire redemarrer le pc pourquoi tu l'as zappé ?

chdu57 · Answer

Log Opened: 2012-09-19 @ 07:17:24
07:17:24 - -----------------
07:17:24 - | Begin Logging |
07:17:24 - -----------------
07:17:24 - Fix started on a WIN_VISTA X86 computer
07:17:24 - Prep in progress. Please Wait.
07:17:27 - Prep complete
07:17:27 - Repairing Services Now. Please wait...
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\BFE.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\SubLayer>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Provider>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\BITS.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Performance>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\iphlpsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Teredo>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\iphlpsvc\Teredo> failed with: Le fichier spécifié est introuvable.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Interfaces>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\config>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\MpsSvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\SharedAccess.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\WinDefend.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Security>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\WinDefend\Security> failed with: Le fichier spécifié est introuvable.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\wscsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Security>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\wscsvc\Security> failed with: Le fichier spécifié est introuvable.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\wuauserv.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv>

SetACL finished successfully.
07:17:29 - Services Repair Complete.
07:17:35 - Reboot Initiated
Log Opened: 2012-09-19 @ 07:22:19
07:22:19 - -----------------
07:22:19 - | Begin Logging |
07:22:19 - -----------------
07:22:19 - Fix started on a WIN_VISTA X86 computer
07:22:19 - Prep in progress. Please Wait.
07:22:22 - Prep complete
07:22:22 - Repairing Services Now. Please wait...
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\BFE.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\SubLayer>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Provider>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\BITS.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Performance>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\iphlpsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Interfaces>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\config>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\MpsSvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\SharedAccess.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\WinDefend.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Parameters>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\WinDefend\Parameters> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\wscsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Parameters>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\wscsvc\Parameters> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\wuauserv.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv>

SetACL finished successfully.
07:22:23 - Services Repair Complete.
07:22:43 - Reboot Skipped

chdu57 · Answer

je viens de le refaire 
je remet le text mais je pense qu'il y a aussi le 1er test qui est inclus dans la page

chdu57 · Answer

Log Opened: 2012-09-19 @ 07:17:24
07:17:24 - -----------------
07:17:24 - | Begin Logging |
07:17:24 - -----------------
07:17:24 - Fix started on a WIN_VISTA X86 computer
07:17:24 - Prep in progress. Please Wait.
07:17:27 - Prep complete
07:17:27 - Repairing Services Now. Please wait...
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\BFE.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\SubLayer>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Provider>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\BITS.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Performance>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\iphlpsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Teredo>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\iphlpsvc\Teredo> failed with: Le fichier spécifié est introuvable.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Interfaces>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\config>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\MpsSvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\SharedAccess.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\WinDefend.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Security>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\WinDefend\Security> failed with: Le fichier spécifié est introuvable.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\wscsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Security>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\wscsvc\Security> failed with: Le fichier spécifié est introuvable.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\wuauserv.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv>

SetACL finished successfully.
07:17:29 - Services Repair Complete.
07:17:35 - Reboot Initiated
Log Opened: 2012-09-19 @ 07:22:19
07:22:19 - -----------------
07:22:19 - | Begin Logging |
07:22:19 - -----------------
07:22:19 - Fix started on a WIN_VISTA X86 computer
07:22:19 - Prep in progress. Please Wait.
07:22:22 - Prep complete
07:22:22 - Repairing Services Now. Please wait...
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\BFE.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\SubLayer>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Provider>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\Persistent>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime\Filter>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy\BootTime>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters\Policy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BFE>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\BITS.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Performance>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\BITS>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\iphlpsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\Interfaces>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc\config>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\iphlpsvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\MpsSvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\Teredo>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters\PortKeywords>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\MpsSvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\SharedAccess.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Epoch>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\StandardProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\PublicProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile\Logging>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy\DomainProfile>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults\FirewallPolicy>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess\Defaults>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\SharedAccess>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\WinDefend.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend\Parameters>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\WinDefend\Parameters> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\WinDefend>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\wscsvc.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc\Parameters>
ERROR: Writing SD to <machine\System\CurrentControlset\Services\wscsvc\Parameters> failed with: Accès refusé.
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wscsvc>

SetACL finished successfully.
INFO: The restore action ignores the object name parameter (paths are read from the backup file). However, other actions that require the object name may be combined with -restore.
INFORMATION: Input file for restore operation opened: '.\Vista\wuauserv.sddl'
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Security>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv\Parameters>
INFORMATION: Restoring SD of: <machine\System\CurrentControlset\Services\wuauserv>

SetACL finished successfully.
07:22:23 - Services Repair Complete.
07:22:43 - Reboot Skipped

g3n-h@ckm@n · Answer

reessaie l'install du sp2

chdu57 · Answer

toujours le meme problème

g3n-h@ckm@n · Answer

pose la question à la section windows je ne vois plus quoi faire.....

donne leur le lien d'ici pour qu ils voient ce qui a été fait

Virus bloquant le bureau de mon pc

124 réponses

Votre réponse

Newsletters