Ordinateur Lent + Mises à jour désactivées Résolu

Question

Bonjour tout le monde je rencontres des problèmes depuis hier à savoir les mises à jour automatiques sont désactivées, pas moyen de les réactiver et mon ordinateur et subitement lent ainsi qu'internet....  Merci de m'aider

gen-hackman · Accepted Answer

bonjour deja commende par ceci :

> Télécharge DSS (Deckard's System Scanner de Deckard) sur ton Bureau : http://www.techsupportforum.com/sectools/Deckard/dss.exe
- Choisis <enregistrer> et <Bureau> pour l'emplacement.
- Ferme toutes les applications en cours (même internet). C'est important car sinon le PC peut planter.
- Double-clique sur dss.exe pour lancer l'outil.
- S'il ne trouve pas HijackThis, clique sur Oui.
- Clique sur OK à chaque fois que cela te sera demandé.
- Une fois l'analyse finie un rapport s'affichera. Poste son contenu dans ta réponse stp.
NB : Le rapport se trouve aussi ici : C:\Deckard\System Scanner\main.txt
PS : Si tu obtiens deux rapports (main.txt + extra.txt) alors poste les deux stp.
Attention : les rapports peuvent être long donc envoie chacun d'eux dans un poste différent (sinon il risque de manquer la fin).

Après avoir poster le ou les rapport(s) DSS, fais ceci aussi :

> Télécharge SDFix sur ton bureau
- Double clique sur l'archive SDFix qui à été créé sur le Bureau et installe le programme (l'installation va créer un dossier (à la racine du disque dur par défaut) nommé SDFix).

> Démarre en mode sans échec (impératif) : (image) Si problème : tuto ici.
- Vas dans c:/SDFix et double-clique sur RunThis.bat
- Appuie sur < Y > puis < Entrée >....Le nettoyage commance....patience...
- Le programme va te demander de relancer le PC, frappe une touche...
- Le nettoyage se termine...un rapport apparait...
-Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse

Gohantanemoub · Answer

Salut merci de m'aider mais le problème c'est que le mode sans échec ne marche pas chez moi je crois... d'ailleurs il n'a jamais marcher =D enfaite je fais F8 je choisis le mode sans echec y a marqué le message " Press Esc To .... " après un trait blanc qui clignote sur fond noir puis plus rien :/

Gohantanemoub · Answer

Voici les rapports : 

1 er rapport : 

Deckard's System Scanner v20071014.68
Run by Hitsugaya Byakuya on 2008-05-14 13:22:29
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
34: 2008-05-14 11:22:54 UTC - RP34 - Deckard's System Scanner Restore Point
33: 2008-05-14 10:53:56 UTC - RP33 - BricoPack Automatic Restore Point
32: 2008-05-13 21:49:48 UTC - RP32 - Installé Opera 9.27
31: 2008-05-13 21:48:10 UTC - RP31 - Installé Ad-Aware 2007
30: 2008-05-13 21:42:50 UTC - RP30 - Supprimé Ad-Aware 2008


-- First Restore Point -- 
1: 2008-05-13 21:24:12 UTC - RP1 - Point de vérification système


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Hitsugaya Byakuya.exe) -----------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:24:01, on 14/05/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe
C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\_avgas.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Fichiers communs\G DATA\AVKProxy\AVKProxy.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Documents and Settings\Hitsugaya Byakuya\Bureau\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Hitsugaya Byakuya.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {ED36ADAB-93A6-4DE8-A6A2-7C72ACE5C2FA} - C:\WINDOWS\system32\xxyaxYpm.dll
O2 - BHO: (no name) - {F1B2B165-FBF2-4EB3-98FF-9CF5506062B5} - C:\WINDOWS\system32\iifebbaX.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\_avgas.exe" /minimized
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\system32\msconfig.exe /auto
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\pacsteamt\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [PackNoVs] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\pack-it.exe" --unsetvs
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - Winlogon Notify: iifebbaX - C:\WINDOWS\SYSTEM32\iifebbaX.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Fichiers communs\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: G DATA Scheduler (AVKService) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe
O23 - Service: Gardien d'AntiVirus (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

Gohantanemoub · Answer

Extra.txt : 

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Édition familiale (build 2600) SP 3.0
Architecture: X86; Language: French

CPU 0: Intel(R) Pentium(R) 4 CPU 2.93GHz
Percentage of Memory in Use: 60%
Physical Memory (total/avail): 1023.3 MiB / 404.79 MiB
Pagefile Memory (total/avail): 2460.04 MiB / 1916.69 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1923.76 MiB

C: is Fixed (NTFS) - 186.31 GiB total, 162.21 GiB free. 
E: is Removable (No Media)
F: is Removable (No Media)
G: is Removable (No Media)
H: is Removable (No Media)
J: is Fixed (NTFS) - 107.83 GiB total, 80.89 GiB free. 
K: is CDROM (No Media)
L: is CDROM (No Media)
M: is Fixed (FAT32) - 100.15 GiB total, 100.07 GiB free. 
N: is CDROM (No Media)
P: is CDROM (No Media)
R: is CDROM (No Media)
S: is Fixed (NTFS) - 257.73 GiB total, 198.86 GiB free. 
T: is CDROM (No Media)
Z: is CDROM (No Media)

\.\PHYSICALDRIVE0 - Maxtor 6B200M0 - 186.31 GiB - 1 partition
  \PARTITION0 (bootable) - Système de fichiers installable - 186.31 GiB - C:

\.\PHYSICALDRIVE2 - Generic USB CF Reader USB Device

\.\PHYSICALDRIVE4 - Generic USB MS Reader USB Device

\.\PHYSICALDRIVE1 - Generic USB SD Reader USB Device

\.\PHYSICALDRIVE3 - Generic USB SM Reader USB Device

\.\PHYSICALDRIVE5 - WDC WD50 00AAVS-00ZTB0 USB Device - 465.76 GiB - 3 partitions
  \PARTITION0 - Système de fichiers installable - 257.73 GiB - S:
  \PARTITION1 - Système de fichiers installable - 107.83 GiB - J:
  \PARTITION2 - Unknown - 100.2 GiB - M:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Hitsugaya Byakuya\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Fichiers communs
COMPUTERNAME=SOUL-SOCIETY
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Hitsugaya Byakuya
LOGONSERVER=\SOUL-SOCIETY
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\PROGRA~1\DISKEE~1\DISKEE~1\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0401
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\HITSUG~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\HITSUG~1\LOCALS~1\Temp
USERDOMAIN=SOUL-SOCIETY
USERNAME=Hitsugaya Byakuya
USERPROFILE=C:\Documents and Settings\Hitsugaya Byakuya
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Hitsugaya Byakuya [I](admin)/I


-- Add/Remove Programs ---------------------------------------------------------

 --> C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Agere Systems PCI Soft Modem --> agrsmdel
AlienGUIse Theme Manager --> C:\PROGRA~1\ALIENG~1	hememgr.exe /uninstallwise
Archiveur WinRAR --> C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
µTorrent --> "C:\Program Files\uTorrent\uTorrent.exe" /UNINSTALL
AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
Counter-Strike: Source --> "C:\PacSteamT\steam.exe" steam://uninstall/240
Diskeeper 2008 Pro Premier --> MsiExec.exe /X{4ECCF281-ED79-4EA7-AE89-5E39D3291C2A}
DivX Codec --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter --> C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player --> C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
EVEREST Ultimate Edition v4.50 --> "C:\Program Files\Lavalys\EVEREST Ultimate Edition\unins000.exe"
G DATA InternetSecurity --> C:\Program Files\InstallShield Installation Information\{EBC48410-C292-412D-A72A-4F2855988D55}\setup.exe -runfromtemp -l0x0009 -removeonly
GameGain --> "C:\Program Files\GameGain\unins000.exe"
GEAR 32bit Driver Installer --> MsiExec.exe /X{E89B484C-B913-49A0-959B-89E836001658}
Internet Download Manager --> C:\Program Files\Internet Download Manager\Uninstall.exe
jv16 PowerTools 2008 1.8.0.448 --> "C:\Program Files\jv16 PowerTools 2008\unins000.exe"
LiveUpdate 3.2 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Look 'n' Stop 2.06 --> "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -uninst
Messenger Plus! Live --> "C:\Program Files\Messenger Plus! Live\Uninstall.exe"
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Silverlight --> MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Mise à jour de sécurité pour Windows XP (KB941569) --> "C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
MSXML 6.0 Parser (KB925673) --> MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
Norton Ghost --> MsiExec.exe /I{B0255743-165B-4BD5-8DA8-37DFB9930012}
Notepad++ --> C:\Program Files\Notepad++\uninstall.exe
O&O Defrag Professional Edition --> MsiExec.exe /I{53480330-E1D1-41CA-B8F8-7F78644F7F50}
Opera 9.27 --> MsiExec.exe /X{503D6E3E-1A48-44F5-BB7C-EB3B593FAED0}
Pack Vista Inspirat 2 1.0 --> C:\WINDOWS\BricoPacks\Vista Inspirat 2\Remove.exe
PacSteamT --> C:\PacSteamT\PacSteamT-Uninstall.exe
PC Booster --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{73F1BDB7-11E1-11D5-9DC6-00C04F2FC33B}\setup.exe" -l0x40c  -removeonly
PowerQuest PartitionMagic 8.0 --> C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{6BE2A4A4-99FB-48ED-AE1E-4E850389F804} 
REALTEK GbE & FE Ethernet PCI NIC Driver --> C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe -runfromtemp -l0x040c -removeonly
Realtek High Definition Audio Driver --> RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c  -removeonly
Registry Clean Expert --> "C:\Program Files\Registry Clean Expert\unins000.exe"
Registry Fast v4.0 --> "C:\Program Files\Registry Fast\unins000.exe"
SparkleXP --> C:\Program Files\SparkleXP\Uninstall.exe
Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
TuneUp Utilities 2008 --> MsiExec.exe /I{5888428E-699C-4E71-BF71-94EE06B497DA}
Uniblue PowerSuite --> "C:\Program Files\Uniblue\unins000.exe"
Unlocker 1.8.7 --> C:\Program Files\Unlocker\uninst.exe
Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live installer --> MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Mail --> MsiExec.exe /I{C514C594-23AA-4F13-A070-DB8BDB27594F}
Windows Live Messenger --> MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Presentation Foundation --> MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows XP Service Pack 3 --> "C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Language Pack 1.0 --> "C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Pack 1.0 --> 
Yahoo! Install Manager --> C:\WINDOWS\system32egsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL
Yahoo! Toolbar avec bloqueur de fenêtres pop-up --> C:\PROGRA~1\Yahoo!\Common\unyt.exe


-- Application Event Log -------------------------------------------------------

Event Record #/Type577 / Error
Event Submitted/Written: 05/14/2008 01:09:01 PM
Event ID/Source: 1000 / Application Error
Event Description:
Application défaillante Ad-Watch2007.exe, version 7.0.2.6, module défaillant AWProcessWatch.dll, version 7.0.2.2, adresse de défaillance 0x00007e9f.
Traitement de l'événement propre au support pour [Ad-Watch2007.exe!ws!]

Event Record #/Type557 / Success
Event Submitted/Written: 05/14/2008 00:39:38 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type526 / Error
Event Submitted/Written: 05/13/2008 11:06:20 PM
Event ID/Source: 4118 / Ci
Event Description:
Une analyse complète n'a pas pu être effectuée sur Dc2.

Event Record #/Type513 / Error
Event Submitted/Written: 05/13/2008 07:08:50 PM
Event ID/Source: 4126 / Ci
Event Description:
Nettoyage des méta-données endommagées de l'index de
contenu sur s:\system volume information\catalog.wci. L'index sera automatiquement restauré en refiltrant tous les documents.

Event Record #/Type512 / Error
Event Submitted/Written: 05/13/2008 07:08:50 PM
Event ID/Source: 4124 / Ci
Event Description:
L'index de contenu sur s:\system volume information\catalog.wci est endommagé. Veuillez arrêter
et redémarrer le service d'indexation (cisvc).



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type1122 / Error
Event Submitted/Written: 05/14/2008 01:16:59 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM a reçu l'erreur "%%1058" lors de la mise en route du service wuauserv avec les arguments ""
pour démarrer le serveur :
{E60687F7-01A1-40AA-86AC-DB1CBF673334}

Event Record #/Type1087 / Error
Event Submitted/Written: 05/14/2008 00:46:15 PM
Event ID/Source: 7023 / Service Control Manager
Event Description:
Le service Onduleur s'est arrêté avec l'erreur : 
%%2481

Event Record #/Type1086 / Error
Event Submitted/Written: 05/14/2008 00:46:14 PM / 05/14/2008 00:46:15 PM
Event ID/Source: 7023 / Service Control Manager
Event Description:
Le service Accès du périphérique d'interface utilisateur s'est arrêté avec l'erreur : 
%%126

Event Record #/Type1085 / Error
Event Submitted/Written: 05/14/2008 00:45:54 PM
Event ID/Source: 2481 / UPS
Event Description:
Le service Onduleur n'est pas configuré convenablement.

Event Record #/Type1084 / Error
Event Submitted/Written: 05/14/2008 00:44:17 PM
Event ID/Source: 3095 / NETLOGON
Event Description:
Cet ordinateur est configuré en tant que membre d'un groupe de travail,
et non en tant que membre d'un domaine. Il n'est pas nécessaire
d'exécuter le service Accès réseau dans cette configuration.



-- End of Deckard's System Scanner: finished at 2008-05-14 13:27:57 ------------

Gohantanemoub · Answer

Je suis entrain de faire le scan SDFix en mode sans échec sur mon PC (la je suis sur un autre PC)

Gohantanemoub · Answer

Scan SD Fix : 


[b]SDFix: Version 1.182 [/b]
Run by Hitsugaya Byakuya on 14/05/2008 at 14:07

Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\HITSUG~1\Bureau\SDFix

[b]Checking Services [/b]:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-14 14:23:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:ff,f0,ef,95,26,20,5f,37,41,b2,1f,01,e8,fb,56,f6,b1,e5,f7,3e,e9,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:62,d6,e7,08,a2,29,54,b7,69,5f,4d,a3,86,b4,2f,83,27,05,cf,3b,29,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:ff,f0,ef,95,26,20,5f,37,41,b2,1f,01,e8,fb,56,f6,b1,e5,f7,3e,e9,..
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System]
"OODEFRAG10.00.00.01WORKSTATION"="8F1391BDB996638997BF8510D7A0331FF0F10D903DAA7D192C224AB6F44C777B57D409053695ACD529337BE457DA3D8E2CF479D2BF3C2AF10214DDDBFA89B5163CDA69E94DF3D51735B839DD608CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5CA2D97226D213B555A6A0AC4980AC7933A4F3D2FCEAD9356D555A15D800FD7E5910B2CF24456BE44839298AB10A5389C8DB7EDEAC6A0AEFD01B38DA6F4823273DB12F77A7D0E408A57B5816D69179FA7C9C731611A406577BA6F67820607F4AE75FDA8F639EDBD3A3072A410B1B8C4E0ABE685C234ECC8D247145F86AEC3B032655A2ECF6E9C8FDC2F767CAB60FF2734A60A5762F21D2D997390BCB1E9AF811D9132B475A6C985F1AAF92521459857B25632790565BFDA6340160C3E196CB57745BCABB5965AD7451D05E5F35EC131C196B9EB80C3DAA04EC8E9297AF15BCDFFE358B4A111B5CDD26C4B0DA7B3BDCAF3AE16EDE1A0E25A3C96AA464D4CBC655976C2B58F5D16D61E936A61020409A332E74B2DC9D17B35E6665CA2974F4D9086C101CACCCD71DE881968FB32F76F4C9AD15B36B87A58A2C7010EF48024FD9EBC2710774317A1E7E67986FD8865E0A3888F675A91C8AD6AD2D412F89491F201972AA44C013109554A7B67CF9DCFDEB6921152A98F29D3626F1925C9967A9F74AE894E28434ED1AC064AA23F337DD216BEC2B3C20FAB5BB7B2B61FC864EB8A1DFA5CFA61A2B70BA3A52F50208F20923EEF53B46897333EFB957D24843421D4F5FBB3E843CE2F7F8DF3A5D6E5D3F92DF4A5B0B1B057275CC0F8B4A2E29DF27ABEDD588A78C1B6847F17B676E7AA08CBAF75022BCA2DF64C04D6CF14F7213AF52D82E97EE0DE4A7915384E13E4EED91081599CD6559F8E7AEEDB7B9813E9D90D011151D6B29A8A23310DCDA4C2B533D12E490A001854DEDEF0A3BD2CD8F95A72EA9708A66AB1FC8FD531DA83DC450B098CAA5EEAFE243684D60DAB2714F64D8E159389757C5D98DB66E72E169B5B8114BD3D9D1C71592CD07D40E14DEC7490AD57D7740EE0B39E895D51D63D9F9350651ABC4A6CFA3C896CFED5F763B2A54266C164FC18EF3755748A2F44ECFF4413C45250F0F847745C0CD56ED19DF07EB1BF746F321CC5D98D5F012E084BFE92BE53436F66FD7DE3FCD9CDCED855B57C95CC2D5ADA47588026AA205DE2FCD04183520F6D0706C0DBC44CBF4A683EDF57B618630D7578518649C6880003CD8507F657FA881001D189C2DDDB573210D24642374E7E488B094C5F6BCAC6A58EEBFAD31BCAA03CFF3FA8E95CAD8C132E282B721AFAED64B5C6C010A14D6D6FAD4284259B483E3D33313970F7B3E97CB4D9901DD51DB47F6A36DC5E8CF7013DA0042AFA33BDCC6464E"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:æTorrent"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\DOCUME~1\HITSUG~1\Bureau\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon 28 Jan 2008     1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 28 Jan 2008     5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 28 Jan 2008     2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Mon 12 May 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Tue 12 Apr 2005     2,246,551 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4cabbc33d9fa3ea879d2330766ba6ff1\download\BIT1F.tmp"
Mon 12 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\50b1dbf091e5ad2003668acab0cb3bc0\download\BIT56.tmp"
Mon 12 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b81252ef70e0d4f53d4fb43336030927\download\BIT43.tmp"
Mon 12 May 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e17d2630592b6b8b86888b3ce879a3ab\download\BIT39.tmp"

[b]Finished![/b]

Gohantanemoub · Answer

Up svp c'est urgent

Gohantanemoub · Answer

Svp c'est de pire en pire les programmes mettent super longtemps à s'installer

gen-hackman · Answer

essaie de renvoyer un hijackthis car la....

Gohantanemoub · Answer

Pourquoi ?! C'est mauvais ou pas ?

gen-hackman · Answer

ben je sais pas la moitie a ete coupe

Gohantanemoub · Answer

D'accord j'en refais un par Hijackthis.exe ou par DSS ?

Gohantanemoub · Answer

Up stp sinon je viens de voir qu'une passerellle internet est apparue je sais pas d'où elle sort o_O

gen-hackman · Answer

ben un hijakthis

Gohantanemoub · Answer

Ok je te refais ça

Gohantanemoub · Answer

Voilà le rapport : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:28:08, on 14/05/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe
C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Fichiers communs\G DATA\AVKProxy\AVKProxy.exe
C:\WINDOWS\System32\dmadmin.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\_avgas.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe
C:\pacsteamt\steam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\G DATA InternetSecurity\GUI\avkis.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\Explorer.exe
C:\Documents and Settings\Hitsugaya Byakuya\Bureau\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: QT Breadcrumbs Address Bar - {af83e43c-dd2b-4787-826b-31b17dee52ed} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\_avgas.exe" /minimized
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [AVKTray] "C:\Program Files\G DATA InternetSecurity\AVKTray\AVKTray.exe"
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\system32\msconfig.exe /auto
O4 - HKLM\..\Run: [BM6b2c1c60] Rundll32.exe "C:\WINDOWS\system32\uebhotwy.dll",s
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\pacsteamt\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Styler.lnk = ?
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Fichiers communs\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: G DATA Scheduler (AVKService) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKService.exe
O23 - Service: Gardien d'AntiVirus (AVKWCtl) - G DATA Software AG - C:\Program Files\G DATA InternetSecurity\AVK\AVKWCtl.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

Gohantanemoub · Answer

Personnellement j'ai quelques doutes sur : 

O4 - HKLM\..\Run: [BM6b2c1c60] Rundll32.exe "C:\WINDOWS\system32\uebhotwy.dll",s


O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SERVICE RÉSEAU') 
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

c'est 1 là c'est car j'ai créer mon cd avec nLite ? mais la première m'inquiète

Gohantanemoub · Answer

UP !!

Gohantanemoub · Answer

RE UP PLZ

Gohantanemoub · Answer

UP UP UP besoin d'aide pleaze

Gohantanemoub · Answer

up...

Gohantanemoub · Answer

pleaze aide moi c'est de pire en pire !

gen-hackman · Answer

bonjour pour commencer :


nettoie ton pc avec ccleaner(gratuit) 
https://www.ccleaner.com/ 

télécharge/installe/met a jour et nettoie ton pc avec spybot (gratuit) 
http://users.skynet.be/fa936042/spybotsd13.exe 

télécharge/installe/met a jour et nettoie ton pc avec adaware (gratuit) 
https://www.adaware.com/fr 

télécharge/installe/met a jour et nettoie ton pc avec Microsoft anti-spyware (GIANT anti-spyware) (gratuit) 
https://www.microsoft.com/fr-fr/security?rtc=1 

en cas d'échec des solutions gratuites précédentes: 
télécharge/installe/met a jour et nettoie ton pc avec spysweeper: 
(démo valable 30 jours) 
https://www.webroot.com/fr/fr 

afin de ne plus te faire infecter a nouveau applique les solutions préventives ci-dessous: 

préventif==> 

télécharge/installe et vaccine ton pc avec spywareblaster (gratuit) 
http://www.brightfort.com/spywareblaster.html 

change de navigateur internet 
remplace internet explorer par firefox (gratuit) 
http://www.mozilla-europe.org/fr/products/firefox/ 

si tu est sous Windows 2000 / XP / 2003 server 
vaccine ton pc avec Windows Worms Doors Cleaner (gratuit) 
http://www.firewallleaktester.com/tools/wwdc.exe

Gohantanemoub · Answer

Merci beaucoup sa refonctionne

isa · Answer

ma mise a jour est desactive j ai fait a plusieur reprise la reactivation automatique mais sa marche toujours pas

cybernad · Answer

Bonsoir,

J'ai le  même problème.  De plus DSS ne fonctionne pas sur mon pc j'ai un message d'erreur.

Je viens d'utiliser l'autre programme worms doors et là j'ai quelques messages ... deux ok et trois problèmes.  Lorsque je clique sur le lien pour expliquer le problème c'est en anglais..  Je poste le premier message.  Si l'on peut m'aider?

Microsoft Security Bulletin MS03-026
Buffer Overrun In RPC Interface Could Allow Code Execution (823980)

Originally posted: July 16, 2003 
Revised: September 10, 2003

Summary
Who should read this bulletin: 
Users running Microsoft ® Windows ® 

Impact of vulnerability: 
Run code of attacker's choice 

Maximum Severity Rating: 
Critical 

Recommendation: 
Systems administrators should apply the patch immediately

End User Bulletin: 
An end user version of this bulletin is available at: 

https://www.microsoft.com/fr-fr/security?rtc=1

Protect your PC:
Additional information on how you can help protect your PC is available at the following locations: 

• End Users can visit the Protect Your PC Web site.
 
• IT Professionals can visit the Microsoft TechNet Security Center Web site. 
 

Affected Software: 

• Microsoft Windows NT® 4.0 
 
• Microsoft Windows NT 4.0 Terminal Services Edition 
 
• Microsoft Windows 2000 
 
• Microsoft Windows XP 
 
• Microsoft Windows Server™ 2003 
 

Not Affected Software:

• Microsoft Windows Millennium Edition 
 

Top of section
General Information
 Technical details  

Technical description: 

Microsoft originally released this bulletin and patch on July 16, 2003 to correct a security vulnerability in a Windows Distributed Component Object Model (DCOM) Remote Procedure Call (RPC) interface. Subsequent to the release of this bulletin Microsoft has been made aware that additional ports involving RPC can be used to exploit this vulnerability. Information regarding these additional ports has been added to the mitigating factors and the Workaround section of the bulletin. In addition, Microsoft has released security bulletin MS03-039 and an updated scanning tool which supersedes this bulletin and the original scanning tool provided with it. 

The updated tool provided with MS03-039 supersedes the one provided in Microsoft Knowledge Base article 826369. If the tool originally provided with this bulletin is used against a system which has installed the security patch provided MS03-039, the outdated tool will incorrectly report that the system is missing the patch provided in MS03-026. Microsoft encourages customers to run the latest version of the tool available in Microsoft Knowledge Base article 827363 to determine if their systems are patched. 

Remote Procedure Call (RPC) is a protocol used by the Windows operating system. RPC provides an inter-process communication mechanism that allows a program running on one computer to seamlessly execute code on a remote system. The protocol itself is derived from the Open Software Foundation (OSF) RPC protocol, but with the addition of some Microsoft specific extensions. 

There is a vulnerability in the part of RPC that deals with message exchange over TCP/IP. The failure results because of incorrect handling of malformed messages. This particular vulnerability affects a Distributed Component Object Model (DCOM) interface with RPC, which listens on RPC enabled ports. This interface handles DCOM object activation requests that are sent by client machines to the server. An attacker who successfully exploited this vulnerability would be able to run code with Local System privileges on an affected system. The attacker would be able to take any action on the system, including installing programs, viewing changing or deleting data, or creating new accounts with full privileges.

To exploit this vulnerability, an attacker would need to send a specially formed request to the remote computer on specific RPC ports. 

Mitigating factors: 

• To exploit this vulnerability, the attacker would require the ability to send a specially crafted request to port 135, 139, 445 or 593 or any other specifically configured RPC port on the remote machine. For intranet environments, these ports would normally be accessible, but for Internet connected machines, these would normally be blocked by a firewall. In the case where these ports are not blocked, or in an intranet configuration, the attacker would not require any additional privileges. 
 
• Best practices recommend blocking all TCP/IP ports that are not actually being used, and most firewalls including the Windows Internet Connection Firewall (ICF) block those ports by default. For this reason, most machines attached to the Internet should have RPC over TCP or UDP blocked. RPC over UDP or TCP is not intended to be used in hostile environments such as the Internet. More robust protocols such as RPC over HTTP are provided for hostile environments. 

To learn more about securing RPC for client and server please refer to https://docs.microsoft.com/en-us/windows/win32/rpc/writing-a-secure-rpc-client-or-server?redirectedfrom=MSDN 

To learn more about the ports used by RPC, please refer to: https://docs.microsoft.com/en-us/
 

Severity Rating: 

Windows NT 4.0
 Critical
 
Windows NT 4.0 Terminal Server Edition
 Critical
 
Windows 2000
 Critical
 
Windows XP
 Critical
 
Windows Server 2003
 Critical
 

The above assessment is based on the types of systems affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them. 

Vulnerability identifier: CAN-2003-0352 

Tested Versions:

Microsoft tested Windows Me, Windows NT 4.0, Windows NT 4.0 Terminal Services Edition, Windows 2000, Windows XP and Windows Server 2003, to assess whether they are affected by this vulnerability. Previous versions are no longer supported, and may or may not be affected by this vulnerability.

Top of section
 Frequently asked questions  

Why have you revised this bulletin?
Subsequent to the release of this bulletin Microsoft has been made aware that additional ports involving RPC can be used to exploit this vulnerability. Information regarding these additional ports has been added to the mitigating factors and the Workaround section of the bulletin. In addition, Microsoft has released security bulletin MS03-039 and a new scanning tool which supersedes this bulletin and the original scanning tool provided with it. As such, the bulletin has also been updated to reflect the release of the new patch and new scanning tool. 

Is the patch supported on Windows 2000 Service Pack 2?
This security patch will install on Windows 2000 Service Pack 2. However, Microsoft no longer supports this version, according to the Microsoft Support Lifecycle policy found at https://docs.microsoft.com/en-us/lifecycle/ In addition, this security patch has only received minimal testing on Windows 2000 Service Pack 2. Customers are strongly advised to upgrade to a supported service pack as soon as possible. Microsoft Product Support Services will support customers who have installed this patch on Windows 2000 Service Pack 2 if a problem results from installation of the patch. 

Is the patch supported on Windows NT 4.0 Workstation?
This security patch will install on Windows NT 4.0 Workstation Service Pack 6a. However, Microsoft no longer supports this version, according to the Microsoft Support Lifecycle policy found at https://docs.microsoft.com/en-us/lifecycle/ In addition, this security patch has only received minimal testing on Windows NT 4.0 Workstation Service Pack 6a. Customers are strongly advised to upgrade to a supported version as soon as possible. Microsoft Product Support Services will support customers who have installed this patch on Windows NT 4.0 Workstation Service Pack 6a if a problem results from installation of the patch. 

Are there any tools I can use to detect systems on my network that do not have the MS03-026 patch installed? 
Yes - Microsoft has released a tool that can be used to scan a network for the presence of systems which have not had the MS03-026 or the newly released MS03-039 patch installed. More details on this tool are available in Microsoft Knowledge Base article 827363. 

I previously downloaded the scanning tool for MS03-026, should I download the updated tool?
Yes - although the original scanning tool still scans properly for systems that do not have MS03-026 installed, Microsoft has released MS03-039, which supersedes this bulletin. Once MS03-039 is installed, the original scanning tool will no longer give reliable results. However, the newly released scanning tool will properly scan for vulnerable computers and provide the proper results if MS03-039 has been installed. 

What's the scope of the vulnerability?
This is a buffer overrun vulnerability. An attacker who successfully exploited this vulnerability could gain complete control over a remote computer. This would give the attacker the ability to take any action on the server that they want. For example, and attacker could change Web pages, reformat the hard disk, or add new users to the local administrators group. 
To carry out such an attack, an attacker would require the ability to send a malformed message to the RPC service and thereby cause the target machine to fail in such a way that arbitrary code could be executed. 

What causes the vulnerability? 
The vulnerability results because the Windows RPCSS service does not properly check message inputs under certain circumstances. After establishing a connection, an attacker could send a specially crafted malformed RPC message to cause the underlying Distributed Component Object Model (DCOM) process on the remote system to fail in such a way that arbitrary code could be executed. 

What is DCOM? 
The Distributed Component Object Model (DCOM) is a protocol that enables software components to communicate directly over a network. Previously called "Network OLE," DCOM is designed for use across multiple network transports, including Internet protocols such as HTTP. 

What is Remote Procedure Call (RPC)? 
Remote Procedure Call (RPC) is a protocol that a program can use to request a service from a program located on another computer in a network. RPC helps with interoperability because the program using RPC does not have to understand the network protocols that are supporting communication. In RPC, the requesting program is the client and the service-providing program is the server. 

What is COM Internet Services (CIS) and RPC over HTTP?
RPC over HTTP - v1 (Windows NT 4.0, Windows 2000) and v2 (Windows XP, Windows Server 2003) introduce support for a new RPC transport protocol that allows RPC to operate over TCP ports 80 and 443 (v2 only). This allows a client and a server to communicate in the presence of most proxy servers and firewalls. COM Internet Services (CIS) allows DCOM to use RPC over HTTP to communicate between DCOM clients and DCOM servers. 
More information on "RPC over HTTP " for Windows Server 2003 can be found at the following URL: 
https://docs.microsoft.com/en-us/windows/win32/rpc/remote-procedure-calls-using-rpc-over-http?redirectedfrom=MSDN 
More information on COM Internet Services (sometimes referred to as CIS) can be found at the following URL:
http://msdn2.microsoft.com/en-us/library/ms809302 

How do I know if I have COM Internet Services (CIS) or RPC over HTTP installed?
To determine whether a server has COM Internet Services or RPC over HTTP installed follow the steps below: 

• On Windows NT 4.0 systems with the Windows NT Option Pack installed: Search on all partitions for "rpcproxy.dll". If "rpcproxy.dll" is found on the server, COM Internet Services is installed. 
 
• On Windows 2000 and Windows Server 2003 servers:

In Control Panel, double-click Add/Remove Programs, and then double-click Add/Remove Windows Components.
The Windows Components Wizard starts. 
Click Networking Services, and then click Details. 
If the COM Internet Services Proxy (for Windows 2000 Server) or the RPC over HTTP Proxy (for Windows Server 2003) check box is selected, CIS or RPC over HTTP support is enabled on the server. 
 

Note: You can also search for "rpcproxy.dll" on Windows 2000 and Windows Server 2003 installations if you want to remotely or programmatically determine if CIS or RPC over HTTP is installed. 
To search for a specific file on your computer: click Start, click Search, click For Files or Folders, and then type the name of the file that you want to search for. 
The search may take several minutes, depending on the size of your hard disk. 

What's wrong with the RPCSS Service?
There is a flaw in the RPCSS Service that deals with DCOM activation. A failure results because of incorrect handling of malformed messages. This particular failure affects the underlying RPCSS Service used for DCOM activation, which listens on UDP ports 135, 137, 138, 445 and TCP ports 135, 139, 445, 593. Additionally, it can listen on ports 80 and 443 if CIS or RPC over HTTP is enabled. 
By sending a malformed RPC message, an attacker could cause the RPCSS Service on a system to fail in such a way that arbitrary code could be executed. 

Is this a flaw in the RPC Endpoint Mapper?
No - Although the RPC endpoint mapper shares the RPCSS service with the DCOM infrastructure, the flaw actually occurs in the DCOM Activation infrastructure. The RPC endpoint mapper allows RPC clients to determine the port number currently assigned to a particular RPC service. An endpoint is a protocol-specific identifier of a service on a host machine. For protocols like TCP or UDP, this is a port. For named pipes, it is a named pipe name. Other protocols use other protocol specific endpoints. 

What could this vulnerability enable an attacker to do?
An attacker who successfully exploited this vulnerability could be able to run code with Local System privileges on an affected system. The attacker could be able to take any action on the system, including installing programs, viewing changing or deleting data, or creating new accounts with full privileges. 

How could an attacker exploit this vulnerability?
An attacker could seek to exploit this vulnerability by creating a program that could communicate with a vulnerable server over an affected TCP/UDP port to send a specific kind of malformed RPC message. Receipt of such a message could cause the RPCSS service on the vulnerable system to fail in such a way that it could execute arbitrary code. 
It could also be possible to access the affected component through another vector, such as one that would involve logging onto the system interactively or by using another application that passed parameters to the vulnerable component-- locally or remotely. 

Who could exploit this vulnerability?
Any user who could deliver a malformed RPC message to the RPCSS Service on an affected system could attempt to exploit this vulnerability. Because the RPCSS Service is on by default in all versions of Windows, this in essence means that any user who could establish a connection with an affected system could attempt to exploit this vulnerability. 

What does the patch do?
The patch corrects the vulnerability by altering the DCOM implementation to properly check the information passed to it. 



Workarounds:

Are there any workarounds that can be used to help block exploitation of this vulnerability while I am testing or evaluating the patch? 

Yes. Although Microsoft urges all customers to apply the patch at the earliest possible opportunity, there are a number of workarounds that can be applied to help prevent the vector used to exploit this vulnerability in the interim. There is no guarantee that the workarounds will block all possible attack vectors. 
It should be noted that these workarounds should be considered temporary measures as they just help block paths of attack rather than correcting the underlying vulnerability. 

• Block UDP ports 135, 137, 138, 445 and TCP ports 135, 139, 445, 593 at your firewall and disable COM Internet Services (CIS) and RPC over HTTP, which listen on ports 80 and 443, on the affected systems.

These ports are used to initiate an RPC connection with a remote computer. Blocking them at the firewall ,will help prevent systems behind that firewall from being attacked by attempts to exploit these vulnerabilities. You should also be sure and block any other specifically configured RPC port on the remote machine. 
If enabled, CIS and RPC over HTTP allow DCOM calls to operate over TCP ports 80 (and 443 on XP and Windows Server 2003). Make sure that CIS and RPC over HTTP are disabled on all the affected systems. 
More information on how to disable CIS can be found in Microsoft Knowledge Base Article 825819. 
For information regarding RPC over HTTP, see https://docs.microsoft.com/en-us/windows/win32/rpc/rpc-over-http-security?redirectedfrom=MSDN 
 
• Use a personal firewall such as Internet Connection Firewall (only available on XP and Windows Server 2003) and disable COM Internet Services (CIS)and RPC over HTTP, which listen on ports 80 and 443, on the affected machines, especially any machines that connect to a corporate network remotely using a VPN or similar.

If you are using the Internet Connection Firewall in Windows XP or Windows Server 2003 to protect your Internet connection, it will by default block inbound RPC traffic from the Internet. Make sure that CIS and RPC over HTTP are disabled on all affected machines. 
More information on how to disable CIS can be found in Microsoft Knowledge Base Article 825819. 
For information regarding RPC over HTTP, see https://docs.microsoft.com/en-us/windows/win32/rpc/rpc-over-http-security?redirectedfrom=MSDN 
 
• Block the affected ports using an IPSEC filter and disable COM Internet Services (CIS) and RPC over HTTP, which listen on ports 80 and 443, on the affected machines.

You can secure network communications on Windows 2000-based computers if you use Internet Protocol Security (IPSec). Detailed information on IPSec and how to apply filters can be found in Microsoft Knowledge Base Article 313190 and 813878. Make sure that CIS and RPC over HTTP are disabled on all affected machines. 
More information on how to disable CIS can be found in Microsoft Knowledge Base Article 825819. 
For information regarding RPC over HTTP, see https://docs.microsoft.com/en-us/windows/win32/rpc/rpc-over-http-security?redirectedfrom=MSDN 
 
• Disable DCOM on all affected machines

When a computer is part of a network, the DCOM wire protocol enables COM objects on that computer to communicate with COM objects on other computers. You can disable DCOM for a particular computer to help protect against this vulnerability, but doing so will disable all communication between objects on that computer and objects on other computers.
If you disable DCOM on a remote computer, you will not be able to remotely access that computer afterwards to re-enable DCOM. To re-enable DCOM, you will need physical access to that computer.
Information on how to disable DCOM is available in Microsoft Knowledge Base Article 825750. 

Note: For Windows 2000, the methods described above will only work on systems running Service Pack 3 or later. Customers using Service Pack 2 or below should upgrade to a later Service Pack or use one of the other workarounds. 
 

Top of section
 Patch availability 

Download locations for this patch 

• Windows NT 4.0 
 
• Windows NT 4.0 Terminal Server Edition 
 
• Windows 2000 
 
• Windows XP 32 bit Edition 
 
• Windows XP 64 bit Edition 
 
• Windows Server 2003 32 bit Edition 
 
• Windows Server 2003 64 bit Edition
 
 Additional information about this patch  

Installation platforms: 

• The Windows NT 4.0 patch can be installed on systems running Service Pack 6a. 
 
• The Windows NT 4.0, Terminal Server Edition patch can be installed on systems running Windows NT 4.0, Terminal Server Edition Service Pack 6. 
 
• The Windows 2000 patch can be installed on systems running Windows 2000 Service Pack 2, Service Pack 3, or Service Pack 4. 
 
• The patch for Windows XP can be installed on systems running Windows XP Gold or Service Pack 1. 
 
• The patch for Windows Server 2003 can be installed on systems running Windows Server 2003 Gold.
 

Inclusion in future service packs:

The fix for this issue will be included in Windows 2000 Service Pack 5, Windows XP Service Pack 2, and Windows Server 2003 Service Pack 1. 

Reboot needed: Yes. 

Patch can be uninstalled: Yes. 

Superseded patches: 

• The Windows 2000 and Windows XP patches supercede the Windows 2000 and Windows XP patches discussed in Microsoft Security Bulletin MS03-010. 
 
• This patch supercedes the patch provided with Microsoft Security Bulletin MS01-048 for Microsoft Windows NT 4.0.
 

Verifying patch installation: 

• Windows NT 4.0: 

To verify that the patch has been installed on the machine, confirm that all files listed in the file manifest in Knowledge Base article 823980 are present on the system. 
 
• Windows NT 4.0 Terminal Server Edition: 

To verify that the patch has been installed on the machine, confirm that all files listed in the file manifest in Knowledge Base article 823980 are present on the system. 
 
• Windows 2000: 

To verify that the patch has been installed on the machine, confirm that the following registry key has been created on the machine: 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP5\KB823980.

To verify the individual files, use the date/time and version information provided in the file manifest in Knowledge Base article 823980 are present on the system. 
 
• Windows XP 

• If installed on Windows XP Gold:

To verify that the patch has been installed on the machine, confirm that the following registry key has been created on the machine:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP1\KB823980 
To verify the individual files, use the date/time and version information provided in the file manifest in Knowledge Base article 823980 are present on the system. 
 
• If installed on Windows XP Service Pack 1:

To verify that the patch has been installed on the machine, confirm that the following registry key has been created on the machine: 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP2\KB823980.
To verify the individual files, use the date/time and version information provided in the file manifest in Knowledge Base article 823980 are present on the system. 
 
 
• Windows Server 2003: 

To verify that the patch has been installed on the machine, confirm that the following registry key has been created on the machine: 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Window Server 2003\SP1\KB823980. 
To verify the individual files, use the date/time and version information provided in the file manifest in Knowledge Base article 823980 are present on the system. 
 

Caveats:

None 

Localization:

Localized versions of this patch are available at the locations discussed in "Patch Availability". 

Obtaining other security patches: 

Patches for other security issues are available from the following locations: 

• Security patches are available from the Microsoft Download Center, and can be most easily found by doing a keyword search for "security_patch". 
 
• Patches for consumer platforms are available from the WindowsUpdate web site 
 

Top of section
Top of section
Other information: 
Acknowledgments

Microsoft thanks  The Last Stage of Delirium Research Group for reporting this issue to us and working with us to protect customers. 

Support: 

• Microsoft Knowledge Base article 823980 discusses this issue and will be available approximately 24 hours after the release of this bulletin. Knowledge Base articles can be found on the Microsoft Online Support web site. 
 
• Technical support is available from Microsoft Product Support Services. There is no charge for support calls associated with security patches. 
 

Security Resources: The Microsoft TechNet Security Center Web site provides additional information about security in Microsoft products. 

Disclaimer: 

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. 

Revisions: 

• V1.0 (July 16, 2003): Bulletin Created. 
 
• V1.1 (July 18, 2003): Mitigating factors and Workaround section updated to reflect additional ports. 
 
• V1.2 (July 21, 2003): Added Windows XP gold patch verification registry key. 
 
• V1.3 (July 27, 2003): Updated Workaround section to include additonal information about how to disable DCOM. 
 
• V1.4 (August 12, 2003): Updated to include information about Windows 2000 Service Pack 2 support for this patch and updated bulletin with additonal workaround information. 
 
• V1.5 (August 14, 2003): Added details for scanner tool. 
 
• V1.6 (August 15, 2003): Updated download links, removed the word "Server" from the NT4 link. 
 
• V1.7 (August 18, 2003): Corrected minor formatting errors in the Frequently Asked Questions section. 
 
• V1.8 (August 21, 2003): Updated supercedence information in the Additional Information section. 
 
• V1.9 (August 25, 2003): Updated to include information about Windows NT 4.0 Workstation Service Pack 6a support for this patch 
 
• V2.0 (September 10, 2003): Updated to include information about the release of MS03-039 and tool supercedence. 
 

Top of section

cybernad · Answer

Microsoft Security Bulletin MS03-001
Unchecked Buffer in Locator Service Could Lead to Code Execution (810833)

Originally posted: January 22, 2003

Summary
Who should read this bulletin:
Customers using Microsoft® Windows® NT 4.0, Windows 2000, or Windows XP. 

Impact of vulnerability:
Run code of the attacker's choice 

Maximum Severity Rating:
Critical 

Recommendation:
Customers running Windows NT 4.0 server or Windows 2000 server should apply the patch immediately. Customers who are running Windows NT 4.0 Workstation, Windows 2000 workstation, and Windows XP should install the patch at the earliest opportunity.

Affected Software: 

• Microsoft Windows NT 4.0 
 
• Microsoft Windows NT 4.0, Terminal Server Edition 
 
• Microsoft Windows 2000 
 
• Microsoft Windows XP 
 

End User Bulletin:
An end user version of this bulletin is available at: https://www.microsoft.com/fr-fr/security?rtc=1

Top of section
General Information
 Technical details  

Technical description: 

The Microsoft Locator service is a name service that maps logical names to network-specific names. It ships with Windows NT 4.0, Windows 2000, and Windows XP. By default, the Locator service is enabled only on Windows 2000 domain controllers and Windows NT 4.0 domain controllers; it is not enabled on Windows NT 4.0 workstations or member servers, Windows 2000 workstations or member servers, or Windows XP. 

A security vulnerability results from an unchecked buffer in the Locator service. By sending a specially malformed request to the Locator service, an attacker could cause the Locator service to fail, or to run code of the attacker's choice on the system. 

Mitigating factors: 

• The Locator service is not enabled by default on any affected versions of Windows with the exception of Windows 2000 domain controllers and Windows NT 4.0 domain controllers. 
 
• A properly-configured firewall would block the calls to the Locator service, which would protect an affected machine from an Internet-based attack. 
 

Severity Rating: 

Windows NT 4.0 (Workstations and Member Servers)
 Moderate
 
Windows NT 4.0 (Domain Controllers Only)
 Critical
 
Windows NT 4.0, Terminal Server Edition
 Moderate
 
Windows 2000 (Workstations and Member Servers)
 Moderate
 
Windows 2000 (Domain Controllers Only)
 Critical
 
Windows XP
 Moderate
 

The above assessment is based on the types of systems affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them. 

Vulnerability identifier: CAN-2003-0003 

Tested Versions:

Microsoft tested Windows NT 4.0, Windows 2000, and Windows XP to assess whether they are affected by this vulnerability. The Locator service was not available in versions of Windows prior to Windows NT 4.0.

Top of section
 Frequently asked questions  

What's the scope of the vulnerability?
This is a buffer overrun vulnerability. An attacker who successfully exploited this vulnerability could cause the Locator service to fail, or could cause code of the attacker's choice to be executed with system privileges.
The Locator service is not enabled by default except on Windows 2000 domain controllers and Windows NT 4.0 domain controllers. A properly-configured firewall would block the calls to the Locator service, which would protect an affected machine from an Internet-based attack. 

What causes the vulnerability?
The vulnerability results because of an unchecked buffer in the Microsoft Locator service. If the Locator service was called using a specially malformed argument, it could have the effect of overrunning the buffer. 

What is the Locator service?
The Microsoft Locator service is a name service that maps names to objects. The name is a logical name that is easy for users to recognize and use. The Locator service ships with Windows NT 4.0, Windows 2000, and Windows XP. 

What is the Locator service used for?
A client that is going to make a Remote Procedure Call (RPC) can call the Locator service to resolve a logical name for a network object to a network-specific name for use in the RPC. For example, if a print server has the logical name "laserprinter", an RPC client could call the Locator service to find out the network-specific name that mapped to "laserprinter". The RPC client uses the network-specific name when it makes the RPC call to the service.
By default, the Locator service is only enabled on Windows 2000 domain controllers and Windows NT 4.0 domain controllers. An administrator could enable the Locator service on any Windows NT 4.0, Windows 2000, or Windows XP system. 

What is a Remote Procedure Call?
A Remote Procedure Call is an interprocess communication technique which allows client/server software to communicate. RPC can be used in client/server applications based on Microsoft Windows operating systems and can also be used in heterogeneous network environments that include other operating systems. 

What's wrong with Locator service?
There is a flaw in the way the Locator service handles certain parameter information that is passed to it. Specially malformed parameter data could be passed to the Locator service and could cause a buffer to be overrun. 

What could this vulnerability enable an attacker to do?
If an attack were successful, this vulnerability could enable an attacker to cause the Locator service to fail, or to be able to run code on the system. 

How could an attacker exploit this vulnerability?
An attacker could seek to exploit this vulnerability by forming an RPC call that would employ the Locator service to resolve a logical name, and using the RPC call to pass specially malformed data.
Because a properly configured firewall that blocked NetBIOS traffic would block access to the Locator service from the Internet, a successful attack would need to be launched from an organization's internal network. 

Does the Locator service require authentication?
No, the system making the RPC request does not have to be authenticated by the system running the Locator service. 

Could this vulnerability be exploited from the Internet?
A properly-configured firewall would block the calls to the Locator service, which would protect an affected machine from an Internet-based attack. An attacker would be much more likely to attempt to exploit this vulnerability from an organization's internal network. 

How do I tell if the Locator service is enabled?
The status of the "Remote Procedure Call (RPC) Locator" service and how it is started (automatically or manually) can be viewed in the Control Panel. For Windows 2000 and Windows XP, use Control Panel | Administrative Tools | Services, and on Windows NT 4.0, use Control Panel | Services. 
It is also possible to determine the status of the Locator service from the command line by entering: 

net start

A list of services will be displayed. If "Remote Procedure Call (RPC) Locator" appears in the list, then the locator service is running. 

Are there any applications that enables the locator service on member servers?
Yes - There are several applications, for example Microsoft Exchange Server, that enable the locator service on member servers. Microsoft recommends customers to install the patch at their earliest opportunity on all systems that have the locator service enabled. 

If I am not using the Locator service, can I disable it?
Yes. An administrator can disable the Locator service by setting the RpcLocator service status to "disabled" in the services control panel.
The service can also be stopped via the command line using the sc.exe program, which ships with Windows XP and is included as part of the Windows 2000 Resource Kit. The following command will stop the service: 

sc stop RpcLocator

To disable the service using the command line tool, use the following: 

sc config RpcLocator start= disabled

What systems would be at greatest risk from this vulnerability?
Only Windows 2000 domain controllers and Windows NT 4.0 domain controllers have the Locator service enabled by default, so those would be the systems at greatest risk. The Locator service can be enabled on Windows NT 4.0, Windows NT 4.0, Terminal Server Edition, Windows 2000, and Windows XP. 

What does the patch do?
The patch addresses the vulnerability by correctly handling the information passed to the RPC Locator service.

Top of section
 Patch availability 

Download locations for this patch 

• Windows NT 4.0:

• All except Japanese NEC and Chinese - Hong Kong 
 
• Japanese NEC 
 
• Chinese - Hong Kong 
 
 
• Windows NT 4.0, Terminal Server Edition:

• All 
 
 
• Windows 2000: 

• All except Japanese NEC 
 
• Japanese NEC 
 
 
• Windows XP:

• 32-bit Edition 
 
• 64-bit Edition 
 
 
 Additional information about this patch  

Installation platforms: 

• The Windows NT 4.0 patch can be installed on systems running Service Pack 6a. 
 
• The Windows NT 4.0, Terminal Server Edition patch can be installed on systems running Windows NT 4.0, Terminal Server Edition Service Pack 6. 
 
• The Windows 2000 patch can be installed on systems running Windows 2000 Service Pack 2 or Service Pack 3. 
 
• The patch for Windows XP can be installed on systems running Windows XP Gold or Service Pack 1. 
 

Inclusion in future service packs:

The fix for this issue will be included in Windows 2000 Service Pack 4 and Windows XP Service Pack 2. 

Reboot needed: Yes 

Patch can be uninstalled: Yes 

Superseded patches: None. 

Verifying patch installation: 

• Windows NT 4.0:

To verify that the patch has been installed on the machine, confirm that all files listed in the file manifest in Knowledge Base article 810833 are present on the system. 
 
• Windows NT 4.0 Terminal Server Edition:

To verify that the patch has been installed on the machine, confirm that all files listed in the file manifest in Knowledge Base article 810833 are present on the system. 
 
• Windows 2000:

To verify that the patch has been installed on the machine, confirm that the following registry key has been created on the machine: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP4\Q810833. 

To verify the individual files, use the date/time and version information provided in the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP4\Q810833\Filelist. 
 
• Windows XP: 

• If installed on Windows XP Gold:

To verify that the patch has been installed, confirm that the following registry key has been created on the machine: HKLM\Software\Microsoft\Updates\Windows XP\SP1\Q810833. 

To verify the individual files, use the date/time and version information provided in the following registry key: HKLM\Software\Microsoft\Updates\Windows XP\SP1\Q810833\Filelist. 
 
• If installed on Windows XP Service Pack 1:

To verify that the patch has been installed, confirm that the following registry key has been created on the machine: HKLM\Software\Microsoft\Updates\Windows XP\SP2\Q810833. 

To verify the individual files, use the date/time and version information provided in the following registry key: HKLM\Software\Microsoft\Updates\Windows XP\SP2\Q810833\Filelist. 
 
 

Caveats:

None 

Localization:

Localized versions of this patch are available at the locations discussed in "Patch Availability". 

Obtaining other security patches: 

Patches for other security issues are available from the following locations: 

• Security patches are available from the Microsoft Download Center, and can be most easily found by doing a keyword search for "security_patch". 
 
• Patches for consumer platforms are available from the WindowsUpdate web site 
 

Top of section
Top of section
Other information: 
Acknowledgments

Microsoft thanks David Litchfield of Next Generation Security Software Ltd. (http://www.nextgenss.com) for reporting this issue to us and working with us to protect customers. 

Support: 

• Microsoft Knowledge Base article 810833 discusses this issue and will be available approximately 24 hours after the release of this bulletin. Knowledge Base articles can be found on the Microsoft Online Support web site. 
 
• Technical support is available from Microsoft Product Support Services. There is no charge for support calls associated with security patches. 
 

Security Resources: The Microsoft TechNet Security Web Site provides additional information about security in Microsoft products. 

Disclaimer: 

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. 

Revisions: 

• V1.0 (January 22, 2003): Bulletin Created. 
 
• V1.1 (October 28, 2003): Updated bulletin to reflect recommendation for patching member servers 
 

Top of section

cybernad · Answer

Microsoft Security Bulletin MS03-049
Buffer Overrun in the Workstation Service Could Allow Code Execution (828749)

Issued: November 11, 2003
Updated: November 19, 2003
Version Number: 1.2 

See all Windows bulletins released November, 2003

Summary
Who Should Read This Document: 
Customers using Microsoft® Windows® 

Impact of Vulnerability: 
Remote Code Execution

Maximum Severity Rating: 
Critical 

Recommendation: 
Systems administrators should apply the patch immediately.

Security Update Replacement: 
None

Caveats: 
None

Tested Software and Security Update Download Locations:

Affected Software 

• Microsoft Windows 2000 Service Pack 2, Service Pack 3, Service Pack 4 - Download the update 
 
• Microsoft Windows XP, Microsoft Windows XP Service Pack 1 - Download the update from MS03-043 (828035)
 
• Microsoft Windows XP 64-Bit Edition - Download the update from MS03-043 (828035)

Note: There is no Windows XP version of the MS03-049 security update. The Windows XP security updates that released as part of Security Bulletin MS03-043 (828035) include the updated file that helps protect from this vulnerability. The Windows XP download links in this bulletin link to the Windows XP MS03-043 security update. If you have applied the Windows XP security updates for MS03-043 (828035) you do not have to reapply the update to be protected against the vulnerability described in this bulletin. However, the Windows 2000 security update that is released as part of this security bulletin contains updated files that were not part of the MS03-043 (828035) security bulletin. Customers have to apply this Windows 2000 security update even if they applied the Windows 2000 security updates for MS03-043 (828035). Future updates to the MS03-043 Windows XP security update may be released, they will also contain the necessary files to be protected against this vulnerability.
 

Non Affected Software 

• Microsoft Windows NT Workstation 4.0, Service Pack 6a 
 
• Microsoft Windows NT Server 4.0, Service Pack 6a 
 
• Microsoft Windows NT Server 4.0, Terminal Server Edition, Service Pack 6 
 
• Microsoft Windows Millennium Edition 
 
• Microsoft Windows XP 64-Bit Edition Version 2003 
 
• Microsoft Windows Server 2003 
 
• Microsoft Windows Server 2003 64-Bit Edition 
 

The software listed above has been tested to determine if the versions are affected. Other versions are no longer supported, and may or may not be affected.

Top of section
General Information
 Technical Details  

Technical description: 

A security vulnerability exists in the Workstation service that could allow remote code execution on an affected system. This vulnerability results because of an unchecked buffer in the Workstation service. 

If exploited, an attacker could gain System privileges on an affected system, or could cause the Workstation service to fail. An attacker could take any action on the system, including installing programs, viewing data, changing data, or deleting data, or creating new accounts with full privileges.

Mitigating factors: 

• If users have blocked inbound UDP ports 138, 139, 445 and TCP ports 138, 139, 445 by using a firewall an attacker would be prevented from sending messages to the Workstation service. Most firewalls, including Internet Connection Firewall in Windows XP, block these ports by default.
 
• Disabling the Workstation service will prevent the possibility of attack. However there are a number of impacts when performing this workaround. Please see the Workaround section for more details.
 
• Only Windows 2000 and Window XP are affected. Other operating systems are not vulnerable to this attack.
 

Severity Rating: 

Microsoft Windows 2000
 Critical
 
Microsoft Windows XP
 Critical
 

The above assessment is based on the types of systems affected by the vulnerability, their typical deployment patterns, and the effect that exploiting the vulnerability would have on them. 

Vulnerability identifier: CAN-2003-0812 

Top of section
 Workarounds  

Microsoft has tested the following workarounds that apply to this vulnerability. These workarounds help block known attack vectors, however they will not correct the underlying vulnerability. Workarounds may reduce functionality in some cases; in such cases, the reduction in functionality is identified below.

• Block UDP ports 138, 139, 445 and TCP ports 138, 139, 445 at your firewall. 

These ports are used to accept a Remote Procedure Call (RPC) connection at a remote computer. Blocking them at the firewall will help prevent systems behind that firewall from being attacked by attempts to exploit this vulnerability. 
 
• Use a personal firewall such as Internet Connection Firewall, which is included with Windows XP. 

If you use the Internet Connection Firewall feature in Windows XP to help protect your Internet connection, Internet Connection Firewall blocks inbound traffic from the Internet or from the intranet by default. 

To enable the Internet Connection Firewall feature by using the Network Setup Wizard: 

1.
 Click Start, and then click Control Panel.
 
2.
 In the default Category View, click Network and Internet Connections, and then click Setup or change your home or small office network. The Internet Connection Firewall feature is enabled when you select a configuration in the Network Setup Wizard that indicates that your computer is connected directly to the Internet. 
 

To configure Internet Connection Firewall manually for a connection: 

1.
 Click Start, and then click Control Panel.
 
2.
 In the default Category View, click Networking and Internet Connections, and then click Network Connections. 
 
3.
 Right-click the connection on which you want to enable Internet Connection Firewall, and then click Properties. 
 
4.
 Click the Advanced tab.
 
5.
 Select the Protect my computer or network by limiting or preventing access to this computer from the Internet check box, and then click OK. 

Note: If you want to enable the use of some applications and services through the firewall, click Settings on the Advanced tab, and then select the programs, the protocols, and the services. 
 
 
• Enable advanced TCP/IP filtering on Windows 2000-based systems and on Windows XP-based systems. 

You can enable advanced TCP/IP filtering to block all unsolicited, inbound traffic. For additional information about how to configure TCP/IP filtering, click the following article number to view the article in the Microsoft Knowledge Base: 

309798 HOW TO: Configure TCP/IP Filtering in Windows 2000
 
• Disable the Workstation service. 

You can disable the Workstation service to help prevent the possibility of an attack. 

To disable the Workstation service on Windows XP: 

• Click Start, and then click Control Panel. 
 
• In the default Category View, click Performance and Maintenance.
 
• Click Administrative Tools. 
 
• Double-click Services. 
 
• Double-click Workstation. 
 
• On the General tab, click Disabled in the Startup type list. 
 
• Click Stop under Service status, and then click OK.
 

To disable the Workstation service on Windows 2000: 

• Click Start, point to Settings, and then click Control Panel.
 
• Double-click Administrative Tools.
 
• Double-click Services.
 
• Double-click Workstation.
 
• On the General tab, click Disabled in the Startup type list.
 
• Click Stop under Service status, and then click OK.
 

Impact of Workaround: If the Workstation service is disabled, the system cannot connect to any shared file resources or shared print resources on a network. Only use this workaround on stand-alone systems (such as many home systems) that do not connect to a network. If the Workstation service is disabled, any services that explicitly depend on the Workstation service do not start, and an error message is logged in the system event log. The following services depend on the Workstation service: 

• Alerter
 
• Browser
 
• Messenger
 
• Net Logon
 
• RPC Locator
 

These services are required to access resources on a network and to perform domain authentication. Internet connectivity and browsing for stand-alone systems, such as users on dial-up connections, on DSL connections, or on cable modem connections, should not be affected if these services are disabled. 

Note: The Microsoft Baseline Security Analyzer will not function if the Workstation service is disabled. It is possible that other applications may also require the Workstation service. If an application requires the Workstation service, simply re-enable the service. This can be performed by changing the Startup Type for the Workstation service back to Automatic and restarting the system.
 

Top of section
 Frequently Asked Questions  

What is the scope of the vulnerability?
This is a buffer overrun vulnerability. An attacker who successfully exploited this vulnerability could allow remote code execution with System privileges on an affected system, or an attacker could cause the Workstation service to fail. The attacker could then take any action on the system, including installing programs, viewing data, changing data, or deleting data, or creating new accounts with full privileges. 

What causes the vulnerability? 
The vulnerability results because of an unchecked buffer within the Workstation service. 

What is the Workstation Service?
Both local file system requests and remote file or print network requests are routed through the Workstation service. This service determines where the resource is located and then routes the request to the local file system or to the networking components. When the Workstation service is stopped, all requests are assumed to be local requests. For a detailed understanding of the Windows networking architecture, visit the following Microsoft Web site: https://www.microsoft.com/fr-fr/ /technet/prodtechnol/windows2000serv/reskit/cnet/cnad_arc_tfgi.mspx

What could this vulnerability enable an attacker to do?
An attacker who successfully exploited this vulnerability could cause code to execute with System privileges on an affected system or could cause the Workstation service to fail. An attacker could then take any action on the system, including installing programs, viewing data, changing data, or deleting data, or creating new accounts with full privileges.

Who could exploit the vulnerability?
Any anonymous user who could deliver a malformed message to the Workstation service on an affected system could attempt to exploit this vulnerability. Because the Workstation service is enabled by default in all versions of Windows, this means that any user who could establish a connection with an affected system could attempt to exploit this vulnerability.

How could an attacker exploit this vulnerability?
An attacker could seek to exploit this vulnerability by creating a specially-crafted network message and by sending the message to the Workstation service on an affected system. Receipt of such a message could cause the Workstation service on the vulnerable system to fail in such a way that could allow the Workstation service to execute code. 
An attacker could also access the affected component through another vector, such as one that would involve logging onto the system interactively or by using another application that passed parameters to the vulnerable component (locally or remotely). 

What does the update do?
The update eliminates the vulnerability by ensuring that the Workstation service properly validates the length of a message before passing the message to the allocated buffer.

Why does the Windows XP update reference the MS03-043 Security Bulletin?
There is no Windows XP version of the MS03-049 security update. The Windows XP security updates that released as part of Security Bulletin MS03-043 (828035) include the updated file that helps protect from this vulnerability. The Windows XP download links in this bulletin link to the Windows XP MS03-043 security update. If you have applied the Windows XP security updates for MS03-043 (828035) you do not have to reapply the update to be protected against the vulnerability described in this bulletin. However, the Windows 2000 security update that is released as part of this security bulletin contains updated files that were not part of the MS03-043 (828035) security bulletin. Customers have to apply this Windows 2000 security update even if they applied the Windows 2000 security updates for MS03-043 (828035). Future updates to the MS03-043 Windows XP security update may be released, they will also contain the necessary files to be protected against this vulnerability.

Top of section
 Security Update Information  

Installation platforms and Prerequisites: 

For information about the specific security update for your platform, click the appropriate link: 

 Windows XP (all versions)  

Note: There is no Windows XP version of the MS03-049 security update. The Windows XP security updates that released as part of Security Bulletin MS03-043 (828035) include the updated file that helps protect from this vulnerability. The Windows XP download links in this bulletin link to the Windows XP MS03-043 security update. If you have applied the Windows XP security updates for MS03-043 (828035) you do not have to reapply the update to be protected against the vulnerability described in this bulletin. However, the Windows 2000 security update that is released as part of this security bulletin contains updated files that were not part of the MS03-043 (828035) security bulletin. Customers have to apply this Windows 2000 security update even if they applied the Windows 2000 security updates for MS03-043 (828035). Future updates to the MS03-043 Windows XP security update may be released, they will also contain the necessary files to be protected against this vulnerability. For complete Windows XP security update details please consult the MS03-043 security bulletin 

Top of section
 Windows 2000 (all versions)  

Prerequisites

For Windows 2000 this security update requires Service Pack 2 (SP2), Service Pack 3 (SP3), or Service Pack 4 (SP4). 

For information about the Windows desktop product life cycle, visit the following Microsoft Web site: https://docs.microsoft.com/en-us/lifecycle/

For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 260910 How to Obtain the Latest Windows 2000 Service Pack 

Inclusion in future service packs: 

The fix for this issue will be included in Windows 2000 Service Pack 5.

Installation Information

This security update supports the following Setup switches: 

/help Displays the command line options

Setup Modes

/quiet Quiet mode (no user interaction or display)

/passive Unattended mode (progress bar only)<

/uninstall Uninstalls the package

Restart Options 

/norestart Do not restart when installation is complete

/forcerestart Restart after installation

Special Options 

/l Lists installed Windows hotfixes or update packages

/o Overwrite OEM files without prompting

/n Do not backup files needed for uninstall

/f Force other programs to close when the computer shuts down

Note: For backward compatibility, the security update also supports the setup switches used by the previous version of the setup utility, however usage of the previous switches should be discontinued as this support may be removed in future security updates.

Deployment Information

To install the security update without any user intervention, use the following command line for Windows 2000 Service Pack 2, Windows 2000 Service Pack 3, Windows 2000 Service Pack 4:

Windows2000-kb828749-x86-enu /passive /quiet

To install the security update without forcing the computer to restart, use the following command line for Windows 2000 Service Pack 2, Windows 2000 Service Pack 3, Windows 2000 Service Pack 4:

Windows2000-kb828749-x86-enu /norestart

Note: You can combine these switches into one command line.

For information about how to deploy this security update with Software Update Services, visit the following Microsoft Web site: 

https://azure.microsoft.com/en-us/?ocid=cloudplat_hp

Restart Requirement

You must restart your computer after you apply this security patch.

Removal Information

To remove this security update, use the Add/Remove Programs tool in Control Panel.

System administrators can use the Spuninst.exe utility to remove this security update. The Spuninst.exe utility is located in the %Windir%\$NTUninstallKB828749$\Spuninst folder, and it supports the following Setup switches: 

/?: Show the list of installation switches. 

/u: Use unattended mode.

/f: Force other programs to quit when the computer shuts down.

/z: Do not restart when the installation is complete. 

/q: Use Quiet mode (no user interaction). 

File Information

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel. 

Windows 2000 Service Pack 2, Windows 2000 Service Pack 3, Windows 2000 Service Pack 4:

Date Time Version Size File Name 
02-Oct-2003
 22:53
 5.00.2195.6862
 96,528
 Wkssvc.dll
 

Verifying Update Installation

To verify that the security update is installed on your computer use the Microsoft Baseline Security Analyzer (MBSA) tool. For additional information about MBSA, click the following article number to view the article in the Microsoft Knowledge Base: 

320454 Microsoft Baseline Security Analyzer Version 1.1.1 Is Available 

You may also be able to verify the files that this security update installed by reviewing the following registry key: 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows 2000\SP5\KB828749\Filelist

Note: This registry key may not be not created properly when an administrator or an OEM integrates or slipstreams the 828749 security update into the Windows installation source files. 

Top of section
Top of section
Acknowledgments

Microsoft thanks the following for working with us to protect customers:

• eEye Digital Security for reporting the issue in MS03-049. 
 

Obtaining other security updates:

Updates for other security issues are available from the following locations: 

• Security updates are available from the Microsoft Download Center, and can be most easily found by doing a keyword search for "security_patch". 
 
• Updates for consumer platforms are available from the Windows Update web site 
 

Support: 

• Technical support is available from Microsoft Product Support Services at 1-866-PCSAFETY. There is no charge for support calls associated with security patches.
 
• International customers can get support from their local Microsoft subsidiaries. There is no charge for support associated with security updates. Information on how to contact Microsoft support is available at https://support.microsoft.com/en-us 
 

Security Resources: 

• The Microsoft TechNet Security Web Site provides additional information about security in Microsoft products. 
 
• Microsoft Software Update Services: https://azure.microsoft.com/en-us/?ocid=cloudplat_hp 
 
• Microsoft Baseline Security Analyzer (MBSA) details: https://docs.microsoft.com/en-us/ Please see https://support.microsoft.com/en-us for list of security updates that have detection limitations with MBSA tool. 
 
• Windows Update Catalog: https://support.microsoft.com/en-us 
 
• Windows Update: http://www.update.microsoft.com/windowsupdate/v6/default.aspx 
 
• Office Update: http://office.microsoft.com/officeupdate/ 
 

Software Update Services (SUS):

Microsoft Software Update Services (SUS) enables administrators to quickly and reliably deploy the latest critical updates and security updates to Windows® 2000 and Windows Server™ 2003-based servers, as well as to desktop computers running Windows 2000 Professional or Windows XP Professional.

For information about how to deploy this security patch with Software Update Services, visit the following Microsoft Web site:

https://azure.microsoft.com/en-us/?ocid=cloudplat_hp

Systems Management Server (SMS):

Systems Management Server can provide assistance deploying this security update. For information about Systems Management Server visit the SMS Web Site. SMS also provides several additional tools to assist administrators in the deployment of security updates such as the SMS 2.0 Software Update Services Feature Pack and the SMS 2.0 Administration Feature Pack. The SMS 2.0 Software Update Services Feature Pack utilizes the Microsoft Baseline Security Analyzer and the Microsoft Office Detection Tool to provide broad support for security bulletin remediation. Some software updates may require administrative rights following a restart of the computer.

Note: The inventory capabilities of the SMS 2.0 Software Update Services Feature Pack may be used for targeting updates to specific computers, and the SMS 2.0 Administration Feature Pack's Elevated Rights Deployment Tool can be used for installation. This provides optimal deployment for updates that require explicit targeting using Systems Management Server and administrative rights after the computer has been restarted.

Disclaimer: 

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. 

Revisions: 

• V1.0 (November 11, 2003): Bulletin published
 
• V1.1 November 11, 2003: Updated the File Manifest and Restart Requirement sections for Windows 2000.
 
• V1.2 November 19, 2003: Updated Information Relating to the Windows XP Security Update.
 



Voilà donc les trois explications dirons nous suite aux messages d'erreurs données par Worms Door

cybernad · Answer

Re bonjour,

personne n'a d'idée ? 

Je suis dans la semoule et maintenant j'ai un soucis avec userinit.exe qui ne démarre pas.

Pour utiliser mon pc je dois lorsque mon bureau s'affiche vide seul le papier peint s'active faire ctrl alt del pour pouvoir executer des taches via le gestionnaire.

Aidez-moi svp sans devoir formater car je n'ai pas de système d'exploitation sous la main

Merci

mantis6521 · Answer

Pour ceux qui ont des problèmes avec Windows media player qui plante et message d'erreur indiv01.key
Allez dans C:\Documents and Settings\All Users\DRM\Cache

Et effacer tout ce qui se trouve dedans.

adama02 · Answer

en fait je te conseille de contacter ce monsieur. un as d'internet... Mengue Christian Ulrich . il pourra vous donnez  donner des explications. merci
son lien est 
https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fhome.php#/profile.php?id=1664400259

Ordinateur Lent + Mises à jour désactivées

31 réponses

Discussions similaires

Newsletters