Sujet Précédent Sujet Suivant

Mon ordi rame, aidez moi svp!

Fermé
John - 26 avril 2009 à 18:57
 John - 8 mai 2009 à 15:33
Bonjour,
Voila depuis quelques temps mon ordi rame severement par periodes, je ne comprends pas pourquoi, j'ai passé antivirus, antimalware sur ordi et DD externe, Ccleaner, défragmenté, sorti la batterie, c'est toujours pareil...
J'ai également passé une analyse Hijackthis, ToolbarSD ( et un nettoyage ), et RSIT, je peux copier les rapports au besoin.
merci de votre aide!
A voir également:

132 réponses

Précédent
Réponse 81 / 132
Utilisateur anonyme
1 mai 2009 à 18:32
ok pour avancer il y a du reste de rootkit dans ce pc

---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort.

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous :





:processes
explorer.exe

:services
Bonjour Service

:files
C:\ProgramData\is-7DHV3
C:\ProgramData\is-QT399
C:\ProgramData\is-IP2GH

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log
0
Réponse 82 / 132
Utilisateur anonyme
1 mai 2009 à 18:36
crapoulou selon C_XX Boonty serait devenu légitime
0
crapoulou Messages postés 28159 Date d'inscription mercredi 28 novembre 2007 Statut Modérateur, Contributeur sécurité Dernière intervention 17 mai 2024 7 990
1 mai 2009 à 18:41
Ah ok, c'est noté ! merci.
C'est pour ça qu'il ne le prend plus en comptez. Je te laisse terminer si tu veux.
Rootkit ces dossiers ?!
0
Réponse 83 / 132
John
1 mai 2009 à 18:37
Désinstaller des logiciels inutiles j'ai fait aussi, mais bon j'en avais pas installé de nouveaux avant que ca rame...
J'ai un ordi portable, c'est pareil au niveau de la poussière? Comme j'ai dis j'avais remarqué ( un peu avant qu'il rame ) qu'il chauffait bcp plus, comme j'ai la main dessus pour écrire
0
Réponse 84 / 132
Utilisateur anonyme
1 mai 2009 à 18:42
oui ce sont des references de services de rootkits si je me souviens bien j'en ai deja vu pas mal dans les rsit à rootkits ;)
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 85 / 132
John
1 mai 2009 à 18:54
Voici le rapport :

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Service\Driver Bonjour Service not found.
Unable to delete service\driver keyBonjour Service.
========== FILES ==========
Folder move failed. C:\ProgramData\is-7DHV3 scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\is-QT399 scheduled to be moved on reboot.
Folder move failed. C:\ProgramData\is-IP2GH scheduled to be moved on reboot.
========== COMMANDS ==========
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\etilqs_PslAnQJfPblsU5akFlnr scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\fla17D7.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\fla2502.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\RtkBtMnt.exe scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DF4129.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DF4138.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DFC1F.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DFC29.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
File delete failed. C:\Windows\temp\fwtsqmfile00.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\fwtsqmfile01.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\fwtsqmfile02.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\fwtsqmfile03.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\fwtsqmfile04.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\fwtsqmfile05.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\fwtsqmfile06.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\fwtsqmfile07.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\fwtsqmfile08.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\fwtsqmfile09.sqm scheduled to be deleted on reboot.
File delete failed. C:\Windows\temp\fwtsqmfile10.sqm scheduled to be deleted on reboot.
Windows Temp folder emptied.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05012009_184529
0
Réponse 86 / 132
Utilisateur anonyme
1 mai 2009 à 19:00
ok relances otmoveit avec clic droit "executer en tant qu'admin......."

antivirus désactivé stp
0
Réponse 87 / 132
John
1 mai 2009 à 19:03
Je fais ca et je poste le rapport de suite!
Sinon pour ma question au niveau de la poussière? ^^
0
Réponse 88 / 132
John
1 mai 2009 à 19:08
Rapport :

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Service\Driver Bonjour Service stopped successfully.
Service\Driver Bonjour Service deleted successfully.
========== FILES ==========
C:\ProgramData\is-7DHV3 moved successfully.
C:\ProgramData\is-QT399 moved successfully.
C:\ProgramData\is-IP2GH moved successfully.
========== COMMANDS ==========
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\etilqs_eOsVO6pMPMH7SzNHFKyd scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\RtkBtMnt.exe scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DF5C49.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DF5D20.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DFA8DE.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DFAF3F.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
Windows Temp folder emptied.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05012009_190254

Files moved on Reboot...
File C:\Users\MICHAL~1\AppData\Local\Temp\etilqs_eOsVO6pMPMH7SzNHFKyd not found!
C:\Users\MICHAL~1\AppData\Local\Temp\RtkBtMnt.exe moved successfully.
File C:\Users\MICHAL~1\AppData\Local\Temp\~DF5C49.tmp not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\~DF5D20.tmp not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\~DFA8DE.tmp not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\~DFAF3F.tmp not found!
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_001_ moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_002_ moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_003_ moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_MAP_ moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\urlclassifier3.sqlite moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\XUL.mfl moved successfully.
0
Réponse 89 / 132
Utilisateur anonyme
1 mai 2009 à 19:19
pour la poussiere tu peux aller "souffler" par les trous de ventilation (pas où est le ventilo) dans une station service de loin

pour le reste redemarre puis renvoie un rsit avant de ta connecter sur internet et msn
0
Réponse 90 / 132
John
1 mai 2009 à 19:24
Pour la poussiere tu peux aller "souffler" par les trous de ventilation (pas où est le ventilo) dans une station service de loin
Euh, dans une station service? x)
Ma connexion se fait automatiquement et instantanément, je sais pas cmt l'empecher?
0
Réponse 91 / 132
Utilisateur anonyme
1 mai 2009 à 19:32
dans une station service? x)

oui y a des souffleurs :)

Ma connexion se fait automatiquemen = oui non mais je veux dire avant d'ouvrir une page ou msn
0
Réponse 92 / 132
John
1 mai 2009 à 19:40
Est-ce qu'un compresseur ( de tres loin ^^ ) ferait l'affaire ?

Rapport RSIT :


Logfile of random's system information tool 1.06 (written by random/random)
Run by Michaël at 2009-05-01 19:38:19
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 26 GB (36%) free of 71 GB
Total RAM: 3069 MB (72% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:39:07, on 01/05/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18226)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\d3dlib.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\Michaël\Logiciels Mica\RSIT.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
F:\C'est Mica\Logiciels Mica\Antivirus\Michaël.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\MICHAL~1\AppData\Local\Temp\RtkBtMnt.exe
C:\Windows\System32\rundll32.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [PLFSetL] C:\Windows\PLFSetL.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DXlibrary] C:\Windows\system32\d3dlib.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - F:\Common\Database\bin\fbserver.exe (file missing)
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Users\Michaël\Logiciels Mica\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
0
Réponse 93 / 132
Utilisateur anonyme
1 mai 2009 à 20:01
Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
- Coche Afficher les fichiers et dossiers cachés
- Décoche Masquer les extensions des fichiers dont le type est connu
- Décoche Masquer les fichiers protégés du système d'exploitation (recommandé)
clique sur Appliquer, puis OK.

N'oublie pas de recacher à nouveau les fichiers cachés et protégés du système d'exploitation en fin de désinfection, c'est important

Fais analyser le(s) fichier(s) suivants sur Virustotal :

Virus Total

* Clique sur Parcourir en haut, choisis Poste de travail et cherche ce fichier :

C:\Windows\system32\drivers\a23d7odc.sys

* Clique maintenant sur Envoyer le fichier. et laisse travailler tant que "Situation actuelle : en cours d'analyse" est affiché.
* Il est possible que le fichier soit mis en file d'attente en raison d'un grand nombre de demandes d'analyses. En ce cas, il te faudra patienter sans actualiser la page.
* Lorsque l'analyse est terminée ("Situation actuelle: terminé"), clique sur Formaté
* Une nouvelle fenêtre de ton navigateur va apparaître
* Clique alors sur les deux fleches
* Fais un clic droit sur la page, et choisis Sélectionner tout, puis copier
* Enfin colle le résultat dans ta prochaine réponse.

ensuite :

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous :





:processes
explorer.exe

:files
C:\Windows\system32\d3dlib.exe

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"DXlibrary"=-

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log
0
Réponse 94 / 132
John
1 mai 2009 à 20:13
J'ai fait ce qu'il faut pour afficher les dossiers comme tu as dis mais impossible de trouver ce fichier, meme en copiant le raccourci indiquant ou il est!
0
Réponse 95 / 132
crapoulou Messages postés 28159 Date d'inscription mercredi 28 novembre 2007 Statut Modérateur, Contributeur sécurité Dernière intervention 17 mai 2024 7 990
1 mai 2009 à 20:16
S3 a23d7odc;a23d7odc; C:\Windows\system32\drivers\a23d7odc.sys []
Le fichier n'est pas là, c'est normal.
0
Réponse 96 / 132
John
1 mai 2009 à 20:17
D'accord, mais ou est-il donc? ^^
0
Réponse 97 / 132
Utilisateur anonyme
1 mai 2009 à 20:36
effectivement crapoulou etourderie de ma part , merci ....sans "signature"....pas de fichier

John passe à otmoveit stp
0
Réponse 98 / 132
John
1 mai 2009 à 21:09
Voici le rapport ;

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\Windows\system32\d3dlib.exe moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DXlibrary deleted successfully.
========== COMMANDS ==========
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\etilqs_XxNeBV3gSPyG8i8LEMB3 scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\fla8ED9.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\fla9956.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\RtkBtMnt.exe scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DF2032.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DF2150.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DFBFCC.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DFBFDD.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
Windows Temp folder emptied.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05012009_203959

Files moved on Reboot...
File C:\Users\MICHAL~1\AppData\Local\Temp\etilqs_XxNeBV3gSPyG8i8LEMB3 not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\fla8ED9.tmp not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\fla9956.tmp not found!
C:\Users\MICHAL~1\AppData\Local\Temp\RtkBtMnt.exe moved successfully.
File C:\Users\MICHAL~1\AppData\Local\Temp\~DF2032.tmp not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\~DF2150.tmp not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\~DFBFCC.tmp not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\~DFBFDD.tmp not found!
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_001_ moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_002_ moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_003_ moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_MAP_ moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\urlclassifier3.sqlite moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\XUL.mfl moved successfully.
0
Réponse 99 / 132
John
1 mai 2009 à 21:11
Ah j'avais pas désactivé l'antivirus...
je refais ><
0
Réponse 100 / 132
John
1 mai 2009 à 21:12
Voici le rapport ;

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\Windows\system32\d3dlib.exe moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DXlibrary deleted successfully.
========== COMMANDS ==========
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\etilqs_XxNeBV3gSPyG8i8LEMB3 scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\fla8ED9.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\fla9956.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\RtkBtMnt.exe scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DF2032.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DF2150.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DFBFCC.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\MICHAL~1\AppData\Local\Temp\~DFBFDD.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
Windows Temp folder emptied.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05012009_203959

Files moved on Reboot...
File C:\Users\MICHAL~1\AppData\Local\Temp\etilqs_XxNeBV3gSPyG8i8LEMB3 not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\fla8ED9.tmp not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\fla9956.tmp not found!
C:\Users\MICHAL~1\AppData\Local\Temp\RtkBtMnt.exe moved successfully.
File C:\Users\MICHAL~1\AppData\Local\Temp\~DF2032.tmp not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\~DF2150.tmp not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\~DFBFCC.tmp not found!
File C:\Users\MICHAL~1\AppData\Local\Temp\~DFBFDD.tmp not found!
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_001_ moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_002_ moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_003_ moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\Cache\_CACHE_MAP_ moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\urlclassifier3.sqlite moved successfully.
C:\Users\Michaël\AppData\Local\Mozilla\Firefox\Profiles\5w0gnbtn.default\XUL.mfl moved successfully.
0

Discussions similaires

Mon pc s'allume et s'éteint en boucle
Jack -
Daniel -

16 réponses