Ultimate cleaner

Bonjour, j'aurais besoin d'aide pour supprimer ultimate cleaner de mon pc.merci d'avance
Configuration: Windows XP
Internet Explorer 7.0

4 réponses

  1. Modérateur
    Beaucoup de saletés !

    Télécharger ComboFix (par sUBs) sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    * Démarrer en mode sans echec
    * Double cliquer combofix.exe.
    * Appuyer sur la touche Y (Yes) pour démarrer le scan
    * Le rapport sera crée dans: C:\Combofix.txt, poste le stp

    ++
    1. Modérateur
      Salut

      Télécharge ceci :

      Lien : http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

      Tuto : http://pageperso.aol.fr/balltrap34/demohijack.htm

      Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum.

      ++
      1. je ne suis pas tres doué je pensLogfile of Trend Micro HijackThis v2.0.2
        Scan saved at 19:06: VIRUS ALERT!, on 30/06/2007
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16640)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\csrss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
        C:\WINDOWS\Explorer.EXE
        C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
        C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
        C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\Program Files\Logitech\Profiler\lwemon.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\WINDOWS\system32\HPZipm12.exe
        C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
        C:\WINDOWS\system32\PnkBstrA.exe
        C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
        C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
        C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
        C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
        C:\WINDOWS\system32\wbem\wmiapsrv.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\wscntfy.exe
        C:\WINDOWS\System32\alg.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Orange\Launcher\Launcher.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
        C:\Program Files\Orange\connectivity\connectivitymanager.exe
        C:\Program Files\Orange\systray\systrayapp.exe
        C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
        C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
        C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Program Files\Internet Explorer\iexplore.exe
        C:\Documents and Settings\moustache\Bureau\HiJackThis.exe
        C:\WINDOWS\system32\wbem\wmiprvse.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://resultsmaster.com/...
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
        O2 - BHO: (no name) - {3A49B63B-4EF2-4346-A35B-D038B8FCF3FD} - C:\WINDOWS\system32\ssqNEWno.dll
        O2 - BHO: (no name) - {48F0B738-34A6-4113-B966-33C4EF85BCD9} - C:\WINDOWS\system32\urqnMcYS.dll
        O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
        O2 - BHO: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Hotbar\bin\10.2.196.0\HostIE.dll (file missing)
        O2 - BHO: QXK Olive - {B33B96B9-E0C2-4648-9819-A38DDCAFA33C} - C:\WINDOWS\boqnrwdmstg.dll (file missing)
        O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\2.bin\ASKTBAR.DLL (file missing)
        O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\2.bin\ASKTBAR.DLL (file missing)
        O3 - Toolbar: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Hotbar\bin\10.2.196.0\HostIE.dll (file missing)
        O3 - Toolbar: atfxqogp - {9E6CD9DF-5EF9-40F4-84FA-C4842EB1F283} - C:\WINDOWS\atfxqogp.dll
        O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\MOUSTA~1\LOCALS~1\Temp\rbnpsrv.exe/r
        O4 - HKLM\..\Run: [SBI] C:\Documents and Settings\moustache\Local Settings\Temporary Internet Files\Content.IE5\8UQS5JEW\install_sbd_fr[1].exe
        O4 - HKLM\..\Run: [ugac] "C:\PROGRA~1\FICHIE~1\ANTIVI~1\ugac.exe" -start
        O4 - HKLM\..\Run: [BMN] "C:\Program Files\Fichiers communs\AntivirusFiable\bm.exe" dm=http://antivirusfiable.com ad=http://antivirusfiable.com sd=http://gregistre.antivirusfiable.com
        O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
        O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
        O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Policies\Explorer\Run: [Windows Security Tool] WinSecure.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O4 - Global Startup: Acer Empowering Technology.lnk = ?
        O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
        O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
        O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O15 - Trusted Zone: https://www.orange.fr/portail
        O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab
        O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
        O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
        O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
        O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
        O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15035/CTPID.cab
        O17 - HKLM\System\CCS\Services\Tcpip\..\{7779D19C-B1EC-4181-BF7D-417053996405}: NameServer = 208.67.220.220,208.67.222.222
        O17 - HKLM\System\CCS\Services\Tcpip\..\{8617A672-6BE7-4A67-AD48-90C0E8EB06A6}: NameServer = 208.67.220.220,208.67.222.222
        O17 - HKLM\System\CCS\Services\Tcpip\..\{F8872FE0-9976-4E3C-B6EB-0C37C2D26803}: NameServer = 208.67.220.220,208.67.222.222
        O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
        O20 - Winlogon Notify: urqnMcYS - C:\WINDOWS\SYSTEM32\urqnMcYS.dll
        O21 - SSODL: vregfwlx - {DC729353-40B5-40EA-BE4A-8E7AE0A8C514} - C:\WINDOWS\vregfwlx.dll
        O21 - SSODL: vltdfabw - {B96B5887-B0B8-40CD-A451-5F757D90FCFE} - C:\WINDOWS\vltdfabw.dll (file missing)
        O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
        O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
        O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
        O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
        O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
        O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
        O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
    2. Contributeur sécurité
      bonjour, passes smitfraudfix recherche en mode normal mais nettoyage en mode sans echec et postes un hijackthis http://siri.urz.free.fr/Fix/SmitfraudFix.php
      mettre un rapport hijackthis
      comment l'installer: http://pageperso.aol.fr/balltrap34/Hijenr.gif
      le télécharger: http://www.merijn.org/files/hijackthis.zip
      pour le rapport et fixer les lignes: http://pageperso.aol.fr/balltrap34/demohijack.htm
      mais avant de le lancer pour analyse rends toi sur ton pc ici : C:\Program Files\Hijackthis\HijackThis.exe <--- clik droit sur ce dernier et choisis "renommer" : tapes monjack et valide .
      !!Déconnectes toi et fermes toute tes applications en cours !!
      Double clik sur le raccourci du bureau,
      Fais un scan monjack (ou HijackThis renommé) et postes le rapport générer pour analyse ...
      car certaine infection se planque d'hijackthis
      1. Contributeur sécurité
        re, juste une remarque tu utilises quoi comme anti-virus car la il y a bitdéfender et norton tu en as un de trop car avec deux anti-virus tu risques de planter le pc du jour au lendemain sans comprendre ce qui t'arrive