Ultimate cleaner

Bonjour, j'aurais besoin d'aide pour supprimer ultimate cleaner de mon pc.merci d'avance
Configuration: Windows XP
Internet Explorer 7.0

4 réponses

  1. Contributeur sécurité
    re, juste une remarque tu utilises quoi comme anti-virus car la il y a bitdéfender et norton tu en as un de trop car avec deux anti-virus tu risques de planter le pc du jour au lendemain sans comprendre ce qui t'arrive
    1. Modérateur
      Beaucoup de saletés !

      Télécharger ComboFix (par sUBs) sur le Bureau : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

      * Démarrer en mode sans echec
      * Double cliquer combofix.exe.
      * Appuyer sur la touche Y (Yes) pour démarrer le scan
      * Le rapport sera crée dans: C:\Combofix.txt, poste le stp

      ++
      1. Contributeur sécurité
        bonjour, passes smitfraudfix recherche en mode normal mais nettoyage en mode sans echec et postes un hijackthis http://siri.urz.free.fr/Fix/SmitfraudFix.php
        mettre un rapport hijackthis
        comment l'installer: http://pageperso.aol.fr/balltrap34/Hijenr.gif
        le télécharger: http://www.merijn.org/files/hijackthis.zip
        pour le rapport et fixer les lignes: http://pageperso.aol.fr/balltrap34/demohijack.htm
        mais avant de le lancer pour analyse rends toi sur ton pc ici : C:\Program Files\Hijackthis\HijackThis.exe <--- clik droit sur ce dernier et choisis "renommer" : tapes monjack et valide .
        !!Déconnectes toi et fermes toute tes applications en cours !!
        Double clik sur le raccourci du bureau,
        Fais un scan monjack (ou HijackThis renommé) et postes le rapport générer pour analyse ...
        car certaine infection se planque d'hijackthis
        1. Modérateur
          Salut

          Télécharge ceci :

          Lien : http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

          Tuto : http://pageperso.aol.fr/balltrap34/demohijack.htm

          Choisir l'option "do a scan and a logfile", et faire un copier/coller du rapport ainsi générer sur le forum.

          ++
          1. je ne suis pas tres doué je pensLogfile of Trend Micro HijackThis v2.0.2
            Scan saved at 19:06: VIRUS ALERT!, on 30/06/2007
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.6000.16640)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\csrss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
            C:\WINDOWS\Explorer.EXE
            C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
            C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
            C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
            C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
            C:\WINDOWS\system32\nvsvc32.exe
            C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
            C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
            C:\Program Files\Logitech\Profiler\lwemon.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\WINDOWS\system32\HPZipm12.exe
            C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
            C:\WINDOWS\system32\PnkBstrA.exe
            C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe
            C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
            C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
            C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
            C:\WINDOWS\system32\wbem\wmiapsrv.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\wscntfy.exe
            C:\WINDOWS\System32\alg.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\rundll32.exe
            C:\Program Files\Orange\Launcher\Launcher.exe
            C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe
            C:\Program Files\Orange\connectivity\connectivitymanager.exe
            C:\Program Files\Orange\systray\systrayapp.exe
            C:\Program Files\Orange\connectivity\CoreCom\CoreCom.exe
            C:\Program Files\Orange\connectivity\CoreCom\OraConfigRecover.exe
            C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\Program Files\Internet Explorer\iexplore.exe
            C:\Documents and Settings\moustache\Bureau\HiJackThis.exe
            C:\WINDOWS\system32\wbem\wmiprvse.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://resultsmaster.com/...
            R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Orange\SearchURLHook\SearchPageURL.dll
            O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
            O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
            O2 - BHO: (no name) - {3A49B63B-4EF2-4346-A35B-D038B8FCF3FD} - C:\WINDOWS\system32\ssqNEWno.dll
            O2 - BHO: (no name) - {48F0B738-34A6-4113-B966-33C4EF85BCD9} - C:\WINDOWS\system32\urqnMcYS.dll
            O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
            O2 - BHO: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Hotbar\bin\10.2.196.0\HostIE.dll (file missing)
            O2 - BHO: QXK Olive - {B33B96B9-E0C2-4648-9819-A38DDCAFA33C} - C:\WINDOWS\boqnrwdmstg.dll (file missing)
            O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\2.bin\ASKTBAR.DLL (file missing)
            O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\2.bin\ASKTBAR.DLL (file missing)
            O3 - Toolbar: Hotbar - {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - C:\Program Files\Hotbar\bin\10.2.196.0\HostIE.dll (file missing)
            O3 - Toolbar: atfxqogp - {9E6CD9DF-5EF9-40F4-84FA-C4842EB1F283} - C:\WINDOWS\atfxqogp.dll
            O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
            O4 - HKLM\..\Run: [advap32] C:\DOCUME~1\MOUSTA~1\LOCALS~1\Temp\rbnpsrv.exe/r
            O4 - HKLM\..\Run: [SBI] C:\Documents and Settings\moustache\Local Settings\Temporary Internet Files\Content.IE5\8UQS5JEW\install_sbd_fr[1].exe
            O4 - HKLM\..\Run: [ugac] "C:\PROGRA~1\FICHIE~1\ANTIVI~1\ugac.exe" -start
            O4 - HKLM\..\Run: [BMN] "C:\Program Files\Fichiers communs\AntivirusFiable\bm.exe" dm=http://antivirusfiable.com ad=http://antivirusfiable.com sd=http://gregistre.antivirusfiable.com
            O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
            O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
            O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
            O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
            O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui
            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Policies\Explorer\Run: [Windows Security Tool] WinSecure.exe
            O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
            O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
            O4 - Global Startup: Acer Empowering Technology.lnk = ?
            O4 - Global Startup: Acer WLAN 11g USB Dongle.lnk = C:\Program Files\Acer WLAN 11g USB Dongle\ZDWlan.exe
            O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
            O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
            O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O15 - Trusted Zone: https://www.orange.fr/portail
            O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab
            O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - https://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
            O16 - DPF: {87AF076E-D86D-4E87-ADDD-F05804E1F150} - https://www.virginmega.fr/DownloadManager/Release/Prod/DownMan.cab
            O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin3.valueactive.com/Register/Branding/olr3313/OCX/v1018/flashax.cab
            O16 - DPF: {DFB5BCF1-06AE-4ABB-BFA8-1E228F41C50A} (CamfrogWEB Advanced Unicode Control) - https://www.bobtv.fr/download/cfweb_www.bobtv.fr-download_instmodule.exe
            O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15035/CTPID.cab
            O17 - HKLM\System\CCS\Services\Tcpip\..\{7779D19C-B1EC-4181-BF7D-417053996405}: NameServer = 208.67.220.220,208.67.222.222
            O17 - HKLM\System\CCS\Services\Tcpip\..\{8617A672-6BE7-4A67-AD48-90C0E8EB06A6}: NameServer = 208.67.220.220,208.67.222.222
            O17 - HKLM\System\CCS\Services\Tcpip\..\{F8872FE0-9976-4E3C-B6EB-0C37C2D26803}: NameServer = 208.67.220.220,208.67.222.222
            O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
            O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
            O20 - Winlogon Notify: urqnMcYS - C:\WINDOWS\SYSTEM32\urqnMcYS.dll
            O21 - SSODL: vregfwlx - {DC729353-40B5-40EA-BE4A-8E7AE0A8C514} - C:\WINDOWS\vregfwlx.dll
            O21 - SSODL: vltdfabw - {B96B5887-B0B8-40CD-A451-5F757D90FCFE} - C:\WINDOWS\vltdfabw.dll (file missing)
            O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
            O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
            O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
            O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
            O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
            O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
            O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
            O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
            O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Fichiers communs\BitDefender\BitDefender Update Service\livesrv.exe
            O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
            O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
            O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
            O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
            O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
            O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
            O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Fichiers communs\BitDefender\BitDefender Communicator\xcommsvr.exe