remove the RECYCLER.exe virus Closed

Question

Hello,
please I have a problem with the RECYCLER.exe virus.
When I sent a folder from my PC to my flash drive which was empty before, I found a folder called RECYCLER.exe. It told me it was a virus; I scanned my flash drive but the antivirus didn't detect any viruses, which is strange. And since I copied the folder from my PC, it means this virus is inside, but when I did a full scan, I found nothing.
It told me to show hidden folders by using Control Panel --> Folder Options --> Show hidden files and folders, but the folders remain hidden and when I go back to the folder options, I find the option to show hidden files and folders disabled. I don't know why this problem exists and I can't solve it.
Please help me to destroy this virus and if you have other ideas, please let me know.
Thanks in advance.

Configuration: Windows XP Internet Explorer 7.0

jlpjlp · Accepted Answer

Hey there

No panic
C_XX & Chiquitine29 have created what you need!

Download and install UsbFix from C_XX & Chiquitine29

Connect your external data sources to your PC (USB stick, external hard drive, etc...) that may have been infected without opening them

# Double click on the UsbFix shortcut present on your desktop.

# Choose option 1 (Search)

# Let the tool work.

# Then post the UsbFix.txt report that will appear.

# Note: The UsbFix.txt report is saved at the root of the drive. (C:\UsbFix.txt)

(CTRL+A to select all, CTRL+C to copy and CTRL+V to paste)

# Note: "Process.exe", a component of the tool, is detected by some antivirus software (AntiVir, Dr.Web, Kaspersky Anti-Virus) as a RiskTool.
It is not a virus, but a utility designed to terminate processes.
In the wrong hands, this utility could stop security software (Antivirus, Firewall...) hence the alert issued by these antivirus programs.

fix200 · Answer

Hello,
Please avoid SMS language,

Then,

▶ Download UsbFix from C_XX & Chiquitine29 & Chimay8

▶ Installation tutorial

▶ Search tutorial

▶ Start the installation with the default settings

▶ Connect your external data sources to your PC (USB flash drive, external hard drive, etc.) that may have been infected (!) without opening them (!)

▶ Double-click the UsbFix shortcut on your desktop

▶ Choose option 1 (search)

▶ Let the tool work

▶ Then post the UsbFix.txt report that will appear

Notes:
1- The UsbFix.txt report is saved at the root of the drive

2- If the Desktop does not reappear, press Ctrl + Alt + Delete, Tab "File", "New task", type explorer.exe and confirm

3- "Process.exe", a component of the tool, is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky Anti-Virus) as a RiskTool.
It is not a virus, but a utility designed to terminate processes.
In the wrong hands, this utility could stop security software (Antivirus, Firewall...) which is why these antivirus programs issue an alert.

--
A subject that is marked "unresolved" is like someone shopping at the store without paying...
So, please remember to mark your subject as RESOLVED

jlpjlp · Answer

stick the report

faheyv · Answer

Hi!
It's easy, just read and follow these instructions:
1- work station>tools>folder options>view>show: hidden folders, known file extensions, protected files then apply and OK

2- you enter the folder where your system is located and launch the "Search" tab and type "EXE" and hit "search" and there will be many .EXE files displayed.

3-To recognize the type of Virus that is active on your PC, you open the task manager "control-alt-delete" and display all the processes in use

4-Once the task manager is displayed, you need to stop the process corresponding to a file written entirely in uppercase, such as "3ACDE4.EXE" or something like that because it is the virus recycle.exe in person

5-After that you go back to the search you performed in step 2 and delete ("Shift+Delete") "3ACDE4.EXE" and that's it, it's done

Then you restart your PC and that's it. To check for the absence of this type of virus, you open the task manager and normally there will no longer be 3ACDE4.EXE or anything like that, and your PC is clean!

It's a bit long, but that's how it works!

If you want more advice, you can write to me at my email "faheyv@yahoo.fr"
Ok
See you!

Typhonx · Answer

Thank you!! This site always does wonders!!

Ora · Answer

Is RECYCLER written in uppercase in XP the virus? It seems to combine with Doc. & Setting, a menu... 32, and a fourth one whose name I’ve forgotten. Please let me know if I need to refresh the BIOS since I reinstalled XP and it reappears. Ora

jlpjlp · Answer

Hi, it's an infection that spreads through external drives (USB sticks, external hard drives...) so even after formatting, if you reconnect an infected external drive to the PC, it will be affected again...

We need you to provide a research report using USBFix as explained above.

chkzchk · Answer

thank you..........good

seralus · Answer

############################## | UsbFix 7.057 | [Search]

User: Kevin (Administrator) # KEVIN-PC [Packard Bell EasyNote LM98]
Updated on 08/17/2011 by El Desaparecido
Launched at 11:10:31 | 08/25/2011
Website: http://www.teamxscript.org
Submit your sample: http://www.teamxscript.org/Upload.php
Contact: TeamXscript.ElDesaparecido@gmail.com

CPU: Intel(R) Core(TM) i3 CPU M 350 @ 2.27GHz
CPU 2: Intel(R) Core(TM) i3 CPU M 350 @ 2.27GHz
Microsoft Windows 7 Home Premium Edition (6.1.7601 64-Bit) # Service Pack 1
Internet Explorer 8.0.7601.17514

Windows Firewall: Disabled /!\
RAM -> 3957 MB
C:\ (%systemdrive%) -> Local Disk # 453 GB (295 GB free - 65%) [Packard Bell] # NTFS
D:\ -> CD-ROM
E:\ -> Local Disk # 466 GB (89 GB free - 19%) [Michou] # NTFS
F:\ -> CD-ROM

################## | Infectious Elements |

Present! E:\film.lnk
Present! E:\Jeux.lnk
Present! E:\malcolm.lnk
Present! E:\Musique.lnk
Present! E:\Virtual DJ Pro 7 & Serial.lnk
Present! D:\Autorun.inf
Present! D:\autorun.exe

################## | Registry |

################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\{5b46a07a-b797-11df-8f98-206a8a0086d1}
Shell\AutoRun\Command = F:\setup.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{a374b907-78bd-11df-a7dc-806e6f6e6963}
Shell\AutoRun\Command = D:\autorun.exe
Shell\setup\Command = D:\install.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{c996a5bc-7bf5-11e0-98ab-207c8f061aff}
Shell\AutoRun\Command = E:\Setup.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{d54d290f-5aa8-11e0-aabf-207c8f061aff}
Shell\AutoRun\Command = "E:\WD SmartWare.exe" autoplay=true

################## | Vaccine |

D:\Autorun.inf -> Vaccine created by Panda USB Vaccine

################## | E.O.F |

seralus · Answer

Thank you for helping me, I have the same problem!!

jlpjlp · Answer

get to the cleaning

Goulier09 · Answer

Internet Explorer 8.0.7600.16385

RAM -> 2047 MB
C:\ (%systemdrive%) -> Hard drive # 149 GB (10 GB free - 7%) [] # NTFS
D:\ -> CD-ROM
F:\ -> Removable drive # 15 GB (3 GB free - 20%) [] # FAT32
J:\ -> Hard drive # 931 GB (37 GB free - 4%) [LaCie] # FAT32

################## | Infectious items |

Present! C:\Users\FM\AppData\Roaming\8C19.tmp
Present! C:\Users\FM\AppData\Roaming\B9EC.tmp
Present! C:\Users\FM\AppData\Roaming\BD5D.tmp
Present! C:\Users\FM\AppData\Roaming\D0C9.tmp
Present! C:\Users\FM\AppData\Roaming\E659.tmp
Present! F:\DCIM.lnk
Present! J:\System Volume Information.lnk
Present! J:\FOUND.000.lnk
Present! J:\UPDATE.lnk
Present! J:\.Trashes.lnk
Present! J:\Recycled.lnk
Present! J:\.fseventsd.lnk
Present! J:\$RECYCLE.BIN.lnk
Present! J:\.Spotlight-V100.lnk
Present! J:\- ART -.lnk
Present! J:\- GEEK -.lnk
Present! J:\- LIFE -.lnk
Present! J:\Lightroom v3.0.lnk
Present! F:\Recycler\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx
Present! F:\Recycler\R-1-5-21-1482476501-1644491937-682003330-1013\acleaner.exe
Present! F:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665
Present! F:\RECYCLER\R-1-5-21-1482476501-1644491937-682003330-1013

################## | Registry |

Present! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoRecentDocsHistory
Present! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoRecentDocsMenu
Present! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoRecycleFiles
Present! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoResolveSearch
Present! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoSMHelp
Present! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoWinKeys

################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\{49fce0a7-3f32-11df-a771-806e6f6e6963}
Shell\AutoRun\Command = E:\LaunchU3.exe -a

################## | Vaccine |

(!) This computer is not vaccinated!

################## | E.O.F |

Thank you in advance for helping me with this task, I have 1 terabyte of photos at stake ^^. I don't usually use IE, but the virus does ^^

nockurn · Answer

############################## | UsbFix 7.057 | [Search]

User: Kevin (Administrator) # KEVIN-PC [Packard Bell EasyNote LM98]
Updated on 08/17/2011 by El Desaparecido
Launched at 11:10:31 | 08/25/2011
Website: http://www.teamxscript.org
Submit your sample: http://www.teamxscript.org/Upload.php
Contact: TeamXscript.ElDesaparecido@gmail.com

CPU: Intel(R) Core(TM) i3 CPU M 350 @ 2.27GHz
CPU 2: Intel(R) Core(TM) i3 CPU M 350 @ 2.27GHz
Microsoft Windows 7 Home Premium Edition (6.1.7601 64-Bit) # Service Pack 1
Internet Explorer 8.0.7601.17514

Windows Firewall: Disabled /!\
RAM -> 3957 MB
C:\ (%systemdrive%) -> Local Disk # 453 GB (295 GB free - 65%) [Packard Bell] # NTFS
D:\ -> CD-ROM
E:\ -> Local Disk # 466 GB (89 GB free - 19%) [Michou] # NTFS
F:\ -> CD-ROM

################## | Infectious Elements |

Present! E:\film.lnk
Present! E:\Jeux.lnk
Present! E:\malcolm.lnk
Present! E:\Musique.lnk
Present! E:\Virtual DJ Pro 7 & Serial.lnk
Present! D:\Autorun.inf
Present! D:\autorun.exe

################## | Registry |

################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\{5b46a07a-b797-11df-8f98-206a8a0086d1}
Shell\AutoRun\Command = F:\setup.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{a374b907-78bd-11df-a7dc-806e6f6e6963}
Shell\AutoRun\Command = D:\autorun.exe
Shell\setup\Command = D:\install.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{c996a5bc-7bf5-11e0-98ab-207c8f061aff}
Shell\AutoRun\Command = E:\Setup.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{d54d290f-5aa8-11e0-aabf-207c8f061aff}
Shell\AutoRun\Command = "E:\WD SmartWare.exe" autoplay=true

################## | Vaccine |

D:\Autorun.inf -> Vaccine created by Panda USB Vaccine

################## | E.O.F |

julie89 · Answer

I have the same issue with the card of my Olympus camera LENS.
I can see my photos when I view them on the camera, but when I try to read the card with a PC to recover them, a RECYCLER folder has appeared on my card containing only one file: 4f883.exe and not my photos.
The UsbFix link mentioned earlier doesn't work anymore!!!!

jlpjlp · Answer

type usbfix in google and you'll get the link

julie89 · Answer

Thank you. Here is the report

############################## | UsbFix V 7.089 | [Search]

User: cw (Administrator) # CW-VAIO
Updated on 09/06/2012 by El Desaparecido
Started at 13:32:38 | 18/06/2012

Website: https://www.sosvirus.net/
Forum: http://forum.eldesaparecido.com
Suspicious file? : http://eldesaparecido.com/upload.php
Contact: contact@eldesaparecido.com

PC: Sony Corporation (VGN-NW21EF_S) (x64-based PC) # Notebook
CPU: Pentium(R) Dual-Core CPU T4300 @ 2.10GHz (2100)
RAM -> [Total : 4063 | Free : 1916]
BIOS: BIOS Date: 05/09/08 11:12:06 Ver: 08.00.10
BOOT: Normal boot

OS: Microsoft Windows 7 Home Premium Edition (6.1.7601 64-Bit) # Service Pack 1
WB: Windows Internet Explorer 9.0.8112.16421

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AV: avast! Antivirus [(!) Disabled | Updated]
FW: Windows Firewall Service [Enabled]

C:\ (%systemdrive%) -> Fixed Disk # 289 GB (116 GB free - 40%) [] # NTFS
D:\ -> Removable Disk # 4 GB (4 GB free - 98%) [] # FAT32
F:\ -> CD-ROM

################## | Active Processes |

C:\Windows\system32\csrss.exe (540)
C:\Windows\system32\wininit.exe (612)
C:\Windows\system32\csrss.exe (624)
C:\Windows\system32\services.exe (668)
C:\Windows\system32\winlogon.exe (700)
C:\Windows\system32\lsass.exe (712)
C:\Windows\system32\lsm.exe (720)
C:\Windows\system32\svchost.exe (848)
C:\Windows\system32\svchost.exe (940)
C:\Windows\system32\atiesrxx.exe (988)
C:\Windows\System32\svchost.exe (384)
C:\Windows\System32\svchost.exe (436)
C:\Windows\system32\svchost.exe (536)
C:\Windows\system32\svchost.exe (1112)
C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe (1176)
C:\Windows\system32\atieclxx.exe (1192)
C:\Windows\system32\svchost.exe (1312)
C:\Windows\System32\spoolsv.exe (1564)
C:\Windows\system32\svchost.exe (1604)
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (1748)
C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe (1780)
C:\Program Files (x86)\Ciel\Ciel Pilotage\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe (1848)
C:\Program Files (x86)\SFR\3G Connection Manager\SFRABCDService.exe (1908)
C:\Windows\system32\svchost.exe (1948)
C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (1980)
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (1396)
C:\Program Files\Sony\VAIO Power Management\SPMService.exe (784)
C:\Windows\SysWOW64\DllHost.exe (1156)
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (2108)
C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe (2288)
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe (2316)
C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (2360)
C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (2420)
C:\Windows\System32\svchost.exe (2448)
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe (2516)
C:\Windows\system32\taskhost.exe (2964)
C:\Windows\system32\Dwm.exe (1808)
C:\Windows\Explorer.EXE (3032)
C:\Windows\system32\taskeng.exe (3240)
C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe (3272)
C:\Program Files\Apoint\Apoint.exe (3456)
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (3464)
C:\Program Files\Java\jre6\bin\jusched.exe (3500)
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (3512)
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (3524)
C:\Program Files\Apoint\ApMsgFwd.exe (3540)
C:\Program Files (x86)\Gadwin Systems\PrintScreen\PrintScreen.exe (3548)
C:\Windows\splwow64.exe (3580)
C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe (3616)
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (3696)
C:\Program Files\Apoint\Apntex.exe (3788)
C:\Program Files\Apoint\Apvfb.exe (3796)
C:\Program Files (x86)\SAGEM\SAGEM F@st 800-840\dslmon.exe (3804)
C:\Program Files (x86)\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe (3840)
C:\Windows\system32\conhost.exe (3856)
C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (4028)
C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe (3176)
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (3192)
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (3344)
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (3740)
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (3488)
C:\Program Files (x86)\Mozilla Firefox\firefox.exe (924)
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (2692)
C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\FOXIT READER.EXE (3764)
C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe (3084)
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe (4340)
C:\Windows\system32\SearchIndexer.exe (4348)
C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (4512)
C:\Windows\system32\svchost.exe (4780)
C:\Windows\system32\WUDFHost.exe (4908)
C:\Program Files\Windows Media Player\wmpnetwk.exe (4932)
C:\Windows\System32\svchost.exe (1292)
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (4916)
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (4452)
C:\Windows\system32\svchost.exe (5736)
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (804)
C:\Windows\system32\rundll32.exe (5308)
C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe (1924)
C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\DeviceSetup.exe (4336)
C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE (5660)
C:\Windows\system32\taskeng.exe (7484)
C:\UsbFix\Go.exe (10068)
C:\Windows\system32\wbem\wmiprvse.exe (9988)
C:\Windows\system32\SearchProtocolHost.exe (10816)
C:\Windows\system32\SearchFilterHost.exe (10840)

################## | Infectious Items |

Present! D:\Recycler\desktop.ini

################## | Registry |

################## | Mountpoints2 |

HKCU\.\.\.\.\Explorer\MountPoints2\G
Shell\AutoRun\Command = G:\SFR.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{3c890ad7-05ec-11e1-9a6b-0024be42af4c}
Shell\AutoRun\Command = G:\LGAutoRun.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{448920fd-5db7-11df-aefb-0024be42af4c}
Shell\AutoRun\Command = G:\AutoRun.exe

HKCU\.\.\.\.\Explorer\MountPoints2\{6b4fdd6c-5db5-11df-a481-0024be42af4c}
Shell\AutoRun\Command = G:\AutoRun.exe

################## | Vaccine |

(!) This computer is not vaccinated!

################## | E.O.F |

julie89 · Answer

Sniff... Can nobody help me? Please!!!!

jlpjlp · Answer

stick to the deletion report but not much available  it would have been better to create your own topic

julie89 · Answer

Thank you, but actually yesterday I realized that no one was responding to me and I created my own topic.

jlpjlp · Answer

ok

a bit of reading to answer your questions here:

https://forums.commentcamarche.net/forum/affich-37636394-desinfecter-une-cle-usb-ou-un-disque-amovible

and continue on the other topic

see you later

kimboox4 · Answer

############################## | UsbFix V 7.100 | [Search]  User: root (Administrator) # ROOT-PC Updated on 11/11/2012 by El Desaparecido Launched at 23:03:47 | 22/11/2012  Website: https://www.sosvirus.net/ Contact: contact@eldesaparecido.com  PC: Gigabyte Technology Co., Ltd. (P41-ES3G) (X86-based PC CPU: Pentium(R) Dual-Core CPU E5400 @ 2.70GHz (2700) RAM -> [Total: 2046 | Free: 664] BIOS: Award Modular BIOS v6.00PG BOOT: Normal boot  OS: Microsoft Windows 7 Ultimate Edition (6.1.7600 32-Bit) # WB: Windows Internet Explorer 8.0.7600.16385  SC: Security Center Service [Enabled] WU: Windows Update Service [Enabled] AS: Windows Defender [Enabled | Updated] FW: Windows FireWall Service [Enabled]  C:\ (%systemdrive%) -> Fixed disk # 98 Go (61 Go free - 62%) [] # NTFS D:\ -> Fixed disk # 200 Go (49 Go free - 25%) [Local disk] # NTFS E:\ -> CD-ROM G:\ -> Removable disk # 2 Go (2 Go free - 100%) [KFAT3] # FAT32  ################## | Active Processes |  C:\Windows\system32\csrss.exe (396) C:\Windows\system32\wininit.exe (460) C:\Windows\system32\csrss.exe (472) C:\Windows\system32\winlogon.exe (504) C:\Windows\system32\services.exe (568) C:\Windows\system32\lsass.exe (584) C:\Windows\system32\lsm.exe (592) C:\Windows\system32\svchost.exe (696) C:\Windows\system32
vvsvc.exe (756) C:\Program Files\NVIDIA Corporation\3D Vision
vSCPAPISvr.exe (784) C:\Windows\system32\svchost.exe (824) C:\Windows\System32\svchost.exe (984) C:\Windows\System32\svchost.exe (1020) C:\Windows\system32\svchost.exe (1056) C:\Windows\system32\svchost.exe (1192) C:\Windows\system32\svchost.exe (1344) C:\Program Files\NVIDIA Corporation\Display
vxdsync.exe (1436) C:\Windows\system32
vvsvc.exe (1448) C:\Windows\System32\spoolsv.exe (1512) C:\Windows\system32\svchost.exe (1648) C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe (1728) C:\Program Files\Bonjour\mDNSResponder.exe (1772) C:\Windows\system32	askhost.exe (1948) C:\Windows\system32\Dwm.exe (2036) C:\Windows\Explorer.EXE (112) C:\Program Files\Mozilla Firefox\firefox.exe (404) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50ST7.EXE (452) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RP7.EXE (608) C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (716) C:\Program Files\NVIDIA Corporation
Tune
TuneService.exe (1288) C:\Program Files\Microsoft\BingBar\SeaPort.EXE (1384) C:\Windows\system32\svchost.exe (2024) C:\Program Files\NVIDIA Corporation
Tune
TuneCmd.exe (2328) C:\Program Files\Epson Software\Event Manager\EEventManager.exe (2492) C:\Windows\FixCamera.exe (2504) C:\Windows	snp325.exe (2540) C:\Windows\vsnp325.exe (2552) C:\Program Files\HSPA USB Modem\HSPALauncher.exe (2568) C:\Program Files\AutorunRemover\AutorunRemover.exe (2580) C:\Program Files\handyCafe\Filter Server\ipsrv.exe (2632) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (2660) C:\Program Files\Internet Download Manager\IDMan.exe (2860) C:\Windows\system32\svchost.exe (2884) C:\Program Files\Google\Drive\googledrivesync.exe (3204) C:\Program Files\Internet Download Manager\IEMonitor.exe (3212) C:\Windows\system32\SearchIndexer.exe (3364) C:\Windows\system32\svchost.exe (3536) C:\Windows\System32\svchost.exe (3736) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (3792) C:\Usersoot\AppData\Local\Akamai
etsession_win.exe (3852) C:\Usersoot\AppData\Local\Akamai
etsession_win.exe (3884) C:\Program Files\handyCafe\Filter Server\iplcln.exe (3896) C:\Windows\System32\spool\drivers\w32x86\3\E_FATIHJE.EXE (3920) C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (3956) C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe (3964) C:\Program Files\Windows Media Player\wmpnetwk.exe (2324) C:\Program Files\handyCafe\Filter Server\clnfw.exe (1796) C:\Program Files\Google\Drive\googledrivesync.exe (3028) C:\Program Files\NVIDIA Corporation\Display
vtray.exe (2436) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (5692) C:\Windows\System32\svchost.exe (5776) C:\Program Files\handyCafe\Server\hndserver.exe (5864) C:\Program Files\Google\Chrome\Application\chrome.exe (5072) C:\Program Files\Google\Chrome\Application\chrome.exe (2856) C:\Program Files\Google\Chrome\Application\chrome.exe (5140) C:\Program Files\Google\Chrome\Application\chrome.exe (1940) C:\Program Files\Google\Chrome\Application\chrome.exe (4652) C:\Program Files\Google\Chrome\Application\chrome.exe (1248) C:\Program Files\Google\Chrome\Application\chrome.exe (3664) C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (4844) C:\Program Files\Google\Chrome\Application\chrome.exe (5364) C:\Usersoot\AppData\Local\Temp\Rar$EX00.945\AutoRunExterminator.exe (2188) C:\Program Files\Google\Chrome\Application\chrome.exe (3864) C:\Program Files\Google\Chrome\Application\chrome.exe (932) C:\Program Files\Google\Chrome\Application\chrome.exe (2804) C:\Program Files\Google\Chrome\Application\chrome.exe (864) C:\Program Files\Google\Chrome\Application\chrome.exe (1904) C:\Windows\system32	askhost.exe (5944) C:\Program Files\Unlocker\UnlockerAssistant.exe (4020) C:\Program Files\Google\Chrome\Application\chrome.exe (3464) C:\Program Files\Google\Chrome\Application\chrome.exe (6024) C:\Windows\system32\WUDFHost.exe (2600) C:\UsbFix\Go.exe (3520) C:\Windows\system32\wbem\wmiprvse.exe (4672)  ################## | Infectious Items |  Present! C:\Usersoot\AppData\Local\Temp\_mdA987.tmp Present! C:\Usersoot\AppData\Local\Bron.tok-12-14 Present! C:\Usersoot\AppData\Local\ListHost12.txt Present! G:\Recycler\S-2-6-73-6471567841-2015484756-628076460-7036\*.cpl  ################## | Registry |  Present! HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\System|DisableRegistryTools Present! HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\policies\System|DisableRegistryTools Present! HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\System|DisableTaskMgr Present! HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\policies\System|DisableTaskMgr Present! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr  ################## | Mountpoints2 |  HKCU\.\.\.\.\Explorer\MountPoints2\{09beb098-2e8e-11e2-b4bd-6cf0497e0403} Shell\AutoRun\Command = F:\autorun.exe  HKCU\.\.\.\.\Explorer\MountPoints2\{e1053c50-2e42-11e2-8c31-6cf0497e0403} Shell\AutoRun\Command = F:\autorun.exe    ################## | Vaccine |  (!) This computer is not vaccinated!  ################## | E.O.F |

jlpjlp · Answer

remove with usbfix and paste the obtained report  then download malwarebyte antimalware, update it and paste a complete analysis report with it

lilasoso89 · Answer

############################## | UsbFix V 7.102 | [Search]  User: nesrine (Administrator) # NES-D3F3AC11CCF Updated on 20/12/2012 by El Desaparecido Launched at 13:10:43 | 24/01/2013  Website: https://www.sosvirus.net/ Contact: contact@eldesaparecido.com  PC: Acer (Aspire 7739Z) (X86-based PC CPU: Intel Pentium II Processor (1998) RAM -> [Total: 2357 | Free: 1012] BIOS: InsydeH2O Version 03.60.52V1.01 BOOT: Normal boot  OS: Microsoft Windows XP Professional (5.1.2600 32-Bit) # Service Pack 3 WB: Windows Internet Explorer 6.0.2900.5512  SC: Security Center Service [Enabled] WU: Windows Update Service [Enabled] FW: Windows FireWall Service [Enabled]  C:\ (%systemdrive%) -> Hard Drive # 196 GB (146 GB free - 75%) [] # NTFS D:\ -> Removable Drive # 4 GB (1 GB free - 29%) [LYDIA] # FAT32 E:\ -> Hard Drive # 270 GB (248 GB free - 92%) [] # NTFS F:\ -> CD-ROM  ################## | Active Processes |  C:\windows\System32\smss.exe (480) C:\windows\system32\winlogon.exe (948) C:\windows\system32\services.exe (992) C:\windows\system32\lsass.exe (1004) C:\windows\system32\svchost.exe (1168) C:\windows\System32\svchost.exe (1296) C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (1416) C:\windows\system32\spoolsv.exe (1796) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (2012) C:\Documents and Settings
esrine\Desktop\utile\bin\jqs.exe (196) C:\Program Files\Norton 360\Engine\6.4.0.9\ccSvcHst.exe (624) E:\oracle\product\10.2.0\db_1\bin\isqlplussvc.exe (720) E:\oracle\product\10.2.0\db_1\jdk\bin\java.exe (1468) E:\oracle\product\10.2.0\db_1\BIN\TNSLSNR.exe (1476) e:\oracle\product\10.2.0\db_1\bin\ORACLE.EXE (1864) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (284) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (1880) C:\windows\system32\svchost.exe (2120) C:\Program Files\Norton 360\Engine\6.4.0.9\ccSvcHst.exe (2528) C:\WINDOWS\system32\wbem\wmiapsrv.exe (2536) C:\windows\Explorer.EXE (2716) C:\windows\system32\wscntfy.exe (2908) C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe (3712) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (3856) C:\WINDOWS\system32\wbem\unsecapp.exe (4048) C:\windows\RTHDCPL.EXE (2644) C:\PROGRA~1\HSPAUS~1\HSPALA~1.EXE (2652) C:\windows\system32undll32.exe (2736) C:\windows\system32\ctfmon.exe (2784) C:\Program Files\Messenger\msmsgs.exe (3084) C:\Program Files\McAfee Security Scan\3.0.207\SSScheduler.exe (3840) C:\Program Files\Mozilla Firefox\firefox.exe (352) C:\Program Files\Mozilla Firefox\plugin-container.exe (1496) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE (1104) C:\UsbFix\Go.exe (2020)  ################## | Infectious Items |  Present! E:\AUTORUN.INF  ################## | Registry |  Present! HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\System|DisableRegistryTools Present! HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\policies\System|DisableRegistryTools Present! HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\policies\System|DisableTaskMgr Present! HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\policies\System|DisableTaskMgr Present! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr Present! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr Present! HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore|DisableConfig Present! HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore|DisableSR Present! HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\explorer|NoFolderOptions  ################## | Mountpoints2 |  HKCU\.\.\.\.\Explorer\MountPoints2\{213df038-42e5-11e2-b17b-78929c088ec8} Shell\AutoRun\Command = D:\setup.exe  HKCU\.\.\.\.\Explorer\MountPoints2\{2980346d-5afc-11e2-8656-78929c088ec8} Shell\AutoRun\Command = D:\SysAnti.exe Shell\Explore\Command = D:\SysAnti.exe Shell\Open\Command = D:\SysAnti.exe  HKCU\.\.\.\.\Explorer\MountPoints2\{9ba57a82-f9b8-11e1-b0e5-78929c088ec8} Shell\AutoRun\Command = D:\autorun.exe  HKCU\.\.\.\.\Explorer\MountPoints2\{9ba57a83-f9b8-11e1-b0e5-78929c088ec8} Shell\AutoRun\Command = D:\autorun.exe    ################## | Vaccination |  (!) This computer is not vaccinated!  ################## | E.O.F |

1122Z · Answer

############################## | UsbFix V 7.129 | [Removal]

User: W12 (Administrator) # W12-PC
Updated on 06/24/2013 by El Desaparecido
Launched at 14:58:57 | 07/16/2013

Website: http://sosvirus.net/
Upload Malware: http://www.sosvirus.net/upload-malware-pour-analyse-t489.html
Contact: ***@***

PC: MICRO-STAR INTERNATIONAL CO.,LTD (MS-7529) (x64-based PC)
CPU: Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz (2933)
RAM -> [Total: 3071 | Free: 1827]
BIOS: Default System BIOS
BOOT: Normal boot

OS: Microsoft Windows 7 Professional (6.1.7601 64-Bit) # Service Pack 1
WB: Windows Internet Explorer 9.0.8112.16421

SC: Security Center Service [Enabled]
WU: Windows Update Service [Enabled]
AS: Windows Defender [Enabled | Updated]
FW: Windows FireWall Service [Enabled]

C:\ (%systemdrive%) -> Hard disk # 59 Go (19 Go free - 33%) [] # NTFS
D:\ -> Hard disk # 107 Go (35 Go free - 32%) [Local disk] # NTFS
E:\ -> Hard disk # 67 Go (37 Go free - 55%) [] # NTFS
F:\ -> CD-ROM
H:\ -> CD-ROM

################## | El Desaparecido Section |

HKLM\SOFTWARE | Run : [FixCamera] - C:\Windows\FixCamera.exe
HKLM\SOFTWARE | Run : [tsnp325] - C:\Windows\tsnp325.exe
HKLM\SOFTWARE | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
HKLM\SOFTWARE | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE | Run : [AccuWeatherWidget] - "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
HKLM\SOFTWARE | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE\wow6432Node | Run : [FixCamera] - C:\Windows\FixCamera.exe
HKLM\SOFTWARE\wow6432Node | Run : [tsnp325] - C:\Windows\tsnp325.exe
HKLM\SOFTWARE\wow6432Node | Run : [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\SOFTWARE\wow6432Node | Run : [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
HKLM\SOFTWARE\wow6432Node | Run : [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM\SOFTWARE\wow6432Node | Run : [AccuWeatherWidget] - "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup
HKLM\SOFTWARE\wow6432Node | Run : [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\SOFTWARE | RunOnce : [] -
HKLM\SOFTWARE\wow6432Node | RunOnce : [] -
HKU\S-1-5-19\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-1748201786-431495879-1759824913-1000\SOFTWARE | Run : [Supercopier.exe] - C:\Program Files (x86)\Supercopier\Supercopier.exe
HKU\S-1-5-21-1748201786-431495879-1759824913-1000\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
HKU\S-1-5-21-1748201786-431495879-1759824913-1000\SOFTWARE | Run : [EPSON Stylus SX200 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEFE.EXE /FU "C:\Windows\TEMP\E_S8EE4.tmp" /EF "HKCU"
HKU\S-1-5-21-1748201786-431495879-1759824913-1000\SOFTWARE | Run : [Facebook Update] - "C:\Users\W12\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
HKU\S-1-5-21-1748201786-431495879-1759824913-1000\SOFTWARE | Run : [IDMan] - C:\Program Files (x86)\Internet Download Manager\IDMan.exe /onboot
HKU\S-1-5-21-1748201786-431495879-1759824913-1000\SOFTWARE | Run : [WebCake Desktop] - "C:\Users\W12\AppData\Roaming\WebCake\WebCakeDesktop.exe"
HKU\S-1-5-21-1748201786-431495879-1759824913-1001\SOFTWARE | Run : [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-1748201786-431495879-1759824913-1001\SOFTWARE | Run : [ProgLauncher] - C:\Program Files (x86)\ProgDVB\ProgLauncher.exe
HKU\S-1-5-21-1748201786-431495879-1759824913-1001\SOFTWARE | Run : [IDMan] - C:\Program Files (x86)\Internet Download Manager\IDMan.exe /onboot
HKU\S-1-5-21-1748201786-431495879-1759824913-1001\SOFTWARE | Run : [Supercopier.exe] - C:\Program Files (x86)\Supercopier\Supercopier.exe
HKU\S-1-5-21-1748201786-431495879-1759824913-1001\SOFTWARE | Run : [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
HKU\S-1-5-21-1748201786-431495879-1759824913-1001\SOFTWARE | Run : [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
HKU\S-1-5-21-1748201786-431495879-1759824913-1001\SOFTWARE | Run : [EPSON Stylus SX200 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEFE.EXE /FU "C:\Windows\TEMP\E_S8EE4.tmp" /EF "HKCU"
HKU\S-1-5-21-1748201786-431495879-1759824913-1001\SOFTWARE | Run : [Facebook Update] - "C:\Users\W12\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
HKU\S-1-5-18\SOFTWARE | Run : [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
HKU\S-1-5-19\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-20\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe
HKU\S-1-5-21-1748201786-431495879-1759824913-1001\SOFTWARE | RunOnce : [mctadmin] - C:\Windows\System32\mctadmin.exe

################## | Stopped Processes |

Stopped! C:\Windows\system32\nvvsvc.exe (828)
Stopped! C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (852)
Stopped! C:\Windows\System32\spoolsv.exe (1408)
Stopped! C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (1572)
Stopped! C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (1660)
Stopped! C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe (1808)
Stopped! C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler64.exe (2060)
Stopped! C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (2104)
Stopped! C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe (2184)
Stopped! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (2692)
Stopped! C:\Program Files\iPod\bin\iPodService.exe (3340)
Stopped! C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (3368)
Stopped! C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (4588)
Stopped! C:\Windows\system32\nvvsvc.exe (3016)
Stopped! C:\Windows\system32\taskhost.exe (4696)
Stopped! C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (4240)
Stopped! C:\Windows\vsnp325.exe (4380)
Stopped! C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (1008)
Stopped! C:\Program Files (x86)\Supercopier\Supercopier.exe (2668)
Stopped! C:\Windows\System32\spool\drivers\x64\3\E_IATIEFE.EXE (3732)
Stopped! C:\Program Files (x86)\Internet Download Manager\IDMan.exe (1896)
Stopped! C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (356)
Stopped! C:\Users\W12\AppData\Roaming\WebCake\WebCakeDesktop.exe (4464)
Stopped! C:\Program Files (x86)\TechniSat DVB\bin\Server4PC.exe (2740)
Stopped! C:\Windows\FixCamera.exe (704)
Stopped! C:\Windows\tsnp325.exe (1300)
Stopped! C:\Program Files (x86)\iTunes\iTunesHelper.exe (2300)
Stopped! C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (3832)
Stopped! C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe (4704)
Stopped! C:\Program Files (x86)\AIMP3\AIMP3.exe (3552)
Stopped! C:\Windows\SysWOW64\DllHost.exe (1980)
Stopped! C:\Windows\system32\msiexec.exe (4684)
Stopped! C:\Windows\SysWOW64\NOTEPAD.EXE (4260)

################## | Infectious Items |

Not deleted! H:\setup.exe
Deleted! D:\Thumbs.db
Not deleted! H:\autorun.inf

(!) Temporary files deleted.

################## | Registry |

################## | Mountpoints2 |

Deleted! HKCU\.\.\.\.\Explorer\MountPoints2\{5efa5270-b1bb-11e2-a518-002421bbc481}
Deleted! HKCU\.\.\.\.\Explorer\MountPoints2\{5efa528b-b1bb-11e2-a518-002421bbc481}
Deleted! HKCU\.\.\.\.\Explorer\MountPoints2\{7b083aa8-948c-11e2-94d1-002421bbc481}
Deleted! HKCU\.\.\.\.\Explorer\MountPoints2\{e22c5289-a420-11e2-8e3a-002421bbc481}

################## | Listing |

[05/03/2013 - 19:19:36 | SHD ] C:\$Recycle.Bin
[16/07/2013 - 14:53:35 | RASHD ] C:\Autorun.inf
[05/03/2013 - 19:14:47 | SHD ] C:\Boot
[21/11/2010 - 04:23:51 | RASH | 383786] C:\bootmgr
[05/03/2013 - 19:14:48 | N | 8192] C:\BOOTSECT.BAK
[16/07/2013 - 14:53:41 | D ] C:\Config.Msi
[12/05/2013 - 21:58:17 | D ] C:\dell
[10/05/2013 - 21:05:09 | D ] C:\Dev-Pas
[14/07/2009 - 06:08:56 | SHD ] C:\Documents and Settings
[12/03/2013 - 14:33:05 | D ] C:\dvbdream
[27/06/2013 - 19:42:54 | D ] C:\FFOutput
[14/05/2013 - 20:09:26 | D ] C:\Fraps
[25/03/2013 - 21:01:10 | N | 230424] C:\img2-001.raw
[14/03/2013 - 21:43:34 | N | 365] C:\MAX.BAK
[14/03/2013 - 21:43:34 | N | 365] C:\max.pas
[07/04/2013 - 14:20:13 | RHD ] C:\MSOCache
[05/03/2013 - 19:24:06 | D ] C:\NVIDIA
[16/07/2013 - 12:56:41 | ASH | 1073741824] C:\pagefile.sys
[14/07/2009 - 04:20:08 | D ] C:\PerfLogs
[04/07/2013 - 10:30:02 | D ] C:\Program Files
[16/07/2013 - 14:53:35 | D ] C:\Program Files (x86)
[16/07/2013 - 14:53:35 | HD ] C:\ProgramData
[05/03/2013 - 19:19:16 | SHD ] C:\Recovery
[28/03/2013 - 23:20:39 | D ] C:\Report
[16/07/2013 - 13:08:01 | D ] C:\rsit
[20/04/2013 - 19:51:43 | D ] C:\sn0wbreeze
[16/07/2013 - 14:52:58 | SHD ] C:\System Volume Information
[13/03/2013 - 21:44:54 | D ] C:\TP
[15/03/2013 - 18:36:57 | D ] C:\TPWW
[16/07/2013 - 15:03:07 | D ] C:\UsbFix
[16/07/2013 - 15:03:18 | A | 9789] C:\UsbFix [Clean 1] W12-PC.txt
[16/07/2013 - 14:52:39 | N | 9984] C:\UsbFix [Scan 1] W12-PC.txt
[16/07/2013 - 14:58:20 | N | 9709] C:\UsbFix [Scan 2] W12-PC.txt
[05/03/2013 - 19:26:06 | D ] C:\Users
[12/04/2013 - 09:15:55 | N | 413] C:\wakeuptoken.info
[15/07/2013 - 01:25:11 | D ] C:\Windows
[05/03/2013 - 19:19:36 | SHD ] D:\$RECYCLE.BIN
[27/06/2013 - 19:45:12 | D ] D:\amine
[16/07/2013 - 14:53:36 | RASHD ] D:\Autorun.inf
[16/02/2013 - 10:22:12 | D ] D:\Config.Msi
[15/07/2013 - 19:51:53 | D ] D:\special music folder
[15/07/2013 - 15:54:48 | D ] D:\Downloads
[05/12/2009 - 20:21:58 | N | 166406] D:\Recording.amr
[17/03/2012 - 00:45:51 | D ] D:\frikwi
[15/07/2013 - 15:57:05 | D ] D:\My documents
[18/03/2013 - 15:41:46 | D ] D:\msdownld.tmp
[16/07/2013 - 03:56:32 | N | 610826] D:\New Microsoft Office Word Document.docx
[14/07/2013 - 02:44:30 | D ] D:\Program Files (x86)
[10/07/2013 - 22:17:13 | D ] D:\RAI2LUXE
[01/07/2011 - 23:09:59 | SHD ] D:\RECYCLER
[16/07/2013 - 04:22:11 | D ] D:\sab
[28/09/2012 - 11:27:30 | SHD ] D:\System Volume Information
[25/04/2013 - 08:57:12 | D ] D:\?????? ??????
[05/03/2013 - 19:19:36 | SHD ] E:\$RECYCLE.BIN
[16/07/2013 - 14:53:37 | RASHD ] E:\Autorun.inf
[05/12/2011 - 21:41:27 | D ] E:\bnituf
[02/04/2013 - 18:01:43 | D ] E:\Config.Msi
[01/01/2013 - 17:09:20 | N | 25600] E:\contacts.xls
[15/07/2013 - 14:20:46 | D ] E:\GAMER
[18/11/2012 - 11:37:26 | D ] E:\I am learning Word
[02/04/2013 - 13:55:44 | D ] E:\Program Files (x86)
[01/07/2011 - 23:11:46 | SHD ] E:\RECYCLER
[26/01/2012 - 22:59:10 | N | 1236] E:\Serial photo instrument.lnk
[28/09/2012 - 23:07:34 | SHD ] E:\System Volume Information
[15/07/2013 - 14:10:57 | D ] E:\Downloads
[12/03/2013 - 15:36:16 | D ] E:\VIRTUAL MACHINE
[28/05/2013 - 12:05:34 | D ] H:\Crack
[28/05/2013 - 12:05:46 | R | 43] H:\autorun.inf
[28/05/2013 - 12:07:31 | R | 2098729728] H:\setup-1.bin
[28/05/2013 - 12:10:49 | R | 2100000000] H:\setup-2.bin
[28/05/2013 - 12:13:05 | R | 1941413161] H:\setup-3.bin
[28/05/2013 - 12:13:06 | R | 1269842] H:\setup.exe

################## | Vaccine |

C:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
D:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)
E:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)

################## | E.O.F | http://sosvirus.net |

ona ccm · Answer

I have the same problem and here is my report    ############################## | UsbFix V 7.154 | [Scan]  User: PC3 (Administrator) # PC3-PC Updated on 12/13/2013 by El Desaparecido - Team SosVirus Launched at 14:00:57 | 12/16/2013  Website: http://www.usbfix.net Forum: http://www.sosvirus.net/ Upload Malware: http://www.sosvirus.net/upload_malware.php Contact: http://www.usbfix.net/contact/  PC: Hewlett-Packard (2820h) CPU: Pentium(R) Dual-Core CPU E5200 @ 2.50GHz RAM -> [Total: 3567 | Free: 2395] Bios: Hewlett-Packard Boot: Normal boot  OS: Microsoft Windows 7 Professional (6.1.7600 32-Bit) WB: Windows Internet Explorer: 8.0.7600.16385 WB: Google Chrome: 31.0.1650.63  SC: Security Center Service [Enabled] WU: Windows Update Service [Enabled] AV: avast! Antivirus [(!) Disabled | (!) Outdated] AS: Windows Defender: 6.1.7600.16385 (win7_rtm.090713-1255) FW: Windows FireWall Service [Enabled]  C:\ (%systemdrive%) -> Fixed Drive # 81 GB (61 GB free - 76%) [] # NTFS D:\ -> Fixed Drive # 68 GB (64 GB free - 94%) [] # NTFS E:\ -> CD-ROM G:\ -> Removable Drive # 7 GB (7 GB free - 99%) [KINGSTON] # NTFS  ################## | Active Processes |  C:\Windows\system32\csrss.exe (ID: 364 | ParentID: 340) C:\Windows\system32\wininit.exe (ID: 404 | ParentID: 340) C:\Windows\system32\services.exe (ID: 460 | ParentID: 404) C:\Windows\system32\lsass.exe (ID: 500 | ParentID: 404) C:\Windows\system32\lsm.exe (ID: 516 | ParentID: 404) C:\Windows\system32\svchost.exe (ID: 640 | ParentID: 460) C:\Windows\system32\svchost.exe (ID: 732 | ParentID: 460) C:\Windows\System32\svchost.exe (ID: 800 | ParentID: 460) C:\Windows\System32\svchost.exe (ID: 872 | ParentID: 460) C:\Windows\system32\svchost.exe (ID: 900 | ParentID: 460) C:\Windows\system32\svchost.exe (ID: 1056 | ParentID: 460) C:\Windows\system32\svchost.exe (ID: 1152 | ParentID: 460) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (ID: 1200 | ParentID: 460) C:\Windows\system32\svchost.exe (ID: 1600 | ParentID: 460) C:\Windows\system32\svchost.exe (ID: 1252 | ParentID: 460) C:\Windows\System32\svchost.exe (ID: 3404 | ParentID: 460) C:\Windows\system32\wbem\wmiprvse.exe (ID: 3748 | ParentID: 640) C:\Windows\system32\WUDFHost.exe (ID: 4584 | ParentID: 872) C:\Windows\system32\HPSIsvc.exe (ID: 4764 | ParentID: 460) C:\Program Files\ma-config.com\MaConfigAgent.exe (ID: 1772 | ParentID: 460) C:\Windows\system32\SearchIndexer.exe (ID: 3948 | ParentID: 460) C:\Windows\System32\spoolsv.exe (ID: 1436 | ParentID: 460) C:\Windows\system32\CAPRPCSK.EXE (ID: 3428 | ParentID: 1436) C:\Windows\system32\spool\drivers\w32x86\3\CAPPSWK.EXE (ID: 4676 | ParentID: 1272) C:\Windows\system32\csrss.exe (ID: 2632 | ParentID: 2992) C:\Windows\system32\winlogon.exe (ID: 4228 | ParentID: 2992) C:\Windows\system32	askeng.exe (ID: 4136 | ParentID: 900) C:\Windows\system32\Dwm.exe (ID: 2800 | ParentID: 872) C:\Windows\Explorer.EXE (ID: 4568 | ParentID: 4832) C:\Windows\system32	askhost.exe (ID: 4360 | ParentID: 460) C:\Program Files\Adobe\Reader 9.0\Readereader_sl.exe (ID: 4308 | ParentID: 4568) C:\Program Files\Common Files\Real\Update_OBealsched.exe (ID: 5148 | ParentID: 4568) C:\Program Files\Analog Devices\Core\smax4pnp.exe (ID: 1796 | ParentID: 4568) C:\Program Files\Alwil Software\Avast5\AvastUI.exe (ID: 2688 | ParentID: 4568) C:\Windows\System32\igfxtray.exe (ID: 1940 | ParentID: 4568) C:\Windows\System32\hkcmd.exe (ID: 5352 | ParentID: 4568) C:\Windows\System32\igfxpers.exe (ID: 616 | ParentID: 4568) C:\Program Files\Internet Download Manager\IDMan.exe (ID: 3252 | ParentID: 4568) C:\Windows\System32\spool\drivers\w32x86\3\CAPPSWK.EXE (ID: 2316 | ParentID: 5720) C:\Program Files\Internet Explorer\iexplore.exe (ID: 1972 | ParentID: 3900) C:\Windows\system32\igfxsrvc.exe (ID: 3412 | ParentID: 640) C:\Windows\System32\spool\drivers\w32x86\3\CAPPSWK.EXE (ID: 1904 | ParentID: 5720) C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 2536 | ParentID: 4568) C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 4624 | ParentID: 2536) C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 6060 | ParentID: 2536) C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5260 | ParentID: 2536) C:\Program Files\Windows Media Player\wmpnetwk.exe (ID: 5412 | ParentID: 460) C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 5580 | ParentID: 2536) C:\Program Files\Google\Chrome\Application\chrome.exe (ID: 1516 | ParentID: 2536) C:\UsbFix\Go.exe (ID: 3628 | ParentID: 3332)  ################## | Regedit Run |  04 - HKLM\SOFTWARE | Run: [Adobe Reader Speed Launcher] - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 04 - HKLM\SOFTWARE | Run: [TkBellExe] - "C:\Program Files\Common Files\Real\Update_OBealsched.exe" -osboot 04 - HKLM\SOFTWARE | Run: [SoundMAXPnP] - C:\Program Files\Analog Devices\Core\smax4pnp.exe 04 - HKLM\SOFTWARE | Run: [CAPON] - C:\Windows\system32\Spool\Drivers\w32x86\3\CAPONN.EXE 04 - HKLM\SOFTWARE | Run: [avast5] - "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui 04 - HKLM\SOFTWARE | Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe 04 - HKLM\SOFTWARE | Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe 04 - HKLM\SOFTWARE | Run: [Persistence] - C:\Windows\system32\igfxpers.exe 04 - HKLM\SOFTWARE | RunOnce: [] - 04 - HKU\S-1-5-19\SOFTWARE | Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun 04 - HKU\S-1-5-20\SOFTWARE | Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun 04 - HKU\S-1-5-21-228751511-1143617535-3597589232-1000\SOFTWARE | Run: [IDMan] - C:\Program Files\Internet Download Manager\IDMan.exe /onboot 04 - HKU\S-1-5-19\SOFTWARE | RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe 04 - HKU\S-1-5-20\SOFTWARE | RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe  ################## | Generic Search |  Present! G:\Recycler\S-1-0-34-6261331142-4457534771-630413285-5034\JbBPUqdR.exe Present! G:\Recycler\S-1-0-34-6261331142-4457534771-630413285-5034\gidEsSYF.exe Present! G:\Recycler\S-1-0-34-6261331142-4457534771-630413285-5034\mWrYoSdv.exe Present! G:\Recycler\S-1-0-34-6261331142-4457534771-630413285-5034\GNZiaOgl.cpl Present! G:\Recycler\S-1-0-34-6261331142-4457534771-630413285-5034\pRFkfIDc.cpl Present! G:\Recycler\S-1-0-34-6261331142-4457534771-630413285-5034\qSLWaHxu.cpl Present! G:\Recycler\S-1-2-05-4520150206-2776357587-347287467-5711\yffkRADF.exe Present! G:\Recycler\S-1-2-05-4520150206-2776357587-347287467-5711\WFoxffmb.exe Present! G:\Recycler\S-1-2-05-4520150206-2776357587-347287467-5711\KBicNtUv.exe Present! G:\Recycler\S-1-2-05-4520150206-2776357587-347287467-5711\gAGyvxRp.exe Present! G:\Recycler\S-1-2-05-4520150206-2776357587-347287467-5711\dTVOHPAH.cpl Present! G:\Recycler\S-1-2-05-4520150206-2776357587-347287467-5711\fQAtNRsE.cpl Present! G:\Recycler\S-1-2-05-4520150206-2776357587-347287467-5711\cGaGbGSa.cpl Present! G:\Recycler\S-1-2-05-4520150206-2776357587-347287467-5711\LTrjRduU.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\UFYRZOHe.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\MvixcekC.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\kvSVvUeP.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\StOkjZuq.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\OXDTTvbE.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\bQBWSAyx.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\fUjFjHMi.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\vOqYtRph.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\LmsKqwGo.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\XyEfuByJ.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021
AvEJGHD.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\pyAbkegh.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\LYblyCZF.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\UqGxLRYW.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\MTubebix.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\dqPGCOsG.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\GiuGEjRf.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\sJTqgtLV.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\JTvvdltJ.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\TFRkZQZW.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\mMayAMVf.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\DMTVEVdA.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\OnpVmwRP.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\PhwTxxMg.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\KKhbVLLA.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\KHLRSAXq.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\TPyCuWYb.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\weZISLQi.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\BurUeEfd.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\pywXwrxb.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\gUAkuADl.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\ggVkcVJl.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\kcMXUlsD.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\BePgDiAt.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\vZUoUMOg.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\IcgYtymL.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021URMpWsB.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\grunLlMq.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\QxUCOGvg.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\hJjGpCRr.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\LkHklOLH.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021	TFcJmxv.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\ADnOTyBi.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\BEtPTHxP.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\VvHKsDSD.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\ekVIgMCn.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\lWPyNygu.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\drMhqEIA.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\hvCnaIbJ.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\KjOYynwe.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\uJHMamTQ.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\MjVXFspL.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\THGYQSEb.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\ZqCxdXEo.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\XJuLnpej.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\mOxmiliW.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021
FMPkmiA.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021	YvIXGeh.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\PrsnOLXT.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\cKxDUDwW.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\UxIjvPBo.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\byWedDxU.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\McUPUdva.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\DDVIuoJF.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\FFViNeiZ.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\epTxnZpw.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\KRckXNlS.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\SupGypan.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\vNPflSFu.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\xIWIdadt.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\XPuOjKPa.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\pCvZQwfa.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\UKbScQEt.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\iFZInMfK.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\qIMotSHb.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\mFfMKoUR.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\xfHchgQo.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\JKZATCfQ.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\UghvUYCa.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\mjQEDTSk.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\lrneKKNi.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\aPsHEiwu.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\ZfefaZad.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\bIuTLVNQ.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\lBkfmfhS.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\eCtfrUEx.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\RgTEJDqD.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\TEAoxpCU.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\mtoFiZIF.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\sdNxEmkl.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\KWPioBJJ.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\IrRsGpeC.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\kwsuiRmn.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\gUlCJjoZ.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\bugilaUt.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\oVjhaXAY.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\HrpwWGyq.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\cIJtnQhW.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\abrIuVmp.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\GWEatHDE.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\gSHrpGQC.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\IcmLEuex.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021
UwLiLXY.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\anmRgmSG.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\FacXnVvx.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\wIKoUIEL.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\vGdvVawV.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\pyxdRnJw.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\bXLKpdYb.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021	PCpSMui.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\FvOMYcJD.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021Toxkybx.exe Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\goAeJkUL.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021	HWYVwbB.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\RgZuJUAX.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\RRCKhtqg.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\bfQoNhtc.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\mTMUsgij.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\AFFCGmGq.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\LPUxRhrx.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\wsrTnmxp.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\ycTkrwwc.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\NekmayLQ.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\dOBguJCj.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\SqXLJVDa.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021PACIvLI.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\ZbDLepqj.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\CliAQhIb.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\ShhSsTuM.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\WPGbDZQe.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\VWRcPRha.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\EaPxLqkn.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\ccljubch.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021UFtjNBe.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\BUKklPPW.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\kVivJtJv.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\kaQLgHLx.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\fOLbMRWD.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\LRjRuxeM.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\MnTHLhfS.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\LTJqduFV.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\brGPQJBR.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\cePAlWQL.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\XLSvJqKE.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\uvKMBUvC.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\ioPJxQJQ.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\GQGObJCy.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\fQmPLhxe.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\eBqajxWR.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\eeSsvpAG.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\eGnydgKJ.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\mWWbyELl.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\dOyxrbJP.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021	fyCvXJD.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\FlgOLPeo.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\hqtfExyA.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\CRauCUGT.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\EfHPSBDl.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\yllSPabS.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\bspexovG.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\PCSGQTHQ.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021kViEpCu.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\UAxHmZer.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\ZmCtqGYN.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\aoZAvCpt.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\EkkPGfom.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021
RjWMnZM.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\uqsgtLJR.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\AEQDQrTA.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\LUKaeRtJ.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\XGvnScni.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\LLymjZGA.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\yZVWnDSA.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\jLpuTBdG.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\XqlZcDNZ.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\aoiuGSqr.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\kQEfbnVk.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\KDQuySWh.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\IPsWtwQQ.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\XTAlOJrq.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\gNWXisuU.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\MMErtyPd.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\gitsQArK.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\PyneuBoB.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\DNACNZhn.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\SFQxcYbS.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\fwpSJOgh.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\KJECFPns.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\GnAsGFRm.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\OtsHgnrI.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\qrxFBytt.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\iifALalD.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\AyubYjwP.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\KGdmZeAt.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\CsMoToNc.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\urVwEesv.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\RrbkaPKW.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\bZUnKerH.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\URfEnxCl.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\UHpqyjfh.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\deOPrRMu.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\MTffexSO.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\igiOgufo.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\UsAaeThc.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\dcJHVEwA.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\vnWqfMqi.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\JtGhwBhs.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\oYAfAQuc.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\gUuZKpbM.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\YOhSuqDj.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\fYIEnHlC.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\FqeMCsef.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\syGbUGBN.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\BWtCJdkR.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\bytgjOxv.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\sFdOkGTF.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\EbYIBfUD.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\LhwGnfnY.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\wGmBvKOL.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\LiYarZmy.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\WNvILBth.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\ZeIojMDL.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\TjGlvkIF.cpl Present! G:\Recycler\S-3-5-40-3082536437-6151848824-302888160-2021\uVOZYUSZ.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\PmspxAny.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\kDNbVRKP.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\DALOlHAP.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\RtNdqDWv.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\FZBRIgNj.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\edceuIHi.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\GtFObTbn.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\jIqeDQnQ.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\aFBJUJIM.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\QDVDvYKM.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\YRQILsOo.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\ZyFXXMsg.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\FMMLtdNt.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\GkSexoVj.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\kAoJlHup.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\OcfeDRqh.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\WSMsoJJV.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\BUlifHFy.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\bZuxFryI.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\FgnOWaBY.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\VRUPRIcb.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\GulPppYD.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\ixEnXDpP.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\fpfUJcln.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852
uXCEfyZ.exe Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\yVIkyVqo.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\CWrqOQyc.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852	XFABjFe.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\pTtvXfku.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\RKZgSmRx.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\AGVuBaUH.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852pniSTCY.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\LKLpGLNN.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\gAmHCjBP.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\bTjnMTme.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\XZLAXQOv.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\RLACRSIJ.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\keXGvdHy.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\EYxbfkRc.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\SvogZpfn.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\JKhGENHt.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\GnudfcnP.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\JVcjSBxQ.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\bQwDCQDP.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\TOpYuhaB.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\PihYynar.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\jljsihfp.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\VRuKMAiw.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852\PTaoovcs.cpl Present! G:\Recycler\S-8-2-33-6376746606-6234265261-074054735-0852	eiDxOGF.cpl Present! G:\autorun.inf  ################## | Registry |  Present! HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyGames -> 0  ################## | Vaccine |  D:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)  ################## | E.O.F | http://www.usbfix.net - http://www.sosvirus.net |

¡El Desaparecido! · Answer

Hello,  Please, I have a problem with the RECYCLER virus  Response, to remove it, do the following:  # Download UsbFix by El Desaparecido to your Desktop. # If your antivirus displays an alert, ignore it and temporarily disable the antivirus. # Connect all your external data sources to your PC (USB drives, external hard drives, etc...) without opening them. # Double click on UsbFix.exe. # Click on Delete.   # Note: The computer will restart automatically, upon restart, click on the message displayed by UsbFix and let the program work.     # Let the tool work, your desktop will not be accessible during the cleaning phase, this is normal.  # At the end of the scan, a report will be displayed, post it in your next response on the forum.  # The report is also saved at the root of the system drive ( C:\UsbFix [Clean ?] Computer Name.txt ). ( CTRL+A to select, CTRL+C to copy, and CTRL+V to paste ) # ->> Tutorial (help) with images on the author's site.  ############  Don't be afraid to execute the delete option even if the word delete sounds a bit scary ;-) In case of difficulties, please create your own thread on the forum:  https://forums.commentcamarche.net/forum/virus-securite-7/new  You will not receive a response to this thread because everyone posts their report here.  Moderation would do well to close this thread anyway :) Developer: UsbFix ## Webmaster: SosVirus As Birdy said -> People help the people

Remove the RECYCLER.exe virus

26 réponses

Texture issues in enshrouded

Driver his

Peritel to hdmi conversion

How to access the bios on a compaq notebook

Dsi won't turn on anymore

Search for a song with the lyrics

Left mouse click, touchpad click inactive

Codes stronghold crusader

Stuck computer system repair

Disable write protection mp3 player