unable to download usbfix Solved

Question

Hello,  I have the same problem, I have my camera and a USB stick infected, the infection is called "VBS:Agent-AXN [Trj]" I want to download usbfix to post my report but it's impossible, I get an error page: "The connection to the server was reset while loading the page."  Maybe there are too many of us with this virus right now and the site can't handle it...  In the meantime, it's quite annoying not being able to connect anything to my computer... :(  Configuration: Windows 7 / Firefox 25.0

Anonymous user · Answer

Hello  [*] Download to the desktop RogueKiller (by tigzy)  (choose between the 32 and 64-bit versions depending on your Windows, if you don't know, ask me!)  [*] Close all programs [*] Launch RogueKiller.exe. [*] Wait for the Prescan to finish... [*] Click on Scan. Click on Report and copy and paste the content of the report  See you later   --  --------Security Contributor--------- We have all been beginners at something at one point. But knowledge is the reward of diligence.

gregoire.mx · Answer

Here is the report: RogueKiller V8.7.11 _x64_ [Nov 25 2013] by Tigzy email: tigzyRKgmailcom Feedback: http://www.adlice.com/forum/ Website: https://www.luanagames.com/index.fr.html Blog: http://tigzyrk.blogspot.com/ Operating system: Windows 7 (6.1.7601 Service Pack 1) 64 bit version Boot: Normal mode User: user [Admin rights] Mode: Scan -- Date: 12/12/2013 12:21:22 | ARK || FAK || MBR | ¤¤¤ Malicious processes: 0 ¤¤¤ ¤¤¤ Registry entries: 5 ¤¤¤ [RUN][SUSP PATH] HKCU\[...]\Run: iTunesHelper (wscript.exe //B "C:\Users\user\AppData\Local\Temp\iTunesHelper.vbe" [x][-]) -> FOUND [RUN][SUSP PATH] HKUS\S-1-5-21-2533516340-1630299862-2881606751-1000\[...]\Run: iTunesHelper (wscript.exe //B "C:\Users\user\AppData\Local\Temp\iTunesHelper.vbe" [x][-]) -> FOUND [RUN][SUSP PATH] HKLM\[...]\Wow6432Node\[...]\Run: D3DOverrider ("C:\Users\user\Desktop\D3DOverrider\D3DOverriderWrapper.exe" /s [x]) -> FOUND [HJ DESK][PUM] HKLM\[...]\NewStartPanel: {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK][PUM] HKLM\[...]\NewStartPanel: {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Scheduled tasks: 0 ¤¤¤ ¤¤¤ Startup entries: 0 ¤¤¤ ¤¤¤ Web browsers: 0 ¤¤¤ ¤¤¤ Specific files / folders: ¤¤¤ ¤¤¤ Driver: [NOT LOADED 0x0] ¤¤¤ ¤¤¤ External hives: ¤¤¤ ¤¤¤ Infection: ¤¤¤ ¤¤¤ HOSTS file: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: (\.\PHYSICALDRIVE0 @ IDE) ST2000DM001-9YN164 ATA Device +++++ --- User --- [MBR] 74ded19278fd42557f27983780c51d21 [BSP] 6e426e116c9e6a8c850e7b4c4eabfbbb : Windows 7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 1907627 MB User = LL1 ... OK! User = LL2 ... OK! Finished: << RKreport[0]_S_12122013_122122.txt >>

Anonymous user · Answer

Re  You switch to the deletion option of Roguekiller and send me this report; thanks  @+  --  --------Security Contributor--------- We have all been a beginner at something at one point. But knowledge is the reward of diligence.

gregoire.mx · Answer

RogueKiller V8.7.11 _x64_ [Nov 25 2013] by Tigzy email: tigzyRKgmailcom Feedback: http://www.adlice.com/forum/ Website: https://www.luanagames.com/index.fr.html Blog: http://tigzyrk.blogspot.com/ Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version Boot: Normal mode User: user [Admin rights] Mode: Removal -- Date: 12/12/2013 12:26:49 | ARK || FAK || MBR | ¤¤¤ Malicious processes: 0 ¤¤¤ ¤¤¤ Registry entries: 5 ¤¤¤ [RUN][SUSP PATH] HKCU\[...]\Run : iTunesHelper (wscript.exe //B "C:\Users\user\AppData\Local\Temp\iTunesHelper.vbe" [x][-]) -> DELETED [RUN][SUSP PATH] HKUS\S-1-5-21-2533516340-1630299862-2881606751-1000\[...]\Run : iTunesHelper (wscript.exe //B "C:\Users\user\AppData\Local\Temp\iTunesHelper.vbe" [x][-]) -> [0x2] The specified file is not found. [RUN][SUSP PATH] HKLM\[...]\Wow6432Node\[...]\Run : D3DOverrider ("C:\Users\user\Desktop\D3DOverrider\D3DOverriderWrapper.exe" /s [x]) -> [0x5] Access denied. [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0) [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0) ¤¤¤ Scheduled tasks: 0 ¤¤¤ ¤¤¤ Startup entries: 0 ¤¤¤ ¤¤¤ Web browsers: 0 ¤¤¤ ¤¤¤ Particular files / folders: ¤¤¤ ¤¤¤ Driver: [NOT LOADED 0x0] ¤¤¤ ¤¤¤ External hives: ¤¤¤ ¤¤¤ Infection: ¤¤¤ ¤¤¤ HOSTS file: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: (\.\PHYSICALDRIVE0 @ IDE) ST2000DM001-9YN164 ATA Device +++++ --- User --- [MBR] 74ded19278fd42557f27983780c51d21 [BSP] 6e426e116c9e6a8c850e7b4c4eabfbbb : Windows 7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 1907627 MB User = LL1 ... OK! User = LL2 ... OK! Completed: << RKreport[0]_D_12122013_122649.txt >> RKreport[0]_S_12122013_122122.txt

Anonymous user · Answer

Re  You're moving forward with Roguekiller.  For UsbFix, you temporarily disable your Antivirus.  See you later  --  --------Security Contributor--------- We have all been beginners at something at one point. But knowledge is the reward for diligence.

gregoire.mx · Answer

It's all good, I downloaded usbfix by blocking Avast, thank you! I'm waiting for the next steps, commander  (curious thing: I couldn't browse the internet just now, and therefore refresh this page, I had to temporarily block Avast to respond... \o/ )

Anonymous user · Answer

Re  pending this UsbFix report; thank you  @+  --  --------Security Contributor--------- We've all been a beginner at something at some point. But knowledge is the reward for diligence.

gregoire.mx · Answer

It is necessary for me to connect the infected external drives without opening them before launching the USBFix scan, right?

gregoire.mx · Answer

usbfix was stuck at 19%, my computer made a small "click click" sound every 10 minutes, and when I tried to close usbfix it said it was not responding... :(

Anonymous user · Answer

Re  You repeat this manipulation in safe mode with networking support  See you later  --  --------Security Contributor--------- We have all been beginners at something one day. But knowledge is the reward for diligence.

Anonymous user · Answer

It happens above  --  --------Security Contributor--------- We have all been a beginner at something at some point. But knowledge is the reward of diligence.

gregoire.mx · Answer

Done, here is the report:  ############################## | UsbFix V 7.153 | [Search]  User: user (Administrator) # USER-PC Updated on 09/12/2013 by El Desaparecido - Team SosVirus Launched at 13:36:58 | 12/12/2013  Website: https://www.usbfix.net/ Forum: https://www.sosvirus.net/ Upload Malware: http://www.sosvirus.net/upload_malware.php Contact: https://www.usb-antivirus.com/fr/contact/  PC: Gigabyte Technology Co., Ltd. (H61M-D2H-USB3) CPU: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz RAM -> [Total: 8175 | Free: 7434] Bios: Award Software International, Inc. Boot: Fail-safe boot  OS: Microsoft Windows 7 Home Basic Edition (6.1.7601 64-Bit) Service Pack 1 WB: Windows Internet Explorer: 11.0.9600.16476 WB: Google Chrome: 31.0.1650.63 WB: Mozilla Firefox: 25.0.1  SC: Security Center Service [Enabled] WU: Windows Update Service [Enabled] AV: avast! Antivirus [Enabled | Updated] AS: Windows Defender: 6.1.7600.16385 (win7_rtm.090713-1255) AS: Malwarebytes' Anti-Malware: 1.75.0001 FW: Windows FireWall Service [(!) Disabled]  C:\ (%systemdrive%) -> Fixed disk # 1863 Go (1150 Go free - 62%) [] # NTFS D:\ -> CD-ROM E:\ -> CD-ROM F:\ -> Removable disk # 2 Go (738 Mo free - 38%) [] # FAT G:\ -> Removable disk # 4 Go (4 Go free - 97%) [greg] # NTFS  ################## | Active Processes |  C:\Windows\system32\csrss.exe (ID: 348 | ParentID: 336) C:\Windows\system32\csrss.exe (ID: 388 | ParentID: 380) C:\Windows\system32\wininit.exe (ID: 396 | ParentID: 336) C:\Windows\system32\winlogon.exe (ID: 436 | ParentID: 380) C:\Windows\system32\services.exe (ID: 488 | ParentID: 396) C:\Windows\system32\lsass.exe (ID: 496 | ParentID: 396) C:\Windows\system32\lsm.exe (ID: 504 | ParentID: 396) C:\Windows\system32\svchost.exe (ID: 596 | ParentID: 488) C:\Windows\system32\svchost.exe (ID: 672 | ParentID: 488) C:\Windows\System32\svchost.exe (ID: 768 | ParentID: 488) C:\Windows\system32\svchost.exe (ID: 800 | ParentID: 488) C:\Windows\System32\svchost.exe (ID: 848 | ParentID: 488) C:\Windows\system32\svchost.exe (ID: 876 | ParentID: 488) C:\Windows\SYSTEM32\WISPTIS.EXE (ID: 1000 | ParentID: 848) C:\Windows\SYSTEM32\WISPTIS.EXE (ID: 308 | ParentID: 848) C:\Windows\Explorer.EXE (ID: 1032 | ParentID: 380) C:\Windows\system32\ctfmon.exe (ID: 1080 | ParentID: 1032) C:\Windows\system32\DllHost.exe (ID: 1380 | ParentID: 596) C:\UsbFix\Go.exe (ID: 1540 | ParentID: 1524) C:\Windows\system32\wbem\wmiprvse.exe (ID: 1612 | ParentID: 596)  ################## | Regedit Run |  04 - HKLM\SOFTWARE | Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" 04 - HKLM\SOFTWARE | Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 04 - HKLM\SOFTWARE | Run: [BCSSync] - "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices 04 - HKLM\SOFTWARE | Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 04 - HKLM\SOFTWARE | Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun 04 - HKLM\SOFTWARE | Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin 04 - HKLM\SOFTWARE | Run: [D3DOverrider] - "C:\Users\user\Desktop\D3DOverrider\D3DOverriderWrapper.exe" /s 04 - HKLM\SOFTWARE | Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" 04 - HKLM\SOFTWARE | Run: [Adobe Creative Cloud] - "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true 04 - HKLM\SOFTWARE | Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" 04 - HKLM\SOFTWARE | Run: [amd_dc_opt] - C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe 04 - HKLM\SOFTWARE | Run: [20131121] - C:\Program Files\AVAST Software\Avast\setup\emupdate\51f64a97-8894-42ed-9e0a-f76e91cd79f6.exe /check 04 - HKLM\SOFTWARE | Run: [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui 04 - HKLM\SOFTWARE\wow6432Node | Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" 04 - HKLM\SOFTWARE\wow6432Node | Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 04 - HKLM\SOFTWARE\wow6432Node | Run: [BCSSync] - "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices 04 - HKLM\SOFTWARE\wow6432Node | Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 04 - HKLM\SOFTWARE\wow6432Node | Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun 04 - HKLM\SOFTWARE\wow6432Node | Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin 04 - HKLM\SOFTWARE\wow6432Node | Run: [D3DOverrider] - "C:\Users\user\Desktop\D3DOverrider\D3DOverriderWrapper.exe" /s 04 - HKLM\SOFTWARE\wow6432Node | Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" 04 - HKLM\SOFTWARE\wow6432Node | Run: [Adobe Creative Cloud] - "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true 04 - HKLM\SOFTWARE\wow6432Node | Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" 04 - HKLM\SOFTWARE\wow6432Node | Run: [amd_dc_opt] - C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe 04 - HKLM\SOFTWARE\wow6432Node | Run: [20131121] - C:\Program Files\AVAST Software\Avast\setup\emupdate\51f64a97-8894-42ed-9e0a-f76e91cd79f6.exe /check 04 - HKLM\SOFTWARE\wow6432Node | Run: [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui 04 - HKLM\SOFTWARE | RunOnce: [] - 04 - HKLM\SOFTWARE\wow6432Node | RunOnce: [] - 04 - HKU\S-1-5-19\SOFTWARE | Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun 04 - HKU\S-1-5-20\SOFTWARE | Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Steam] - "C:\Program Files (x86)\Steam\steam.exe" -silent 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Desura] - C:\Program Files (x86)\Desura\desura.exe -autostart 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Gadwin PrintScreen] - C:\Program Files (x86)\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [AdobeBridge] - 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Google Update] - "C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe" /c 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [MyTomTomSA.exe] - "C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe" 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [OfficeSyncProcess] - "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Orange Installer] - "C:\Program Files (x86)\Orange\Orange Installer\OrangeInstaller.exe" 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [OrangeInside] - C:\Users\user\AppData\Roaming\Orange\OrangeInside\one\OrangeInside.exe 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [iTunesHelper] - wscript.exe //B "C:\Users\user\AppData\Local\Temp\iTunesHelper.vbe" 04 - HKU\S-1-5-19\SOFTWARE | RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe 04 - HKU\S-1-5-20\SOFTWARE | RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe  ################## | Generic Search |  Present! C:\Users\user\AppData\Local\Temp\iTunesHelper.vbe Present! C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe Present! F:\iTunesHelper.vbe Present! G:\iTunesHelper.vbe Present! C:\install.exe Present! F:\.lnk Present! F:\FRAME.lnk Present! F:\DCIM.lnk Present! F:\.Trashes.lnk Present! F:\.TemporaryItems.lnk Present! C:\Users\user\AppData\Local\Temp\java.exe  ################## | MD5 Comparison Reference |  Md5: 223A90ACCB50879B3CE1895BBF7B3A52 -> C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe Md5: 2BCBCF86077A7E0F77BDB82F331F2957 -> C:\Users\user\AppData\Local\Temp\iTunesHelper.vbe Md5: 792FFECE1BC964E8DD1C464E05A7F0A2 -> F:\iTunesHelper.vbe Md5: 2BCBCF86077A7E0F77BDB82F331F2957 -> G:\iTunesHelper.vbe  ################## | MD5 Comparison |  Present! Md5: 2BCBCF86077A7E0F77BDB82F331F2957 -> C:\Users\user\AppData\Local\Temp\iTunesHelper.vbe Present! Md5: 223A90ACCB50879B3CE1895BBF7B3A52 -> C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe Present! Md5: 792FFECE1BC964E8DD1C464E05A7F0A2 -> F:\iTunesHelper.vbe Present! Md5: 2BCBCF86077A7E0F77BDB82F331F2957 -> G:\iTunesHelper.vbe  ################## | Registry |  Present! HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper Present! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper Present! HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run|iTunesHelper Present! HKCU\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper  ################## | Vaccine |  F:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido) G:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)  ################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ |

Anonymous user · Answer

Re  You switch to the deletion option and send me this report; thank you  --  --------Contributor Security--------- We have all been beginners at something at one point. But knowledge is the reward for diligence.

gregoire.mx · Answer

Should I do it in safe mode too?

gregoire.mx · Answer

Here is the deletion report:  ############################## | UsbFix V 7.153 | [Deletion]  User: user (Administrator) # USER-PC Updated on 09/12/2013 by El Desaparecido - Team SosVirus Launched at 14:06:49 | 12/12/2013  Website: https://www.usbfix.net/ Forum: https://www.sosvirus.net/ Upload Malware: http://www.sosvirus.net/upload_malware.php Contact: https://www.usb-antivirus.com/fr/contact/  PC: Gigabyte Technology Co., Ltd. (H61M-D2H-USB3) CPU: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz RAM -> [Total: 8175 | Free: 7280] Bios: Award Software International, Inc. Boot: Fail-safe boot  OS: Microsoft Windows 7 Home Basic Edition (6.1.7601 64-Bit) Service Pack 1 WB: Windows Internet Explorer: 11.0.9600.16476 WB: Google Chrome: 31.0.1650.63 WB: Mozilla Firefox: 25.0.1  SC: Security Center Service [Enabled] WU: Windows Update Service [Enabled] AV: avast! Antivirus [(!) Disabled | Updated] AS: Windows Defender: 6.1.7600.16385 (win7_rtm.090713-1255) AS: Malwarebytes' Anti-Malware: 1.75.0001 FW: Windows FireWall Service [(!) Disabled]  C:\ (%systemdrive%) -> Hard disk # 1863 Go (1150 Go free(s) - 62%) [] # NTFS D:\ -> CD-ROM E:\ -> CD-ROM G:\ -> Removable disk # 4 Go (4 Go free(s) - 97%) [greg] # NTFS  ################## | Stopped Processes |  Stopped! C:\Windows\SYSTEM32\WISPTIS.EXE (ID: 1796 | ParentID: 848) Stopped! C:\Windows\SYSTEM32\WISPTIS.EXE (ID: 1832 | ParentID: 848) Stopped! C:\Windows\Explorer.exe (ID: 1052 | ParentID: 1572) Stopped! C:\Windows\system32\ctfmon.exe (ID: 1304 | ParentID: 1052) Stopped! C:\Windows\system32\DllHost.exe (ID: 1912 | ParentID: 588)  ################## | Regedit Run |  04 - HKLM\SOFTWARE | Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" 04 - HKLM\SOFTWARE | Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 04 - HKLM\SOFTWARE | Run: [BCSSync] - "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices 04 - HKLM\SOFTWARE | Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 04 - HKLM\SOFTWARE | Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun 04 - HKLM\SOFTWARE | Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin 04 - HKLM\SOFTWARE | Run: [D3DOverrider] - "C:\Users\user\Desktop\D3DOverrider\D3DOverriderWrapper.exe" /s 04 - HKLM\SOFTWARE | Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" 04 - HKLM\SOFTWARE | Run: [Adobe Creative Cloud] - "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true 04 - HKLM\SOFTWARE | Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" 04 - HKLM\SOFTWARE | Run: [amd_dc_opt] - C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe 04 - HKLM\SOFTWARE | Run: [20131121] - C:\Program Files\AVAST Software\Avast\setup\emupdate\51f64a97-8894-42ed-9e0a-f76e91cd79f6.exe /check 04 - HKLM\SOFTWARE | Run: [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui 04 - HKLM\SOFTWARE\wow6432Node | Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" 04 - HKLM\SOFTWARE\wow6432Node | Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 04 - HKLM\SOFTWARE\wow6432Node | Run: [BCSSync] - "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices 04 - HKLM\SOFTWARE\wow6432Node | Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 04 - HKLM\SOFTWARE\wow6432Node | Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun 04 - HKLM\SOFTWARE\wow6432Node | Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin 04 - HKLM\SOFTWARE\wow6432Node | Run: [D3DOverrider] - "C:\Users\user\Desktop\D3DOverrider\D3DOverriderWrapper.exe" /s 04 - HKLM\SOFTWARE\wow6432Node | Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" 04 - HKLM\SOFTWARE\wow6432Node | Run: [Adobe Creative Cloud] - "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true 04 - HKLM\SOFTWARE\wow6432Node | Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" 04 - HKLM\SOFTWARE\wow6432Node | Run: [amd_dc_opt] - C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe 04 - HKLM\SOFTWARE\wow6432Node | Run: [20131121] - C:\Program Files\AVAST Software\Avast\setup\emupdate\51f64a97-8894-42ed-9e0a-f76e91cd79f6.exe /check 04 - HKLM\SOFTWARE\wow6432Node | Run: [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui 04 - HKLM\SOFTWARE | RunOnce: [] - 04 - HKLM\SOFTWARE\wow6432Node | RunOnce: [] - 04 - HKU\S-1-5-19\SOFTWARE | Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun 04 - HKU\S-1-5-20\SOFTWARE | Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Steam] - "C:\Program Files (x86)\Steam\steam.exe" -silent 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Desura] - C:\Program Files (x86)\Desura\desura.exe -autostart 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Gadwin PrintScreen] - C:\Program Files (x86)\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [AdobeBridge] - 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Google Update] - "C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe" /c 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [MyTomTomSA.exe] - "C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe" 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [OfficeSyncProcess] - "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Orange Installer] - "C:\Program Files (x86)\Orange\Orange Installer\OrangeInstaller.exe" 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [OrangeInside] - C:\Users\user\AppData\Roaming\Orange\OrangeInside\one\OrangeInside.exe 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [iTunesHelper] - wscript.exe //B "C:\Users\user\AppData\Local\Temp\iTunesHelper.vbe" 04 - HKU\S-1-5-19\SOFTWARE | RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe 04 - HKU\S-1-5-20\SOFTWARE | RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe  ################## | Generic Search |  Deleted! C:\Users\user\AppData\Local\Temp\iTunesHelper.vbe Deleted! C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe Deleted! G:\iTunesHelper.vbe Deleted! C:\install.exe Deleted! C:\Users\user\AppData\Local\Temp\java.exe  (!) Temporary files deleted.  ################## | MD5 Comparison Reference |  Md5 : FE289C99EEC0E87C96F4ABC7470D1868 -> C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iTunesHelper.vbe Md5 : 2BCBCF86077A7E0F77BDB82F331F2957 -> C:\Users\user\AppData\Local\Temp\iTunesHelper.vbe Md5 : 451EE6D7BF39B268BCC16BCA7517F89F -> G:\iTunesHelper.vbe  ################## | MD5 Comparison |  -> No identical MD5 value found.  ################## | Registry |  Deleted! HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper Deleted! HKLM\Software\Microsoft\Windows\CurrentVersion\Run|iTunesHelper  ################## | Listing |  [07/11/2007 - 07:00:40 | N | 0 Ko] - C:\eula.1041.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.1036.txt [07/11/2007 - 07:00:40 | N | 10 Ko] - C:\eula.1033.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.1031.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.1028.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.1042.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.2052.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.3082.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.1040.txt [19/06/2013 - 10:13:03 | N | 24 Ko] - C:\AdwCleaner[R1].txt [19/06/2013 - 10:13:49 | N | 24 Ko] - C:\AdwCleaner[S1].txt [20/06/2013 - 09:28:13 | N | 1 Ko] - C:\AdwCleaner[R2].txt [20/06/2013 - 12:19:38 | N | 1 Ko] - C:\AdwCleaner[R3].txt [20/06/2013 - 12:20:20 | N | 1 Ko] - C:\AdwCleaner[R4].txt [20/06/2013 - 12:20:33 | N | 1 Ko] - C:\AdwCleaner[S2].txt [12/12/2013 - 12:45:03 | N | 12 Ko] - C:\UsbFix [Scan 1] USER-PC.txt [12/12/2013 - 13:44:35 | N | 10 Ko] - C:\UsbFix [Scan 2] USER-PC.txt [12/12/2013 - 14:06:02 | N | 9 Ko] - C:\UsbFix [Scan 3] USER-PC.txt [12/12/2013 - 14:10:57 | A | 9 Ko] - C:\UsbFix [Clean 1] USER-PC.txt [12/12/2013 - 13:57:45 | ASH | 6278584 Ko] - C:\hiberfil.sys [12/12/2013 - 13:57:47 | ASH | 8371448 Ko] - C:\pagefile.sys [07/11/2007 - 07:12:28 | N | 228 Ko] - C:\VC_RED.MSI [11/12/2013 - 22:57:44 | D] - C:\Config.Msi [29/11/2012 - 19:15:17 | N | 0 Ko] - C:\csb.log [30/11/2012 - 02:07:28 | N | 3 Ko] - C:\RHDSetup.log [30/11/2012 - 02:07:28 | N | 0 Ko] - C:\Install.log [07/11/2007 - 07:00:40 | N | 1 Ko] - C:\install.ini [07/11/2007 - 07:00:40 | N | 1 Ko] - C:\globdata.ini [07/11/2007 - 07:03:18 | N | 74 Ko] - C:\install.res.2052.dll [07/11/2007 - 07:03:18 | N | 94 Ko] - C:\install.res.3082.dll [07/11/2007 - 07:03:18 | N | 78 Ko] - C:\install.res.1042.dll [07/11/2007 - 07:03:18 | N | 94 Ko] - C:\install.res.1031.dll [07/11/2007 - 07:03:18 | N | 89 Ko] - C:\install.res.1033.dll [07/11/2007 - 07:03:18 | N | 95 Ko] - C:\install.res.1036.dll [07/11/2007 - 07:03:18 | N | 93 Ko] - C:\install.res.1040.dll [07/11/2007 - 07:03:18 | N | 80 Ko] - C:\install.res.1041.dll [07/11/2007 - 07:03:18 | N | 75 Ko] - C:\install.res.1028.dll [12/12/2013 - 13:48:31 | N | 1 Ko] - C:\.dir [07/11/2007 - 07:09:22 | N | 1409 Ko] - C:\VC_RED.cab [07/11/2007 - 07:00:40 | N | 6 Ko] - C:\vcredist.bmp [30/11/2012 - 02:02:36 | SHD] - C:\$Recycle.Bin [14/07/2009 - 04:20:08 | D] - C:\PerfLogs [14/07/2009 - 06:08:56 | SHD] - C:\Documents and Settings [30/11/2012 - 02:02:21 | SHD] - C:\Recovery [30/11/2012 - 02:02:26 | D] - C:\Users [30/11/2012 - 02:06:02 | D] - C:\Intel [06/12/2012 - 17:09:00 | RHD] - C:\MSOCache [24/03/2013 - 20:24:37 | D] - C:\FFOutput [26/03/2013 - 12:58:05 | D] - C:\AMD [14/10/2013 - 18:55:52 | D] - C:\AdwCleaner [17/10/2013 - 10:22:04 | D] - C:\Autodesk [25/10/2013 - 22:07:58 | D] - C:\xampp [26/11/2013 - 14:14:42 | D] - C:\Games [26/11/2013 - 14:16:36 | N | 0 Ko] - C:\END [03/12/2013 - 11:50:56 | HD] - C:\ProgramData [04/12/2013 - 10:28:26 | D] - C:\Program Files [09/12/2013 - 18:57:56 | D] - C:\Program Files (x86) [11/12/2013 - 22:55:04 | SHD] - C:\System Volume Information [12/12/2013 - 13:35:30 | D] - C:\Windows [12/12/2013 - 14:10:36 | D] - C:\UsbFix [12/12/2013 - 14:06:01 | RASHD] - G:\Autorun.inf  ################## | Vaccine |  G:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)  ################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ |

Anonymous user · Answer

Re  Why unplug the F key?  You are taking the delete option with this key plugged in  @+   --------Security Contributor--------- We have all been beginners at something at some point. But knowledge is the reward of diligence.

gregoire.mx · Answer

Yes, that's what I noticed. Actually, it's my camera; it ran out of battery and turned off by itself. I'm recharging the battery and I'll start over.

gregoire.mx · Answer

after recharging the battery and reconnecting everything, here is this deletion report:  ############################## | UsbFix V 7.153 | [Deletion]  User: user (Administrator) # USER-PC Updated on 12/09/2013 by El Desaparecido - Team SosVirus Started at 14:59:09 | 12/12/2013  Website: https://www.usbfix.net/ Forum: https://www.sosvirus.net/ Upload Malware: http://www.sosvirus.net/upload_malware.php Contact: https://www.usb-antivirus.com/fr/contact/  PC: Gigabyte Technology Co., Ltd. (H61M-D2H-USB3) CPU: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz RAM -> [Total: 8175 | Free: 7255] Bios: Award Software International, Inc. Boot: Fail-safe boot  OS: Microsoft Windows 7 Home Basic Edition (6.1.7601 64-Bit) Service Pack 1 WB: Windows Internet Explorer: 11.0.9600.16476 WB: Google Chrome: 31.0.1650.63 WB: Mozilla Firefox: 25.0.1  SC: Security Center Service [Enabled] WU: Windows Update Service [Enabled] AV: avast! Antivirus [Enabled | Updated] AS: Windows Defender: 6.1.7600.16385 (win7_rtm.090713-1255) AS: Malwarebytes' Anti-Malware: 1.75.0001 FW: Windows FireWall Service [(!) Disabled]  C:\ (%systemdrive%) -> Fixed disk # 1863 Go (1153 Go free - 62%) [] # NTFS D:\ -> CD-ROM E:\ -> CD-ROM F:\ -> Removable disk # 2 Go (738 Mo free - 38%) [] # FAT G:\ -> Removable disk # 4 Go (4 Go free - 99%) [greg] # NTFS  ################## | Stopped Processes |  Stopped! C:\Windows\explorer.exe (ID: 936 |ParentID: 432) Stopped! C:\Windows\system32\ctfmon.exe (ID: 1160 |ParentID: 936) Stopped! C:\Windows\SYSTEM32\WISPTIS.EXE (ID: 580 |ParentID: 840) Stopped! C:\Windows\SYSTEM32\WISPTIS.EXE (ID: 944 |ParentID: 840)  ################## | Regedit Run |  04 - HKLM\SOFTWARE | Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" 04 - HKLM\SOFTWARE | Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 04 - HKLM\SOFTWARE | Run: [BCSSync] - "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices 04 - HKLM\SOFTWARE | Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 04 - HKLM\SOFTWARE | Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun 04 - HKLM\SOFTWARE | Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin 04 - HKLM\SOFTWARE | Run: [D3DOverrider] - "C:\Users\user\Desktop\D3DOverrider\D3DOverriderWrapper.exe" /s 04 - HKLM\SOFTWARE | Run: [Adobe Creative Cloud] - "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true 04 - HKLM\SOFTWARE | Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" 04 - HKLM\SOFTWARE | Run: [amd_dc_opt] - C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe 04 - HKLM\SOFTWARE | Run: [20131121] - C:\Program Files\AVAST Software\Avast\setup\emupdate\51f64a97-8894-42ed-9e0a-f76e91cd79f6.exe /check 04 - HKLM\SOFTWARE | Run: [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui 04 - HKLM\SOFTWARE\wow6432Node | Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" 04 - HKLM\SOFTWARE\wow6432Node | Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe 04 - HKLM\SOFTWARE\wow6432Node | Run: [BCSSync] - "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices 04 - HKLM\SOFTWARE\wow6432Node | Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 04 - HKLM\SOFTWARE\wow6432Node | Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun 04 - HKLM\SOFTWARE\wow6432Node | Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin 04 - HKLM\SOFTWARE\wow6432Node | Run: [D3DOverrider] - "C:\Users\user\Desktop\D3DOverrider\D3DOverriderWrapper.exe" /s 04 - HKLM\SOFTWARE\wow6432Node | Run: [Adobe Creative Cloud] - "C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" --showwindow=false --onOSstartup=true 04 - HKLM\SOFTWARE\wow6432Node | Run: [SunJavaUpdateSched] - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" 04 - HKLM\SOFTWARE\wow6432Node | Run: [amd_dc_opt] - C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe 04 - HKLM\SOFTWARE\wow6432Node | Run: [20131121] - C:\Program Files\AVAST Software\Avast\setup\emupdate\51f64a97-8894-42ed-9e0a-f76e91cd79f6.exe /check 04 - HKLM\SOFTWARE\wow6432Node | Run: [AvastUI.exe] - "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui 04 - HKLM\SOFTWARE | RunOnce: [] - 04 - HKLM\SOFTWARE\wow6432Node | RunOnce: [] - 04 - HKU\S-1-5-19\SOFTWARE | Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun 04 - HKU\S-1-5-20\SOFTWARE | Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Steam] - "C:\Program Files (x86)\Steam\steam.exe" -silent 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [DAEMON Tools Lite] - "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Desura] - C:\Program Files (x86)\Desura\desura.exe -autostart 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Gadwin PrintScreen] - C:\Program Files (x86)\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [AdobeBridge] - 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Google Update] - "C:\Users\user\AppData\Local\Google\Update\GoogleUpdate.exe" /c 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [MyTomTomSA.exe] - "C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe" 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [OfficeSyncProcess] - "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [Orange Installer] - "C:\Program Files (x86)\Orange\Orange Installer\OrangeInstaller.exe" 04 - HKU\S-1-5-21-2533516340-1630299862-2881606751-1000\SOFTWARE | Run: [OrangeInside] - C:\Users\user\AppData\Roaming\Orange\OrangeInside\one\OrangeInside.exe 04 - HKU\S-1-5-19\SOFTWARE | RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe 04 - HKU\S-1-5-20\SOFTWARE | RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe  ################## | Generic Search |  Deleted! F:\.TemporaryItems.lnk Deleted! F:\iTunesHelper.vbe  (!) Temporary files deleted.  ################## | MD5 Comparison Reference |  Md5 : 2BCBCF86077A7E0F77BDB82F331F2957 -> F:\iTunesHelper.vbe  ################## | MD5 Comparison |  -> No identical Md5 value found.  ################## | Registry |   ################## | Listing |  [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.1042.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.1031.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.1028.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.1036.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.1040.txt [07/11/2007 - 07:00:40 | N | 0 Ko] - C:\eula.1041.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.2052.txt [07/11/2007 - 07:00:40 | N | 17 Ko] - C:\eula.3082.txt [07/11/2007 - 07:00:40 | N | 10 Ko] - C:\eula.1033.txt [19/06/2013 - 10:13:03 | N | 24 Ko] - C:\AdwCleaner[R1].txt [19/06/2013 - 10:13:49 | N | 24 Ko] - C:\AdwCleaner[S1].txt [20/06/2013 - 09:28:13 | N | 1 Ko] - C:\AdwCleaner[R2].txt [20/06/2013 - 12:19:38 | N | 1 Ko] - C:\AdwCleaner[R3].txt [20/06/2013 - 12:20:20 | N | 1 Ko] - C:\AdwCleaner[R4].txt [20/06/2013 - 12:20:33 | N | 1 Ko] - C:\AdwCleaner[S2].txt [12/12/2013 - 12:45:03 | N | 12 Ko] - C:\UsbFix [Scan 1] USER-PC.txt [12/12/2013 - 13:44:35 | N | 10 Ko] - C:\UsbFix [Scan 2] USER-PC.txt [12/12/2013 - 14:06:02 | N | 9 Ko] - C:\UsbFix [Scan 3] USER-PC.txt [12/12/2013 - 14:10:59 | N | 11 Ko] - C:\UsbFix [Clean 1] USER-PC.txt [12/12/2013 - 14:58:46 | N | 8 Ko] - C:\UsbFix [Scan 4] USER-PC.txt [12/12/2013 - 15:03:06 | A | 8 Ko] - C:\UsbFix [Clean 2] USER-PC.txt [12/12/2013 - 14:41:37 | ASH | 6278584 Ko] - C:\hiberfil.sys [12/12/2013 - 14:41:40 | ASH | 8371448 Ko] - C:\pagefile.sys [07/11/2007 - 07:12:28 | N | 228 Ko] - C:\VC_RED.MSI [11/12/2013 - 22:57:44 | D] - C:\Config.Msi [29/11/2012 - 19:15:17 | N | 0 Ko] - C:\csb.log [30/11/2012 - 02:07:28 | N | 0 Ko] - C:\Install.log [30/11/2012 - 02:07:28 | N | 3 Ko] - C:\RHDSetup.log [07/11/2007 - 07:00:40 | N | 1 Ko] - C:\globdata.ini [07/11/2007 - 07:00:40 | N | 1 Ko] - C:\install.ini [07/11/2007 - 07:03:18 | N | 75 Ko] - C:\install.res.1028.dll [07/11/2007 - 07:03:18 | N | 94 Ko] - C:\install.res.3082.dll [07/11/2007 - 07:03:18 | N | 89 Ko] - C:\install.res.1033.dll [07/11/2007 - 07:03:18 | N | 95 Ko] - C:\install.res.1036.dll [07/11/2007 - 07:03:18 | N | 93 Ko] - C:\install.res.1040.dll [07/11/2007 - 07:03:18 | N | 80 Ko] - C:\install.res.1041.dll [07/11/2007 - 07:03:18 | N | 78 Ko] - C:\install.res.1042.dll [07/11/2007 - 07:03:18 | N | 74 Ko] - C:\install.res.2052.dll [07/11/2007 - 07:03:18 | N | 94 Ko] - C:\install.res.1031.dll [12/12/2013 - 14:14:43 | N | 1 Ko] - C:\.dir [07/11/2007 - 07:09:22 | N | 1409 Ko] - C:\VC_RED.cab [07/11/2007 - 07:00:40 | N | 6 Ko] - C:\vcredist.bmp [30/11/2012 - 02:02:36 | SHD] - C:\$Recycle.Bin [14/07/2009 - 04:20:08 | D] - C:\PerfLogs [14/07/2009 - 06:08:56 | SHD] - C:\Documents and Settings [30/11/2012 - 02:02:21 | SHD] - C:\Recovery [30/11/2012 - 02:02:26 | D] - C:\Users [30/11/2012 - 02:06:02 | D] - C:\Intel [06/12/2012 - 17:09:00 | RHD] - C:\MSOCache [24/03/2013 - 20:24:37 | D] - C:\FFOutput [26/03/2013 - 12:58:05 | D] - C:\AMD [14/10/2013 - 18:55:52 | D] - C:\AdwCleaner [17/10/2013 - 10:22:04 | D] - C:\Autodesk [25/10/2013 - 22:07:58 | D] - C:\xampp [26/11/2013 - 14:14:42 | D] - C:\Games [26/11/2013 - 14:16:36 | N | 0 Ko] - C:\END [03/12/2013 - 11:50:56 | HD] - C:\ProgramData [04/12/2013 - 10:28:26 | D] - C:\Program Files [09/12/2013 - 18:57:56 | D] - C:\Program Files (x86) [11/12/2013 - 22:55:04 | SHD] - C:\System Volume Information [12/12/2013 - 13:35:30 | D] - C:\Windows [12/12/2013 - 14:59:11 | D] - C:\UsbFix [03/01/2009 - 18:59:26 | N | 4 Ko] - F:\._.Trashes [03/01/2009 - 18:59:26 | SHD] - F:\.Trashes [17/01/2009 - 12:25:48 | N | 4 Ko] - F:\._.TemporaryItems [17/01/2009 - 12:25:48 | D] - F:\.TemporaryItems [12/12/2013 - 14:58:48 | RASHD] - F:\Autorun.inf [01/01/2008 - 00:00:00 | D] - F:\DCIM [01/01/2008 - 00:00:00 | D] - F:\FRAME [12/12/2013 - 14:58:46 | RASHD] - G:\Autorun.inf  ################## | Vaccine |  F:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido) G:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)  ################## | E.O.F | https://www.usbfix.net/ - https://www.sosvirus.net/ |

Anonymous user · Answer

Re  Download Malwaresbytes anti malware here https://www.malwarebytes.com/  * Install it (make sure to choose "French"; do not change the installation settings) and  update it.   * Review the tutorial to get familiar with the program:  https://forum.pcastuces.com/sujet.asp?f=31&s=3  (that said, it is very easy to use).  Restart Malwaresbytes by carefully following these instructions:  ! Disconnect and close all running applications!  * Launch Malwarebyte's.  Under Vista, Seven or Windows 8 (right-click and select "run as administrator")  *Proceed with an update  *Perform a "Quick" scan  --> Let the program run (and do not use the PC for anything else during the scan). --> At the end, click on  "Show results" . --> Make sure all infected items are checked, then  click on "remove selected" .   Note: if your PC needs to restart to complete the cleanup, do it!    Post the saved report after removing the infected items  (in the "report/log" tab of Malwaresbytes, the most recent one)  @+  --  --------Security Contributor--------- We have all been beginners at something at some point. But knowledge is the reward of diligence.

gregoire.mx · Answer

Do you think I’m done with these damn viruses?

Anonymous user · Answer

Re  awaiting the MBAM report; thank you  --  --------Security Contributor--------- We have all been a beginner at something at some point. But knowledge is the reward for diligence.

gregoire.mx · Answer

ah, I thought I had posted it, here it is :  Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org  Database version: v2013.12.12.04  Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16476 user :: USER-PC [administrator]  12/12/2013 15:21:10 mbam-log-2013-12-12 (15-21-10).txt  Scan type: Full scan (C:\|F:\|G:\) Scan options enabled: Memory | Startup | Registry | File System | Heuristic/Extra | Heuristic/Shuriken | PUP | PUM Scan options disabled: P2P Item(s) scanned: 625205 Elapsed time: 1 hour(s), 25 minute(s), 27 second(s)  Memory processes detected: 0 (No harmful items detected)  Memory modules detected: 0 (No harmful items detected)  Registry key(s) detected: 21 HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Software.Updater) -> Successfully quarantined and removed. HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> Successfully quarantined and removed. HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> Successfully quarantined and removed. HKCR\Updater.AmiUpd.1 (PUP.Software.Updater) -> Successfully quarantined and removed. HKCR\Updater.AmiUpd (PUP.Software.Updater) -> Successfully quarantined and removed. HKCR\CLSID\{A6FEED89-3BCD-4D19-9DC2-3E613A80A2A4} (PUP.Optional.Amonetize.A) -> Successfully quarantined and removed. HKCR\TypeLib\{1C1356DA-1E98-4810-A9F6-18D89BD1C0C0} (PUP.Optional.Amonetize.A) -> Successfully quarantined and removed. HKCR\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7} (PUP.Optional.Amonetize.A) -> Successfully quarantined and removed. HKCR\AmiBs.Installer.1 (PUP.Optional.Amonetize.A) -> Successfully quarantined and removed. HKCR\AmiBs.Installer (PUP.Optional.Amonetize.A) -> Successfully quarantined and removed. HKCR\CLSID\{F63AAEDC-3602-49EF-AA45-262380A98980} (PUP.Optional.ValueApps) -> Successfully quarantined and removed. HKCR\TypeLib\{C9A54DFE-051F-49C5-9FC7-ECB81DC6C69F} (PUP.Optional.ValueApps) -> Successfully quarantined and removed. HKCR\Interface\{8050556E-4AD3-40BD-B338-7DBB0D5C10C8} (PUP.Optional.ValueApps) -> Successfully quarantined and removed. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F63AAEDC-3602-49EF-AA45-262380A98980} (PUP.Optional.ValueApps) -> Successfully quarantined and removed. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{F63AAEDC-3602-49EF-AA45-262380A98980} (PUP.Optional.ValueApps) -> Successfully quarantined and removed. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{F63AAEDC-3602-49EF-AA45-262380A98980} (PUP.Optional.ValueApps) -> Successfully quarantined and removed. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F63AAEDC-3602-49EF-AA45-262380A98980} (PUP.Optional.ValueApps) -> Successfully quarantined and removed. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ValueApps (PUP.Optional.ValueAppsplugin.A) -> Successfully quarantined and removed. HKCR\TypeLib\{DD7858C7-889A-42E4-9863-E4AA3A0BFE65} (PUP.Optional.ValueAppsplugin.A) -> Successfully quarantined and removed. HKCR\Interface\{68FD483F-A55D-4B78-AE10-48EF2BBE317E} (PUP.Optional.ValueAppsplugin.A) -> Successfully quarantined and removed. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> Successfully quarantined and removed.  Registry value(s) detected: 0 (No harmful items detected)  Registry data item(s) detected: 0 (No harmful items detected)  Folder(s) detected: 4 C:\Users\user\AppData\Roaming\ValueApps\IE (PUP.Optional.ValueAppsplugin.A) -> Successfully quarantined and removed. C:\Users\user\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Successfully quarantined and removed. C:\Users\user\AppData\Roaming\OpenCandy\2EB41CADA1874F159622875537DBCB32 (PUP.Optional.OpenCandy) -> Successfully quarantined and removed. C:\Users\user\AppData\Local\Temp\ct3311333 (PUP.Optional.Conduit.A) -> Successfully quarantined and removed.  File(s) detected: 77 C:\Users\user\AppData\Roaming\ValueApps\IE\MonPrx.dll (PUP.Optional.ValueApps) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_ar.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_bg.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_bn.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_ca.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_cs.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_da.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_de.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_el.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_en-GB.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_en.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_es-419.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_es.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_et.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_fa.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_fi.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_fil.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_gu.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_hi.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_hr.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_hu.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_id.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_is.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_it.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_iw.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_ja.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_kn.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_ko.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_lv.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_ml.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_mr.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_ms.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_nl.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_no.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_or.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_pl.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_pt-BR.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_pt-PT.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_ro.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_ru.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_sk.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_sl.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_sr.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_sv.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_ta.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_te.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_th.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_tr.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_uk.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_ur.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_vi.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_zh-CN.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\goopdateres_zh-TW.dll.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\SoftwareCrashHandler.exe.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\AdwCleaner\Quarantine\C\Program Files (x86)\Software\Update\1.2.201.0\SoftwareUpdate.exe.vir (Adware.Boxore) -> Successfully quarantined and removed. C:\Program Files\Adobe\Adobe After Effects CS6\Support Files\amtlib.dll (PUP.RiskwareTool.CK) -> Successfully quarantined and removed. C:\Program Files\Adobe\Adobe Illustrator CS6 (64 Bit)\Support Files\Contents\Windows\amtlib.dll (PUP.RiskwareTool.CK) -> Successfully quarantined and removed. C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)\amtlib.dll (PUP.RiskwareTool.CK) -> Successfully quarantined and removed. C:\Program Files (x86)\Adobe\Adobe Dreamweaver CS6\amtlib.dll (PUP.RiskwareTool.CK) -> Successfully quarantined and removed. C:\Program Files (x86)\Adobe\Adobe Flash CS6\amtlib.dll (PUP.RiskwareTool.CK) -> Successfully quarantined and removed. C:\Program Files (x86)\Adobe\Adobe InDesign CS6\amtlib.dll (PUP.RiskwareTool.CK) -> Successfully quarantined and removed. C:\Users\user\AppData\Local\Temp\mam-ct3316263\ctbe.exe (PUP.Optional.Conduit) -> Successfully quarantined and removed. C:\Users\user\AppData\Local\Temp\mam-ct3316263\mamstub.exe (PUP.Optional.Conduit.A) -> Successfully quarantined and removed. C:\Users\user\AppData\Local\Temp\__TEMPWEBPLAYER__\bubble.exe (PUP.Optional.BubbleDock.A) -> Successfully quarantined and removed. C:\Users\user\Desktop\greg\keygen\amtlib.dll (PUP.RiskwareTool.CK) -> Successfully quarantined and removed. C:\Users\user\Desktop\greg\keygen\autodesk3dsmax2013x64keygen.zip (RiskWare.Tool.CK) -> Successfully quarantined and removed. C:\Users\user\Desktop\greg\keygen\EA.Games.Multi.Keygen.exe (RiskWare.Tool.CK) -> Successfully quarantined and removed. C:\Users\user\Desktop\greg\keygen\autodesk3dsmax2013x64keygen\xf-3dsmax_x64.exe (RiskWare.Tool.CK) -> Successfully quarantined and removed. C:\Users\user\Downloads\Avast_Pro_Antivirus_2013_Keys_generator_downloader_fr_154.exe (PUP.Optional.GoForFiles.A) -> Successfully quarantined and removed. C:\Users\user\AppData\Roaming\ValueApps\IE\settings.json (PUP.Optional.ValueAppsplugin.A) -> Successfully quarantined and removed. C:\Users\user\AppData\Roaming\ValueApps\IE\EnableExtDll.dll (PUP.Optional.ValueAppsplugin.A) -> Successfully quarantined and removed. C:\Users\user\AppData\Roaming\ValueApps\IE\uninstaller.exe (PUP.Optional.ValueAppsplugin.A) -> Successfully quarantined and removed. C:\Users\user\AppData\Roaming\ValueApps\IE\ValueAppLog0.log (PUP.Optional.ValueAppsplugin.A) -> Successfully quarantined and removed. C:\Users\user\AppData\Roaming\ValueApps\IE\ValueApps.exe (PUP.Optional.ValueAppsplugin.A) -> Successfully quarantined and removed. C:\Users\user\AppData\Roaming\OpenCandy\2EB41CADA1874F159622875537DBCB32\Setupsft_chr_p1v7.exe (PUP.Optional.OpenCandy) -> Successfully quarantined and removed. C:\Users\user\AppData\Local\Temp\ct3311333\chromeid.txt (PUP.Optional.Conduit.A) -> Successfully quarantined and removed. C:\Users\user\AppData\Local\Temp\ct3311333\setup.ini.txt (PUP.Optional.Conduit.A) -> Successfully quarantined and removed.  (end)

Anonymous user · Answer

Re  Download AdwCleaner (by Xplode) to your desktop. Run it, click on [Scan] and wait for the scan to complete. Once the scan is finished, click on the [Clean] button. Wait during the cleaning process. Read the message that appears, then click on Ok. The PC will automatically restart and the report will open at the end of the restart. Post the report  Note: The report is also saved under C:\AdwCleaner[S1].txt  To read: Toolbars are not mandatory (by Malekal): https://forum.malekal.com/viewtopic.php?t=6173&start= Potentially unwanted programs: https://forum.malekal.com/viewtopic.php?t=33776&start= https://www.malekal.com/adwares-pup-protection/  @+  --  --------Security Contributor--------- We have all been beginners at something at some point. But knowledge is the reward for diligence.

gregoire.mx · Answer

I did what you told me, here is the report:  # AdwCleaner v3.015 - Report created on 12/12/2013 at 17:29:13 # Updated on 10/12/2013 by Xplode # Operating system: Windows 7 Home Basic Service Pack 1 (64 bits) # Username: user - USER-PC # Executed from: C:\Users\user\Downloads\adwcleaner.exe # Option: Clean  ***** [ Services ] *****   ***** [ Files / Folders ] *****  Folder Deleted: C:\users\user\AppData\Local\SwvUpdater Folder Deleted: C:\users\user\AppData\LocalLow\Softonic Folder Deleted: C:\users\user\AppData\Roaming\goforfiles Folder Deleted: C:\users\user\AppData\Roaming\ValueApps File Deleted: C:\END File Deleted: C:\Program Files (x86)\Mozilla Firefox\searchplugins\safeguard-secure-search.xml File Deleted: C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\035xrjsp.default\user.js File Deleted: C:\Windows\System32\Tasks\Desk 365 RunAsStdUser File Deleted: C:\Windows\System32\Tasks\GoforFilesUpdate  ***** [ Shortcuts ] *****   ***** [ Registry ] *****  Key Deleted: HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32 Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\updateSaltarSmart_RASAPI32 Key Deleted: HKLM\SOFTWARE\Microsoft\Tracing\updateSaltarSmart_RASMANCS Key Deleted: HKLM\SYSTEM\CurrentControlSet\services\eventlog\Application\Update SaltarSmart Key Deleted: HKLM\SOFTWARE\Classes\AppID\{4277F7CF-0000-46CF-BA49-D624465C4BAB} Key Deleted: HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D} Key Deleted: HKLM\SOFTWARE\Classes\AppID\{88AF4F6A-C6B7-4229-9275-824E98BF97F9} Key Deleted: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C9A6357B-25CC-4BCF-96C1-78736985D412} Key Deleted: HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C5CBB76-7379-4490-AA5B-B037C0A36381} Key Deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{3860D897-7DCD-473C-9744-B21DB133AB20} Key Deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} Key Deleted: [x64] HKLM\SOFTWARE\Classes\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7} Key Deleted: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F63AAEDC-3602-49EF-AA45-262380A98980} Key Deleted: HKCU\Software\Conduit Key Deleted: HKCU\Software\GoforFiles Key Deleted: HKCU\Software\AppDataLow\Software\Conduit Key Deleted: HKLM\Software\GoforFiles Key Deleted: HKLM\Software\hdcode Key Deleted: HKLM\Software\Uniblue  ***** [ Browsers ] *****  -\ Internet Explorer v11.0.9600.16428  Restored Setting: HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]  -\ Mozilla Firefox v25.0.1 (fr)  [ File: C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\035xrjsp.default\prefs.js ]   [ File: C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\h0d63oi1.default\prefs.js ]   -\ Google Chrome v31.0.1650.63  [ File: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\preferences ]  Deleted: homepage Deleted: urls_to_restore_on_startup  *************************  AdwCleaner[R0].txt - [19930 bytes] - [14/10/2013 17:24:10] AdwCleaner[R1].txt - [3661 bytes] - [12/12/2013 17:28:00] AdwCleaner[S0].txt - [20034 bytes] - [14/10/2013 18:55:44] AdwCleaner[S1].txt - [3418 bytes] - [12/12/2013 17:29:13]  ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [3478 bytes] ##########

Anonymous user · Answer

Re  There’s quite a bit of cleaning done!  To check for software updates to apply on your PC https://www.flexera.com/products/operations/software-vulnerability-management.html The free version is at the bottom right Various links will be offered for outdated software.   See you later   --  --------Security Contributor--------- We have all been beginners at something at one point. But knowledge is the reward of diligence.

gregoire.mx · Answer

Alright, I'll check that out, but as for the initial virus, that is, the one that was on the USB drives and my computer, do you think it’s gone?  In any case, thanks for your quick response, you’re my hero of the day!

Anonymous user · Answer

We haven't finished ...  Keep me updated once these updates are made; thanks  See you later  --  --------Security Contributor--------- We've all been beginners at something at some point. But knowledge is the reward of diligence.

gregoire.mx · Answer

It's good, I've updated the programs that were not updated.

Anonymous user · Answer

Re  If you say so; it’s for the safety of your PC and your wallet.  We finalize.  Download DelFix from Xplode  Run it. You have 5 choices:   Reactivate UAC  Remove disinfection tools (checked by default) Make a backup of the registry  Purge system restore Factory reset settings  Check the ones that are in bold and you execute The report is generally found here C:\DelFix.txt    The rest of the security: http://forum.malekal.com/comment-securiser-son-ordinateur.html   @+ --  --------Security Contributor--------- We all were beginners at something at one point. But knowledge is the reward of diligence.

gregoire.mx · Answer

I have nothing in bold, there is only "Remove disinfectant tools" (checked by default)   Does that mean it's good? :)

gregoire.mx · Answer

Sorry!  It's done:  # DelFix v10.6 - Report created on 12/12/2013 at 18:24:59 # Updated on 11/11/2013 by Xplode # Username: user - USER-PC # Operating System: Windows 7 Home Basic Service Pack 1 (64 bit)  ~ UAC activation ... OK  ~ Removal of disinfection tools ...   ~ Purge of system restore ...  Deleted: RP #173 [End of disinfection | 12/12/2013 17:22:27]  New restore point created!  ########## - EOF - ##########

Anonymous user · Answer

Here you go  I therefore suggest to consider this subject as resolved  See you later  --  --------Security Contributor--------- We have all been beginners at something at some point. But knowledge is the reward for diligence.

gregoire.mx · Answer

Thank you for everything! I'm going to mark it as "resolved"  last question: "What are these viruses for? Who benefits from them? What are their networks? Who is pulling the strings?"   other than annoying people, I don't see the point....

Anonymous user · Answer

Re  You have some links at the bottom of some of my answers; you can start by reading them ;-)  @+  --  --------Security Contributor--------- We have all been beginners at something at some point. But knowledge is the reward for diligence.

caro0603 · Answer

I'm sorry, but I can't assist with that.

Unable to download usbfix

35 answers

Capistars.fr

This solar-powered, gps-enabled agricultural robot sows and weaves weeds by itself (and without pesticides)

Missing lock icon

Anomalies in my laptop usage: virus?

Meetic change main photo

Avoid driving on august 1st, the worst day for summer traffic.

Self-invoking js function

Suspicion of network compromise / public ip

Full screen mode

Cannot use my ctp18 tablet with meetingbar