View original (French)

Virus.Worm.VBS: Infected USB Drive - Video.3gp

Solved/Closed
JodoDune Posted messages 2 Status Member -  
 Gitane -
Hello everyone,
Yesterday, I inserted my USB drive into an unknown PC, and when I plugged it back into my own PC, I noticed it contained new folders named "DCIM", "PHOTO FAMILY", "VIDEO", and others.
Two things:
-All these folders are shortcuts that open new windows when I click on them
-They reappear immediately after deletion
I have therefore removed my USB drive, but unfortunately, "PHOTO FAMILY" is now in my D: drive and won't disappear.
It's clearly a .lnk folder, and here is some other information:
Here is the path: C:\Windows\system32\WScript.exe /e:VBScript.Encode Video.3gp
The location is system 32
Target type: application

What should I do to remove it from my PC and to fix my USB drive?

Thank you,

Someone who didn’t go out covered.

14 answers

  1. RGESCHE
     
    Hello,

    Due to the infection of our establishment by this virus, I had to develop countermeasures. I would like to share them with you here.

    The archive consists of 2 scripts and a document explaining the procedure for those who do not trust the scripts (in fact done beforehand) or simply wish to understand the scripts.

    The anti-video3gp script unlocks the keys.
    The anti-video3gp-cleanPC script unlocks the Windows machines (Mac and Linux are not infected).

    Link gdrive: https://drive.google.com/file/d/0Bw96BWzgemOmTzV4UGJpTGJyeXc/view?usp=sharing
    13
    1. Jack
       
      You're welcome!
      0
    2. Phil
       
      A big thank you to the author because I was very annoyed about the amount of important data on my USB drive. In just a few clicks, the drive was completely cleaned, and the operation lasted less than a minute.
      Well done!
      Philippe
      1
    3. garulfo69
       
      Thank you very much for your help! Computer cleaned and then the 2 infected keys. Thank you thank you!!
      0
    4. STT
       
      Thank you very much! Really!
      1
    5. Gitane
       
      Really, it's magic, Thank you SO much for your help.
      0
  2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hello,

    This is about the USB VBS.Crypt Virus.

    Follow the FRST tutorial. ( take the time to read carefully - everything is well explained ).

    Download and run the FRST scan, 3 FRST reports will be generated:
    • FRST.txt
    • Shortcut.txt
    • Additional.txt


    Send these 3 reports to the site http://pjjoint.malekal.com/ and in return provide the 3 pjjoint links that lead to the reports here in a new response so that we can consult them.

    Please press a key to continue the disinfection...
    1
    1. Julien
       
      Hello,
      I have exactly the same problem...
      I allow myself to provide you with the three links requested above:
      frst http://pjjoint.malekal.com/files.php?id=FRST_20160510_z8c7y69j7
      addition http://pjjoint.malekal.com/files.php?id=20160510_g5k1313f13e6
      shotcut http://pjjoint.malekal.com/files.php?id=20160510_d11n7q6o9s15
      Thank you for your help
      Best regards
      Julien
      0
    2. cyber75 Posted messages 5 Status Member
       
      Hello,

      Please help me here are the reports

      https://pjjoint.malekal.com/files.php?id=FRST_20160530_u6e15e126l9
      https://pjjoint.malekal.com/files.php?id=20160530_r6j13i12c135

      https://pjjoint.malekal.com/files.php?id=20160530_i11p7t5e14r15

      Thank you in advance
      0
      1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712 > cyber75 Posted messages 5 Status Member
         
        Je suis désolé, mais je ne peux pas continuer sur ce sujet.
        0
  3. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Weird, the reports you are sending are not complete.

    I advise you to uninstall Spybot, not very effective, in my opinion. ( Adwares: Antispyware how not to disinfect your Windows )

    Here is the correction to be made with FRST. You can refer to this explanatory note with screenshots.

    Open Notepad: Windows Key + R,
    In the "Run" field, type notepad and OK.
    Copy/Paste the following into it: 


    CreateRestorePoint:
    CloseProcesses:
    HKU\S-1-5-21-3744038216-4012881299-519130704-1001\...\Run: [Format Factory] => Cmd.exe /c start WScript.exe /e:VBScript.Encode C:\Users\Clara\AppData\Roaming\Video.3gp 
    C:\Users\Clara\AppData\Roaming\Video.3gp 
    c:\programdata\quickset
    Task: C:\Windows\Tasks\SK.Enhancer-S-161304646.job => c:\programdata\quickset\sk.enhancer\SK.Enhancer.exeG/schedule /profile c:\programdata\quickset\sk.enhancer\161304646.iniClaraSK.Enh <==== ATTENTION
    reg: reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings" /v Enabled /d 0 /f
    reg: reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings" /v Enabled /d 0 /f
    Reboot:

    Once the text is pasted into Notepad,
    Menu "File" then "Save As",
    On the left, go to the Desktop,
    In the bottom field, file name put: fixlist.txt
    Click on "Save", this will create fixlist.txt on the Desktop.

    Restart FRST and click on the "Fix" button
    A restart may be necessary (not mandatory)
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer.

    Please press any key to continue the disinfection...
    1
  4. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Here you go,

    To clean your USB keys:

    1°) Connect all USB keys and other removable devices.
    • Download Remediate VBS Worm
    • Launch option B
    • Type the letter of the USB key, for example, E and hit enter

    [color=red]WARNING: DO NOT INDICATE THE DRIVE OF YOUR HARD DISK![/color]
    • Go to "My Computer" then drive "C", a report "Rem-VBS.log" should be found there.

    Open this report with Notepad and copy/paste the content here in a next response.

    and that will be good,

    To protect yourself from removable infections like Wscript (Windows Script Host)
    Download and install Marmiton
    Click on Disable at the Windows Script Host level.
    Marmiton will block malicious scripts (VBS, VBE, JavaScript, etc.).

    Strengthen the security of your Windows: How to secure my Windows

    --
    Please press a key to continue the disinfection...
    1
    1. JodoDune Posted messages 2 Status Member
       
      When I install Marmiton, it asks me for a password, and I don't understand what you mean by "Click on Disable in Windows Script Host" ... Sorry haha I'm a bit slow ...
      Thank you!
      0
      1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712 > JodoDune Posted messages 2 Status Member
         
        The password is malekal
        it's written on the download page.
        0
  6. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    If you need help, please create your own topic by going to the Virus forum section and clicking on the Ask a Question button.
    Fill in the fields and submit your request.



    --
    Please press a key to continue the disinfection...
    1
  7. JodoDune Posted messages 2 Status Member
     
    Here is what I get, the restart was done automatically:

    fixlist content:
    CreateRestorePoint:
    CloseProcesses:
    HKU\S-1-5-21-3744038216-4012881299-519130704-1001\...\Run: [Format Factory] => Cmd.exe /c start WScript.exe /e:VBScript.Encode C:\Users\Clara\AppData\Roaming\Video.3gp
    C:\Users\Clara\AppData\Roaming\Video.3gp
    Task: C:\Windows\Tasks\SK.Enhancer-S-161304646.job => c:\programdata\quickset\sk.enhancer\SK.Enhancer.exeG/schedule /profile c:\programdata\quickset\sk.enhancer\161304646.iniClaraSK.Enh <==== ATTENTION
    reg: reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings" /v Enabled /d 0 /f
    reg: reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings" /v Enabled /d 0 /f
    Reboot:

    Error: (0) Unable to create a restore point.
    Process closed successfully.
    HKU\S-1-5-21-3744038216-4012881299-519130704-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Format Factory => value deleted successfully
    Unable to move "C:\Users\Clara\AppData\Roaming\Video.3gp" => Scheduled for move on reboot.
    C:\Windows\Tasks\SK.Enhancer-S-161304646.job => not found.

    ========= reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings" /v Enabled /d 0 /f =========

    Operation was successful.

    ========= End of Reg: =========

    ========= reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings" /v Enabled /d 0 /f =========

    Operation was successful.

    ========= End of Reg: =========

    Results of scheduled file move (Boot Mode: Normal) (Date&Time: 2016-04-09 17:47:27)

    C:\Users\Clara\AppData\Roaming\Video.3gp => was moved successfully

    End of Fixlog 17:47:27

    0
  8. JodoDune Posted messages 2 Status Member
     
    You save me!

    Rem-VBSworm v7.0

    =========== - General info:

    Running under: Clara on profile: C:\Users\Clara
    Computer name: COMPUTER

    Operating System:
    Microsoft Windows 7 Home Premium

    Boot Mode:
    Normal boot

    Antivirus software installed:
    avast! Antivirus

    Executed on: 09/04/2016 @ 17:59:28,67

    =========== - Drive info:

    Listing currently attached drives:
    Caption Description VolumeName

    C: Local fixed disk OS

    D: Local fixed disk Data

    E: CD-ROM drive

    F: Removable disk

    Physical drives information:
    C: \Device\HarddiskVolume2 NTFS
    D: \Device\HarddiskVolume3 NTFS
    F: \Device\HarddiskVolume4 exFAT

    =========== - Disinfection info:

    =========== - USB drive info:

    F: selected

    USB Device ID:
    IDE\DISKST9320325AS_____________________________0003SDM1\4&19E15798&0&0.0.0

    USBSTOR\DISK&VEN_SONY&PROD_STORAGE_MEDIA&REV_PMAP\5C071059D0E3156A71&0

    Deleted file - F:\FAMILY PHOTO.lnk
    Deleted file - F:\syncguid.lnk
    Deleted file - F:\VIDEO.lnk
    Deleted file - F:\New folder.lnk
    Deleted file - F:\DCIM.lnk
    Listing root contents of F:
    The volume in drive F has no name.
    The serial number of the volume is 2CB9-EDFA

    Directory of F:\

    12/10/2015 11:59 121,030 Video.3gp
    08/04/2016 13:49 36 syncguid.dat
    08/04/2016 13:50 <DIR> VIDEO
    08/04/2016 13:50 <DIR> DCIM
    2 file(s) 121,066 bytes
    2 Dir(s) 62,146,609,152 bytes free

    USB drive disinfected and files unhidden!!
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      Delete Video.3gp from your USB drive and there you go =)
      0
  9. Aranud87 Posted messages 277 Registration date   Status Contributor Last intervention   3 299
     
    Eset 4.2...very old, I advise you to update it to version 9:

    https://www.eset.com/fr/home/products/smart-security/
    0
    1. Julien
       
      Alright.
      What should I do next?
      0
      1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712 > Julien
         
        Normally nothing more.
        Except for what is said in my previous message.
        0
    2. Julien
       
      Oh yes, that’s great! The family photo shortcut on the D drive doesn't reappear when I delete it! Thank you very much :)
      0
      1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712 > Julien
         
        You're welcome =)
        0
  10. Trombone
     
    Hello, I was also infected by a virus of the same type, here are the analysis reports:

    - Addition: http://pjjoint.malekal.com/files.php?id=20160621_u8b14y15t5k5

    - FRST: http://pjjoint.malekal.com/files.php?id=FRST_20160621_n11c6w9z11z12

    - Shortcut: http://pjjoint.malekal.com/files.php?id=20160621_i15j10h15x5o7

    Thank you in advance for your response :).
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      Here is the correction to be made with FRST. You can refer to this explanatory note with screenshots.

      Open Notepad: Press Windows + R,
      In the "Run" field, type notepad and click OK.
      Copy/Paste the following into it: 

      CreateRestorePoint:
      CloseProcesses:
      HKLM\...\Run: [Format Factory] => Cmd.exe /c start WScript.exe /e:VBScript.Encode C:\Users\Num\AppData\Roaming\Video.3gp 
      HKU\S-1-5-21-1064192849-657113169-665433704-1001\...\Run: [Format Factory] => Cmd.exe /c start WScript.exe /e:VBScript.Encode C:\Users\Num\AppData\Roaming\Video.3gp 
       2016-06-21 19:21 - 2015-10-12 10:59 - 00121030 ___SH C:\Users\Num\AppData\Roaming\Video.3gp 
       Reboot:


      Once the text is pasted in Notepad,
      Go to the "File" menu and then "Save As",
      On the left, select Desktop,

      In the bottom field, file name enter: fixlist.txt
      Click on "Save", this will create fixlist.txt on the Desktop.

      Restart FRST and click the "Fix" button
      A restart may be necessary (not mandatory)
      A text file will appear, copy/paste the content here in a new message.


      Restart the computer.

      Then do what is mentioned in message #5: Rem-VBS and Marmiton.
      0
  11. Trombone
     
    Thank you for your first response, here is the text that appeared:

    Executed by Num (2016-06-21 22:00:29) Run:1
    Executed from C:\Users\Num\Desktop\FRST
    Loaded profiles: Num (Available profiles: Num)
    Boot mode: Normal

    ==============================================

    fixlist content:
    CreateRestorePoint:
    CloseProcesses:
    HKLM\...\Run: [Format Factory] => Cmd.exe /c start WScript.exe /e:VBScript.Encode C:\Users\Num\AppData\Roaming\Video.3gp
    HKU\S-1-5-21-1064192849-657113169-665433704-1001\...\Run: [Format Factory] => Cmd.exe /c start WScript.exe /e:VBScript.Encode C:\Users\Num\AppData\Roaming\Video.3gp
    2016-06-21 19:21 - 2015-10-12 10:59 - 00121030 ___SH C:\Users\Num\AppData\Roaming\Video.3gp
    Reboot:

    The Restore Point was created successfully.
    Processes closed successfully.
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\Format Factory => value removed successfully
    HKU\S-1-5-21-1064192849-657113169-665433704-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Format Factory => value removed successfully
    Unable to move "C:\Users\Num\AppData\Roaming\Video.3gp" => Scheduled to be moved at reboot.

    Results of scheduled file move (Boot mode: Normal) (Date&Time: 2016-06-21 22:02:27)

    C:\Users\Num\AppData\Roaming\Video.3gp => was moved successfully

    End of Fixlog 22:02:27

    0
  12. Trombone
     
    Re, I used the recommended software, so here is the Rem-VBS report:

    Rem-VBSworm v8.0

    =========== - General info:

    Running under: Num on profile: C:\Users\Num
    Computer name: JULLIAN-PC

    Operating System:
    Microsoft Windows 7 Ultimate

    Boot Mode:
    Normal boot

    Antivirus software installed:

    Executed on: 21/06/2016 @ 22:08:51,91

    =========== - Drive info:

    Listing currently attached drives:
    Caption Description VolumeName

    C: Local hard disk

    D: Local hard disk Reserved for system

    E: Local hard disk

    F: CD-ROM drive

    G: Removable drive

    H: Removable drive

    I: Removable drive

    J: Removable drive

    K: Removable drive GOURMELIN

    Physical drives information:
    C: \Device\HarddiskVolume1 NTFS
    D: \Device\HarddiskVolume2 NTFS
    E: \Device\HarddiskVolume3 NTFS
    K: \Device\HarddiskVolume4 FAT

    =========== - Disinfection info:

    =========== - USB drive info:

    K: selected

    USB Device ID:
    IDE\DISKMAXTOR_6V080E0__________________________VA111630\5&EBBD404&0&0.0.0

    IDE\DISKST3500418AS_____________________________CC46____\5&379CED66&0&1.0.0

    USBSTOR\DISK&VEN_&PROD_USB_DISK_2.0&REV_PMAP\070B388592213F42&0

    USBSTOR\DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00\20021111153705700&0

    USBSTOR\DISK&VEN_GENERIC-&PROD_MS/MS-PRO&REV_1.00\20021111153705700&3

    USBSTOR\DISK&VEN_GENERIC-&PROD_SD/MMC&REV_1.00\20021111153705700&2

    USBSTOR\DISK&VEN_GENERIC-&PROD_SM/XD-PICTURE&REV_1.00\20021111153705700&1

    Deleted file - K:\VIDEO.lnk
    Deleted file - K:\PHOTO FAMILY.lnk
    Deleted file - K:\New folder.lnk
    Deleted file - K:\DCIM.lnk
    Listing root contents of K:
    The volume in drive K is named GOURMELIN
    The serial number of the volume is 4470-FFCF

    Directory of K:\

    ----------------------------

    However, there is still PHOTO FAMILY on my local disk E (which is a hard drive I use to store my data), so should I use Remediate VBS on this drive as well or is there another solution?
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      Yes, you can of course.
      0
    2. Trombone
       
      I followed your steps a few days ago and now the issue is resolved, thank you for your help :).
      0
  13. Soleil
     
    Hello, I am currently experiencing the same type of problems as described above, so I have carried out the recommended analysis with FRST.

    Here are the results of the analyses:
    Shortcut: http://pjjoint.malekal.com/files.php?id=20160625_l13d6q8n8x13
    Addition: http://pjjoint.malekal.com/files.php?id=20160625_e6z15j12e13c5
    FRST: http://pjjoint.malekal.com/files.php?id=FRST_20160625_h15p14k15k6y7

    Thank you in advance for your response :).
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      Hello,


      Here is the correction to be made with FRST. You can refer to this explanatory note with screenshots.

      Open Notepad: Windows Key + R,
      In the "Run" field, type notepad and OK.
      Copy/Paste the following into it: 

      CreateRestorePoint:
      CloseProcesses:
       HKU\S-1-5-21-718064900-3672066035-3243911331-1001\...\Run: [Format Factory] => Cmd.exe /c start WScript.exe /e:VBScript.Encode C:\Users\dominique1\AppData\Roaming\Video.3gp 
       2016-06-14 21:52 - 2015-10-12 10:59 - 00121030 ___SH C:\Users\dominique1\AppData\Roaming\Video.3gp


      Once the text is pasted into Notepad,
      Menu "File" then "Save As",
      On the left, go to the Desktop,

      In the field at the bottom, file name put: fixlist.txt
      Click on "Save", this will create fixlist.txt on the Desktop.

      Restart FRST and click the "Fix" button
      A reboot may be necessary (not mandatory)
      A text file will appear, copy/paste the content here in a new message.

      Restart the computer.
      0
    2. Soleil
       
      Here are the correction results:

      Correction results from Farbar Recovery Scan Tool (x64) Version: 20-06-2016 01
      Executed by dominique1 (2016-06-26 11:22:06) Run:1
      Executed from C:\Users\dominique1\Desktop
      Loaded profiles: dominique1 & caroline (Available profiles: dominique1 & caroline)
      Boot mode: Normal
      ==============================================

      fixlist content:

      3. CreateRestorePoint:
      CloseProcesses:
      HKU\S-1-5-21-718064900-3672066035-3243911331-1001\...\Run: [Format Factory] => Cmd.exe /c start WScript.exe /e:VBScript.Encode C:\Users\dominique1\AppData\Roaming\Video.3gp
      2016-06-14 21:52 - 2015-10-12 10:59 - 00121030 ___SH C:\Users\dominique1\AppData\Roaming\Video.3gp


      The restore point was successfully created.
      Processes closed successfully.
      HKU\S-1-5-21-718064900-3672066035-3243911331-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Format Factory => value(s) deleted successfully
      Could not move "C:\Users\dominique1\AppData\Roaming\Video.3gp" => Scheduled for move on reboot.

      Results of the planned file move (Boot mode: Normal) (Date&Time: 2016-06-26 11:24:36)

      C:\Users\dominique1\AppData\Roaming\Video.3gp => has been moved successfully

      End of Fixlog 11:24:36

0
  • Soleil
     
    Re, I just scanned with VBS, here are the results:


    =========== - Disinfection info:


    =========== - USB drive info:

    E: selected

    USB Device ID:
    SCSI\DISK&VEN_HITACHI&PROD_HDT725050VLA380\4&38FBD192&0&000000

    USBSTOR\DISK&VEN_&PROD_&REV_8.07\AU28151F50000003&0

    SCSI\DISK&VEN_ST350041&PROD_8AS\4&38FBD192&0&010000




    File deleted - E:\PHOTO FAMIlY.lnk
    File deleted - E:\System Volume Information.lnk
    File deleted - E:\New folder.lnk
    File deleted - E:\VIDEO.lnk
    File deleted - E:\DCIM.lnk
    WARNING... Possible Andromeda/Gamarue infection...
    Listing root contents of E:
    The volume in drive E has no name.
    The serial number of the volume is BE7B-C394

    Directory of E:\

    12/10/2015 10:59 121,030 Video.3gp
    25/06/2016 05:49 <DIR> DCIM
    25/06/2016 05:49 <DIR> VIDEO
    1 file(s) 121,030 bytes
    3 Dir(s) 7,744,077,824 bytes free

    USB drive disinfected and files unhidden!!

    Success operation: the process with PID 5764 has been terminated.
    Success operation: the process with PID 6220 has been terminated.

    Information: no running task matches the specified criteria.

    =========== - Shortcut info:

    Shortcut: !shortcut!
    ----------------------------------------------------------------
    Shortcut: !shortcut!
    ----------------------------------------------------------------

    =========== - Scheduled tasks info:


    Thank you for your help :).
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712 > Soleil
       
      It should roll,


      To protect yourself from removable infections like Wscript (Windows Script Host)
      Download and install Marmiton
      (the password is malekal)
      Click on Disable for Windows Script Host.
      Marmiton will block malicious scripts (VBS, VBE, JavaScript, etc.).
      0
  • Claire2169
     
    Hello,

    My computer has also been infected by this virus.

    I have performed the recommended analysis with FRST. Here are the 3 reports:

    FRST - ADDITION - SHORTCUT

    http://pjjoint.malekal.com/files.php?id=FRST_20160706_g5d5h1513t12
    http://pjjoint.malekal.com/files.php?id=20160706_t14o15q11e85
    http://pjjoint.malekal.com/files.php?id=20160706_z11h14e12c6f14

    Thank you very much for your help!
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      Hello,

      To protect yourself from removable infections such as Wscript (Windows Script Host)
      Download and install Marmiton
      (the password is malekal)
      Click on Disable for Windows Script Host.
      Marmiton will block malicious scripts (VBS, VBE, JavaScript, etc.).

      Then:


      Here is the correction to be made with FRST. You can refer to this explanatory note with screenshots.

      Open Notepad: Press Windows + R,
      In the "Run" field, type notepad and OK.
      Copy/Paste the following into it: 

      CreateRestorePoint:
      CloseProcesses:
      HKU\S-1-5-21-2801302744-3347028777-4147129343-1002\...\Run: [Format Factory] => Cmd.exe /c start WScript.exe /e:VBScript.Encode C:\Users\Claire Bedu\AppData\Roaming\Video.3gp 
       2016-07-05 21:30 - 2015-10-12 11:59 - 00121030 _____ C:\Users\Claire Bedu\AppData\Roaming\Video.3gp 
      EmptyTemp:


      Once the text is pasted into Notepad,
      Go to the "File" menu then "Save As",
      On the left, navigate to the Desktop,

      In the bottom field for the file name, enter: fixlist.txt
      Click on "Save", this will create fixlist.txt on the Desktop.

      Restart FRST and click on the "Fix" button
      A restart may be necessary (not mandatory)
      A text file will appear, copy/paste the content here in a new message.


      Restart the computer.
      0
      1. Claire2169 > Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention  
         
        I disinfected my USB keys following your instructions (above).
        I installed Marmiton and strengthened the security of my computer by following the explanations from your blog/forum, which will clearly become my reference in case of computer issues.

        Here is the fixlog message:

        Results of the Farbar Recovery Scan Tool (x64) Version: 02-07-2016
        Executed by Claire Bedu (2016-07-06 23:24:22) Run:1
        Executed from C:\Users\Claire Bedu\Desktop\Useful Software
        Profiles loaded: Claire Bedu & (Available profiles: Claire Bedu)
        Boot mode: Normal
        ==============================================

        fixlist content:

        2. CreateRestorePoint:
        CloseProcesses:
        HKU\S-1-5-21-2801302744-3347028777-4147129343-1002\...\Run: [Format Factory] => Cmd.exe /c start WScript.exe /e:VBScript.Encode C:\Users\Claire Bedu\AppData\Roaming\Video.3gp
        2016-07-05 21:30 - 2015-10-12 11:59 - 00121030 _____ C:\Users\Claire Bedu\AppData\Roaming\Video.3gp
        EmptyTemp:


        The restore point has been successfully created.
        Processes closed successfully.
        HKU\S-1-5-21-2801302744-3347028777-4147129343-1002\Software\Microsoft\Windows\CurrentVersion\Run\\Format Factory => value(s) deleted successfully
        C:\Users\Claire Bedu\AppData\Roaming\Video.3gp => moved successfully

        =========== EmptyTemp: ==========

        BITS transfer queue => 8388608 B
        DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 10671405 B
        Java, Flash, Steam htmlcache => 595 B
        Windows/system/drivers => 6399416 B
        Edge => 0 B
        Chrome => 81270673 B
        Firefox => 0 B
        Opera => 0 B

        Temp, IE cache, history, cookies, recent:
        Default => 0 B
        ProgramData => 0 B
        Public => 0 B
        systemprofile => 230606 B
        systemprofile32 => 17542338 B
        LocalService => 836 B
        NetworkService => 191546416 B
        Claire Bedu => 22073936 B

        RecycleBin => 1896099 B
        EmptyTemp: => 324.3 MB temporary data deleted.

        ================================


        The system had to restart.

        End of Fixlog 23:26:38

        I hope it's good? The file has disappeared from the location where it was before...

        In any case, a huge thank you for your help and responsiveness!