View original (French)

U3ROM

tom45 -  
bazfile Posted messages 58494 Registration date   Status Moderator Last intervention   -
Hello,

I have a virus on my USB stick. The problem is that USBfix detects it, quarantines it, but when I plug the stick back in and run another scan, it appears again in the results if I run another scan.

Configuration: Windows / Chrome 94.0.4606.71

10 answers

  1.
    bazfile Posted messages 58494 Registration date   Status Moderator Last intervention   20 270
     
    Hello,
    Give the USBfix report so I can see what it detects.
    Do you do a complete analysis with USBfix or just the analysis of the USB key?

    bazfile
    Moderator/Security Contributor.
    A hello, a reply, a thank you are always appreciated.
    0
    1. tom45
       
      Hello bazfile
      Here is the report

      https://www.cjoint.com/c/KJpiyAD25fO

      I’m running in full mode because if I click on USB it starts the scan on the C drive which is my hard drive.
      0
      1. bazfile Posted messages 58494 Registration date   Status Moderator Last intervention   20 270 > tom45
         
        The USBfix report does not find any infection; the "Infected elements" section is empty.
        The end of the report indicates an infected element but does not specify which one; I wonder if it is a bug in USBfix.
        0
  2. tom45
     
    I tried with another version on another PC and I have the same problem.
    0
    1. bazfile Posted messages 58494 Registration date   Status Moderator Last intervention   20 270
       
      Without knowing the element in question, it's hard to tell you more.
      To see if your PC is infected:
      Download FRST, once downloaded save it on the desktop then open it, you will have this:

      Click on Scan, at the end of the scan you will have two text files on the desktop FRST and Addition, .
      Be sure to wait for the messages saying that the scan is complete      , then send these reports to https://www.cjoint.com/ see this tutorial and then provide the two links generated by Cjoint in your next message.

      For your USB key:
      Download Remediate VBS WORM open Remediate VBS WORM take option B as follows:


      Then press Enter, a window appears enter the letter of your USB key to disinfect be careful never to select drive C:

      Press Enter, when the disinfection is complete, open drive C where you will find a file named Rem-VBS.log send it to https://www.cjoint.com/ put the generated link in your response.
      0
  3. tom45
     
    The second one says wrong letter or system drive selected

    For your information, it's a hard drive, not a USB stick; I don't know if that changes anything?
    0
    1. bazfile Posted messages 58494 Registration date   Status Moderator Last intervention   20 270
       
      You have been talking about a USB stick from the beginning and now you say it's a hard drive. Remediate VBS WORM is for USB sticks, not for hard drives. USBfix finds nothing, so I think it's a false alarm and a bug in USBfix.
      0
  4. tom45
     
    Yes, I saw I made a mistake, I have 2 external hard drives that are infected with U3rom, and in both cases I have the same problem.
    When I go on my Windows, I can't see the folder, but on a Linux, I can see it.
    When I delete it on Linux, it comes back systematically.
    0
    1. bazfile Posted messages 58494 Registration date   Status Moderator Last intervention   20 270
       
      Désolé, je ne peux pas accéder à des liens externes.
      0
  6. tom45
     
    [https://www.cjoint.com/]
    0
    1. bazfile Posted messages 58494 Registration date   Status Moderator Last intervention   20 270
       
      Non, I need the analysis reports from FRST, not from USBfix.
      REMINDER:
      Download FRST and once downloaded save it on the desktop then open it, you will have this:

      Click on Analyze and at the end of the analysis, you will have two text files on your desktop FRST and Addition, .
      Be sure to wait until the messages indicating that the analysis is complete are displayed      , then upload these reports to https://www.cjoint.com/ see this tutorial then provide the two links generated by Cjoint in your next message.
      0
  9. tom45
     
    He doesn't have a virus, that's really the key.
    0
  10. tom45
     
    disk not key indeed.

    sorry for the multiple message I can't have it changed.
    0
    1. bazfile Posted messages 58494 Registration date   Status Moderator Last intervention   20 270
       
      Your PC is not infected; the multiple scheduled tasks are apparently remnants of updates deployed by your company. As for the infection of your USB drive, I have no trace on your PC because I don't believe that a USB infection would remain solely on the USB drive or removable disk; it also infects the PC to which it is connected.

      All I can tell you is that your version of Windows 10 is not up to date. Regarding the USB drive, I maintain that it is a false positive from USBfix. There are not many tools similar to USBfix, and USB infections are becoming increasingly rare, at least in France. You can possibly try using this tool from Kaspersky to analyze your USB drive (don't forget to select its letter) with Kaspersky Removal Tool.
      0
  11. tom45
     
    Indeed, I caught it on a PC running XP ;( I will try your tool

    thank you for your help
    0
    1. bazfile Posted messages 58494 Registration date   Status Moderator Last intervention   20 270
       
      I saw your report, I disabled your Cjoint links.
      0