Tutorial UsbFix : Clean option

  • Download UsbFix on your computer, and execute it.
  • It will launch automatically, and a shortcut will be created on your desktop.
  • Connect all your external data sources to your PC (Usb keys, external drives, etc…) Do not open them.
  • Choose “Clean” option.

usbfix-clean
  • A pop-up will follow :

Connect all your external data sources to your PC (Usb keys, external drives, etc…)

  • Once you’re ready, click “OK”.

usbfix screen tutorial
  • While cleaning, you will loose access to your desktop, but this is normal.

usbfix search
  • The numbers of analysed and infected éléments are displayed.

usbfix-search-detected
  • Once cleaning is over, you’ll be suggested to donate the author, El Desaparecido.

usbfix-donate
  • Donation is not compulsory, but is useful to go on developping the software, and meet the expense to maintain our website server.
  • Once you’ve made a choice, a report will open.

2014-02-14_112103
  • You can find a copy of this report on your desktop, and another at : C:\UsbFix\Log\UsbFix [Clean 1] Your PC.txt
  • Copy/paste it on the board you’ve asked for help.
  • If you are not taken care, we invite you to create a subject on the forum of disinfection SosVirus and to transmit the report for analysis.

logo-2-300x86

Free Support

Forum SosVirus

Help UsbFix

Rate this tutorial

1 Star2 Stars3 Stars4 Stars5 Stars
(14 votes, average: 4.29 out of 5)
Loading...

Her is an example of a report showing an infection :

############################## | UsbFix V 7.164 |

[Deletion]

User: SosVirus (Administrator) # VMWARE
Updated 05/02/2014 by El Desaparecido – Team SosVirus
Started at 11:17:00 | 14/02/2014

Website : https://www.usb-antivirus.com/
Changelog : https://www.usb-antivirus.com/changelog/
Support : http://www.sosvirus.net/
Contact : https://www.usb-antivirus.com/contact/
Live Detection : http://how-to-remove.us/

PC: Intel Corporation (440BX Desktop Reference Platform)
CPU: AMD FX(tm)-8150 Eight-Core Processor
RAM -> [Total : 2047 Mo| Free : 1510 Mo] Bios: Phoenix Technologies LTD
Boot: Normal boot

OS: Microsoft Windows 8.1 Professionnel (6.3.9600 64-Bit)
WB: Windows Internet Explorer : 11.0.9600.16384

SC: Security Center [Enabled] WU: Windows Update [Enabled] AV: Windows Defender [(!) Disabled | Updated] AS: Windows Defender [(!) Disabled | Updated] FW: Windows FireWall [(!) Disabled]

C:\ (%systemdrive%) -> Fixed drive # 60 Gb (46 Mb free – 77%) [] # NTFS
D:\ -> CD-ROM
E:\ -> Removable drive # 15 Gb (15 Mb free – 99%) [UsbFix] # NTFS

################## | Active Processes |

C:\Windows\system32\wininit.exe (ID: 492 |ParentID: 432)
C:\Windows\system32\winlogon.exe (ID: 532 |ParentID: 484)
C:\Windows\system32\lsass.exe (ID: 604 |ParentID: 492)
C:\Windows\system32\svchost.exe (ID: 680 |ParentID: 588)
C:\Windows\system32\svchost.exe (ID: 720 |ParentID: 588)
C:\Windows\system32\dwm.exe (ID: 804 |ParentID: 532)
C:\Windows\System32\svchost.exe (ID: 880 |ParentID: 588)
C:\Windows\system32\svchost.exe (ID: 924 |ParentID: 588)
C:\Windows\servicing\TrustedInstaller.exe (ID: 964 |ParentID: 588)
C:\Windows\system32\svchost.exe (ID: 980 |ParentID: 588)
C:\Windows\System32\svchost.exe (ID: 328 |ParentID: 588)
C:\Windows\system32\svchost.exe (ID: 792 |ParentID: 588)
C:\Windows\System32\spoolsv.exe (ID: 1100 |ParentID: 588)
C:\Windows\system32\svchost.exe (ID: 1124 |ParentID: 588)
C:\Windows\system32\dashost.exe (ID: 1316 |ParentID: 328)
C:\Windows\system32\svchost.exe (ID: 1608 |ParentID: 588)
C:\Windows\System32\WUDFHost.exe (ID: 1764 |ParentID: 328)
C:\Windows\System32\WUDFHost.exe (ID: 1848 |ParentID: 328)
C:\Windows\System32\svchost.exe (ID: 2060 |ParentID: 588)
C:\Windows\System32\svchost.exe (ID: 2476 |ParentID: 588)
C:\Windows\system32\taskhostex.exe (ID: 2580 |ParentID: 924)
C:\Windows\Explorer.EXE (ID: 2668 |ParentID: 2644)
C:\Windows\system32\runonce.exe (ID: 2732 |ParentID: 2668)
C:\Windows\BrowserChoice\browserchoice.exe (ID: 2848 |ParentID: 924)
C:\Windows\system32\DllHost.exe (ID: 2952 |ParentID: 680)
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe (ID: 1040 |ParentID: 328)
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe (ID: 224 |ParentID: 1040)
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.16384_none_fa1dc1539b4180d8\TiWorker.exe (ID: 2016 |ParentID: 680)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 484 |ParentID: 680)

################## | Regedit Run |

04 – HKCU\..\Run : [bc417da8242d899d911d46b52a2aa2c2] “C:\Users\SosVirus\AppData\Local\Temp\svchots.exe” ..
04 – HKCU\..\Run : [0ed9b0dd4f968cc32d4e7c0293ea9e57] “C:\Users\SosVirus\AppData\Roaming\Systwm.exe” ..
04 – HKCU\..\Run : [b463fa29ba63b297b9177c677944ff44] “C:\Users\SosVirus\AppData\Roaming\trsa.exe” ..
04 – HKLM\..\RunOnce : [] 04 – HKU\S-1-5-21-3326037888-2103832623-3606209763-1001\..\Run : [bc417da8242d899d911d46b52a2aa2c2] “C:\Users\SosVirus\AppData\Local\Temp\svchots.exe” ..
04 – HKU\S-1-5-21-3326037888-2103832623-3606209763-1001\..\Run : [0ed9b0dd4f968cc32d4e7c0293ea9e57] “C:\Users\SosVirus\AppData\Roaming\Systwm.exe” ..
04 – HKU\S-1-5-21-3326037888-2103832623-3606209763-1001\..\Run : [b463fa29ba63b297b9177c677944ff44] “C:\Users\SosVirus\AppData\Roaming\trsa.exe” ..

################## | Generic Research |

Deleted ! C:\Users\SosVirus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ed9b0dd4f968cc32d4e7c0293ea9e57.exe
Deleted ! C:\Users\SosVirus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b463fa29ba63b297b9177c677944ff44.exe
Deleted ! C:\Users\SosVirus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bc417da8242d899d911d46b52a2aa2c2.exe
Deleted ! E:\My Picture.SCR
Deleted ! E:\set.vbs
Deleted ! C:\Users\SosVirus\AppData\Roaming\trsa.exe
Deleted ! C:\Users\SosVirus\AppData\Roaming\trsa.exe.tmp
Deleted ! E:\0ed9b0dd4f968cc32d4e7c0293ea9e57.exe
Deleted ! E:\29d6ad028fa7e9945b60c9f480764362.zip.lnk
Deleted ! E:\3dcedd76b1f542ec14094a9afe39a1b2.zip.lnk
Deleted ! E:\8bf5931005ec23184864abaa42a2cd18.zip.lnk
Deleted ! E:\b114764aa3567a0bb3a22a8374b3d46b.zip.lnk
Deleted ! E:\set.vbs.lnk
Deleted ! C:\Users\SosVirus\AppData\Local\Temp\svchots.exe
Deleted ! C:\Users\SosVirus\AppData\Roaming\Systwm.exe
Deleted ! C:\Users\SosVirus\Desktop\29d6ad028fa7e9945b60c9f480764362\set.vbs
Deleted ! C:\Users\SosVirus\Desktop\3dcedd76b1f542ec14094a9afe39a1b2\bc417da8242d899d911d46b52a2aa2c2.exe
Deleted ! C:\Users\SosVirus\Desktop\8bf5931005ec23184864abaa42a2cd18\b463fa29ba63b297b9177c677944ff44.exe
Deleted ! C:\Users\SosVirus\Desktop\b114764aa3567a0bb3a22a8374b3d46b\0ed9b0dd4f968cc32d4e7c0293ea9e57.exe

(!) Temporary files deleted.

################## | Registry |

Deleted ! HKCU\Software\0ed9b0dd4f968cc32d4e7c0293ea9e57
Deleted ! HKCU\Software\b463fa29ba63b297b9177c677944ff44
Deleted ! HKCU\Software\bc417da8242d899d911d46b52a2aa2c2
Repaired ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|EnableLUA -> 1
Repaired ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|ConsentPromptBehaviorAdmin -> 5
Deleted ! HKU\S-1-5-21-3326037888-2103832623-3606209763-1001\Software\Microsoft\Windows\CurrentVersion\Run|0ed9b0dd4f968cc32d4e7c0293ea9e57
Deleted ! HKU\S-1-5-21-3326037888-2103832623-3606209763-1001\Software\Microsoft\Windows\CurrentVersion\Run|b463fa29ba63b297b9177c677944ff44
Deleted ! HKU\S-1-5-21-3326037888-2103832623-3606209763-1001\Software\Microsoft\Windows\CurrentVersion\Run|bc417da8242d899d911d46b52a2aa2c2

################## | UsbFix – Information |

UsbFix has detected on your computer, an infection which a Keylogger function.
After cleaning with UsbFix, please modify all your passwords.
If you made purchases on Internet,
please contact your bank to enviseager an opposition on your bank card.

Info (Fr) : https://www.usb-antivirus.com/2014/03/remove-shortcut-virus-usb/
Info (Fr) : https://www.usb-antivirus.com/2014/03/infections-spreading-usb-peripherals/

################## | Listing |

[07/02/2014 – 21:28:28 | SHD] – C:\$Recycle.Bin[30/09/2013 – 05:24:45 | RASH | 389 Ko] – C:\bootmgr[18/06/2013 – 13:18:29 | N | 0 Ko] – C:\BOOTNXT[22/08/2013 – 15:45:52 | SHD] – C:\Documents and Settings[14/02/2014 – 11:15:18 | ASH | 1677300 Ko] – C:\hiberfil.sys[14/02/2014 – 11:15:19 | ASH | 1179648 Ko] – C:\pagefile.sys[22/08/2013 – 16:22:35 | D] – C:\PerfLogs[14/02/2014 – 10:48:16 | D] – C:\Program Files[14/02/2014 – 10:48:23 | D] – C:\Program Files (x86)[08/02/2014 – 14:57:44 | HD] – C:\ProgramData[14/02/2014 – 11:15:20 | ASH | 262144 Ko] – C:\swapfile.sys[14/02/2014 – 10:59:51 | SHD] – C:\System Volume Information[14/02/2014 – 11:01:43 | D] – C:\UsbFix[08/02/2014 – 14:58:05 | N | 7 Ko | 1BBCDA94C8E4F1F4338CC9C92F4AEED2] – C:\UsbFix [Clean 2] VMWARE.txt[14/02/2014 – 11:19:09 | A | 7 Ko | 5568C1C29DC7608599E48ABEA2BD0572] – C:\UsbFix [Clean 4] VMWARE.txt[08/02/2014 – 17:38:10 | N | 2 Ko | 8BBC825E8BD88E8ED481F9A5A9B70930] – C:\UsbFix [Listing 1] VMWARE.txt[08/02/2014 – 17:38:28 | N | 2 Ko | 443500AE377FD42FA365A14C830A1597] – C:\UsbFix [Listing 2] VMWARE.txt[08/02/2014 – 14:20:41 | N | 6 Ko | 89B16C2D48414085E6AC534665A0C2E0] – C:\UsbFix [Scan 1] VMWARE.txt[14/02/2014 – 11:06:42 | N | 8 Ko | C6D99C733C0937DA30EA50DDDBE67A88] – C:\UsbFix [Scan 2] VMWARE.txt[07/02/2014 – 21:25:08 | D] – C:\Users[14/02/2014 – 10:51:16 | D] – C:\Windows[14/02/2014 – 09:53:55 | N | 7 Ko] – E:\29d6ad028fa7e9945b60c9f480764362.zip[14/02/2014 – 09:53:29 | N | 226 Ko] – E:\3dcedd76b1f542ec14094a9afe39a1b2.zip[14/02/2014 – 09:52:48 | N | 100 Ko] – E:\8bf5931005ec23184864abaa42a2cd18.zip[14/02/2014 – 09:53:05 | N | 36 Ko] – E:\b114764aa3567a0bb3a22a8374b3d46b.zip[17/01/2014 – 09:46:38 | SHD] – E:\System Volume Information

################## | Vaccin |

E:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)

################## | E.O.F |

Tutorial UsbFixTutorial UsbFix

2017-01-17T09:29:39+00:00

19 Comments

  1. John Lino October 31, 2015 at 7:50 AM

    Hi, I have the same problem as Jhenz. I recently purchased USBFix Basic but everytime I clicked on the icon at the desktop, a pop-up window opens up asking if I would like to update to get the latest version or get automatic updates. After choosing to get the latest version, or even after choosing to get automatic updates, nothing happens. I couldn’t access the box with the clean and report functions I was able to use the first time to clean my computer system. Please reply.

    • El Desaparecido
      El Desaparecido October 31, 2015 at 8:56 AM

      Hi John,

      You have a reply for your mail.
      You should download a fresh copy of UsbFix Basic

      Best Regards

  2. jhenz September 23, 2015 at 2:25 AM

    im having a trouble with usb fix as im trying to run it it pops out a message saying download the latest version or get automatic updates i prefer choosing download the latest version and after downloading it i try to run it but the same message appears how can i get rid of this.. i really need usbfix coz its really helps me a lot with regards to coputer system and flashdrives….

  3. aqwwe August 1, 2015 at 11:01 PM

    Good works

  4. ramesh June 7, 2015 at 7:48 AM

    When I clean my usb drive, I find an error message that ur pc run into a problem………….What’s the solution for this.Please reply.

  5. harrison April 22, 2015 at 10:05 PM

    Thanks. It has work for me

  6. philip March 25, 2015 at 11:53 AM

    Pls… I’ve use usbFix to restore my files, but when I connect my drive to my computer, remove it and then plug it in again, I stil see dat secure browser logo. Hw do I get rid of the secure browser boiling point totally away from my system?

  7. lidyayaya December 30, 2014 at 3:49 PM

    this has helped me. thx a lot 🙂

  8. ssss November 20, 2014 at 1:26 PM

    How to delete lpt1.usbfix

  9. unknown November 18, 2014 at 4:25 PM

    Thanks a lot, this really worked for me……

  10. Maykel August 1, 2014 at 2:20 AM

    After the restart , nothing happens

  11. Nahid Hossain July 16, 2014 at 10:08 AM

    Hello, I have been helped by this tools . This is soo useful. But I am in a trouble. There is a option in USB fix name dvaccinate. I have vaccianted my PC with that command. Now I can’t see me drive names. All the name changed to Local Disc.

    USB fix created autorun folder by default to all the drive and they left a file in it named lpt1.UsbFix

    Please reply me how can I remove this file from Hard disc and able to rename the drive again ?

    Regard
    Nahid

  12. Daniyal Ahmed June 3, 2014 at 7:11 AM

    Great great tutorial really helpful

  13. Naeem May 28, 2014 at 7:03 AM

    Usb Fix System its also deleted the Mobile Shorts also from mobile flash as well ? Please answer my question

    I am waiting your kind response. Thanks

    • El Desaparecido
      El Desaparecido May 28, 2014 at 7:16 AM

      Hi,

      Yes. UsbFix clean memory card on your phone, if the phone is connected on your PC with USB …

Leave A Comment