Tutorial UsbFix : Clean option

[fusion_builder_container hundred_percent=”yes” overflow=”visible”][fusion_builder_row][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][fusion_checklist icon=”fa-arrow-right” iconcolor=”#1e73be” circle=”no” circlecolor=”” size=”15px” class=”” id=””]

• Download UsbFix on your computer, and execute it.
• It will launch automatically, and a shortcut will be created on your desktop.
• Connect all your external data sources to your PC (Usb keys, external drives, etc…) Do not open them.
• Choose “Clean” option.

[/fusion_checklist]

[fusion_separator top=”20″ style=”none”/]

[fusion_imageframe lightbox=”no” lightbox_image=”” style_type=”” hover_type=”zoomin” bordercolor=”#d3d3d3″ bordersize=”0px” border radius=”0″ stylecolor=”” align=”center” link=”” linktarget=”” animation_type=”0″ animation_direction=”down” animation_speed=”0.1″ class=”” id=””] [/fusion_imageframe]

[fusion_separator top=”20″ style=”none”/]

[/fusion_builder_column][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][fusion_checklist icon=”fa-arrow-right” iconcolor=”#1e73be” circle=”no” circlecolor=”” size=”15px” class=”” id=””]

• A pop-up will follow :

[/fusion_checklist]

[fusion_separator top=”20″ style=”none”/]

Connect all your external data sources to your PC (Usb keys, external drives, etc…)

[fusion_separator top=”20″ style=”none”/]

[/fusion_builder_column][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][fusion_checklist icon=”fa-arrow-right” iconcolor=”#1e73be” circle=”no” circlecolor=”” size=”15px” class=”” id=””]

• Once you’re ready, click “OK”.

[/fusion_checklist]

[fusion_separator top=”20″ style=”none”/]

[fusion_imageframe lightbox=”no” lightbox_image=”” style_type=”” hover_type=”zoomin” bordercolor=”#d3d3d3″ bordersize=”0px” border radius=”0″ stylecolor=”” align=”center” link=”” linktarget=”” animation_type=”0″ animation_direction=”down” animation_speed=”0.1″ class=”” id=””] [/fusion_imageframe]

[fusion_separator top=”20″ style=”none”/]

[/fusion_builder_column][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][fusion_checklist icon=”fa-arrow-right” iconcolor=”#1e73be” circle=”no” circlecolor=”” size=”15px” class=”” id=””]

• While cleaning, you will loose access to your desktop, but this is normal.

[/fusion_checklist]

[fusion_separator top=”20″ style=”none”/]

[fusion_imageframe lightbox=”no” lightbox_image=”” style_type=”” hover_type=”zoomin” bordercolor=”#d3d3d3″ bordersize=”0px” border radius=”0″ stylecolor=”” align=”center” link=”” linktarget=”” animation_type=”0″ animation_direction=”down” animation_speed=”0.1″ class=”” id=””] [/fusion_imageframe]

[fusion_separator top=”20″ style=”none”/]

[/fusion_builder_column][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][fusion_checklist icon=”fa-arrow-right” iconcolor=”#1e73be” circle=”no” circlecolor=”” size=”15px” class=”” id=””]

• The numbers of analysed and infected éléments are displayed.

[/fusion_checklist]

[fusion_separator top=”20″ style=”none”/]

[fusion_imageframe lightbox=”no” lightbox_image=”” style_type=”” hover_type=”zoomin” bordercolor=”#d3d3d3″ bordersize=”0px” border radius=”0″ stylecolor=”” align=”center” link=”” linktarget=”” animation_type=”0″ animation_direction=”down” animation_speed=”0.1″ class=”” id=””] [/fusion_imageframe]

[fusion_separator top=”20″ style=”none”/]

[/fusion_builder_column][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][fusion_checklist icon=”fa-arrow-right” iconcolor=”#1e73be” circle=”no” circlecolor=”” size=”15px” class=”” id=””]

• Once cleaning is over, you’ll be suggested to donate the author, El Desaparecido.

[/fusion_checklist]

[fusion_separator top=”20″ style=”none”/]

[fusion_imageframe lightbox=”no” lightbox_image=”” style_type=”” hover_type=”zoomin” bordercolor=”#d3d3d3″ bordersize=”0px” border radius=”0″ stylecolor=”” align=”center” link=”” linktarget=”” animation_type=”0″ animation_direction=”down” animation_speed=”0.1″ class=”” id=””] [/fusion_imageframe]

[fusion_separator top=”20″ style=”none”/]

[/fusion_builder_column][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][fusion_checklist icon=”fa-arrow-right” iconcolor=”#1e73be” circle=”no” circlecolor=”” size=”15px” class=”” id=””]

• Donation is not compulsory, but is useful to go on developping the software, and meet the expense to maintain our website server.
• Once you’ve made a choice, a report will open.

[/fusion_checklist]

[fusion_separator top=”20″ style=”none”/]

[fusion_imageframe lightbox=”no” lightbox_image=”” style_type=”” hover_type=”zoomin” bordercolor=”#d3d3d3″ bordersize=”0px” border radius=”0″ stylecolor=”” align=”center” link=”” linktarget=”” animation_type=”0″ animation_direction=”down” animation_speed=”0.1″ class=”” id=””] [/fusion_imageframe]

[fusion_separator top=”20″ style=”none”/]

[/fusion_builder_column][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][fusion_checklist icon=”fa-arrow-right” iconcolor=”#1e73be” circle=”no” circlecolor=”” size=”15px” class=”” id=””]

• You can find a copy of this report on your desktop, and another at : C:\UsbFix\Log\UsbFix [Clean 1] Your PC.txt
• Copy/paste it on the board you’ve asked for help.
• If you are not taken care, we invite you to create a subject on the forum of disinfection SosVirus and to transmit the report for analysis.

[/fusion_checklist]

[fusion_separator top=”40″ style=”shadow”/]

[/fusion_builder_column][fusion_builder_column type=”1_2″ last=”no” class=”” id=””][fusion_imageframe lightbox=”no” style_type=”none” bordercolor=”#d1d1d1″ bordersize=”0px” stylecolor=”#ffffff” align=”center” link=”” linktarget=”_self” animation_type=”0″ animation_direction=”” animation_speed=”0.1″ class=”” id=””] [/fusion_imageframe][/fusion_builder_column][fusion_builder_column type=”1_2″ last=”yes” class=”” id=””][fusion_text]

Free Support

[/fusion_text][fusion_button link=”https://www.sos-virus.net/” color=”custom” size=”large” type=”shake” shape=”square” target=”_blank” title=”Free support” gradient_colors=”transparent|” gradient_hover_colors=”rgba(000,000,000,.05)|” accent_color=”#a0ce4e” accent_hover_color=”#96c346″ bevel_color=”” border_width=”2px” shadow=”no” icon=”fa-star” icon_position=”left” icon_divider=”yes” modal=”” animation_type=”0″ animation_direction=”up” animation_speed=”1″ alignment=”” class=”” id=””]Forum SosVirus[/fusion_button][/fusion_builder_column][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][fusion_separator style_type=”shadow” top_margin=”40″ bottom_margin=”40″ sep_color=”” icon=”” width=”” class=”” id=””/][/fusion_builder_column][fusion_builder_column type=”1_2″ last=”no” class=”” id=””][fusion_text]

[/fusion_text][/fusion_builder_column][fusion_builder_column type=”1_2″ last=”yes” class=”” id=””][fusion_title size=”3″ content_align=”left” style_type=”” sep_color=”” class=”” id=””]Rate this tutorial[/fusion_title][fusion_separator style_type=”none” top_margin=”20″ bottom_margin=”” sep_color=”” icon=”” width=”” class=”” id=””/]
[fusion_text][ratings][/fusion_text][/fusion_builder_column]

[fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][fusion_separator style_type=”shadow” top_margin=”40″ bottom_margin=”40″ sep_color=”” icon=”” width=”” class=”” id=””/]

Her is an example of a report showing an infection :

[fusion_separator style_type=”none” top_margin=”10″ bottom_margin=”10″ sep_color=”” icon=”” width=”” class=”” id=””/]

############################## | UsbFix V 7.164 | [/fusion_builder_column][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][Deletion]

User: SosVirus (Administrator) # VMWARE
Updated 05/02/2014 by El Desaparecido – Team SosVirus
Started at 11:17:00 | 14/02/2014

Website : https://www.usb-antivirus.com/
Changelog : https://www.usb-antivirus.com/changelog/
Support : https://www.sosvirus.net/
Contact : https://www.usb-antivirus.com/contact/
Live Detection : https://how-to-remove.us/

PC: Intel Corporation (440BX Desktop Reference Platform)
CPU: AMD FX(tm)-8150 Eight-Core Processor
RAM -> [Total : 2047 Mo| Free : 1510 Mo]
Bios: Phoenix Technologies LTD
Boot: Normal boot

OS: Microsoft Windows 8.1 Professionnel (6.3.9600 64-Bit)
WB: Windows Internet Explorer : 11.0.9600.16384

SC: Security Center [Enabled]
WU: Windows Update [Enabled]
AV: Windows Defender [(!) Disabled | Updated]
AS: Windows Defender [(!) Disabled | Updated]
FW: Windows FireWall [(!) Disabled]

C:\ (%systemdrive%) -> Fixed drive # 60 Gb (46 Mb free – 77%) [] # NTFS
D:\ -> CD-ROM
E:\ -> Removable drive # 15 Gb (15 Mb free – 99%) [UsbFix] # NTFS

################## | Active Processes |

C:\Windows\system32\wininit.exe (ID: 492 |ParentID: 432)
C:\Windows\system32\winlogon.exe (ID: 532 |ParentID: 484)
C:\Windows\system32\lsass.exe (ID: 604 |ParentID: 492)
C:\Windows\system32\svchost.exe (ID: 680 |ParentID: 588)
C:\Windows\system32\svchost.exe (ID: 720 |ParentID: 588)
C:\Windows\system32\dwm.exe (ID: 804 |ParentID: 532)
C:\Windows\System32\svchost.exe (ID: 880 |ParentID: 588)
C:\Windows\system32\svchost.exe (ID: 924 |ParentID: 588)
C:\Windows\servicing\TrustedInstaller.exe (ID: 964 |ParentID: 588)
C:\Windows\system32\svchost.exe (ID: 980 |ParentID: 588)
C:\Windows\System32\svchost.exe (ID: 328 |ParentID: 588)
C:\Windows\system32\svchost.exe (ID: 792 |ParentID: 588)
C:\Windows\System32\spoolsv.exe (ID: 1100 |ParentID: 588)
C:\Windows\system32\svchost.exe (ID: 1124 |ParentID: 588)
C:\Windows\system32\dashost.exe (ID: 1316 |ParentID: 328)
C:\Windows\system32\svchost.exe (ID: 1608 |ParentID: 588)
C:\Windows\System32\WUDFHost.exe (ID: 1764 |ParentID: 328)
C:\Windows\System32\WUDFHost.exe (ID: 1848 |ParentID: 328)
C:\Windows\System32\svchost.exe (ID: 2060 |ParentID: 588)
C:\Windows\System32\svchost.exe (ID: 2476 |ParentID: 588)
C:\Windows\system32\taskhostex.exe (ID: 2580 |ParentID: 924)
C:\Windows\Explorer.EXE (ID: 2668 |ParentID: 2644)
C:\Windows\system32\runonce.exe (ID: 2732 |ParentID: 2668)
C:\Windows\BrowserChoice\browserchoice.exe (ID: 2848 |ParentID: 924)
C:\Windows\system32\DllHost.exe (ID: 2952 |ParentID: 680)
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe (ID: 1040 |ParentID: 328)
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe (ID: 224 |ParentID: 1040)
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.16384_none_fa1dc1539b4180d8\TiWorker.exe (ID: 2016 |ParentID: 680)
C:\Windows\system32\wbem\wmiprvse.exe (ID: 484 |ParentID: 680)

################## | Regedit Run |

04 – HKCU\..\Run : [bc417da8242d899d911d46b52a2aa2c2] “C:\Users\SosVirus\AppData\Local\Temp\svchots.exe” ..
04 – HKCU\..\Run : [0ed9b0dd4f968cc32d4e7c0293ea9e57] “C:\Users\SosVirus\AppData\Roaming\Systwm.exe” ..
04 – HKCU\..\Run : [b463fa29ba63b297b9177c677944ff44] “C:\Users\SosVirus\AppData\Roaming\trsa.exe” ..
04 – HKLM\..\RunOnce : []
04 – HKU\S-1-5-21-3326037888-2103832623-3606209763-1001\..\Run : [bc417da8242d899d911d46b52a2aa2c2] “C:\Users\SosVirus\AppData\Local\Temp\svchots.exe” ..
04 – HKU\S-1-5-21-3326037888-2103832623-3606209763-1001\..\Run : [0ed9b0dd4f968cc32d4e7c0293ea9e57] “C:\Users\SosVirus\AppData\Roaming\Systwm.exe” ..
04 – HKU\S-1-5-21-3326037888-2103832623-3606209763-1001\..\Run : [b463fa29ba63b297b9177c677944ff44] “C:\Users\SosVirus\AppData\Roaming\trsa.exe” ..

################## | Generic Research |

Deleted ! C:\Users\SosVirus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ed9b0dd4f968cc32d4e7c0293ea9e57.exe
Deleted ! C:\Users\SosVirus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b463fa29ba63b297b9177c677944ff44.exe
Deleted ! C:\Users\SosVirus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bc417da8242d899d911d46b52a2aa2c2.exe
Deleted ! E:\My Picture.SCR
Deleted ! E:\set.vbs
Deleted ! C:\Users\SosVirus\AppData\Roaming\trsa.exe
Deleted ! C:\Users\SosVirus\AppData\Roaming\trsa.exe.tmp
Deleted ! E:\0ed9b0dd4f968cc32d4e7c0293ea9e57.exe
Deleted ! E:\29d6ad028fa7e9945b60c9f480764362.zip.lnk
Deleted ! E:\3dcedd76b1f542ec14094a9afe39a1b2.zip.lnk
Deleted ! E:\8bf5931005ec23184864abaa42a2cd18.zip.lnk
Deleted ! E:\b114764aa3567a0bb3a22a8374b3d46b.zip.lnk
Deleted ! E:\set.vbs.lnk
Deleted ! C:\Users\SosVirus\AppData\Local\Temp\svchots.exe
Deleted ! C:\Users\SosVirus\AppData\Roaming\Systwm.exe
Deleted ! C:\Users\SosVirus\Desktop\29d6ad028fa7e9945b60c9f480764362\set.vbs
Deleted ! C:\Users\SosVirus\Desktop\3dcedd76b1f542ec14094a9afe39a1b2\bc417da8242d899d911d46b52a2aa2c2.exe
Deleted ! C:\Users\SosVirus\Desktop\8bf5931005ec23184864abaa42a2cd18\b463fa29ba63b297b9177c677944ff44.exe
Deleted ! C:\Users\SosVirus\Desktop\b114764aa3567a0bb3a22a8374b3d46b\0ed9b0dd4f968cc32d4e7c0293ea9e57.exe

(!) Temporary files deleted.

################## | Registry |

Deleted ! HKCU\Software\0ed9b0dd4f968cc32d4e7c0293ea9e57
Deleted ! HKCU\Software\b463fa29ba63b297b9177c677944ff44
Deleted ! HKCU\Software\bc417da8242d899d911d46b52a2aa2c2
Repaired ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|EnableLUA -> 1
Repaired ! HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System|ConsentPromptBehaviorAdmin -> 5
Deleted ! HKU\S-1-5-21-3326037888-2103832623-3606209763-1001\Software\Microsoft\Windows\CurrentVersion\Run|0ed9b0dd4f968cc32d4e7c0293ea9e57
Deleted ! HKU\S-1-5-21-3326037888-2103832623-3606209763-1001\Software\Microsoft\Windows\CurrentVersion\Run|b463fa29ba63b297b9177c677944ff44
Deleted ! HKU\S-1-5-21-3326037888-2103832623-3606209763-1001\Software\Microsoft\Windows\CurrentVersion\Run|bc417da8242d899d911d46b52a2aa2c2

################## | UsbFix – Information |

UsbFix has detected on your computer, an infection which a Keylogger function.
After cleaning with UsbFix, please modify all your passwords.
If you made purchases on Internet,
please contact your bank to enviseager an opposition on your bank card.

Info (Fr) : https://www.usb-antivirus.com/2014/03/remove-shortcut-virus-usb/
Info (Fr) : https://www.usb-antivirus.com/2014/03/infections-spreading-usb-peripherals/

################## | Listing |

[07/02/2014 – 21:28:28 | SHD] – C:\$Recycle.Bin
[30/09/2013 – 05:24:45 | RASH | 389 Ko] – C:\bootmgr
[18/06/2013 – 13:18:29 | N | 0 Ko] – C:\BOOTNXT
[22/08/2013 – 15:45:52 | SHD] – C:\Documents and Settings
[14/02/2014 – 11:15:18 | ASH | 1677300 Ko] – C:\hiberfil.sys
[14/02/2014 – 11:15:19 | ASH | 1179648 Ko] – C:\pagefile.sys
[22/08/2013 – 16:22:35 | D] – C:\PerfLogs
[14/02/2014 – 10:48:16 | D] – C:\Program Files
[14/02/2014 – 10:48:23 | D] – C:\Program Files (x86)
[08/02/2014 – 14:57:44 | HD] – C:\ProgramData
[14/02/2014 – 11:15:20 | ASH | 262144 Ko] – C:\swapfile.sys
[14/02/2014 – 10:59:51 | SHD] – C:\System Volume Information
[14/02/2014 – 11:01:43 | D] – C:\UsbFix
[08/02/2014 – 14:58:05 | N | 7 Ko | 1BBCDA94C8E4F1F4338CC9C92F4AEED2] – C:\UsbFix [Clean 2] VMWARE.txt
[14/02/2014 – 11:19:09 | A | 7 Ko | 5568C1C29DC7608599E48ABEA2BD0572] – C:\UsbFix [Clean 4] VMWARE.txt
[08/02/2014 – 17:38:10 | N | 2 Ko | 8BBC825E8BD88E8ED481F9A5A9B70930] – C:\UsbFix [Listing 1] VMWARE.txt
[08/02/2014 – 17:38:28 | N | 2 Ko | 443500AE377FD42FA365A14C830A1597] – C:\UsbFix [Listing 2] VMWARE.txt
[08/02/2014 – 14:20:41 | N | 6 Ko | 89B16C2D48414085E6AC534665A0C2E0] – C:\UsbFix [Scan 1] VMWARE.txt
[14/02/2014 – 11:06:42 | N | 8 Ko | C6D99C733C0937DA30EA50DDDBE67A88] – C:\UsbFix [Scan 2] VMWARE.txt
[07/02/2014 – 21:25:08 | D] – C:\Users
[14/02/2014 – 10:51:16 | D] – C:\Windows
[14/02/2014 – 09:53:55 | N | 7 Ko] – E:\29d6ad028fa7e9945b60c9f480764362.zip
[14/02/2014 – 09:53:29 | N | 226 Ko] – E:\3dcedd76b1f542ec14094a9afe39a1b2.zip
[14/02/2014 – 09:52:48 | N | 100 Ko] – E:\8bf5931005ec23184864abaa42a2cd18.zip
[14/02/2014 – 09:53:05 | N | 36 Ko] – E:\b114764aa3567a0bb3a22a8374b3d46b.zip
[17/01/2014 – 09:46:38 | SHD] – E:\System Volume Information

################## | Vaccin |

E:\Autorun.inf -> Vaccine created by UsbFix (El Desaparecido)

################## | E.O.F |

[fusion_separator style_type=”shadow” top_margin=”40″ bottom_margin=”40″ sep_color=”” icon=”” width=”” class=”” id=””/]

[fusion_separator top=”40″ style=”none”/][/fusion_builder_column][/fusion_builder_row][/fusion_builder_container]