Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)
Magic Disk est un adware (logiciel publicitaire), qui affiche des publicités intempestives indépendantes des sites visités.
- S'installe en tant que programme, soit à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime, soit depuis le site de l'éditeur
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MagicDisk/warning4.png&key=8ffeac907cb5af87e9dd4d6959097d9212c01869be6f1090c56f20d0721428fa)
- Affiche ces alertes pendant l'installation
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MagicDisk/warning1.png&key=42149dd9eada4ef0b24d368e996cae300a3c9636a42647b7a3b77df37e87bc5b)http://
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MagicDisk/warning2.png&key=a0aa9ea7354deb27db7f6568b9e201626ab590e6fa59c1641dfc1093a9fa8073)
- Crée cette icône sur le Bureau et dans le Menu Démarrer
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MagicDisk/icons.png&key=56262553f2dbbe89308484d9be6112b4f0f9f5b786f3d1ae16e182b9c0604bbf)
- Affiche cet écran principal de l'application
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MagicDisk/main.png&key=5bc5cad550d70a377863326e453a41ee16db163ae877d7dfc65ba428814efcb4)
**********
Détection de Magic Disk dans des rapports FRST :
mgdisk (HKLM-x32\...\{E4594B8F-F580-4EF7-8787-4A4FF7AE4A8A}) (Version: - )
(Chengdu Xingju Infinite Technology Co.,Ltd.) C:\Program Files (x86)\mgdisk\mgdisk.exe
HKLM-x32\...\Run: [mgdisk] => C:\Program Files (x86)\mgdisk\mgdisk.exe [854440 2017-07-04] (Chengdu Xingju Infinite Technology Co.,Ltd.)
R1 cfidsk; C:\Windows\System32\drivers\cfidsk.sys [196520 2017-07-04] ()
C:\Program Files (x86)\mgdisk
C:\Users\Public\Desktop\mgdisk.lnk
C:\Users\Public\Documents\XMUpdate
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\mgdisk
**********
Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)
PUP.Optional.MagicDisk
PUP.Optional.ChinAd
-Scan Details-
Process: 1
PUP.Optional.MagicDisk, C:\PROGRAM FILES (X86)\MGDISK\MGDISK.EXE, Quarantined, [8175], [403629],1.0.2309
Module: 4
PUP.Optional.MagicDisk, C:\PROGRAM FILES (X86)\MGDISK\MGDISK.EXE, Quarantined, [8175], [403629],1.0.2309
PUP.Optional.MagicDisk, C:\Program Files (x86)\mgdisk\sciter32.dll, Quarantined, [8175], [403629],1.0.2309
PUP.Optional.MagicDisk, C:\Program Files (x86)\mgdisk\sqlite3.dll, Quarantined, [8175], [403629],1.0.2309
PUP.Optional.MagicDisk, C:\Program Files (x86)\mgdisk\zlib.dll, Quarantined, [8175], [403629],1.0.2309
Registry Key: 2
PUP.Optional.MagicDisk, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{E4594B8F-F580-4EF7-8787-4A4FF7AE4A8A}, Delete-on-Reboot, [8175], [413788],1.0.2309
PUP.Optional.ChinAd, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\cfidsk, Delete-on-Reboot, [115], [412913],1.0.2309
Registry Value: 1
PUP.Optional.MagicDisk, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|mgdisk, Delete-on-Reboot, [8175], [403629],1.0.2309
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 2
PUP.Optional.MagicDisk, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MGDISK, Delete-on-Reboot, [8175], [413772],1.0.2309
PUP.Optional.MagicDisk, C:\PROGRAM FILES (X86)\MGDISK, Delete-on-Reboot, [8175], [403629],1.0.2309
File: 14
PUP.Optional.MagicDisk, C:\USERS\{username}\DESKTOP\SETUP-CFD.EXE, Delete-on-Reboot, [8175], [413788],1.0.2309
PUP.Optional.MagicDisk, C:\USERS\PUBLIC\DESKTOP\MGDISK.LNK, Delete-on-Reboot, [8175], [413774],1.0.2309
PUP.Optional.MagicDisk, C:\PROGRAM FILES (X86)\MGDISK\UNINST.EXE, Delete-on-Reboot, [8175], [413788],1.0.2309
PUP.Optional.ChinAd, C:\WINDOWS\SYSTEM32\DRIVERS\CFIDSK.SYS, Delete-on-Reboot, [115], [412913],1.0.2309
PUP.Optional.MagicDisk, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\MGDISK\MGDISK.LNK, Delete-on-Reboot, [8175], [413772],1.0.2309
PUP.Optional.MagicDisk, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\mgdisk\uninstall mgdisk.lnk, Delete-on-Reboot, [8175], [413772],1.0.2309
PUP.Optional.MagicDisk, C:\PROGRAM FILES (X86)\MGDISK\MGDISK.EXE, Delete-on-Reboot, [8175], [403629],1.0.2309
PUP.Optional.MagicDisk, C:\Program Files (x86)\mgdisk\mgdinst.dll, Delete-on-Reboot, [8175], [403629],1.0.2309
PUP.Optional.MagicDisk, C:\Program Files (x86)\mgdisk\mgdisk.db3, Delete-on-Reboot, [8175], [403629],1.0.2309
PUP.Optional.MagicDisk, C:\Program Files (x86)\mgdisk\mgdisk.ini, Delete-on-Reboot, [8175], [403629],1.0.2309
PUP.Optional.MagicDisk, C:\Program Files (x86)\mgdisk\mgdisk.ssf, Delete-on-Reboot, [8175], [403629],1.0.2309
PUP.Optional.MagicDisk, C:\Program Files (x86)\mgdisk\sciter32.dll, Delete-on-Reboot, [8175], [403629],1.0.2309
PUP.Optional.MagicDisk, C:\Program Files (x86)\mgdisk\sqlite3.dll, Delete-on-Reboot, [8175], [403629],1.0.2309
PUP.Optional.MagicDisk, C:\Program Files (x86)\mgdisk\zlib.dll, Delete-on-Reboot, [8175], [403629],1.0.2309
Physical Sector: 0
(No malicious items detected)
Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)
Source : Removal instructions for Magic Disk de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/203964-removal-instructions-for-magic-disk/)
Toujours infecté ? Une question avant de faire des manipulations ?
Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/ en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/