Imprimer la page - WinRepair Pro

Forum Security-X => Sécurité Générale => Malwares => Discussion démarrée par: chantal11 le juillet 21, 2017, 12:00:46

Titre: WinRepair Pro
Posté par: chantal11 le juillet 21, 2017, 12:00:46

Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)

WinRepair Pro est un faux nettoyeur/optimiseur, affiche intentionnellement des faux-positifs pour convaincre l'utilisateur que son système a des problèmes et lui faire acheter le logiciel.
Plus d'infos : Registry Cleaners: Digital Snake Oil | Malwarebytes Labs (https://blog.malwarebytes.com/cybercrime/2015/06/digital-snake-oil/)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/WinRepairPro/main.png&key=62b755251032fb7426f310f3c807d1b8720803bd881fec708f656686d49ba15d)

S'installe en tant que programme, soit à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime, soit depuis le site de l'éditeur

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/WinRepairPro/warning4.png&key=22871c12a8ccac7c15aa91c600c5115e679ffe4a424a79d806a21c9ef34b9640)

Affiche ces alertes pendant l'installation

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/WinRepairPro/warning1.png&key=e63ae02a2a42927464868c6c14d16d0d99035da76e50b52092b10e7bfc39bc81)

Affiche ces écrans pendant les opérations

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/WinRepairPro/warning5.png&key=4f6a0ff80cede8c1babd38920f098f4a9b8bfc9fa7fd3f0b12ea0ccf49befa28)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/WinRepairPro/warning6.png&key=2b659c39256b7a7bcdf6b30069ced04cceccf05e79047fb485dfa679e24844df)

Crée cette icône dans la Barre des tâches, sur le Bureau et dans le Menu Démarrer

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/WinRepairPro/icons.png&key=764ec1348fe714ee57d1de72ac3f994efb3128dd93bda282f343dd662f3be795)

Crée ces tâches planifiées

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/WinRepairPro/warning3.png&key=b368912cbc4e38fea50b82c219633aca15cd25704897ef80312d6c6d34936459)

**********

Détection de WinRepair Pro dans des rapports FRST :

Citer

WinRepair Pro (HKLM-x32\...\WinRepair Pro_is1) (Version: 3.6 - winrepairpro.com)
Task: {38A69C83-2026-46DB-AA16-5931E384BF22} - System32\Tasks\WinRepair Pro_UPDATES => C:\Program Files (x86)\WinRepair Pro\WinRepairPro.exe [2015-10-20] (WinRepair Pro)
Task: {7CB9AB85-ADCC-41C8-839F-B0F0BEE63D16} - System32\Tasks\WinRepair Pro_DEFAULT => C:\Program Files (x86)\WinRepair Pro\WinRepairPro.exe [2015-10-20] (WinRepair Pro)
Task: {9B7C2EA8-231B-4D3C-BADA-371A3A27F5E5} - System32\Tasks\WinRepair Pro => C:\Program Files (x86)\WinRepair Pro\WinRepairPro.exe [2015-10-20] (WinRepair Pro)
Task: C:\Windows\Tasks\WinRepair Pro_DEFAULT.job => C:\Program Files (x86)\WinRepair Pro\WinRepairPro.exe
Task: C:\Windows\Tasks\WinRepair Pro_UPDATES.job => C:\Program Files (x86)\WinRepair Pro\WinRepairPro.exe

(WinRepair Pro) C:\Program Files (x86)\WinRepair Pro\WinRepairPro.exe
C:\Users\{Nom_Utilisateur}\AppData\Roaming\WinRepair Pro
C:\Windows\System32\Tasks\WinRepair Pro
C:\Windows\System32\Tasks\WinRepair Pro_UPDATES
C:\Windows\System32\Tasks\WinRepair Pro_DEFAULT
C:\Users\Public\Desktop\WinRepair Pro.lnk
C:\Windows\Tasks\WinRepair Pro_UPDATES.job
C:\Windows\Tasks\WinRepair Pro_DEFAULT.job
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRepair Pro
C:\Program Files (x86)\WinRepair Pro
C:\Users\{Nom_Utilisateur}\AppData\Local\Temp\vVo3847.exe

**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)
Sous la version Premium, Malwarebytes bloque l'accès à leur site.

Citer

PUP.Optional.WinRepairPro

Citer

-Scan Details-
Process: 1
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\WINREPAIRPRO.EXE, Quarantined, [9380], [407705],1.0.2155

Module: 3
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\ISXDL.DLL, Quarantined, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\XMLLITE.DLL, Quarantined, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\WINREPAIRPRO.EXE, Quarantined, [9380], [407705],1.0.2155

Registry Key: 10
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WinRepair Pro_is1, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, HKCU\SOFTWARE\WinRepair Pro, Delete-on-Reboot, [9380], [407719],1.0.2155
PUP.Optional.WinRepairPro, HKCU\SOFTWARE\WIN\REPAIR\pro, Delete-on-Reboot, [9380], [407720],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{38A69C83-2026-46DB-AA16-5931E384BF22}, Delete-on-Reboot, [9380], [407732],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{7CB9AB85-ADCC-41C8-839F-B0F0BEE63D16}, Delete-on-Reboot, [9380], [407732],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{9B7C2EA8-231B-4D3C-BADA-371A3A27F5E5}, Delete-on-Reboot, [9380], [407732],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\WOW6432NODE\WIN\REPAIR\pro, Delete-on-Reboot, [9380], [407717],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WinRepair Pro, Delete-on-Reboot, [9380], [407731],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WinRepair Pro_DEFAULT, Delete-on-Reboot, [9380], [407731],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WinRepair Pro_UPDATES, Delete-on-Reboot, [9380], [407731],1.0.2155

Registry Value: 3
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{38A69C83-2026-46DB-AA16-5931E384BF22}|PATH, Delete-on-Reboot, [9380], [407732],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{7CB9AB85-ADCC-41C8-839F-B0F0BEE63D16}|PATH, Delete-on-Reboot, [9380], [407732],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{9B7C2EA8-231B-4D3C-BADA-371A3A27F5E5}|PATH, Delete-on-Reboot, [9380], [407732],1.0.2155

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.WinRepairPro, C:\USERS\{username}\APPDATA\ROAMING\WinRepair Pro, Delete-on-Reboot, [9380], [407712],1.0.2155
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WinRepair Pro, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\WINREPAIR PRO, Delete-on-Reboot, [9380], [407707],1.0.2155

File: 64
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\ISXDL.DLL, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\XMLLITE.DLL, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\WINREPAIRPRO.EXE, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Users\{username}\AppData\Roaming\WinRepair Pro\backup6.bin, Delete-on-Reboot, [9380], [407712],1.0.2155
PUP.Optional.WinRepairPro, C:\Users\{username}\AppData\Roaming\WinRepair Pro\eng_wrp.dat, Delete-on-Reboot, [9380], [407712],1.0.2155
PUP.Optional.WinRepairPro, C:\Users\{username}\AppData\Roaming\WinRepair Pro\log_06-15-2017.log, Delete-on-Reboot, [9380], [407712],1.0.2155
PUP.Optional.WinRepairPro, C:\Users\{username}\AppData\Roaming\WinRepair Pro\results.wrp, Delete-on-Reboot, [9380], [407712],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\FileList.wrp, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Chinese_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Chinese_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\CleanSchedule.exe, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Danish_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Danish_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Dutch_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Dutch_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\eng_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\eng_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Italian_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Italian_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Japanese_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Japanese_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\korean_uninst_ko.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\korean_wrp_ko.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Norwegian_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Norwegian_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\polish_uninst_pl.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\polish_wrp_pl.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\portugese_uninst_pt.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\portugese_wrp_pt.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Portuguese_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Portuguese_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Finnish_uninst_fi.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Finnish_wrp_fi.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\French_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\French_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\German_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\German_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\greek_uninst_el.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\greek_wrp_el.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\install_left_image.bmp, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\RegList.wrp, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\russian_uninst_ru.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\russian_wrp_ru.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\spanish_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Spanish_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\swedish_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Swedish_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\traditionalcn_uninst_zh-tw.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\TraditionalCn_wrp_zh-tw.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Turkish_uninst_tr.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\turkish_wrp_tr.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\unins000.dat, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\unins000.exe, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\WRPUns.exe, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRepair Pro\Register WinRepair Pro.lnk, Delete-on-Reboot, [9380], [407707],1.0.2155
PUP.Optional.WinRepairPro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRepair Pro\Uninstall WinRepair Pro.lnk, Delete-on-Reboot, [9380], [407707],1.0.2155
PUP.Optional.WinRepairPro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRepair Pro\WinRepair Pro.lnk, Delete-on-Reboot, [9380], [407707],1.0.2155
Adware.Imali, C:\USERS\{username}\DESKTOP\SETUP.EXE, Delete-on-Reboot, [628], [1597],1.0.2155
PUP.Optional.WinRepairPro, C:\USERS\PUBLIC\DESKTOP\WINREPAIR PRO.LNK, Delete-on-Reboot, [9380], [407709],1.0.2155
PUP.Optional.WinRepairPro, C:\WINDOWS\TASKS\WINREPAIR PRO_UPDATES.JOB, Delete-on-Reboot, [9380], [407714],1.0.2155
PUP.Optional.WinRepairPro, C:\WINDOWS\TASKS\WINREPAIR PRO_DEFAULT.JOB, Delete-on-Reboot, [9380], [407714],1.0.2155
PUP.Optional.WinRepairPro, C:\WINDOWS\SYSTEM32\TASKS\WinRepair Pro, Delete-on-Reboot, [9380], [407713],1.0.2155
PUP.Optional.WinRepairPro, C:\WINDOWS\SYSTEM32\TASKS\WinRepair Pro_DEFAULT, Delete-on-Reboot, [9380], [407713],1.0.2155
PUP.Optional.WinRepairPro, C:\WINDOWS\SYSTEM32\TASKS\WinRepair Pro_UPDATES, Delete-on-Reboot, [9380], [407713],1.0.2155

Physical Sector: 0
(No malicious items detected)

Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)

Source : Removal instructions for WinRepair Pro de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/202713-removal-instructions-for-winrepair-pro/)

Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/ en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/