Security-X

Forum Security-X => Sécurité Générale => Malwares => Discussion démarrée par: chantal11 le juillet 21, 2017, 14:17:22

Titre: DirAnalyze
Posté par: chantal11 le juillet 21, 2017, 14:17:22

Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)

DirAnalyze est un faux nettoyeur/optimiseur, affiche intentionnellement des faux-positifs pour convaincre l'utilisateur que son système a des problèmes et lui faire acheter le logiciel.
Plus d'infos : Registry Cleaners: Digital Snake Oil | Malwarebytes Labs (https://blog.malwarebytes.com/cybercrime/2015/06/digital-snake-oil/)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/SDiskFinder/main.png&key=6893232312b50911ce131b96ae57061e11c512ac9f4db0003d547ba583805c9e)

• Le lien sur cette interface graphique ouvre ce site

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/SDiskFinder/website.png&key=e406f657127c8690a97292b64bab21447beb908869d2434f68b612d54d6d7a3e)

• Crée ces tâches planifiées

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/SDiskFinder/warning3.png&key=95ae95a9386ee9a0bf7ba1800b4563eb81b1c58ddf6e67139c08255285b4dc08)

**********

Détection de DirAnalyze dans des rapports FRST :

Citer

Task: {05B0FD01-1950-4A64-85D5-82AC65DA6EF1} - System32\Tasks\DirAnalyzer => C:\Users\Public\DiskCleaner\sdiskfinder.exe [2017-07-04] (DirAnalyze )
Task: {2797DCFE-8D43-439A-BD17-BF5E4F8BBDDA} - System32\Tasks\SDisk Finder => C:\Users\Public\DiskCleaner\sdiskfinder.exe [2017-07-04] (DirAnalyze )
Task: {A43C518E-E01F-4859-BA69-127862BD61EE} - System32\Tasks\Microsoft\DiskOptimizer => C:\Program Files (x86)\SDisk Finder\sdiskfinder.exe [2017-07-04] (DirAnalyze )
Task: C:\Windows\Tasks\Test Task.job => C:\Windows\System32\notepad.exe

C:\Users\{username}\Downloads\scf.db
C:\Windows\System32\Tasks\DirAnalyzer
C:\Windows\System32\Tasks\SDisk Finder
C:\Windows\Tasks\Test Task.job
C:\Users\Public\DiskCleaner
C:\Program Files (x86)\SDisk Finder
(DirAnalyze ) C:\Users\{Nom_Utilisateur}\Downloads\scf.exe

**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)
Sous la version Premium, Malwarebytes bloque l'accès à leur domaine.

Citer

PUP.Optional.SDiskFinder

Citer

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 4
PUP.Optional.SDiskFinder, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\DirAnalyzer, Delete-on-Reboot, [9446], [413145],1.0.2290
PUP.Optional.SDiskFinder, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\SDisk Finder, Delete-on-Reboot, [9446], [412870],1.0.2290
PUP.Optional.SDiskFinder, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{05B0FD01-1950-4A64-85D5-82AC65DA6EF1}, Delete-on-Reboot, [9446], [413144],1.0.2290
PUP.Optional.SDiskFinder, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{501DB47D-6021-45AB-AB44-FFA0E693E46E}, Delete-on-Reboot, [9446], [412869],1.0.2290

Registry Value: 2
PUP.Optional.SDiskFinder, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{05B0FD01-1950-4A64-85D5-82AC65DA6EF1}|PATH, Delete-on-Reboot, [9446], [413144],1.0.2290
PUP.Optional.SDiskFinder, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{501DB47D-6021-45AB-AB44-FFA0E693E46E}|PATH, Delete-on-Reboot, [9446], [412869],1.0.2290

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 2
PUP.Optional.SDiskFinder, C:\USERS\PUBLIC\DISKCLEANER, Delete-on-Reboot, [9446], [412874],1.0.2290
PUP.Optional.SDiskFinder, C:\PROGRAM FILES (X86)\SDISK FINDER, Delete-on-Reboot, [9446], [412873],1.0.2290

File: 8
PUP.Optional.SDiskFinder, C:\USERS\{username}\DESKTOP\SCF.EXE, Delete-on-Reboot, [9446], [413142],1.0.2290
PUP.Optional.SDiskFinder, C:\PROGRAM FILES (X86)\SDISK FINDER\SDISKFINDER.EXE, Delete-on-Reboot, [9446], [413142],1.0.2290
PUP.Optional.SDiskFinder, C:\USERS\{username}\DOWNLOADS\SCF.EXE, Delete-on-Reboot, [9446], [413142],1.0.2290
PUP.Optional.SDiskFinder, C:\USERS\PUBLIC\DISKCLEANER\SDISKFINDER.EXE, Delete-on-Reboot, [9446], [413142],1.0.2290
PUP.Optional.SDiskFinder, C:\WINDOWS\TASKS\TEST TASK.JOB, Delete-on-Reboot, [9446], [413151],1.0.2290
PUP.Optional.SDiskFinder, C:\WINDOWS\SYSTEM32\TASKS\DIRANALYZER, Delete-on-Reboot, [9446], [413146],1.0.2290
PUP.Optional.SDiskFinder, C:\WINDOWS\SYSTEM32\TASKS\MICROSOFT\DISKOPTIMIZER, Delete-on-Reboot, [9446], [413152],1.0.2290
PUP.Optional.SDiskFinder, C:\WINDOWS\SYSTEM32\TASKS\SDISK FINDER, Delete-on-Reboot, [9446], [412871],1.0.2290

Physical Sector: 0
(No malicious items detected)

Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)


Source : Removal instructions for DirAnalyze de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/203722-removal-instructions-for-diranalyze/)

---

Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/  en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/