Auteur Sujet: WinRepair Pro (Lu 16685 fois)

chantal11 · « **le:** juillet 21, 2017, 12:00:46 »

Contenu republié avec la permission de Malwarebytes

WinRepair Pro est un faux nettoyeur/optimiseur, affiche intentionnellement des faux-positifs pour convaincre l'utilisateur que son système a des problèmes et lui faire acheter le logiciel.
Plus d'infos : Registry Cleaners: Digital Snake Oil | Malwarebytes Labs

S'installe en tant que programme, soit à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime, soit depuis le site de l'éditeur

Affiche ces alertes pendant l'installation

Affiche ces écrans pendant les opérations

Crée cette icône dans la Barre des tâches, sur le Bureau et dans le Menu Démarrer

Crée ces tâches planifiées

**********

Détection de WinRepair Pro dans des rapports FRST :

Citer

WinRepair Pro (HKLM-x32\...\WinRepair Pro_is1) (Version: 3.6 - winrepairpro.com)
Task: {38A69C83-2026-46DB-AA16-5931E384BF22} - System32\Tasks\WinRepair Pro_UPDATES => C:\Program Files (x86)\WinRepair Pro\WinRepairPro.exe [2015-10-20] (WinRepair Pro)
Task: {7CB9AB85-ADCC-41C8-839F-B0F0BEE63D16} - System32\Tasks\WinRepair Pro_DEFAULT => C:\Program Files (x86)\WinRepair Pro\WinRepairPro.exe [2015-10-20] (WinRepair Pro)
Task: {9B7C2EA8-231B-4D3C-BADA-371A3A27F5E5} - System32\Tasks\WinRepair Pro => C:\Program Files (x86)\WinRepair Pro\WinRepairPro.exe [2015-10-20] (WinRepair Pro)
Task: C:\Windows\Tasks\WinRepair Pro_DEFAULT.job => C:\Program Files (x86)\WinRepair Pro\WinRepairPro.exe
Task: C:\Windows\Tasks\WinRepair Pro_UPDATES.job => C:\Program Files (x86)\WinRepair Pro\WinRepairPro.exe

(WinRepair Pro) C:\Program Files (x86)\WinRepair Pro\WinRepairPro.exe
C:\Users\{Nom_Utilisateur}\AppData\Roaming\WinRepair Pro
C:\Windows\System32\Tasks\WinRepair Pro
C:\Windows\System32\Tasks\WinRepair Pro_UPDATES
C:\Windows\System32\Tasks\WinRepair Pro_DEFAULT
C:\Users\Public\Desktop\WinRepair Pro.lnk
C:\Windows\Tasks\WinRepair Pro_UPDATES.job
C:\Windows\Tasks\WinRepair Pro_DEFAULT.job
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRepair Pro
C:\Program Files (x86)\WinRepair Pro
C:\Users\{Nom_Utilisateur}\AppData\Local\Temp\vVo3847.exe

**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)
Sous la version Premium, Malwarebytes bloque l'accès à leur site.

Citer

PUP.Optional.WinRepairPro

Citer

-Scan Details-
Process: 1
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\WINREPAIRPRO.EXE, Quarantined, [9380], [407705],1.0.2155

Module: 3
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\ISXDL.DLL, Quarantined, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\XMLLITE.DLL, Quarantined, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\WINREPAIRPRO.EXE, Quarantined, [9380], [407705],1.0.2155

Registry Key: 10
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WinRepair Pro_is1, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, HKCU\SOFTWARE\WinRepair Pro, Delete-on-Reboot, [9380], [407719],1.0.2155
PUP.Optional.WinRepairPro, HKCU\SOFTWARE\WIN\REPAIR\pro, Delete-on-Reboot, [9380], [407720],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{38A69C83-2026-46DB-AA16-5931E384BF22}, Delete-on-Reboot, [9380], [407732],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{7CB9AB85-ADCC-41C8-839F-B0F0BEE63D16}, Delete-on-Reboot, [9380], [407732],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{9B7C2EA8-231B-4D3C-BADA-371A3A27F5E5}, Delete-on-Reboot, [9380], [407732],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\WOW6432NODE\WIN\REPAIR\pro, Delete-on-Reboot, [9380], [407717],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WinRepair Pro, Delete-on-Reboot, [9380], [407731],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WinRepair Pro_DEFAULT, Delete-on-Reboot, [9380], [407731],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WinRepair Pro_UPDATES, Delete-on-Reboot, [9380], [407731],1.0.2155

Registry Value: 3
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{38A69C83-2026-46DB-AA16-5931E384BF22}|PATH, Delete-on-Reboot, [9380], [407732],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{7CB9AB85-ADCC-41C8-839F-B0F0BEE63D16}|PATH, Delete-on-Reboot, [9380], [407732],1.0.2155
PUP.Optional.WinRepairPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{9B7C2EA8-231B-4D3C-BADA-371A3A27F5E5}|PATH, Delete-on-Reboot, [9380], [407732],1.0.2155

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.WinRepairPro, C:\USERS\{username}\APPDATA\ROAMING\WinRepair Pro, Delete-on-Reboot, [9380], [407712],1.0.2155
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WinRepair Pro, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\WINREPAIR PRO, Delete-on-Reboot, [9380], [407707],1.0.2155

File: 64
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\ISXDL.DLL, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\XMLLITE.DLL, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\PROGRAM FILES (X86)\WINREPAIR PRO\WINREPAIRPRO.EXE, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Users\{username}\AppData\Roaming\WinRepair Pro\backup6.bin, Delete-on-Reboot, [9380], [407712],1.0.2155
PUP.Optional.WinRepairPro, C:\Users\{username}\AppData\Roaming\WinRepair Pro\eng_wrp.dat, Delete-on-Reboot, [9380], [407712],1.0.2155
PUP.Optional.WinRepairPro, C:\Users\{username}\AppData\Roaming\WinRepair Pro\log_06-15-2017.log, Delete-on-Reboot, [9380], [407712],1.0.2155
PUP.Optional.WinRepairPro, C:\Users\{username}\AppData\Roaming\WinRepair Pro\results.wrp, Delete-on-Reboot, [9380], [407712],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\FileList.wrp, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Chinese_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Chinese_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\CleanSchedule.exe, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Danish_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Danish_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Dutch_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Dutch_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\eng_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\eng_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Italian_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Italian_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Japanese_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Japanese_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\korean_uninst_ko.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\korean_wrp_ko.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Norwegian_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Norwegian_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\polish_uninst_pl.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\polish_wrp_pl.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\portugese_uninst_pt.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\portugese_wrp_pt.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Portuguese_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Portuguese_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Finnish_uninst_fi.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Finnish_wrp_fi.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\French_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\French_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\German_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\German_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\greek_uninst_el.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\greek_wrp_el.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\install_left_image.bmp, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\RegList.wrp, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\russian_uninst_ru.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\russian_wrp_ru.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\spanish_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Spanish_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\swedish_uninst.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Swedish_wrp.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\traditionalcn_uninst_zh-tw.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\TraditionalCn_wrp_zh-tw.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\Turkish_uninst_tr.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\turkish_wrp_tr.ini, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\unins000.dat, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\unins000.exe, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\Program Files (x86)\WinRepair Pro\WRPUns.exe, Delete-on-Reboot, [9380], [407705],1.0.2155
PUP.Optional.WinRepairPro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRepair Pro\Register WinRepair Pro.lnk, Delete-on-Reboot, [9380], [407707],1.0.2155
PUP.Optional.WinRepairPro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRepair Pro\Uninstall WinRepair Pro.lnk, Delete-on-Reboot, [9380], [407707],1.0.2155
PUP.Optional.WinRepairPro, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRepair Pro\WinRepair Pro.lnk, Delete-on-Reboot, [9380], [407707],1.0.2155
Adware.Imali, C:\USERS\{username}\DESKTOP\SETUP.EXE, Delete-on-Reboot, [628], [1597],1.0.2155
PUP.Optional.WinRepairPro, C:\USERS\PUBLIC\DESKTOP\WINREPAIR PRO.LNK, Delete-on-Reboot, [9380], [407709],1.0.2155
PUP.Optional.WinRepairPro, C:\WINDOWS\TASKS\WINREPAIR PRO_UPDATES.JOB, Delete-on-Reboot, [9380], [407714],1.0.2155
PUP.Optional.WinRepairPro, C:\WINDOWS\TASKS\WINREPAIR PRO_DEFAULT.JOB, Delete-on-Reboot, [9380], [407714],1.0.2155
PUP.Optional.WinRepairPro, C:\WINDOWS\SYSTEM32\TASKS\WinRepair Pro, Delete-on-Reboot, [9380], [407713],1.0.2155
PUP.Optional.WinRepairPro, C:\WINDOWS\SYSTEM32\TASKS\WinRepair Pro_DEFAULT, Delete-on-Reboot, [9380], [407713],1.0.2155
PUP.Optional.WinRepairPro, C:\WINDOWS\SYSTEM32\TASKS\WinRepair Pro_UPDATES, Delete-on-Reboot, [9380], [407713],1.0.2155

Physical Sector: 0
(No malicious items detected)

Tutoriel d'utilisation Malwarebytes en images

Source : Removal instructions for WinRepair Pro de Metallica - Malwarebytes Forums

Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/ en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/

Auteur Sujet: WinRepair Pro (Lu 16685 fois)

chantal11

WinRepair Pro