DirAnalyze est un
faux nettoyeur/optimiseur, affiche intentionnellement des faux-positifs pour convaincre l'utilisateur que son système a des problèmes et lui faire acheter le logiciel.
Plus d'infos :
Registry Cleaners: Digital Snake Oil | Malwarebytes Labs- Le lien sur cette interface graphique ouvre ce site
- Crée ces tâches planifiées
**********Détection de
DirAnalyze dans des rapports
FRST :
Task: {05B0FD01-1950-4A64-85D5-82AC65DA6EF1} - System32\Tasks\DirAnalyzer => C:\Users\Public\DiskCleaner\sdiskfinder.exe [2017-07-04] (DirAnalyze )
Task: {2797DCFE-8D43-439A-BD17-BF5E4F8BBDDA} - System32\Tasks\SDisk Finder => C:\Users\Public\DiskCleaner\sdiskfinder.exe [2017-07-04] (DirAnalyze )
Task: {A43C518E-E01F-4859-BA69-127862BD61EE} - System32\Tasks\Microsoft\DiskOptimizer => C:\Program Files (x86)\SDisk Finder\sdiskfinder.exe [2017-07-04] (DirAnalyze )
Task: C:\Windows\Tasks\Test Task.job => C:\Windows\System32\notepad.exe
C:\Users\{username}\Downloads\scf.db
C:\Windows\System32\Tasks\DirAnalyzer
C:\Windows\System32\Tasks\SDisk Finder
C:\Windows\Tasks\Test Task.job
C:\Users\Public\DiskCleaner
C:\Program Files (x86)\SDisk Finder
(DirAnalyze ) C:\Users\{Nom_Utilisateur}\Downloads\scf.exe
**********Détecté et traité par
Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)
Sous la version Premium,
Malwarebytes bloque l'accès à leur domaine.
PUP.Optional.SDiskFinder
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 4
PUP.Optional.SDiskFinder, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\DirAnalyzer, Delete-on-Reboot, [9446], [413145],1.0.2290
PUP.Optional.SDiskFinder, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\SDisk Finder, Delete-on-Reboot, [9446], [412870],1.0.2290
PUP.Optional.SDiskFinder, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{05B0FD01-1950-4A64-85D5-82AC65DA6EF1}, Delete-on-Reboot, [9446], [413144],1.0.2290
PUP.Optional.SDiskFinder, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{501DB47D-6021-45AB-AB44-FFA0E693E46E}, Delete-on-Reboot, [9446], [412869],1.0.2290
Registry Value: 2
PUP.Optional.SDiskFinder, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{05B0FD01-1950-4A64-85D5-82AC65DA6EF1}|PATH, Delete-on-Reboot, [9446], [413144],1.0.2290
PUP.Optional.SDiskFinder, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{501DB47D-6021-45AB-AB44-FFA0E693E46E}|PATH, Delete-on-Reboot, [9446], [412869],1.0.2290
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 2
PUP.Optional.SDiskFinder, C:\USERS\PUBLIC\DISKCLEANER, Delete-on-Reboot, [9446], [412874],1.0.2290
PUP.Optional.SDiskFinder, C:\PROGRAM FILES (X86)\SDISK FINDER, Delete-on-Reboot, [9446], [412873],1.0.2290
File: 8
PUP.Optional.SDiskFinder, C:\USERS\{username}\DESKTOP\SCF.EXE, Delete-on-Reboot, [9446], [413142],1.0.2290
PUP.Optional.SDiskFinder, C:\PROGRAM FILES (X86)\SDISK FINDER\SDISKFINDER.EXE, Delete-on-Reboot, [9446], [413142],1.0.2290
PUP.Optional.SDiskFinder, C:\USERS\{username}\DOWNLOADS\SCF.EXE, Delete-on-Reboot, [9446], [413142],1.0.2290
PUP.Optional.SDiskFinder, C:\USERS\PUBLIC\DISKCLEANER\SDISKFINDER.EXE, Delete-on-Reboot, [9446], [413142],1.0.2290
PUP.Optional.SDiskFinder, C:\WINDOWS\TASKS\TEST TASK.JOB, Delete-on-Reboot, [9446], [413151],1.0.2290
PUP.Optional.SDiskFinder, C:\WINDOWS\SYSTEM32\TASKS\DIRANALYZER, Delete-on-Reboot, [9446], [413146],1.0.2290
PUP.Optional.SDiskFinder, C:\WINDOWS\SYSTEM32\TASKS\MICROSOFT\DISKOPTIMIZER, Delete-on-Reboot, [9446], [413152],1.0.2290
PUP.Optional.SDiskFinder, C:\WINDOWS\SYSTEM32\TASKS\SDISK FINDER, Delete-on-Reboot, [9446], [412871],1.0.2290
Physical Sector: 0
(No malicious items detected)
Tutoriel d'utilisation Malwarebytes en imagesSource : Removal instructions for DirAnalyze de Metallica - Malwarebytes Forums
Toujours infecté ? Une question avant de faire des manipulations ?
Venez poster un
nouveau sujet dans ce forum :
http://forum.security-x.fr/desinfections/ en prenant soin de suivre la procédure
http://forum.security-x.fr/desinfections/procedure-preliminaire/
