Security-X

Forum Security-X => Sécurité Générale => Malwares => Discussion démarrée par: chantal11 le octobre 19, 2017, 17:14:45

Titre: Easy PC Optimizer
Posté par: chantal11 le octobre 19, 2017, 17:14:45
Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)

Easy PC Optimizer est un faux nettoyeur/optimiseur, affiche intentionnellement des faux-positifs pour convaincre l'utilisateur que son système a des problèmes et lui faire acheter le logiciel.
Plus d'infos : Registry Cleaners: Digital Snake Oil | Malwarebytes Labs (https://blog.malwarebytes.com/cybercrime/2015/06/digital-snake-oil/)


(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/EasyPCOptimizer/main.png&key=a66c31be8cf45968353ef27b7432922a5e7bfde6cbdde2eec1e927d8db8f7843)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/EasyPCOptimizer/warning4.png&key=c33caaab7c5556b4cd6850f08893d77e06a0b8685bfcb1f0c6459812121ffdab)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/EasyPCOptimizer/warning1.png&key=2dbb21af331c9a9a13100f8f436f19bbf1e0c1e4d72c697d589be04988e807cc)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/EasyPCOptimizer/warning2.png&key=a1b13bbcc6c0cf6771083f332c1b0d7cf40410a70b8ce40be610ec79ffd4cc66)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/EasyPCOptimizer/warning5.png&key=db215b66ddcc04cae6907f9c1ab816dd784ed5f9a704638e0c7bdef6e5f66bb2)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/EasyPCOptimizer/warning6.png&key=01f1bde3b232c4368e3eed5cdcf7ac3ffb76aabd11a4b86d80a994a1809553a6)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/EasyPCOptimizer/icons.png&key=94a56317d49ac01a487250c43d4466cd3d0302664ccc36349fe8f56ce1548b6a)


(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/EasyPCOptimizer/warning3.png&key=82882e1e1e345cf3580cf1d14a714fa59aa271b8883eea53aa9690ec40244aea)







**********

Détection de Easy PC Optimizer dans des rapports FRST :

Citer
Easy PC Optimizer (HKLM-x32\...\Easy PC Optimizer_is1) (Version: 1.6.1.207 - WebMinds, Inc.)
Task: {80EBACE7-F5E2-4384-B5EB-E2A09E9E45D2} - System32\Tasks\Easy PC Optimizer - Run without UAC => C:\Program Files (x86)\Easy PC Optimizer\EPIC.exe [2017-03-28] (WebMinds, Inc)
Task: {81DDD0D7-BB32-4EE7-A7E5-915C3EFFF87D} - System32\Tasks\Easy PC Optimizer Scheduled Scan - {Nom_Utilisateur} => C:\Program Files (x86)\Easy PC Optimizer\EPIC.exe [2017-03-28] (WebMinds, Inc)
Task: {FB616293-533A-43D8-823D-BC4B35174601} - System32\Tasks\Easy PC Optimizer - Background Scanning => C:\Program Files (x86)\Easy PC Optimizer\EPIC.exe [2017-03-28] (WebMinds, Inc)
Task: C:\Windows\Tasks\Easy PC Optimizer Scheduled Scan - {Nom_Utilisateur}.job => C:\Program Files (x86)\Easy PC Optimizer\EPIC.exe

(WebMinds, Inc) C:\Program Files (x86)\Easy PC Optimizer\EPIC.exe
C:\Windows\System32\Tasks\Easy PC Optimizer Scheduled Scan - {Nom_Utilisateur}
C:\Windows\Tasks\Easy PC Optimizer Scheduled Scan - {Nom_Utilisateur}.job
C:\Windows\System32\Tasks\Easy PC Optimizer - Background Scanning
C:\Windows\System32\Tasks\Easy PC Optimizer - Run without UAC
C:\Users\{Nom_Utilisateur}\Desktop\Easy PC Optimizer.lnk
C:\Users\{Nom_Utilisateur}\AppData\Roaming\Easy PC Optimizer
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Easy PC Optimizer
C:\Program Files (x86)\Easy PC Optimizer

**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)
Sous la version Premium, Malwarebytes bloque l'accès au domaine easypcoptimizer.com et l'IP 65.60.40.44

Citer
-Scan Details-
Process: 1
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\EPIC.exe, Quarantined, [8968], [442097],1.0.3029

Module: 2
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\engine.dll, Quarantined, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\EPIC.exe, Quarantined, [8968], [442097],1.0.3029

Registry Key: 7
PUP.Optional.EasyPCOptimizer, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Easy PC Optimizer_is1, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Easy PC Optimizer - Background Scanning, Delete-on-Reboot, [8968], [442110],1.0.3029
PUP.Optional.EasyPCOptimizer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Easy PC Optimizer - Run without UAC, Delete-on-Reboot, [8968], [442114],1.0.3029
PUP.Optional.RegistryPowerCleaner, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\Easy PC Optimizer Scheduled Scan - {username}, Delete-on-Reboot, [8966], [442107],1.0.3029
PUP.Optional.EasyPCOptimizer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{80EBACE7-F5E2-4384-B5EB-E2A09E9E45D2}, Delete-on-Reboot, [8968], [442115],1.0.3029
PUP.Optional.RegistryPowerCleaner, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{81DDD0D7-BB32-4EE7-A7E5-915C3EFFF87D}, Delete-on-Reboot, [8966], [442106],1.0.3029
PUP.Optional.EasyPCOptimizer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{FB616293-533A-43D8-823D-BC4B35174601}, Delete-on-Reboot, [8968], [442111],1.0.3029

Registry Value: 3
PUP.Optional.EasyPCOptimizer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{80EBACE7-F5E2-4384-B5EB-E2A09E9E45D2}|PATH, Delete-on-Reboot, [8968], [442115],1.0.3029
PUP.Optional.RegistryPowerCleaner, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{81DDD0D7-BB32-4EE7-A7E5-915C3EFFF87D}|PATH, Delete-on-Reboot, [8966], [442106],1.0.3029
PUP.Optional.EasyPCOptimizer, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{FB616293-533A-43D8-823D-BC4B35174601}|PATH, Delete-on-Reboot, [8968], [442111],1.0.3029

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 2
PUP.Optional.EasyPCOptimizer, C:\PROGRAM FILES (X86)\EASY PC OPTIMIZER, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\USERS\{username}\APPDATA\ROAMING\EASY PC OPTIMIZER, Delete-on-Reboot, [8968], [442100],1.0.3029

File: 21
PUP.Optional.EasyPCOptimizer, C:\WINDOWS\SYSTEM32\TASKS\EASY PC OPTIMIZER - BACKGROUND SCANNING, Delete-on-Reboot, [8968], [442109],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\PROGRAM FILES (X86)\EASY PC OPTIMIZER\UNINS000.DAT, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\engine.dll, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\EpcoUninstaller.exe, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\EPIC.exe, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\Homepage.url, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\IgnoreList.dat, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\license.txt, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\Res_English.xml, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\Res_French.xml, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\Res_Spanish.xml, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\Support.url, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\unins000.exe, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\Program Files (x86)\Easy PC Optimizer\unins000.msg, Delete-on-Reboot, [8968], [442097],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\USERS\{username}\APPDATA\ROAMING\MICROSOFT\INTERNET EXPLORER\QUICK LAUNCH\EASY PC OPTIMIZER.LNK, Delete-on-Reboot, [8968], [442101],1.0.3029
PUP.Optional.RegistryPowerCleaner, C:\WINDOWS\SYSTEM32\TASKS\Easy PC Optimizer Scheduled Scan - {username}, Delete-on-Reboot, [8966], [442105],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\WINDOWS\SYSTEM32\TASKS\EASY PC OPTIMIZER - RUN WITHOUT UAC, Delete-on-Reboot, [8968], [442113],1.0.3029
PUP.Optional.RegistryPowerCleaner, C:\WINDOWS\TASKS\Easy PC Optimizer Scheduled Scan - {username}.job, Delete-on-Reboot, [8966], [442104],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\USERS\{username}\APPDATA\ROAMING\EASY PC OPTIMIZER\EPCO.LOG, Delete-on-Reboot, [8968], [442100],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\USERS\{username}\DESKTOP\EASY PC OPTIMIZER.LNK, Delete-on-Reboot, [8968], [442102],1.0.3029
PUP.Optional.EasyPCOptimizer, C:\USERS\{username}\DESKTOP\EASYPCOPTIMIZERSETUP.EXE, Delete-on-Reboot, [8968], [442117],1.0.3029

Physical Sector: 0
(No malicious items detected)



Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)


Source : Removal instructions for Easy PC Optimizer de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/212852-removal-instructions-for-easy-pc-optimizer/)



Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/  en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/