Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)
BuzzDock est un Browser Hijacker (pirate de navigateur) qui modifie les paramètres du navigateur (page d’accueil , page de recherche, ....) afin de forcer la consultation du site ciblé et affiche aussi des publicités.
BuzzDock appartient à la famille Yontoo
- S'installe en tant que programme, à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime
(https://forums.malwarebytes.org/applications/core/interface/imageproxy/imageproxy.php?img=https%3A%2F%2Fstatic-cdn.malwarebytes.org%2Fpub_images%2FBuzzDock%2Fwarning4.png&key=f01a5550d99c5021df21bd67ecfc2bbc3efad61233b9bf7d828af6442d1ad61a)
- BuzzDock affiche ces alertes pendant l'installation
(https://forums.malwarebytes.org/applications/core/interface/imageproxy/imageproxy.php?img=https%3A%2F%2Fstatic-cdn.malwarebytes.org%2Fpub_images%2FBuzzDock%2Fmain.png&key=37967a70cb266d75bf8745f1f2435be4d30a1a266cb3b88ab879c941b1393f87)
(https://forums.malwarebytes.org/applications/core/interface/imageproxy/imageproxy.php?img=https%3A%2F%2Fstatic-cdn.malwarebytes.org%2Fpub_images%2FBuzzDock%2Fwarning5.png&key=e501f305bd25fb716b3024f5ee6a889d8c85e22544ee340bbc3c69e4364bf4d5)
(https://forums.malwarebytes.org/applications/core/interface/imageproxy/imageproxy.php?img=https%3A%2F%2Fstatic-cdn.malwarebytes.org%2Fpub_images%2FBuzzDock%2Fwarning6.png&key=02db06d999cc570228d199fc41925ac59512018f141b5b5347bc632fcda1fed0)
- S'installe en tant qu'extension/add-on du navigateur
(https://forums.malwarebytes.org/applications/core/interface/imageproxy/imageproxy.php?img=https%3A%2F%2Fstatic-cdn.malwarebytes.org%2Fpub_images%2FBuzzDock%2Fwarning1.png&key=89aa38d2ace0d6dcf08eaf4dcf055d533182c9fbd583bb2c99c7a412690268ad)
(https://forums.malwarebytes.org/applications/core/interface/imageproxy/imageproxy.php?img=https%3A%2F%2Fstatic-cdn.malwarebytes.org%2Fpub_images%2FBuzzDock%2Fwarning2.png&key=3714867393c37239b8b3197cce1ef38999dfe87200d22622ecf27233eb384478)
**********
Détection de BuzzDock dans des rapports FRST :
Buzzdock (HKLM\...\Buzzdock) (Version: 2015.12.05.013022 - Alactro)
() C:\Program Files (x86)\Buzzdock\bin\utilBuzzdock.exe
() C:\Program Files (x86)\Buzzdock\bin\Buzzdock.Plinx.exe
() C:\Program Files (x86)\Buzzdock\updateBuzzdock.exe
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.yahoo.com/?fr=hp-ddc-bd&type=bz__alt__ddc_dsssyc_bd_com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.yahoo.com/?fr=hp-ddc-bd&type=bz__alt__ddc_dsssyc_bd_com
SearchScopes: HKLM-x32 -> {BC45C12F-EFCA-43FD-8F62-02BBBF261E64} URL = hxxps://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=bz__alt__ddc_dss_bd_com&q={searchTerms}
SearchScopes: HKCU -> DefaultScope {BC45C12F-EFCA-43FD-8F62-02BBBF261E64} URL = hxxps://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=bz__alt__ddc_dss_bd_com&q={searchTerms}
SearchScopes: HKCU -> {BC45C12F-EFCA-43FD-8F62-02BBBF261E64} URL = hxxps://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=bz__alt__ddc_dss_bd_com&q={searchTerms}
BHO-x32: Buzzdock 2.0.0.0 -> {8bb0cdcd-99ce-4a14-9c67-c2849d5f8a60} -> C:\Program Files (x86)\Buzzdock\Buzzdockbho.dll [AAAA-MM-JJ] (Alactro)
FF Homepage: hxxps://search.yahoo.com/?fr=hp-ddc-bd&type=bz__alt__ddc_dsssyc_bd_com
FF NewTab: hxxps://search.yahoo.com/?fr=hp-ddc-bd&type=bz__alt__ddc_dsssyc_bd_com
FF Keyword.URL: hxxps://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=bz__alt__ddc_dss_bd_com&q=
FF SelectedSearchEngine: Yahoo! Search
FF DefaultSearchEngine: Yahoo! Search
FF SearchPlugin: C:\Users\NomàUtilisateur\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\searchplugins\dsrlte.xml [AAAA-MM-JJ]
FF Extension: Buzzdock - C:\Users\NomàUtilisateur\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\Extensions\{f9ad6521-f00e-4e64-bef5-840dd8fe6cbb}.xpi [AAAA-MM-JJ] [not signed]
CHR RestoreOnStartup: Default -> "hxxps://search.yahoo.com/?fr=hp-ddc-bd&type=bz__alt__ddc_dsssyc_bd_com"
CHR StartupUrls: Default -> "hxxps://search.yahoo.com/?fr=hp-ddc-bd&type=bz__alt__ddc_dsssyc_bd_com"
CHR DefaultSearchURL: Default -> hxxps://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=bz__alt__ddc_dss_bd_com&q={searchTerms}
CHR DefaultSearchKeyword: Default -> yahoo.com
CHR DefaultNewTabURL: Default -> hxxps://search.yahoo.com/?fr=hp-ddc-bd&type=bz__alt__ddc_dsssyc_bd_com
R2 Update Buzzdock; C:\Program Files (x86)\Buzzdock\updateBuzzdock.exe [658208 AAAA-MM-JJ] ()
R2 Util Buzzdock; C:\Program Files (x86)\Buzzdock\bin\utilBuzzdock.exe [658208 AAAA-MM-JJ] ()
C:\Program Files (x86)\Buzzdock
C:\ProgramData\Tarma Installer
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Buzzdock
C:\Users\NomàUtilisateur\AppData\Local\Temp\c0dc3950-5808-4a79-9f77-7d33428114dc.dll
**********
Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)
PUP.Optional.BuzzDock
PUP.Optional.Yontoo
PUP.Optional.BrowseFox
PUP.Optional.BDYahoo
Tutoriel d'utilisation Malwarebytes en images (http://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-version-2/)
Source : Removal instructions for BuzzDock de Metallica - Malwarebytes Forums (https://forums.malwarebytes.org/topic/181272-removal-instructions-for-buzzdock/)
Toujours infecté ? Une question avant de faire des manipulations ?
Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/ en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/