Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)
OtherSearch est un adware (logiciel publicitaire), qui affiche des publicités intempestives indépendantes des sites visités.
OtherSearch détourne aussi le moteur de recherche.
- S'installe en tant que programme, soit à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime, soit depuis le site de l'éditeur
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/OtherSearch5/warning4.png&key=54a7817782aa7dfa77934a1491b2b98a510f56c34fd1791549a8ff819a09cb32)
- Crée ces tâches planifiées
(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/OtherSearch5/warning3.png&key=347d7a89345f94aaa98ea63523cf693e545f3e5c32407b3003b1d81e65612de5)
**********
Détection de OtherSearch dans des rapports FRST :
OtherSearch (HKLM-x32\...\OtherSearch) (Version: 4.0.0.0 - Skyler Emil)
Task: {2CC813CA-E270-4015-8298-46C7716D1350} - System32\Tasks\NBMXXYeVN7 => C:\Program Files (x86)\M4zQG0dx1S\updengine.exe [2017-05-31] ()
R2 OtherSearch; C:\Program Files (x86)\M4zQG0dx1S\kl.dll [669696 2017-05-30] () [File not signed]
R1 Lace514; C:\Windows\System32\drivers\Lace_wpf_x64.sys [69400 2017-05-05] (Lace514)
C:\Windows\System32\Tasks\NBMXXYeVN7
C:\END
C:\Program Files (x86)\M4zQG0dx1S
(Lace514) C:\Windows\system32\Drivers\Lace_wpf_x64.sys
**********
Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable) et Adware (programme publicitaire)
Adware.OtherSearch
Adware.OtherSearch.TSKRST
PUP.Optional.OtherSearch
Rootkit.Komodia.PUA
-Scan Details-
Process: 0
(No malicious items detected)
Module: 1
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\kl.dll, Quarantined, [2808], [371199],1.0.2057
Registry Key: 4
Adware.OtherSearch, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\OtherSearch, Delete-on-Reboot, [2156], [384381],1.0.2057
Adware.OtherSearch.TSKRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\OtherSearch, Delete-on-Reboot, [2808], [371199],1.0.2057
Rootkit.Komodia.PUA, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Lace514, Delete-on-Reboot, [1776], [365194],1.0.2057
PUP.Optional.OtherSearch, HKLM\SOFTWARE\WOW6432NODE\OTHERSEARCH, Delete-on-Reboot, [570], [305744],1.0.2057
Registry Value: 1
PUP.Optional.OtherSearch, HKLM\SOFTWARE\WOW6432NODE\OTHERSEARCH|AFFID, Delete-on-Reboot, [570], [305744],1.0.2057
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 3
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\SSL, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\PROGRAM FILES (X86)\M4zQG0dx1S, Delete-on-Reboot, [2808], [371199],1.0.2057
File: 20
Adware.OtherSearch, C:\PROGRAM FILES (X86)\M4ZQG0DX1S\UNINSTALL.EXE, Delete-on-Reboot, [2156], [384381],1.0.2057
Adware.OtherSearch.TSKRST, C:\PROGRAM FILES (X86)\M4zQG0dx1S\SSL\OtherSearch Inc CA 2.cer, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\certutil.exe, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\mozcrt19.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\nspr4.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\nss3.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\plc4.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\plds4.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\smime3.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\softokn3.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\SSL\cert.db, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\data.dt, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\dlog.txt, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\kl.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\kl.ecf, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\s.xml, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\slite.exe, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\updengine.exe, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\WINDOWS\SYSTEM32\TASKS\NBMXXYeVN7, Delete-on-Reboot, [2808], [-1],0.0.0
Rootkit.Komodia.PUA, C:\WINDOWS\SYSTEM32\DRIVERS\LACE_WPF_X64.SYS, Delete-on-Reboot, [1776], [365194],1.0.2057
Physical Sector: 0
(No malicious items detected)
Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)
Source : Removal instructions for OtherSearch de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/201979-removal-instructions-for-othersearch/)
Toujours infecté ? Une question avant de faire des manipulations ?
Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/ en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/