Imprimer la page - OnlineWorkSuite

Forum Security-X => Sécurité Générale => Malwares => Discussion démarrée par: chantal11 le juillet 07, 2017, 15:16:46

Titre: OnlineWorkSuite
Posté par: chantal11 le juillet 07, 2017, 15:16:46

Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)

OnlineWorkSuite est un Browser Hijacker NewTab (https://blog.malwarebytes.com/glossary/NewTab/) (pirate de navigateur nouvel onglet) qui modifie les paramètres du navigateur (page d’accueil , page de recherche, nouvel onglet ....) afin de forcer la consultation du site ciblé et affiche aussi des publicités.
OnlineWorkSuite est une barre d’outils de Mindspark/Ask toolbar (https://blog.malwarebytes.org/malvertising-2/2014/11/mindspark-toolbars/) maintenant connu comme des Applications IAC.

S'installe en tant que programme, soit à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime, soit depuis le site de l'éditeur

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/OnlineWorkSuite/warning4.png&key=8d83d056a66a3b96b58af483af4c0234902edd5bd6703ba7f62c3660d5ce3f82)

Affiche ces alertes pendant l'installation

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/OnlineWorkSuite/warning5.png&key=4417c020586edfda7d03eb5216008b3ea2a441329f7ddbe2a44abfbf303fb5ca)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/OnlineWorkSuite/warning6.png&key=7a618dc2a18b104a4e1587000a5b9176ae684230ffc7f24fda2b531130355ced)

S'installe en tant qu'extension/add-on du navigateur

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/OnlineWorkSuite/warning1.png&key=9d0f0c02ab70dff05c9080725b151931d7d5aa95b1c2aeae7a3aff817a8860d4)

Affiche cette nouvelle page de démarrage dans les navigateurs infectés

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/OnlineWorkSuite/startpage.png&key=2df66d77a14826768a69fe63090eabc049a75ac2cde4bfe64651fc9aea7c774c)

**********

Détection de OnlineWorkSuite dans des rapports FRST :

Citer

OnlineWorkSuite Internet Explorer Homepage and New Tab (HKCU\...\OnlineWorkSuiteTooltab Uninstall Internet Explorer) (Version: - Mindspark Interactive Network, Inc.) <==== ATTENTION

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp.myway.com/onlineworksuite/ttab02/index.html?n={n1}&p2={p21}&ptb={ptb1}&coid={coid1}
FF Homepage: hxxp://hp.myway.com/onlineworksuite/ttab02/index.html?coId={coid2}&subId&ln=en&n={n2}&ptb={ptb2}&st=tab&p2={p22}&si
FF Extension: OnlineWorkSuite - C:\Users\{Nom_Utilisateur}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\Extensions\_j1Members_@free.onlineworksuite.com [2017-07-06]
C:\Users\{Nom_Utilisateur}\AppData\Local\OnlineWorkSuiteTooltab

**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)
Sous la version Premium, Malwarebytes bloque le domaine hp.myway.com et l'IP 2.19.63.115

Citer

PUP.Optional.MindSpark
PUP.Optional.MindSpark.Generic

Citer

-Scan Details-
Process: 0
(No malicious items detected)

Module: 1
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\ONLINEWORKSUITETOOLTAB\TOOLTABEXTENSION.DLL, Quarantined, [283], [301125],1.0.2300

Registry Key: 1
PUP.Optional.MindSpark, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\OnlineWorkSuiteTooltab Uninstall Internet Explorer, Delete-on-Reboot, [283], [301125],1.0.2300

Registry Value: 1
PUP.Optional.MindSpark, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\OnlineWorkSuiteTooltab Uninstall Internet Explorer|PUBLISHER, Delete-on-Reboot, [283], [352442],1.0.2300

Registry Data: 1
PUP.Optional.MindSpark, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Replace-on-Reboot, [283], [293497],1.0.2300

Data Stream: 0
(No malicious items detected)

Folder: 4
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\LOCAL\OnlineWorkSuiteTooltab, Delete-on-Reboot, [866], [356944],1.0.2300
PUP.Optional.MindSpark.Generic, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\_j1Members_@free.onlineworksuite.com\META-INF, Delete-on-Reboot, [866], [371671],1.0.2300
PUP.Optional.MindSpark.Generic, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\_j1Members_@free.onlineworksuite.com\chrome, Delete-on-Reboot, [866], [371671],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\EXTENSIONS\_J1MEMBERS_@FREE.ONLINEWORKSUITE.COM, Delete-on-Reboot, [866], [371671],1.0.2300

File: 55
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\ONLINEWORKSUITETOOLTAB\TOOLTABEXTENSION.DLL, Delete-on-Reboot, [283], [301125],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [319354],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\PREFS.JS, Replaced, [866], [356946],1.0.2300
PUP.Optional.MindSpark, C:\USERS\{username}\DESKTOP\ONLINEWORKSUITE.{coid1}.EXE, Delete-on-Reboot, [283], [365288],1.0.2300
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_onlineworksuite.dl.tb.ask.com_0.localstorage, Delete-on-Reboot, [283], [240306],1.0.2300
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_onlineworksuite.dl.tb.ask.com_0.localstorage-journal, Delete-on-Reboot, [283], [240306],1.0.2300
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\{profile}.default\EXTENSIONS\_J1MEMBERS_@FREE.ONLINEWORKSUITE.COM\BOOTSTRAP.JS, Delete-on-Reboot, [866], [371671],1.0.2300
PUP.Optional.MindSpark.Generic, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\_j1Members_@free.onlineworksuite.com\chrome\ffxtbr.jar, Delete-on-Reboot, [866], [371671],1.0.2300
PUP.Optional.MindSpark.Generic, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\_j1Members_@free.onlineworksuite.com\META-INF\manifest.mf, Delete-on-Reboot, [866], [371671],1.0.2300
PUP.Optional.MindSpark.Generic, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\_j1Members_@free.onlineworksuite.com\META-INF\mozilla.rsa, Delete-on-Reboot, [866], [371671],1.0.2300
PUP.Optional.MindSpark.Generic, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\_j1Members_@free.onlineworksuite.com\META-INF\mozilla.sf, Delete-on-Reboot, [866], [371671],1.0.2300
PUP.Optional.MindSpark.Generic, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\_j1Members_@free.onlineworksuite.com\chrome.manifest, Delete-on-Reboot, [866], [371671],1.0.2300
PUP.Optional.MindSpark.Generic, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\_j1Members_@free.onlineworksuite.com\chrome.manifest.restartless, Delete-on-Reboot, [866], [371671],1.0.2300
PUP.Optional.MindSpark.Generic, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\{profile}.default\extensions\_j1Members_@free.onlineworksuite.com\install.rdf, Delete-on-Reboot, [866], [371671],1.0.2300
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_onlineworksuite.dl.myway.com_0.localstorage, Delete-on-Reboot, [283], [240305],1.0.2300
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_onlineworksuite.dl.myway.com_0.localstorage-journal, Delete-on-Reboot, [283], [240305],1.0.2300

Physical Sector: 0
(No malicious items detected)

Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)

Source : Removal instructions for OnlineWorkSuite de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/203865-removal-instructions-for-onlineworksuite/)

Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/ en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/