Security-X

Forum Security-X => Sécurité Générale => Malwares => Discussion démarrée par: chantal11 le juillet 20, 2017, 11:56:15

Titre: SearchManager
Posté par: chantal11 le juillet 20, 2017, 11:56:15

Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)

SearchManager est un Browser Hijacker (pirate de navigateur) qui modifie les paramètres du navigateur (page d’accueil , page de recherche, ....) afin de forcer la consultation du site ciblé et affiche aussi des publicités.

• Affiche ces alertes pendant l'installation

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/SearchManager/warning2.png&key=fb5b98c4f4c9274da762012380ecf066a9f3daa058301aa5dc5372ed24be24e0)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/SearchManager/warning5.png&key=347c8963ff4dc57aa896f321bd674f0e2ecf2a29c926854071007e8bb375ac10)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/SearchManager/warning6.png&key=c1284f88dc517aa8f8c7ac1c1d23b4ec570d8197e6df9559de2ca4ec8851973e)

• S'installe en tant qu'extension/add-on du navigateur Chrome

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/SearchManager/warning3.png&key=80af269cb78015b2b95b66e9f2fec09560f4ebc6e2e7f508792393fdda7bf761)

• Affiche cette page de démarrage dans le navigateur

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/SearchManager/startpage.png&key=7595655d1d5c0aa1c054851b5ab3d2f6c40d3383a7e69de5c869926ddc59b946)

• Paramètre un nouveau moteur de recherche par défaut

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/SearchManager/warning7.png&key=5c1994af2de0afe6dfa28579df05fdc92e3dc3c5803236f8fc0f9c7c273d155b)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/SearchManager/warning8.png&key=5a58597563e29553b6165b568bf32e8553297f903d2add543ac1cf4329e3d479)

**********

Détection de SearchManager dans des rapports FRST :

Citer

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://{cc}.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=bgy_fs_17_27&param1=1&param2={p2}{cc}os_ver%3D6.1%26os%3DWindows%2B7%2BUltimate
SearchScopes: HKCU -> DefaultScope {518b33ae-375d-712d-6742-d1fe0400268d} URL = hxxps://{cc}.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=bgy_fs_17_27&param1=1&param2={p3}{cc}os%3DWindows%2B7%2BUltimate&p={searchTerms}
SearchScopes: HKCU -> {518b33ae-375d-712d-6742-d1fe0400268d} URL = hxxps://{cc}.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=bgy_fs_17_27&param1=1&param2={p3}{cc}os%3DWindows%2B7%2BUltimate&p={searchTerms}
FF NewTab: about:newtab
FF DefaultSearchEngine: Yahoo! Powered Search
FF SelectedSearchEngine: Yahoo! Powered Search
FF Homepage: hxxps://{cc}.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=bgy_fs_17_27&param1=1&param2=f%3D1%26b%3DFirefox%26cc%3D{cc}os%3DWindows%2B7%2BUltimate
FF Keyword.URL: user_pref("keyword.URL", true);
FF SearchPlugin: C:\Users\{Nom_Utilisateur}\AppData\Roaming\Mozilla\Firefox\Profiles\x82gpani.default-1491393116824\searchplugins\yahoo! powered search.xml [2017-07-05]
CHR DefaultSearchURL: Default -> hxxp://srch.bar/{searchTerms}
CHR DefaultSearchKeyword: Default -> sm
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
CHR Extension: (Search Manager) - C:\Users\{Nom_Utilisateur}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej [2017-07-05]
CHR HKLM\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKCU\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx

**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)

Citer

PUP.Optional.SearchManager
PUP.Optional.ProductSetup
PUP.Optional.InstallCore

Citer

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 5
PUP.Optional.InstallCore, HKCU\SOFTWARE\csastats, Delete-on-Reboot, [3], [260986],1.0.2294
PUP.Optional.ProductSetup, HKCU\SOFTWARE\PRODUCTSETUP, Delete-on-Reboot, [15069], [242047],1.0.2294
PUP.Optional.SearchManager, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\pilplloabdedfmialnfchjomjmpjcoej, Delete-on-Reboot, [542], [260991],1.0.2294
PUP.Optional.SearchManager, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\pilplloabdedfmialnfchjomjmpjcoej, Delete-on-Reboot, [542], [260991],1.0.2294
PUP.Optional.SearchManager, HKCU\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\pilplloabdedfmialnfchjomjmpjcoej, Delete-on-Reboot, [542], [183362],1.0.2294

Registry Value: 1
PUP.Optional.ProductSetup, HKCU\SOFTWARE\PRODUCTSETUP|TB, Delete-on-Reboot, [15069], [242047],1.0.2294

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 11
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\icons, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\fonts, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\skin\icons, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\_metadata, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\vendor, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\skin, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\EXTENSIONS\pilplloabdedfmialnfchjomjmpjcoej, Delete-on-Reboot, [542], [331417],1.0.2294

File: 84
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\fonts\HelveticaNeue-Thin.otf, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\fonts\HelveticaNeueLT-Roman.woff, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\fonts\neue-bold.woff, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\fonts\neue.woff, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\icons\128.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\icons\16.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\icons\48.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\icons\close.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\icons\favicon.ico, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\icons\trends.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\01d.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\01n.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\02d.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\02n.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\03d.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\03n.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\04d.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\04n.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\09d.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\09n.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\10d.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\10n.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\11d.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\11n.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\13d.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\13n.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\50d.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\weather\50n.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\hero-bg.jpg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\bing.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\bing_large.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\bluesky-bg.jpg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\brush.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\bt.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\clock.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\cloud.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\cupcake-bg.jpg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\desk-bg.jpg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\doodle.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\down.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\eyeglass.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\google.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\google_large.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\just-the-box-empty.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\just-the-box.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\mountain-bg.jpg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\pointer2.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\radio-selected.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\radio-unselected.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\sea-bg.jpg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\settings.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\star-unselected.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\star.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\toggle-off.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\toggle-on.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\transparent_img.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\yahoo.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\yahoo.svg, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\images\yahoo_large.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\content\bundle.v0.0.1.min.css, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\skin\icons\16.png, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\vendor\md5.min.js, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\vendor\react-dom.min.js, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\vendor\react-with-addons.min.js, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\vendor\underscore-min.js, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\_metadata\computed_hashes.json, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\_metadata\verified_contents.json, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\2bfc185be71f44cd73ac81511fc1f5a5.woff, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\b495e340f4ef8924fea0284c1bf9e7ac.woff, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\background.html, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\background.v0.0.1.min.js, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\c5a5cbf4dbcaa7064f2bc77f52101aec.otf, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\client.v0.0.1.min.js, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\common.js, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\e5d3501d500d07b0a1e952b0f8a81d78.woff, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\e_.json, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\index.html, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\manifest.json, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\popupTab2.html, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\popupTab2.js, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.SearchManager, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pilplloabdedfmialnfchjomjmpjcoej\10.1.1.52_0\responseConfig.json, Delete-on-Reboot, [542], [331417],1.0.2294
PUP.Optional.FusionCore, C:\USERS\{username}\DESKTOP\ADVANCEDOCRFREE.EXE, Delete-on-Reboot, [982], [413201],1.0.2294
PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\chrome-extension_pilplloabdedfmialnfchjomjmpjcoej_0.localstorage, Delete-on-Reboot, [542], [260990],1.0.2294
PUP.Optional.SearchManager, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\chrome-extension_pilplloabdedfmialnfchjomjmpjcoej_0.localstorage-journal, Delete-on-Reboot, [542], [260990],1.0.2294

Physical Sector: 0
(No malicious items detected)

Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)


Source : Removal instructions for SearchManager de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/203768-removal-instructions-for-searchmanager/)

---

Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/  en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/