Security-X

Forum Security-X => Sécurité Générale => Malwares => Discussion démarrée par: chantal11 le juillet 20, 2017, 14:47:32

Titre: 115118.net
Posté par: chantal11 le juillet 20, 2017, 14:47:32
Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)

115118.net est un Browser Hijacker (pirate de navigateur) qui modifie les paramètres du navigateur (page d’accueil , page de recherche, ....) afin de forcer la consultation du site ciblé et affiche aussi des publicités.


(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/115118net/warning1.png&key=b16d783d1ae0a7622a7ac8b74fd54fdd8e171b81a51fbefd5faa995b76ad16de)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/115118net/warning3.png&key=f71fa71437be198ed59950d524fd850558de9b58c6db3e5c1116644a0482eda3)


(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/115118net/warning2.png&key=6af8e0da2b14f769ebc44dd4c9c2e7db65c6f2a33503a18c9c87247c017741a9)









**********

Détection de 115118.net dans des rapports FRST :

Citer
HKLM-x32\...\Run: [????{] => C:\Program Files (x86)\home\gho.exe [347728 2014-07-17] ()
HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.115118.net/?772js407
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.115118.net/?772js407
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.115118.net/?772js407
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.115118.net/?772js407
SearchScopes: HKCU -> DefaultScope {EB7D113C-C3B0-B5E3-3626-035F87FFDF45} URL = hxxp://www.uc880.com/ie.htm?wd={searchTerms}&ie=utf-8
SearchScopes: HKCU -> Baidu URL = hxxp://www.uc880.com/ie.htm?wd={searchTerms}&ie=utf-8
SearchScopes: HKCU -> Google URL = hxxp://www.uc880.com/ie.htm?wd={searchTerms}&ie=utf-8
SearchScopes: HKCU -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.uc880.com/ie.htm?wd={searchTerms}&ie=utf-8
SearchScopes: HKCU -> {3887B59A-D1F6-4135-8247-48E1EC2C2EDD} URL = hxxp://www.uc880.com/ie.htm?wd={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&ie=utf-8
SearchScopes: HKCU -> {EB7D113C-C3B0-B5E3-3626-035F87FFDF45} URL = hxxp://www.uc880.com/ie.htm?wd={searchTerms}&ie=utf-8
SearchScopes: HKCU -> {F5EA8C0E-C6B5-4D60-8AFD-243026ABC33F} URL = hxxp://www.uc880.com/ie.htm?wd={searchTerms}&ie=utf-8
C:\Program Files (x86)\home



**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)


Citer
-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 9
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\Baidu, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\Google, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{3887B59A-D1F6-4135-8247-48E1EC2C2EDD}, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{EB7D113C-C3B0-B5E3-3626-035F87FFDF45}, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{F5EA8C0E-C6B5-4D60-8AFD-243026ABC33F}, Delete-on-Reboot, [115], [258339],1.0.2349

Registry Value: 9
PUP.Optional.StartPage, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|??????, Delete-on-Reboot, [60], [415594],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\Baidu|URL, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\Google|URL, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|URL, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}|SUGGESTIONSURLFALLBACK, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{3887B59A-D1F6-4135-8247-48E1EC2C2EDD}|URL, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{EB7D113C-C3B0-B5E3-3626-035F87FFDF45}|URL, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.ChinAd, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{F5EA8C0E-C6B5-4D60-8AFD-243026ABC33F}|URL, Delete-on-Reboot, [115], [258339],1.0.2349
PUP.Optional.StartPage, HKCU\SOFTWARE\POLICIES\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Delete-on-Reboot, [60], [415595],1.0.2349

Registry Data: 4
Hijack.StartPage.Gen, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Replace-on-Reboot, [16643], [292512],1.0.2349
Hijack.StartPage.Gen, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|DEFAULT_PAGE_URL, Replace-on-Reboot, [16643], [292512],1.0.2349
Hijack.StartPage.Gen, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|DEFAULT_PAGE_URL, Replace-on-Reboot, [16643], [292511],1.0.2349
Hijack.StartPage.Gen, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Replace-on-Reboot, [16643], [292511],1.0.2349

Data Stream: 0
(No malicious items detected)

Folder: 1
PUP.Optional.StartPage, C:\PROGRAM FILES (X86)\HOME, Delete-on-Reboot, [60], [415594],1.0.2349

File: 15
PUP.Optional.StartPage.Generic, C:\USERS\{username}\APPDATA\ROAMING\MICROSOFT\INTERNET EXPLORER\QUICK LAUNCH\????.URL, Delete-on-Reboot, [625], [415584],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\330LA?????.URL, Delete-on-Reboot, [625], [415587],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\XTXZ????????.URL, Delete-on-Reboot, [625], [415592],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\UC880???? ????.URL, Delete-on-Reboot, [625], [415589],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\???-?!???.URL, Delete-on-Reboot, [625], [415589],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\U?????.URL, Delete-on-Reboot, [625], [415590],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\????-????.URL, Delete-on-Reboot, [625], [415589],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\52XP WIN7????.URL, Delete-on-Reboot, [625], [415586],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\????-????.URL, Delete-on-Reboot, [625], [415589],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\115118.NET??????.URL, Delete-on-Reboot, [625], [415585],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\WIN860???? ???.URL, Delete-on-Reboot, [625], [415591],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\????????.URL, Delete-on-Reboot, [625], [415593],1.0.2349
PUP.Optional.StartPage, C:\PROGRAM FILES (X86)\HOME\GHO.EXE, Delete-on-Reboot, [60], [415594],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\26176???.URL, Delete-on-Reboot, [625], [415588],1.0.2349
PUP.Optional.StartPage.Generic, C:\USERS\{username}\FAVORITES\WIN8??????.URL, Delete-on-Reboot, [625], [415591],1.0.2349

Physical Sector: 0
(No malicious items detected)


Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)


Source : Removal instructions for 115118.net de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/204224-removal-instructions-for-115118net/)


Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/  en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/