Imprimer la page - MergeDocsOnline

Forum Security-X => Sécurité Générale => Malwares => Discussion démarrée par: chantal11 le juillet 20, 2017, 15:32:58

Titre: MergeDocsOnline
Posté par: chantal11 le juillet 20, 2017, 15:32:58

Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)

MergeDocsOnline est un Browser Hijacker NewTab (https://blog.malwarebytes.com/glossary/NewTab/) (pirate de navigateur nouvel onglet) qui modifie les paramètres du navigateur (page d’accueil , page de recherche, nouvel onglet ....) afin de forcer la consultation du site ciblé et affiche aussi des publicités.
MergeDocsOnline appartient à la famille Mindspark/Ask (https://blog.malwarebytes.org/malvertising-2/2014/11/mindspark-toolbars/) maintenant connu comme des Applications IAC.

S'installe en tant que programme, soit à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime, soit depuis le site de l'éditeur

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MergeDocsOnline/warning4.png&key=9a99ce543524491fc5f75fb67b337743bf860e8af4400942bce5cfbfe6cb9428)

Affiche ces alertes pendant l'installation

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MergeDocsOnline/warning5.png&key=8b560f4c996cedc5807070bc92194d0dfcf6bf99c40659244a504406e7bc0f5f)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MergeDocsOnline/warning6.png&key=0b9b6f85b309e899330dea0ae8b0c92aae13a803ebfc72b09ec741c4cbbcf9f7)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MergeDocsOnline/warning7.png&key=57f0e4787ef72e0a3ff2b0630f4c4b36b39067c051c442a70db3b0f0a1937628)

S'installe en tant qu'extension/add-on du navigateur

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MergeDocsOnline/warning1.png&key=f13e94ec08f022f65892b351ccc2e545a6f1512ad94c422769d44572f0c48f15)

Affiche cette nouvelle page de démarrage dans les navigateurs infectés

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MergeDocsOnline/startpage.png&key=95b3a8507d6d5b3f36fc96f58ef339439ae9901195203a31a08f69827f283891)

**********

Détection de MergeDocsOnline dans des rapports FRST :

Citer

MergeDocsOnline Internet Explorer Homepage and New Tab (HKCU\...\MergeDocsOnlineTooltab Uninstall Internet Explorer) (Version: - Mindspark Interactive Network, Inc.) <==== ATTENTION

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp.myway.com/mergedocsonline/ttab02/index.html?n={n1}&p2={p21}&ptb={ptb1}&coid={coid1}
FF Homepage: hxxp://hp.myway.com/mergedocsonline/ttab02/index.html?coId={coid2}&subId&ln=en&n={n2}&ptb={ptb2}&st&p2={p21}&si
FF Extension: MergeDocsOnline - C:\Users\{Nom_Utilisateur}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\Extensions\_ewMembers_@free.mergedocsonline.com [2017-07-17]

**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)
Sous la version Premium, Malwarebytes bloque le domaine hp.myway.com et l'IP 2.19.63.115

Citer

PUP.Optional.MindSpark
PUP.Optional.MindSpark.Generic

Citer

-Scan Details-
Process: 0
(No malicious items detected)

Module: 1
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\MERGEDOCSONLINETOOLTAB\TOOLTABEXTENSION.DLL, Quarantined, [284], [301125],1.0.2382

Registry Key: 1
PUP.Optional.MindSpark, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MergeDocsOnlineTooltab Uninstall Internet Explorer, Delete-on-Reboot, [284], [301125],1.0.2382

Registry Value: 1
PUP.Optional.MindSpark, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MergeDocsOnlineTooltab Uninstall Internet Explorer|PUBLISHER, Delete-on-Reboot, [284], [352442],1.0.2382

Registry Data: 1
PUP.Optional.MindSpark, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Replace-on-Reboot, [284], [293497],1.0.2382

Data Stream: 0
(No malicious items detected)

Folder: 5
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\MergeDocsOnline_ew, Delete-on-Reboot, [284], [240302],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\META-INF, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\chrome, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\EXTENSIONS\_EWMEMBERS_@FREE.MERGEDOCSONLINE.COM, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\LOCAL\MergeDocsOnlineTooltab, Delete-on-Reboot, [875], [356944],1.0.2382

File: 56
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\MERGEDOCSONLINETOOLTAB\TOOLTABEXTENSION.DLL, Delete-on-Reboot, [284], [301125],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [356946],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\DESKTOP\MERGEDOCSONLINE.070779E1ADB149AC8EE0A526D5423376.EXE, Delete-on-Reboot, [284], [365288],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\MergeDocsOnline_ew\{ptb2}.sqlite, Delete-on-Reboot, [284], [240302],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_mergedocsonline.dl.myway.com_0.localstorage, Delete-on-Reboot, [284], [240305],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_mergedocsonline.dl.myway.com_0.localstorage-journal, Delete-on-Reboot, [284], [240305],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\EXTENSIONS\_EWMEMBERS_@FREE.MERGEDOCSONLINE.COM\INSTALL.RDF, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\chrome\ffxtbr.jar, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\META-INF\manifest.mf, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\META-INF\mozilla.rsa, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\META-INF\mozilla.sf, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\bootstrap.js, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\chrome.manifest, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\chrome.manifest.restartless, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_mergedocsonline.dl.tb.ask.com_0.localstorage, Delete-on-Reboot, [284], [240306],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_mergedocsonline.dl.tb.ask.com_0.localstorage-journal, Delete-on-Reboot, [284], [240306],1.0.2382

Physical Sector: 0
(No malicious items detected)

Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)

Source : Removal instructions for MergeDocsOnline de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/204669-removal-instructions-for-mergedocsonline/)

Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/ en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/