OtherSearch

[chantal11]

Contenu republié avec la permission de Malwarebytes

OtherSearch est un adware (logiciel publicitaire), qui affiche des publicités intempestives indépendantes des sites visités.
OtherSearch détourne aussi le moteur de recherche.

•   S'installe en tant que programme, soit à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime, soit depuis le site de l'éditeur

• Crée ces tâches planifiées

**********

Détection de OtherSearch dans des rapports FRST :

OtherSearch (HKLM-x32\...\OtherSearch) (Version: 4.0.0.0 - Skyler Emil)
Task: {2CC813CA-E270-4015-8298-46C7716D1350} - System32\Tasks\NBMXXYeVN7 => C:\Program Files (x86)\M4zQG0dx1S\updengine.exe [2017-05-31] ()

R2 OtherSearch; C:\Program Files (x86)\M4zQG0dx1S\kl.dll [669696 2017-05-30] () [File not signed]
R1 Lace514; C:\Windows\System32\drivers\Lace_wpf_x64.sys [69400 2017-05-05] (Lace514)
C:\Windows\System32\Tasks\NBMXXYeVN7
C:\END
C:\Program Files (x86)\M4zQG0dx1S
(Lace514) C:\Windows\system32\Drivers\Lace_wpf_x64.sys

**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable) et Adware (programme publicitaire)

Adware.OtherSearch
Adware.OtherSearch.TSKRST
PUP.Optional.OtherSearch
Rootkit.Komodia.PUA

-Scan Details-
Process: 0
(No malicious items detected)

Module: 1
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\kl.dll, Quarantined, [2808], [371199],1.0.2057

Registry Key: 4
Adware.OtherSearch, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\OtherSearch, Delete-on-Reboot, [2156], [384381],1.0.2057
Adware.OtherSearch.TSKRST, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\OtherSearch, Delete-on-Reboot, [2808], [371199],1.0.2057
Rootkit.Komodia.PUA, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Lace514, Delete-on-Reboot, [1776], [365194],1.0.2057
PUP.Optional.OtherSearch, HKLM\SOFTWARE\WOW6432NODE\OTHERSEARCH, Delete-on-Reboot, [570], [305744],1.0.2057

Registry Value: 1
PUP.Optional.OtherSearch, HKLM\SOFTWARE\WOW6432NODE\OTHERSEARCH|AFFID, Delete-on-Reboot, [570], [305744],1.0.2057

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\SSL, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\PROGRAM FILES (X86)\M4zQG0dx1S, Delete-on-Reboot, [2808], [371199],1.0.2057

File: 20
Adware.OtherSearch, C:\PROGRAM FILES (X86)\M4ZQG0DX1S\UNINSTALL.EXE, Delete-on-Reboot, [2156], [384381],1.0.2057
Adware.OtherSearch.TSKRST, C:\PROGRAM FILES (X86)\M4zQG0dx1S\SSL\OtherSearch Inc CA 2.cer, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\certutil.exe, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\mozcrt19.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\nspr4.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\nss3.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\plc4.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\plds4.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\smime3.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\nss\softokn3.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\SSL\cert.db, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\data.dt, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\dlog.txt, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\kl.dll, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\kl.ecf, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\s.xml, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\slite.exe, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\Program Files (x86)\M4zQG0dx1S\updengine.exe, Delete-on-Reboot, [2808], [371199],1.0.2057
Adware.OtherSearch.TSKRST, C:\WINDOWS\SYSTEM32\TASKS\NBMXXYeVN7, Delete-on-Reboot, [2808], [-1],0.0.0
Rootkit.Komodia.PUA, C:\WINDOWS\SYSTEM32\DRIVERS\LACE_WPF_X64.SYS, Delete-on-Reboot, [1776], [365194],1.0.2057

Physical Sector: 0
(No malicious items detected)

Tutoriel d'utilisation Malwarebytes en images


Source : Removal instructions for OtherSearch de Metallica - Malwarebytes Forums

Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/  en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/