« précédent suivant »
Pages: [1]   En bas

Auteur Sujet: MergeDocsOnline  (Lu 15488 fois)

0 Membres et 1 Invité sur ce sujet

Hors ligne chantal11

  • Admin Formation
  • Mega Power Members
  • ****
  • Messages: 25124
    • Windows 10 - Windows 8 - Windows 7 - Windows Vista
MergeDocsOnline
« le: juillet 20, 2017, 15:32:58 »
Contenu republié avec la permission de Malwarebytes

MergeDocsOnline est un Browser Hijacker NewTab (pirate de navigateur nouvel onglet) qui modifie les paramètres du navigateur (page d’accueil , page de recherche, nouvel onglet ....) afin de forcer la consultation du site ciblé et affiche aussi des publicités.
MergeDocsOnline appartient à la famille Mindspark/Ask maintenant connu comme des Applications IAC.

  • S'installe en tant que programme, soit à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime, soit depuis le site de l'éditeur

  • Affiche ces alertes pendant l'installation



  • S'installe en tant qu'extension/add-on du navigateur

  • Affiche cette nouvelle page de démarrage dans les navigateurs infectés









**********

Détection de MergeDocsOnline dans des rapports FRST :

Citer
MergeDocsOnline Internet Explorer Homepage and New Tab (HKCU\...\MergeDocsOnlineTooltab Uninstall Internet Explorer) (Version:  - Mindspark Interactive Network, Inc.) <==== ATTENTION

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://hp.myway.com/mergedocsonline/ttab02/index.html?n={n1}&p2={p21}&ptb={ptb1}&coid={coid1}
FF Homepage: hxxp://hp.myway.com/mergedocsonline/ttab02/index.html?coId={coid2}&subId&ln=en&n={n2}&ptb={ptb2}&st&p2={p21}&si
FF Extension: MergeDocsOnline - C:\Users\{Nom_Utilisateur}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\Extensions\_ewMembers_@free.mergedocsonline.com [2017-07-17]



**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)
Sous la version Premium, Malwarebytes bloque le domaine hp.myway.com et l'IP 2.19.63.115


Citer
PUP.Optional.MindSpark
PUP.Optional.MindSpark.Generic

Citer
-Scan Details-
Process: 0
(No malicious items detected)

Module: 1
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\MERGEDOCSONLINETOOLTAB\TOOLTABEXTENSION.DLL, Quarantined, [284], [301125],1.0.2382

Registry Key: 1
PUP.Optional.MindSpark, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MergeDocsOnlineTooltab Uninstall Internet Explorer, Delete-on-Reboot, [284], [301125],1.0.2382

Registry Value: 1
PUP.Optional.MindSpark, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MergeDocsOnlineTooltab Uninstall Internet Explorer|PUBLISHER, Delete-on-Reboot, [284], [352442],1.0.2382

Registry Data: 1
PUP.Optional.MindSpark, HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|START PAGE, Replace-on-Reboot, [284], [293497],1.0.2382

Data Stream: 0
(No malicious items detected)

Folder: 5
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\MergeDocsOnline_ew, Delete-on-Reboot, [284], [240302],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\META-INF, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\chrome, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\EXTENSIONS\_EWMEMBERS_@FREE.MERGEDOCSONLINE.COM, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\LOCAL\MergeDocsOnlineTooltab, Delete-on-Reboot, [875], [356944],1.0.2382

File: 56
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\MERGEDOCSONLINETOOLTAB\TOOLTABEXTENSION.DLL, Delete-on-Reboot, [284], [301125],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [319354],1.0.2382
PUP.Optional.MindSpark.Generic, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\PREFS.JS, Replaced, [875], [356946],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\DESKTOP\MERGEDOCSONLINE.070779E1ADB149AC8EE0A526D5423376.EXE, Delete-on-Reboot, [284], [365288],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\MergeDocsOnline_ew\{ptb2}.sqlite, Delete-on-Reboot, [284], [240302],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_mergedocsonline.dl.myway.com_0.localstorage, Delete-on-Reboot, [284], [240305],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_mergedocsonline.dl.myway.com_0.localstorage-journal, Delete-on-Reboot, [284], [240305],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\(profile).default\EXTENSIONS\_EWMEMBERS_@FREE.MERGEDOCSONLINE.COM\INSTALL.RDF, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\chrome\ffxtbr.jar, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\META-INF\manifest.mf, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\META-INF\mozilla.rsa, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\META-INF\mozilla.sf, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\bootstrap.js, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\chrome.manifest, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\Users\{username}\AppData\Roaming\Mozilla\Firefox\Profiles\(profile).default\extensions\_ewMembers_@free.mergedocsonline.com\chrome.manifest.restartless, Delete-on-Reboot, [284], [302304],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_mergedocsonline.dl.tb.ask.com_0.localstorage, Delete-on-Reboot, [284], [240306],1.0.2382
PUP.Optional.MindSpark, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\LOCAL STORAGE\http_mergedocsonline.dl.tb.ask.com_0.localstorage-journal, Delete-on-Reboot, [284], [240306],1.0.2382

Physical Sector: 0
(No malicious items detected)


Tutoriel d'utilisation Malwarebytes en images


Source : Removal instructions for MergeDocsOnline de Metallica - Malwarebytes Forums


Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/  en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/
IP archivée
 
Pages: [1]   En haut
« précédent suivant »
Tags: MergeDocsOnline hijacker navigateur NewTab 
 

Le site internet Security-x.fr utilise des cookies. Un cookie est un fichier texte stocké par votre navigateur, qui lui permet de conserver des informations entre les pages internet et les sessions de navigation. Ces fichiers permettent d'améliorer votre navigation sur notre site. Learn more