Auteur Sujet: MoneyFriend  (Lu 2433 fois)

0 Membres et 1 Invité sur ce sujet

Hors ligne chantal11

  • Admin Formation
  • Mega Power Members
  • ****
  • Messages: 24243
    • Windows 10 - Windows 8 - Windows 7 - Windows Vista
MoneyFriend
« le: juillet 06, 2017, 16:20:43 »
Contenu republié avec la permission de Malwarebytes

MoneyFriend est un adware (logiciel publicitaire), qui affiche des publicités intempestives indépendantes des sites visités.


  •   S'installe en tant que programme, soit à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime, soit depuis le site de l'éditeur

  • Paramètre un proxy verrouillé par une stratégie
http://

  • Installe ces extensions/add-on












**********

Détection de MoneyFriend dans des rapports FRST :

Citer
MoneyFriend (HKLM-x32\...\MoneyFriend1.0) (Version: 1.0 - Pcom)
Task: {01B17F3D-1CFF-4255-86FB-88B88C7DB473} - System32\Tasks\WinDriver => C:\Windows\slp.exe [2007-10-28] (www.commandline.co.uk)
Task: {D3FD6F4E-A5AE-4F98-A0B7-9B171ADCA718} - System32\Tasks\WinVDA => C:\Windows\slp.exe [2007-10-28] (www.commandline.co.uk)

Microsoft) C:\Windows\fhelper.exe
(Groom-A-Zebu (tm)  ) C:\Windows\vgagfx.exe
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKCU\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
AutoConfigURL: [.DEFAULT] => file://C:\Windows\System32\Drivers\iexplore.pac
AutoConfigURL: [S-1-5-21-1350903546-318028887-1286703239-1003] => file://C:\Windows\System32\Drivers\iexplore.pac
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
FF NetworkProxy: "user_pref("extensions.enableScopes", 15);type", 4);user_pref("xpinstall.signatures.required", false
FF Extension: Furniture Guru - C:\Users\{Nom_Utilisateur}\AppData\Roaming\Mozilla\Firefox\Profiles\x82gpani.default-1491393116824\Extensions\jid1-aMet0JAAbFecLw@jetpack.xpi [2015-11-04] [not signed]
FF Extension: Indiashopps - C:\Users\{Nom_Utilisateur}\AppData\Roaming\Mozilla\Firefox\Profiles\x82gpani.default-1491393116824\Extensions\jid1-rrMTK7JqsxNOeQ@jetpack.xpi [2016-04-20]
FF Extension: Furniture Guru - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\jid1-aMet0JAAbFecLw@jetpack.xpi [2015-11-04] [not signed]
FF Extension: Indiashopps - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\jid1-rrMTK7JqsxNOeQ@jetpack.xpi [2016-04-20]
CHR HKCU\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pgoackgjjkpbkjoomkklkofbhpkbeboc] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pgoackgjjkpbkjoomkklkofbhpkbeboc] - hxxps://clients2.google.com/service/update2/crx
R2 fhelper; C:\Windows\fhelper.exe [10240 2016-08-27] (Microsoft) [File not signed]
C:\Windows\System32\Tasks\WinVDA
C:\Windows\System32\Tasks\WinDriver
C:\Program Files (x86)\MoneyFriend
(Microsoft) C:\Windows\plotpix.exe
(Microsoft) C:\Windows\fhelper.exe
C:\Windows\default.cfg
C:\Windows\loadermaster.exe
C:\Windows\gruber.exe
C:\Windows\bgpss.txt
C:\Windows\gdwslk
C:\Windows\jhndsn
C:\Windows\mdkfpoud.bat
C:\Windows\nitakihg.bat
(Groom-A-Zebu (tm) ) C:\Windows\vgagfx.exe
(Groom-A-Zebu (tm) ) C:\Windows\system32\mndhsj.exe
C:\Windows\system32\Drivers\iexplore.pac


**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)


Citer
PUP.Optional.MSoft.ChrPRST
PUP.Optional.ProxyHijacker
PUP.Optional.IndiaShopps.ChrPRST
Trojan.Dropper.Generic

Citer
-Scan Details-
Process: 1
Trojan.Dropper.Generic, C:\WINDOWS\FHELPER.EXE, Quarantined, [575], [355568],1.0.2192

Module: 1
Trojan.Dropper.Generic, C:\WINDOWS\FHELPER.EXE, Quarantined, [575], [355568],1.0.2192

Registry Key: 18
Trojan.Dropper.Generic, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\fhelper, Delete-on-Reboot, [575], [355568],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\POLICIES\GOOGLE\CHROME, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\CHROME, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, HKCU\SOFTWARE\POLICIES\GOOGLE\CHROME, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NLASVC\PARAMETERS\INTERNET\MANUALPROXIES, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, HKCU\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\akhdblbjebmbllhinponghfmaekhlhob, Delete-on-Reboot, [9469], [408561],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, HKCU\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\pgoackgjjkpbkjoomkklkofbhpkbeboc, Delete-on-Reboot, [9468], [408566],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKCU\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\akhdblbjebmbllhinponghfmaekhlhob, Delete-on-Reboot, [9469], [408561],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\msaver1.0.1.20, Delete-on-Reboot, [9469], [408584],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, HKCU\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\pgoackgjjkpbkjoomkklkofbhpkbeboc, Delete-on-Reboot, [9468], [408566],1.0.2192
PUP.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WinDriver, Delete-on-Reboot, [3964], [408578],1.0.2192
PUP.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WinVDA, Delete-on-Reboot, [3964], [408581],1.0.2192
PUP.Optional.MoneyFreind, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MoneyFriend1.0, Delete-on-Reboot, [9437], [408574],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\msaver1.0.1.20, Delete-on-Reboot, [9469], [408585],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\akhdblbjebmbllhinponghfmaekhlhob, Delete-on-Reboot, [9469], [408562],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\pgoackgjjkpbkjoomkklkofbhpkbeboc, Delete-on-Reboot, [9468], [408567],1.0.2192
PUP.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{01B17F3D-1CFF-4255-86FB-88B88C7DB473}, Delete-on-Reboot, [3964], [408577],1.0.2192
PUP.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{D3FD6F4E-A5AE-4F98-A0B7-9B171ADCA718}, Delete-on-Reboot, [3964], [408576],1.0.2192

Registry Value: 15
PUP.Optional.ProxyHijacker, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AUTOCONFIGURL, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AUTOCONFIGURL, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AUTOCONFIGURL, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, HKCU\SOFTWARE\POLICIES\GOOGLE\CHROME\ExtensionInstallForcelist|5, Delete-on-Reboot, [9469], [408586],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKCU\SOFTWARE\POLICIES\GOOGLE\CHROME\ExtensionInstallWhitelist|5, Delete-on-Reboot, [9469], [408586],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\POLICIES\GOOGLE\CHROME\ExtensionInstallForcelist|5, Delete-on-Reboot, [9469], [408587],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\POLICIES\GOOGLE\CHROME\ExtensionInstallWhitelist|5, Delete-on-Reboot, [9469], [408587],1.0.2192
PUP.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{01B17F3D-1CFF-4255-86FB-88B88C7DB473}|PATH, Delete-on-Reboot, [3964], [408577],1.0.2192
PUP.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{D3FD6F4E-A5AE-4F98-A0B7-9B171ADCA718}|PATH, Delete-on-Reboot, [3964], [408576],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\CHROME\ExtensionInstallForcelist|5, Delete-on-Reboot, [9469], [408587],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\CHROME\ExtensionInstallWhitelist|5, Delete-on-Reboot, [9469], [408587],1.0.2192

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 6
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\_metadata, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\AKHDBLBJEBMBLLHINPONGHFMAEKHLHOB, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\_metadata, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\PGOACKGJJKPBKJOOMKKLKOFBHPKBEBOC, Delete-on-Reboot, [9468], [408560],1.0.2192

File: 48
Trojan.Dropper.Generic, C:\WINDOWS\FHELPER.EXE, Delete-on-Reboot, [575], [355568],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\_metadata\computed_hashes.json, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\_metadata\verified_contents.json, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\background.js, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\deals.html, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\jquery.min.js, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\manifest.json, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\product_page.js, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\redir_page.js, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\set128.png, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\PROGRAMDATA\NTUSER.POL, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, C:\USERS\{username}\NTUSER.POL, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, C:\WINDOWS\SYSTEM32\GROUPPOLICY\USER\REGISTRY.POL, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, C:\WINDOWS\SYSTEM32\GROUPPOLICY\MACHINE\REGISTRY.POL, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\_metadata\verified_contents.json, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\jquery.min.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\allNeed.css, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\amazon.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\arrow1.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\background.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\deals.css, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\deals.html, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\FlipScript.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\FlipStyle.css, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\hide-left.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\hide-right.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\icon.ico, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\icon.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\jquery.easing.1.3.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\manifest.json, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\offer.css, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\product_page.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\reset.min.css, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\sidebar-exclusive.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\snapdeal.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\style.css, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\watch-price1.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\watch-price2.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.MoneyFreind, C:\USERS\{username}\DESKTOP\DEALZ2.EXE, Delete-on-Reboot, [9437], [408246],1.0.2192
PUP.Optional.ProxyHijacker, C:\WINDOWS\SYSTEM32\DRIVERS\IEXPLORE.PAC, Delete-on-Reboot, [3964], [408573],1.0.2192
RiskWare.CHP, C:\WINDOWS\SLP.EXE, Delete-on-Reboot, [16429], [278738],1.0.2192
Trojan.Dropper.Generic, C:\WINDOWS\PLOTPIX.EXE, Delete-on-Reboot, [575], [355568],1.0.2192
RiskWare.CHP, C:\WINDOWS\HREWNF.EXE, Delete-on-Reboot, [16429], [278738],1.0.2192
PUP.Optional.Dealz, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\X82GPANI.DEFAULT-1491393116824\EXTENSIONS\JID1-RRMTK7JQSXNOEQ@JETPACK.XPI, Delete-on-Reboot, [617], [237667],1.0.2192
PUP.Optional.FurnitureGuru, C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\EXTENSIONS\JID1-AMET0JAABFECLW@JETPACK.XPI, Delete-on-Reboot, [9462], [408569],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\EXTENSIONS\JID1-RRMTK7JQSXNOEQ@JETPACK.XPI, Delete-on-Reboot, [9468], [408563],1.0.2192
PUP.Optional.ProxyHijacker, C:\WINDOWS\SYSTEM32\TASKS\WINDRIVER, Delete-on-Reboot, [3964], [408579],1.0.2192
PUP.Optional.ProxyHijacker, C:\WINDOWS\SYSTEM32\TASKS\WINVDA, Delete-on-Reboot, [3964], [408582],1.0.2192

Physical Sector: 0
(No malicious items detected)


Tutoriel d'utilisation Malwarebytes en images


Source : Removal instructions for MoneyFriend de Metallica - Malwarebytes Forums



Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/  en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/
« Modifié: juillet 06, 2017, 17:18:13 par chantal11 »
 

Security-X

MoneyFriend
« le: juillet 06, 2017, 16:20:43 »