Security-X

Forum Security-X => Sécurité Générale => Malwares => Discussion démarrée par: chantal11 le juillet 06, 2017, 16:20:43

Titre: MoneyFriend
Posté par: chantal11 le juillet 06, 2017, 16:20:43
Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)

MoneyFriend est un adware (logiciel publicitaire), qui affiche des publicités intempestives indépendantes des sites visités.


(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MoneyFriend/warning4.png&key=1f4c8e42bbf46fbaf2e4d627c779cac616dfc40c2909b13037dff1789f619694)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MoneyFriend/IEproxy.png&key=6f316093e99c028aa299a7ddbf0a97d7f64c3773cc8fd34827fc7550cc621fd9)http://


(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MoneyFriend/warning2.png&key=c46627e337e48166f30df826c3e41d9b5f0021e6c8c23fbee77f361881026ca4)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MoneyFriend/warning1.png&key=e3850e99677d0185fa3cfc1ed5a91a73136b1e92945bf3c0bc080f47c855dfbb)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/MoneyFriend/warning5.png&key=f0fa245d5ee6ac3756101a95f32df74393aabaac45b12a3b8d18046e3de7a186)









**********

Détection de MoneyFriend dans des rapports FRST :

Citer
MoneyFriend (HKLM-x32\...\MoneyFriend1.0) (Version: 1.0 - Pcom)
Task: {01B17F3D-1CFF-4255-86FB-88B88C7DB473} - System32\Tasks\WinDriver => C:\Windows\slp.exe [2007-10-28] (www.commandline.co.uk)
Task: {D3FD6F4E-A5AE-4F98-A0B7-9B171ADCA718} - System32\Tasks\WinVDA => C:\Windows\slp.exe [2007-10-28] (www.commandline.co.uk)

Microsoft) C:\Windows\fhelper.exe
(Groom-A-Zebu (tm)  ) C:\Windows\vgagfx.exe
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKCU\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
AutoConfigURL: [.DEFAULT] => file://C:\Windows\System32\Drivers\iexplore.pac
AutoConfigURL: [S-1-5-21-1350903546-318028887-1286703239-1003] => file://C:\Windows\System32\Drivers\iexplore.pac
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
FF NetworkProxy: "user_pref("extensions.enableScopes", 15);type", 4);user_pref("xpinstall.signatures.required", false
FF Extension: Furniture Guru - C:\Users\{Nom_Utilisateur}\AppData\Roaming\Mozilla\Firefox\Profiles\x82gpani.default-1491393116824\Extensions\jid1-aMet0JAAbFecLw@jetpack.xpi [2015-11-04] [not signed]
FF Extension: Indiashopps - C:\Users\{Nom_Utilisateur}\AppData\Roaming\Mozilla\Firefox\Profiles\x82gpani.default-1491393116824\Extensions\jid1-rrMTK7JqsxNOeQ@jetpack.xpi [2016-04-20]
FF Extension: Furniture Guru - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\jid1-aMet0JAAbFecLw@jetpack.xpi [2015-11-04] [not signed]
FF Extension: Indiashopps - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\jid1-rrMTK7JqsxNOeQ@jetpack.xpi [2016-04-20]
CHR HKCU\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pgoackgjjkpbkjoomkklkofbhpkbeboc] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pgoackgjjkpbkjoomkklkofbhpkbeboc] - hxxps://clients2.google.com/service/update2/crx
R2 fhelper; C:\Windows\fhelper.exe [10240 2016-08-27] (Microsoft) [File not signed]
C:\Windows\System32\Tasks\WinVDA
C:\Windows\System32\Tasks\WinDriver
C:\Program Files (x86)\MoneyFriend
(Microsoft) C:\Windows\plotpix.exe
(Microsoft) C:\Windows\fhelper.exe
C:\Windows\default.cfg
C:\Windows\loadermaster.exe
C:\Windows\gruber.exe
C:\Windows\bgpss.txt
C:\Windows\gdwslk
C:\Windows\jhndsn
C:\Windows\mdkfpoud.bat
C:\Windows\nitakihg.bat
(Groom-A-Zebu (tm) ) C:\Windows\vgagfx.exe
(Groom-A-Zebu (tm) ) C:\Windows\system32\mndhsj.exe
C:\Windows\system32\Drivers\iexplore.pac


**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)


Citer
PUP.Optional.MSoft.ChrPRST
PUP.Optional.ProxyHijacker
PUP.Optional.IndiaShopps.ChrPRST
Trojan.Dropper.Generic

Citer
-Scan Details-
Process: 1
Trojan.Dropper.Generic, C:\WINDOWS\FHELPER.EXE, Quarantined, [575], [355568],1.0.2192

Module: 1
Trojan.Dropper.Generic, C:\WINDOWS\FHELPER.EXE, Quarantined, [575], [355568],1.0.2192

Registry Key: 18
Trojan.Dropper.Generic, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\fhelper, Delete-on-Reboot, [575], [355568],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\POLICIES\GOOGLE\CHROME, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\CHROME, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, HKCU\SOFTWARE\POLICIES\GOOGLE\CHROME, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\NLASVC\PARAMETERS\INTERNET\MANUALPROXIES, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, HKCU\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\akhdblbjebmbllhinponghfmaekhlhob, Delete-on-Reboot, [9469], [408561],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, HKCU\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\pgoackgjjkpbkjoomkklkofbhpkbeboc, Delete-on-Reboot, [9468], [408566],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKCU\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\akhdblbjebmbllhinponghfmaekhlhob, Delete-on-Reboot, [9469], [408561],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\msaver1.0.1.20, Delete-on-Reboot, [9469], [408584],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, HKCU\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\pgoackgjjkpbkjoomkklkofbhpkbeboc, Delete-on-Reboot, [9468], [408566],1.0.2192
PUP.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WinDriver, Delete-on-Reboot, [3964], [408578],1.0.2192
PUP.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\WinVDA, Delete-on-Reboot, [3964], [408581],1.0.2192
PUP.Optional.MoneyFreind, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\MoneyFriend1.0, Delete-on-Reboot, [9437], [408574],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\msaver1.0.1.20, Delete-on-Reboot, [9469], [408585],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\akhdblbjebmbllhinponghfmaekhlhob, Delete-on-Reboot, [9469], [408562],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\pgoackgjjkpbkjoomkklkofbhpkbeboc, Delete-on-Reboot, [9468], [408567],1.0.2192
PUP.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{01B17F3D-1CFF-4255-86FB-88B88C7DB473}, Delete-on-Reboot, [3964], [408577],1.0.2192
PUP.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{D3FD6F4E-A5AE-4F98-A0B7-9B171ADCA718}, Delete-on-Reboot, [3964], [408576],1.0.2192

Registry Value: 15
PUP.Optional.ProxyHijacker, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AUTOCONFIGURL, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AUTOCONFIGURL, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|AUTOCONFIGURL, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.ProxyHijacker, HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|PROXYENABLE, Delete-on-Reboot, [3964], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, HKCU\SOFTWARE\POLICIES\GOOGLE\CHROME\ExtensionInstallForcelist|5, Delete-on-Reboot, [9469], [408586],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKCU\SOFTWARE\POLICIES\GOOGLE\CHROME\ExtensionInstallWhitelist|5, Delete-on-Reboot, [9469], [408586],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\POLICIES\GOOGLE\CHROME\ExtensionInstallForcelist|5, Delete-on-Reboot, [9469], [408587],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\POLICIES\GOOGLE\CHROME\ExtensionInstallWhitelist|5, Delete-on-Reboot, [9469], [408587],1.0.2192
PUP.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{01B17F3D-1CFF-4255-86FB-88B88C7DB473}|PATH, Delete-on-Reboot, [3964], [408577],1.0.2192
PUP.Optional.ProxyHijacker, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{D3FD6F4E-A5AE-4F98-A0B7-9B171ADCA718}|PATH, Delete-on-Reboot, [3964], [408576],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\CHROME\ExtensionInstallForcelist|5, Delete-on-Reboot, [9469], [408587],1.0.2192
PUP.Optional.MSoft.ChrPRST, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\CHROME\ExtensionInstallWhitelist|5, Delete-on-Reboot, [9469], [408587],1.0.2192

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 6
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\_metadata, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\AKHDBLBJEBMBLLHINPONGHFMAEKHLHOB, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\_metadata, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\PGOACKGJJKPBKJOOMKKLKOFBHPKBEBOC, Delete-on-Reboot, [9468], [408560],1.0.2192

File: 48
Trojan.Dropper.Generic, C:\WINDOWS\FHELPER.EXE, Delete-on-Reboot, [575], [355568],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\_metadata\computed_hashes.json, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\_metadata\verified_contents.json, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\background.js, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\deals.html, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\jquery.min.js, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\manifest.json, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\product_page.js, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\redir_page.js, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\akhdblbjebmbllhinponghfmaekhlhob\1.0.0.15_0\set128.png, Delete-on-Reboot, [9469], [408559],1.0.2192
PUP.Optional.MSoft.ChrPRST, C:\PROGRAMDATA\NTUSER.POL, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, C:\USERS\{username}\NTUSER.POL, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, C:\WINDOWS\SYSTEM32\GROUPPOLICY\USER\REGISTRY.POL, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.MSoft.ChrPRST, C:\WINDOWS\SYSTEM32\GROUPPOLICY\MACHINE\REGISTRY.POL, Delete-on-Reboot, [9469], [-1],0.0.0
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\_metadata\verified_contents.json, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\jquery.min.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\allNeed.css, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\amazon.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\arrow1.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\background.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\deals.css, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\deals.html, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\FlipScript.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\FlipStyle.css, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\hide-left.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\hide-right.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\icon.ico, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\icon.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\jquery.easing.1.3.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\manifest.json, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\offer.css, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\product_page.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\reset.min.css, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\sidebar-exclusive.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\snapdeal.js, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\style.css, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\watch-price1.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgoackgjjkpbkjoomkklkofbhpkbeboc\1.0.1.7_0\watch-price2.png, Delete-on-Reboot, [9468], [408560],1.0.2192
PUP.Optional.MoneyFreind, C:\USERS\{username}\DESKTOP\DEALZ2.EXE, Delete-on-Reboot, [9437], [408246],1.0.2192
PUP.Optional.ProxyHijacker, C:\WINDOWS\SYSTEM32\DRIVERS\IEXPLORE.PAC, Delete-on-Reboot, [3964], [408573],1.0.2192
RiskWare.CHP, C:\WINDOWS\SLP.EXE, Delete-on-Reboot, [16429], [278738],1.0.2192
Trojan.Dropper.Generic, C:\WINDOWS\PLOTPIX.EXE, Delete-on-Reboot, [575], [355568],1.0.2192
RiskWare.CHP, C:\WINDOWS\HREWNF.EXE, Delete-on-Reboot, [16429], [278738],1.0.2192
PUP.Optional.Dealz, C:\USERS\{username}\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\X82GPANI.DEFAULT-1491393116824\EXTENSIONS\JID1-RRMTK7JQSXNOEQ@JETPACK.XPI, Delete-on-Reboot, [617], [237667],1.0.2192
PUP.Optional.FurnitureGuru, C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\EXTENSIONS\JID1-AMET0JAABFECLW@JETPACK.XPI, Delete-on-Reboot, [9462], [408569],1.0.2192
PUP.Optional.IndiaShopps.ChrPRST, C:\PROGRAM FILES (X86)\MOZILLA FIREFOX\BROWSER\EXTENSIONS\JID1-RRMTK7JQSXNOEQ@JETPACK.XPI, Delete-on-Reboot, [9468], [408563],1.0.2192
PUP.Optional.ProxyHijacker, C:\WINDOWS\SYSTEM32\TASKS\WINDRIVER, Delete-on-Reboot, [3964], [408579],1.0.2192
PUP.Optional.ProxyHijacker, C:\WINDOWS\SYSTEM32\TASKS\WINVDA, Delete-on-Reboot, [3964], [408582],1.0.2192

Physical Sector: 0
(No malicious items detected)


Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)


Source : Removal instructions for MoneyFriend de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/202976-removal-instructions-for-moneyfriend/)


Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/  en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/