Security-X

Forum Security-X => Sécurité Générale => Malwares => Discussion démarrée par: chantal11 le septembre 13, 2017, 16:44:55

Titre: YogaSearch
Posté par: chantal11 le septembre 13, 2017, 16:44:55
Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)

YogaSearch est un Browser Hijacker (pirate de navigateur) qui modifie les paramètres du navigateur (page d’accueil , page de recherche, ....) afin de forcer la consultation du site ciblé et affiche aussi des publicités.
YogaSearch détourne les résultats de recherche.

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/YogaSearch/warning4.png&key=8af0a7b92f28a33373c1c455bbef65cf5b541b9e867a303af3208884ca15bbcc)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/YogaSearch/main.png&key=9f2df726605b53e42cf26bffb8fddfb7ea238dd2a1eda90980a3d26f34cb2873)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/YogaSearch/icons.png&key=4bb60fbd4886f8432fb8e9795c8a1060b839f28fb31a377af0e5b3c604c7b581)


(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/YogaSearch/compare.png&key=58f3bebdb3a40b5ae2c8c6f868eb666cde7a1ddb07a0324543c86b7c9e9ab4ac)









**********

Détection de YogaSearch dans des rapports FRST :

Citer
Yoga Search (HKLM-x32\...\YogaSearch) (Version:  - )
ShortcutWithArgument: C:\Users\{Nom_Utilisateur}\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --load-extension="C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa"

C:\Users\{Nom_Utilisateur}\Desktop\Google Chrome.lnk



**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)
Sous la version Premium, Malwarebytes bloque le domaine technows.ws et l'IP 104.27.173.74

Citer
-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 1
PUP.Optional.YogaSearch, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\YogaSearch, Delete-on-Reboot, [8123], [430730],1.0.2753

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 1
PUP.Optional.YogaSearch.ShrtCln, C:\USERS\{username}\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\EXTENSIONS\IKMAPCAEKNFGFMJLIBNHCBCHFABLCKBPA, Delete-on-Reboot, [8210], [432810],1.0.2753

File: 10
PUP.Optional.YogaSearch.ShrtCln, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa\favicon.ico, Delete-on-Reboot, [8210], [432810],1.0.2753
PUP.Optional.YogaSearch.ShrtCln, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa\home.html, Delete-on-Reboot, [8210], [432810],1.0.2753
PUP.Optional.YogaSearch.ShrtCln, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa\icon.png, Delete-on-Reboot, [8210], [432810],1.0.2753
PUP.Optional.YogaSearch.ShrtCln, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa\icon128.png, Delete-on-Reboot, [8210], [432810],1.0.2753
PUP.Optional.YogaSearch.ShrtCln, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa\icon16.png, Delete-on-Reboot, [8210], [432810],1.0.2753
PUP.Optional.YogaSearch.ShrtCln, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa\icon48.png, Delete-on-Reboot, [8210], [432810],1.0.2753
PUP.Optional.YogaSearch.ShrtCln, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa\manifest.json, Delete-on-Reboot, [8210], [432810],1.0.2753
PUP.Optional.YogaSearch.ShrtCln, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa\Postback.exe, Delete-on-Reboot, [8210], [432810],1.0.2753
PUP.Optional.YogaSearch.ShrtCln, C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Extensions\ikmapcaeknfgfmjlibnhcbchfablckbpa\tab.html, Delete-on-Reboot, [8210], [432810],1.0.2753
PUP.Optional.YogaSearch, C:\USERS\{username}\DESKTOP\YOGASEARCH.EXE, Delete-on-Reboot, [8123], [430734],1.0.2753

Physical Sector: 0
(No malicious items detected)


Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)


Source : Removal instructions for YogaSearch de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/210111-removal-instructions-for-yogasearch/)



Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/  en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/