– BearShare est un client freeware Peer2Peer qui utilise le réseau Gnutella. Il ne se désinstalle que partiellement.

Caractéristiques :

– Il appartient à une famille de PUP Optionnels (Potentially Unwanted Program).
– Vendeur : PUP.Optional.

Actions principales :

– Il s’installe deux processus lancés au démarrage du système (RP),
– Il pirate la page de démarrage du navigateur Mozilla Firefox (M0),
– Il modifie la page de démarrage du navigateur Internet Explorer (R0) à l’insu de l’utilisateur,
– Il modifie la page de recherche du navigateur Internet Explorer (R1) à l’insu de l’utilisateur,
– Il s’installe en tant de Browser Helper Object de Navigateur internet (O2),
– Il s’installe en tant que Toolbar de Navigateur internet (O3),
– Il s’installe dans la Base de Registres afin d’être lancé à chaque démarrage du système (O4),
– Il place un raccourci Quick Launch sous Microsoft Internet Explorer (O4 GS),
– Il s’installe en tant que valeur de registre AppInit_DLLs (O20),
– Il installe deux programme BearShare et Wincore MediaBar (O42),
– Il crée une multitude de clés de Registre « Software »,
– Il créé des dossier supplémentaires dans les dossiers de l’utilisateur (O43),
– Il s’installe en export de clé d’application autorisée (ECAA) (O47),
– Il crée une multitude de clés et de valeurs de registre. Certaines de ces clés sont installées ave le PUP.iMesh (O88 ).

Aperçu ZHPDiag :

—-\\ Processus lancés
[MD5.7D82710E26DCA45CFBD12EB97ED34D25] – (.MusicLab, LLC – BearShare.) — C:\Program Files\BearShare Applications\BearShare\BearShare.exe [25795000] [PID.2880]
[MD5.D79A4EAB63EDBD1FD47C3FC7D53A3822] – (.MusicLab, LLC – Data Manager.) — C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\DATAMN~1.EXE [1693112] [PID.3264]

—\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
M0 – MFSP: prefs.js [roland – seybyvv0.default] http://search.bearshare.net

—\\ Internet Explorer, Démarrage,Recherche,URLSearchHook, Phishing (R0,R1,R3,R4)
R0 – HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com
R1 – HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://dts.search-results.com
R1 – HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://dts.search-results.com

—\\ Browser Helper Objects de navigateur (O2)
O2 – BHO: DataMngr – {B939CF93-F2CB-443d-956C-DC523D85C9DB} . (.MusicLab, LLC – Url Helper.) — C:\Program Files\BearShare Applications\MediaBar\Datamngr\BrowserConnection.dll
O2 – BHO: Wincore Mediabar – {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} . (.. – dtx Dynamic Link Library.) — C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll

—\\ Internet Explorer Toolbars (O3)
O3 – Toolbar: Wincore Mediabar – {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} . (.. – dtx Dynamic Link Library.) — C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll

—\\ Applications démarrées par registre & par dossier (O4)
O4 – HKLM\..\Run: [DATAMNGR] . (.MusicLab, LLC – Data Manager.) — C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe

—\\ Autres liens utilisateurs (O4)
O4 – GS\TaskBar: BearShare.lnk . (.MusicLab, LLC – BearShare.) — C:\Program Files (x86)\BearShare Applications\BearShare\BearShare.exe
O4 – GS\QuickLaunch: BearShare.lnk . (.MusicLab, LLC – BearShare.) — C:\Program Files (x86)\BearShare Applications\BearShare\BearShare.exe

—\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 – AppInit_DLLs: . (.MusicLab, LLC – Data Manager.) – C:\Program Files\BEARSH~1\MediaBar\Datamngr\datamngr.dll

—\\ Logiciels installés (O42)
O42 – Logiciel: BearShare – (.Musiclab, LLC.) [HKLM] — BearShare
O42 – Logiciel: BearShare – (.Musiclab, LLC.) [HKLM] — {5F624839-947D-46EA-BD63-FD847C1AC6F1}
O42 – Logiciel: Wincore MediaBar – (.Musiclab, LLC.) [HKLM] — Wincore MediaBar

—\\ HKCU & HKLM Software Keys
[HKCU\Software\BearShare]
[HKLM\Software\BearShare Mediabar]
[HKCU\Software\BearShare]
[HKCU\Software\DataMngr]
[HKCU\Software\DataMngr_Toolbar]
[HKLM\Software\BearShareMediabarTb]
[HKLM\Software\DataMngr]
[HKLM\Software\MimarSinan]
[HKLM\Software\MusicNet]
[HKLM\Software\RegisteredApplications]
[HKCU\Software\DM]
[HKLM\Software\Wow6432Node\BearShareSRTB]

—\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 – CFD: 16/03/2013 – 15:41:45 – [0,079] —-D C:\ProgramData\BearShare
O43 – CFD: 03/02/2012 – 09:36:46 – [50,334] —-D- C:\Program Files\BearShare Applications
O43 – CFD: 03/02/2012 – 09:36:58 – [0,001] —-D- C:\Documents and Settings\Coolman\Application Data\mediabarbs
O43 – CFD: 03/02/2012 – 09:37:02 – [36,438] —-D- C:\Documents and Settings\Coolman\Local Settings\Application Data\BearShare
O43 – CFD: 03/02/2012 – 09:33:24 – [0] —-D- C:\Documents and Settings\Coolman\Local Settings\Application Data\PackageAware

—\\ Export de clé d’application autorisée (O47)
O47 – AAKE:Key Export SP – « C:\Program Files\BearShare Applications\BearShare\BearShare.exe » [Enabled] .(.MusicLab, LLC – BearShare.) — C:\Program Files\BearShare Applications\BearShare\BearShare.exe
O47 – AAKE:Key Export SP – « C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar\dtUser.exe » [Enabled] .(.Visicom Media Inc. – DTX broker.) — C:\Program Files\BearShare Applications\MediaBar\Datamngr\ToolBar\dtUser.exe
O47 – AAKE:Key Export DP – « C:\Program Files\BearShare Applications\BearShare\BearShare.exe » [Enabled] .(.MusicLab, LLC – BearShare.) — C:\Program Files\BearShare Applications\BearShare\BearShare.exe

—\\ Scan Additionnel (O88 )
[HKLM\Software\BearShareMediabarTb]
[HKLM\Software\Wow6432Node\BearShareSRTB]
[HKCU\Software\DataMngr]
[HKLM\Software\DataMngr]
[HKCU\Software\DataMngr_Toolbar]
[HKLM\Software\Classes\AppID\BearShare.exe]
[HKLM\Software\Classes\AppID\DiscoveryHelper.DLL]
[HKLM\Software\Classes\AppID\GIFAnimator.DLL]
[HKLM\Software\Classes\AppID\IMTrProgress.DLL]
[HKLM\Software\Classes\AppID\IMWeb.DLL]
[HKLM\Software\Classes\AppID\Launcher.EXE]
[HKLM\Software\Classes\AppID\NCTAudioCDGrabber2.DLL]
[HKLM\Software\Classes\AppID\NCTAudioCompress3.DLL]
[HKLM\Software\Classes\AppID\NCTAudioFile3.DLL]
[HKLM\Software\Classes\AppID\NCTAudioFileWMA3.DLL]
[HKLM\Software\Classes\AppID\NCTAudioFormatSettings3.DLL]
[HKLM\Software\Classes\AppID\WMHelper.DLL]
[HKCR\clsid\{35b8892d-c3fb-4d88-990d-31db2ebd72bd}]
[HKCR\clsid\{6ed74ae3-8066-4385-aaba-243e033f75a3}]
[HKCR\clsid\{77829f14-d911-40ff-a2f0-d11db8d6d0bc}]
[HKCR\clsid\{a8fa2fde-bf01-4dd9-aaff-7bacfdcae896}]
[HKCR\interface\{1e2d3c35-7aa0-4f6b-a334-30035604c03b}]
[HKCR\typelib\{93e3d79c-0786-48ff-9329-93bc9f6dc2b3}]
[HKCR\typelib\{e160feb0-334e-4648-9ee1-fcbbf2e2aa4b}]
[HKLM\Software\Classes\CLSID\{01AD9322-02FF-4f4f-AC52-92FDA5AE65F0}]
[HKLM\Software\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581}]
[HKLM\Software\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}]
[HKLM\Software\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}]
[HKLM\Software\Classes\CLSID\{5D9E7BE9-95E5-4392-8CD2-D82DE89589ED}]
[HKLM\Software\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}]
[HKLM\Software\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}]
[HKLM\Software\Classes\AppID\{CC50232E-FDB1-436F-B658-452F88E81736}]
[HKLM\Software\Classes\CLSID\{412CD209-DDA4-4275-8C79-55F1C93FBD47}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{872F3C0B-4462-424c-BB9F-74C6899B9F92}]
[HKLM\Software\Classes\TypeLib\{96F7FABC-5789-EFA4-B6ED-1272F4C1D27B}]
[HKLM\Software\Classes\CLSID\{A2858A72-758F-4486-B6A1-7F1DCC0924FA}]
[HKLM\Software\Classes\AppID\{A7DDCBDE-5C86-415c-8A37-763AE183E7E4}]
[HKLM\Software\Classes\CLSID\{B6F8DA9F-2696-419e-A8A3-19BE41EF51BD}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B6F8DA9F-2696-419e-A8A3-19BE41EF51BD}]
[HKLM\Software\Classes\CLSID\{C63CA8A4-AB4E-49e5-A6C0-33FC86D80205}]
[HKLM\Software\Classes\CLSID\{C6A7847E-8931-4a9a-B4EF-72A91E3CCF4D}]
[HKLM\Software\Classes\CLSID\{DD0F1D24-E250-4e93-966C-65615720AEFB}]
[HKLM\Software\Classes\CLSID\{EC1277BB-1C71-4c0d-BA6D-BFEA16E773A6}]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Wincore MediaBar]
[HKLM\Software\Classes\DiscoveryHelper.iMesh6Discovery]
[HKLM\Software\Classes\DiscoveryHelper.iMesh6Discovery.1]
[HKLM\Software\Classes\imweb.imwebcontrol]
[HKLM\Software\Classes\AppID\{1fc41815-fa4c-4f8b-b143-2c045c8ea2fc}]
[HKLM\Software\Classes\AppID\{21493C1F-D071-496A-9C27-450578888291}]
[HKLM\Software\Classes\TypeLib\{252c2315-cce0-4446-8da7-c00292a690ba}]
[HKLM\Software\Classes\AppID\{403A885F-CB00-40C1-BDC1-EB09053194F7}]
[HKLM\Software\Classes\TypeLib\{403A885F-CB00-40C1-BDC1-EB09053194F7}]
[HKLM\Software\Classes\AppID\{55C1727F-5535-4C2A-9601-8C2458608B48}]
[HKLM\Software\Classes\TypeLib\{55C1727F-5535-4C2A-9601-8C2458608B48}]
C:\Program Files\BearShare Applications
C:\ProgramData\BearShare

Liens :

botcrawl.com
CCM articles

Supprimer (Remove) :

– Supprimer l’extension « BearShare » de tous les navigateurs installés,
– Supprimer le plugin « BearShare » de tous les navigateurs installés,
– Supprimer le logiciel « BearShare » via le panneau de configuration Windows,
Nettoyer avec ZHPCleaner