PUP.Optional.MoviesToolbar

MoviesToolbar est un programme qui s’installe généralement à votre insu via le téléchargement de logiciels gratuits.
– Il recueille vos habitudes de navigations et les communique à un serveur (Tracking).
– Il peut se propager avec PUP.Optional.Bandoo.

Caractéristiques :

– Il appartient à une famille de PUP Optionnels (Potentially Unwanted Program).
– Vendeur : PUP.Optional.

Actions principales :

– Il s’installe en tant que processus lancé au démarrage du système (RP),
– Il installe un programme d’extension pour le navigateur Google Chrome (G2),
– Il installe un programme d’extension pour le navigateur Mozilla Firefox (M2),
– Il s’installe en tant que BHO (Browser Helper Object) de Navigateur internet (O2),
– Il s’installe en tant que Toolbar de Navigateur internet (O3),
– Il s’installe en tant que valeur de registre Winlogon Notify (autorun)(O20),
– Il s’installe en tant que service pour être lancé à chaque démarrage du système (O23),(SS/SR),
– Il démarre une session manager (O36),
– Il s’installe en tant que programme (O42),
– Il crée de multiples clés de Registre “Software”,
– Il crée des dossiers supplémentaires (O43),
– Il s’installe dans le dossier Windows prefetcher (O45),
– Il s’installe en export de clé d’application autorisée (ECAA) (O47),
– Il crée de multiples fichiers utilisateurs (O61),
– Il modifie le fournisseur de recherche Internet (O69),
– Il s’installe dans des dossiers particuliers de l’utilisateur (O84),
– Il crée une connexion entrante active dans les exceptions d’application du parefeu Windows (O87),
– Il pollue la base de Registres avec de nombreuses clés et valeurs (O88 ),
– Il crée des clés de registre CLSID (O101)

Aperçu ZHPDiag :

—\\ Processus lancés
[fusion_builder_container hundred_percent=”yes” overflow=”visible”][fusion_builder_row][fusion_builder_column type=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”no” center_content=”no” min_height=”none”][MD5.64C64E7268887F661B911DEED945B898] – (.Bandoo Media Inc. – Datamngr Coordinator.) — C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe [3360256] [PID.1224]
[MD5.F4938525565B6AFD0F547934F20754E4] – (.Bandoo Media Inc. – Data Manager.) — C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrUI.exe [3534848] [PID.3384]
[MD5.DB4721B0BA9D705AADA438B1AB50E53C] – (.SafetyNut Inc. – SafetyNut Manager.) — C:\Program Files (x86)\Movies Toolbar\SafetyNut\SafetyNutManager.exe [3422728] [PID.2272]
[MD5.42D6FF4DE3623C0656F06795048F8BB6] – (.SafetyNut Inc. – SafetyNut.) — C:\Program Files (x86)\Movies Toolbar\SafetyNut\safetynut.exe [3588104] [PID.2816]

—\\ Google Chrome, Démarrage,Recherche,Extensions (G0,G1,G2)
G2 – GCE: Preference [User Data\Default] [aaaaabcbmongicmdegkmmfgdickgnnob] Movies Toolbar v.29.1, (Désactivé)
G2 – GCE: Preference [User Data\Default] [aaaaimdcedbpbcjjbbnfcbbjcngmomic] Movies Toolbar v.21.56058, (Désactivé)

—\\ Liste des dossiers d’extension Google Chrome
G2 – EXT: C:\Documents and Settings\Coolman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aaaaabcbmongicmdegkmmfgdickgnnob [Movies Toolbar]
G2 – EXT: C:\Documents and Settings\Coolman\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aaaaimdcedbpbcjjbbnfcbbjcngmomic [Movies Toolbar]

—\\ Mozilla Firefox, Plugins,Demarrage,Recherche,Extensions (P2,M0,M1,M2,M3)
M2 – MFEP: prefs.js [Coolman – fmcyacz6.default\{3444c3c5-6c56-4a16-a453-832b05bf6ea4}] [] Movies Toolbar (Dist. by Somoto Ltd.) v1.6.2.0 (..)
M2 – MFEP: prefs.js [Coolman – fmcyacz6.default\{d1dac034-9fd9-4c13-a388-d2e10e57707f}] [] Movies Toolbar (Dist. by Bandoo Media, Inc.) v1.8.1.0 (..)

—\\ Browser Helper Objects de navigateur (O2)
O2 – BHO: Movies Toolbar (Dist. by Bandoo Media, Inc.) [64Bits] – {609BBD0C-AC47-40E5-B047-27520779C4C9} . (.APN LLC – dtx Dynamic Link Library.) — C:\Program Files (x86)\Movies Toolbar\Datamngr\SRTOOL~1\IE\searchresultsDx.dll
O2 – BHO: Movies Toolbar (Dist. by Somoto Ltd.)) – {3444C3C5-6C56-4A16-A453-832B05BF6EA4} . (.APN LLC – dtx Dynamic Link Library.) — C:\Program Files (x86)\Movies Toolbar\Datamngr\SRTOOL~1\IE\searchresultsDx.dll

—\\ Internet Explorer Toolbars (O3)
O3 – Toolbar: Movies Toolbar (Dist. by Somoto Ltd.) – {3444C3C5-6C56-4A16-A453-832B05BF6EA4} . (.APN LLC – dtx Dynamic Link Library.) — C:\Program Files (x86)\Movies Toolbar\Datamngr\SRTOOL~1\IE\searchresultsDx.dll

—\\ Valeur de Registre AppInit_DLLs et sous-clés Winlogon Notify (autorun) (O20)
O20 – AppInit_DLLs: . (…) – C:\Program Files\Movies Toolbar\SafetyNut\safetyldr.dll

—\\ Liste des services NT non Microsoft et non désactivés (O23)
O23 – Service: Datamngr Coordinator (DatamngrCoordinator) . (.Bandoo Media Inc. – Datamngr Coordinator.) – C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe
O23 – Service: SafetyNut Manager (SafetyNutManager) . (.SafetyNut Inc. – SafetyNut Manager.) – C:\Program Files (x86)\Movies Toolbar\SafetyNut\SafetyNutManager.exe

—\\ Session Manager Key (AppCertDlls,KnownDLLs) (O36)
O36 – AppCertDlls: (x86) . (…) — C:\Program Files (x86)\Movies Toolbar\Datamngr\apcrtldr.dll
O36 – AppCertDlls: (x64) . (…) — C:\Program Files (x86)\Movies Toolbar\Datamngr\x64\apcrtldr.dll
O36 – AppCertDlls: (x86) . (…) — C:\Program Files (x86)\Movies Toolbar\SafetyNut\safetycrt.dll
O36 – AppCertDlls: (x64) . (…) — C:\Program Files (x86)\Movies Toolbar\SafetyNut\x64\safetycrt.dll

—\\ Logiciels installés (O42)
O42 – Logiciel: Movies Toolbar for Firefox (Dist. by Bandoo Media, Inc.) – (.APN LLC.) [HKLM][64Bits] — savevidmoviestoolbarFF
O42 – Logiciel: Movies Toolbar for Firefox (Dist. by Bandoo Media, Inc.) – (.IAC Search and Media.) [HKLM] — ilividmoviestoolbar181FF
O42 – Logiciel: Movies Toolbar for Firefox (Dist. by Somoto Ltd.) – (.APN LLC.) [HKLM] — somotomoviestoolbar1FF
O42 – Logiciel: Movies Toolbar for Chrome (Dist. by Bandoo Media, Inc.) – (.IAC Search and Media.) [HKLM] — ilividmoviestoolbar181CR
O42 – Logiciel: Movies Toolbar for Chrome (Dist. by Somoto Ltd.) – (.APN LLC.) [HKLM] — somotomoviestoolbar1CR
O42 – Logiciel: Movies Toolbar for Internet Explorer (Dist. by Somoto Ltd.) – (.APN LLC.) [HKLM] — somotomoviestoolbar1IE

—\\ HKCU & HKLM Software Keys
[HKCU\Software\AppDataLow\Software\koyotesoftmoviestoolbar]
[HKCU\Software\koyotesoftmoviestoolbar]
[HKLM\Software\Wow6432Node\DataMngr]
[HKCU\Software\DataMngr_Toolbar]

—\\ Contenu des dossiers Programs/ProgramFiles/ProgramData/AppData (O43)
O43 – CFD: 13/08/2013 – 10:28:10 – [22,958] —-D C:\Program Files (x86)\Movies Toolbar
O43 – CFD: 11/03/2014 – 14:11:55 – [] —-D C:\Program Files\Movies Toolbar

—\\ Derniers fichiers créés par Windows Prefetcher (O45)
O45 – LFCP:[MD5.F3CDCDC57FC3A660BB4793FE8FBDEAE9] – 27/10/2013 – 22:51:16 —A- – C:\Windows\Prefetch\MOVIESTOOLBARSETUP_SOMOTO_9_1-178E4E29.pf

—\\ Export de clé d’application autorisée (O47)
O47 – AAKE:Key Export SP – “C:\Program Files\Movies Toolbar\SafetyNut\SRTOOL~1\IE\dtUser.exe” [Enabled] .(.APN LLC.) — C:\Program Files\Movies Toolbar\SafetyNut\SRTOOL~1\IE\dtUser.exe

—\\ Derniers fichiers modifiés ou crées (Utilisateur) (O61)
O61 – LFC: 27/10/2013 – 00:03:08 —A- . (.SafetyNut Inc..) — C:\Users\Coolman\AppData\Local\Temp\MoviesToolbarSetup_Somoto_9_10_2013.exe [7884008]

—\\ Search Browser Infection (SBI) (O69)
O69 – SBI: SearchScopes [HKCU] {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} – (Ask.com) – http://dts.search.ask.com

—\\ Recherche particuliere à la racine de certains dossiers (SPRF) (O84)
[MD5.FC0CB8F2ADA86F7EC51F9FB6FFB56C19] [SPRF][27/10/2013] (.SafetyNut Inc. – Movies Toolbar Install.) — C:\Users\Coolman\AppData\Local\Temp\MoviesToolbarSetup_Somoto_9_10_2013.exe [7884008]

—\\ Firewall Active Exception List (FirewallRules) (O87)
O87 – FAEL: “{7DFE1E0F-2B4F-402E-8299-1D571EEF3F7F}” | In – Public – P6 – TRUE | .(.APN LLC – DtUser.) — C:\Program Files (x86)\Movies Toolbar\Datamngr\SRTOOL~1\IE\dtUser.exe
O87 – FAEL: “{F47C7110-6B3B-4176-BFA9-2140611F664D}” | In – Public – P17 – TRUE | .(.APN LLC – DtUser.) — C:\Program Files (x86)\Movies Toolbar\Datamngr\SRTOOL~1\IE\dtUser.exe

—\\ Etat général des services non Microsoft (EGS) (SR=Running, SS=Stopped)
SR – | Auto 12/08/2013 3360256 | (DatamngrCoordinator) . (.Bandoo Media Inc..) – C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe
SR – | Auto 09/10/2013 3422728 | (SafetyNutManager) . (.SafetyNut Inc..) – C:\Program Files (x86)\Movies Toolbar\SafetyNut\SafetyNutManager.exe

—\\ Scan Additionnel (O88 )
[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{609BBD0C-AC47-40E5-B047-27520779C4C9}]
[HKLM\Software\Classes\CLSID\{609BBD0C-AC47-40E5-B047-27520779C4C9}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{609BBD0C-AC47-40E5-B047-27520779C4C9}]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{609BBD0C-AC47-40E5-B047-27520779C4C9}]
[HKLM\SYSTEM\CurrentControlSet\Services\DatamngrCoordinator]
[HKLM\SYSTEM\CurrentControlSet\Services\SafetyNutManager]
[HKCU\Software\AppDataLow\Software\koyotesoftmoviestoolbar]
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ilividmoviestoolbardlaFF]
[HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\savevidmoviestoolbarFF]
[HKCU\Software\DataMngr_Toolbar]
[HKCU\Software\koyotesoftmoviestoolbar]
[HKLM\Software\Google\Chrome\Extensions\aaaaabcbmongicmdegkmmfgdickgnnob]
[HKLM\Software\Google\Chrome\Extensions\aaaaimdcedbpbcjjbbnfcbbjcngmomic]
C:\Users\Coolman\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaabcbmongicmdegkmmfgdickgnnob
C:\Users\Coolman\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaimdcedbpbcjjbbnfcbbjcngmomic
C:\Program Files\Movies Toolbar\SafetyNut\SRTOOL~1\IE\dtUser.exe
C:\Program Files (x86)\Movies Toolbar\Datamngr
C:\Program Files (x86)\Movies Toolbar\Datamngr\SRTOOL~1\IE\searchresultsDx.dll
C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrCoordinator.exe
C:\Program Files (x86)\Movies Toolbar\Datamngr\DatamngrUI.exe
C:\Program Files (x86)\Movies Toolbar\Datamngr\Internet Explorer Settings.exe

—\\ Recherche de clés de registre CLSID (O101)
[HKCR\CLSID\{3444c3c5-6c56-4a16-a453-832b05bf6ea4}] (Movies Toolbar (Dist. by Somoto Ltd.))

Liens :

www.systemlookup.com
malwaretips.com

Alias :

PUP.Optional.MoviesToolbar.A [Malwarebytes]
PUP.Datamngr
Adware.Bandoo

Supprimer (Remove) :

– Supprimer l’extension “Movies Toolbar” de tous les navigateurs installés,
– Supprimer le logiciel “Movies Toolbar” via le panneau de configuration Windows,
– Modifier les pages de recherche et de démarrage de tous les navigateurs installés,
– Vider le cache des navigateurs
Nettoyer avec ZHPCleaner[/fusion_builder_column][/fusion_builder_row][/fusion_builder_container]

Retour haut de page