Imprimer la page - AML Free Registry Cleaner

Forum Security-X => Sécurité Générale => Malwares => Discussion démarrée par: chantal11 le juin 07, 2017, 10:58:48

Titre: AML Free Registry Cleaner
Posté par: chantal11 le juin 07, 2017, 10:58:48

Contenu republié avec la permission de Malwarebytes (https://forums.malwarebytes.org/index.php?showforum=39)

AML Free Registry Cleaner est un adware (logiciel publicitaire), qui affiche des publicités intempestives indépendantes des sites visités.

S'installe en tant que programme, soit à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime, soit depuis le site de l'éditeur

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/AMLFreeRegistryCleaner/warning4.png&key=4cecc558ffb0b5e01075731d79d0b190936bd57c1b8d4049d4946365175e955b)

Affiche ces alertes pendant l'installation

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/AMLFreeRegistryCleaner/warning1.png&key=f32b3cf732ba1d24d020d03d6eac8196164c6b1db36e5da1663b88a3e3f419a2)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/AMLFreeRegistryCleaner/warning2.png&key=fd95d51baa9f41bc5bd93182c8fa0c07c861dc29a2f91a7dcfb12b5ff8543c41)

Affiche cet écran principal

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/AMLFreeRegistryCleaner/main.png&key=c24dfa9f7001d603fcac36cd6fe0a215a343e910049f0da01d6e11c8b9a03085)

Affiche cette alerte pendant les opérations

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/AMLFreeRegistryCleaner/warning5.png&key=35915ef07cc7128f16234c2bb1ad38cda0d2cdfe6e0272de094b7cbbe70520c5)

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/AMLFreeRegistryCleaner/warning6.png&key=ef0cfacf111346d9c8533553969343de23bbe8a1c5cb8d86c26f82461f084c34)

Crée ces icônes sur le Bureau et dans le Menu Démarrer

(https://forums.malwarebytes.com/applications/core/interface/imageproxy/imageproxy.php?img=https://static-cdn.malwarebytes.org/pub_images/AMLFreeRegistryCleaner/icons.png&key=41545e7e3442523cd0f112205c4cf886bbd9dead99d273b26ede2f74f782c3c6)

**********

Détection de AML Free Registry Cleaner dans des rapports FRST :

Citer

AML Free Registry Cleaner 4.25 (HKLM-x32\...\{315F5FFC-1A5C-4A2A-B8E7-1C5B1174C198}_is1) (Version: - AML SOFT, Inc.)

(AML Software - AMLSOFT.COM) C:\Program Files (x86)\AML Products\Registry Cleaner\regclean.exe
HKLM-x32\...\Run: [AML Registry Cleaner] => C:\Program Files (x86)\AML Products\Registry Cleaner\regclean.exe [570448 2013-06-24] (AML Software - AMLSOFT.COM)
C:\Users\{Nom_Utilisateur}\Desktop\AML Free Registry Cleaner.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AML Free Registry Cleaner
C:\Program Files (x86)\AML Products

**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)

Citer

PUP.Optional.AMLRegistryCleaner

Citer

-Scan Details-
Process: 1
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\REGCLEAN.EXE, Quarantined, [9348], [404065],1.0.2071

Module: 3
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\MSVBVM60.DLL, Quarantined, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\REGCLEAN.EXE, Quarantined, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\STYLES\OFFICE2007.CJSTYLES, Quarantined, [9348], [404065],1.0.2071

Registry Key: 39
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7FC25D12-4726-4E59-82B9-3646C36EC852}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\Codejock.SkinFrameworkGlobalSettings.13.2.0, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{7FC25D12-4726-4E59-82B9-3646C36EC852}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7FC25D12-4726-4E59-82B9-3646C36EC852}\InprocServer32, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A80E5B29-CD98-4345-92A0-6451DD531633}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\Codejock.SkinFramework.13.2.0, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{A80E5B29-CD98-4345-92A0-6451DD531633}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\TYPELIB\{BD0C1912-66C3-49CC-8B12-7B347BF6C846}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{128507E0-C56F-43C0-BCF1-8193B35FE4C4}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{2CE3C052-6C04-4596-A61E-FC6C6A14F738}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{40217CB8-4463-4030-B324-AC6A8075FEC8}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{63C40CBE-DE43-4B56-BCEB-E14B825CF245}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{64302D0E-6EDB-49A7-89DE-A0F37936759E}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{AFA0E6A1-28D7-4F2C-87A7-7266367B4655}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{C58A92D0-3EBE-4355-A6C9-5FECDC54922D}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{D4997761-BA1B-4099-B62C-D8220CB9E302}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{128507E0-C56F-43C0-BCF1-8193B35FE4C4}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2CE3C052-6C04-4596-A61E-FC6C6A14F738}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{40217CB8-4463-4030-B324-AC6A8075FEC8}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{63C40CBE-DE43-4B56-BCEB-E14B825CF245}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{64302D0E-6EDB-49A7-89DE-A0F37936759E}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AFA0E6A1-28D7-4F2C-87A7-7266367B4655}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C58A92D0-3EBE-4355-A6C9-5FECDC54922D}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D4997761-BA1B-4099-B62C-D8220CB9E302}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{128507E0-C56F-43C0-BCF1-8193B35FE4C4}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{2CE3C052-6C04-4596-A61E-FC6C6A14F738}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{40217CB8-4463-4030-B324-AC6A8075FEC8}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{63C40CBE-DE43-4B56-BCEB-E14B825CF245}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{64302D0E-6EDB-49A7-89DE-A0F37936759E}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{AFA0E6A1-28D7-4F2C-87A7-7266367B4655}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{C58A92D0-3EBE-4355-A6C9-5FECDC54922D}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{D4997761-BA1B-4099-B62C-D8220CB9E302}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{BD0C1912-66C3-49CC-8B12-7B347BF6C846}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{BD0C1912-66C3-49CC-8B12-7B347BF6C846}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A80E5B29-CD98-4345-92A0-6451DD531633}\InprocServer32, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{7FC25D12-4726-4E59-82B9-3646C36EC852}\InprocServer32, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{A80E5B29-CD98-4345-92A0-6451DD531633}\InprocServer32, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{315F5FFC-1A5C-4A2A-B8E7-1C5B1174C198}_is1, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKCU\SOFTWARE\AML\Registry Cleaner, Delete-on-Reboot, [9348], [404079],1.0.2071

Registry Value: 1
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|AML Registry Cleaner, Delete-on-Reboot, [9348], [404065],1.0.2071

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\Styles, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AML FREE REGISTRY CLEANER, Delete-on-Reboot, [9348], [404068],1.0.2071

File: 22
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\MSVBVM60.DLL, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\REGCLEAN.EXE, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\STYLES\OFFICE2007.CJSTYLES, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\clean.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\Codejock.SkinFramework.Unicode.v13.2.0.ocx, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\english.dll, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\Exclude.lst, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\FRC.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\ftlist.txt, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\open.cpa, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\pm.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\regback.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\regclean.exe.manifest, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\regsearch.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\startup.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\sysres.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\unins000.dat, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\unins000.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AML Free Registry Cleaner\AML Free Registry Cleaner.lnk, Delete-on-Reboot, [9348], [404068],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AML Free Registry Cleaner\Uninstall AML Free Registry Cleaner.lnk, Delete-on-Reboot, [9348], [404068],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\USERS\{username}\DESKTOP\AML FREE REGISTRY CLEANER.LNK, Delete-on-Reboot, [9348], [404071],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\USERS\{username}\DESKTOP\REGCLEANER.EXE, Delete-on-Reboot, [9348], [404072],1.0.2071

Physical Sector: 0
(No malicious items detected)

Tutoriel d'utilisation Malwarebytes en images (https://forum.security-x.fr/tutoriels-317/tutoriel-malwarebytes-anti-malware-22723/)

Source : Removal instructions for AML Free Registry Cleaner de Metallica - Malwarebytes Forums (https://forums.malwarebytes.com/topic/202102-removal-instructions-for-aml-free-registry-cleaner/)

Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/ en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/