AML Free Registry Cleaner

[chantal11]

Contenu republié avec la permission de Malwarebytes

AML Free Registry Cleaner est un adware (logiciel publicitaire), qui affiche des publicités intempestives indépendantes des sites visités.

•   S'installe en tant que programme, soit à l'insu de l'utilisateur ou parce qu'il n'a pas décoché les sponsors proposés lors de l'installation d'un logiciel gratuit légitime, soit depuis le site de l'éditeur

• Affiche ces alertes pendant l'installation

• Affiche cet écran principal

• Affiche cette alerte pendant les opérations

• Crée ces icônes sur le Bureau et dans le Menu Démarrer

**********

Détection de AML Free Registry Cleaner dans des rapports FRST :

AML Free Registry Cleaner 4.25 (HKLM-x32\...\{315F5FFC-1A5C-4A2A-B8E7-1C5B1174C198}_is1) (Version:  - AML SOFT, Inc.)

(AML Software - AMLSOFT.COM) C:\Program Files (x86)\AML Products\Registry Cleaner\regclean.exe
HKLM-x32\...\Run: [AML Registry Cleaner] => C:\Program Files (x86)\AML Products\Registry Cleaner\regclean.exe [570448 2013-06-24] (AML Software - AMLSOFT.COM)
C:\Users\{Nom_Utilisateur}\Desktop\AML Free Registry Cleaner.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AML Free Registry Cleaner
C:\Program Files (x86)\AML Products

**********

Détecté et traité par Malwarebytes en tant que PUP/LPI (Programme potentiellement Indésirable)

PUP.Optional.AMLRegistryCleaner

-Scan Details-
Process: 1
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\REGCLEAN.EXE, Quarantined, [9348], [404065],1.0.2071

Module: 3
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\MSVBVM60.DLL, Quarantined, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\REGCLEAN.EXE, Quarantined, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\STYLES\OFFICE2007.CJSTYLES, Quarantined, [9348], [404065],1.0.2071

Registry Key: 39
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7FC25D12-4726-4E59-82B9-3646C36EC852}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\Codejock.SkinFrameworkGlobalSettings.13.2.0, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{7FC25D12-4726-4E59-82B9-3646C36EC852}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{7FC25D12-4726-4E59-82B9-3646C36EC852}\InprocServer32, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A80E5B29-CD98-4345-92A0-6451DD531633}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\Codejock.SkinFramework.13.2.0, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{A80E5B29-CD98-4345-92A0-6451DD531633}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\TYPELIB\{BD0C1912-66C3-49CC-8B12-7B347BF6C846}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{128507E0-C56F-43C0-BCF1-8193B35FE4C4}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{2CE3C052-6C04-4596-A61E-FC6C6A14F738}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{40217CB8-4463-4030-B324-AC6A8075FEC8}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{63C40CBE-DE43-4B56-BCEB-E14B825CF245}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{64302D0E-6EDB-49A7-89DE-A0F37936759E}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{AFA0E6A1-28D7-4F2C-87A7-7266367B4655}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{C58A92D0-3EBE-4355-A6C9-5FECDC54922D}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\INTERFACE\{D4997761-BA1B-4099-B62C-D8220CB9E302}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{128507E0-C56F-43C0-BCF1-8193B35FE4C4}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{2CE3C052-6C04-4596-A61E-FC6C6A14F738}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{40217CB8-4463-4030-B324-AC6A8075FEC8}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{63C40CBE-DE43-4B56-BCEB-E14B825CF245}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{64302D0E-6EDB-49A7-89DE-A0F37936759E}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{AFA0E6A1-28D7-4F2C-87A7-7266367B4655}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{C58A92D0-3EBE-4355-A6C9-5FECDC54922D}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D4997761-BA1B-4099-B62C-D8220CB9E302}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{128507E0-C56F-43C0-BCF1-8193B35FE4C4}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{2CE3C052-6C04-4596-A61E-FC6C6A14F738}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{40217CB8-4463-4030-B324-AC6A8075FEC8}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{63C40CBE-DE43-4B56-BCEB-E14B825CF245}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{64302D0E-6EDB-49A7-89DE-A0F37936759E}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{AFA0E6A1-28D7-4F2C-87A7-7266367B4655}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{C58A92D0-3EBE-4355-A6C9-5FECDC54922D}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{D4997761-BA1B-4099-B62C-D8220CB9E302}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{BD0C1912-66C3-49CC-8B12-7B347BF6C846}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{BD0C1912-66C3-49CC-8B12-7B347BF6C846}, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A80E5B29-CD98-4345-92A0-6451DD531633}\InprocServer32, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{7FC25D12-4726-4E59-82B9-3646C36EC852}\InprocServer32, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{A80E5B29-CD98-4345-92A0-6451DD531633}\InprocServer32, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{315F5FFC-1A5C-4A2A-B8E7-1C5B1174C198}_is1, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, HKCU\SOFTWARE\AML\Registry Cleaner, Delete-on-Reboot, [9348], [404079],1.0.2071

Registry Value: 1
PUP.Optional.AMLRegistryCleaner, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|AML Registry Cleaner, Delete-on-Reboot, [9348], [404065],1.0.2071

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\Styles, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\PROGRAMDATA\MICROSOFT\WINDOWS\START MENU\PROGRAMS\AML FREE REGISTRY CLEANER, Delete-on-Reboot, [9348], [404068],1.0.2071

File: 22
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\MSVBVM60.DLL, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\REGCLEAN.EXE, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\PROGRAM FILES (X86)\AML PRODUCTS\REGISTRY CLEANER\STYLES\OFFICE2007.CJSTYLES, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\clean.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\Codejock.SkinFramework.Unicode.v13.2.0.ocx, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\english.dll, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\Exclude.lst, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\FRC.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\ftlist.txt, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\open.cpa, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\pm.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\regback.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\regclean.exe.manifest, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\regsearch.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\startup.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\sysres.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\unins000.dat, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\Program Files (x86)\AML Products\Registry Cleaner\unins000.exe, Delete-on-Reboot, [9348], [404065],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AML Free Registry Cleaner\AML Free Registry Cleaner.lnk, Delete-on-Reboot, [9348], [404068],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AML Free Registry Cleaner\Uninstall AML Free Registry Cleaner.lnk, Delete-on-Reboot, [9348], [404068],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\USERS\{username}\DESKTOP\AML FREE REGISTRY CLEANER.LNK, Delete-on-Reboot, [9348], [404071],1.0.2071
PUP.Optional.AMLRegistryCleaner, C:\USERS\{username}\DESKTOP\REGCLEANER.EXE, Delete-on-Reboot, [9348], [404072],1.0.2071

Physical Sector: 0
(No malicious items detected)

Tutoriel d'utilisation Malwarebytes en images


Source : Removal instructions for AML Free Registry Cleaner de Metallica - Malwarebytes Forums

Toujours infecté ? Une question avant de faire des manipulations ?

Venez poster un nouveau sujet dans ce forum : http://forum.security-x.fr/desinfections/  en prenant soin de suivre la procédure http://forum.security-x.fr/desinfections/procedure-preliminaire/