MeMedia.AdVantage détecté par spybot

[pear]

tout est OK

 

Vous voulez dire que vous n'avez plus de problème ?

 

Mmedia et le reste ?

[didoufr]

Vous voulez dire que vous n'avez plus de problème ?

 

Mmedia et le reste ?

 

non que tout est comme indiqué

je n'ai plus rien sauf ce mediavantage ! de crotte

pcdoctor ne le vois pas ni aucun autre logiciel unuiquement spybot par contre j'ai decouvert sous une flèche ( ce n'est pas moi ) un explication donnée par spybot en anglais, j'ai beau faire une traduction je ne comprends pas comment cette chose a pu arriver la voici ce texte

 

Société: MeMedia Inc. /WhenU

Produit: MeMedia.AdVantage

Menace: Adware

 

 

Fonctionnalités

Advertising component that is bundled with software to make it available without usage fees. Supposed to have contextual advertising delivered 4-5 times per day.

 

Description

Advantage runs visible with an icon in the taskbar, it connects to various WhenU and MeMedia sites. Once it completes its requests it will collect information about the user's surfing habits to address him with contextual advertising.

But not all advertising is contextual, on opening google.de a popup/-under will appear that advertises adult contacts. The Firefox add-on that is also installed can be disabled but does not uninstall with the rest of Advantage, it has to be uninstalled manually in contrast to its installation along the other Advantage components. MeMedia is the new company name for WhenU.

 

Déclaration vie privée

By downloading AdVantage (the “Software”), a product of MeMedia Inc. (“MeMedia”), you give permission to MeMedia to display relevant contextual pop-up ads, comparison shopping results and coupons while you are online. The Software selects which ads and offers to display based on several factors, including: Web pages you visit, terms you enter into search engines and other online forms, content of the Web pages you view and your IP address and zip code.

 

MeMedia is committed to serving highly relevant, contextual pop-up ads, comparison shopping results and coupons, while still providing consumers with industry-leading privacy protection. The Software protects your privacy by uploading a database of content in small chunks to your computer and then determining on your computer whether to retrieve information from MeMedia or third-party servers. To protect your privacy, the same database of content is sent to all of our users. The determination of which ads to display to an individual user is made on the individual user’s own computer and isolated from MeMedia servers. In this way, MeMedia is able to deliver relevant coupons, information and advertisements without sending all of your browsing activity back to MeMedia and without establishing any profile about you (even anonymously) on MeMedia servers.

 

Your privacy is also protected in the following manner:

Your personally-identifiable information is not required in order to use the Software. MeMedia does not know your individual identity and does not attempt to discern it in any way.

MeMedia does not assemble any personally-identifiable browsing profiles of you or your individual machine.

MeMedia does not assemble any anonymous machine-identifiable browsing profile of you or your machine.

The Software sends back to MeMedia servers anonymous information from your computer so that we can keep track of the number of users in our network and optimize the performance and relevance of the ads. For example, the Software may send MeMedia or a MeMedia partner a communication that includes information about the Webpage you were viewing when you saw or clicked on a particular ad, the term you entered into a search engine or online form and/or your IP address or zip code. MeMedia has intentionally designed these communications back to MeMedia or a MeMedia partner to be highly protective of user privacy in the following ways:

 

Each individual desktop is assigned an anonymous, unique machine ID. This machine ID is used only to enable MeMedia to count unique, active desktops in the network. The machine ID is not used to determine which ads to serve individual users or to create browsing profiles of users. All Software components will be removed upon uninstallation, except for your anonymous, unique machine ID, which remains in the registry.

When ads are requested and/or displayed by the Software, impressions and click-throughs, including the factor (e.g., the URL, keyword, search term, IP address, zip code or some combination thereof) that caused the ad to be displayed are reported to MeMedia.

The anonymous information that your computer sends back to MeMedia servers may be shared with MeMedia partners to improve the performance of the Software and to optimize the relevancy of the advertisements. MeMedia uses reasonable commercial efforts to restrict the further dissemination of such anonymous information by such partners. However, MeMedia does not control the activities of our partners and cannot prevent them from using or disseminating such anonymous information.

[pear]

Bonjour,

 

 

IL y a quelque chose que je ne comprends pas.

Normalement Toolbar&Sd nettoie Whenu:

 

Les programmes pris en compte :

 

Accoona, ActiveShopper, ADS Plugins, Adssite Advanced Toolbar, Adult-Links, AltNet, AntivirusGold, AskSBar, AskTBar, Browser Accelerator, BrowsingAdvisor, BrowsingEnhancer, BrowsingProgram, BrowsingSoftware, BrowsingTool, ContextAdvisor, ContextEnhancer, ContextProgram, ContextTool, Dealio, DR_S, ErrorsTool, EZshopper, FastFinder, FBrowserAdvisor, FBrowsingAdvisor, FFTOOLBAR ToolBar, GamesBar, Hbtools, HbTools_Icons, Hotbar, INSTAFIN, INSTAFINK, Instant Buzz, IntelligentAdvisor, InternetProgram, InternetSoftware, ISTbar, IstSvc, KaZaA, Mirar, Morpheus Toolbar, MyGlobalSearch, MyQuickSearch, MySearch, MyToolbar, MyTotalSearch, Myway, MyWaySearch, MyWebSearch, MyWebSearchWB, NavExcel, NavigationAdvisor, NavigationEnhancer, NavigationProgram, NavigationTool, Need2Find, PageRevisor, Push toolbar, P2P Networking, RXToolbar, Sbar Toolbar, SearchEssistant, Search Settings, Seekmo, Seekmo Programs, Seekmo Search Assistant, ShopNav, Shopper Report, ShopperReports, SideFind, SLMSS, Slotchbar, SmartShopper, Spam Blocker Utility, Starware, Starware305, Starware316, Starware343, Starware347, Starware354, Starware370, Starware390, StatsTool, SurfAccuracy, TrustIn Bar, Try2Find, UCmore, VSAdd-in, VS Toolbar, WeatherStudio,WhenU , WinAble, Wssclient, XXXToolbar, YourSiteBar, Zango, 2020Search, 7Search, ...

 

Voulez vous le relancer, svp ?

 

D'autre part, avez vous tenté cette procédure ?

3a- Désinstaller "AdVantage"

- Bouton "Démarrer" / "Panneau de configuration" / "Ajout-Suppression de programmes"

- Recherchez "AdVantage" et supprimez-le.

 

3b- Si la suppression échoue :

- Avec l'explorateur Windows allez dans le dossier C:\Program Files\advantage

- Puis double cliquez sur le fichier "advuninst.exe"

 

3c- Si cette méthode échoue encore le faire en mode sans échec.

 

4- Suppression du dossier "AdVantage"

- Avec l'explorateur Windows aller dans le dossier C:\Program Files

- Recherchez le dossier AdVantage et supprimez-le.

[didoufr]

Bonjour,

 

 

IL y a quelque chose que je ne comprends pas.

Normalement Toolbar&Sd nettoie Whenu:

 

 

 

Voulez vous le relancer, svp ?

 

D'autre part, avez vous tenté cette procédure ?

re bonjour

je n'ai pas de adVantage a desinstaller

je n'ai pas de repertoire du même nom

la recherche ne me trouve rien d'approchant

 

voici le 1er rapport avec tb ensuite le second après suppression

'© Eric_71 ( Contact : eric.71.MesPages@gmail.com )

On Error Resume Next

Dim fso

Set FSO = CreateObject("Scripting.FileSystemObject")

Set FTX = FSO.createTextFile("OS_v.txt",true)

strComputer = "."

Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & _

strComputer & "\root\cimv2")

 

Set OS__infos = objWMIService.ExecQuery("Select * from Win32_OperatingSystem")

Set BO__infos = objWMIService.ExecQuery("Select * from Win32_ComputerSystem")

Set US__infos = objWMIService.ExecQuery("Select * from Win32_NetworkLoginProfile")

Set PR__infos = objWMIService.ExecQuery("Select * from Win32_Processor")

Set BI__infos = objWMIService.ExecQuery("Select * from Win32_BIOS")

Set DI__infos = objWMIService.ExecQuery("Select * from Win32_LogicalDisk",,48)

Set objWMISecurity = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter")

Set colAV = objWMISecurity.ExecQuery("Select * from AntiVirusProduct")

Set colFI = objWMISecurity.ExecQuery("Select * from FirewallProduct")

Set wshNetwork = CreateObject("WScript.Network")

strUser = wshNetwork.Username

For Each objOS__ in OS__infos

OSvers = objOS__.Caption & " ( v" & objOS__.Version & " ) " & objOS__.CSDVersion

OSbuild = objOS__.BuildType

Next

For Each objBO__ in BO__infos

BOprocT = objBO__.SystemType

Next

For Each objPR__ in PR__infos

PRprocN = objPR__.Name

Next

For Each objBI__ in BI__infos

BIbios = "BIOS : " & objBI__.Name

Next

For Each objUS__ in US__infos

If objUS__.Privileges = 2 Then

USuser = "USER : " & strUser & " ( Administrator )"

Else

USuser = "USER : " & strUser & " ( Not Administrator ! )"

End If

Next

For Each objBO__ in BO__infos

BOboot = "BOOT : " & objBO__.BootupState

Next

For Each objAV In colAV

If objAV.OnAccessScanningEnabled = 0 Then

AVstatus = "Not Activated"

Else

AVstatus = "Activated"

End If

Next

For Each objFI In colFI

If objFI.Enabled = 0 Then

FIstatus = "Not Activated"

Else

FIstatus = "Activated"

End If

Next

For Each objAV in colAV

AVstat = "Antivirus : " & objAV.DisplayName & " " & objAV.VersionNumber & " (" & AVstatus & ")"

Next

For Each objFI In colFI

FIstat = "Firewall : " & objFI.DisplayName & " " & objFI.VersionNumber & " (" & FIstatus & ")"

Next

For Each objDI__ in DI__infos

Select Case objDI__.DriveType

Case 1 strTL = "..."

Case 2 strTL = "USB"

Case 3 strTL = "Local Disk"

Case 4 strTL = "Network Disk"

Case 5 strTL = "CD or DVD"

Case 6 strTL = "RAM"

Case Else strTL = "..."

End Select

If objDI__.DriveType =2 Then

strTD = Int(objDI__.Size /1048576) & " Mo"

Else

strTD = Int(objDI__.Size /1073741824) & " Go"

End If

if strTD = " Go" Then

strDI = strDI & objDI__.Name & "\ (" & strTL & ")" & vbCrlf

elseif strTD = " Mo" Then

strDI = strDI & objDI__.Name & "\ (" & strTL & ")" & vbCrlf

else

strDI = strDI & objDI__.Name & "\ (" & strTL & ") - " & objDI__.FileSystem & _

" - Total:" & strTD & " (Free:" & Int(objDI__.FreeSpace /1073741824) & " Go)" & vbCrlf

end if

Next

FTX.writeline OSvers

FTX.writeline BOprocT & " ( " & OSbuild & " : " & PRprocN & " )"

FTX.writeline BIbios

FTX.writeline USuser

FTX.writeline BOboot

FTX.writeline ""

FTX.writeline AVstat

FTX.writeline FIstat

FTX.writeline ""

FTX.writeline strDI

FTX.close

 

 

encore un rapport

-----------\\ ToolBar S&D 1.2.4 XP/Vista

 

 

"C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )

Option : [1] ( 29/10/2008|17:41 )

 

[ UAC => 1 ]

 

-----------\\ Recherche de Fichiers / Dossiers ...

 

 

-----------\\ [..\Internet Explorer\Main]

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"Local Page"="C:\\Windows\\system32\\blank.htm"

"Search Page"="http://www.google.com"

"Search Bar"="http://www.google.com/ie"

"Start Page"="http://www.google.fr/"

"Url"="http://go.microsoft.com/fwlink/?LinkId=75720"

 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]

"Start Page"="http://www.msn.com/"

"Default_Page_URL"="http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=81&bd=Pavilion&pf=desktop"

"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"'>http://go.microsoft.com/fwlink/?LinkId=54896"

"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"

 

 

--------------------\\ Recherche d'autres infections

 

--------------------\\ Cracks & Keygens ..

 

C:\Users\hp\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@crackserialkeygen[2].txt

C:\Users\hp\Documents\Downloads\Nero 7.5.9\keygen.exe

C:\Users\hp\Favorites\cracks etc

C:\Users\hp\Favorites\cracks etc\Crack et S‚rial.url

C:\Users\hp\Favorites\cracks etc\Les Cracks de Superg‚g‚.url

C:\Users\hp\Favorites\torrent\Bit Torrent Search Engine eMule BitTorrent Binary Usenet Serials Cracks.url

 

 

[ UAC => 1 ]

 

 

1 - "C:\ToolBar SD\TB_1.txt" - 29/10/2008|17:41 - Option : [1]

 

-----------\\ Fin du rapport a 17:41:43.27

 

un autre après 2)

'© Eric_71 ( Contact : eric.71.MesPages@gmail.com )

On Error Resume Next

Dim fso

Set FSO = CreateObject("Scripting.FileSystemObject")

Set FTX = FSO.createTextFile("OS_v.txt",true)

strComputer = "."

Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & _

strComputer & "\root\cimv2")

 

Set OS__infos = objWMIService.ExecQuery("Select * from Win32_OperatingSystem")

Set BO__infos = objWMIService.ExecQuery("Select * from Win32_ComputerSystem")

Set US__infos = objWMIService.ExecQuery("Select * from Win32_NetworkLoginProfile")

Set PR__infos = objWMIService.ExecQuery("Select * from Win32_Processor")

Set BI__infos = objWMIService.ExecQuery("Select * from Win32_BIOS")

Set DI__infos = objWMIService.ExecQuery("Select * from Win32_LogicalDisk",,48)

Set objWMISecurity = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\SecurityCenter")

Set colAV = objWMISecurity.ExecQuery("Select * from AntiVirusProduct")

Set colFI = objWMISecurity.ExecQuery("Select * from FirewallProduct")

Set wshNetwork = CreateObject("WScript.Network")

strUser = wshNetwork.Username

For Each objOS__ in OS__infos

OSvers = objOS__.Caption & " ( v" & objOS__.Version & " ) " & objOS__.CSDVersion

OSbuild = objOS__.BuildType

Next

For Each objBO__ in BO__infos

BOprocT = objBO__.SystemType

Next

For Each objPR__ in PR__infos

PRprocN = objPR__.Name

Next

For Each objBI__ in BI__infos

BIbios = "BIOS : " & objBI__.Name

Next

For Each objUS__ in US__infos

If objUS__.Privileges = 2 Then

USuser = "USER : " & strUser & " ( Administrator )"

Else

USuser = "USER : " & strUser & " ( Not Administrator ! )"

End If

Next

For Each objBO__ in BO__infos

BOboot = "BOOT : " & objBO__.BootupState

Next

For Each objAV In colAV

If objAV.OnAccessScanningEnabled = 0 Then

AVstatus = "Not Activated"

Else

AVstatus = "Activated"

End If

Next

For Each objFI In colFI

If objFI.Enabled = 0 Then

FIstatus = "Not Activated"

Else

FIstatus = "Activated"

End If

Next

For Each objAV in colAV

AVstat = "Antivirus : " & objAV.DisplayName & " " & objAV.VersionNumber & " (" & AVstatus & ")"

Next

For Each objFI In colFI

FIstat = "Firewall : " & objFI.DisplayName & " " & objFI.VersionNumber & " (" & FIstatus & ")"

Next

For Each objDI__ in DI__infos

Select Case objDI__.DriveType

Case 1 strTL = "..."

Case 2 strTL = "USB"

Case 3 strTL = "Local Disk"

Case 4 strTL = "Network Disk"

Case 5 strTL = "CD or DVD"

Case 6 strTL = "RAM"

Case Else strTL = "..."

End Select

If objDI__.DriveType =2 Then

strTD = Int(objDI__.Size /1048576) & " Mo"

Else

strTD = Int(objDI__.Size /1073741824) & " Go"

End If

if strTD = " Go" Then

strDI = strDI & objDI__.Name & "\ (" & strTL & ")" & vbCrlf

elseif strTD = " Mo" Then

strDI = strDI & objDI__.Name & "\ (" & strTL & ")" & vbCrlf

else

strDI = strDI & objDI__.Name & "\ (" & strTL & ") - " & objDI__.FileSystem & _

" - Total:" & strTD & " (Free:" & Int(objDI__.FreeSpace /1073741824) & " Go)" & vbCrlf

end if

Next

FTX.writeline OSvers

FTX.writeline BOprocT & " ( " & OSbuild & " : " & PRprocN & " )"

FTX.writeline BIbios

FTX.writeline USuser

FTX.writeline BOboot

FTX.writeline ""

FTX.writeline AVstat

FTX.writeline FIstat

FTX.writeline ""

FTX.writeline strDI

FTX.close

[pear]

je n'ai pas de adVantage a desinstaller

je n'ai pas de repertoire du même nom

la recherche ne me trouve rien d'approchant

 

Et pourtant, vous vez toujours ce satané message.

 

Cherchez dans le règistre:

Exécuter->Regedit

Positionnez vous sur Poste de travail ,à gauche

 

Edition ->Rechercher

Tapez MMEDIA

vous devriez le trouver.

Notez la clé trouvée qui s'inscrit au bas de l'écran.

Positionnez vous sur MMEDIA à droite pour le mettre en surbrillance

Clic droit ->Supprimer

Acceptez la modification du régistre

appuyez sur la touche F3 pour continuer la recherche jusqu'à ce qu'apparaisse "Recherche terminée"

 

Postez ce que vous avez trouvé.

 

Si vous répugnez à utiliser Regedit, voyez Vilma Registry

http://speedweb1.free.fr/frames2.php?page=outils5

En tapant MMEDIA dans l'onglet de recherche, vous aurez tous les résultats d'un seul coup.

[didoufr]

bonjour

je trouve des NMMediaServer.EXE et autre NM mais pas de MM NM etant apparament deprendant de nero

 

j'ai quelques IWMMedialibraryresultset

[pear]

Incompréhensible!.

 

Ces mots

Société:

MeMedia Inc. /WhenU

Produit:

MeMedia.AdVantage

Vous devriez les trouver soit dans le régistre , soit dans votre partition système àmoins qu'ils ne soient cachés dans un log qui les lance.

Voyons si on trouve quelque chose de suspect dans ce qui se lance au démarrage:

 

Copiez /collez dans le bloc notes.

Enregistrez , sur le bureau, sous reg.bat

Double clic pour lancer.

Postez le résultat.

 

regedit /a /e %systemdrive%\regkey.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

notepad %systemdrive%\regkey.txt

del /q %systemdrive%\regkey.txt

 

Il se pourrait que Bitdefender le connaisse:

 

Essayez un scanen ligne:http://www.bitdefender.fr/scan_fr/scan8/ie.html

Modifié le 4 novembre 2008 par pear

[didoufr]

Incompréhensible!.

 

Ces mots

Société:

Produit:

Vous devriez les trouver soit dans le régistre , soit dans votre partition système àmoins qu'ils ne soient cachés dans un log qui les lance.

Voyons si on trouve quelque chose de suspect dans ce qui se lance au démarrage:

 

Copiez /collez dans le bloc notes.

Enregistrez , sur le bureau, sous reg.bat

Double clic pour lancer.

Postez le résultat.

 

regedit /a /e %systemdrive%\regkey.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

notepad %systemdrive%\regkey.txt

del /q %systemdrive%\regkey.txt

 

Il se pourrait que Bitdefender le connaisse:

 

Essayez un scanen ligne:http://www.bitdefender.fr/scan_fr/scan8/ie.html

voici deja un rapport je file sur bitdefender

 

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"=hex(2):25,50,72,6f,67,72,61,6d,46,69,6c,65,73,25,5c,57,69,\

6e,64,6f,77,73,20,44,65,66,65,6e,64,65,72,5c,4d,53,41,53,43,75,69,2e,65,78,\

65,20,2d,68,69,64,65,00

"hpsysdrv"="c:\\hp\\support\\hpsysdrv.exe"

"KBD"="C:\\HP\\KBD\\KbdStub.EXE"

"StartCCC"="\"c:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\CLIStart.exe\""

"RtHDVCpl"="RtHDVCpl.exe"

"SunJavaUpdateReg"="\"C:\\Windows\\system32\\jureg.exe\""

@=""

"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"

"avgnt"="\"C:\\Program Files\\Avira\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"

"NBKeyScan"="\"C:\\Program Files\\Nero\\Nero8\\Nero BackItUp\\NBKeyScan.exe\""

"WinampAgent"="\"C:\\Program Files\\Winamp\\winampa.exe\""

"ISTray"="\"C:\\Program Files\\Spyware Doctor\\pctsTray.exe\""

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

@=""

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]

"Installed"="1"

@=""

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]

"NoChange"="1"

"Installed"="1"

@=""

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]

"Installed"="1"

@=""

[didoufr]

bitdefender refuse le scan

je vais voir d'autre scan en ligne !!

[pear]

Je viens de relire mon dernier message.

Ces mots

Société:

Produit:

Vous devriez les trouver soit dans le régistre , soit dans votre partition système àmoins qu'ils ne soient cachés dans un log qui les lance.

Voyons si on trouve quelque chose de suspect dans ce qui se lance au démarrage:

 

Je voulais dire Société: Memedia produit:Advantage.

Il semble que cela puisse s'inscrire dans le régistre aussi sous Meme.