Rapport hijackthis

Bonjour,
voici un rapport de hijackthis a analyser merci d'avance

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:16:34, on 26/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\PPStream\PPStream.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\StormII\stormliv.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\PROGRA~1\TVAnts\Tvants.exe
C:\WINDOWS\explorer.exe
C:\Program Files\SopCast\SopCast.exe
C:\Program Files\SopCast\adv\SopAdver.exe
C:\Documents and Settings\fourcade\Bureau\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files\FlashGet Network\Flashget\ComDlls\bhoCATCH.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SBCSTray] C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [FlashGet] "C:\Program Files\FlashGet Network\Flashget\FlashGet.exe" /min
O4 - HKLM\..\Run: [OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: PPS.lnk = C:\Program Files\PPStream\PPStream.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: UseFlashGet - C:\Program Files\FlashGet Network\Flashget\ComDlls\Bholink.htm
O8 - Extra context menu item: UseFlashGetDownloadAllLink - C:\Program Files\FlashGet Network\Flashget\ComDlls\Bhoall.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
Configuration: Windows XP
Firefox 2.0.0.14

22 réponses

  1. Que donne la 2nde?
    Tu as le CD d'install de Windows?

    PS: Merci le Sioux !
    1. je ne peut plus afficher le panneau de configuration en affichage par catégorie
      la phrase n'y est plus
      1. j'ai fait la premiere manip
        en fait le message d'errur apparait au demarrage de l'ordi
        1. Contributeur sécurité
          Bonsoir

          Je viens jeter un oeil sur demande de Regenium.

          * Pour ta barre des taches :
          Télécharge Zebrestore http://telechargement.zebulon.fr/233-zeb-restore.html

          Met le dans un dossier sur ton Bureau par exemple.

          Lance Zebrestore et coche les cases suivante :

          Panneau de config
          Bureau

          et clique sur le bouton "Restaurer".

          Quitte le programme et dis moi si ces fonctions remarchent ;-)

          * Pour ton panneau de config, tu peux basculer vers autre affichage via "basculer vers l affichage des catégories" a gauche en haut du panneau de config.

          * Pour le message d'erreur qui apparait a chaque demarrage generic hosts process for win32 a rencontré un probleme et doit fermer

          1ere chose à essayer :

          Démarrer / exécuter tapes services.msc

          Navigue jusqu au Service: Client DNS

          Clique droit
          sur la ligne du service en question puis arrêter
          Clique droit a nouveau puis propriétés et a type de Démarrage mettre sur désactivé puis valider par appliquer et ok

          2 nd essai

          Muni toi du cd Windows car il te sera sans doute demander puis

          Démarrer / exécuter tapes cmd puis sfc /scannow

          Dis moi ce que cela donne

          * Par ailleurs, je te conseille de désinstaller Flashget puis de poster un nouveau rapport HijackThis une fois cela fait.

          @ suivre.
          1. Ca peut venir de là...
            As tu tenté de faire une réparation de Windows?

            Je dois filer,

            J'ai demandé de l'aide de la part d'une autre personne avec un peu de chance elle te répondra bientôt !

            A+
            1. oui jai laissé faire la defragmentation mais quant je suis revenue 15 minutes aprés le pc était en veille
              c'est grave?
              1. La défragmentation s'est elle arrêtée en plein milieu / avais-tu la veille automatique activée?
                1. non en fait j'ai defragmenté puis j'ai redemarrer l'ordi et ca a fait ca.de plus mon ordi est lent
                  1. Comme ca nonn, désolé !
                    tu devrais faire un nouveau post (celui-ci est marqué comme résolu) avec la description du pbm.
                    Peut être une capture d'écran pourrait aider

                    Ces pbm sont récents?
                    Suite au télécharment d'un fichier ou à la visite d'un site verreux?
                    1. merci pour tes conseils jai reinstaller l'imprimante mais rien n'y fait
                      une reparation de windows c'est avec la console de récupération non?
                      aussi je voulais te demander j'ai le panneau de configuration qui est pas en affichage classique et la barre des taches qui parfois se met en blanc
                      y aurait t'il un autre probleme
                    2. Hello,

                      A priori, il n'y a pas d'infection mais voici un lien qui pourra t'aider:
                      https://forum.zebulon.fr/topic/66066-r%C3%A9soudre-lerreur-g%C3%A9n%C3%A9ric-host-process-for-win32/
                      Par contre j'ajouterais un firewall plus costaud que celui d'XP (ZA par ex: https://www.malekal.com/tutoriel-zonealarm-firewall/ )

                      T'as bien mis à jour Windows et Kaspersky régulièrement? (c'est le message d'un vieux vers appelé Blaster)
                      Perso, je commencerais par enlever les périphériques (facile et rapide) imprimante, scanner... et voir si ca change quoi que ce soit.
                      Après je tenterais une restauration du systeme à une date antérieure si cette alerte est récente.
                      Puis une réparation de Windows (pas de formatage)

                      Si toujours rien, fais le moi savoir
                      1. oui j'ai un message d'erreur qui apparait a chaque demarrage generic hosts process for win32 a rencontré un probleme et doit fermer
                        merci de ton aide
                        1. oui j'ai un message d'erreur qui apparait a chaque demarrage generic hosts process for win32 a rencontré un probleme et doit fermer
                          merci de ton aide
                          1. Hello,

                            oublis ce que j'ai mis plus haut, tes 2 fichiers sont sains.
                            A la rigueur tu peux fixer cette ligne avec hijackthis:
                            O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

                            Mais sinon je ne vois rien de suspect.

                            As-tu des symptomes particulier?
                            1. Antivirus Version Dernière mise à jour Résultat
                              AhnLab-V3 2008.4.25.2 2008.04.25 -
                              AntiVir 7.8.0.10 2008.04.25 -
                              Authentium 4.93.8 2008.04.26 -
                              Avast 4.8.1169.0 2008.04.26 -
                              AVG 7.5.0.516 2008.04.26 -
                              BitDefender 7.2 2008.04.26 -
                              CAT-QuickHeal 9.50 2008.04.26 -
                              ClamAV 0.92.1 2008.04.26 -
                              DrWeb 4.44.0.09170 2008.04.26 -
                              eSafe 7.0.15.0 2008.04.21 -
                              eTrust-Vet 31.3.5736 2008.04.26 -
                              Ewido 4.0 2008.04.26 -
                              F-Prot 4.4.2.54 2008.04.26 -
                              F-Secure 6.70.13260.0 2008.04.26 -
                              FileAdvisor 1 2008.04.26 -
                              Fortinet 3.14.0.0 2008.04.26 -
                              Ikarus T3.1.1.26.0 2008.04.26 -
                              Kaspersky 7.0.0.125 2008.04.26 -
                              McAfee 5282 2008.04.25 -
                              Microsoft 1.3408 2008.04.22 -
                              NOD32v2 3057 2008.04.26 -
                              Norman 5.80.02 2008.04.25 -
                              Panda 9.0.0.4 2008.04.26 -
                              Prevx1 V2 2008.04.26 Heuristic: Suspicious Backdoor
                              Rising 20.41.52.00 2008.04.26 -
                              Sophos 4.28.0 2008.04.26 -
                              Sunbelt 3.0.1056.0 2008.04.17 -
                              Symantec 10 2008.04.26 -
                              TheHacker 6.2.92.294 2008.04.26 -
                              VBA32 3.12.6.5 2008.04.26 -
                              VirusBuster 4.3.26:9 2008.04.26 -
                              Webwasher-Gateway 6.6.2 2008.04.26 -
                              Information additionnelle
                              File size: 2179072 bytes
                              MD5...: efe4585ddf09ffb39852c9e8565e1e69
                              SHA1..: 5107a487d99b6d65ac23fc4e5c6de9e21b25f05f
                              SHA256: e68b4d85c4c1e53ffdd3713e59ac2bb59ccfdb52fb882e20a8ce4c35ec769dc0
                              SHA512: 4cee6fcbc8202327ce601b5090a3c9cc8c85fadf86f9c116d79fda1ae61e06be
                              b67ecb94f4d448c0c50b1aab9a6672ee07466ba5f0ae4788bf421a6fe153699b
                              PEiD..: -
                              PEInfo: PE Structure information

                              ( base data )
                              entrypointaddress.: 0x5350dd
                              timedatestamp.....: 0x476e7869 (Sun Dec 23 15:02:01 2007)
                              machinetype.......: 0x14c (I386)

                              ( 4 sections )
                              name viradd virsiz rawdsiz ntrpy md5
                              .text 0x1000 0x17c39c 0x17d000 6.59 f664c81013dfce8db352715ba2c2e7f0
                              .rdata 0x17e000 0x6ab0a 0x6b000 4.74 6e62455e0fae919d65af3345e292e58e
                              .data 0x1e9000 0xd1d8 0x7000 4.87 df23ccf07ae83ef2927808558c850576
                              .rsrc 0x1f7000 0x231b0 0x24000 4.04 0bc10ebf171f64ae11ce824cf391568b

                              ( 14 imports )
                              > KERNEL32.dll: UnhandledExceptionFilter, LockResource, GetModuleHandleA, InterlockedExchange, CompareStringA, SetThreadContext, FlushInstructionCache, InterlockedCompareExchange, VirtualAlloc, VirtualProtect, VirtualQuery, GlobalFree, GetTickCount, DuplicateHandle, CreateThread, SetThreadPriority, TerminateThread, IsBadReadPtr, lstrcpynA, IsBadWritePtr, FreeLibrary, SwitchToThread, GetThreadContext, CreateFileA, ReadProcessMemory, ExitProcess, GetModuleFileNameA, SetUnhandledExceptionFilter, TerminateProcess, LocalFree, GetPrivateProfileStringA, WritePrivateProfileStringA, CompareFileTime, Beep, GlobalAlloc, GlobalLock, GlobalUnlock, SystemTimeToFileTime, GetThreadTimes, GetCurrentProcess, GetProcessTimes, SuspendThread, GetThreadLocale, SetThreadExecutionState, ResumeThread, FileTimeToLocalFileTime, FileTimeToSystemTime, FreeResource, GetSystemInfo, SetLastError, GetTimeZoneInformation, GetSystemTime, MulDiv, lstrcmpiA, InterlockedDecrement, LocalAlloc, ResetEvent, WaitForSingleObject, GetLocalTime, GetCurrentProcessId, SetEvent, RaiseException, GetCurrentThread, EnumResourceNamesW, LoadLibraryA, lstrlenA, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, GetCurrentThreadId, GetLastError, MapViewOfFile, CloseHandle, UnmapViewOfFile, GetVersion, SetEnvironmentVariableA, GetDriveTypeA, GetCurrentDirectoryA, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, IsValidLocale, EnumSystemLocalesA, GetLocaleInfoA, GetUserDefaultLCID, GetStringTypeA, GetConsoleMode, GetConsoleCP, LCMapStringA, GetDateFormatA, GetTimeFormatA, GetOEMCP, GetACP, QueryPerformanceCounter, VirtualFree, HeapCreate, HeapDestroy, GetStartupInfoA, GetFileType, SetHandleCount, GetCommandLineW, GetCommandLineA, GetEnvironmentStrings, FreeEnvironmentStringsA, GetStdHandle, HeapSize, ExitThread, IsDebuggerPresent, SizeofResource, HeapReAlloc, GetSystemTimeAsFileTime, RtlUnwind, GetProcessHeap, HeapAlloc, HeapFree, LoadResource, Sleep, GetVersionExA, GlobalDeleteAtom, lstrcmpA, TlsGetValue, GlobalReAlloc, GlobalHandle, TlsAlloc, TlsSetValue, LocalReAlloc, TlsFree, EnumResourceLanguagesW, ConvertDefaultLocale, InterlockedIncrement, FindClose, ReadFile, WriteFile, SetFilePointer, FlushFileBuffers, LockFile, UnlockFile, SetEndOfFile, GetFileSize, ReleaseMutex, SetFileTime, GetFileTime, GlobalFlags, LocalFileTimeToFileTime, SetErrorMode
                              > ADVAPI32.dll: CreateServiceW, SetFileSecurityW, GetFileSecurityW, RegisterServiceCtrlHandlerW, SetServiceStatus, StartServiceCtrlDispatcherW, QueryServiceStatus, DeregisterEventSource, DeleteService, RegisterEventSourceW, ReportEventW, RegCloseKey, OpenSCManagerW, OpenServiceW, CloseServiceHandle
                              > USER32.dll: GetWindow, IsChild, IsWindowEnabled, GetDlgItem, GetAsyncKeyState, TranslateMessage, IsRectEmpty, SetRect, SetRectEmpty, SetFocus, MsgWaitForMultipleObjects, SetClipboardData, CloseClipboard, EmptyClipboard, OpenClipboard, MoveWindow, ShowWindow, GetLastActivePopup, MessageBoxA, SetParent, FillRect, UnregisterClassA, GetNextDlgGroupItem, InvalidateRgn, LockWindowUpdate, GetDCEx, FrameRect, DrawFocusRect, OffsetRect, GetClientRect, ClientToScreen, ScreenToClient, InvalidateRect, RedrawWindow, GetActiveWindow, GetCapture, SetCapture, GetParent, WindowFromPoint, DestroyCursor, GetCursorPos, ReleaseCapture, SetCursor, CreateMenu, GetSubMenu, IsIconic, IsWindowVisible, SetTimer, SetForegroundWindow, SetWindowPos, GetDlgCtrlID, IsWindow, GetWindowThreadProcessId, KillTimer, GetDesktopWindow, GetSystemMenu, GetFocus, PtInRect, IsZoomed, SetWindowRgn, UpdateWindow, GetMenuItemCount, GetMenuItemID, IsMenu, InflateRect, CopyRect, UnionRect, EnumChildWindows, GetSysColor, DestroyIcon, GetWindowRect, SendDlgItemMessageA, GetSystemMetrics, GetWindowPlacement, SystemParametersInfoA, IntersectRect, SetWindowPlacement, SetScrollInfo, GetScrollInfo, DeferWindowPos, EqualRect, AdjustWindowRectEx, ShowScrollBar, GetScrollPos, SetScrollPos, GetScrollRange, SetScrollRange, GetKeyState, TrackPopupMenu, ScrollWindow, MapWindowPoints, GetMessagePos, GetMessageTime, UnhookWindowsHookEx, DestroyWindow, GetTopWindow, EndDeferWindowPos, BeginDeferWindowPos, SetActiveWindow, GetForegroundWindow, CallNextHookEx, GetSysColorBrush, GetDC, ReleaseDC, GetWindowDC, BeginPaint, EndPaint, GetMenuState, CheckMenuItem, EnableMenuItem, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, GetDlgItemInt, SetMenu, BringWindowToTop, CreatePopupMenu, DestroyMenu, ReuseDDElParam, UnpackDDElParam, MapDialogRect, DeleteMenu, EndDialog, GetNextDlgTabItem, ValidateRect, MessageBeep, PostQuitMessage, ShowOwnedPopups, SetWindowContextHelpId, DrawIcon, GetMenu
                              > GDI32.dll: StretchBlt, CreateCompatibleBitmap, CreateBitmap, StretchDIBits, SelectObject, SetBkColor, BitBlt, SetTextColor, DeleteDC, DeleteObject, GetStockObject, SetBkMode, SetMapMode, ExcludeClipRect, IntersectClipRect, LineTo, MoveToEx, CreateRoundRectRgn, SelectClipRgn, GetViewportExtEx, GetWindowExtEx, GetDeviceCaps, PtVisible, RectVisible, Escape, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, ExtSelectClipRgn, CreatePatternBrush, CreatePen, CreateSolidBrush, GetTextColor, Rectangle, DPtoLP, PatBlt, SaveDC, RestoreDC, GetPixel, CreateRectRgn, GetClipBox, GetBkColor, GetMapMode, CombineRgn, CreateCompatibleDC, CreateRectRgnIndirect, GetRgnBox, Ellipse, LPtoDP, CreateEllipticRgn, SetRectRgn
                              > COMCTL32.dll: -
                              > SHLWAPI.dll: PathFindFileNameW, PathStripToRootW, PathRemoveExtensionW, PathFindExtensionW, PathIsRelativeW, PathIsUNCW, SHDeleteKeyW, StrToIntExA, PathFileExistsW
                              > ole32.dll: CoTaskMemAlloc, CoDisconnectObject, CLSIDFromString, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CreateILockBytesOnHGlobal, OleUninitialize, CoFreeUnusedLibraries, OleInitialize, CoRevokeClassObject, OleIsCurrentClipboard, OleFlushClipboard, CoRegisterMessageFilter, CLSIDFromProgID, OleRun, StringFromCLSID, CoTaskMemFree, CoCreateGuid, CoInitializeEx, CoCreateInstance, CoInitialize, CoInitializeSecurity, CoGetClassObject, CoUninitialize
                              > OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
                              > WS2_32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
                              > ODBC32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
                              > dbghelp.dll: SymGetOptions, SymSetOptions, SymInitialize, SymLoadModule, SymCleanup, SymGetLineFromAddr, SymGetModuleBase, SymFunctionTableAccess, StackWalk, SymGetSymFromAddr
                              > IPHLPAPI.DLL: GetTcpTable, GetBestRoute, GetIpAddrTable
                              > SHELL32.dll: DragFinish
                              > WINSPOOL.DRV: ClosePrinter

                              ( 0 exports )
                              Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=B01056950053F537403B2145AF64100080108D0B
                              Bit9 info: http://fileadvisor.bit9.com/services/extinfo.aspx?md5=efe4585ddf09ffb39852c9e8565e1e69
                              1. Tiens... Je m'attendais plutôt à un truc du genre:

                                Antivirus Version Update Result
                                AhnLab-V3 2007.6.9.0 06.08.2007 no virus found
                                AntiVir 7.4.0.32 06.09.2007 no virus found
                                Authentium 4.93.8 05.23.2007 no virus found
                                Avast 4.7.997.0 06.09.2007 no virus found
                                AVG 7.5.0.467 06.09.2007 no virus found
                                BitDefender 7.2 06.09.2007 no virus found
                                CAT-QuickHeal 9.00 06.09.2007 no virus found
                                ClamAV devel-20070416 06.09.2007 no virus found
                                DrWeb 4.33 06.09.2007 no virus found
                                eSafe 7.0.15.0 06.06.2007 no virus found
                                eTrust-Vet 30.7.3703 06.08.2007 no virus found
                                Ewido 4.0 06.09.2007 no virus found
                                FileAdvisor 1 06.09.2007 no virus found
                                Fortinet 2.85.0.0 06.09.2007 no virus found
                                F-Prot 4.3.2.48 06.08.2007 no virus found
                                F-Secure 6.70.13030.0 06.08.2007 Trojan-Downloader.Win32.Agent.bkw
                                Ikarus T3.1.1.8 06.09.2007 no virus found
                                Kaspersky 4.0.2.24 06.09.2007 Trojan-Downloader.Win32.Agent.bkw
                                McAfee 5049 06.08.2007 no virus found
                                Microsoft 1.2503 06.09.2007 no virus found
                                NOD32v2 2320 06.09.2007 no virus found
                                Norman 5.80.02 06.08.2007 no virus found
                                Panda 9.0.0.4 06.09.2007 no virus found
                                Prevx1 V2 06.09.2007 no virus found
                                Sophos 4.18.0 06.01.2007 no virus found
                                Sunbelt 2.2.907.0 06.09.2007 no virus found
                                Symantec 10 06.09.2007 no virus found
                                TheHacker 6.1.6.131 06.08.2007 no virus found
                                VBA32 3.12.0 06.07.2007 no virus found
                                VirusBuster 4.3.23:9 06.08.2007 no virus found
                                Webwasher-Gateway 6.0.1 06.09.2007 no virus found
                            2. Antivirus Version Dernière mise à jour Résultat
                              AhnLab-V3 2008.4.25.2 2008.04.25 -
                              AntiVir 7.8.0.10 2008.04.25 -
                              Authentium 4.93.8 2008.04.26 -
                              Avast 4.8.1169.0 2008.04.26 -
                              AVG 7.5.0.516 2008.04.26 -
                              BitDefender 7.2 2008.04.26 -
                              CAT-QuickHeal 9.50 2008.04.26 -
                              ClamAV 0.92.1 2008.04.26 -
                              DrWeb 4.44.0.09170 2008.04.26 -
                              eSafe 7.0.15.0 2008.04.21 -
                              eTrust-Vet 31.3.5736 2008.04.26 -
                              Ewido 4.0 2008.04.26 -
                              F-Prot 4.4.2.54 2008.04.26 -
                              F-Secure 6.70.13260.0 2008.04.26 -
                              FileAdvisor 1 2008.04.26 -
                              Fortinet 3.14.0.0 2008.04.26 -
                              Ikarus T3.1.1.26 2008.04.26 -
                              Kaspersky 7.0.0.125 2008.04.26 -
                              McAfee 5282 2008.04.25 -
                              Microsoft 1.3408 2008.04.22 -
                              NOD32v2 3057 2008.04.26 -
                              Norman 5.80.02 2008.04.25 -
                              Panda 9.0.0.4 2008.04.26 -
                              Prevx1 V2 2008.04.26 Heuristic: Suspicious File Which Interferes With Vulnerable Files Like The HostsFile
                              Rising 20.41.52.00 2008.04.26 -
                              Sophos 4.28.0 2008.04.26 -
                              Sunbelt 3.0.1056.0 2008.04.17 -
                              Symantec 10 2008.04.26 -
                              TheHacker 6.2.92.294 2008.04.26 -
                              VBA32 3.12.6.5 2008.04.26 -
                              VirusBuster 4.3.26:9 2008.04.26 -
                              Webwasher-Gateway 6.6.2 2008.04.26 -
                              Information additionnelle
                              File size: 1414304 bytes
                              MD5...: e34e9d701b4162e796a0ba1b0d5eb5f2
                              SHA1..: 00200d765711f974edc03a23e3df35723830f7bf
                              SHA256: c699ff4e28edceb81a3875e548fcf8795976fd33fe7d6940227e74b63be76b58
                              SHA512: 4fa363c6b7e1b5cb786cc90c940d9e57cd04ce5decdcd70e0c1cbc0256d4f987
                              98e4137e01688d7d3d18aff75caa3eb9b1939aea840c0d6507522273e1a5ee35
                              PEiD..: Armadillo v1.71
                              PEInfo: PE Structure information

                              ( base data )
                              entrypointaddress.: 0x45cd6c
                              timedatestamp.....: 0x48106ace (Thu Apr 24 11:11:10 2008)
                              machinetype.......: 0x14c (I386)

                              ( 5 sections )
                              name viradd virsiz rawdsiz ntrpy md5
                              .text 0x1000 0xccf7a 0xcd000 6.62 875733b4b9230640da28d1ba062b149e
                              .rdata 0xce000 0x2bfb7 0x2c000 4.70 8cac9259cc298d559657344d41ead439
                              .data 0xfa000 0x12768 0xda00 5.00 e695c14d096a5df2ab40341be02fedc3
                              .HookSec 0x10d000 0x4 0x200 0.00 bf619eac0cdf3f68d496ea9344137e8b
                              .rsrc 0x10e000 0x516b0 0x51800 6.12 42ffc6e93f37ed5f601d71a1ca86baf3

                              ( 16 imports )
                              > KERNEL32.dll: IsBadReadPtr, IsBadCodePtr, IsValidLocale, IsValidCodePage, GetLocaleInfoA, EnumSystemLocalesA, GetUserDefaultLCID, CompareStringA, CompareStringW, SetEnvironmentVariableA, GetLocaleInfoW, GetStringTypeA, GetStdHandle, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, SetUnhandledExceptionFilter, IsBadWritePtr, VirtualAlloc, VirtualFree, GetEnvironmentVariableA, LCMapStringW, UnhandledExceptionFilter, GetFileType, SetStdHandle, HeapSize, GetCommandLineA, GetStartupInfoA, RaiseException, HeapReAlloc, ExitProcess, ExitThread, CreateThread, GetLocalTime, GetTimeZoneInformation, RtlUnwind, FindResourceExA, SetErrorMode, SetFileTime, SystemTimeToFileTime, GetProfileStringA, UnmapViewOfFile, DosDateTimeToFileTime, FlushInstructionCache, GetProcessHeap, GetTempPathA, VirtualQuery, FindResourceExW, DebugBreak, FreeResource, InterlockedExchange, GetFileTime, lstrlenW, GetOEMCP, GetCPInfo, GetProcessVersion, GlobalFlags, VirtualProtect, TlsGetValue, LocalReAlloc, TlsSetValue, GlobalReAlloc, TlsFree, GlobalHandle, TlsAlloc, GetCurrentThread, GetFullPathNameA, GetVolumeInformationA, FlushFileBuffers, DuplicateHandle, GetThreadLocale, FileTimeToLocalFileTime, FormatMessageA, InterlockedIncrement, GetVersion, GetCurrentThreadId, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, GetModuleHandleA, InterlockedDecrement, FileTimeToSystemTime, GetSystemTime, GetSystemDirectoryA, CreateToolhelp32Snapshot, Process32First, Process32Next, WinExec, lstrcmpA, lstrcmpiA, lstrcpynA, GetExitCodeProcess, GlobalMemoryStatus, GetWindowsDirectoryA, CopyFileA, GetCurrentProcess, GetCurrentProcessId, OpenProcess, TerminateProcess, lstrcatA, CreateProcessA, GetLogicalDriveStringsA, GetDriveTypeA, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, SetLastError, GlobalAlloc, GlobalLock, GlobalUnlock, MulDiv, GlobalFree, CreateEventA, FindResourceA, LoadResource, SizeofResource, LockResource, LCMapStringA, WideCharToMultiByte, GetACP, CreateDirectoryA, GetCurrentDirectoryA, SetCurrentDirectoryA, LockFile, WriteFile, UnlockFile, ReadFile, MoveFileA, FindFirstFileA, FindNextFileA, FindClose, GetFileSize, SetFilePointer, SetEndOfFile, CreateFileA, GetFileAttributesA, MultiByteToWideChar, GetVersionExA, GetLastError, GetProcAddress, LoadLibraryA, FreeLibrary, LocalFree, LocalAlloc, OutputDebugStringA, lstrcpyA, ResetEvent, WaitForSingleObject, CloseHandle, LeaveCriticalSection, EnterCriticalSection, GetExitCodeThread, GetModuleFileNameA, DeleteCriticalSection, InitializeCriticalSection, lstrlenA, GetPrivateProfileStringA, GetTickCount, Sleep, DeleteFileA, WritePrivateProfileStringA, GetPrivateProfileIntA, GetStringTypeW
                              > USER32.dll: SetScrollRange, GetScrollPos, SetScrollPos, GetTopWindow, GetCapture, WinHelpA, wsprintfA, GetClassInfoA, RegisterClassA, GetDlgItem, GetWindowTextLengthA, GetWindowTextA, GetDlgCtrlID, DestroyWindow, CreateWindowExA, SetWindowsHookExA, CallNextHookEx, GetClassLongA, UnhookWindowsHookEx, CallWindowProcA, DefWindowProcA, GetMessageTime, GetMessagePos, GetForegroundWindow, IntersectRect, GetWindowPlacement, DestroyCursor, DestroyIcon, InflateRect, FindWindowA, OffsetRect, GetSysColor, GetWindowDC, SetWindowPos, RemovePropA, LockWindowUpdate, MessageBeep, ExitWindowsEx, IsChild, SetRectEmpty, DrawIcon, GetSystemMenu, SetClassLongA, GetWindowLongA, ReleaseCapture, SetMenu, RegisterWindowMessageA, SendMessageA, GetParent, EnableWindow, GetClientRect, GetPropA, ShowWindow, GetLastActivePopup, FlashWindow, GetMenuStringA, InsertMenuItemA, EnableMenuItem, AppendMenuA, LoadImageA, GetMenu, InsertMenuA, GetClassNameA, CreatePopupMenu, SetWindowLongA, SetWindowRgn, GrayStringA, DrawTextA, TabbedTextOutA, GetDesktopWindow, FillRect, GetDC, ReleaseDC, GetMenuItemInfoA, GetMenuStringW, GetScrollRange, ShowScrollBar, SetScrollInfo, GetScrollInfo, AdjustWindowRectEx, SetFocus, SetActiveWindow, MapWindowPoints, SendDlgItemMessageA, CheckDlgButton, GetMenuItemID, ModifyMenuA, GetWindow, LoadCursorA, SetCursor, GetFocus, IsWindow, EqualRect, LoadBitmapA, MonitorFromWindow, GetMonitorInfoA, InvalidateRect, GetKeyState, ScreenToClient, GetCursorPos, CopyAcceleratorTableA, LoadAcceleratorsA, PostMessageA, DispatchMessageA, PeekMessageA, MessageBoxA, TrackPopupMenu, GetMenuState, GetMenuItemCount, DeleteMenu, SetMenuItemInfoA, GetSubMenu, LoadMenuA, SetPropA, CreateAcceleratorTableA, DestroyAcceleratorTable, WindowFromPoint, LoadIconA, SystemParametersInfoA, SetForegroundWindow, IsIconic, KillTimer, UpdateWindow, RegisterHotKey, UnregisterHotKey, UnregisterClassA, HideCaret, ShowCaret, ExcludeUpdateRgn, DefDlgProcA, IsWindowUnicode, MonitorFromPoint, IsDlgButtonChecked, IsDialogMessageA, SetWindowTextA, MoveWindow, IsWindowEnabled, GetNextDlgTabItem, SetMenuItemBitmaps, GetMenuCheckMarkDimensions, ClientToScreen, BeginPaint, EndPaint, CreateDialogIndirectParamA, GetActiveWindow, EndDialog, wvsprintfA, CharNextA, DestroyMenu, CharUpperA, LoadStringA, PostQuitMessage, ValidateRect, GetMessageA, GetNextDlgGroupItem, SetWindowContextHelpId, PostThreadMessageA, RemoveMenu, RegisterClipboardFormatA, SetCapture, GetSysColorBrush, GetMenuItemRect, GetMenuDefaultItem, UnionRect, RedrawWindow, DrawFocusRect, DrawStateA, CreateIconIndirect, SendMessageTimeoutA, IsMenu, GetIconInfo, LoadCursorFromFileA, FindWindowExA, WindowFromDC, MessageBoxIndirectA, FrameRect, ModifyMenuW, AppendMenuW, DrawTextExW, DrawTextExA, DrawTextW, TrackPopupMenuEx, LoadBitmapW, LoadImageW, LoadIconW, DrawIconEx, LoadStringW, InsertMenuW, InsertMenuItemW, DrawFrameControl, EnableScrollBar, IsRectEmpty, SetTimer, GetSystemMetrics, SetRect, CopyRect, GetWindowRect, TranslateAcceleratorA, PtInRect, GetAsyncKeyState, CheckMenuItem, TranslateMessage, SetParent, CloseClipboard, GetClipboardData, OpenClipboard, IsWindowVisible, SetDlgItemInt, MapDialogRect
                              > GDI32.dll: SetWindowExtEx, ScaleWindowExtEx, SelectClipRgn, ExcludeClipRect, IntersectClipRect, MoveToEx, LineTo, SetTextAlign, GetViewportExtEx, GetWindowExtEx, CreatePen, CreatePatternBrush, GetTextColor, SetWindowOrgEx, GetMapMode, DPtoLP, LPtoDP, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SetMapMode, SetStretchBltMode, RestoreDC, SaveDC, CreateRectRgnIndirect, GetClipBox, CreateEllipticRgn, CreatePolygonRgn, FillRgn, FrameRgn, CreateFontIndirectA, CreateFontA, SetBkMode, GetDIBits, GetStockObject, CreateRectRgn, GetPixel, CombineRgn, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, SetBkColor, SetTextColor, CreateBitmap, CreateCompatibleBitmap, DeleteObject, GetDeviceCaps, GetTextExtentPoint32W, GetTextExtentPointA, GetTextExtentPointW, TextOutW, GetViewportOrgEx, GetWindowOrgEx, SetPixelV, CreateDIBSection, SetBrushOrgEx, CreateBitmapIndirect, SetPixel, GetNearestColor, RoundRect, GetCharWidthA, Rectangle, OffsetRgn, ExtCreateRegion, CreateICA, SetBoundsRect, GetBkMode, PlgBlt, GetCurrentObject, CreateDIBitmap, SetDIBitsToDevice, CreateCompatibleDC, BitBlt, StretchBlt, GetObjectA, CreateSolidBrush, SelectObject, PatBlt, DeleteDC, GetBkColor, GetTextExtentPoint32A
                              > comdlg32.dll: GetFileTitleA, GetOpenFileNameA, GetSaveFileNameA, ChooseColorW, ChooseColorA
                              > WINSPOOL.DRV: DocumentPropertiesA, ClosePrinter, OpenPrinterA
                              > ADVAPI32.dll: RegQueryValueExA, RegOpenKeyA, RegSetValueExA, RegCreateKeyA, RegQueryValueExW, RegSetValueExW, RegQueryInfoKeyA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegOpenKeyExA, RegQueryValueA, AdjustTokenPrivileges, LookupPrivilegeValueA, RegCloseKey, RegCreateKeyExA, OpenProcessToken
                              > SHELL32.dll: DragQueryFileA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetMalloc, Shell_NotifyIconA, ShellExecuteA, DragFinish, ShellExecuteExA, SHGetSpecialFolderLocation, SHGetDesktopFolder
                              > COMCTL32.dll: ImageList_AddMasked, -, ImageList_Destroy, ImageList_Create, ImageList_GetImageInfo, ImageList_Duplicate, _TrackMouseEvent, ImageList_GetIcon, ImageList_Draw
                              > oledlg.dll: -
                              > ole32.dll: CoRevokeClassObject, CoFreeUnusedLibraries, OleUninitialize, OleInitialize, CoTaskMemAlloc, CoTaskMemFree, StgCreateDocfileOnILockBytes, StgOpenStorageOnILockBytes, CoGetClassObject, CLSIDFromString, CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize, CreateStreamOnHGlobal, CoRegisterMessageFilter, OleFlushClipboard, OleIsCurrentClipboard, CreateILockBytesOnHGlobal
                              > OLEPRO32.DLL: -, -
                              > OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -
                              > WS2_32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
                              > VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA
                              > WININET.dll: InternetCanonicalizeUrlA, InternetCrackUrlA
                              > SHLWAPI.dll: SHGetValueA, PathIsDirectoryA, PathFileExistsA

                              ( 1 exports )
                              _interfaceMap@CCustomControlSite@@1UAFX_INTERFACEMAP@@B
                              Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=B65932C7A0357AEE94D515FD339164008E217322
                              • 1
                              • 2