[OK] virus Backdoor.win32.Agent.afqs

Sécurité et insécurité. Virus, Trojans, Spywares, Failles etc. …

Modérateur: Modérateurs et Modératrices

Règles du forum
Assiste.com a suspendu l'assistance à la décontamination après presque 15 ans sur l'ancien forum puis celui-ci. Voir :

Procédure de décontamination 1 - Anti-malware
Décontamination anti-malwares

Procédure de décontamination 2 - Anti-malware et antivirus (La Manip)
La Manip - Procédure standard de décontamination

Entretien périodique d'un PC sous Windows
Entretien périodique d'un PC sous Windows

Protection des navigateurs, de la navigation et de la vie privée
Protéger le navigateur, la navigation et la vie privée

[OK] virus Backdoor.win32.Agent.afqs

Messagede hari84 » 23 Avr 2009, 07:57

Bonjour, mon antivirus gdata 2008 a détecté un virus nommé Backdoor.win32.Agent.afqs situé dans C\Windows\system32\wbem\wmiprvse.exe et ""wmiapsrv.exe qu'il a mis en quarantaine.
Je ne peux apparemment pas les supprimer.
voici le log hijack.
Merci d'avance
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:34:45, on 19/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Gdata\AVK\AVKService.exe
D:\Gdata\AVK\AVKWCtl.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Fichiers communs\G DATA\AVKProxy\AVKProxy.exe
C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Microsoft LifeCam\LifeTray.exe
D:\Gdata\Firewall\GDFwSvc.exe
C:\WINDOWS\vVX3000.exe
D:\Gdata\Firewall\GDFirewallTray.exe
D:\Gdata\AVKTray\AVKTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Analyseur Jak\Analyseur Jake.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://recherche.neuf.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,d:\gdata\avkkid\avkcks.exe
O2 - BHO: G DATA WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - D:\Gdata\Webfilter\AvkWebIE.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: G DATA WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - D:\Gdata\Webfilter\AvkWebIE.dll
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [GDFirewallTray] D:\Gdata\Firewall\GDFirewallTray.exe
O4 - HKLM\..\Run: [AVKTray] D:\Gdata\AVKTray\AVKTray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-3825963638-499390841-3790187816-1008\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupda ... 9731383765
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1096353671
O23 - Service: G DATA AntiVirus Proxy (AVKProxy) - G DATA Software AG - C:\Program Files\Fichiers communs\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: G DATA Scheduler (AVKService) - G DATA Software AG - D:\Gdata\AVK\AVKService.exe
O23 - Service: Gardien d'AntiVirus (AVKWCtl) - G DATA Software AG - D:\Gdata\AVK\AVKWCtl.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Pare-feu personnel G DATA (GDFwSvc) - G DATA Software AG - D:\Gdata\Firewall\GDFwSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 7457 bytes
hari84
 
Messages: 6
Inscription: 19 Avr 2009, 16:56

Messagede nickW » 23 Avr 2009, 18:09

Bonjour,

Le fichier wmiprvse.exe situé dans le dossier C:\WINDOWS\system32\wbem est normalement un fichier Microsoft parfaitement légitime.
Il en est de même pour le fichier wmiapsrv.exe.

Le premier correspond à Windows Management Instrumentation
http://www.liutilities.com/products/win ... /wmiprvse/

Le second, au service Carte de performance WMI
http://assiste.com.free.fr/p/services_w ... e_wmi.html



A mon avis, il s'agit d'un faux-positif (détection erronée), comme dans cet autre sujet:
http://www.infos-du-net.com/forum/28681 ... agent-afqs

Peux-tu:
1/ faire une mise à jour des fichiers de signature de l'antivirus pour contrôler si les fichiers sont toujours signalés comme infectés
2/ les faire analyser sur VirusTotal

Étape 1: Affichage tous fichiers
Vérifier que ton PC affiche bien tous les fichiers
http://assiste.com.free.fr/p/comment/co ... aches.html


Étape 2: VirusTotal
Aller sur le site http://www.virustotal.com/fr/ - Note: Javascript doit être activé.

Sous Envoyer un fichier, cliquer sur le bouton Parcourir
Dans la fenêtre "Envoi du fichier", naviguer jusqu'au dossier C:\WINDOWS\system32\wbem, puis sélectionner le fichier wmiprvse.exe et cliquer sur le bouton Ouvrir

Le fichier est envoyé. Si Virustotal annonce que le fichier a déjà été analysé, cliquer sur le bouton Reanalyse le fichier maintenant

Il est possible que l'analyse soit mise en file d'attente (si de nombreuses demandes d'analyse sont en cours). Il faut dans ce cas patienter, sans Actualiser la page.

Laisser l'analyse se dérouler, tant que la mention en cours d'analyse est affichée.

Lorsque l'analyse est terminée (affichage de Situation actuelle: terminé), cliquer sur Image Formaté (situé juste sous le cadre Fichier... reçu le... - Résultat...)

Il y a ouverture d'une nouvelle fenêtre du navigateur. cliquer sur la seconde image à partir de la gauche: Image

Faire un clic droit sur la page puis choisir Sélectionner tout, faire de nouveau un clic droit puis choisir Copier

Revenir sur le forum, dans ton sujet, cliquer sur le bouton Répondre, puis Coller dans le nouveau message le résultat de Virustotal.

Idem pour le second fichier wmiapsrv.exe


A suivre,
nickW - Image
30/07/2012: Plus de désinfection de PC jusqu'à nouvel ordre.
Pas de demande d'analyse de log en MP (Message Privé)
Mes configs
Avatar de l’utilisateur
nickW
Modérateur
 
Messages: 21698
Inscription: 20 Mai 2004, 17:41
Localisation: Dordogne/Île de France

Messagede hari84 » 25 Avr 2009, 10:59

Fichier wmiprvse.exe reçu le 2009.04.25 11:40:27 (CET)
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.04.25 -
AhnLab-V3 5.0.0.2 2009.04.24 -
AntiVir 7.9.0.156 2009.04.24 -
Antiy-AVL 2.0.3.1 2009.04.24 -
Authentium 5.1.2.4 2009.04.24 -
Avast 4.8.1335.0 2009.04.25 -
AVG 8.5.0.287 2009.04.24 -
BitDefender 7.2 2009.04.25 -
CAT-QuickHeal 10.00 2009.04.25 -
ClamAV 0.94.1 2009.04.25 -
Comodo 1135 2009.04.25 -
DrWeb 4.44.0.09170 2009.04.25 -
eSafe 7.0.17.0 2009.04.23 -
eTrust-Vet 31.6.6475 2009.04.24 -
F-Prot 4.4.4.56 2009.04.24 -
F-Secure 8.0.14470.0 2009.04.25 -
Fortinet 3.117.0.0 2009.04.25 -
GData 19 2009.04.25 -
Ikarus T3.1.1.49.0 2009.04.25 -
K7AntiVirus 7.10.714 2009.04.23 -
Kaspersky 7.0.0.125 2009.04.25 -
McAfee 5595 2009.04.24 -
McAfee+Artemis 5595 2009.04.24 -
McAfee-GW-Edition 6.7.6 2009.04.25 -
Microsoft 1.4602 2009.04.25 -
NOD32 4035 2009.04.25 -
Norman 6.00.06 2009.04.24 -
nProtect 2009.1.8.0 2009.04.25 -
Panda 10.0.0.14 2009.04.24 -
PCTools 4.4.2.0 2009.04.24 -
Prevx1 3.0 2009.04.25 -
Rising 21.26.52.00 2009.04.25 -
Sophos 4.41.0 2009.04.25 -
Sunbelt 3.2.1858.2 2009.04.24 -
Symantec 1.4.4.12 2009.04.25 -
TheHacker 6.3.4.1.314 2009.04.25 -
TrendMicro 8.700.0.1004 2009.04.24 -
VBA32 3.12.10.3 2009.04.24 -
ViRobot 2009.4.24.1708 2009.04.24 -
VirusBuster 4.6.5.0 2009.04.24 -
Information additionnelle
File size: 227840 bytes
MD5...: 798a9e6828997eef4517ada8a2259831
SHA1..: f36ce7091903b73a6905460069877ddc209ad2e7
SHA256: 64389fad94d54e2d43a7292ad3c57cb16f90f2c80ea44099e02d11e19e390a5b
SHA512: 4ece1a5d4d99af0ff7e10dbdcdcfe70453d93763a696765a9bc3d6fd8261f4c8<br>55ec560f9157a882363d27918afc211a63e499c8a1fb5917bc7d2a298f09bc82
ssdeep: 3072:k2RPa5U4Ux6E/oirCr/fZX9VGywcP1cN0ugxQ6jD0amQIH/UYSlb10snO:p<br>mHZfGywc+07Q6nkrsZ0s<br>
PEiD..: -
TrID..: File type identification<br>Win32 Executable MS Visual C++ (generic) (65.2%)<br>Win32 Executable Generic (14.7%)<br>Win32 Dynamic Link Library (generic) (13.1%)<br>Generic Win/DOS Executable (3.4%)<br>DOS Executable Generic (3.4%)
PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x249d8<br>timedatestamp.....: 0x498c0c76 (Fri Feb 06 10:09:58 2009)<br>machinetype.......: 0x14c (I386)<br><br>( 3 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0x357c6 0x35800 6.27 91eda5672a475ac14a6fac342247b2bf<br>.data 0x37000 0x1b34 0x1a00 4.76 0c5298720d0922985230fcebf45feacb<br>.rsrc 0x39000 0x3d8 0x400 3.32 e86398dba0191456aaac41550d509e93<br><br>( 11 imports ) <br>&gt; msvcrt.dll: __set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z, wcstok, __CxxFrameHandler, setlocale, wcslen, _vsnwprintf, _except_handler3, _purecall, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, __1type_info@@UAE@XZ, __dllonexit, _onexit, _CxxThrowException, _terminate@@YAXXZ, _controlfp, _wcsicmp, _c_exit, _exit, _XcptFilter, _cexit, exit, _initterm, __getmainargs, _acmdln<br>&gt; ADVAPI32.dll: RegQueryValueExW, GetTokenInformation, AdjustTokenPrivileges, AccessCheck, MapGenericMask, MakeAbsoluteSD, ConvertStringSecurityDescriptorToSecurityDescriptorW, SetSecurityDescriptorOwner, OpenProcessToken, OpenThreadToken, GetAclInformation, ImpersonateLoggedOnUser, RegOpenKeyExW, RegDeleteKeyW, RegCreateKeyExW, RegCloseKey, RegDisablePredefinedCache, RevertToSelf, SetThreadToken, FreeSid, SetSecurityDescriptorDacl, AddAce, InitializeAcl, GetLengthSid, CopySid, AllocateAndInitializeSid, InitializeSecurityDescriptor, ReportEventW, RegisterEventSourceW, DeregisterEventSource, RegSetValueExW, MakeSelfRelativeSD, GetSecurityDescriptorLength, SetSecurityDescriptorGroup<br>&gt; KERNEL32.dll: GetProcessHeap, HeapCreate, HeapDestroy, HeapAlloc, HeapFree, DeleteCriticalSection, InterlockedCompareExchange, GetProcAddress, GetModuleHandleW, CompareStringW, lstrcmpiW, GetCurrentProcessId, CloseHandle, InterlockedIncrement, InterlockedDecrement, SetEvent, InitializeCriticalSectionAndSpinCount, TerminateProcess, GetCurrentProcess, GetLastError, WaitForMultipleObjects, GetCurrentThreadId, WaitForSingleObject, DuplicateHandle, Sleep, CreateThread, UnmapViewOfFile, GetVersionExW, LocalFree, MapViewOfFile, CreateFileMappingW, OpenFileMappingW, OpenEventW, lstrlenW, GetModuleFileNameW, DebugBreak, EnterCriticalSection, LeaveCriticalSection, TlsAlloc, TlsFree, ChangeTimerQueueTimer, InterlockedExchange, SwitchToThread, CreateEventW, LCMapStringW, FreeLibrary, LoadLibraryW, GetSystemDirectoryW, GetTickCount, GetCurrentThread, QueryPerformanceCounter, GetSystemTimeAsFileTime, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleHandleA, GetStringTypeExW, GetCommandLineW, GetStartupInfoA<br>&gt; USER32.dll: DispatchMessageW, UnregisterClassW, CreateWindowExW, LoadCursorW, RegisterClassW, ShowWindow, UpdateWindow, GetSystemMenu, DeleteMenu, DefWindowProcW, PostMessageW, DestroyWindow, LoadIconW, TranslateMessage, GetMessageW, PeekMessageW, MsgWaitForMultipleObjects, MsgWaitForMultipleObjectsEx<br>&gt; ntdll.dll: wcsncpy, wcstol, NtQuerySystemInformation<br>&gt; wbemcomn.dll: _ErrorTrace@@YAHDPBDZZ, _DebugTrace@@YAHDPBDZZ<br>&gt; FastProx.dll: _New@CWbemCallSecurity@@SGPAV1@XZ<br>&gt; NCObjAPI.DLL: WmiCreateObjectWithFormat, WmiEventSourceConnect, WmiSetAndCommitObject, WmiEventSourceDisconnect, WmiDestroyObject<br>&gt; OLEAUT32.dll: -, -, -, -, -, -, -, -, -<br>&gt; ole32.dll: CLSIDFromString, StringFromGUID2, CoImpersonateClient, CoRevertToSelf, CoGetCallContext, CoGetClassObject, CoRegisterClassObject, CoFreeUnusedLibrariesEx, CoInitializeEx, CoInitializeSecurity, CoUninitialize, CoRevokeClassObject, CoCreateGuid, CoMarshalInterThreadInterfaceInStream, CoGetInterfaceAndReleaseStream, CoCreateInstance, CoSwitchCallContext<br>&gt; RPCRT4.dll: RpcMgmtSetServerStackSize<br><br>( 0 exports ) <br>
PDFiD.: -
RDS...: NSRL Reference Data Set<br>-

Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.04.25 -
AhnLab-V3 5.0.0.2 2009.04.24 -
AntiVir 7.9.0.156 2009.04.24 -
Antiy-AVL 2.0.3.1 2009.04.24 -
Authentium 5.1.2.4 2009.04.24 -
Avast 4.8.1335.0 2009.04.25 -
AVG 8.5.0.287 2009.04.24 -
BitDefender 7.2 2009.04.25 -
CAT-QuickHeal 10.00 2009.04.25 -
ClamAV 0.94.1 2009.04.25 -
Comodo 1135 2009.04.25 -
DrWeb 4.44.0.09170 2009.04.25 -
eSafe 7.0.17.0 2009.04.23 -
eTrust-Vet 31.6.6475 2009.04.24 -
F-Prot 4.4.4.56 2009.04.24 -
F-Secure 8.0.14470.0 2009.04.25 -
Fortinet 3.117.0.0 2009.04.25 -
GData 19 2009.04.25 -
Ikarus T3.1.1.49.0 2009.04.25 -
K7AntiVirus 7.10.714 2009.04.23 -
Kaspersky 7.0.0.125 2009.04.25 -
McAfee 5595 2009.04.24 -
McAfee+Artemis 5595 2009.04.24 -
McAfee-GW-Edition 6.7.6 2009.04.25 -
Microsoft 1.4602 2009.04.25 -
NOD32 4035 2009.04.25 -
Norman 6.00.06 2009.04.24 -
nProtect 2009.1.8.0 2009.04.25 -
Panda 10.0.0.14 2009.04.24 -
PCTools 4.4.2.0 2009.04.24 -
Prevx1 3.0 2009.04.25 -
Rising 21.26.52.00 2009.04.25 -
Sophos 4.41.0 2009.04.25 -
Sunbelt 3.2.1858.2 2009.04.24 -
Symantec 1.4.4.12 2009.04.25 -
TheHacker 6.3.4.1.314 2009.04.25 -
TrendMicro 8.700.0.1004 2009.04.24 -
VBA32 3.12.10.3 2009.04.24 -
ViRobot 2009.4.24.1708 2009.04.24 -
VirusBuster 4.6.5.0 2009.04.24 -

Information additionnelle
File size: 227840 bytes
MD5...: 798a9e6828997eef4517ada8a2259831
SHA1..: f36ce7091903b73a6905460069877ddc209ad2e7
SHA256: 64389fad94d54e2d43a7292ad3c57cb16f90f2c80ea44099e02d11e19e390a5b
SHA512: 4ece1a5d4d99af0ff7e10dbdcdcfe70453d93763a696765a9bc3d6fd8261f4c8<br>55ec560f9157a882363d27918afc211a63e499c8a1fb5917bc7d2a298f09bc82
ssdeep: 3072:k2RPa5U4Ux6E/oirCr/fZX9VGywcP1cN0ugxQ6jD0amQIH/UYSlb10snO:p<br>mHZfGywc+07Q6nkrsZ0s<br>
PEiD..: -
TrID..: File type identification<br>Win32 Executable MS Visual C++ (generic) (65.2%)<br>Win32 Executable Generic (14.7%)<br>Win32 Dynamic Link Library (generic) (13.1%)<br>Generic Win/DOS Executable (3.4%)<br>DOS Executable Generic (3.4%)
PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0x249d8<br>timedatestamp.....: 0x498c0c76 (Fri Feb 06 10:09:58 2009)<br>machinetype.......: 0x14c (I386)<br><br>( 3 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0x357c6 0x35800 6.27 91eda5672a475ac14a6fac342247b2bf<br>.data 0x37000 0x1b34 0x1a00 4.76 0c5298720d0922985230fcebf45feacb<br>.rsrc 0x39000 0x3d8 0x400 3.32 e86398dba0191456aaac41550d509e93<br><br>( 11 imports ) <br>&gt; msvcrt.dll: __set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z, wcstok, __CxxFrameHandler, setlocale, wcslen, _vsnwprintf, _except_handler3, _purecall, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, __1type_info@@UAE@XZ, __dllonexit, _onexit, _CxxThrowException, _terminate@@YAXXZ, _controlfp, _wcsicmp, _c_exit, _exit, _XcptFilter, _cexit, exit, _initterm, __getmainargs, _acmdln<br>&gt; ADVAPI32.dll: RegQueryValueExW, GetTokenInformation, AdjustTokenPrivileges, AccessCheck, MapGenericMask, MakeAbsoluteSD, ConvertStringSecurityDescriptorToSecurityDescriptorW, SetSecurityDescriptorOwner, OpenProcessToken, OpenThreadToken, GetAclInformation, ImpersonateLoggedOnUser, RegOpenKeyExW, RegDeleteKeyW, RegCreateKeyExW, RegCloseKey, RegDisablePredefinedCache, RevertToSelf, SetThreadToken, FreeSid, SetSecurityDescriptorDacl, AddAce, InitializeAcl, GetLengthSid, CopySid, AllocateAndInitializeSid, InitializeSecurityDescriptor, ReportEventW, RegisterEventSourceW, DeregisterEventSource, RegSetValueExW, MakeSelfRelativeSD, GetSecurityDescriptorLength, SetSecurityDescriptorGroup<br>&gt; KERNEL32.dll: GetProcessHeap, HeapCreate, HeapDestroy, HeapAlloc, HeapFree, DeleteCriticalSection, InterlockedCompareExchange, GetProcAddress, GetModuleHandleW, CompareStringW, lstrcmpiW, GetCurrentProcessId, CloseHandle, InterlockedIncrement, InterlockedDecrement, SetEvent, InitializeCriticalSectionAndSpinCount, TerminateProcess, GetCurrentProcess, GetLastError, WaitForMultipleObjects, GetCurrentThreadId, WaitForSingleObject, DuplicateHandle, Sleep, CreateThread, UnmapViewOfFile, GetVersionExW, LocalFree, MapViewOfFile, CreateFileMappingW, OpenFileMappingW, OpenEventW, lstrlenW, GetModuleFileNameW, DebugBreak, EnterCriticalSection, LeaveCriticalSection, TlsAlloc, TlsFree, ChangeTimerQueueTimer, InterlockedExchange, SwitchToThread, CreateEventW, LCMapStringW, FreeLibrary, LoadLibraryW, GetSystemDirectoryW, GetTickCount, GetCurrentThread, QueryPerformanceCounter, GetSystemTimeAsFileTime, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleHandleA, GetStringTypeExW, GetCommandLineW, GetStartupInfoA<br>&gt; USER32.dll: DispatchMessageW, UnregisterClassW, CreateWindowExW, LoadCursorW, RegisterClassW, ShowWindow, UpdateWindow, GetSystemMenu, DeleteMenu, DefWindowProcW, PostMessageW, DestroyWindow, LoadIconW, TranslateMessage, GetMessageW, PeekMessageW, MsgWaitForMultipleObjects, MsgWaitForMultipleObjectsEx<br>&gt; ntdll.dll: wcsncpy, wcstol, NtQuerySystemInformation<br>&gt; wbemcomn.dll: _ErrorTrace@@YAHDPBDZZ, _DebugTrace@@YAHDPBDZZ<br>&gt; FastProx.dll: _New@CWbemCallSecurity@@SGPAV1@XZ<br>&gt; NCObjAPI.DLL: WmiCreateObjectWithFormat, WmiEventSourceConnect, WmiSetAndCommitObject, WmiEventSourceDisconnect, WmiDestroyObject<br>&gt; OLEAUT32.dll: -, -, -, -, -, -, -, -, -<br>&gt; ole32.dll: CLSIDFromString, StringFromGUID2, CoImpersonateClient, CoRevertToSelf, CoGetCallContext, CoGetClassObject, CoRegisterClassObject, CoFreeUnusedLibrariesEx, CoInitializeEx, CoInitializeSecurity, CoUninitialize, CoRevokeClassObject, CoCreateGuid, CoMarshalInterThreadInterfaceInStream, CoGetInterfaceAndReleaseStream, CoCreateInstance, CoSwitchCallContext<br>&gt; RPCRT4.dll: RpcMgmtSetServerStackSize<br><br>( 0 exports ) <br>
PDFiD.: -
RDS...: NSRL Reference Data Set<br>-

Fichier wmiapsrv.exe reçu le 2009.04.25 11:56:41 (CET)
Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.04.25 -
AhnLab-V3 5.0.0.2 2009.04.24 -
AntiVir 7.9.0.156 2009.04.24 -
Antiy-AVL 2.0.3.1 2009.04.24 -
Authentium 5.1.2.4 2009.04.24 -
Avast 4.8.1335.0 2009.04.25 -
AVG 8.5.0.287 2009.04.24 -
BitDefender 7.2 2009.04.25 -
CAT-QuickHeal 10.00 2009.04.25 -
ClamAV 0.94.1 2009.04.25 -
Comodo 1135 2009.04.25 -
DrWeb 4.44.0.09170 2009.04.25 -
eSafe 7.0.17.0 2009.04.23 -
eTrust-Vet 31.6.6475 2009.04.24 -
F-Prot 4.4.4.56 2009.04.24 -
F-Secure 8.0.14470.0 2009.04.25 -
Fortinet 3.117.0.0 2009.04.25 -
GData 19 2009.04.25 -
Ikarus T3.1.1.49.0 2009.04.25 -
K7AntiVirus 7.10.714 2009.04.23 -
Kaspersky 7.0.0.125 2009.04.25 -
McAfee 5595 2009.04.24 -
McAfee+Artemis 5595 2009.04.24 -
McAfee-GW-Edition 6.7.6 2009.04.25 -
Microsoft 1.4602 2009.04.25 -
NOD32 4035 2009.04.25 -
Norman 6.00.06 2009.04.24 -
nProtect 2009.1.8.0 2009.04.25 -
Panda 10.0.0.14 2009.04.24 -
PCTools 4.4.2.0 2009.04.24 -
Prevx1 3.0 2009.04.25 -
Rising 21.26.52.00 2009.04.25 -
Sophos 4.41.0 2009.04.25 -
Sunbelt 3.2.1858.2 2009.04.24 -
Symantec 1.4.4.12 2009.04.25 -
TheHacker 6.3.4.1.314 2009.04.25 -
TrendMicro 8.700.0.1004 2009.04.24 -
VBA32 3.12.10.3 2009.04.24 -
ViRobot 2009.4.24.1708 2009.04.24 -
VirusBuster 4.6.5.0 2009.04.24 -
Information additionnelle
File size: 126464 bytes
MD5...: 4e8e8a58f56b25d0795f484e5eb7f898
SHA1..: b484453de87f141832ea855697dc610403a824ff
SHA256: 32f8ec10a5992185c13304aaa532c638ecb709ef9d9d883f88032bb30e3ae098
SHA512: 672a417f4f79e583acb74574578a55372f1a7b289bdf15b2c8ce58eda0040088<br>1817464373897407780ffbc9ad2b76c685b37d60b60679ab259d934d0d33c6b7
ssdeep: 3072:9i6OyPEInRXghvg1pQfuvC8usofkCQt4uZ561k/ONt9Q5Gsg:qmEInRXghT<br>Wq8usq/1k/ONt9Qm<br>
PEiD..: -
TrID..: File type identification<br>Win32 Executable Generic (42.3%)<br>Win32 Dynamic Link Library (generic) (37.6%)<br>Generic Win/DOS Executable (9.9%)<br>DOS Executable Generic (9.9%)<br>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0xacf6<br>timedatestamp.....: 0x48025230 (Sun Apr 13 18:34:24 2008)<br>machinetype.......: 0x14c (I386)<br><br>( 3 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0x1d183 0x1d200 6.21 c974d609c2bc806026013a883ca1127e<br>.data 0x1f000 0x15d8 0x1200 6.04 c5edf13c7e9176c0e27e75435513a60c<br>.rsrc 0x21000 0x590 0x600 3.72 307d06d6b6de1ef9774b93704940e312<br><br>( 9 imports ) <br>&gt; msvcrt.dll: _wcsicmp, wcsrchr, _CxxThrowException, _wtol, realloc, _vsnwprintf, _wtoi, wcslen, _terminate@@YAXXZ, _controlfp, _onexit, __dllonexit, __1type_info@@UAE@XZ, _except_handler3, __set_app_type, __p__fmode, wcscmp, wcschr, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, wcscspn, wcsspn, iswdigit, vswprintf, memmove, _wcsrev, _wcslwr, _wcsupr, wcsstr, wcspbrk, mbstowcs, wcscoll, _acmdln, exit, _cexit, _XcptFilter, _exit, _c_exit, memset, free, memcpy, __CxxFrameHandler, __2@YAPAXI@Z, __3@YAXPAX@Z, malloc<br>&gt; ADVAPI32.dll: RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegDeleteValueA, RegDeleteKeyA, RegOpenKeyExA, RegQueryInfoKeyA, RegQueryInfoKeyW, RegEnumKeyA, RegEnumKeyW, RegEnumValueA, RegOpenCurrentUser, RegCloseKey, RegDeleteKeyW, RegEnumKeyExW, RegOpenKeyExW, RegDeleteValueW, RegSetValueExW, RegCreateKeyExW, CopySid, GetLengthSid, IsValidSid, GetTokenInformation, OpenProcessToken, RegisterEventSourceW, DeregisterEventSource, CloseServiceHandle, QueryServiceStatus, QueryServiceConfigW, OpenServiceW, OpenSCManagerW, InitializeSecurityDescriptor, FreeSid, AllocateAndInitializeSid, SetSecurityDescriptorDacl, SetEntriesInAclW, SetServiceStatus, RegisterServiceCtrlHandlerW, DeleteService, ControlService, StartServiceCtrlDispatcherW, ChangeServiceConfig2W, CreateServiceW, RegEnumValueW, RegOpenKeyW, RegQueryValueExW<br>&gt; KERNEL32.dll: lstrlenW, lstrcatW, lstrcpyW, ReleaseSemaphore, WaitForSingleObject, SwitchToThread, GetCurrentProcess, InterlockedIncrement, TryEnterCriticalSection, InterlockedDecrement, InitializeCriticalSection, SetEvent, ResetEvent, EnterCriticalSection, LocalFree, LocalAlloc, lstrcmpiW, GetCommandLineW, CreateMutexW, CreateEventW, LoadLibraryW, DeleteCriticalSection, FreeLibrary, ReleaseMutex, InterlockedCompareExchange, GetModuleHandleW, GetModuleFileNameW, Sleep, WaitForMultipleObjects, UnmapViewOfFile, lstrcmpW, MapViewOfFile, CreateFileMappingW, FlushViewOfFile, GetExitCodeProcess, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleHandleA, GetStartupInfoA, GetLocaleInfoW, MoveFileExW, FormatMessageW, FormatMessageA, lstrlenA, LeaveCriticalSection, CloseHandle, DeleteFileW, CreateDirectoryW, CreateFileW, WriteFile, WideCharToMultiByte, GetVersionExA, MultiByteToWideChar, GetVersionExW, CreateSemaphoreW, GetLastError, ExpandEnvironmentStringsW, GetProcAddress, OpenProcess, SetLastError, OpenEventW, GetSystemDefaultLCID<br>&gt; USER32.dll: wsprintfW, CharNextW, LoadStringW<br>&gt; ntdll.dll: NtQueryObject, atol, iswspace<br>&gt; OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -<br>&gt; ole32.dll: CoInitializeEx, CoUninitialize, CoInitializeSecurity, CoCreateInstance, CoFreeUnusedLibraries, CoSetProxyBlanket<br>&gt; loadperf.dll: LoadPerfCounterTextStringsW, UnloadPerfCounterTextStringsW<br>&gt; wbemcomn.dll: _Throttle@@YGJKKKKK@Z<br><br>( 192 exports ) <br>__0CHPtrArray@@QAE@XZ, __0CHString@@QAE@ABV0@@Z, __0CHString@@QAE@GH@Z, __0CHString@@QAE@PBD@Z, __0CHString@@QAE@PBE@Z, __0CHString@@QAE@PBG@Z, __0CHString@@QAE@PBGH@Z, __0CHString@@QAE@XZ, __0CHStringArray@@QAE@XZ, __0CRegistry@@QAE@ABV0@@Z, __0CRegistry@@QAE@XZ, __0CRegistrySearch@@QAE@ABV0@@Z, __0CRegistrySearch@@QAE@XZ, __1CHPtrArray@@QAE@XZ, __1CHString@@QAE@XZ, __1CHStringArray@@QAE@XZ, __1CRegistry@@QAE@XZ, __1CRegistrySearch@@QAE@XZ, __4CHPtrArray@@QAEAAV0@ABV0@@Z, __4CHString@@QAEABV0@ABV0@@Z, __4CHString@@QAEABV0@D@Z, __4CHString@@QAEABV0@G@Z, __4CHString@@QAEABV0@PAV0@@Z, __4CHString@@QAEABV0@PBD@Z, __4CHString@@QAEABV0@PBE@Z, __4CHString@@QAEABV0@PBG@Z, __4CHStringArray@@QAEAAV0@ABV0@@Z, __4CRegistry@@QAEAAV0@ABV0@@Z, __4CRegistrySearch@@QAEAAV0@ABV0@@Z, __ACHPtrArray@@QAEAAPAXH@Z, __ACHPtrArray@@QBEPAXH@Z, __ACHString@@QBEGH@Z, __ACHStringArray@@QAEAAVCHString@@H@Z, __ACHStringArray@@QBE_AVCHString@@H@Z, __BCHString@@QBEPBGXZ, __H@YG_AVCHString@@ABV0@0@Z, __H@YG_AVCHString@@ABV0@G@Z, __H@YG_AVCHString@@ABV0@PBG@Z, __H@YG_AVCHString@@GABV0@@Z, __H@YG_AVCHString@@PBGABV0@@Z, __YCHString@@QAEABV0@ABV0@@Z, __YCHString@@QAEABV0@D@Z, __YCHString@@QAEABV0@G@Z, __YCHString@@QAEABV0@PBG@Z, _Add@CHPtrArray@@QAEHPAX@Z, _Add@CHStringArray@@QAEHPBG@Z, _AllocBeforeWrite@CHString@@IAEXH@Z, _AllocBuffer@CHString@@IAEXH@Z, _AllocCopy@CHString@@IBEXAAV1@HHH@Z, _AllocSysString@CHString@@QBEPAGXZ, _Append@CHPtrArray@@QAEHABV1@@Z, _Append@CHStringArray@@QAEHABV1@@Z, _AssignCopy@CHString@@IAEXHPBG@Z, _CheckAndAddToList@CRegistrySearch@@AAEXPAVCRegistry@@VCHString@@1AAVCHPtrArray@@11H@Z, _Close@CRegistry@@QAEXXZ, _CloseSubKey@CRegistry@@AAEXXZ, _Collate@CHString@@QBEHPBG@Z, _Compare@CHString@@QBEHPBG@Z, _CompareNoCase@CHString@@QBEHPBG@Z, _ConcatCopy@CHString@@IAEXHPBGH0@Z, _ConcatInPlace@CHString@@IAEXHPBG@Z, _Copy@CHPtrArray@@QAEXABV1@@Z, _Copy@CHStringArray@@QAEXABV1@@Z, _CopyBeforeWrite@CHString@@IAEXXZ, _CreateOpen@CRegistry@@QAEJPAUHKEY__@@PBGPAGKKPAU_SECURITY_ATTRIBUTES@@PAK@Z, _DeleteCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBG@Z, _DeleteCurrentKeyValue@CRegistry@@QAEKPBG@Z, _DeleteKey@CRegistry@@QAEJPAVCHString@@@Z, _DeleteValue@CRegistry@@QAEJPBG@Z, _ElementAt@CHPtrArray@@QAEAAPAXH@Z, _ElementAt@CHStringArray@@QAEAAVCHString@@H@Z, _Empty@CHString@@QAEXXZ, _EnumerateAndGetValues@CRegistry@@QAEJAAKAAPAGAAPAE@Z, _Find@CHString@@QBEHG@Z, _Find@CHString@@QBEHPBG@Z, _FindOneOf@CHString@@QBEHPBG@Z, _Format@CHString@@QAAXIZZ, _Format@CHString@@QAAXPBGZZ, _FormatMessageW@CHString@@QAAXIZZ, _FormatMessageW@CHString@@QAAXPBGZZ, _FormatV@CHString@@QAEXPBGPAD@Z, _FreeExtra@CHPtrArray@@QAEXXZ, _FreeExtra@CHString@@QAEXXZ, _FreeExtra@CHStringArray@@QAEXXZ, _FreeSearchList@CRegistrySearch@@QAEHHAAVCHPtrArray@@@Z, _GetAllocLength@CHString@@QBEHXZ, _GetAt@CHPtrArray@@QBEPAXH@Z, _GetAt@CHString@@QBEGH@Z, _GetAt@CHStringArray@@QBE_AVCHString@@H@Z, _GetBuffer@CHString@@QAEPAGH@Z, _GetBufferSetLength@CHString@@QAEPAGH@Z, _GetClassNameW@CRegistry@@QAEPAGXZ, _GetCurrentBinaryKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGPAEPAK@Z, _GetCurrentBinaryKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z, _GetCurrentBinaryKeyValue@CRegistry@@QAEKPBGPAEPAK@Z, _GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAK@Z, _GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z, _GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHStringArray@@@Z, _GetCurrentKeyValue@CRegistry@@QAEKPBGAAK@Z, _GetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z, _GetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHStringArray@@@Z, _GetCurrentRawKeyValue@CRegistry@@AAEKPAUHKEY__@@PBGPAXPAK3@Z, _GetCurrentRawSubKeyValue@CRegistry@@AAEKPBGPAXPAK2@Z, _GetCurrentSubKeyCount@CRegistry@@QAEKXZ, _GetCurrentSubKeyName@CRegistry@@QAEKAAVCHString@@@Z, _GetCurrentSubKeyPath@CRegistry@@QAEKAAVCHString@@@Z, _GetCurrentSubKeyValue@CRegistry@@QAEKPBGAAK@Z, _GetCurrentSubKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z, _GetCurrentSubKeyValue@CRegistry@@QAEKPBGPAXPAK@Z, _GetData@CHPtrArray@@QAEPAPAXXZ, _GetData@CHPtrArray@@QBEPAPBXXZ, _GetData@CHString@@IBEPAUCHStringData@@XZ, _GetData@CHStringArray@@QAEPAVCHString@@XZ, _GetData@CHStringArray@@QBEPBVCHString@@XZ, _GetLength@CHString@@QBEHXZ, _GetLongestClassStringSize@CRegistry@@QAEKXZ, _GetLongestSubKeySize@CRegistry@@QAEKXZ, _GetLongestValueData@CRegistry@@QAEKXZ, _GetLongestValueName@CRegistry@@QAEKXZ, _GetPlatformID@CRegistry@@CGKXZ, _GetSize@CHPtrArray@@QBEHXZ, _GetSize@CHStringArray@@QBEHXZ, _GetUpperBound@CHPtrArray@@QBEHXZ, _GetUpperBound@CHStringArray@@QBEHXZ, _GetValueCount@CRegistry@@QAEKXZ, _GethKey@CRegistry@@QAEPAUHKEY__@@XZ, _Init@CHString@@IAEXXZ, _InsertAt@CHPtrArray@@QAEXHPAV1@@Z, _InsertAt@CHPtrArray@@QAEXHPAXH@Z, _InsertAt@CHStringArray@@QAEXHPAV1@@Z, _InsertAt@CHStringArray@@QAEXHPBGH@Z, _IsEmpty@CHString@@QBEHXZ, _Left@CHString@@QBE_AV1@H@Z, _LoadStringW@CHString@@IAEHIPAGI@Z, _LoadStringW@CHString@@QAEHI@Z, _LocateKeyByNameOrValueName@CRegistrySearch@@QAEHPAUHKEY__@@PBG1PAPBGKAAVCHString@@3@Z, _LockBuffer@CHString@@QAEPAGXZ, _MakeLower@CHString@@QAEXXZ, _MakeReverse@CHString@@QAEXXZ, _MakeUpper@CHString@@QAEXXZ, _Mid@CHString@@QBE_AV1@H@Z, _Mid@CHString@@QBE_AV1@HH@Z, _NextSubKey@CRegistry@@QAEKXZ, _Open@CRegistry@@QAEJPAUHKEY__@@PBGK@Z, _OpenAndEnumerateSubKeys@CRegistry@@QAEJPAUHKEY__@@PBGK@Z, _OpenCurrentUser@CRegistry@@QAEKPBGK@Z, _OpenLocalMachineKeyAndReadValue@CRegistry@@QAEJPBG0AAVCHString@@@Z, _OpenSubKey@CRegistry@@AAEKXZ, _PrepareToReOpen@CRegistry@@AAEXXZ, _Release@CHString@@IAEXXZ, _Release@CHString@@KGXPAUCHStringData@@@Z, _ReleaseBuffer@CHString@@QAEXH@Z, _RemoveAll@CHPtrArray@@QAEXXZ, _RemoveAll@CHStringArray@@QAEXXZ, _RemoveAt@CHPtrArray@@QAEXHH@Z, _RemoveAt@CHStringArray@@QAEXHH@Z, _ReverseFind@CHString@@QBEHG@Z, _RewindSubKeys@CRegistry@@QAEXXZ, _Right@CHString@@QBE_AV1@H@Z, _SafeStrlen@CHString@@KGHPBG@Z, _SearchAndBuildList@CRegistrySearch@@QAEHVCHString@@AAVCHPtrArray@@00HPAUHKEY__@@@Z, _SetAt@CHPtrArray@@QAEXHPAX@Z, _SetAt@CHString@@QAEXHG@Z, _SetAt@CHStringArray@@QAEXHPBG@Z, _SetAtGrow@CHPtrArray@@QAEXHPAX@Z, _SetAtGrow@CHStringArray@@QAEXHPBG@Z, _SetCHStringResourceHandle@@YGXPAUHINSTANCE__@@@Z, _SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAK@Z, _SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z, _SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHStringArray@@@Z, _SetCurrentKeyValue@CRegistry@@QAEKPBGAAK@Z, _SetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z, _SetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHStringArray@@@Z, _SetCurrentKeyValueExpand@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z, _SetDefaultValues@CRegistry@@AAEXXZ, _SetSize@CHPtrArray@@QAEXHH@Z, _SetSize@CHStringArray@@QAEXHH@Z, _SpanExcluding@CHString@@QBE_AV1@PBG@Z, _SpanIncluding@CHString@@QBE_AV1@PBG@Z, _TrimLeft@CHString@@QAEXXZ, _TrimRight@CHString@@QAEXXZ, _UnlockBuffer@CHString@@QAEXXZ, _myRegCreateKeyEx@CRegistry@@AAEJPAUHKEY__@@PBGKPAGKKPAU_SECURITY_ATTRIBUTES@@PAPAU2@PAK@Z, _myRegDeleteKey@CRegistry@@AAEJPAUHKEY__@@PBG@Z, _myRegDeleteValue@CRegistry@@AAEJPAUHKEY__@@PBG@Z, _myRegEnumKey@CRegistry@@AAEJPAUHKEY__@@KPAGK@Z, _myRegEnumValue@CRegistry@@AAEJPAUHKEY__@@KPAGPAK22PAE2@Z, _myRegOpenKeyEx@CRegistry@@AAEJPAUHKEY__@@PBGKKPAPAU2@@Z, _myRegQueryInfoKey@CRegistry@@AAEJPAUHKEY__@@PAGPAK22222222PAU_FILETIME@@@Z, _myRegQueryValueEx@CRegistry@@AAEJPAUHKEY__@@PBGPAK2PAE2@Z, _myRegSetValueEx@CRegistry@@AAEJPAUHKEY__@@PBGKKPBEK@Z, _s_dwPlatform@CRegistry@@0KA<br>
PDFiD.: -
RDS...: NSRL Reference Data Set<br>-

Antivirus Version Dernière mise à jour Résultat
a-squared 4.0.0.101 2009.04.25 -
AhnLab-V3 5.0.0.2 2009.04.24 -
AntiVir 7.9.0.156 2009.04.24 -
Antiy-AVL 2.0.3.1 2009.04.24 -
Authentium 5.1.2.4 2009.04.24 -
Avast 4.8.1335.0 2009.04.25 -
AVG 8.5.0.287 2009.04.24 -
BitDefender 7.2 2009.04.25 -
CAT-QuickHeal 10.00 2009.04.25 -
ClamAV 0.94.1 2009.04.25 -
Comodo 1135 2009.04.25 -
DrWeb 4.44.0.09170 2009.04.25 -
eSafe 7.0.17.0 2009.04.23 -
eTrust-Vet 31.6.6475 2009.04.24 -
F-Prot 4.4.4.56 2009.04.24 -
F-Secure 8.0.14470.0 2009.04.25 -
Fortinet 3.117.0.0 2009.04.25 -
GData 19 2009.04.25 -
Ikarus T3.1.1.49.0 2009.04.25 -
K7AntiVirus 7.10.714 2009.04.23 -
Kaspersky 7.0.0.125 2009.04.25 -
McAfee 5595 2009.04.24 -
McAfee+Artemis 5595 2009.04.24 -
McAfee-GW-Edition 6.7.6 2009.04.25 -
Microsoft 1.4602 2009.04.25 -
NOD32 4035 2009.04.25 -
Norman 6.00.06 2009.04.24 -
nProtect 2009.1.8.0 2009.04.25 -
Panda 10.0.0.14 2009.04.24 -
PCTools 4.4.2.0 2009.04.24 -
Prevx1 3.0 2009.04.25 -
Rising 21.26.52.00 2009.04.25 -
Sophos 4.41.0 2009.04.25 -
Sunbelt 3.2.1858.2 2009.04.24 -
Symantec 1.4.4.12 2009.04.25 -
TheHacker 6.3.4.1.314 2009.04.25 -
TrendMicro 8.700.0.1004 2009.04.24 -
VBA32 3.12.10.3 2009.04.24 -
ViRobot 2009.4.24.1708 2009.04.24 -
VirusBuster 4.6.5.0 2009.04.24 -

Information additionnelle
File size: 126464 bytes
MD5...: 4e8e8a58f56b25d0795f484e5eb7f898
SHA1..: b484453de87f141832ea855697dc610403a824ff
SHA256: 32f8ec10a5992185c13304aaa532c638ecb709ef9d9d883f88032bb30e3ae098
SHA512: 672a417f4f79e583acb74574578a55372f1a7b289bdf15b2c8ce58eda0040088<br>1817464373897407780ffbc9ad2b76c685b37d60b60679ab259d934d0d33c6b7
ssdeep: 3072:9i6OyPEInRXghvg1pQfuvC8usofkCQt4uZ561k/ONt9Q5Gsg:qmEInRXghT<br>Wq8usq/1k/ONt9Qm<br>
PEiD..: -
TrID..: File type identification<br>Win32 Executable Generic (42.3%)<br>Win32 Dynamic Link Library (generic) (37.6%)<br>Generic Win/DOS Executable (9.9%)<br>DOS Executable Generic (9.9%)<br>Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information<br><br>( base data )<br>entrypointaddress.: 0xacf6<br>timedatestamp.....: 0x48025230 (Sun Apr 13 18:34:24 2008)<br>machinetype.......: 0x14c (I386)<br><br>( 3 sections )<br>name viradd virsiz rawdsiz ntrpy md5<br>.text 0x1000 0x1d183 0x1d200 6.21 c974d609c2bc806026013a883ca1127e<br>.data 0x1f000 0x15d8 0x1200 6.04 c5edf13c7e9176c0e27e75435513a60c<br>.rsrc 0x21000 0x590 0x600 3.72 307d06d6b6de1ef9774b93704940e312<br><br>( 9 imports ) <br>&gt; msvcrt.dll: _wcsicmp, wcsrchr, _CxxThrowException, _wtol, realloc, _vsnwprintf, _wtoi, wcslen, _terminate@@YAXXZ, _controlfp, _onexit, __dllonexit, __1type_info@@UAE@XZ, _except_handler3, __set_app_type, __p__fmode, wcscmp, wcschr, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, wcscspn, wcsspn, iswdigit, vswprintf, memmove, _wcsrev, _wcslwr, _wcsupr, wcsstr, wcspbrk, mbstowcs, wcscoll, _acmdln, exit, _cexit, _XcptFilter, _exit, _c_exit, memset, free, memcpy, __CxxFrameHandler, __2@YAPAXI@Z, __3@YAXPAX@Z, malloc<br>&gt; ADVAPI32.dll: RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegDeleteValueA, RegDeleteKeyA, RegOpenKeyExA, RegQueryInfoKeyA, RegQueryInfoKeyW, RegEnumKeyA, RegEnumKeyW, RegEnumValueA, RegOpenCurrentUser, RegCloseKey, RegDeleteKeyW, RegEnumKeyExW, RegOpenKeyExW, RegDeleteValueW, RegSetValueExW, RegCreateKeyExW, CopySid, GetLengthSid, IsValidSid, GetTokenInformation, OpenProcessToken, RegisterEventSourceW, DeregisterEventSource, CloseServiceHandle, QueryServiceStatus, QueryServiceConfigW, OpenServiceW, OpenSCManagerW, InitializeSecurityDescriptor, FreeSid, AllocateAndInitializeSid, SetSecurityDescriptorDacl, SetEntriesInAclW, SetServiceStatus, RegisterServiceCtrlHandlerW, DeleteService, ControlService, StartServiceCtrlDispatcherW, ChangeServiceConfig2W, CreateServiceW, RegEnumValueW, RegOpenKeyW, RegQueryValueExW<br>&gt; KERNEL32.dll: lstrlenW, lstrcatW, lstrcpyW, ReleaseSemaphore, WaitForSingleObject, SwitchToThread, GetCurrentProcess, InterlockedIncrement, TryEnterCriticalSection, InterlockedDecrement, InitializeCriticalSection, SetEvent, ResetEvent, EnterCriticalSection, LocalFree, LocalAlloc, lstrcmpiW, GetCommandLineW, CreateMutexW, CreateEventW, LoadLibraryW, DeleteCriticalSection, FreeLibrary, ReleaseMutex, InterlockedCompareExchange, GetModuleHandleW, GetModuleFileNameW, Sleep, WaitForMultipleObjects, UnmapViewOfFile, lstrcmpW, MapViewOfFile, CreateFileMappingW, FlushViewOfFile, GetExitCodeProcess, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleHandleA, GetStartupInfoA, GetLocaleInfoW, MoveFileExW, FormatMessageW, FormatMessageA, lstrlenA, LeaveCriticalSection, CloseHandle, DeleteFileW, CreateDirectoryW, CreateFileW, WriteFile, WideCharToMultiByte, GetVersionExA, MultiByteToWideChar, GetVersionExW, CreateSemaphoreW, GetLastError, ExpandEnvironmentStringsW, GetProcAddress, OpenProcess, SetLastError, OpenEventW, GetSystemDefaultLCID<br>&gt; USER32.dll: wsprintfW, CharNextW, LoadStringW<br>&gt; ntdll.dll: NtQueryObject, atol, iswspace<br>&gt; OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -<br>&gt; ole32.dll: CoInitializeEx, CoUninitialize, CoInitializeSecurity, CoCreateInstance, CoFreeUnusedLibraries, CoSetProxyBlanket<br>&gt; loadperf.dll: LoadPerfCounterTextStringsW, UnloadPerfCounterTextStringsW<br>&gt; wbemcomn.dll: _Throttle@@YGJKKKKK@Z<br><br>( 192 exports ) <br>__0CHPtrArray@@QAE@XZ, __0CHString@@QAE@ABV0@@Z, __0CHString@@QAE@GH@Z, __0CHString@@QAE@PBD@Z, __0CHString@@QAE@PBE@Z, __0CHString@@QAE@PBG@Z, __0CHString@@QAE@PBGH@Z, __0CHString@@QAE@XZ, __0CHStringArray@@QAE@XZ, __0CRegistry@@QAE@ABV0@@Z, __0CRegistry@@QAE@XZ, __0CRegistrySearch@@QAE@ABV0@@Z, __0CRegistrySearch@@QAE@XZ, __1CHPtrArray@@QAE@XZ, __1CHString@@QAE@XZ, __1CHStringArray@@QAE@XZ, __1CRegistry@@QAE@XZ, __1CRegistrySearch@@QAE@XZ, __4CHPtrArray@@QAEAAV0@ABV0@@Z, __4CHString@@QAEABV0@ABV0@@Z, __4CHString@@QAEABV0@D@Z, __4CHString@@QAEABV0@G@Z, __4CHString@@QAEABV0@PAV0@@Z, __4CHString@@QAEABV0@PBD@Z, __4CHString@@QAEABV0@PBE@Z, __4CHString@@QAEABV0@PBG@Z, __4CHStringArray@@QAEAAV0@ABV0@@Z, __4CRegistry@@QAEAAV0@ABV0@@Z, __4CRegistrySearch@@QAEAAV0@ABV0@@Z, __ACHPtrArray@@QAEAAPAXH@Z, __ACHPtrArray@@QBEPAXH@Z, __ACHString@@QBEGH@Z, __ACHStringArray@@QAEAAVCHString@@H@Z, __ACHStringArray@@QBE_AVCHString@@H@Z, __BCHString@@QBEPBGXZ, __H@YG_AVCHString@@ABV0@0@Z, __H@YG_AVCHString@@ABV0@G@Z, __H@YG_AVCHString@@ABV0@PBG@Z, __H@YG_AVCHString@@GABV0@@Z, __H@YG_AVCHString@@PBGABV0@@Z, __YCHString@@QAEABV0@ABV0@@Z, __YCHString@@QAEABV0@D@Z, __YCHString@@QAEABV0@G@Z, __YCHString@@QAEABV0@PBG@Z, _Add@CHPtrArray@@QAEHPAX@Z, _Add@CHStringArray@@QAEHPBG@Z, _AllocBeforeWrite@CHString@@IAEXH@Z, _AllocBuffer@CHString@@IAEXH@Z, _AllocCopy@CHString@@IBEXAAV1@HHH@Z, _AllocSysString@CHString@@QBEPAGXZ, _Append@CHPtrArray@@QAEHABV1@@Z, _Append@CHStringArray@@QAEHABV1@@Z, _AssignCopy@CHString@@IAEXHPBG@Z, _CheckAndAddToList@CRegistrySearch@@AAEXPAVCRegistry@@VCHString@@1AAVCHPtrArray@@11H@Z, _Close@CRegistry@@QAEXXZ, _CloseSubKey@CRegistry@@AAEXXZ, _Collate@CHString@@QBEHPBG@Z, _Compare@CHString@@QBEHPBG@Z, _CompareNoCase@CHString@@QBEHPBG@Z, _ConcatCopy@CHString@@IAEXHPBGH0@Z, _ConcatInPlace@CHString@@IAEXHPBG@Z, _Copy@CHPtrArray@@QAEXABV1@@Z, _Copy@CHStringArray@@QAEXABV1@@Z, _CopyBeforeWrite@CHString@@IAEXXZ, _CreateOpen@CRegistry@@QAEJPAUHKEY__@@PBGPAGKKPAU_SECURITY_ATTRIBUTES@@PAK@Z, _DeleteCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBG@Z, _DeleteCurrentKeyValue@CRegistry@@QAEKPBG@Z, _DeleteKey@CRegistry@@QAEJPAVCHString@@@Z, _DeleteValue@CRegistry@@QAEJPBG@Z, _ElementAt@CHPtrArray@@QAEAAPAXH@Z, _ElementAt@CHStringArray@@QAEAAVCHString@@H@Z, _Empty@CHString@@QAEXXZ, _EnumerateAndGetValues@CRegistry@@QAEJAAKAAPAGAAPAE@Z, _Find@CHString@@QBEHG@Z, _Find@CHString@@QBEHPBG@Z, _FindOneOf@CHString@@QBEHPBG@Z, _Format@CHString@@QAAXIZZ, _Format@CHString@@QAAXPBGZZ, _FormatMessageW@CHString@@QAAXIZZ, _FormatMessageW@CHString@@QAAXPBGZZ, _FormatV@CHString@@QAEXPBGPAD@Z, _FreeExtra@CHPtrArray@@QAEXXZ, _FreeExtra@CHString@@QAEXXZ, _FreeExtra@CHStringArray@@QAEXXZ, _FreeSearchList@CRegistrySearch@@QAEHHAAVCHPtrArray@@@Z, _GetAllocLength@CHString@@QBEHXZ, _GetAt@CHPtrArray@@QBEPAXH@Z, _GetAt@CHString@@QBEGH@Z, _GetAt@CHStringArray@@QBE_AVCHString@@H@Z, _GetBuffer@CHString@@QAEPAGH@Z, _GetBufferSetLength@CHString@@QAEPAGH@Z, _GetClassNameW@CRegistry@@QAEPAGXZ, _GetCurrentBinaryKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGPAEPAK@Z, _GetCurrentBinaryKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z, _GetCurrentBinaryKeyValue@CRegistry@@QAEKPBGPAEPAK@Z, _GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAK@Z, _GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z, _GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHStringArray@@@Z, _GetCurrentKeyValue@CRegistry@@QAEKPBGAAK@Z, _GetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z, _GetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHStringArray@@@Z, _GetCurrentRawKeyValue@CRegistry@@AAEKPAUHKEY__@@PBGPAXPAK3@Z, _GetCurrentRawSubKeyValue@CRegistry@@AAEKPBGPAXPAK2@Z, _GetCurrentSubKeyCount@CRegistry@@QAEKXZ, _GetCurrentSubKeyName@CRegistry@@QAEKAAVCHString@@@Z, _GetCurrentSubKeyPath@CRegistry@@QAEKAAVCHString@@@Z, _GetCurrentSubKeyValue@CRegistry@@QAEKPBGAAK@Z, _GetCurrentSubKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z, _GetCurrentSubKeyValue@CRegistry@@QAEKPBGPAXPAK@Z, _GetData@CHPtrArray@@QAEPAPAXXZ, _GetData@CHPtrArray@@QBEPAPBXXZ, _GetData@CHString@@IBEPAUCHStringData@@XZ, _GetData@CHStringArray@@QAEPAVCHString@@XZ, _GetData@CHStringArray@@QBEPBVCHString@@XZ, _GetLength@CHString@@QBEHXZ, _GetLongestClassStringSize@CRegistry@@QAEKXZ, _GetLongestSubKeySize@CRegistry@@QAEKXZ, _GetLongestValueData@CRegistry@@QAEKXZ, _GetLongestValueName@CRegistry@@QAEKXZ, _GetPlatformID@CRegistry@@CGKXZ, _GetSize@CHPtrArray@@QBEHXZ, _GetSize@CHStringArray@@QBEHXZ, _GetUpperBound@CHPtrArray@@QBEHXZ, _GetUpperBound@CHStringArray@@QBEHXZ, _GetValueCount@CRegistry@@QAEKXZ, _GethKey@CRegistry@@QAEPAUHKEY__@@XZ, _Init@CHString@@IAEXXZ, _InsertAt@CHPtrArray@@QAEXHPAV1@@Z, _InsertAt@CHPtrArray@@QAEXHPAXH@Z, _InsertAt@CHStringArray@@QAEXHPAV1@@Z, _InsertAt@CHStringArray@@QAEXHPBGH@Z, _IsEmpty@CHString@@QBEHXZ, _Left@CHString@@QBE_AV1@H@Z, _LoadStringW@CHString@@IAEHIPAGI@Z, _LoadStringW@CHString@@QAEHI@Z, _LocateKeyByNameOrValueName@CRegistrySearch@@QAEHPAUHKEY__@@PBG1PAPBGKAAVCHString@@3@Z, _LockBuffer@CHString@@QAEPAGXZ, _MakeLower@CHString@@QAEXXZ, _MakeReverse@CHString@@QAEXXZ, _MakeUpper@CHString@@QAEXXZ, _Mid@CHString@@QBE_AV1@H@Z, _Mid@CHString@@QBE_AV1@HH@Z, _NextSubKey@CRegistry@@QAEKXZ, _Open@CRegistry@@QAEJPAUHKEY__@@PBGK@Z, _OpenAndEnumerateSubKeys@CRegistry@@QAEJPAUHKEY__@@PBGK@Z, _OpenCurrentUser@CRegistry@@QAEKPBGK@Z, _OpenLocalMachineKeyAndReadValue@CRegistry@@QAEJPBG0AAVCHString@@@Z, _OpenSubKey@CRegistry@@AAEKXZ, _PrepareToReOpen@CRegistry@@AAEXXZ, _Release@CHString@@IAEXXZ, _Release@CHString@@KGXPAUCHStringData@@@Z, _ReleaseBuffer@CHString@@QAEXH@Z, _RemoveAll@CHPtrArray@@QAEXXZ, _RemoveAll@CHStringArray@@QAEXXZ, _RemoveAt@CHPtrArray@@QAEXHH@Z, _RemoveAt@CHStringArray@@QAEXHH@Z, _ReverseFind@CHString@@QBEHG@Z, _RewindSubKeys@CRegistry@@QAEXXZ, _Right@CHString@@QBE_AV1@H@Z, _SafeStrlen@CHString@@KGHPBG@Z, _SearchAndBuildList@CRegistrySearch@@QAEHVCHString@@AAVCHPtrArray@@00HPAUHKEY__@@@Z, _SetAt@CHPtrArray@@QAEXHPAX@Z, _SetAt@CHString@@QAEXHG@Z, _SetAt@CHStringArray@@QAEXHPBG@Z, _SetAtGrow@CHPtrArray@@QAEXHPAX@Z, _SetAtGrow@CHStringArray@@QAEXHPBG@Z, _SetCHStringResourceHandle@@YGXPAUHINSTANCE__@@@Z, _SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAK@Z, _SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z, _SetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHStringArray@@@Z, _SetCurrentKeyValue@CRegistry@@QAEKPBGAAK@Z, _SetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z, _SetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHStringArray@@@Z, _SetCurrentKeyValueExpand@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z, _SetDefaultValues@CRegistry@@AAEXXZ, _SetSize@CHPtrArray@@QAEXHH@Z, _SetSize@CHStringArray@@QAEXHH@Z, _SpanExcluding@CHString@@QBE_AV1@PBG@Z, _SpanIncluding@CHString@@QBE_AV1@PBG@Z, _TrimLeft@CHString@@QAEXXZ, _TrimRight@CHString@@QAEXXZ, _UnlockBuffer@CHString@@QAEXXZ, _myRegCreateKeyEx@CRegistry@@AAEJPAUHKEY__@@PBGKPAGKKPAU_SECURITY_ATTRIBUTES@@PAPAU2@PAK@Z, _myRegDeleteKey@CRegistry@@AAEJPAUHKEY__@@PBG@Z, _myRegDeleteValue@CRegistry@@AAEJPAUHKEY__@@PBG@Z, _myRegEnumKey@CRegistry@@AAEJPAUHKEY__@@KPAGK@Z, _myRegEnumValue@CRegistry@@AAEJPAUHKEY__@@KPAGPAK22PAE2@Z, _myRegOpenKeyEx@CRegistry@@AAEJPAUHKEY__@@PBGKKPAPAU2@@Z, _myRegQueryInfoKey@CRegistry@@AAEJPAUHKEY__@@PAGPAK22222222PAU_FILETIME@@@Z, _myRegQueryValueEx@CRegistry@@AAEJPAUHKEY__@@PBGPAK2PAE2@Z, _myRegSetValueEx@CRegistry@@AAEJPAUHKEY__@@PBGKKPBEK@Z, _s_dwPlatform@CRegistry@@0KA<br>
PDFiD.: -
RDS...: NSRL Reference Data Set<br>-
hari84
 
Messages: 6
Inscription: 19 Avr 2009, 16:56

Messagede hari84 » 25 Avr 2009, 11:38

Bonjour, désolé pour le temps de réponse
Après toutes les manips indiquées, apparemment aucun virus détecté, serait ce un faux + ?
sinon hijack this fonctionne à nouveau (???)
merci de vos réponses
hari84
 
Messages: 6
Inscription: 19 Avr 2009, 16:56

Messagede nickW » 25 Avr 2009, 12:52

Bonjour,

nickW, le 23/04/2009 à 19h09, a écrit:A mon avis, il s'agit d'un faux-positif (détection erronée), ...


:wink:


HijackThis ne devait pas fonctionner après la mise en quarantaine des fichiers par ton antivirus (et avant que Windows ne les restaure automatiquement).


Salut,
nickW - Image
30/07/2012: Plus de désinfection de PC jusqu'à nouvel ordre.
Pas de demande d'analyse de log en MP (Message Privé)
Mes configs
Avatar de l’utilisateur
nickW
Modérateur
 
Messages: 21698
Inscription: 20 Mai 2004, 17:41
Localisation: Dordogne/Île de France

Messagede hari84 » 25 Avr 2009, 12:59

Merci à toi
je note le sujet comme résolu
a bientôt
hari84
 
Messages: 6
Inscription: 19 Avr 2009, 16:56


Retourner vers Sécurité (Contamination - Décontamination)

Qui est en ligne

Utilisateurs parcourant ce forum: Aucun utilisateur enregistré et 48 invités