WinTaskAdInstPack.exe

Salut,

GitanosJazz:

Connaissez-vous cette bébête là ?

Je dirais: not-a-virus:AdWare.WinAd chez KAV.

--
joke0

Bonjour à tous
Connaissez-vous cette bébête là ?
WinTaskAdInstPack.exe
KAV signale un virus Install~1.exe dans C:temp
qui comporte ce "WinTaskAdInstPack.exe",
royalement inconnu.

D'habitude, KAV me prévient 3 à 4 fois de suite
et je supprime à chaque fois sans chercher
dans C:temp.

Mathieu@(SecuVirus.com) a répondu
Salut,
Alors je me suis procuré : WinTaskAdInstPack.exe ( 127Ko ) sur eMule
Compressé avec UPX et programmé avec Microsoft Visual C++ 6.0.
* Possible StringData Ref from Data Obj ->"Info.txt"
* Possible StringData Ref from Data Obj ->"License.txt"

0042602F . 74 69 6E 67 2>ASCII "ting this agreem"
0042603F . 65 6E 74 20 7>ASCII "ent you also acc"
0042604F . 65 70 74 20 7>ASCII "ept the terms an"
0042605F . 64 20 63 6F 6>ASCII "d conditions of "
0042606F . 74 68 65 20 3>ASCII "the 180search As"
0042607F . 73 69 73 74 6>ASCII "sistant End User"
0042608F . 20 4C 69 63 6>ASCII " License agreeme"
0042609F . 6E DB 6E ; CHAR
'n'
004260A0 . 74 20 61 6E 6>ASCII "t and privacy st"
004260B0 . 61 74 65 6D 6>ASCII "atement located "
004260C0 . 61 74 20 68 7>ASCII "at http://www.18"
004260D0 . 30 73 65 61 7>ASCII "0searchassistant"
004260E0 . 2E 63 6F 6D 2>ASCII ".com/eula.aspx. "
004260F0 . 31 38 30 73 6>ASCII "180search Assist"
00426100 . 61 6E 74 20 6>ASCII "ant is a permi"
0042610E . 73 DB 73 ; CHAR
's'
0042610F . 73 69 6F 6E 2>ASCII "sion-based searc"
0042611F . 68 20 61 73 7>ASCII "h assistant appl"
0042612F . 69 63 61 74 6>ASCII "ication that pro"
0042613F . 76 69 64 65 7>ASCII "vides access to "
0042614F . 61 20 77 69 6>ASCII "a wide range of "
0042615F . 77 65 62 73 6>ASCII "websites, applic"
0042616F . 61 74 69 6F 6>ASCII "ations and infor"
0042617F . 6D 61 74 ASCII "mat"
00426182 . 69 DB 69 ; CHAR
'i'
00426183 . 6F 6E 2E 20 3>ASCII "on. 180search As"
00426193 . 73 69 73 74 6>ASCII "sistant will per"
004261A3 . 69 6F 64 69 6>ASCII "iodically direct"
004261B3 . 20 79 6F 75 2>ASCII " you to our spon"
004261C3 . 73 6F 72 73 2>ASCII "sors' websites, "
004261D3 . 61 6C 6C 6F 7>ASCII "allowing you to "
004261E3 . 63 6F 6D 70 6>ASCII "compare p"
004261EC . 72 DB 72 ; CHAR
'r'
004261ED . 6F 64 75 63 7>ASCII "oducts, services"
004261FD . 2C 20 61 6E 6>ASCII ", and prices bet"
0042620D . 77 65 65 6E 2>ASCII "ween websites. 1"
0042621D . 38 30 73 65 6>ASCII "80search Assista"
0042622D . 6E 74 20 77 6>ASCII "nt will collect "
0042623D . 69 6E 66 6F 7>ASCII "information abou"
0042624D . 74 20 74 68 6>ASCII "t the websites y"
0042625D . 6F 75 ASCII "ou"
0042625F . 20 DB 20 ; CHAR
' '
00426260 . 76 69 73 69 7>ASCII "visit, but will "
00426270 . 6E 6F 74 20 6>ASCII "not collect any "
00426280 . 69 DB 69 ; CHAR
'i'
00426281 . 6E 66 6F 72 6>ASCII "nformation that "
00426291 . 77 69 6C 6C 2>ASCII "will be used to "
004262A1 . 69 64 65 6E 7>ASCII "identify you per"
004262B1 . 73 6F 6E 61 6>ASCII "sonally. The inf"
004262C1 . 6F 72 6D 61 7>ASCII "ormation that 18"
004262D1 . 30 73 65 61 7>ASCII "0search Assistan"
004262E1 . 74 20 63 6F 6>ASCII "t collect"
004262EA . 73 DB 73 ; CHAR
's'
004262EB . 20 61 6E 64 2>ASCII " and transmits w"
004262FB . 69 6C 6C 20 6>ASCII "ill be used to p"
0042630B . 72 6F 76 69 6>ASCII "rovide you with "
0042631B . 61 63 63 65 7>ASCII "access to compar"
0042632B . 61 74 69 76 6>ASCII "ative shopping o"
0042633B . 70 70 6F 72 7>ASCII "pportunities at "
0042634B . 74 69 6D 65 7>ASCII "times when we co"
0042635B . 6E 73 69 ASCII "nsi"
0042635E . 64 DB 64 ; CHAR
'd'
0042635F . 65 72 20 74 6>ASCII "er them most rel"
0042636F . 65 76 61 6E 7>ASCII "evant. 180search"
0042637F . 20 41 73 73 6>ASCII " Assistant can b"
0042638F . 65 20 75 6E 6>ASCII "e uninstalled at"
0042639F . 20 61 6E 79 2>ASCII " any time by goi"
004263AF . 6E 67 20 74 6>ASCII "ng to the "Add/R"
004263BF . 65 6D 6F 76 ASCII "emov"
004263C3 . 65 DB 65 ; CHAR
'e'
004263C4 . 20 50 72 6F 6>ASCII " Programs" menu "
004263D4 . 6F 6E 20 79 6>ASCII "on your computer"
004263E4 . 20 61 6E 64 2>ASCII " and clicking th"
004263F4 . 65 20 22 52 6>ASCII "e "Remove" butto"
00426404 . 6E 20 6E 65 7>ASCII "n next to the en"
00426414 . 74 72 79 20 6>ASCII "try for Uninstal"
00426424 . 6C 20 31 38 3>ASCII "l 180"
00426429 . 73 DB 73 ; CHAR
's'
0042642A . 65 61 72 63 6>ASCII "earch Assistant."
0042643A . 20 54 6F 20 6>ASCII " To learn more a"
0042644A . 62 6F 75 74 2>ASCII "bout the 180sear"
0042645A . 63 68 20 41 7>ASCII "ch Assistant, pl"
0042646A . 65 61 73 65 2>ASCII "ease visit the 1"
0042647A . 38 30 73 65 6>ASCII "80search Assista"
0042648A . 6E 74 20 77 6>ASCII "nt website at ww"
0042649A . 77 2E 31 ASCII "w.1"
0042649D . 38 DB 38 ; CHAR
'8'
0042649E . 30 73 65 61 7>ASCII "0searchassistant"
004264AE . 2E 63 6F 6D 2>ASCII ".com.

Access "
004264BE . 69 73 20 6D 6>ASCII "is made availabl"
004264CE . 65 20 6F 6E 6>ASCII "e only t"
004264D6 . 6F DB 6F ; CHAR
'o'
004264D7 . 20 74 68 6F 7>ASCII " those who accep"
004264E7 . 74 20 74 68 6>ASCII "t the terms of t"
004264F7 . 68 65 20 66 6>ASCII "he following agr"
00426507 . 65 65 6D 65 6>ASCII "eement:

By ac"
00426517 . 63 65 70 74 6>ASCII "cepting this agr"
00426527 . 65 65 6D 65 6>ASCII "eement, I certif"
00426537 . 79 20 74 68 6>ASCII "y the following"
00426546 3A DB 3A ; CHAR
':'
00426547 0D DB 0D
00426548 0A DB 0A
00426549 . 2D DB 2D ; CHAR
'-'
0042654A . 20 49 20 61 6>ASCII " I am an adult, "
0042655A . 62 65 69 6E 6>ASCII "being at least 1"
0042656A . 38 20 79 65 6>ASCII "8 years of ag"
00426577 65 DB 65 ; CHAR
'e'
00426578 2E DB 2E ; CHAR
'.'
00426579 0D DB 0D
0042657A 0A DB 0A
0042657B . 2D DB 2D ; CHAR
'-'
0042657C . 20 49 20 61 6>ASCII " I am the owner "
0042658C . 6F 66 20 74 6>ASCII "of this computer"
0042659C . 2C 20 6F 72 2>ASCII ", or am autho"
004265A9 . 72 DB 72 ; CHAR
'r'
004265AA . 69 7A 65 64 2>ASCII "ized by the owne"
004265BA . 72 20 6F 66 2>ASCII "r of this comput"
004265CA . 65 72 20 74 6>ASCII "er to install so"
004265DA . 66 74 77 61 7>ASCII "ftware on this s"
004265EA . 79 73 74 65 6>ASCII "ystem.
- I unde"
004265FA . 72 73 74 61 6>ASCII "rstand that by a"
0042660A . 63 63 65 70 7>ASCII "ccepting these t"
0042661A . 65 72 ASCII "er"
0042661C . 6D DB 6D ; CHAR
'm'
0042661D . 73 20 61 6E 6>ASCII "s and conditions"
0042662D . 2C 20 74 68 6>ASCII ", this program w"
0042663D . 69 6C 6C 20 6>ASCII "ill be installed"
0042664D . 20 6F 6E 20 6>ASCII " on my computer "
0042665D . 61 6E 64 20 6>ASCII "and my web brows"
0042666D . 65 72 20 68 6>ASCII "er home and sear"
0042667D . 63 68 20 70 6>ASCII "ch page will "
0042668A . 62 DB 62 ; CHAR
'b'
0042668B . 65 20 63 68 6>ASCII "e changed in ord"
0042669B . 65 72 20 74 6>ASCII "er to allow me a"
004266AB . 63 63 65 73 7>ASCII "ccess.
- I furt"
004266BB . 68 65 72 20 7>ASCII "her understand t"
004266CB . 68 61 74 20 6>ASCII "hat an accessory"
004266DB . 20 74 6F 6F 6>ASCII " tool bar will b"
004266EB . 65 20 ASCII "e "
004266ED . 61 DB 61 ; CHAR
'a'
004266EE . 64 64 65 64 2>ASCII "dded to my web b"
004266FE . 72 6F 77 73 6>ASCII "rowser which wil"
0042670E . 6C 20 72 65 6>ASCII "l remain visible"
0042671E . 20 61 73 20 6>ASCII " as long as the "
0042672E . 73 6F 66 74 7>ASCII "software is inst"
0042673E . 61 6C 6C 65 6>ASCII "alled and agree "
0042674E . 74 ASCII "t"
0042674F . 68 DB 68 ; CHAR
'h'
00426750 . 61 74 20 49 2>ASCII "at I wish to use"
00426760 . 20 79 6F 75 7>ASCII " your search eng"
00426770 . 69 6E 65 20 6>ASCII "ine for my web b"
00426780 . 72 6F 77 73 6>ASCII "rowsers auto sea"
00426790 . 72 63 68 20 6>ASCII "rch option and d"
004267A0 . 65 66 61 75 6>ASCII "efault error pag"
004267B0 . 65 2E 20 44 6>ASCII "e. Defau"
004267B8 . 6C DB 6C ; CHAR
'l'
004267B9 . 74 20 65 72 7>ASCII "t error page cha"
004267C9 . 6E 67 65 73 2>ASCII "nges include add"
004267D9 . 69 6E 67 20 6>ASCII "ing a domain nam"
004267E9 . 65 20 73 75 6>ASCII "e suffix to your"
004267F9 . 20 64 6E 73 2>ASCII " dns setting if "
00426809 . 79 6F 75 20 6>ASCII "you do not alrea"
00426819 . 64 79 20 68 6>ASCII "dy have this"
00426825 . 20 DB 20 ; CHAR
' '
00426826 . 6F 70 74 69 6>ASCII "option set.
- T"
00426836 . 6F 20 65 6E 7>ASCII "o ensure you alw"
00426846 . 61 DB 61 ; CHAR
'a'
00426847 . 79 73 20 68 6>ASCII "ys have the late"
00426857 . 73 74 20 76 6>ASCII "st version and f"
00426867 . 6F 72 20 79 6>ASCII "or your convenie"
00426877 . 6E 63 65 20 7>ASCII "nce this softwar"
00426887 . 65 20 77 69 6>ASCII "e will automatic"
00426897 . 61 6C 6C 79 2>ASCII "ally update itse"
004268A7 . 6C ASCII "l"
004268A8 . 66 DB 66 ; CHAR
'f'
004268A9 . 20 66 72 6F 6>ASCII " from time to ti"
004268B9 . 6D 65 20 6F 6>ASCII "me once installe"
004268C9 . 64 2E 0D 0A 2>ASCII "d.
- If you dec"
004268D9 . 69 64 65 20 7>ASCII "ide to change yo"
004268E9 . 75 72 20 68 6>ASCII "ur homepage at a"
004268F9 . 20 6C 61 74 6>ASCII " later date our "
00426909 . 70 61 73 73 7>ASCII "passth"
0042690F . 72 DB 72 ; CHAR
'r'
00426910 . 6F 75 67 68 2>ASCII "ough toolbar wil"
00426920 . 6C 20 62 65 2>ASCII "l be installed i"
00426930 . 6E 20 79 6F 7>ASCII "n your webbrowse"
00426940 . 72 2E 20 54 6>ASCII "r. This toolbar "
00426950 . 77 69 6C 6C 2>ASCII "will remain acti"
00426960 . 76 65 20 61 7>ASCII "ve as long as th"
00426970 . 69 73 20 73 6>ASCII "is software is i"
00426980 . 6E 73 ASCII "ns"
00426982 . 74 DB 74 ; CHAR
't'
00426983 . 61 6C 6C 65 6>ASCII "alled on your sy"
00426993 . 73 74 65 6D 2>ASCII "stem.
- I under"
004269A3 . 73 74 61 6E 6>ASCII "stand that, by a"
004269B3 . 63 63 65 70 7>ASCII "ccepting these t"
004269C3 . 65 72 6D 73 2>ASCII "erms and conditi"
004269D3 . 6F 6E 73 2C 2>ASCII "ons, bookmarks t"
004269E3 . 68 61 74 20 6>ASCII "hat may lead to "
004269F3 . 63 6F 6E 74 ASCII "cont"
004269F7 . 65 DB 65 ; CHAR
'e'
004269F8 . 6E 74 20 6F 6>ASCII "nt of an adult a"
00426A08 . 6E 64 2F 6F 7>ASCII "nd/or sexual nat"
00426A18 . 75 72 65 20 7>ASCII "ure will be adde"
00426A28 . 64 20 74 6F 2>ASCII "d to my system, "
00426A38 . 77 68 69 63 6>ASCII "which may be rem"
00426A48 . 6F 76 65 64 2>ASCII "oved manually or"
00426A58 . 20 76 69 61 2>ASCII " via "
00426A5D . 75 DB 75 ; CHAR
'u'
00426A5E . 6E 2D 69 6E 7>ASCII "n-installation o"
00426A6E . 66 20 74 68 6>ASCII "f the software.
"
00426A7E . 0A 2D 20 49 6>ASCII "
- In order for "
00426A8E . 75 73 20 74 6>ASCII "us to keep this "
00426A9E . 73 6F 66 74 7>ASCII "software free fr"
00426AAE . 6F 6D 20 74 6>ASCII "om time to time "
00426ABE . 70 72 6F 6D 6>ASCII "promotional offe"
00426ACE . 72 73 20 66 7>ASCII "rs fr"
00426AD3 . 6F DB 6F ; CHAR
'o'
00426AD4 . 6D 20 6F 75 7>ASCII "m our sponsors w"
00426AE4 . 69 6C 6C 20 6>ASCII "ill be displayed"
00426AF4 . 20 74 6F 20 7>ASCII " to you.
- To p"
00426B04 . 72 65 76 65 6>ASCII "revent your brow"
00426B14 . 73 65 72 20 6>ASCII "ser from becomin"
00426B24 . 67 20 63 6C 7>ASCII "g cluttered when"
00426B34 . 20 6F 75 72 2>ASCII " our toolbar is"
00426B43 . 20 DB 20 ; CHAR
' '
00426B44 . 69 6E 73 74 6>ASCII "installed, any o"
00426B54 . 74 68 65 72 2>ASCII "ther toolbars yo"
00426B64 . 75 DB 75 ; CHAR
'u'
00426B65 . 20 63 75 72 7>ASCII " currently have "
00426B75 . 76 69 73 69 6>ASCII "visible will be "
00426B85 . 64 65 61 63 7>ASCII "deactivated. The"
00426B95 . 79 20 63 61 6>ASCII "y can be restore"
00426BA5 . 64 20 6D 61 6>ASCII "d manually throu"
00426BB5 . 67 68 20 74 6>ASCII "gh the IE view m"
00426BC5 . 65 6E 75 2E 0>ASCII "enu.
- Once ins"
00426BD5 . 74 61 6C 6C 6>ASCII "talle"
00426BDA . 64 DB 64 ; CHAR
'd'
00426BDB . 20 69 66 20 7>ASCII " if you decide t"
00426BEB . 6F 20 63 68 6>ASCII "o change your st"
00426BFB . 61 72 74 20 6>ASCII "art or search pa"
00426C0B . 67 65 20 74 6>ASCII "ge this informat"
00426C1B . 69 6F 6E 20 7>ASCII "ion will be sent"
00426C2B . 20 62 61 63 6>ASCII " back to our ser"
00426C3B . 76 65 72 2E ASCII "ver."
00426C3F 0D DB 0D
00426C40 0A DB 0A
00426C41 . 2D DB 2D ; CHAR
'-'
00426C42 . 20 42 6F 6F 6>ASCII " Bookmarking to "
00426C52 . 61 20 70 61 6>ASCII "a page on this s"
00426C62 . 65 72 76 65 7>ASCII "erver/site wh"
00426C6F . 65 DB 65 ; CHAR
'e'
00426C70 . 72 65 62 79 2>ASCII "reby this warnin"
00426C80 . 67 20 70 61 6>ASCII "g page is by-pas"
00426C90 . 73 65 64 20 7>ASCII "sed shall consti"
00426CA0 . 74 75 74 65 2>ASCII "tute an implicit"
00426CB0 . 20 61 63 63 6>ASCII " acceptance of t"
00426CC0 . 68 65 20 66 6>ASCII "he foregoing ter"
00426CD0 . 6D 73 20 68 6>ASCII "ms he"
00426CD5 . 72 DB 72 ; CHAR
'r'
00426CD6 . 65 69 6E 20 7>ASCII "ein set forth.
"
00426CE6 . 2D 20 49 20 7>ASCII "- I understand t"
00426CF6 . 68 65 20 73 7>ASCII "he standards and"
00426D06 . 20 6C 61 77 7>ASCII " laws of the com"
00426D16 . 6D 75 6E 69 7>ASCII "munity, site and"
00426D26 . 20 63 6F 6D 7>ASCII " computer to whi"
00426D36 . 63 68 20 49 2>ASCII "ch I am transpor"
00426D46 . 74 69 ASCII "ti"
00426D48 . 6E DB 6E ; CHAR
'n'
00426D49 . 67 20 74 68 6>ASCII "g this material,"
00426D59 . 20 61 6E 64 2>ASCII " and am solely r"
00426D69 . 65 73 70 6F 6>ASCII "esponsible for m"
00426D79 . 79 20 61 63 7>ASCII "y actions.
- If"
00426D89 . 20 49 20 75 7>ASCII " I use these ser"
00426D99 . 76 69 63 65 7>ASCII "vices in violati"
00426DA9 . 6F 6E 20 6F 6>ASCII "on of the abov"
00426DB7 . 65 DB 65 ; CHAR
'e'
00426DB8 . 20 61 67 72 6>ASCII " agreement, I
"
00426DC8 . 75 6E 64 65 7>ASCII "understand I may"
00426DD8 . 20 62 65 20 6>ASCII " be in violation"
00426DE8 . 20 6F 66 20 6>ASCII " of local and/or"
00426DF8 . 20 66 65 64 6>ASCII " federal laws an"
00426E08 . 64 20 61 6D 2>ASCII "d am solely
re"
00426E18 . 73 70 6F 6E 7>ASCII "spons"
00426E1D . 69 DB 69 ; CHAR
'i'
00426E1E . 62 6C 65 20 6>ASCII "ble for my actio"
00426E2E . 6E 73 2E 0D 0>ASCII "ns.
- By accept"
00426E3E . 69 6E 67 20 7>ASCII "ing these terms "
00426E4E . 61 6E 64 20 6>ASCII "and conditions, "
00426E5E . 49 20 77 69 6>ASCII "I will have rele"
00426E6E . 61 73 65 64 2>ASCII "ased and dischar"
00426E7E . 67 65 64 20 7>ASCII "ged the p"
00426E87 . 72 DB 72 ; CHAR
'r'
00426E88 . 6F 76 69 64 6>ASCII "oviders, owners "
00426E98 . 61 6E 64 20 6>ASCII "and creators of "
00426EA8 . 74 68 69 73 2>ASCII "this software/si"
00426EB8 . 74 65 20 66 7>ASCII "te from any and "
00426EC8 . 61 6C 6C 20 6>ASCII "all liability wh"
00426ED8 . 69 63 68 20 6>ASCII "ich might arise."
00426EE8 . 0D 0A 42 79 2>ASCII "
By clicking AC"
00426EF8 . 43 45 ASCII "CE"
00426EFA . 50 DB 50 ; CHAR
'P'
00426EFB . 54 20 79 6F 7>ASCII "T you agree to t"
00426F0B . 68 65 20 74 6>ASCII "he terms of the "
00426F1B . 70 72 65 63 6>ASCII "preceding agreem"
00426F2B . 65 6E 74 2E 0>ASCII "ent.

For gene"
00426F3B . 72 61 6C 20 7>ASCII "ral support plea"
00426F4B . 73 DB 73 ; CHAR
's'
00426F4C . 65 20 65 6D 6>ASCII "e email support@"
00426F5C . 62 6C 61 7A 6>ASCII "blazefind.com. F"
00426F6C . 6F 72 20 63 6>ASCII "or comments or c"
00426F7C . 6F 6E 63 65 7>ASCII "oncerns about a "
00426F8C . 77 65 62 73 6>ASCII "website that is "
00426F9C . 70 72 6F 6D 6>ASCII "promoting this s"
00426FAC . 6F 66 74 77 6>ASCII "oftware please e"
00426FBC . 6D 61 69 ASCII "mai"
00426FBF . 6C DB 6C ; CHAR
'l'
00426FC0 . 20 73 75 70 7>ASCII " support@blazefi"
00426FD0 . 6E 64 2E 63 6>ASCII "nd.com with all "
00426FE0 . 70 65 72 74 6>ASCII "pertinent inform"
00426FF0 . 61 74 69 6F 6>ASCII "ation.

1. LIC"
00427000 . 45 4E 53 45 2>ASCII "ENSE GRANT. "You"
00427010 . 22 20 6D 65 6>ASCII "" means the pers"
00427020 . 6F 6E 20 6F 7>ASCII "on or compan"
0042702C . 79 DB 79 ; CHAR
'y'
0042702D . 20 77 68 6F 2>ASCII " who is being li"
0042703D . 63 65 6E 73 6>ASCII "censed to use th"
0042704D . 65 20 73 6F 6>ASCII "e software and/o"
0042705D . 72 20 73 65 7>ASCII "r service. "We","
0042706D . 20 22 75 73 2>ASCII " "us" means BLAZ"
0042707D . 45 46 49 4E 4>ASCII "EFIND.COM, "Soft"
0042708D . 77 61 72 65 2>ASCII "ware" means soft"
0042709D . 77 61 72 65 2>ASCII "ware owne"
004270A6 . 64 DB 64 ; CHAR
'd'

Donc ça semble pas être un virus mais un Spy de la suite connue 180search
(http://www.180searchassistant.com )

Dodo time
Bonne Nuit!
Mathieu



begin 666 wink.gif
M1TE&.#EA#P`/`+,``````+^_O___````````````````````````````````
M`````````````````````"'Y! $```$`+ `````/`````0T,$@):ITX5,'Y
MQ4 G>E,XC@`EF.MJIJSEQ>PI;C9:YZYGOQK?C12<R8C%7P;7^60TEA0F`@`[
`
end

begin 666 smile.gif
M1TE&.#EA#P`/`)$!`````+^_O___`````"'Y! $```$`+ `````/`````(N
MC V9QY$"X6(@6GGJO0!)+3RA$XDA:&Y6JGXMIX$K%G,8^2EE]G:4?&ID%+Y#
#`0`[
`
end