SahAgent

[super_newbie_pro]

Bonjour

J'ai découvert un fichier txt nommé SahAgent.log contenant ceci :
__________________
Cannot open registry TypeLib {CDE442A3-DC2C-467E-A311-B4BC775D86C5}1.1win32
Cannot read registry TypeLib {CDE442A3-DC2C-467E-A311-B4BC775D86C5}1.1win32
Reading default activeX cache C:WINDOWSDownloaded Program Files
Success copy lsp.dll
Success copy SahAgent.exe
Success copy SahDownloader.exe
Success copy xmlparse.dll
Success copy xmltok.dll
Success copy sporder.dll
Success copy SAHUninstall.exe
Success copy v.dat
Success copy vg.dat
Delete C:WINDOWSDownloaded Program Filesv.dat succeeded
Delete C:WINDOWSDownloaded Program Filesvg.dat succeeded
Scanning Installed Providers

Installing Layered Providers

Installed over MSAFD Tcpip [TCP/IP]
Installed over MSAFD Tcpip [UDP/IP]
Installed over MSAFD Tcpip [RAW/IP]
Installed over RSVP UDP Service Provider
Installed over RSVP TCP Service Provider
Installed over MSAFD nwlnkipx [IPX]
Installed over MSAFD nwlnkspx [SPX]
Installed over MSAFD nwlnkspx [SPX] [Pseudo Stream]
Installed over MSAFD nwlnkspx [SPX II]
Installed over MSAFD nwlnkspx [SPX II] [Pseudo Stream]
Installed over MSAFD NetBIOS [DeviceNwlnkNb] SEQPACKET 4
Installed over MSAFD NetBIOS [DeviceNwlnkNb] DATAGRAM 4
Installed over MSAFD NetBIOS [DeviceNetBT_Tcpip_{BF7288F6-D85A-4332-8B85-388C9AC8DBA0}] SEQPACKET 0
Installed over MSAFD NetBIOS [DeviceNetBT_Tcpip_{BF7288F6-D85A-4332-8B85-388C9AC8DBA0}] DATAGRAM 0
Installed over MSAFD NetBIOS [DeviceNetBT_Tcpip_{80B20B70-5A0A-49AF-A3F8-62F7760D08E2}] SEQPACKET 1
Installed over MSAFD NetBIOS [DeviceNetBT_Tcpip_{80B20B70-5A0A-49AF-A3F8-62F7760D08E2}] DATAGRAM 1
Installed over MSAFD NetBIOS [DeviceNetBT_Tcpip_{3162CCE6-DEF8-4880-A5DC-901EDAB5C46C}] SEQPACKET 2
Installed over MSAFD NetBIOS [DeviceNetBT_Tcpip_{3162CCE6-DEF8-4880-A5DC-901EDAB5C46C}] DATAGRAM 2
Installed over MSAFD NetBIOS [DeviceNetBT_Tcpip_{45C82B38-AA9E-429B-A973-C047856002F7}] SEQPACKET 3
Installed over MSAFD NetBIOS [DeviceNetBT_Tcpip_{45C82B38-AA9E-429B-A973-C047856002F7}] DATAGRAM 3
Installed over MSAFD NetBIOS [DeviceNetBT_Tcpip_{AF94D4CD-BCDF-49F0-8D19-FD5FBB0EF3C5}] SEQPACKET 5
Installed over MSAFD NetBIOS [DeviceNetBT_Tcpip_{AF94D4CD-BCDF-49F0-8D19-FD5FBB0EF3C5}] DATAGRAM 5
Preparing To Reoder Installed Chains

Reodering Installed Chains

Saving New Protocol Order

Installation is completed.
_____________

je n'ai jamais installé ce truc et il ne figure pas dans les programmes pouvant être désinstallés et j'ai l'impression qu'il s'agit d'un sérieux spyware... Pourriez vous me le confirmer voire m'expliquer comment procéder pour l'enlever de mon ordi ?
Merci

[eser]

Salut
J'ai trouvé à§a: <a href="http://www.computing.net/security/wwwbo ... /6211.html" target="_blank">http://www.computing.net/security/wwwbo ... 11.html</a>

[super_newbie_pro]

<< Nom : Dave
Date : le 27 aoà»t 2003 à  15:33:13 le Pacifique
Sujet : aide virale : (

Réponse :
Vous avez spyware dirigeant-
O4 - HKLM ..Run : [SAHAgent] C:WINDOWSSystem32SahAgent.exe

C'est de ShopAtHome. Proximité cela. >>

Visiblement, ce serait un spyware... Cependant, ayant déjà  vu le coup avec le soit disant nounours qui était un virus, quelqu'un peut il confirmer qu'il faut supprimer SahAgent.exe ?

Merci

[Invité]

<a href="http://www.alltheweb.com/search?avkw=fo ... _lang=pref" target="_blank">http://www.alltheweb.com/search?avkw=fo ... ng=pref</a>
----------------------------------------------------------------------------------------
<a href="http://www.doxdesk.com/parasite/ShopAtHomeSelect.html" target="_blank">http://www.doxdesk.com/parasite/ShopAtH ... ct.html</a>
c'est effectivement un spy...
"The software can download and execute arbitrary code from its controlling server, as a silent update feature."
----------------------------------------------------------------------------------------
SAHagent Sahagent.exe Shop At Home Network parasite - security issues
<a href="http://www.pacs-portal.co.uk/startup_pa ... rtup_s.php" target="_blank">http://www.pacs-portal.co.uk/startup_pa ... p_s.php</a>

là , plus aucun remors à  enlever ce "truc"....
salut

[super_newbie_pro]

Ok merci ! <IMG SRC="/images/smiles/thumbs_up46.gif">

G donc viré dans system32 deux programmes :

SahAgent.exe
et SahAgentdownload.exe <IMG SRC="/images/smiles/shades_smile46.gif">