Bon ben vous le savez; hack + souris
Fermé
Utilisateur anonyme
-
Utilisateur anonyme -
Utilisateur anonyme -
salut Gerard, salut olivier
merci a vous 2 !
voila ci joint mon hijack this, apparremment clean,vraiment j espere trouver avant de passer a l etape superieure [...]
Ma souris se fige bcp et fais un peu n importe quoi
Logfile of HijackThis v1.99.1
Scan saved at 21:31:31, on 07/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\FICHIE~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exe
C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\AOL 9.0a\waol.exe
C:\Program Files\AOL 9.0a\shellmon.exe
C:\Program Files\Fichiers communs\Aol\aoltpspd.exe
C:\Documents and Settings\Propriétaire\Mes documents\Mes Projets\protection\hijackthis_199\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\FICHIE~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1B3D55E8-2565-4A51-A094-32EBFF549A5F}: NameServer = 205.188.146.145
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
--------------------------------------------------------
---------------------------------------------------------
Un silent runner :
"Silent Runners.vbs", revision 39, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"RecordNow!" = (empty string)
"NVIEW" = "rundll32.exe nview.dll,nViewLoadHook" [MS]
"BackupNotify" = "c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [null data]
"Acme.PCHButton" = "C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exe" ["Motive Communications, Inc."]
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"hpsysdrv" = "c:\windows\system\hpsysdrv.exe" ["Hewlett-Packard Company"]
"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
"CamMonitor" = "c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [empty string]
"HPHUPD05" = "c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [file not found]
"HPHmon05" = "C:\WINDOWS\System32\hphmon05.exe" ["Hewlett-Packard"]
"KBD" = "C:\HP\KBD\KBD.EXE" ["Hewlett-Packard Company"]
"UpdateManager" = ""C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r" ["Sonic Solutions"]
"Recguard" = "C:\WINDOWS\SMINST\RECGUARD.EXE" [empty string]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /installquiet /keeploaded /nodetect" ["NVIDIA Corporation"]
"VTTimer" = "VTTimer.exe" [file not found]
"ATIModeChange" = "Ati2mdxx.exe" ["ATI Technologies, Inc."]
"PS2" = "C:\WINDOWS\system32\ps2.exe" ["Hewlett-Packard Company"]
"ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"Microsoft Works Update Detection" = "C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" ["Microsoft® Corporation"]
"RealTray" = "C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER" ["RealNetworks, Inc."]
"AOLSAV" = "C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe" ["TechCity Solutions France"]
"AOLDialer" = "C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe" ["America Online, Inc"]
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON"]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"AOL Spyware Protection" = ""C:\PROGRA~1\FICHIE~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"" [null data]
"csymenbkzj" = "c:\windows\system32\csymenbkzj.exe -start" [null data]
"AVGCtrl" = ""C:\Program Files\AVPersonal\AVGNT.EXE" /min" ["H+BEDV Datentechnik GmbH"]
"Zone Labs Client" = "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" ["Zone Labs, LLC"]
"msnappau" = ""C:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exe"" [MS]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup\ {++}
EXECUTION UNLIKELY: "Registrando Panda ActiveX" = "C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\ActiveScan\as.dll" [MS]
EXECUTION UNLIKELY: "Registrando Panda Almacen" = "C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\ActiveScan\pavpz.dll" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\(Default) = "ST" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll" [MS]
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = "MSNToolBandBHO" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{19CC43A1-6925-4B48-B292-830291F393A6}" = "HPNSView"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\HP\Digital Imaging\bin\hpdns_01.dll" [empty string]
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}" = "RecordNow! SendToExt"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\RecordNow!\shlext.dll" ["Sonic Solutions"]
"{7F67036B-66F1-411A-AD85-759FB9C5B0DB}" = "SampleView"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Explorateur de Bureau"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
"{D3581EB7-5E16-4182-9F58-86FA713B42F9}" = "AOL"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\FICHIE~1\aolshare\shell\fr\shellext.dll" ["America Online, Inc."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AntiVir/Win\(Default) = "{a7cda720-84ee-11d0-b5c0-00001b3ca278}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\AVPersonal\AVShlExt.DLL" ["H+BEDV Datentechnik GmbH"]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
AntiVir/Win\(Default) = "{a7cda720-84ee-11d0-b5c0-00001b3ca278}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\AVPersonal\AVShlExt.DLL" ["H+BEDV Datentechnik GmbH"]
Active Desktop and Wallpaper:
-----------------------------
Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Propriétaire\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"
Enabled Screen Saver:
---------------------
HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\ssstars.scr" [MS]
Startup items in "Propriétaire" & "All Users" startup folders:
--------------------------------------------------------------
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
Enabled Scheduled Tasks:
------------------------
"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 19
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}" = "Vue HP" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll" ["Hewlett-Packard Company"]
"{4982D40A-C53B-4615-B15B-B5B5E98D167C}" = "AOL Toolbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\AOL Toolbar\toolbar.dll" ["IE Toolbar"]
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}" = "Vue HP" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll" ["Hewlett-Packard Company"]
"{4982D40A-C53B-4615-B15B-B5B5E98D167C}" = "AOL Toolbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\AOL Toolbar\toolbar.dll" ["IE Toolbar"]
"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = "MSN" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]
HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{4982D40A-C53B-4615-B15B-B5B5E98D167C}" = "AOL Toolbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\AOL Toolbar\toolbar.dll" ["IE Toolbar"]
"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = "0"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]
Explorer Bars
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\ = "Real.com" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Shdocvw.dll" [MS]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{4982D40A-C53B-4615-B15B-B5B5E98D167C}\
"ButtonText" = "AOL Toolbar"
"MenuText" = "AOL Toolbar"
{85D1F590-48F4-11D9-9669-0800200C9A66}\
"MenuText" = "Uninstall BitDefender Online Scanner v8"
"Exec" = "%windir%\bdoscandel.exe" [null data]
{CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\
"ButtonText" = "Real.com"
{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]
Miscellaneous IE Hijack Points
------------------------------
C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
Added lines (compared with English-language version):
[Strings]: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"
Missing lines (compared with English-language version):
[Strings]: 2 lines
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
AntiVir Service, AntiVirService, ""C:\Program Files\AVPersonal\AVGUARD.EXE"" ["H+BEDV Datentechnik GmbH"]
AntiVir Update, AVWUpSrv, ""C:\Program Files\AVPersonal\AVWUPSRV.EXE"" ["H+BEDV Datentechnik GmbH, Germany"]
AOL Connectivity Service, AOL ACS, "C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe" ["America Online, Inc."]
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\Ati2evxx.exe" ["ATI Technologies Inc."]
TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"]
WAN Miniport (ATW) Service, WANMiniportService, ""C:\WINDOWS\wanmpsvc.exe"" ["America Online, Inc."]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]
----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "Yes" at the first message box.
---------- (total run time: 18 seconds, including 2 seconds for message boxes)
----------------------------------------------
---------------------------------------------
Ensuite il me semble que cette commande verifie si il y a d autres connections sur le pc, tu vois quelque chose?
Microsoft Windows XP [version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\Propriétaire>netstat a
Affiche les statistiques de protocole et des connexions réseau TCP/IP actuelles.
NETSTAT [-a] [-b] [-e] [-n] [-o] [-p protocole] [-r] [-s] [-v] [intervalle]
-a Affiche toutes les connexions et les ports d'écoute.
-b Affiche les fichiers exécutables impliqués dans la création de c
haque connexion ou
port d'écoute. Certains fichiers exécutables connus peuvent hébe
rger
plusieurs composants indépendants. Dans ce cas, la
séquence des composants impliqués dans la création de la connexi
on
ou du port d'écoute est affichée et le nom du fichier exécutabl
e
apparaître entre crochets [] en bas, le nom du composant appelé
apparaît en haut,
et ainsi de suite jusqu'à ce que TCP/IP soit atteint. Remarquez
que cette option
peut prendre du temps et échouera si vous ne disposez pas des au
torisations
suffisantes.
-e Affiche les statistiques Ethernet. Cette option peut être combin
ée avec l'option
-s.
-n Affiche les adresses et les numéros de port au format numérique.
-o Affiche l'identificateur du processus propriétaire associé à cha
que connexion.
-p protocole Affiche les connexions pour le protocole spécifié ; protocole
peut être une des valeurs suivantes : TCP, UDP, TCPv6 ou UDPv6.
S'il est utilisé avec l'option
-s pour afficher les statistiques par protocole, le protocole pe
ut être une des valeurs suivantes :
IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP ou UDPv6.
-r Affiche la table de routage.
-s Affiche les statistiques par protocole. Par défaut, les statist
iques sont
affichées pour IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP et UDPv6.
L'option -p peut être utilisée pour spécifier un sous-jeu de la
valeur par défaut.
-v Lorsqu'elle est utilisée avec -b, cette option affichera la séqu
ence des
composants impliqués dans la création de la connexion ou du port
d'écoute
pour tous les fichiers exécutables.
intervalle Affiche régulièrement les statistiques sélectionnées, en faisant
une pause pendant le nombre de secondes spécifié par l'intervalle
entre chaque affichage. Appuyez sur CTRL+C pour arrêter l'affic
hage
des statistiques. Si l'intervalle est omis, netstat n'affichera
les
informations de configuration actuelle qu'une seule fois.
C:\Documents and Settings\Propriétaire>netstat -a
Connexions actives
Proto Adresse locale Adresse distante Etat
TCP MOI:epmap 0.0.0.0:0 LISTENING
TCP MOI:microsoft-ds 0.0.0.0:0 LISTENING
TCP MOI:18350 0.0.0.0:0 LISTENING
TCP MOI:1027 0.0.0.0:0 LISTENING
TCP MOI:1298 localhost:18350 ESTABLISHED
TCP MOI:18350 localhost:1298 ESTABLISHED
TCP MOI:netbios-ssn 0.0.0.0:0 LISTENING
UDP MOI:microsoft-ds *:*
UDP MOI:isakmp *:*
UDP MOI:1056 *:*
UDP MOI:1057 *:*
UDP MOI:4500 *:*
UDP MOI:ntp *:*
UDP MOI:1900 *:*
UDP MOI:ntp *:*
UDP MOI:netbios-ns *:*
UDP MOI:netbios-dgm *:*
UDP MOI:1900 *:*
A+
merci a vous 2 !
voila ci joint mon hijack this, apparremment clean,vraiment j espere trouver avant de passer a l etape superieure [...]
Ma souris se fige bcp et fais un peu n importe quoi
Logfile of HijackThis v1.99.1
Scan saved at 21:31:31, on 07/08/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\FICHIE~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exe
C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\AOL 9.0a\waol.exe
C:\Program Files\AOL 9.0a\shellmon.exe
C:\Program Files\Fichiers communs\Aol\aoltpspd.exe
C:\Documents and Settings\Propriétaire\Mes documents\Mes Projets\protection\hijackthis_199\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AOLSAV] C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\FICHIE~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1B3D55E8-2565-4A51-A094-32EBFF549A5F}: NameServer = 205.188.146.145
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\Program Files\Fichiers communs\AOL\AOL Spyware Protection\\aolserv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
--------------------------------------------------------
---------------------------------------------------------
Un silent runner :
"Silent Runners.vbs", revision 39, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"RecordNow!" = (empty string)
"NVIEW" = "rundll32.exe nview.dll,nViewLoadHook" [MS]
"BackupNotify" = "c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [null data]
"Acme.PCHButton" = "C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBP4\plugin\bin\PCHButton.exe" ["Motive Communications, Inc."]
"ctfmon.exe" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"hpsysdrv" = "c:\windows\system\hpsysdrv.exe" ["Hewlett-Packard Company"]
"HotKeysCmds" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
"CamMonitor" = "c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [empty string]
"HPHUPD05" = "c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [file not found]
"HPHmon05" = "C:\WINDOWS\System32\hphmon05.exe" ["Hewlett-Packard"]
"KBD" = "C:\HP\KBD\KBD.EXE" ["Hewlett-Packard Company"]
"UpdateManager" = ""C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r" ["Sonic Solutions"]
"Recguard" = "C:\WINDOWS\SMINST\RECGUARD.EXE" [empty string]
"NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" [MS]
"nwiz" = "nwiz.exe /installquiet /keeploaded /nodetect" ["NVIDIA Corporation"]
"VTTimer" = "VTTimer.exe" [file not found]
"ATIModeChange" = "Ati2mdxx.exe" ["ATI Technologies, Inc."]
"PS2" = "C:\WINDOWS\system32\ps2.exe" ["Hewlett-Packard Company"]
"ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"Microsoft Works Update Detection" = "C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" ["Microsoft® Corporation"]
"RealTray" = "C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER" ["RealNetworks, Inc."]
"AOLSAV" = "C:\PROGRA~1\TECHCI~1\AOLSAV\AOLAgent.exe" ["TechCity Solutions France"]
"AOLDialer" = "C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe" ["America Online, Inc"]
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON"]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"AOL Spyware Protection" = ""C:\PROGRA~1\FICHIE~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"" [null data]
"csymenbkzj" = "c:\windows\system32\csymenbkzj.exe -start" [null data]
"AVGCtrl" = ""C:\Program Files\AVPersonal\AVGNT.EXE" /min" ["H+BEDV Datentechnik GmbH"]
"Zone Labs Client" = "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" ["Zone Labs, LLC"]
"msnappau" = ""C:\Program Files\MSN Apps\Updater\01.03.0000.1005\fr\msnappau.exe"" [MS]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Setup\ {++}
EXECUTION UNLIKELY: "Registrando Panda ActiveX" = "C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\ActiveScan\as.dll" [MS]
EXECUTION UNLIKELY: "Registrando Panda Almacen" = "C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\ActiveScan\pavpz.dll" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{53707962-6F74-2D53-2644-206D7942484F}\(Default) = (no title provided)
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\SPYBOT~1\SDHelper.dll" ["Safer Networking Limited"]
{9394EDE7-C8B5-483E-8773-474BF36AF6E4}\(Default) = "ST" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll" [MS]
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\(Default) = "MSNToolBandBHO" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Extension Affichage Panorama du Panneau de configuration"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Extension icône HyperTerminal"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{19CC43A1-6925-4B48-B292-830291F393A6}" = "HPNSView"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\HP\Digital Imaging\bin\hpdns_01.dll" [empty string]
"{DEE12703-6333-4D4E-8F34-738C4DCC2E04}" = "RecordNow! SendToExt"
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\RecordNow!\shlext.dll" ["Sonic Solutions"]
"{7F67036B-66F1-411A-AD85-759FB9C5B0DB}" = "SampleView"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\ShellvRTF.dll" ["XSS"]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Explorateur de Bureau"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\nvshell.dll" ["NVIDIA Corporation"]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
"{D3581EB7-5E16-4182-9F58-86FA713B42F9}" = "AOL"
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\FICHIE~1\aolshare\shell\fr\shellext.dll" ["America Online, Inc."]
"{640167b4-59b0-47a6-b335-a6b3c0695aea}" = "Portable Media Devices"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
"{cc86590a-b60a-48e6-996b-41d25ed39a1e}" = "Portable Media Devices Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Audiodev.dll" [MS]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AntiVir/Win\(Default) = "{a7cda720-84ee-11d0-b5c0-00001b3ca278}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\AVPersonal\AVShlExt.DLL" ["H+BEDV Datentechnik GmbH"]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
AntiVir/Win\(Default) = "{a7cda720-84ee-11d0-b5c0-00001b3ca278}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\AVPersonal\AVShlExt.DLL" ["H+BEDV Datentechnik GmbH"]
Active Desktop and Wallpaper:
-----------------------------
Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Propriétaire\Local Settings\Application Data\Microsoft\Wallpaper1.bmp"
Enabled Screen Saver:
---------------------
HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\ssstars.scr" [MS]
Startup items in "Propriétaire" & "All Users" startup folders:
--------------------------------------------------------------
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
Enabled Scheduled Tasks:
------------------------
"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 19
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\
"{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}" = "Vue HP" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll" ["Hewlett-Packard Company"]
"{4982D40A-C53B-4615-B15B-B5B5E98D167C}" = "AOL Toolbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\AOL Toolbar\toolbar.dll" ["IE Toolbar"]
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{B2847E28-5D7D-4DEB-8B67-05D28BCF79F5}" = "Vue HP" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll" ["Hewlett-Packard Company"]
"{4982D40A-C53B-4615-B15B-B5B5E98D167C}" = "AOL Toolbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\AOL Toolbar\toolbar.dll" ["IE Toolbar"]
"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = "MSN" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]
HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{4982D40A-C53B-4615-B15B-B5B5E98D167C}" = "AOL Toolbar" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\AOL Toolbar\toolbar.dll" ["IE Toolbar"]
"{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}" = "0"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fr\msntb.dll" [MS]
Explorer Bars
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
{FE54FA40-D68C-11D2-98FA-00C0F0318AFE}\ = "Real.com" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\System32\Shdocvw.dll" [MS]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{4982D40A-C53B-4615-B15B-B5B5E98D167C}\
"ButtonText" = "AOL Toolbar"
"MenuText" = "AOL Toolbar"
{85D1F590-48F4-11D9-9669-0800200C9A66}\
"MenuText" = "Uninstall BitDefender Online Scanner v8"
"Exec" = "%windir%\bdoscandel.exe" [null data]
{CD67F990-D8E9-11D2-98FE-00C0F0318AFE}\
"ButtonText" = "Real.com"
{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]
Miscellaneous IE Hijack Points
------------------------------
C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")
Added lines (compared with English-language version):
[Strings]: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
[Strings]: SAFESITE_VALUE="http://home.microsoft.com/intl/fr/"
Missing lines (compared with English-language version):
[Strings]: 2 lines
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
AntiVir Service, AntiVirService, ""C:\Program Files\AVPersonal\AVGUARD.EXE"" ["H+BEDV Datentechnik GmbH"]
AntiVir Update, AVWUpSrv, ""C:\Program Files\AVPersonal\AVWUPSRV.EXE"" ["H+BEDV Datentechnik GmbH, Germany"]
AOL Connectivity Service, AOL ACS, "C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe" ["America Online, Inc."]
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\Ati2evxx.exe" ["ATI Technologies Inc."]
TrueVector Internet Monitor, vsmon, "C:\WINDOWS\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs, LLC"]
WAN Miniport (ATW) Service, WANMiniportService, ""C:\WINDOWS\wanmpsvc.exe"" ["America Online, Inc."]
Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\System32\wdfmgr.exe" [MS]
----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "Yes" at the first message box.
---------- (total run time: 18 seconds, including 2 seconds for message boxes)
----------------------------------------------
---------------------------------------------
Ensuite il me semble que cette commande verifie si il y a d autres connections sur le pc, tu vois quelque chose?
Microsoft Windows XP [version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\Propriétaire>netstat a
Affiche les statistiques de protocole et des connexions réseau TCP/IP actuelles.
NETSTAT [-a] [-b] [-e] [-n] [-o] [-p protocole] [-r] [-s] [-v] [intervalle]
-a Affiche toutes les connexions et les ports d'écoute.
-b Affiche les fichiers exécutables impliqués dans la création de c
haque connexion ou
port d'écoute. Certains fichiers exécutables connus peuvent hébe
rger
plusieurs composants indépendants. Dans ce cas, la
séquence des composants impliqués dans la création de la connexi
on
ou du port d'écoute est affichée et le nom du fichier exécutabl
e
apparaître entre crochets [] en bas, le nom du composant appelé
apparaît en haut,
et ainsi de suite jusqu'à ce que TCP/IP soit atteint. Remarquez
que cette option
peut prendre du temps et échouera si vous ne disposez pas des au
torisations
suffisantes.
-e Affiche les statistiques Ethernet. Cette option peut être combin
ée avec l'option
-s.
-n Affiche les adresses et les numéros de port au format numérique.
-o Affiche l'identificateur du processus propriétaire associé à cha
que connexion.
-p protocole Affiche les connexions pour le protocole spécifié ; protocole
peut être une des valeurs suivantes : TCP, UDP, TCPv6 ou UDPv6.
S'il est utilisé avec l'option
-s pour afficher les statistiques par protocole, le protocole pe
ut être une des valeurs suivantes :
IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP ou UDPv6.
-r Affiche la table de routage.
-s Affiche les statistiques par protocole. Par défaut, les statist
iques sont
affichées pour IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP et UDPv6.
L'option -p peut être utilisée pour spécifier un sous-jeu de la
valeur par défaut.
-v Lorsqu'elle est utilisée avec -b, cette option affichera la séqu
ence des
composants impliqués dans la création de la connexion ou du port
d'écoute
pour tous les fichiers exécutables.
intervalle Affiche régulièrement les statistiques sélectionnées, en faisant
une pause pendant le nombre de secondes spécifié par l'intervalle
entre chaque affichage. Appuyez sur CTRL+C pour arrêter l'affic
hage
des statistiques. Si l'intervalle est omis, netstat n'affichera
les
informations de configuration actuelle qu'une seule fois.
C:\Documents and Settings\Propriétaire>netstat -a
Connexions actives
Proto Adresse locale Adresse distante Etat
TCP MOI:epmap 0.0.0.0:0 LISTENING
TCP MOI:microsoft-ds 0.0.0.0:0 LISTENING
TCP MOI:18350 0.0.0.0:0 LISTENING
TCP MOI:1027 0.0.0.0:0 LISTENING
TCP MOI:1298 localhost:18350 ESTABLISHED
TCP MOI:18350 localhost:1298 ESTABLISHED
TCP MOI:netbios-ssn 0.0.0.0:0 LISTENING
UDP MOI:microsoft-ds *:*
UDP MOI:isakmp *:*
UDP MOI:1056 *:*
UDP MOI:1057 *:*
UDP MOI:4500 *:*
UDP MOI:ntp *:*
UDP MOI:1900 *:*
UDP MOI:ntp *:*
UDP MOI:netbios-ns *:*
UDP MOI:netbios-dgm *:*
UDP MOI:1900 *:*
A+
A voir également:
- Bon ben vous le savez; hack + souris
- Comment activer le pavé tactile sans souris - Guide
- Souris ordinateur - Guide
- Comment faire apparaître le curseur sans souris - Guide
- Pointeur souris - Guide
- Souris qui va dans le mauvais sens - Guide
91 réponses
Une fois que tu as compris la logique de la programmation, le principal est acquis.
Reste la syntaxe et les commandes (vocabulaire/grammaire) qui varie d'un language à un autre (ca reste très proche, et il y a le net et les livres pour ca).
Le taskbot, je l'ai fait en c++
Reste la syntaxe et les commandes (vocabulaire/grammaire) qui varie d'un language à un autre (ca reste très proche, et il y a le net et les livres pour ca).
Le taskbot, je l'ai fait en c++
lol j est deja du mal avec les bat alors je ne me lance pas
cela fait trop de chose a faire
mon site
combattre les virus
et autres
cela fait trop de chose a faire
mon site
combattre les virus
et autres
re,
merci a vous 3
demain, j essai de changer de souris mais elle decone que sur le net j ai l impression !
je vais faire le scan de sirie
a+
merci a vous 3
demain, j essai de changer de souris mais elle decone que sur le net j ai l impression !
je vais faire le scan de sirie
a+
re,
hier j etais connecte et rootkit vait detecter pas mal de chose (2cles de registre je crois)
aujourd hui je l ai fait deconnecter du net, voila le rapport
C:\Documents and Settings\Propriétaire\Mes documents\Yen_a_tjrs_un\CAQJM7E9.:Zone.Identifier 18/05/2005 14:27 26 bytes Hidden from Windows API.
D: 01/01/1601 02:00 0 bytes Error mounting volume
T en penses quoi?Je dois le faire connecter pour voir?
A+
hier j etais connecte et rootkit vait detecter pas mal de chose (2cles de registre je crois)
aujourd hui je l ai fait deconnecter du net, voila le rapport
C:\Documents and Settings\Propriétaire\Mes documents\Yen_a_tjrs_un\CAQJM7E9.:Zone.Identifier 18/05/2005 14:27 26 bytes Hidden from Windows API.
D: 01/01/1601 02:00 0 bytes Error mounting volume
T en penses quoi?Je dois le faire connecter pour voir?
A+
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
hum 26 octets, c'est leger pour une infection.
Essaye toujours connecté, mais rootkitrevealer peut te sortir des entrées qui n'auront rien à voir avec une infection. (comme des fichiers temporaires en court d'utilisation).
Tu as toujours des fichiers au noms aléatoire ?
Essaye toujours connecté, mais rootkitrevealer peut te sortir des entrées qui n'auront rien à voir avec une infection. (comme des fichiers temporaires en court d'utilisation).
Tu as toujours des fichiers au noms aléatoire ?
salut
sirie,
oui un seul au nom aleatoire que j ai repere ds zone alarme
Hier il m a sorti des fichiers temporaires en cours d execution effectivement et 2 cles de registre,
j essayerais de le faire connecte alors
merci a+
sirie,
oui un seul au nom aleatoire que j ai repere ds zone alarme
Hier il m a sorti des fichiers temporaires en cours d execution effectivement et 2 cles de registre,
j essayerais de le faire connecte alors
merci a+
re a tous,
voila je l ai fait en etant connecte au net cette fois ci
HKLM\SOFTWARE\Zone Labs\ZoneAlarm\IncomingCount 12/08/2005 19:16 4 bytes Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Zone Labs\ZoneAlarm\BlockCount 12/08/2005 19:16 4 bytes Data mismatch between Windows API and raw hive data.
C:\Documents and Settings\Propriétaire\Local Settings\Temp\~DFBFBE.tmp 12/08/2005 19:23 16.00 KB Hidden from Windows API.
C:\Documents and Settings\Propriétaire\Mes documents\Yen_a_tjrs_un\CAQJM7E9.:Zone.Identifier 18/05/2005 14:27 26 bytes Hidden from Windows API.
D: 01/01/1601 02:00 0 bytes Error mounting volume
2/Je vais scanner mes ports pour voir
3/je vais scanner chez kaspersky
4/je vais fermer la prise de controle a distance grace a une manip faite par microsoft
5/si le probleme de souris continue, je vais faire un test avec une autre
a+
voila je l ai fait en etant connecte au net cette fois ci
HKLM\SOFTWARE\Zone Labs\ZoneAlarm\IncomingCount 12/08/2005 19:16 4 bytes Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Zone Labs\ZoneAlarm\BlockCount 12/08/2005 19:16 4 bytes Data mismatch between Windows API and raw hive data.
C:\Documents and Settings\Propriétaire\Local Settings\Temp\~DFBFBE.tmp 12/08/2005 19:23 16.00 KB Hidden from Windows API.
C:\Documents and Settings\Propriétaire\Mes documents\Yen_a_tjrs_un\CAQJM7E9.:Zone.Identifier 18/05/2005 14:27 26 bytes Hidden from Windows API.
D: 01/01/1601 02:00 0 bytes Error mounting volume
2/Je vais scanner mes ports pour voir
3/je vais scanner chez kaspersky
4/je vais fermer la prise de controle a distance grace a une manip faite par microsoft
5/si le probleme de souris continue, je vais faire un test avec une autre
a+
Salut regis59,
Teste tes ports avec:
http://www.nirsoft.net/utils/cports.html
Et aussi:
http://www.sysinternals.com/Utilities/TdiMon.html
http://www.sysinternals.com/Utilities/TcpView.html
TaskBot possède aussi une fonction pour avoir un cliché de l'activité reseau au moment du click.
a+
Teste tes ports avec:
http://www.nirsoft.net/utils/cports.html
Et aussi:
http://www.sysinternals.com/Utilities/TdiMon.html
http://www.sysinternals.com/Utilities/TcpView.html
TaskBot possède aussi une fonction pour avoir un cliché de l'activité reseau au moment du click.
a+
alg.exe 3596 TCP 1027 127.0.0.1 0.0.0.0 Listening C:\WINDOWS\System32\alg.exe Microsoft® Windows® Operating System Application Layer Gateway Service 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:45 ALG A AOLacsd.exe 1716 TCP 1045 172.187.169.79 80 http 64.12.55.216 Close Wait C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe AOL Connectivity Service AOL Connectivity Service 2.0.20.1.FR.213 America Online, Inc. 12/08/2005 20:15:01 AUTORITE NT\SYSTEM AOL ACS A AOLacsd.exe 1716 TCP 1046 172.187.169.79 13784 205.188.78.9 Established C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe AOL Connectivity Service AOL Connectivity Service 2.0.20.1.FR.213 America Online, Inc. 12/08/2005 20:15:01 AUTORITE NT\SYSTEM AOL ACS A AOLDial.exe 624 UDP 1067 127.0.0.1 C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe AOL Connectivity Service AOL Connectivity Service Dialer 2.0.20.1.FR.213 America Online, Inc 12/08/2005 20:15:04 HUREL\Propriétaire A aoltpspd.exe 2956 TCP 443 https 127.0.0.1 0.0.0.0 Listening C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A aoltpspd.exe 2956 TCP 11523 127.0.0.1 0.0.0.0 Listening C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A aoltpspd.exe 2956 TCP 11523 127.0.0.1 1146 127.0.0.1 Established C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A aoltpspd.exe 2956 TCP 11523 127.0.0.1 1147 127.0.0.1 Established C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A aoltpspd.exe 2956 TCP 11523 127.0.0.1 1148 127.0.0.1 Established C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A aoltpspd.exe 2956 TCP 11523 127.0.0.1 1149 127.0.0.1 Established C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A AVGNT.EXE 776 TCP 1025 127.0.0.1 18350 127.0.0.1 Established C:\Program Files\AVPersonal\AVGNT.EXE AntiVir Guard Control Program AntiVir Guard/XP Control Program 6.31.00.01 H+BEDV Datentechnik GmbH 12/08/2005 20:15:05 HUREL\Propriétaire A AVGUARD.EXE 1704 TCP 18350 0.0.0.0 0.0.0.0 Listening C:\Program Files\AVPersonal\AVGUARD.EXE Windows XP/2000/XP Guard Service Antivirus Service for Windows XP/2000/NT 6.31.00.01 H+BEDV Datentechnik GmbH 12/08/2005 20:15:01 AUTORITE NT\SYSTEM AntiVirService A AVGUARD.EXE 1704 TCP 18350 127.0.0.1 1025 127.0.0.1 Established C:\Program Files\AVPersonal\AVGUARD.EXE Windows XP/2000/XP Guard Service Antivirus Service for Windows XP/2000/NT 6.31.00.01 H+BEDV Datentechnik GmbH 12/08/2005 20:15:01 AUTORITE NT\SYSTEM AntiVirService A lsass.exe 892 UDP 500 isakmp 0.0.0.0 C:\WINDOWS\system32\lsass.exe Microsoft® Windows® Operating System LSA Shell (Export Version) 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:14:59 AUTORITE NT\SYSTEM PolicyAgent, ProtectedStorage, SamSs A lsass.exe 892 UDP 4500 0.0.0.0 C:\WINDOWS\system32\lsass.exe Microsoft® Windows® Operating System LSA Shell (Export Version) 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:14:59 AUTORITE NT\SYSTEM PolicyAgent, ProtectedStorage, SamSs A svchost.exe 1120 TCP 135 epmap 0.0.0.0 0.0.0.0 Listening C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 RpcSs A svchost.exe 1208 UDP 1047 0.0.0.0 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 Dnscache A svchost.exe 1156 UDP 123 ntp 127.0.0.1 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 AUTORITE NT\SYSTEM AudioSrv, BITS, Browser, CryptSvc, Dhcp, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, lanmanserver, lanmanworkstation, Netman, Nla, RasAuto, RasMan A svchost.exe 1328 UDP 1900 127.0.0.1 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 LmHosts, SSDPSRV, WebClient A svchost.exe 1156 UDP 123 ntp 169.254.118.30 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 AUTORITE NT\SYSTEM AudioSrv, BITS, Browser, CryptSvc, Dhcp, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, lanmanserver, lanmanworkstation, Netman, Nla, RasAuto, RasMan A svchost.exe 1328 UDP 1900 169.254.118.30 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 LmHosts, SSDPSRV, WebClient A svchost.exe 1156 UDP 123 ntp 172.187.169.79 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 AUTORITE NT\SYSTEM AudioSrv, BITS, Browser, CryptSvc, Dhcp, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, lanmanserver, lanmanworkstation, Netman, Nla, RasAuto, RasMan A svchost.exe 1328 UDP 1900 172.187.169.79 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 LmHosts, SSDPSRV, WebClient A System 4 TCP 445 microsoft-ds 0.0.0.0 0.0.0.0 Listening N/A System 4 TCP 139 netbios-ssn 169.254.118.30 0.0.0.0 Listening N/A System 4 UDP 445 microsoft-ds 0.0.0.0 N/A System 4 UDP 137 netbios-ns 169.254.118.30 N/A System 4 UDP 138 netbios-dgm 169.254.118.30 N/A Unknown 0 TCP 1139 127.0.0.1 11523 127.0.0.1 Time Wait N/A Unknown 0 TCP 1143 127.0.0.1 11523 127.0.0.1 Time Wait N/A Unknown 0 TCP 11523 127.0.0.1 1136 127.0.0.1 Time Wait N/A Unknown 0 TCP 11523 127.0.0.1 1151 127.0.0.1 Time Wait N/A Unknown 0 TCP 1137 172.187.169.79 80 http 205.188.146.146 Time Wait N/A waol.exe 1500 TCP 1146 127.0.0.1 11523 127.0.0.1 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A waol.exe 1500 TCP 1147 127.0.0.1 11523 127.0.0.1 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A waol.exe 1500 TCP 1148 127.0.0.1 11523 127.0.0.1 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A waol.exe 1500 TCP 1149 127.0.0.1 11523 127.0.0.1 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A waol.exe 1500 TCP 1056 172.187.169.79 5190 205.188.5.240 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A waol.exe 1500 UDP 1057 127.0.0.1 C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
J espere que cela va s afficher correctement
TCP/UDP Ports List
Created by using CurrPorts
Process Name Process ID Protocol Local Port Local Port Name Local Address Remote Port Remote Port Name Remote Address State Process Path Product Name File Description File Version Company Process Created On User Name Process Services Process Attributes
alg.exe 3596 TCP 1027 127.0.0.1 0.0.0.0 Listening C:\WINDOWS\System32\alg.exe Microsoft® Windows® Operating System Application Layer Gateway Service 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:45 ALG A
AOLacsd.exe 1716 TCP 1045 172.187.169.79 80 http 64.12.55.216 Close Wait C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe AOL Connectivity Service AOL Connectivity Service 2.0.20.1.FR.213 America Online, Inc. 12/08/2005 20:15:01 AUTORITE NT\SYSTEM AOL ACS A
AOLacsd.exe 1716 TCP 1046 172.187.169.79 13784 205.188.78.9 Established C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe AOL Connectivity Service AOL Connectivity Service 2.0.20.1.FR.213 America Online, Inc. 12/08/2005 20:15:01 AUTORITE NT\SYSTEM AOL ACS A
AOLDial.exe 624 UDP 1067 127.0.0.1 C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe AOL Connectivity Service AOL Connectivity Service Dialer 2.0.20.1.FR.213 America Online, Inc 12/08/2005 20:15:04 HUREL\Propriétaire A
aoltpspd.exe 2956 TCP 443 https 127.0.0.1 0.0.0.0 Listening C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A
aoltpspd.exe 2956 TCP 11523 127.0.0.1 0.0.0.0 Listening C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A
aoltpspd.exe 2956 TCP 11523 127.0.0.1 1146 127.0.0.1 Established C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A
aoltpspd.exe 2956 TCP 11523 127.0.0.1 1147 127.0.0.1 Established C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A
aoltpspd.exe 2956 TCP 11523 127.0.0.1 1148 127.0.0.1 Established C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A
aoltpspd.exe 2956 TCP 11523 127.0.0.1 1149 127.0.0.1 Established C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A
AVGNT.EXE 776 TCP 1025 127.0.0.1 18350 127.0.0.1 Established C:\Program Files\AVPersonal\AVGNT.EXE AntiVir Guard Control Program AntiVir Guard/XP Control Program 6.31.00.01 H+BEDV Datentechnik GmbH 12/08/2005 20:15:05 HUREL\Propriétaire A
AVGUARD.EXE 1704 TCP 18350 0.0.0.0 0.0.0.0 Listening C:\Program Files\AVPersonal\AVGUARD.EXE Windows XP/2000/XP Guard Service Antivirus Service for Windows XP/2000/NT 6.31.00.01 H+BEDV Datentechnik GmbH 12/08/2005 20:15:01 AUTORITE NT\SYSTEM AntiVirService A
AVGUARD.EXE 1704 TCP 18350 127.0.0.1 1025 127.0.0.1 Established C:\Program Files\AVPersonal\AVGUARD.EXE Windows XP/2000/XP Guard Service Antivirus Service for Windows XP/2000/NT 6.31.00.01 H+BEDV Datentechnik GmbH 12/08/2005 20:15:01 AUTORITE NT\SYSTEM AntiVirService A
lsass.exe 892 UDP 500 isakmp 0.0.0.0 C:\WINDOWS\system32\lsass.exe Microsoft® Windows® Operating System LSA Shell (Export Version) 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:14:59 AUTORITE NT\SYSTEM PolicyAgent, ProtectedStorage, SamSs A
lsass.exe 892 UDP 4500 0.0.0.0 C:\WINDOWS\system32\lsass.exe Microsoft® Windows® Operating System LSA Shell (Export Version) 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:14:59 AUTORITE NT\SYSTEM PolicyAgent, ProtectedStorage, SamSs A
svchost.exe 1120 TCP 135 epmap 0.0.0.0 0.0.0.0 Listening C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 RpcSs A
svchost.exe 1208 UDP 1047 0.0.0.0 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 Dnscache A
svchost.exe 1156 UDP 123 ntp 127.0.0.1 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 AUTORITE NT\SYSTEM AudioSrv, BITS, Browser, CryptSvc, Dhcp, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, lanmanserver, lanmanworkstation, Netman, Nla, RasAuto, RasMan A
svchost.exe 1328 UDP 1900 127.0.0.1 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 LmHosts, SSDPSRV, WebClient A
svchost.exe 1156 UDP 123 ntp 169.254.118.30 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 AUTORITE NT\SYSTEM AudioSrv, BITS, Browser, CryptSvc, Dhcp, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, lanmanserver, lanmanworkstation, Netman, Nla, RasAuto, RasMan A
svchost.exe 1328 UDP 1900 169.254.118.30 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 LmHosts, SSDPSRV, WebClient A
svchost.exe 1156 UDP 123 ntp 172.187.169.79 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 AUTORITE NT\SYSTEM AudioSrv, BITS, Browser, CryptSvc, Dhcp, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, lanmanserver, lanmanworkstation, Netman, Nla, RasAuto, RasMan A
svchost.exe 1328 UDP 1900 172.187.169.79 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 LmHosts, SSDPSRV, WebClient A
System 4 TCP 445 microsoft-ds 0.0.0.0 0.0.0.0 Listening N/A
System 4 TCP 139 netbios-ssn 169.254.118.30 0.0.0.0 Listening N/A
System 4 UDP 445 microsoft-ds 0.0.0.0 N/A
System 4 UDP 137 netbios-ns 169.254.118.30 N/A
System 4 UDP 138 netbios-dgm 169.254.118.30 N/A
Unknown 0 TCP 1139 127.0.0.1 11523 127.0.0.1 Time Wait N/A
Unknown 0 TCP 1143 127.0.0.1 11523 127.0.0.1 Time Wait N/A
Unknown 0 TCP 11523 127.0.0.1 1136 127.0.0.1 Time Wait N/A
Unknown 0 TCP 11523 127.0.0.1 1151 127.0.0.1 Time Wait N/A
Unknown 0 TCP 1137 172.187.169.79 80 http 205.188.146.146 Time Wait N/A
waol.exe 1500 TCP 1146 127.0.0.1 11523 127.0.0.1 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
waol.exe 1500 TCP 1147 127.0.0.1 11523 127.0.0.1 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
waol.exe 1500 TCP 1148 127.0.0.1 11523 127.0.0.1 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
waol.exe 1500 TCP 1149 127.0.0.1 11523 127.0.0.1 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
waol.exe 1500 TCP 1056 172.187.169.79 5190 205.188.5.240 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
waol.exe 1500 UDP 1057 127.0.0.1 C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
Created by using CurrPorts
Process Name Process ID Protocol Local Port Local Port Name Local Address Remote Port Remote Port Name Remote Address State Process Path Product Name File Description File Version Company Process Created On User Name Process Services Process Attributes
alg.exe 3596 TCP 1027 127.0.0.1 0.0.0.0 Listening C:\WINDOWS\System32\alg.exe Microsoft® Windows® Operating System Application Layer Gateway Service 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:45 ALG A
AOLacsd.exe 1716 TCP 1045 172.187.169.79 80 http 64.12.55.216 Close Wait C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe AOL Connectivity Service AOL Connectivity Service 2.0.20.1.FR.213 America Online, Inc. 12/08/2005 20:15:01 AUTORITE NT\SYSTEM AOL ACS A
AOLacsd.exe 1716 TCP 1046 172.187.169.79 13784 205.188.78.9 Established C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe AOL Connectivity Service AOL Connectivity Service 2.0.20.1.FR.213 America Online, Inc. 12/08/2005 20:15:01 AUTORITE NT\SYSTEM AOL ACS A
AOLDial.exe 624 UDP 1067 127.0.0.1 C:\Program Files\Fichiers communs\AOL\ACS\AOLDial.exe AOL Connectivity Service AOL Connectivity Service Dialer 2.0.20.1.FR.213 America Online, Inc 12/08/2005 20:15:04 HUREL\Propriétaire A
aoltpspd.exe 2956 TCP 443 https 127.0.0.1 0.0.0.0 Listening C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A
aoltpspd.exe 2956 TCP 11523 127.0.0.1 0.0.0.0 Listening C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A
aoltpspd.exe 2956 TCP 11523 127.0.0.1 1146 127.0.0.1 Established C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A
aoltpspd.exe 2956 TCP 11523 127.0.0.1 1147 127.0.0.1 Established C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A
aoltpspd.exe 2956 TCP 11523 127.0.0.1 1148 127.0.0.1 Established C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A
aoltpspd.exe 2956 TCP 11523 127.0.0.1 1149 127.0.0.1 Established C:\Program Files\Fichiers communs\Aol\aoltpspd.exe AOL TopSpeed(TM) AOL TopSpeed(TM) 1, 1, 1, 0 America Online Inc 12/08/2005 20:16:24 HUREL\Propriétaire A
AVGNT.EXE 776 TCP 1025 127.0.0.1 18350 127.0.0.1 Established C:\Program Files\AVPersonal\AVGNT.EXE AntiVir Guard Control Program AntiVir Guard/XP Control Program 6.31.00.01 H+BEDV Datentechnik GmbH 12/08/2005 20:15:05 HUREL\Propriétaire A
AVGUARD.EXE 1704 TCP 18350 0.0.0.0 0.0.0.0 Listening C:\Program Files\AVPersonal\AVGUARD.EXE Windows XP/2000/XP Guard Service Antivirus Service for Windows XP/2000/NT 6.31.00.01 H+BEDV Datentechnik GmbH 12/08/2005 20:15:01 AUTORITE NT\SYSTEM AntiVirService A
AVGUARD.EXE 1704 TCP 18350 127.0.0.1 1025 127.0.0.1 Established C:\Program Files\AVPersonal\AVGUARD.EXE Windows XP/2000/XP Guard Service Antivirus Service for Windows XP/2000/NT 6.31.00.01 H+BEDV Datentechnik GmbH 12/08/2005 20:15:01 AUTORITE NT\SYSTEM AntiVirService A
lsass.exe 892 UDP 500 isakmp 0.0.0.0 C:\WINDOWS\system32\lsass.exe Microsoft® Windows® Operating System LSA Shell (Export Version) 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:14:59 AUTORITE NT\SYSTEM PolicyAgent, ProtectedStorage, SamSs A
lsass.exe 892 UDP 4500 0.0.0.0 C:\WINDOWS\system32\lsass.exe Microsoft® Windows® Operating System LSA Shell (Export Version) 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:14:59 AUTORITE NT\SYSTEM PolicyAgent, ProtectedStorage, SamSs A
svchost.exe 1120 TCP 135 epmap 0.0.0.0 0.0.0.0 Listening C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 RpcSs A
svchost.exe 1208 UDP 1047 0.0.0.0 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 Dnscache A
svchost.exe 1156 UDP 123 ntp 127.0.0.1 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 AUTORITE NT\SYSTEM AudioSrv, BITS, Browser, CryptSvc, Dhcp, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, lanmanserver, lanmanworkstation, Netman, Nla, RasAuto, RasMan A
svchost.exe 1328 UDP 1900 127.0.0.1 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 LmHosts, SSDPSRV, WebClient A
svchost.exe 1156 UDP 123 ntp 169.254.118.30 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 AUTORITE NT\SYSTEM AudioSrv, BITS, Browser, CryptSvc, Dhcp, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, lanmanserver, lanmanworkstation, Netman, Nla, RasAuto, RasMan A
svchost.exe 1328 UDP 1900 169.254.118.30 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 LmHosts, SSDPSRV, WebClient A
svchost.exe 1156 UDP 123 ntp 172.187.169.79 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 AUTORITE NT\SYSTEM AudioSrv, BITS, Browser, CryptSvc, Dhcp, ERSvc, EventSystem, FastUserSwitchingCompatibility, helpsvc, lanmanserver, lanmanworkstation, Netman, Nla, RasAuto, RasMan A
svchost.exe 1328 UDP 1900 172.187.169.79 C:\WINDOWS\system32\svchost.exe Microsoft® Windows® Operating System Generic Host Process for Win32 Services 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158) Microsoft Corporation 12/08/2005 20:15:00 LmHosts, SSDPSRV, WebClient A
System 4 TCP 445 microsoft-ds 0.0.0.0 0.0.0.0 Listening N/A
System 4 TCP 139 netbios-ssn 169.254.118.30 0.0.0.0 Listening N/A
System 4 UDP 445 microsoft-ds 0.0.0.0 N/A
System 4 UDP 137 netbios-ns 169.254.118.30 N/A
System 4 UDP 138 netbios-dgm 169.254.118.30 N/A
Unknown 0 TCP 1139 127.0.0.1 11523 127.0.0.1 Time Wait N/A
Unknown 0 TCP 1143 127.0.0.1 11523 127.0.0.1 Time Wait N/A
Unknown 0 TCP 11523 127.0.0.1 1136 127.0.0.1 Time Wait N/A
Unknown 0 TCP 11523 127.0.0.1 1151 127.0.0.1 Time Wait N/A
Unknown 0 TCP 1137 172.187.169.79 80 http 205.188.146.146 Time Wait N/A
waol.exe 1500 TCP 1146 127.0.0.1 11523 127.0.0.1 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
waol.exe 1500 TCP 1147 127.0.0.1 11523 127.0.0.1 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
waol.exe 1500 TCP 1148 127.0.0.1 11523 127.0.0.1 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
waol.exe 1500 TCP 1149 127.0.0.1 11523 127.0.0.1 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
waol.exe 1500 TCP 1056 172.187.169.79 5190 205.188.5.240 Established C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
waol.exe 1500 UDP 1057 127.0.0.1 C:\Program Files\AOL 9.0a\waol.exe America Online AOL 9.00.002 America Online, Inc. 12/08/2005 20:16:13 HUREL\Propriétaire A
