Connexions étranges
elmerendero -  
Bonsoir, ayants quelques problèmes de connexions à internet, je viens, après m'être logué sur commentçamarche, d'effectuer une commande NETSTAT... J'y découvre une marée de ports connectés, la plupart avec mon ordi, mais plein d'autres que je ne connais pas. En ayant pris un IP au pif, connecté au port 1832, j'ai interrogé IPADDRESS.COM, qui me donne les elements suivants:
IP address: 91.103.137.2
IP country: France
IP Address state: Limousin
IP Address city: Champs
IP latitude: 43.650002
IP longitude: 1.650000
ISP: AUFEMININ.COM
Organization: AUFEMININ.COM

Après recherche "googlée" il me sors un tas de blogs et forums. Quelqu'un connait-il une explication à la chose?
Merci d'avance.

--
Mieux vaut être saoul plutôt que con... Cela dure moins longtemps... (Coluche ?)

@ +
^_^

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:09:05, on 02/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Shiro SKYPE DECT\USBPhone4Skype.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\philips\Philips SNU5600 Wireless USB Adapter Utility\PHUSBBGMonitor.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\explorer.exe
E:\Telechargements\Programmes\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [USBPhone4Skype] C:\Program Files\Shiro SKYPE DECT\USBPhone4Skype.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [EasyFlirt Messenger] F:\EasyFlirt Messenger\EasyFlirt Messenger.exe /M
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adaptateur USB sans fil Philips SNU5600.lnk = C:\Program Files\philips\Philips SNU5600 Wireless USB Adapter Utility\PHUSBBGMonitor.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://anba1960.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4C75512F-FEE8-4493-AEA3-2CA2A4328EEB}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{9298302C-B480-4AF7-9ADF-FFA44A257405}: NameServer = 192.168.2.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

--
End of file - 8669 bytes
Configuration: Windows XP
Firefox 3.0.1

3 réponses

  2.  elmerendero Auteur
    Merci chronos... je viens de faire plusieurs scans avec avast, spybot, sur le rapport HiJackThis rien me semble anormal... aucun processus étrange dans le task manager... Où faudrait-il chercher?
    Log de mon router:

    09/02/2008 22:16:14 If(PPPoE1) PPP connection ok !
    09/02/2008 22:16:13 PPPoE1 get IP:93.149.216.120
    09/02/2008 22:16:12 PPPoE1 start PPP
    09/02/2008 22:16:12 PPPoE receive PADS
    09/02/2008 22:16:12 PPPoE send PADR
    09/02/2008 22:16:12 PPPoE receive PADO
    09/02/2008 22:16:12 PPPoE send PADI
    09/02/2008 22:16:12 Dial On Demand(PPPoE1)
    09/02/2008 22:16:09 Delay 3 second - do_connect
    09/02/2008 22:16:09 If(PPPoE1) PPP fail : Timeout in LCP negotiation
    09/02/2008 22:16:08 Dial On Demand(PPPoE1)
    09/02/2008 22:16:08 PPPoE stop
    09/02/2008 22:16:08 enter pppShutdown()
    09/02/2008 22:15:21 PPPoE1 start PPP
    09/02/2008 22:15:21 PPPoE receive PADS
    09/02/2008 22:15:21 PPPoE send PADR
    09/02/2008 22:15:21 PPPoE receive PADO
    09/02/2008 22:15:21 PPPoE send PADI
    09/02/2008 22:15:21 Dial On Demand(PPPoE1)
    09/02/2008 22:15:15 Delay 3 second - do_connect
    09/02/2008 22:15:15 PPPoE stop
    09/02/2008 22:15:15 If(PPPoE1) PPP fail : Timeout in LCP negotiation
    09/02/2008 22:15:13 PPPoE1 start PPP
    09/02/2008 22:15:13 PPPoE receive PADS
    09/02/2008 22:15:13 PPPoE send PADR
    09/02/2008 22:15:13 PPPoE receive PADO
    09/02/2008 22:15:13 PPPoE send PADI
    09/02/2008 22:15:13 Dial On Demand(PPPoE1)
    09/02/2008 22:15:11 PPPoE stop
    09/02/2008 22:15:11 enter pppShutdown()
    09/02/2008 22:15:11 If(11) PPP Dial timeout :< 50001
    09/02/2008 22:14:21 PPPoE1 start PPP
    09/02/2008 22:14:21 PPPoE receive PADS
    09/02/2008 22:14:21 PPPoE send PADR
    09/02/2008 22:14:21 PPPoE receive PADO
    09/02/2008 22:14:20 PPPoE send PADI
    09/02/2008 22:14:12 PPPoE send PADI
    09/02/2008 22:14:04 PPPoE send PADI
    09/02/2008 22:14:04 Dial On Demand(PPPoE1)
    09/02/2008 22:14:01 ADSL Media Up !
    09/02/2008 22:13:59 PPPoE send PADI
    09/02/2008 22:13:51 PPPoE send PADI
    09/02/2008 22:13:43 PPPoE send PADI
    09/02/2008 22:13:35 PPPoE send PADI
    09/02/2008 22:13:35 Dial On Demand(PPPoE1)
    09/02/2008 22:13:22 PPPoE stop
    09/02/2008 22:13:22 enter pppShutdown()
    09/02/2008 22:13:22 PPPoE1 stop PPP
    09/02/2008 22:08:30 If(PPPoE1) PPP connection ok !
    09/02/2008 22:08:29 PPPoE1 get IP:93.149.216.111
    09/02/2008 22:08:28 PPPoE1 start PPP
    09/02/2008 22:08:28 PPPoE receive PADS
    09/02/2008 22:08:28 PPPoE send PADR
    09/02/2008 22:08:28 PPPoE receive PADO
    09/02/2008 22:08:28 PPPoE send PADI
    09/02/2008 22:08:20 PPPoE send PADI
    09/02/2008 22:08:20 Dial On Demand(PPPoE1)
    09/02/2008 22:08:14 PPPoE send PADI
    09/02/2008 22:08:06 PPPoE send PADI
    09/02/2008 22:07:58 PPPoE send PADI
    09/02/2008 22:07:53 ADSL Media Up !
    09/02/2008 22:07:50 PPPoE send PADI
    09/02/2008 22:07:50 Dial On Demand(PPPoE1)
    09/02/2008 22:07:45 PPPoE send PADI
    09/02/2008 22:07:37 PPPoE send PADI
    09/02/2008 22:07:29 PPPoE send PADI
    09/02/2008 22:07:21 PPPoE send PADI
    09/02/2008 22:07:21 Dial On Demand(PPPoE1)
    09/02/2008 22:07:18 PPPoE stop
    09/02/2008 22:07:18 enter pppShutdown()
    09/02/2008 22:07:18 PPPoE1 stop PPP
    09/02/2008 22:05:49 **SYN Flood to Host** 192.168.2.3, 1059->> 64.233.183.91, 80 (from PPPoE1 Outbound)
    09/02/2008 21:52:08 If(PPPoE1) PPP connection ok !
    09/02/2008 21:52:07 PPPoE1 get IP:93.149.216.111
    09/02/2008 21:52:07 PPPoE1 start PPP
    09/02/2008 21:52:07 PPPoE receive PADS
    09/02/2008 21:52:07 PPPoE send PADR
    09/02/2008 21:52:07 PPPoE receive PADO
    09/02/2008 21:52:07 PPPoE send PADI
    09/02/2008 21:52:07 Dial On Demand(PPPoE1)
    09/02/2008 21:52:04 Delay 3 second - do_connect
    09/02/2008 21:52:04 If(PPPoE1) PPP fail : Timeout in LCP negotiation
    09/02/2008 21:52:02 Dial On Demand(PPPoE1)
    09/02/2008 21:52:02 PPPoE stop
    09/02/2008 21:52:02 enter pppShutdown()
    09/02/2008 21:51:16 PPPoE1 start PPP
    09/02/2008 21:51:16 PPPoE receive PADS
    09/02/2008 21:51:16 PPPoE send PADR
    09/02/2008 21:51:16 PPPoE receive PADO
    09/02/2008 21:51:16 PPPoE send PADI
    09/02/2008 21:51:16 Dial On Demand(PPPoE1)
    09/02/2008 21:51:12 Delay 3 second - do_connect
    09/02/2008 21:51:12 If(PPPoE1) PPP fail : Timeout in LCP negotiation
    09/02/2008 21:51:11 Dial On Demand(PPPoE1)
    09/02/2008 21:51:11 PPPoE stop
    09/02/2008 21:51:11 enter pppShutdown()
    09/02/2008 21:50:22 PPPoE1 start PPP
    09/02/2008 21:50:22 PPPoE receive PADS
    09/02/2008 21:50:22 PPPoE send PADR
    09/02/2008 21:50:22 PPPoE receive PADO
    09/02/2008 21:50:22 PPPoE send PADI
    09/02/2008 21:50:22 Dial On Demand(PPPoE1)
    09/02/2008 21:50:19 Dial On Demand(PPPoE1)
    09/02/2008 21:50:19 Delay 3 second - do_connect
    09/02/2008 21:50:19 If(PPPoE1) PPP fail : Timeout in LCP negotiation
    09/02/2008 21:50:19 PPPoE stop
    09/02/2008 21:50:19 enter pppShutdown()
    09/02/2008 21:49:31 PPPoE1 start PPP
    09/02/2008 21:49:31 PPPoE receive PADS
    09/02/2008 21:49:31 PPPoE send PADR
    09/02/2008 21:49:31 PPPoE receive PADO
    09/02/2008 21:49:31 PPPoE send PADI
    09/02/2008 21:49:31 Dial On Demand(PPPoE1)
    09/02/2008 21:49:30 Dial On Demand(PPPoE1)
    09/02/2008 21:49:28 Delay 3 second - do_connect
    09/02/2008 21:49:28 If(PPPoE1) PPP fail : Timeout in LCP negotiation
    09/02/2008 21:49:28 PPPoE stop
    09/02/2008 21:49:28 enter pppShutdown()
    09/02/2008 21:48:40 PPPoE1 start PPP
    09/02/2008 21:48:40 PPPoE receive PADS
    09/02/2008 21:48:40 PPPoE send PADR
    09/02/2008 21:48:40 PPPoE receive PADO
    09/02/2008 21:48:40 PPPoE send PADI
    09/02/2008 21:48:40 Dial On Demand(PPPoE1)
    09/02/2008 21:47:58 ADSL Media Up !
    09/02/2008 21:47:57 PPPoE send PADI
    09/02/2008 21:47:49 PPPoE send PADI
    09/02/2008 21:47:41 PPPoE send PADI
    09/02/2008 21:47:33 PPPoE send PADI
    09/02/2008 21:47:33 Dial On Demand(PPPoE1)
    09/02/2008 21:47:30 PPPoE stop
    09/02/2008 21:47:30 enter pppShutdown()
    09/02/2008 21:47:30 PPPoE1 stop PPP
    09/02/2008 21:43:35 **SYN Flood to Host** 192.168.2.3, 4260->> 74.125.77.93, 80 (from PPPoE1 Outbound)
    09/02/2008 21:43:19 If(PPPoE1) PPP connection ok !
    09/02/2008 21:43:18 PPPoE1 get IP:93.149.216.120
    09/02/2008 21:43:18 PPPoE1 start PPP
    09/02/2008 21:43:18 PPPoE receive PADS
    09/02/2008 21:43:18 PPPoE send PADR
    09/02/2008 21:43:18 PPPoE receive PADO
    09/02/2008 21:43:18 PPPoE send PADI
    09/02/2008 21:43:18 Dial On Demand(PPPoE1)
    09/02/2008 21:43:14 Dial On Demand(PPPoE1)
    09/02/2008 21:43:14 Delay 3 second - do_connect
    09/02/2008 21:43:14 If(PPPoE1) PPP fail : Timeout in LCP negotiation
    09/02/2008 21:43:12 PPPoE stop
    09/02/2008 21:43:12 enter pppShutdown()
    09/02/2008 21:42:22 PPPoE1 start PPP
    09/02/2008 21:42:22 PPPoE receive PADS
    09/02/2008 21:42:21 PPPoE send PADR
    09/02/2008 21:42:21 PPPoE receive PADO
    09/02/2008 21:42:21 PPPoE send PADI
    09/02/2008 21:42:21 Dial On Demand(PPPoE1)
    09/02/2008 21:42:04 PPPoE send PADI
    09/02/2008 21:42:02 ADSL Media Up !
    09/02/2008 21:41:56 PPPoE send PADI
    09/02/2008 21:41:48 PPPoE send PADI
    09/02/2008 21:41:40 PPPoE send PADI
    09/02/2008 21:41:40 Dial On Demand(PPPoE1)
    09/02/2008 21:41:34 PPPoE stop

    L'adresse IP correspond à VODAFONE en Italie (j'habite en Italie) mais mon ISP est Tele2... ???

    IPADDRESS.COM :

    IP address: 93.149.216.120
    IP country: Italy
    IP Address state: Liguria
    IP Address city: Ventimiglia
    IP latitude: 43.783298
    IP longitude: 7.600000
    ISP: Vodafone Omnitel N.V.
    Organization: IP addresses allocated to DSL customers
    Host: net-93-149-216-120.t2.dsl.vodafone.it
    1. chronos_26
      je pense que c'est un trojan, je te conseil de poster un rapport hijack...
      1. elmerendero Auteur
        Le voici... et en plus un "copier coller" de mes connections netstat:

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 10:01:47, on 03/09/2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16705)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\Ati2evxx.exe
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\RTHDCPL.EXE
        C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
        C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\Program Files\Shiro SKYPE DECT\USBPhone4Skype.exe
        C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
        C:\Program Files\Skype\Phone\Skype.exe
        C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
        C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
        C:\Program Files\philips\Philips SNU5600 Wireless USB Adapter Utility\PHUSBBGMonitor.exe
        C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
        C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
        C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        E:\Telechargements\Programmes\HiJackThis.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

        https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
        O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
        O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [USBPhone4Skype] C:\Program Files\Shiro SKYPE DECT\USBPhone4Skype.exe
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
        O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers

        communs\Ahead\lib\NMBgMonitor.exe"
        O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
        O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
        O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
        O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
        O4 - Global Startup: Adaptateur USB sans fil Philips SNU5600.lnk = C:\Program Files\philips\Philips SNU5600

        Wireless USB Adapter Utility\PHUSBBGMonitor.exe
        O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

        Files\Java\jre1.6.0_07\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

        Files\Java\jre1.6.0_07\bin\ssv.dll
        O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program

        Files\Microsoft ActiveSync\INetRepl.dll
        O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft

        ActiveSync\INetRepl.dll
        O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} -

        C:\Program Files\Microsoft ActiveSync\INetRepl.dll
        O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet

        Explorer\SkypeIEPlugin.dll
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

        C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search &

        Destroy\SDHelper.dll
        O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2}

        - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

        Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

        Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

        Files\Messenger\msmsgs.exe
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -

        http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
        O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) -

        http://anba1960.spaces.live.com/PhotoUpload/MsnPUpld.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

        http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O17 - HKLM\System\CCS\Services\Tcpip\..\{9298302C-B480-4AF7-9ADF-FFA44A257405}: NameServer = 192.168.2.1
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil

        Software\Avast4\aswUpdSv.exe
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers

        communs\InstallShield\Driver\11\Intel 32\IDriverT.exe

    Discussions similaires

    L'administrateur bloque le réseau sans fil
    bouda19

    26 réponses
    votre administrateur reseau a bloque vos conn
    analog101

    9 réponses
    connexions au serveur Imap sur les ports ont expirés
    Garousta

    2 réponses
    Votre administrateur a bloqué vos connexions
    josephas

    1 réponse
    EXPIRATION DU PORT 993
    Alili13

    4 réponses