[Nuu™™]

Yes, well, sorry for not being around much lately; although, it is not entirely my fault:

You see, there has been a lot of downloads and all that of which I can not account for and as a result my I.S.P. has gone ahead and shaped my Internet. Ergo, I was wondering if there has been some little secret operation going on in the depths of my computer. To discover the true situation, I ask the following:

Is there any way to determine what is coming into one's computer (and what is going out of one's computer, although that is not completely necessary) and by what means it is entering or departing? Some sort of monitor programme or something of that sort?

[Ratty]

Have you got a wireless router? If you don't have security on it, then it's pretty easy for anyone to be able to connect to it. Other than that, I don't know any programs that monitors what programs use bandwidth, and how much they use up.

You've got a firewall yeah? I mean, that'd stop unallowed activity from going in and out of your computer. Won't change anything if it's other people connected to your wireless though (If you have it.)

[Jake]

Make sure your wireless password isnt admin. Try using p45Sw0rd instead.

For monitoring traffic theres tons of stuff. Try a packet sniffer or something.

[Nuu™™]

Have you got a wireless router? If you don't have security on it, then it's pretty easy for anyone to be able to connect to it. Other than that, I don't know any programs that monitors what programs use bandwidth, and how much they use up.

No, I have a D-Link 504G. In any case, the nearest person to my house is an old man who lives on other side of the paddock, and the next nearest would be over a kilometre.

You've got a firewall yeah? I mean, that'd stop unallowed activity from going in and out of your computer. Won't change anything if it's other people connected to your wireless though (If you have it.)

I've got Norton Internet Security and Windows Defender.

Oh, and what's a packet sniffer?

[Troll]

Moniters the packets going in and out of your computer (In other words the stuff) i believe.

[Jake]

What he said.

A packet sniffer (or at least the bootleg one I had) as a pretty useful network traffic monitoring tool.

[Nuu™™]

I've been unshaped! Dolĉa liberigo!

But anyway, what packet sniffer in particular would you recommend?

[Nuu™™]

*bump*

[Ratty]

Ethereal is really good. But apparently in their new version, they renamed it. Check it out. =P

[Kimojuno]

The basic way to check connections in Windows XP is to go to start > run > type 'cmd' > in the command prompt type 'netstat' -- that will show you all connections inbound and outbound. I would also reccomend WinPatrol, as that is a good program that lists all startup programs, active tasks, services, etc.

Jeff.

[Nuu™™]

Hai again! I did the netstat thing, and I got a few unusual results:

http://unam.mx/
http://komando.com/
http://onlinehome.us/
http://akamaitechnologies.net/ - (apparently that has something to do with the F.B.I., which is apparently the U.S. governmental security department. Sounds like bull to me)

[Ratty]

Yeah, that's a little weird. Ever used Hijack This before? If you have, use it, and show us the log (Either post here or PM it to me.)

If you havent, go to http://www.spywarein.../downloads.html, download it, and then do it. Fairly straight forward.

[x..]

Done anything that is illegal, Nuu?


Haha, joking.


Yeah, what the Rat said.

[Nuu™™]

'Course I have hi-jack this. ^ .^

Voilà:

CODE

Logfile of HijackThis v1.99.1
Scan saved at 1:05:47 AM, on 4/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\WhatPulse\WhatPulse.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BOINC\boincmgr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Documents and Settings\Nick\Desktop\Desktop Things\procexp.exe
C:\Program Files\BOINC\boinc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\BOINC\projects\setiathome.berkeley.edu\setiathome_5.27_windows_intelx86.exe
C:\Program Files\BOINC\projects\szdg.lpds.sztaki.hu_szdg\search_2.06_windows_intelx86
C:\Documents and Settings\Nick\Desktop\Desktop Things\HijackThis.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

Xmadole y'ol' spammer.