It will be useful coz, all the ipc scanners i know are detected by AV or with a bad NT pass scan :

-ipcscan 2.0 is detected
-NT scanner(Dos Version) don't use null session to found the users but NT-user.dic
If somebody know this nice log it will be very well apreciated

Soz for a bad english

I suggest just putting the desired file on the "Exclude"-list

Huh, i have found it : HScan tested with norton and KAV, it's enough

i didn't think there was a dos version, u can found it HERE

I hope it will help somebody

Hum just a question, in fact, ipcsan, nt scanner and hs scan uses a dictionnary for users, i knew that the null session gives the users accounts so why use they an user dictionnary whereas fxscanner don't use.

So they don't test all the NT accounts isn't it ?

Thanks for urs answers

http://upx.sourceforge.net/#download

use a exe compressor and they arnt detected

try using FSG and then if that doesnt work try using UPX + UPXREDIR then it shouldnt detect it ) Or hex edit and rename all the IPC or what ever then maybe it might not detect it

Thanks for the link and the good discussion.. I needed those answers... And I'll try it right away.. Thanks a lot m8's

FSG will be detected as a trojan/backdoor. My own comps at home found it. Use a mix of AsPack and morphine. Morphine is attached as its a bit harder to find, you'll be able to find AsPack no problems.
Also, as stated, yes hexing it and changing enough of it will make it undetectable.

Just tried HScan. Dosn't it only tell you the users on the computer.. Can't get any passwords. Can anyone help?

Why do u speek of morphine or UPX ? I told u that HScan and NTScanner arent detected by AVs so u havent to answer for answer, it's offtopic .

And nobody answered to my question :

Ok s54, thanks a lot

So I conclude that it's better to have an user dictionnary (i thought they didn't find the users with a null session).

Just another question, what are the most frequents administrators users names to make a better user.dic ? and for passwords ?

Commonly like "Administrator" and it's equalents in different languages and some "uber"-admins tend to rename the admin account to "admin", "root" or "r00t".
However, there are certain applications that create an admin account or several admin accouns with their own pre-defined passes or weak passes.
Do some google on this topic, nearly nobody knows but there are a few dozens programs that actually do.

Ok, i have made thoses lists after looking my results

I hope it will help u

I think we can login a windows box without know administrator username. It's not important for login.

We can use sid for this and If I didn't forget it, it was 500

So we can login by providing sid. But I'm not sure about this.

What is that sid? I would say that you have to have the user/pass.

A remark :

In fact NTscan mark as results all NT accounts and not only Administrators accounts, so in final only HScan seems to be good. But it's still big : 1.7 MB, if uknow a little NT administrator accounts scanner, give me, it will be well apreciated.

2nd remark :

HScan make a report (a htlm page) and open it in end of scan.. it's not invisible at all, still no good scanner.

3rd remark :

I was thinking about modify IPCscan 2.0 but it seems that it can't etablish Null session (tested at home and on 2 remotes).

Still no ipc scanner..

4th Remark :

NTscan is buggy when there is open netbios but not null session so the solution is to give him an empty user.dic if you scan ranges with a lot of IPCs.

I attach NTscan dos version for thoses who want, i hope it will help u.

sflite.exe cant be detected by any Av yet