Hi,

ich habe in den letzten Tagen einige Malware entfernt, doch drei merkwürdige Erscheinungen bleiben:

1. Etwa eine Minute nach dem Einloggen wird kurz wscntfy.exe gestartet und ein Popup-Balloon erscheint und behauptet, die Firewall sei nicht aktiviert, werschwindet aber sofort (< 1 sec) wieder.
2. Ab und zu erscheint ganz kurz grundlos die Sanduhr am Cursor.
3. svchost.exe läuft mehrfach.

Mein HijackThis-Log:

Logfile of HijackThis v1.99.1
Scan saved at 02:51:55, on 30.11.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\Programme\HealthMonitor\HealthMonitor.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\mqtgsvc.exe
C:\Programme\TortoiseSVN\bin\TSVNCache.exe
C:\Programme\WinPortrait\wpctrl.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Java\jre1.5.0_05\bin\jusched.exe
C:\PROGRA~1\INTERN~2\MEDIAKEY.EXE
C:\Programme\Ahead\InCD\InCD.exe
C:\PROGRAMME\SCANJET\PrecisionScanLT\hppwrsav.exe
C:\PROGRA~1\D4\D4.exe
C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Programme\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
C:\Programme\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\GnuPT\GPGRelay\GPGrelay.exe
C:\Programme\IMAP Notify\IMAPNotify.exe
C:\PROGRA~1\INTERN~2\KBOSDCtl.EXE
C:\Programme\Miranda IM\miranda32.exe
C:\PROGRA~1\INTERN~2\KCodeMsg.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Programme\PopTray\PopTray.exe
C:\Programme\GnuPT\WPT\WinPT.exe
C:\Programme\WinPortrait\floater.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\Programme\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/advanced_search?hl=de
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.int.robustsoft.de:3128
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = robustsoft.de;int.robustsoft.de;<local>
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {826B2228-BC09-49F2-B5F8-42CE26B1B712} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [PivotSoftware] "C:\Programme\WinPortrait\wpctrl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [SBDrvDet] C:\Programme\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MediaKey] C:\PROGRA~1\INTERN~2\MEDIAKEY.EXE
O4 - HKLM\..\Run: [InCD] C:\Programme\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [hppwrsav] C:\PROGRAMME\SCANJET\PrecisionScanLT\hppwrsav.exe
O4 - HKLM\..\Run: [Dimension4] C:\PROGRA~1\D4\D4.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Programme\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTDVDDET] C:\Programme\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Programme\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Programme\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: GPGRelay.lnk = C:\Programme\GnuPT\GPGRelay\GPGrelay.exe
O4 - Startup: IMAP Notify.lnk = C:\Program Files\IMAP Notify\IMAPNotify.exe
O4 - Startup: Miranda IM.lnk = C:\Programme\Miranda IM\miranda32.exe
O4 - Startup: PopTray.lnk = C:\Programme\PopTray\PopTray.exe
O4 - Startup: Windows Privacy Tray.lnk = C:\Programme\GnuPT\WPT\WinPT.exe
O4 - Global Startup: AutoCAD-Startbeschleuniger.lnk = C:\Programme\Gemeinsame Dateien\Autodesk Shared\acstart16.exe
O8 - Extra context menu item: Im Standard-Aggregator abonnieren - C:\Dokumente und Einstellungen\pschoenb\Anwendungsdaten\RssBandit\iecontext_subscribefeed.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesde.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesde.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Programme\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Programme\Hello\PicasaCapture.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/downloads/kws/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programme\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/084aeb38bbac7e759a23/netzip/RdxIE601_de.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040428/qtinstall.info.apple.com/saba/de/win/QuickTimeInstaller.exe
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} -
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4474/mcfscan.cab
O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} (MCSendMessageHandler Class) - http://xtraz.icq.com/xtraz/activex/MISBH.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = robustsoft.de
O17 - HKLM\Software\..\Telephony: DomainName = robustsoft.de
O17 - HKLM\System\CCS\Services\Tcpip\..\{1DE48C90-E102-4F49-9639-D27AAA5F93A0}: Domain = robustsoft.de
O17 - HKLM\System\CCS\Services\Tcpip\..\{1DE48C90-E102-4F49-9639-D27AAA5F93A0}: NameServer = 195.243.152.186
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2AF60CB-CD58-4FC3-B150-DF4309C17F32}: Domain = robustsoft.de
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2AF60CB-CD58-4FC3-B150-DF4309C17F32}: NameServer = 195.243.152.186
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = robustsoft.de
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = robustsoft.de,int.robustsoft.de
O17 - HKLM\System\CS1\Services\Tcpip\..\{1DE48C90-E102-4F49-9639-D27AAA5F93A0}: Domain = robustsoft.de
O17 - HKLM\System\CS1\Services\Tcpip\..\{1DE48C90-E102-4F49-9639-D27AAA5F93A0}: NameServer = 195.243.152.186
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = robustsoft.de,int.robustsoft.de
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: CVSNT (CVS) - GNU - C:\Programme\cvsnt\cvsservice.exe
O23 - Service: CVSNT Locking Service (CVSLock) - Unknown owner - C:\Programme\cvsnt\cvslock.exe
O23 - Service: HealthMonitor - Vittorio Pavesi - C:\Programme\HealthMonitor\HealthMonitor.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Programme\Ahead\InCD\InCDsrv.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite 2005.SR1\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite 2005.SR1\RpcSandraSrv.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programme\TightVNC\WinVNC.exe" -service (file missing)

Scanne mal dein System mit Escan und teile uns anschliessend die Ergebnisse mit.

Zitat von cronos

Scanne mal dein System mit Escan und teile uns anschliessend die Ergebnisse mit.

Habe ich, das sieht aber sehr nach "false positives" aus. Kaspersky Personal Pro meldet nichts.

Hier das Log:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "infected"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed Nov 30 16:52:39 2005 => System found infected with w32/rbot-ank Email-Flooder ({19e28afc-eae3-4ce5-ac83-2407b42f57c9})! Action taken: No Action Taken.
Wed Nov 30 16:52:40 2005 => System found infected with searchexe Spyware/Adware ({807553e5-5146-11d5-a672-00b0d022e945})! Action taken: No Action Taken.
Wed Nov 30 16:52:40 2005 => System found infected with w32/rbot-ank Email-Flooder ({19e28afc-eae3-4ce5-ac83-2407b42f57c9})! Action taken: No Action Taken.
Wed Nov 30 16:52:40 2005 => System found infected with netster Spyware/Adware ({56336bcb-3d8a-11d6-a00b-0050da18de71})! Action taken: No Action Taken.
Wed Nov 30 16:52:46 2005 => System found infected with clipgenie Spyware/Adware (channels.ini)! Action taken: No Action Taken.
Wed Nov 30 16:52:59 2005 => System found infected with whistlesoftware Spyware/Adware (version.ini)! Action taken: No Action Taken.
Wed Nov 30 16:53:06 2005 => System found infected with hotbar Spyware/Adware (wbemess.lo_)! Action taken: No Action Taken.
Wed Nov 30 16:53:17 2005 => System found infected with whistlesoftware Spyware/Adware (version.ini)! Action taken: No Action Taken.
Wed Nov 30 16:55:47 2005 => Total Disinfected Files: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "tagged"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Funde für "offending"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed Nov 30 16:52:42 2005 => Offending Key found: HKLM\Software\gnu !!!
Wed Nov 30 16:52:42 2005 => Offending Key found: HKCU\Software\gnu !!!
Wed Nov 30 16:52:45 2005 => Offending Folder found: C:\Programme\gnu
Wed Nov 30 16:52:46 2005 => Offending file found: C:\Dokumente und Einstellungen\pschoenb\Anwendungsdaten\chessbase\channels.ini
Wed Nov 30 16:52:59 2005 => Offending file found: C:\Dokumente und Einstellungen\pschoenb\Eigene Dateien\projekte\java\workspace\.metadata\version.ini
Wed Nov 30 16:53:06 2005 => Offending file found: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\spybot - search & destroy\backups\wbemess.lo_
Wed Nov 30 16:53:17 2005 => Offending file found: C:\Dokumente und Einstellungen\pschoenb\Eigene Dateien\projekte\java\workspace\.metadata\version.ini
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Wed Nov 30 16:55:47 2005 => Total Virus(es) Found: 11
Wed Nov 30 16:55:47 2005 => Total Errors: 417
Wed Nov 30 16:55:47 2005 => Time Elapsed: 00:04:25
Wed Nov 30 16:55:47 2005 => Total Objects Scanned: 29916
Wed Nov 30 16:55:47 2005 => Virus Database Date: 2005/11/30
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~ © Haui ;-) ~~~~~~~
~~~~~~~ Dank an Cidre ~~~~~~~