TR/VB.AQT, TR/VB.aqt.58. CTFMon.exe in Recycled
Hi zusammen,
ich habe die o. g. Viren und bekomm sie leider nicht weg. Ich betreibe hier ein Windows 2003 Server und kann deshalb mal nicht eben formatieren. Die Viren befinden sich auf allen Netzlaufwerken mit einer Autorun.inf und einem Recycled, in dem die CTFMON.exe ist. Antvir wird als Virenprogramm eingesetzt aber wenn ich diese in Quarantäne lege lasse, kommen die Datein immer wieder. Ich vermute, dass die Viren mit einem Privaten USB-Stick in die Firma gekommen und sind und ich meine auch zu wissen welcher Client es war.
Hijackthislog:
HiJackthis Logfile: Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:55:13, on 29.05.2012
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Avira\AntiVir Server\sched.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Server\avguard.exe
E:\APPS\Atbas\AtbasServerApp\AtbasServerApp.exe
C:\Programme\Avira\AntiVir Server\avshadow.exe
D:\srv_apps\bbgate\BBGate.exe
D:\srv_apps\bbgate\Apache.exe
C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe
C:\WINDOWS\system32\Dfssvc.exe
D:\srv_apps\bbgate\Apache.exe
D:\srv_apps\dmsbb\bin\DMSBackbone.exe
C:\WINDOWS\System32\dns.exe
D:\srv_apps\drops\share\bin\Drops-C-Server.exe
D:\srv_apps\drops\share\bin\Drops-Controller-Server-Timer.exe
D:\srv_apps\drops\share\bin\Drops-C-Server.exe
D:\srv_apps\drops\share\bin\Drops-Installer-Server-Timer.exe
D:\srv_apps\drops\share\bin\Drops-I-Server.exe
E:\APPS\EVA\BIN\EvaJobService.exe
E:\GROUPS\Programme\aps3\srv_apps\Firebird\Firebird_1_5\bin\fbguard.exe
C:\WINDOWS\System32\ismserv.exe
C:\Programme\Java\jre6\bin\jqs.exe
E:\APPS\ElsaWin\bin\LcSvrAdm.exe
E:\APPS\ElsaWin\bin\LcSvrDba.exe
E:\APPS\ElsaWin\bin\LcSvrHis.exe
E:\APPS\ElsaWin\bin\LcSvrPas.exe
E:\APPS\ElsaWin\bin\LcSvrSaz.exe
D:\VWCMD\TOOLS\srvany.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\ntfrs.exe
E:\Apps\EVA\BIN\LEADCommunication.exe
d:\srv_apps\oracle\bin\agntsrvc.exe
d:\srv_apps\oracle\BIN\TNSLSNR.exe
C:\WINDOWS\system32\cmd.exe
d:\srv_apps\oracle\bin\dbsnmp.exe
d:\srv_apps\oracle\bin\ORACLE.EXE
d:\srv_apps\oracle\bin\ORACLE.EXE
E:\APPS\ATBAS\PostgreSQL\8.2\bin\pg_ctl.exe
e:\apps\sdii\TRANSBAS\SD2MUX32.exe
C:\Programme\StempelMeter\zetservr.exe
C:\Programme\StempelMeter\zetrmsvr.exe
C:\WINDOWS\System32\snmp.exe
C:\hp\hpsmh\bin\smhstart.exe
C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe
C:\Programme\UltraVNC\WinVNC.exe
C:\hp\hpsmh\bin\hpsmhd.exe
C:\Programme\TeamViewer\Version5\TeamViewer.exe
C:\WINDOWS\System32\wins.exe
C:\Programme\StempelMeter\zeaufinf.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
C:\Programme\UltraVNC\WinVNC.exe
C:\WINDOWS\system32\CPQNiMgt\cpqnimgt.exe
C:\WINDOWS\system32\CpqRcmc.exe
C:\WINDOWS\system32\CPQMgmt\CqMgServ\cqmgserv.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
C:\WINDOWS\system32\CPQMgmt\CqMgStor\cqmgstor.exe
C:\hp\hpsmh\bin\hpsmhd.exe
C:\Programme\HP\Data Protector Express\v3.50-sp2\win\x86\dpwinsdr.exe
C:\WINDOWS\system32\sysdown.exe
C:\WINDOWS\system32\CPQMgmt\CqMgHost\cqmghost.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
C:\WINDOWS\System32\svchost.exe
E:\APPS\ElsaWin\bin\LcSvrAuf.exe
E:\GROUPS\Programme\aps3\srv_apps\Firebird\Firebird_1_5\bin\fbserver.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Eaufserv\EAufServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cpqteam.exe
C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
C:\Programme\Avira\AntiVir Server\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Message-Bob\Message-Bob.exe
C:\Programme\HP\Data Protector Express\v3.50-sp2\win\x86\dpwingqa.exe
C:\Programme\Hardcopy\hardcopy.exe
E:\APPS\Atbas\bin\AtbasUpd.exe
d:\srv_apps\oracle\BIN\ONRSD.EXE
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
e:\apps\sdii\TRANSBAS\tbkern32.exe
e:\apps\sdii\TRANSBAS\tbkern32.exe
e:\apps\sdii\TRANSBAS\tbkern32.exe
e:\apps\sdii\TRANSBAS\tbkern32.exe
e:\apps\sdii\TRANSBAS\tbkern32.exe
e:\apps\sdii\TRANSBAS\tbkern32.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
E:\APPS\ATBAS\PostgreSQL\8.2\bin\postgres.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programme\Trend Micro\HiJackThis\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://portal
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://portal
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [CPQTEAM] cpqteam.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Server\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Message-Bob] C:\Programme\Message-Bob\Message-Bob.exe /a
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_2_202_221_ActiveX.exe -update activex
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: Hardcopy.LNK = C:\Programme\Hardcopy\hardcopy.exe
O4 - Global Startup: Data Protector Express Quick Access.lnk = C:\Programme\HP\Data Protector Express\v3.50-sp2\win\x86\dpwingqa.exe
O4 - Global Startup: SDASSIST.LNK = SDII\D\D\EXE.W95\SDASSIST.exe
O4 - Global Startup: StempelMeter-Steuerung.lnk = ?
O4 - Global Startup: StempelMeter-Terminal.LNK = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O15 - ESC Trusted Zone: hxxp://runonce.msn.com
O15 - ESC Trusted Zone: hxxp://*.portal
O15 - ESC Trusted Zone: hxxp://shortnews.stern.de
O16 - DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} (F-Secure Online Scanner Launcher) - hxxp://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - hxxp://download.bitdefender.com/resources/scanner/sources/de/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1248895595250
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1247119611203
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: hpapp - {24F45006-5BD9-41B7-9BD9-5F8921C8EBD1} - C:\Programme\Compaq\hpadu\Bin\hpapp.dll
O18 - Protocol: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - E:\APPS\ElsaWin\bin\wiprot.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Avira AntiVir Server Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir Server\sched.exe
O23 - Service: Avira AntiVir Server (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Server\avguard.exe
O23 - Service: Atbas Service (AtbasService) - ATBAS GmbH und Co. KG - E:\APPS\Atbas\AtbasServerApp\AtbasServerApp.exe
O23 - Service: BBGate DMS-Backbone Service (BBGate) - VOLKSWAGEN AG - D:\srv_apps\bbgate\BBGate.exe
O23 - Service: BBGate-HTTPD - Unknown owner - D:\srv_apps\bbgate\Apache.exe
O23 - Service: Client32 - NetSupport Ltd - C:\PROGRA~1\NETSUP~1\client32.exe
O23 - Service: HP Insight NIC Agent (CpqNicMgmt) - Hewlett-Packard Company - C:\WINDOWS\system32\CPQNiMgt\cpqnimgt.exe
O23 - Service: HP ProLiant Remote Monitor Service (CpqRcmc) - Hewlett-Packard Company - C:\WINDOWS\system32\CpqRcmc.exe
O23 - Service: HP Version Control Agent (cpqvcagent) - Hewlett-Packard Company - C:\hp\hpsmh\data\cgi-bin\vcagent\vcagent.exe
O23 - Service: HP Insight Foundation Agents (CqMgHost) - Hewlett-Packard Company - C:\WINDOWS\system32\CPQMgmt\CqMgHost\cqmghost.exe
O23 - Service: HP Insight Server Agents (CqMgServ) - Hewlett-Packard Company - C:\WINDOWS\system32\CPQMgmt\CqMgServ\cqmgserv.exe
O23 - Service: HP Insight Storage Agents (CqMgStor) - Hewlett-Packard Company - C:\WINDOWS\system32\CPQMgmt\CqMgStor\cqmgstor.exe
O23 - Service: DMSBackbone - Alexandria Software Consulting - D:\srv_apps\dmsbb\bin\DMSBackbone.exe
O23 - Service: Data Protector Express (DPXpress) - HP - C:\Programme\HP\Data Protector Express\v3.50-sp2\win\x86\dpwinsdr.exe
O23 - Service: Drops-Controller-Server - Unknown owner - D:\srv_apps\drops\share\bin\Drops-C-Server.exe
O23 - Service: Drops-Controller-Server-Timer - Unknown owner - D:\srv_apps\drops\share\bin\Drops-Controller-Server-Timer.exe
O23 - Service: Drops-Installer-Server - Unknown owner - D:\srv_apps\drops\share\bin\Drops-I-Server.exe
O23 - Service: Drops-Installer-Server-Timer - Unknown owner - D:\srv_apps\drops\share\bin\Drops-Installer-Server-Timer.exe
O23 - Service: EAufServ - LEX-COM - C:\PROGRA~1\Eaufserv\EAufServ.exe
O23 - Service: EvaJobService - ComDev Systemlösungen GmbH - E:\APPS\EVA\BIN\EvaJobService.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - E:\GROUPS\Programme\aps3\srv_apps\Firebird\Firebird_1_5\bin\fbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - E:\GROUPS\Programme\aps3\srv_apps\Firebird\Firebird_1_5\bin\fbserver.exe
O23 - Service: iTVUpdateService - Unknown owner - C:\Programme\iTV2\iTVUpdateService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: ELSA Administration Service (LcSvrAdm) - Volkswagen AG - E:\APPS\ElsaWin\bin\LcSvrAdm.exe
O23 - Service: ELSA Auftragsverwaltungs Service (LcSvrAuf) - Volkswagen AG - E:\APPS\ElsaWin\bin\LcSvrAuf.exe
O23 - Service: ELSA DBA Server (LcSvrDba) - Volkswagen AG - E:\APPS\ElsaWin\bin\LcSvrDba.exe
O23 - Service: ELSA Historie Server (LcSvrHis) - Volkswagen AG - E:\APPS\ElsaWin\bin\LcSvrHis.exe
O23 - Service: ELSA PASS Server (LcSvrPAS) - Volkswagen AG - E:\APPS\ElsaWin\bin\LcSvrPas.exe
O23 - Service: ELSA APOSpro Server (LcSvrSaz) - Volkswagen AG - E:\APPS\ElsaWin\bin\LcSvrSaz.exe
O23 - Service: LeadCommunication - Unknown owner - D:\VWCMD\TOOLS\srvany.exe
O23 - Service: OracleOraHome92Agent - Oracle Corporation - d:\srv_apps\oracle\bin\agntsrvc.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - d:\srv_apps\oracle\BIN\ONRSD.EXE
O23 - Service: OracleOraHome92SNMPPeerEncapsulator - Unknown owner - d:\srv_apps\oracle\BIN\ENCSVC.EXE
O23 - Service: OracleOraHome92SNMPPeerMasterAgent - Unknown owner - d:\srv_apps\oracle\BIN\AGNTSVC.EXE
O23 - Service: oracleorahome92TNSListener (OracleOraHome92TNSListener) - Unknown owner - d:\srv_apps\oracle\BIN\TNSLSNR.exe
O23 - Service: OracleServiceEVA1 - Oracle Corporation - d:\srv_apps\oracle\bin\ORACLE.EXE
O23 - Service: OracleServiceTKP - Oracle Corporation - d:\srv_apps\oracle\bin\ORACLE.EXE
O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - E:\APPS\ATBAS\PostgreSQL\8.2\bin\pg_ctl.exe
O23 - Service: SD2MUX32 - Transaction Software, D 81829 Munich - e:\apps\sdii\TRANSBAS\SD2MUX32.exe
O23 - Service: StempelMeter-Server (SMeterServer) - Klaus Stratmann GmbH - C:\Programme\StempelMeter\zetservr.exe
O23 - Service: StempelMeter-Terminal-Server (SMTermrServer) - Klaus Stratmann GmbH - C:\Programme\StempelMeter\zetrmsvr.exe
O23 - Service: HP ProLiant System Shutdown Service (sysdown) - Compaq Computer Corporation - C:\WINDOWS\system32\sysdown.exe
O23 - Service: HP System Management Homepage (SysMgmtHP) - Hewlett-Packard Company - C:\hp\hpsmh/bin/smhstart.exe
O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe
O23 - Service: uvnc_service - UltraVNC - C:\Programme\UltraVNC\WinVNC.exe
O23 - Service: StempelMeter-Auftragsinformation (ZEAuftInfo) - Klaus Stratmann GmbH - C:\Programme\StempelMeter\zeaufinf.exe
--
End of file - 17021 bytes
--- --- ---
Escan hab ich mal drüber laufen lassen, das ging aber 8 Stunden und dann gab es ein Serverneustart. Wird die log irgendwo gespeichert, dass ich sie hochladen könnte ? Würde mich um Hilfe freuen, auch wenn dieser TR. "glaub ich" nicht viel anstellt.
CCleaner habe ich auch drüber laufen lassen.
edit: in der Autorun.inf steht folgendes:
[autorun]
shellexecute=Recycled\ctfmon.exe
shell\Open(&0)\command=Recycled\ctfmon.exe
shell=Open(&0)
Viele Grüße | 