Trojaner-Board - Seltsamer Datenverkehr -> Malware ?

Hi!

Ich habe vor kurzem wegen Problemen mit der Diablo 3 Beta den Datenverkehr meines PCs mittels Wireshark analysiert und dabei fielen mir seltsame Verbindungen auf.

Diverse Rechner im Netz senden meinem Computer mit unterschiedlichen Source-Ports UDP Pakete auf den Port 17252 meines Computers.
Diese Übertragungen kommen regelmäßig, werden von meinem PC jedoch nicht beantwortet.
Was ist daran merkwürdig?
Über Netstat sehe ich diese Verbindungen nicht, nur über Wireshark und die Einträge in der NAT-Tabelle meines Routers.

Die Source IP-Adressen unterscheiden sich meistens, manche wiederholen sich. Sie gehören diversen österreichischen Privat-Internetzugängen, ab und zu ist eine Adresse aus den USA dabei.

Mein PC zeigt ansonsten keine Auffälligkeiten, aber es laufen keinerlei Programme die diesen Datenverkehr produzieren können. Mich macht besonders stutzig, dass hier regelmäßig Daten an meinen PC gesendet werden, ohne das dieser antwortet.

Ich habe den Verdacht, dass ich mir irgendeine Art von Malware eingefangen habe.

Könntet ihr meine geposteten Logs analysieren, um mir weiterzuhelfen?

Danke!
Code:
.

DDS (Ver_2011-08-26.01) - NTFSAMD64 

Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 1.6.0_18

Run by Stefan at 19:46:35 on 2012-03-17

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.43.1033.18.2047.1173 [GMT 1:00]

.

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe

C:\Windows\SysWOW64\bgsvcgen.exe

C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe

C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe

C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe

C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe

C:\Windows\SysWOW64\vmnat.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\SysWOW64\vmnetdhcp.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\RAVCpl64.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe

C:\Program Files (x86)\VMware\VMware Player\hqtray.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit=userinit.exe,

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"

mRun: [VMware hqtray] "C:\Program Files (x86)\VMware\VMware Player\hqtray.exe"

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

StartupFolder: C:\Users\Stefan\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Stefan\AppData\Roaming\Dropbox\bin\Dropbox.exe

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Nach Microsoft &Excel exportieren - C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL

LSP: C:\Program Files (x86)\VMware\VMware Player\vsocklib.dll

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

TCP: Interfaces\{430FB8C3-7F7E-4F00-8DC5-BB0406003AE8}\3507565646771697 : DhcpNameServer = 10.0.0.138

TCP: Interfaces\{430FB8C3-7F7E-4F00-8DC5-BB0406003AE8}\96D23616E6D286561627D297F657 : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{C1AEFD9C-B42D-48DE-8D45-9AB10E0614FA} : DhcpNameServer = 10.0.0.138

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6}

{DBC80044-A445-435b-BC74-9C25C1C588A9}

mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun-x64: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"

mRun-x64: [VMware hqtray] "C:\Program Files (x86)\VMware\VMware Player\hqtray.exe"

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\w66u6p0f.default\

FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll

FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll

FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npwachk.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

.

============= SERVICES / DRIVERS ===============

.

R1 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]

R2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;C:\Program Files\Common Files\Nitro PDF\Reader\2.0\NitroPDFReaderDriverService2x64.exe [2011-12-20 341800]

R2 TeamViewer5;TeamViewer 5;C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe [2010-3-18 172328]

R2 TeamViewer6;TeamViewer 6;C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-7 2228008]

R2 VMUSBArbService;VMware USB Arbitration Service;C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [2011-3-25 539248]

R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]

R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]

R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]

R3 HCW3x64;Hauppauge WinTV-HVR 713X PCI Card;C:\Windows\system32\DRIVERS\HCW71364.sys --> C:\Windows\system32\DRIVERS\HCW71364.sys [?]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk62x64.sys --> C:\Windows\system32\DRIVERS\yk62x64.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-3-16 652360]

S3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

S3 MpNWMon;Microsoft Malware Protection Network Driver;C:\Windows\system32\DRIVERS\MpNWMon.sys --> C:\Windows\system32\DRIVERS\MpNWMon.sys [?]

S3 netr28ux;RT2870 USB Extensible Wireless LAN Card Driver;C:\Windows\system32\DRIVERS\netr28ux.sys --> C:\Windows\system32\DRIVERS\netr28ux.sys [?]

S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

S3 NisSrv;Microsoft-Netzwerkinspektion;C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-4-27 288272]

S3 Ph3xIB64;Philips 713x Inbox PCI TV Card;C:\Windows\system32\DRIVERS\Ph3xIB64.sys --> C:\Windows\system32\DRIVERS\Ph3xIB64.sys [?]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\Windows\system32\DRIVERS\vwifimp.sys --> C:\Windows\system32\DRIVERS\vwifimp.sys [?]

S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

SUnknown tsusbhub;tsusbhub; [x]

.

=============== Created Last 30 ================

.

2012-03-16 19:49:13        --------        d-----w-        C:\Program Files (x86)\Diablo III Beta

2012-03-16 18:08:12        592824        ----a-w-        C:\Program Files (x86)\Mozilla Firefox\gkmedias.dll

2012-03-16 18:08:12        44472        ----a-w-        C:\Program Files (x86)\Mozilla Firefox\mozglue.dll

2012-03-16 18:01:48        --------        d-----w-        C:\ProgramData\Battle.net

2012-03-16 09:39:29        8643640        ----a-w-        C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{024DD11F-234A-4298-96A7-41F2707B8F98}\mpengine.dll

2012-03-14 21:31:30        5559152        ----a-w-        C:\Windows\System32\ntoskrnl.exe

2012-03-14 21:31:29        3968368        ----a-w-        C:\Windows\SysWow64\ntkrnlpa.exe

2012-03-14 21:31:29        3913584        ----a-w-        C:\Windows\SysWow64\ntoskrnl.exe

2012-03-14 21:27:55        3145728        ----a-w-        C:\Windows\System32\win32k.sys

2012-03-14 21:27:54        9216        ----a-w-        C:\Windows\System32\rdrmemptylst.exe

2012-03-14 21:27:54        149504        ----a-w-        C:\Windows\System32\rdpcorekmts.dll

2012-03-14 21:27:53        77312        ----a-w-        C:\Windows\System32\rdpwsx.dll

2012-03-14 21:27:52        1544192        ----a-w-        C:\Windows\System32\DWrite.dll

2012-03-14 21:27:52        1077248        ----a-w-        C:\Windows\SysWow64\DWrite.dll

2012-03-14 21:27:36        826880        ----a-w-        C:\Windows\SysWow64\rdpcore.dll

2012-03-14 21:27:36        23552        ----a-w-        C:\Windows\System32\drivers\tdtcp.sys

2012-03-14 21:27:36        210944        ----a-w-        C:\Windows\System32\drivers\rdpwd.sys

2012-03-14 21:27:36        1112064        ----a-w-        C:\Windows\System32\rdpcorets.dll

2012-03-14 21:27:36        1031680        ----a-w-        C:\Windows\System32\rdpcore.dll

2012-02-29 17:44:35        162664        ----a-w-        C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10140.bin

2012-02-29 17:23:22        --------        d-----r-        C:\Users\Stefan\Dropbox

2012-02-29 17:18:38        --------        d-----w-        C:\Users\Stefan\AppData\Roaming\Dropbox

.

==================== Find3M  ====================

.

2012-02-24 20:57:56        414368        ----a-w-        C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-02-08 21:53:06        79360        ----a-w-        C:\Windows\SysWow64\ff_vfw.dll

2012-01-31 12:44:20        279656        ------w-        C:\Windows\System32\MpSigStub.exe

2012-01-04 10:44:20        509952        ----a-w-        C:\Windows\System32\ntshrui.dll

2012-01-04 08:58:41        442880        ----a-w-        C:\Windows\SysWow64\ntshrui.dll

2011-12-30 06:26:08        515584        ----a-w-        C:\Windows\System32\timedate.cpl

2011-12-30 05:27:56        478720        ----a-w-        C:\Windows\SysWow64\timedate.cpl

2011-12-28 03:59:24        498688        ----a-w-        C:\Windows\System32\drivers\afd.sys

2011-12-20 09:27:10        17192        ----a-w-        C:\Windows\System32\nitrolocalui2.dll

2011-12-20 09:27:08        28968        ----a-w-        C:\Windows\System32\nitrolocalmon2.dll

.

============= FINISH: 19:47:33,73 ===============