Hi,

habe folgendes auf bisher allen WinXP Rechnern beobachtet.

Es gibt einen Prozeß, der stets folgende Bedingungen erfüllt:

-- er hat immer 6 Zeichen und endet auf .EXE
-- der Name besteht immer aus einer Kombination von 2-4 Großbuchstaben und Ziffern
-- die Großbuchstaben und Zahlen sind wild gewürfelt; der Name beginnt immer mit einem Buchstaben
-- er gehört immer dem User "SYSTEM"
-- seine Größe schwankt um 2.500 KB
-- es gibt auf den Rechnern keine .exe mit diesem Namen
-- eine Suche bei Google nach dem Namen bringt keine Ergebnisse
-- eine Suche in der Ereignisanzeige bringt kein Ergebnis
-- der Prozeß hat in der tasklist /svc keinen Dienst
-- wird der Prozeß gekillt, erscheint er nach ca. 30-60 Minuten erneut in der Taskliste (!), aber mit einem neuen Namen (nach den o.g. Kriterien); allerdings nur
-- wenn der Rechner an einem Netzwerk hängt
-- tritt auf XP Prof. und XP Home gleichermaßen auf
-- spybot meldet keine Auffälligkeiten
-- Trend Micro Virenscanner meldet keine Auffälligkeiten

+ Wer weiß was das ist?
+ Hat sonst noch jemand das auf seinem Rechner beobachtet?

Gruß

Was hältst du davon wenn du ein HijackThis Logfile postest bzw im Zweifelsfall diese Dateien mal bei Virustotal.com gegenchecken zu lassen.

mach ich gerne.
sobald der Prozeß wieder auftaucht. Habe ihn gerade gekillt.
Hijackthis brachte über den Rest der noch da ist kein negatives Ergebnis.
Was sonst auf dem Rechner läuft scheint ok.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:55:48, on 29.09.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\Programme\OfficeScan NT\ntrtscan.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\OfficeScan NT\tmlisten.exe
C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Programme\OfficeScan NT\OfcPfwSvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
C:\WINDOWS\system32\PRISMSTA.EXE
C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe
C:\WINDOWS\Twain_32\SlimU2\HotKey.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\DitExp.exe
C:\Programme\OfficeScan NT\pccntmon.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\cidaemon.exe
D:\3Peter\Passwort Tresor\Tresor.exe
C:\Programme\Outlook Express\msimn.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\TEMP\IN1321.EXE
C:\Programme\OfficeScan NT\pccnt.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.medion.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.arcor.de
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/advanced_search?hl=de&num=100
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.de.netscape.com/de/home/winsearch200.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:4001
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 192.168.*;<local>
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programme\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START
O4 - HKLM\..\Run: [PCMService] "C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [HotKey] C:\WINDOWS\Twain_32\SlimU2\HotKey.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Programme\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [FinePrint Dispatcher v5] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" /source=HKLM
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Programme\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Programme\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Kontrollfeld für die kabellose Tastatur.lnk.disabled
O8 - Extra context menu item: Easy-WebPrint - Drucken - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint - Schnelldruck - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint - Vorschau - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint - Zu Druckliste hinzufügen - res://C:\Programme\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: In GMX NetPhone wählen - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GMX\GMX NetPhone\ContextMenuHandler.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Zur Filterliste hinzufügen (WebWasher) - http://-Web.Washer-/ie_add
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {7527E129-A524-434A-A337-8C19F6F25C91} (AldiSuedActiveFormX Element) - https://shop.aldisued-fotos-druck.de/shop/activex/aldi_sued_express_upload.cab
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {ABC1D8DE-CAB5-4FB7-BCD0-137BAB9F09DC} (aldisued-fotos-druck_de_bilduebertragung) - http://www.aldisued-fotos-druck.de/upload/aldi_sued_bilduebertragung.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{536427B1-D901-426A-A2C9-D31127DC8609}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir Update (AVWUpSrv) - Unknown owner - C:\Programme\AVPersonal\AVWUPSRV.EXE (file missing)
O23 - Service: CA-Lizenz-Client (CA_LIC_CLNT) - Computer Associates International Inc. - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA-Lizenzserver (CA_LIC_SRVR) - Computer Associates International Inc. - C:\Programme\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Programme\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Programme\OfficeScan NT\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Programme\OfficeScan NT\OfcPfwSvc.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Programme\OfficeScan NT\tmlisten.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 10740 bytes

C:\WINDOWS\TEMP\IN1321.EXE

Lass diese Datei mal bei Virustotal.com checken.

Hier das Ergebnis von virustotal und threatexpert:
Da werde ich aber nicht schlau draus. Was sagt mir das?

Die Datei wurde bereits analysiert:

MD5: 3d4a3262f183d37dcc975d933dd732fe
First received: 2006.05.25 14:06:41 UTC
Datum 2009.09.16 10:24:03 UTC [>13D]
Ergebnisse 1/41
Permalink: analisis/a3ef116edcfefdb5fbc22f2eda07a3b93c173d0250daf1000965cf6a55d8bdee-1253096643

Datei EL291F.EXE empfangen 2009.09.16 10:24:03 (UTC)
Status: Beendet
Ergebnis: 1/41 (2.44%)


Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.5.0.24 2009.09.16 -
AhnLab-V3 5.0.0.2 2009.09.16 -
AntiVir 7.9.1.18 2009.09.16 -
Antiy-AVL 2.0.3.7 2009.09.16 -
Authentium 5.1.2.4 2009.09.16 -
Avast 4.8.1351.0 2009.09.15 -
AVG 8.5.0.412 2009.09.16 -
BitDefender 7.2 2009.09.16 -
CAT-QuickHeal 10.00 2009.09.16 -
ClamAV 0.94.1 2009.09.16 -
Comodo 2335 2009.09.16 -
DrWeb 5.0.0.12182 2009.09.16 -
eSafe 7.0.17.0 2009.09.15 -
eTrust-Vet 31.6.6740 2009.09.16 -
F-Prot 4.5.1.85 2009.09.15 -
F-Secure 8.0.14470.0 2009.09.16 -
Fortinet 3.120.0.0 2009.09.16 -
GData 19 2009.09.16 -
Ikarus T3.1.1.72.0 2009.09.16 -
Jiangmin 11.0.800 2009.09.16 -
K7AntiVirus 7.10.845 2009.09.15 -
Kaspersky 7.0.0.125 2009.09.16 -
McAfee 5742 2009.09.15 -
McAfee+Artemis 5742 2009.09.15 -
McAfee-GW-Edition 6.8.5 2009.09.16 Heuristic.BehavesLike.Win32.Rootkit.H
Microsoft 1.5005 2009.09.16 -
NOD32 4429 2009.09.16 -
Norman 6.01.09 2009.09.16 -
nProtect 2009.1.8.0 2009.09.16 -
Panda 10.0.2.2 2009.09.16 -
PCTools 4.4.2.0 2009.09.14 -
Prevx 3.0 2009.09.16 -
Rising 21.47.22.00 2009.09.16 -
Sophos 4.45.0 2009.09.16 -
Sunbelt 3.2.1858.2 2009.09.16 -
Symantec 1.4.4.12 2009.09.16 -
TheHacker 6.3.4.4.404 2009.09.15 -
TrendMicro 8.950.0.1094 2009.09.16 -
VBA32 3.12.10.10 2009.09.15 -
ViRobot 2009.9.16.1939 2009.09.16 -
VirusBuster 4.6.5.0 2009.09.15 -

weitere Informationen
File size: 172099 bytes
MD5 : 3d4a3262f183d37dcc975d933dd732fe
SHA1 : 3247311c21078002cf1a635d8d2b7bce7ee0a38e
SHA256: a3ef116edcfefdb5fbc22f2eda07a3b93c173d0250daf1000965cf6a55d8bdee
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xDEB2
timedatestamp.....: 0x43E855D9 (Tue Feb 7 09:10:01 2006)
machinetype.......: 0x14C (Intel I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1CF8A 0x1D000 6.63 1bf3020cc59b6359057b770603572919
.rdata 0x1E000 0x54C3 0x6000 4.61 82c5d5196e54ea98d2e6d0308f61cc4f
.data 0x24000 0x8CFC 0x5000 2.99 1dec71163e617005ee6deca1fe63c27b
.rsrc 0x2D000 0x508 0x1000 0.88 4100801f13f4cf5e263fef8a7634138d

( 7 imports )

> advapi32.dll: CreateServiceA, QueryServiceStatus, RegQueryValueExA, OpenSCManagerA, OpenServiceA, CloseServiceHandle, QueryServiceConfigA, RegDeleteValueA, RegSetValueExA, RegCreateKeyExA, RegOpenKeyExA, StartServiceA, RegCloseKey, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, DeleteService, RegNotifyChangeKeyValue
> comctl32.dll: -
> gdi32.dll: SetBkColor, SetTextColor, GetObjectA, CreateBitmap, DeleteObject, GetDeviceCaps, DeleteDC, SaveDC, RestoreDC, SelectObject, GetStockObject, SetMapMode, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, GetClipBox, PtVisible, RectVisible, ExtTextOutA, Escape, TextOutA
> kernel32.dll: GetCurrentProcess, WriteFile, SetFilePointer, GetOEMCP, GetFileAttributesA, FlushFileBuffers, RtlUnwind, CreateThread, ExitThread, GetTimeZoneInformation, GetSystemTime, GetLocalTime, GetStartupInfoA, GetCommandLineA, ExitProcess, HeapAlloc, HeapFree, RaiseException, HeapSize, HeapReAlloc, GetCPInfo, GetProcessVersion, GlobalFlags, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, IsBadWritePtr, GetStringTypeA, GetStringTypeW, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadCodePtr, SetStdHandle, CompareStringA, CompareStringW, SetEnvironmentVariableA, GetProcAddress, LoadLibraryA, GetCurrentProcessId, lstrcatA, lstrcpyA, WriteProcessMemory, ReadProcessMemory, CloseHandle, OpenProcess, GetExitCodeThread, WaitForSingleObject, GetModuleHandleA, CreateMutexA, GetLastError, GetSystemDirectoryA, TlsGetValue, ResumeThread, GlobalAlloc, LocalReAlloc, TlsSetValue, GlobalReAlloc, GlobalLock, GetACP, GlobalFree, ResetEvent, LeaveCriticalSection, GlobalHandle, GlobalUnlock, SetLastError, TlsAlloc, lstrcpynA, UnhandledExceptionFilter, FreeLibrary, SetEvent, GetCurrentThreadId, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, lstrcmpA, MultiByteToWideChar, WideCharToMultiByte, InterlockedDecrement, InterlockedIncrement, WaitForMultipleObjects, lstrlenA, LocalAlloc, LocalFree, GetModuleFileNameA, TerminateProcess, MoveFileExA, GetVersion, VirtualAlloc, DeleteFileA, GetTickCount, GetPrivateProfileIntA, CopyFileA, CreateProcessA, Sleep, GetVersionExA, GetComputerNameA, GetTempPathA, GetTempFileNameA, DeleteCriticalSection, CreateEventA, InitializeCriticalSection, GetCurrentDirectoryA, lstrcmpiA, OpenFile, FindFirstFileA, FindNextFileA, FindClose, EnterCriticalSection, _lclose, LCMapStringA, LCMapStringW, FreeEnvironmentStringsA
> user32.dll: LoadStringA, GetNextDlgTabItem, EnableMenuItem, CheckMenuItem, MapWindowPoints, SetMenuItemBitmaps, ModifyMenuA, GetMenuState, LoadBitmapA, GetMenuCheckMarkDimensions, SetWindowTextA, IsWindowEnabled, GetClassNameA, PtInRect, ClientToScreen, GetSysColorBrush, ReleaseDC, GetDC, DestroyMenu, TabbedTextOutA, DrawTextA, GrayStringA, PeekMessageA, GetFocus, SetFocus, AdjustWindowRectEx, GetClientRect, CopyRect, GetSysColor, EnableWindow, GetTopWindow, MessageBoxA, GetParent, GetCapture, WinHelpA, GetClassInfoA, RegisterClassA, GetMenu, GetMenuItemCount, GetSubMenu, GetMenuItemID, GetDlgItem, GetWindowTextA, GetDlgCtrlID, GetKeyState, SetWindowsHookExA, CallNextHookEx, GetClassLongA, SetPropA, UnhookWindowsHookEx, RemovePropA, GetMessageTime, GetLastActivePopup, GetForegroundWindow, SetForegroundWindow, GetWindow, SetWindowPos, SystemParametersInfoA, IsIconic, GetWindowPlacement, GetWindowRect, GetSystemMetrics, SendMessageA, PostMessageA, FindWindowA, KillTimer, DestroyWindow, SetTimer, PostQuitMessage, DefWindowProcA, CreateWindowExA, ShowWindow, UpdateWindow, LoadIconA, LoadCursorA, RegisterClassExA, GetMessageA, DispatchMessageA, TranslateMessage, RegisterWindowMessageA, CallWindowProcA, GetPropA, GetWindowLongA, SetWindowLongA, GetMessagePos
> winspool.drv: OpenPrinterA, DocumentPropertiesA, ClosePrinter
> wsock32.dll: -, -, -

( 1 exports )

> __0TmProcessGuard@@QAE@KHH@Z, __0TmProcessGuard@@QAE@PBD0HH@Z, __0TmProcessGuard@@QAE@XZ, __0TmServiceGuard@@QAE@PBD00HH@Z, __0TmServiceGuard@@QAE@PBDKHH@Z, __0TmServiceGuard@@QAE@XZ, __1TmProcessGuard@@UAE@XZ, __1TmServiceGuard@@UAE@XZ, __4TmProcessGuard@@QAEXAAV0@@Z, __4TmServiceGuard@@QAEXAAV0@@Z, ___7TmProcessGuard@@6B@, ___7TmServiceGuard@@6B@, _BackupService@TmServiceGuard@@IAEXXZ, _CheckProcess@TmProcessGuard@@QAE_NAAVCStringArray@@@Z, _GetGuardInfo@TmProcessGuard@@QBEXAAKAAVCString@@1AAH2@Z, _IsIPChanged@@YA_NPBDPADH@Z, _IsMonitor@TmProcessGuard@@IBE_NXZ, _IsNTPlatform@@YA_NXZ, _IsProcessAlive@TmProcessGuard@@MAE_NXZ, _IsProcessAlive@TmServiceGuard@@MAE_NXZ, _IsRetryNow@TmProcessGuard@@IBE_NXZ, _IsTheSame@TmProcessGuard@@QBE_NABVCString@@0@Z, _IsTheSame@TmProcessGuard@@QBE_NK@Z, _IsTheSame@TmProcessGuard@@QBE_NPBV1@@Z, _IsValidProcess@TmProcessGuard@@QBE_NXZ, _QueryAllLog@TmProcessGuard@@QBEXAAVCStringArray@@@Z, _RegWatchDog_Ofc@@YA_NXZ, _RegWatchDog_Ofc_95@@YA_NXZ, _RegWatchDog_Ofc_NTRT@@YA_NXZ, _RegWatchDog_Ofc_OFCPFWSVC@@YA_NXZ, _RegWatchDog_Ofc_PCCNTMON@@YA_NXZ, _RegWatchDog_Ofc_TMLISTEN@@YA_NXZ, _ResetMonitor@TmProcessGuard@@IAEXXZ, _ResetRetryCount@TmProcessGuard@@QAEXXZ, _ResetRetryTick@TmProcessGuard@@QAEXXZ, _ResetRetryVar@TmProcessGuard@@QAEXXZ, _RetryWakeupProcess@TmProcessGuard@@MAE_NXZ, _RetryWakeupProcess@TmServiceGuard@@MAE_NXZ, _SetMonitor@TmProcessGuard@@IAEXXZ, _SetProcessID@TmProcessGuard@@QAEXK@Z, _SetRetryCountLimit@TmProcessGuard@@QAEXH@Z, _SetRetryTickLimit@TmProcessGuard@@QAEXH@Z, _StepMonitor@TmProcessGuard@@IAEXXZ, _StepRetry@TmProcessGuard@@IAEXXZ, _UnRegWatchDog_Ofc@@YA_NXZ, _UnRegWatchDog_Ofc_95@@YA_NXZ, _UnRegWatchDog_Ofc_NTRT@@YA_NXZ, _UnRegWatchDog_Ofc_OFCPFWSVC@@YA_NXZ, _UnRegWatchDog_Ofc_PCCNTMON@@YA_NXZ, _UnRegWatchDog_Ofc_TMLISTEN@@YA_NXZ, C_IsIPChanged, C_RegWatchDog_Ofc, C_RegWatchDog_Ofc_OFCPFWSVC, C_RegWatchDog_Ofc_PCCNTMON, C_RegWatchDog_Ofc_TMLISTEN, C_UnRegWatchDog_Ofc, C_UnRegWatchDog_Ofc_OFCPFWSVC, C_UnRegWatchDog_Ofc_PCCNTMON, C_UnRegWatchDog_Ofc_TMLISTEN
TrID : File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
ThreatExpert: http://www.threatexpert.com/report.aspx?md5=3d4a3262f183d37dcc975d933dd732fe
ssdeep: 3072:aiKS9TgqUYW+kXxmD7aMb2MEsFqRa7DaLjcUEoi90ye0bHJq:aiKWTgApaBsFDnatye0bHg
PEiD : Armadillo v1.71
CWSandbox: http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=3d4a3262f183d37dcc975d933dd732fe
RDS : NSRL Reference Data Set
-

Submission Summary:
Submission details:
Submission received: 22 July 2008, 05:06:59
Processing time: 4 min 10 sec
Submitted sample:
File MD5: 0x3D4A3262F183D37DCC975D933DD732FE
File SHA-1: 0x3247311C21078002CF1A635D8D2B7BCE7EE0A38E
Filesize: 172.099 bytes
Technical Details:

File System Modifications
The following file was created in the system:

# Filename(s) File Size File Hash
1 [file and pathname of the sample #1] 172.099 bytes MD5: 0x3D4A3262F183D37DCC975D933DD732FE
SHA-1: 0x3247311C21078002CF1A635D8D2B7BCE7EE0A38E

Memory Modifications
There was a new process created in the system:

Process Name Process Filename Main Module Size
[filename of the sample #1] [file and pathname of the sample #1] 188.416 bytes

Registry Modifications
The following Registry Keys were created:
HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro
HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfcWatchDog
The newly created Registry Value is:
[HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\OfcWatchDog]
OFCNT Service Name = "ntrtscan"
OFCNT Process Name = "ntrtscan.exe"
Dog Process Name = "ofcdog.exe"
Default Retry Count = 0x00000007
Default Retry Interval = 0x0000001E
Max Log = 0x00000100

Lies mal das Handbuch zu deinem Trendmicro Officescan.