Trojaner-Board - Was ist von der mysteriösen IP in meiner Registry zu halten?

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Was ist von der mysteriösen IP in meiner Registry zu halten? (https://www.trojaner-board.de/18517-mysterioesen-ip-meiner-registry-halten.html)

Was ist von der mysteriösen IP in meiner Registry zu halten?

Hallo allerseits!
Was mich etwas irritiert: Hijackthis findet diese IP Adresse auf meiner HKLM 212.114.152.1 212.114.153.1. Was hat es denn damit auf sich? Kann mir mal wieder jemand helfen (ich glaube, ich bin hier bald schon Dauergast/-frager)? Wäre super! Anbei poste ich auch mal mein Log-File. Übrigens: Norton Antivir findet nix (bezüglich dieser mysteriösen IP) und auch meine Norton Firewall (die streng eingestellt ist) meldet keinen auffälligen, nicht gewollten Traffic.

Logfile of HijackThis v1.99.1
Scan saved at 15:16:20, on 02.06.2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

Running processes:
C:\WINNT\Explorer.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Programme\WinPoET Broadband Connection\winpppoverethernet.exe
C:\Programme\Norton Personal Firewall\IAMAPP.EXE
C:\WINNT\System32\RUNDLL32.EXE
C:\WINNT\System32\internat.exe
C:\Programme\WinZip\WZQKPICK.EXE
C:\Programme\Norton Personal Firewall\ATRACK.EXE
C:\Programme\eDonkey2000\edonkey2000.exe
C:\Programme\Mozilla1.7.7\mozilla.exe
C:\Dokumente und Einstellungen\Adrian\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Programme\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programme\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [a-winpoet-service] "C:\Programme\WinPoET Broadband Connection\winpppoverethernet.exe"
O4 - HKLM\..\Run: [iamapp] C:\Programme\Norton Personal Firewall\IAMAPP.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programme\WinZip\WZQKPICK.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{C4FF74FD-036C-47A2-817E-F96725F536C0}: NameServer = 212.114.152.1 212.114.153.1
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programme\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Personal Firewall Service (NISSERV) - Symantec Corporation - C:\Programme\Norton Personal Firewall\NISSERV.EXE
O23 - Service: Norton Personal Firewall Accounts Manager (NISUM) - Symantec Corporation - C:\Programme\Norton Personal Firewall\NISUM.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Norton Personal Firewall Proxy Service (SymProxySvc) - Symantec Corporation - C:\Programme\Norton Personal Firewall\SymProxySvc.exe
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - C:\Programme\WinPoET Broadband Connection\WrOS.EXE

Nochmal: Vielen Dank für Eure Hilfe!!! :daumenhoc

Hallo,

1.)

Code:

Suchbegriff: 212.114.152.1

Adresse: whois.ripe.net
 

Suchergebnis:
 

% This is the RIPE Whois query server #2.

% The objects are in RPSL format.

%

% Note: the default output of the RIPE Whois server

% is changed. Your tools may need to be adjusted. See

% http://www.ripe.net/db/news/abuse-proposal-20050331.html

% for more details.

%

% Rights restricted by copyright.

% See http://www.ripe.net/db/copyright.html
 

% Note: This output has been filtered.

%       To receive output for a database update, use the "-B" flag
 

% Information related to '212.114.144.0 - 212.114.158.255'
 

inetnum:      212.114.144.0 - 212.114.158.255

netname:      NEFKOM

descr:        NEFkom Telekommunikation GmbH & Co. KG

descr:        Spittlertorgraben 13

descr:        D-90429 Nuernberg

descr:        Germany

country:      DE

admin-c:      NEF4-RIPE

tech-c:       NEF4-RIPE

rev-srv:      ns.primary-dns.de

rev-srv:      ns.secondary-dns.de

status:       ASSIGNED PA

mnt-by:       NEFKOM-MNT

source:       RIPE # Filtered
 

role:         NEFkom Registry

address:      M"net Telekommunikations GmbH

address:      Spittlertorgraben 13

address:      D-90429 Nuernberg

address:      Germany

phone:        +49 911 180800

fax-no:       +49 911 1808409

e-mail:       registry@nefkom.de

admin-c:      MH1001-RIPE

tech-c:       MH1001-RIPE

tech-c:       JT3074-RIPE

tech-c:       LC4380-RIPE

tech-c:       FH7594-RIPE

nic-hdl:      NEF4-RIPE

remarks:      LIR Role Account

remarks:      *************************************************************

remarks:      * ABUSE CONTACT: abuse@nefkom.de                            *

remarks:      * DO NOT USE registry@nefkom.de in case of ILLEGAL ACTIVITY *

remarks:      * SPAM, ect.                                                *

remarks:      * Abuse Reports sent to the registry account will be ignored*

remarks:      *************************************************************

mnt-by:       NEFKOM-MNT

source:       RIPE # Filtered
 

% Information related to '212.114.128.0/17AS9072'
 

route:        212.114.128.0/17

descr:        NEFkom

descr:        M"net Telekommunikations GmbH

descr:        Subsidiary Nuernberg

descr:        Spittlertorgraben 13

descr:        D-90429 Nuernberg

origin:       AS9072

mnt-by:       NEFKOM-MNT

source:       RIPE # Filtered

2.)

Code:

Suchbegriff: 212.114.153.1

Adresse: whois.ripe.net
 

Suchergebnis:
 

% This is the RIPE Whois query server #2.

% The objects are in RPSL format.

%

% Note: the default output of the RIPE Whois server

% is changed. Your tools may need to be adjusted. See

% http://www.ripe.net/db/news/abuse-proposal-20050331.html

% for more details.

%

% Rights restricted by copyright.

% See http://www.ripe.net/db/copyright.html
 

% Note: This output has been filtered.

%       To receive output for a database update, use the "-B" flag
 

% Information related to '212.114.144.0 - 212.114.158.255'
 

inetnum:      212.114.144.0 - 212.114.158.255

netname:      NEFKOM

descr:        NEFkom Telekommunikation GmbH & Co. KG

descr:        Spittlertorgraben 13

descr:        D-90429 Nuernberg

descr:        Germany

country:      DE

admin-c:      NEF4-RIPE

tech-c:       NEF4-RIPE

rev-srv:      ns.primary-dns.de

rev-srv:      ns.secondary-dns.de

status:       ASSIGNED PA

mnt-by:       NEFKOM-MNT

source:       RIPE # Filtered
 

role:         NEFkom Registry

address:      M"net Telekommunikations GmbH

address:      Spittlertorgraben 13

address:      D-90429 Nuernberg

address:      Germany

phone:        +49 911 180800

fax-no:       +49 911 1808409

e-mail:       registry@nefkom.de

admin-c:      MH1001-RIPE

tech-c:       MH1001-RIPE

tech-c:       JT3074-RIPE

tech-c:       LC4380-RIPE

tech-c:       FH7594-RIPE

nic-hdl:      NEF4-RIPE

remarks:      LIR Role Account

remarks:      *************************************************************

remarks:      * ABUSE CONTACT: abuse@nefkom.de                            *

remarks:      * DO NOT USE registry@nefkom.de in case of ILLEGAL ACTIVITY *

remarks:      * SPAM, ect.                                                *

remarks:      * Abuse Reports sent to the registry account will be ignored*

remarks:      *************************************************************

mnt-by:       NEFKOM-MNT

source:       RIPE # Filtered
 

% Information related to '212.114.128.0/17AS9072'
 

route:        212.114.128.0/17

descr:        NEFkom

descr:        M"net Telekommunikations GmbH

descr:        Subsidiary Nuernberg

descr:        Spittlertorgraben 13

descr:        D-90429 Nuernberg

origin:       AS9072

mnt-by:       NEFKOM-MNT

source:       RIPE # Filtered

=> Du bist wohl NEFkom-Kunde ;)

3.)

Zitat:

Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

Dein System ist nicht auf dem aktuellen Stand! -> Unbedingt updaten!

Zitat:

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=

Das kannst du fixen und C:\WINNT\web\related.htm manuell löschen.

Super! Und vielen Dank für die prompte Antwort - vor allem, weil sie doch recht beruhigend ist. Wäre auch krass, wenn mein Rechner schon wieder verseucht wäre, hab´ ihn nämlich erst gestern abend neu installiert. Werde Deine Ratschläge schnellstens befolgen. Und übrigens: Falls es bei Dir auch Nefkom gibt, die Flatrate ist echt zu empfehlen. :party: Also, nochmal danke