Trojaner-Board - Exchange2003 verschickt SPAMs

Hallo Trojanergemeinde :)
Seit einiger Zeit verschickt der Exchangeserver (2003) in meiner Firma vereinzelt SPAM-Mails. Dadurch sind wir auf RBLs gelistet und können keinen geschäftlichen Mailverkehr mehr verschicken. Dementsprechend "glücklich" ist meine Geschäftsleitung mit mir. :aplaus:
Könnt ihr bitte mal mein HJT-Log vom Server anschauen, ob da irgendwas nicht passt.
Code:
Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:14:15, on 12.06.2008

Platform: Windows 2003 SP2 (WinNT 5.02.3790)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal
 

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\Programme\Symantec\Backup Exec\RAWS\beremote.exe

C:\Compaq\vcagent\vcagent.exe

C:\WINNT\system32\Dfssvc.exe

C:\WINNT\System32\svchost.exe

E:\Programme\Trend Micro\Smex\EUQ\EUQMonitor.exe

C:\WINNT\system32\inetsrv\inetinfo.exe

C:\WINNT\system32\ntfrs.exe

E:\Programme\Trend Micro\Smex\svcGenericHost.exe

E:\Programme\Trend Micro\Smex\svcGenericHost.exe

E:\Programme\Trend Micro\Smex\SMEX_Master.exe

E:\Programme\Trend Micro\Smex\SMEX_SystemWatcher.exe

C:\WINNT\System32\snmp.exe

C:\compaq\survey\Surveyor.EXE

C:\Programme\RealVNC\VNC4\WinVNC4.exe

C:\WINNT\system32\psxss.exe

C:\WINNT\System32\CPQNiMgt\cpqnimgt.exe

C:\WINNT\System32\CpqRcmc.exe

C:\WINNT\System32\CPQMgmt\CqMgServ\cqmgserv.exe

C:\WINNT\System32\CPQMgmt\CqMgStor\cqmgstor.exe

C:\Programme\Exchsrvr\bin\exmgmt.exe

C:\Programme\Exchsrvr\bin\mad.exe

C:\Programme\Gemeinsame Dateien\System\MSSearch\Bin\mssearch.exe

C:\WINNT\system32\sysdown.exe

C:\WINNT\System32\CPQMgmt\CqMgHost\cqmghost.exe

C:\WINNT\System32\CPQMgmt\cpqwmgmt.exe

C:\Programme\Exchsrvr\bin\store.exe

C:\Programme\Exchsrvr\bin\emsmta.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\Explorer.EXE

C:\WINNT\system32\cpqteam.exe

C:\Programme\Symantec\Backup Exec\RAWS\VxMon.exe

C:\WINNT\system32\ctfmon.exe

C:\WINNT\System32\svchost.exe

C:\WINNT\system32\sfmsvc.exe

C:\WINNT\system32\cisvc.exe

C:\WINNT\system32\cidaemon.exe

C:\WINNT\system32\cidaemon.exe

C:\WINNT\system32\cidaemon.exe

C:\WINNT\System32\svchost.exe

c:\winnt\system32\inetsrv\w3wp.exe

C:\WINNT\System32\mdm.exe

C:\WINNT\system32\mmc.exe

C:\WINNT\system32\wuauclt.exe

C:\WINNT\system32\mmc.exe

C:\WINNT\system32\cmd.exe

C:\WINNT\system32\mmc.exe

C:\WINNT\system32\wbem\unsecapp.exe

c:\winnt\system32\inetsrv\w3wp.exe

C:\HiJackThis.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardAdmin.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdoclc.dll/hardAdmin.htm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=10.0.60.11:3128;https=10.0.60.11:3128

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.meinedomaine.at;<local>

O4 - HKLM\..\Run: [CPQTEAM] cpqteam.exe

O4 - HKCU\..\Run: [VxBeMon] "C:\Programme\Symantec\Backup Exec\RAWS\VxMon.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINNT\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [internat.exe] internat.exe (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Programme\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [internat.exe] internat.exe (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Programme\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-21-1935655697-1844237615-725345543-2203\..\Run: [internat.exe] internat.exe (User 'SMEX_Administrator')

O4 - HKUS\S-1-5-21-1935655697-1844237615-725345543-2203\..\RunOnce: [^SetupICWDesktop] C:\Programme\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SMEX_Administrator')

O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Programme\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [internat.exe] internat.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Programme\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O15 - ESC Trusted Zone: http://*.exchange

O15 - ESC Trusted Zone: http://pagead2.googlesyndication.com

O15 - ESC Trusted Zone: http://runonce.msn.com

O15 - ESC Trusted Zone: http://www.petri.co.il

O15 - ESC Trusted Zone: http://www.au.sorbs.net

O15 - ESC Trusted Zone: http://*.windowsupdate.com

O15 - ESC Trusted Zone: http://*.windowsupdate.com (HKLM)

O15 - ESC Trusted IP range: http://10.0.60.89

O15 - ESC Trusted IP range: http://127.0.0.1

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1205683683437

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = meinedomaine.at

O17 - HKLM\Software\..\Telephony: DomainName = meinedomaine.at

O17 - HKLM\System\CCS\Services\Tcpip\..\{C44D8520-E6E3-41AC-BFAF-6DEDCD464563}: NameServer = 10.0.60.246

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = meinedomaine.at

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = meinedomaine.at

O18 - Protocol: hpapp - {24F45006-5BD9-41B7-9BD9-5F8921C8EBD1} - C:\Programme\Compaq\Cpqacuxe\Bin\hpapp.dll

O23 - Service: Backup Exec Remote Agent for Windows Systems (BackupExecAgentAccelerator) - Symantec Corporation - C:\Programme\Symantec\Backup Exec\RAWS\beremote.exe

O23 - Service: HP Insight NIC Agent (CpqNicMgmt) - Hewlett-Packard Company - C:\WINNT\System32\CPQNiMgt\cpqnimgt.exe

O23 - Service: Compaq Remote Monitor Service (CpqRcmc) - Compaq - C:\WINNT\System32\CpqRcmc.exe

O23 - Service: Version Control Agent (cpqvcagent) - Hewlett-Packard Company - C:\Compaq\vcagent\vcagent.exe

O23 - Service: HP Insight Web Agent (CpqWebMgmt) - HP Corporation - C:\WINNT\System32\CPQMgmt\cpqwmgmt.exe

O23 - Service: HP Insight Foundation Agent (CqMgHost) - Hewlett-Packard Company - C:\WINNT\System32\CPQMgmt\CqMgHost\cqmghost.exe

O23 - Service: HP Insight Server Agents (CqMgServ) - Hewlett-Packard Company - C:\WINNT\System32\CPQMgmt\CqMgServ\cqmgserv.exe

O23 - Service: HP Insight Storage Agents (CqMgStor) - Hewlett-Packard Company - C:\WINNT\System32\CPQMgmt\CqMgStor\cqmgstor.exe

O23 - Service: EUQ_Monitor - Trend Micro Inc. - E:\Programme\Trend Micro\Smex\EUQ\EUQMonitor.exe

O23 - Service: EUQ_Setup - Trend Micro Inc. - E:\Programme\Trend Micro\Smex\EUQ\setupInstExchangeRule.exe

O23 - Service: ScanMail for Microsoft Exchange Master Service (ScanMail_Master) - Trend Micro Inc. - E:\Programme\Trend Micro\Smex\svcGenericHost.exe

O23 - Service: ScanMail for Microsoft Exchange Remote Configuration Server (ScanMail_RemoteConfig) - Trend Micro Inc. - E:\Programme\Trend Micro\Smex\svcGenericHost.exe

O23 - Service: ScanMail for Microsoft Exchange System Watcher (ScanMail_SystemWatcher) - Trend Micro Inc. - E:\Programme\Trend Micro\Smex\svcGenericHost.exe

O23 - Service: Surveyor - Hewlett-Packard Development Group, L.P. - C:\compaq\survey\Surveyor.EXE

O23 - Service: HP ProLiant System Shutdown Service (sysdown) - Compaq Computer Corporation - C:\WINNT\system32\sysdown.exe

O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Programme\RealVNC\VNC4\WinVNC4.exe
 

--

End of file - 7873 bytes
Danke euch!

Grüße
HansSolo :)