Mögliche Infektion / Viele Verbindungen
Hallo, wie der Titel schon andeutet, bin ich mir unsicher was mein PC so macht oder genauer gesagt, warum so viele Verbindungen aufgebaut werden.
Es geht um diese Verbindungen: (IP/Name editiert) Code:
svchost.exe:1080 TCP PC-Name:epmap g227210207.adsl.alicedsl.de:32765 ESTABLISHED
bzw. Code:
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.30.165:1229 ESTABLISHED
Mit der Zeit werden es immer mehr (verschiedene IPs).
Ich bin bei Alice und wähle mich über ein Modem (kein Router!) ein. Ich benutze Firefox, habe SpybotSD, AntiVir, (WinDefender) und Zonealarm installiert und AntiVir prüft täglich den System32 Ordner. Bei ShieldsUP wird der Port 135 als offen angezeigt (alle anderen zu) und bei Heise.de-Portscan als "gefiltert". Mehr kann ich erstmal nicht sagen. Ich hoffe ihr könnt mir sagen, was diese Einträge bedeuten, was ich machen kann (und vllt auch wie man dann den Port 135 dicht machen kann, denn "NetBIOS über TCP/IP deaktivieren" ist schon ausgewählt und DCOM ist auch schon ausgestellt.[ntsvcfg])
Danke im Voraus :-)
Dazu stelle ich mal die ganzen Logs rein:
Zuerst mal HiJackThis- das ist ja hier immer so üblich :-): Code:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:19:06, on 01.06.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\FreePDF_XP\fpassist.exe
C:\Windows\sttray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\DSL-Manager\DslMgr.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\TcpView\Tcpview.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\HiJackThis\HiJackThis202.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - .DEFAULT User Startup: DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe (User 'Default user')
O4 - Startup: CCC.lnk = ?
O4 - Startup: DSL-Manager.lnk = C:\Program Files\DSL-Manager\DslMgr.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: QuickSet.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FFC1DEB4-BE8F-495C-81DB-8E1C76F029FD}: NameServer = 213.191.74.11 213.191.92.82
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: DSL-Manager (TDslMgrService) - T-Systems Enterprise Services GmbH - C:\Program Files\DSL-Manager\DslMgrSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
O23 - Service: WOEKPYKYWFR - Sysinternals - www.sysinternals.com - C:\Users\*******\AppData\Local\Temp\WOEKPYKYWFR.exe
--
End of file - 6153 bytes
TCP View: Nach der Einwahl ins Internet: Code:
lsass.exe:748 TCP 0.0.0.0:49155 0.0.0.0:0 LISTENING
svchost.exe:1080 TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
svchost.exe:1232 TCP 0.0.0.0:49153 0.0.0.0:0 LISTENING
svchost.exe:1332 TCP 0.0.0.0:49154 0.0.0.0:0 LISTENING
System:4 TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
wininit.exe:692 TCP 0.0.0.0:49152 0.0.0.0:0 LISTENING
svchost.exe:3652 TCP 0.0.0.0:49156 0.0.0.0:0 LISTENING
System:4 TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING
StarWindService.exe:3852 TCP 0.0.0.0:3260 0.0.0.0:0 LISTENING
StarWindService.exe:3852 TCP 0.0.0.0:3261 0.0.0.0:0 LISTENING
services.exe:736 TCP 0.0.0.0:49157 0.0.0.0:0 LISTENING
DslMgr.exe:2744 TCP IPx.xxx.xxx.xxx:49161 212.185.44.62:80 ESTABLISHED
sidebar.exe:2616 UDP 127.0.0.1:49152 *:*
svchost.exe:1684 UDP 0.0.0.0:5355 *:*
svchost.exe:1332 UDP 0.0.0.0:500 *:*
svchost.exe:1332 UDP 0.0.0.0:4500 *:*
svchost.exe:1520 UDP 0.0.0.0:123 *:*
svchost.exe:1520 UDP 127.0.0.1:1900 *:*
svchost.exe:1520 UDP 169.254.163.85:1900 *:*
svchost.exe:1520 UDP 0.0.0.0:3702 *:*
svchost.exe:1520 UDP 0.0.0.0:49153 *:*
svchost.exe:1520 UDP 0.0.0.0:3702 *:*
svchost.exe:1520 UDP IPx.xxx.xxx.xxx:1900 *:*
svchost.exe:1520 UDP IPx.xxx.xxx.xxx:51993 *:*
svchost.exe:1520 UDP 169.254.163.85:51994 *:*
svchost.exe:1520 UDP 127.0.0.1:51995 *:*
svchost.exe:1684 UDP 0.0.0.0:55873 *:*
svchost.exe:1332 UDPV6 [0:0:0:0:0:0:0:0]:500 *:*
svchost.exe:1520 UDPV6 [0:0:0:0:0:0:0:0]:123 *:*
svchost.exe:1520 UDPV6 [0:0:0:0:0:0:0:1]:1900 *:*
svchost.exe:1520 UDPV6 [0:0:0:0:0:0:0:0]:3702 *:*
svchost.exe:1520 UDPV6 [0:0:0:0:0:0:0:0]:49154 *:*
svchost.exe:1520 UDPV6 [0:0:0:0:0:0:0:0]:3702 *:*
svchost.exe:1520 UDPV6 [0:0:0:0:0:0:0:1]:51992 *:*
TCP View: Nach einiger Zeit...: Code:
svchost.exe:1080 TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
StarWindService.exe:3852 TCP 0.0.0.0:3260 0.0.0.0:0 LISTENING
StarWindService.exe:3852 TCP 0.0.0.0:3261 0.0.0.0:0 LISTENING
wininit.exe:692 TCP 0.0.0.0:49152 0.0.0.0:0 LISTENING
svchost.exe:1232 TCP 0.0.0.0:49153 0.0.0.0:0 LISTENING
svchost.exe:1332 TCP 0.0.0.0:49154 0.0.0.0:0 LISTENING
lsass.exe:748 TCP 0.0.0.0:49155 0.0.0.0:0 LISTENING
svchost.exe:3652 TCP 0.0.0.0:49156 0.0.0.0:0 LISTENING
services.exe:736 TCP 0.0.0.0:49157 0.0.0.0:0 LISTENING
System:4 TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
System:4 TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.30.165:1229 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.20.42:1443 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.68.159:1447 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.20.42:1520 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.30.165:2195 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.84.134:2667 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.84.134:2737 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.84.134:2948 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.84.134:3015 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.30.165:3121 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.30.165:3813 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.198.30:3920 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.198.30:4000 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.210.98:12090 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.210.98:12805 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.27.183:31721 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.27.183:31930 ESTABLISHED
svchost.exe:1080 TCP IP.xxx.xxx.xxx:135 92.227.210.207:32765 ESTABLISHED
firefox.exe:3032 TCP 127.0.0.1:49261 127.0.0.1:49262 ESTABLISHED
firefox.exe:3032 TCP 127.0.0.1:49262 127.0.0.1:49261 ESTABLISHED
firefox.exe:3032 TCP 127.0.0.1:49263 127.0.0.1:49264 ESTABLISHED
firefox.exe:3032 TCP 127.0.0.1:49264 127.0.0.1:49263 ESTABLISHED
pidgin.exe:5540 TCP IP.xxx.xxx.xxx:49362 205.188.8.133:5190 ESTABLISHED
pidgin.exe:5540 TCP IP.xxx.xxx.xxx:49363 64.12.201.40:5190 ESTABLISHED
pidgin.exe:5540 TCP IP.xxx.xxx.xxx:49365 137.226.33.82:5222 ESTABLISHED
svchost.exe:1520 UDP 0.0.0.0:123 *:*
svchost.exe:1332 UDP 0.0.0.0:500 *:*
svchost.exe:1520 UDP IP.xxx.xxx.xxx:1900 *:*
svchost.exe:1520 UDP 127.0.0.1:1900 *:*
svchost.exe:1520 UDP 169.254.163.85:1900 *:*
svchost.exe:1520 UDP 0.0.0.0:3702 *:*
svchost.exe:1520 UDP 0.0.0.0:3702 *:*
svchost.exe:1332 UDP 0.0.0.0:4500 *:*
svchost.exe:1684 UDP 0.0.0.0:5355 *:*
sidebar.exe:2616 UDP 127.0.0.1:49152 *:*
svchost.exe:1520 UDP 0.0.0.0:49153 *:*
svchost.exe:1520 UDP IP.xxx.xxx.xxx:51993 *:*
svchost.exe:1520 UDP 169.254.163.85:51994 *:*
svchost.exe:1520 UDP 127.0.0.1:51995 *:*
pidgin.exe:5540 UDP 127.0.0.1:53304 *:*
pidgin.exe:5540 UDP 127.0.0.1:53305 *:*
pidgin.exe:5540 UDP 127.0.0.1:55374 *:*
pidgin.exe:5540 UDP 127.0.0.1:55375 *:*
pidgin.exe:5540 UDP 127.0.0.1:55392 *:*
pidgin.exe:5540 UDP 127.0.0.1:55393 *:*
pidgin.exe:5540 UDP 127.0.0.1:65385 *:*
pidgin.exe:5540 UDP 127.0.0.1:65386 *:*
pidgin.exe:5540 UDP 127.0.0.1:65439 *:*
pidgin.exe:5540 UDP 127.0.0.1:65440 *:*
svchost.exe:1520 UDPV6 [0:0:0:0:0:0:0:0]:123 *:*
svchost.exe:1332 UDPV6 [0:0:0:0:0:0:0:0]:500 *:*
svchost.exe:1520 UDPV6 [0:0:0:0:0:0:0:1]:1900 *:*
svchost.exe:1520 UDPV6 [0:0:0:0:0:0:0:0]:3702 *:*
svchost.exe:1520 UDPV6 [0:0:0:0:0:0:0:0]:3702 *:*
svchost.exe:1520 UDPV6 [0:0:0:0:0:0:0:0]:49154 *:*
svchost.exe:1520 UDPV6 [0:0:0:0:0:0:0:1]:51992 *:*
| 