Rechner im LAN sind immer mal wieder ausgelastet

#1 Hallo Mitglieder,

bin neu hier, seid nachsichtig. Habe immer wieder ausgelastete Desktop's. Wenn gewartet wird, fangen sich die Anwendungen meistens wieder. Schaden ensteht meist durch User-Abbrüche. DNS-Konfiguration über Forwarder zum Router funktioniert eigentlich. Keinerlei Einträge bei Servern und Netzwerk-Virus-,-malwarescanner (eTrust). Explorer-Exe oft mit 99%CPU-Last, bei Anwendungs-Bremsern keinerlei Anzeige von Auslastung, keine Rückmeldung im Taskmanager, aber wie gesagt, kommen meist wieder. Nutze erstmalig HijackThis in der Hoffnung auf weitere Hinweise. Möglicherweise liegt's ja an irgendeinem Schädling. Hier der Log von meinem Rechner, und schon mal Vielen Dank für die Mühen.

wotan2

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:12:54, on 05.12.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\CA\SharedComponents\BrightStor\CADS\casdscsvc.exe
C:\Programme\CA\SharedComponents\BrightStor\UniAgent\UnivAgent.exe
C:\WINDOWS\system32\crypserv.exe
C:\Programme\Canon\IJPLM\IJPLMSVC.EXE
C:\Programme\CA\eTrust Antivirus\InoRpc.exe
C:\Programme\CA\eTrust Antivirus\InoRT.exe
C:\Programme\CA\eTrust Antivirus\InoTask.exe
C:\Programme\KEN!\KENCLI.EXE
C:\WINDOWS\System32\rcapi.exe
C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\Programme\LANCOM\Advanced_VPN_Client\ncprwsnt.exe
C:\Programme\LANCOM\Advanced_VPN_Client\ncpsec.exe
C:\WINDOWS\system32\ppRemoteService.exe
C:\Programme\LANCOM\Advanced_VPN_Client\rwsrsu.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Java\jre1.6.0_07\bin\jusched.exe
C:\Programme\CRW\shwicon.exe
C:\Programme\Aspire Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\KEN!\kentbcli.exe
C:\Programme\LANCOM\Advanced_VPN_Client\ncpbudgt.exe
C:\Programme\Maxtor\Maxtor Quick Start\msssort.exe
C:\WINDOWS\TPPALDR.EXE
C:\Programme\HP\hpcoretech\hpcmpmgr.exe
C:\Programme\CA\eTrust PestPatrol Corporate Edition\PPMCActiveDetection.exe
C:\WINDOWS\system32\ctfmon.exe
L:\GEObüro SQL\GEObüro.exe
\Nt2server\h$\admin\SERVICEP\admin\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://lika.geobasis-bb.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.arcor.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.arcor.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.arcor.de
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.12:3128/ken.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Arcor AG & Co. KG
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=192.168.1.12:3128;http=192.168.1.12:3128;https=192.168.1.12:3128;socks=192.168.1.12:1080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local>
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Programme\Free Download Manager\iefdmcks.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\CPLFL32.EXE
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ShowIcon_Chander_CRW Series Driver v1.17r019] C:\Programme\CRW\shwicon.exe -t"Chander\CRW Series Driver v1.17r019"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [PCMService] "C:\Programme\Aspire Arcade\PCMService.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KEN Taskbar Client] "C:\Programme\KEN!\kentbcli.exe"
O4 - HKLM\..\Run: [NcpBudget] "C:\Programme\LANCOM\Advanced_VPN_Client\ncpbudgt.exe"
O4 - HKLM\..\Run: [NcpPopup] "C:\Programme\LANCOM\Advanced_VPN_Client\ncppopup.exe" noerrmsg
O4 - HKLM\..\Run: [SfWinStartInfo] l:\SFIRM32\sfWinStartupInfo.exe
O4 - HKLM\..\Run: [mssSort] C:\Programme\Maxtor\Maxtor Quick Start\msssort.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\TPPALDR.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programme\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [CA Total Protection Control Center] "C:\Programme\CA\Protection Suite\Client\TPCC.exe" -tray
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~2\realmon.exe -s
O4 - HKLM\..\Run: [Protection Suite Anti-Spyware Realtime] C:\Programme\CA\eTrust PestPatrol Corporate Edition\\PPMCActiveDetection.exe -logpath:"C:\Programme\CA\eTrust PestPatrol Corporate Edition\\Pest.log"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Programme\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Programme\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Programme\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Programme\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Programme\Free Download Manager\dllink.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll (file missing)
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll (file missing)
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll (file missing)
O9 - Extra button: Print2PDF - {5B7027AD-AA6D-40df-8F56-9560F277D2A5} - C:\WINDOWS\System32\Print602.dll (file missing)
O9 - Extra 'Tools' menuitem: Print2PDF - {5B7027AD-AA6D-40df-8F56-9560F277D2A5} - C:\WINDOWS\System32\Print602.dll (file missing)
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Print2Mail - {A156A7A7-14A2-4282-B487-8E25AB68D608} - C:\WINDOWS\System32\Print602.dll (file missing)
O9 - Extra 'Tools' menuitem: Print2Mail - {A156A7A7-14A2-4282-B487-8E25AB68D608} - C:\WINDOWS\System32\Print602.dll (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Print2Picture - {F242786D-E1AE-49e7-BD01-E1ABCA405241} - C:\WINDOWS\System32\Print602.dll (file missing)
O9 - Extra 'Tools' menuitem: Print2Picture - {F242786D-E1AE-49e7-BD01-E1ABCA405241} - C:\WINDOWS\System32\Print602.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://192.168.1.12:3128/ken.html
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1114783553403
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = oebvi-nedess-vermessung.intern
O17 - HKLM\Software\..\Telephony: DomainName = oebvi-nedess-vermessung.intern
O17 - HKLM\System\CCS\Services\Tcpip\..\{AFE84B2D-DCFE-434F-8DB8-CFFC29DBF116}: NameServer = 192.168.1.1,192.168.1.12
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = oebvi-nedess-vermessung.intern
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = oebvi-nedess-vermessung.intern
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = oebvi-nedess-vermessung.intern
O23 - Service: CA BrightStor Discovery Service (CASDiscoverySvc) - Computer Associates - C:\Programme\CA\SharedComponents\BrightStor\CADS\casdscsvc.exe
O23 - Service: CA BrightStor Universal Agent (CASUniversalAgent) - Computer Associates - C:\Programme\CA\SharedComponents\BrightStor\UniAgent\UnivAgent.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates International Inc. - C:\Programme\CA\SharedComponents\CA_LIC\\lic98rmt.exe
O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Programme\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Programme\CA\eTrust Antivirus\InoTask.exe
O23 - Service: AVM KEN Klient (KEN Client Service) - AVM Berlin - C:\Programme\KEN!\KENCLI.EXE
O23 - Service: LANCAPI Control (LcsCapiCtl) - LANCOM Systems GmbH, Würselen (Germany) - C:\WINDOWS\System32\rcapi.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: ncprwsnt - Unknown owner - C:\Programme\LANCOM\Advanced_VPN_Client\ncprwsnt.exe
O23 - Service: NcpSec - Unknown owner - C:\Programme\LANCOM\Advanced_VPN_Client\ncpsec.exe
O23 - Service: PestPatrol Remote - Computer Associates International, Inc. - C:\WINDOWS\system32\ppRemoteService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programme\WinPcap\rpcapd.exe
O23 - Service: RwsRsu (rwsrsu) - Unknown owner - C:\Programme\LANCOM\Advanced_VPN_Client\rwsrsu.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Programme\Gemeinsame Dateien\SolidWorks Shared\Service\SolidWorksLicensing.exe

--
End of file - 12097 bytes

#2 hallo, einige viren können sich über netzwerk verbreiten, daher währe es wohl besser die rechner vom netzwerk zu trennen.
http://board.protecus.de/t23187.htm
abarbeiten und logs posten

#3 Danke,
die Logs sind im Anhang. Wiederherstellungskonsole konnte durch Combofix nicht installiert werden, wahrscheinlich wegen dem Proxy. Hilft hier später von XP-CD noch?