TR/Silentbanker.J

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:40:42, on 23.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Programme\Gemeinsame Dateien\Ulead Systems\AutoDetector\monitor.exe
C:\WINDOWS\system32\WTMKM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Microsoft ActiveSync\wcescomm.exe
C:\Programme\TaskSwitchXP\TaskSwitchXP.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\ICQ6Toolbar\ICQ Service.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Microsoft Office\Office10\OUTLOOK.EXE
C:\Programme\Microsoft Office\Office10\WINWORD.EXE
C:\PROGRA~1\FREEDO~1\fdm.exe
C:\WINDOWS\system32\atwtusb.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 

h**p://www.t-online.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 

h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL 

= h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 

h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = 

Windows Internet Explorer bereitgestellt von T-Online
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} 

- C:\Programme\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: Adobe PDF Reader Link Helper - 

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 

7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CmjBrowserHelperObject Object - 

{07A11D74-9D25-4fea-A833-8B0D76A5577A} - 

C:\Programme\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O2 - BHO: (no name) - {60FD4F58-4748-48f6-B661-5FCE71B0D907} - (no 

file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - 

C:\Programme\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no 

file)
O2 - BHO: Windows Live Sign-in Helper - 

{9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame 

Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - 

{AA58ED58-01DD-4d91-8333-CF10577473F7} - 

c:\programme\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - 

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - 

C:\Programme\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: FDMIECookiesBHO Class - 

{CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Programme\Free Download 

Manager\iefdmcks.dll
O2 - BHO: Editor plugin - {D8BF9488-4F5C-41f7-8EE5-358FA79C5092} - 

cupid1.dll (file missing)
O3 - Toolbar: GMX Toolbar - {2D1DDD38-CE4D-459b-A01C-F11BC92D5B69} - 

C:\Programme\GMX\GMX Toolbar\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - 

c:\programme\google\googletoolbar2.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - 

C:\Programme\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Programme\ATI Technologies\ATI Control 

Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition 

Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone 

Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA 

Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] 

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [System] C:\WINDOWS\system32\kernels32.exe
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Programme\Gemeinsame 

Dateien\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] 

"C:\Programme\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [MacrokeyManager] WTMKM.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" 

-atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft 

ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [TaskSwitchXP] 

C:\Programme\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [LClock] C:\Programme\LClock\LClock.exe
O4 - HKCU\..\Run: [Vista Sidebar] C:\Programme\Vista 

Sidebar\sidebar.exe
O4 - HKCU\..\Run: [ViStart] C:\Programme\ViStart\ViStart.exe
O4 - HKCU\..\Run: [ViOrb] C:\Programme\ViOrb\ViOrb.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE 

(User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE 

(User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE 

(User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE 

(User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft 

Office\Office10\OSA.EXE
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel 

present
O8 - Extra context menu item: Download all with Free Download Manager - 

file://C:\Programme\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download 

Manager - file://C:\Programme\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download with Free Download Manager - 

file://C:\Programme\Free Download Manager\dllink.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - 

res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - 

C:\Programme\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - 

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - 

C:\Programme\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - 

{2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - 

C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - 

C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - 

{2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - 

C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Send to Mindjet MindManager - 

{941E1A34-C6AF-4baa-A973-224F9C3E04BF} - 

C:\Programme\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - 

C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - 

{B863453A-26C3-4e1f-A54D-A2CD196348E9} - 

C:\Programme\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - 

C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - 

{E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader 

Control) - 

h**p://static.pe.studivz.net/photouploader/ImageUploader5.cab?nocache=1

206571902
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - 

C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Planer 

(AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition 

Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - 

Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - 

C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - 

C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: GoogleDesktopManager - Google - 

C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: ICQ Service - Unknown owner - 

C:\Programme\ICQ6Toolbar\ICQ Service.exe
O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - 

Deutsche Telekom AG, Marmiko IT-Solutions GmbH - 

C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - 

C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WTService - Unknown owner - 

C:\WINDOWS\system32\atwtusb.exe
O24 - Desktop Component 0: (no name) - 

h**p://books.google.com/images/cleardot.gif

--
End of file - 9292 bytes