Trojaner-Board - Win32.Banker erkannt HiJackThis Log-File anbei

Grüß Gott!

Brauche Eure Hilfe. Win32.Banker an Bord. Ist noch mehr vorhanden?
Was tun? Bin nicht gerade ein Insider.
Danke

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:38:25, on 21.01.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
C:\Programme\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Analog Devices\SoundMAX\SMTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\DAEMON Tools Lite\daemon.exe
C:\Programme\Electronic Arts\EADM\Core.exe
C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
C:\Programme\Alwil Software\Avast4\ashWebSv.exe
C:\Programme\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
C:\Programme\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programme\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [EA Core] C:\Programme\Electronic Arts\EADM\Core.exe -silent
O4 - HKCU\..\Run: [Comrade.exe] C:\Programme\GameSpy\Comrade\Comrade.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programme\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1217401107546
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programme\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 6379 bytes

Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.0.0.73 2009.01.21 -
AhnLab-V3 5.0.0.2 2009.01.21 -
AntiVir 7.9.0.57 2009.01.21 -
Authentium 5.1.0.4 2009.01.20 -
Avast 4.8.1281.0 2009.01.21 -
AVG 8.0.0.229 2009.01.21 -
BitDefender 7.2 2009.01.21 -
CAT-QuickHeal 10.00 2009.01.21 -
ClamAV 0.94.1 2009.01.21 -
Comodo 940 2009.01.21 -
DrWeb 4.44.0.09170 2009.01.21 -
eSafe 7.0.17.0 2009.01.20 Win32.Banker
eTrust-Vet 31.6.6319 2009.01.21 -
F-Prot 4.4.4.56 2009.01.21 -
F-Secure 8.0.14470.0 2009.01.21 -
Fortinet 3.117.0.0 2009.01.15 -
GData 19 2009.01.21 -
Ikarus T3.1.1.45.0 2009.01.21 -
K7AntiVirus 7.10.598 2009.01.21 -
Kaspersky 7.0.0.125 2009.01.21 -
McAfee 5501 2009.01.20 -
McAfee+Artemis 5501 2009.01.20 -
Microsoft 1.4205 2009.01.21 -
NOD32 3785 2009.01.21 -
Norman 5.93.01 2009.01.21 -
nProtect 2009.1.8.0 2009.01.21 -
Panda 9.5.1.2 2009.01.21 -
PCTools 4.4.2.0 2009.01.21 -
Prevx1 V2 2009.01.21 -
Rising 21.13.22.00 2009.01.21 -
SecureWeb-Gateway 6.7.6 2009.01.21 -
Sophos 4.37.0 2009.01.21 -
Sunbelt 3.2.1835.2 2009.01.16 -
Symantec 10 2009.01.21 -
TheHacker 6.3.1.5.225 2009.01.21 -
TrendMicro 8.700.0.1004 2009.01.21 -
VBA32 3.12.8.10 2009.01.21 -
ViRobot 2009.1.21.1572 2009.01.21 -
VirusBuster 4.5.11.0 2009.01.21 -
weitere Informationen
File size: 66872 bytes
MD5...: 831883b107684301f48ace752c963984
SHA1..: c3c4cb668c12cd267e6cf56e35ca3b29c768a71c
SHA256: eaf383c4acc17dbb060bb8398225222175e028e1e332e2ce0548c97daed3620e
SHA512: 543e36acb5da2213b91bdc3aa351ab5a77a5d64c671bde3156031767d406bbb9
f0d58f9f9c1bd0419c609930cb25f3f7ec66e539c1a7e72ce91c4bb07a5c0e5e

ssdeep: 1536:mB1UhY9ELMz2SGpQ4tsh3TpdUe5Pl7IfY:m3Uyziq/3vPleY

PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4046e6
timedatestamp.....: 0x46b4e3c9 (Sat Aug 04 20:38:33 2007)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9b67 0xa000 6.66 018a3376d6bc944177c251eeb05bb2da
.rdata 0xb000 0x25dc 0x3000 4.50 c359eef8ac921a1ef5f3475058da55f9
.data 0xe000 0x4bc8 0x1000 1.17 2e0e3834394a62add8287692ef84ee71

( 7 imports )
> WSOCK32.dll: -, -, -, -, -, -, -, -, -, -, -, -
> KERNEL32.dll: GetCurrentProcess, GetTickCount, GetCPInfo, Sleep, GetSystemDirectoryA, CopyFileA, WideCharToMultiByte, SystemTimeToFileTime, FileTimeToLocalFileTime, lstrcmpA, lstrcpyW, FileTimeToSystemTime, MultiByteToWideChar, GetLastError, FormatMessageA, lstrlenA, LocalAlloc, LocalFree, HeapSize, SetEndOfFile, GetLocaleInfoA, VirtualProtect, GetACP, GetStringTypeW, GetStringTypeA, LoadLibraryA, GetSystemInfo, LCMapStringA, LCMapStringW, CompareStringA, CompareStringW, SetEnvironmentVariableA, CreateDirectoryA, GetFileAttributesA, SetFileAttributesA, GetOEMCP, DeleteFileA, GetSystemTimeAsFileTime, ExitProcess, RtlUnwind, HeapFree, HeapAlloc, GetModuleHandleA, GetCommandLineA, GetVersionExA, WriteFile, FlushFileBuffers, CloseHandle, GetProcAddress, TerminateProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, SetFilePointer, GetTimeZoneInformation, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, GetModuleFileNameA, InterlockedExchange, VirtualQuery, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, ReadFile, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetStdHandle, CreateFileA
> USER32.dll: wsprintfA
> ADVAPI32.dll: RegSetValueExA, CreateServiceA, CloseServiceHandle, DeleteService, ControlService, OpenServiceA, OpenSCManagerA, AdjustTokenPrivileges, LookupPrivilegeValueA, StartServiceCtrlDispatcherA, RegisterServiceCtrlHandlerA, RegCreateKeyExA, StartServiceA, RegOpenKeyExA, RegCloseKey, SetServiceStatus, OpenProcessToken
> SHELL32.dll: SHGetFolderPathA
> WINTRUST.dll: WinVerifyTrust
> CRYPT32.dll: CertGetNameStringA, CryptDecodeObject, CertFreeCertificateContext, CryptMsgClose, CertCloseStore, CertVerifyTimeValidity, CertFindCertificateInStore, CryptQueryObject, CryptMsgGetParam

( 0 exports )

ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=831883b107684301f48ace752c963984' target='_blank'>http://www.threatexpert.com/report.aspx?md5=831883b107684301f48ace752c963984</a>
CWSandbox info: <a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=831883b107684301f48ace752c963984' target='_blank'>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=831883b107684301f48ace752c963984</a>