Trojaner-Board - Shockwave missbrauch

Stimmte dass so mit dem Logfile?

Wenn ein Plugin oder so verändert wird ist der Dateiname doch immer noch der gleiche oder? Also kommt man so überhaupt dem Problem auf die Schliche?
Code:
Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:07:52, on 20.06.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal
 

Running processes:

J:\WINDOWS\System32\smss.exe

J:\WINDOWS\system32\winlogon.exe

J:\WINDOWS\system32\services.exe

J:\WINDOWS\system32\lsass.exe

J:\WINDOWS\system32\svchost.exe

J:\WINDOWS\System32\svchost.exe

J:\WINDOWS\system32\spoolsv.exe

J:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe

J:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

J:\Programme\Bonjour\mDNSResponder.exe

J:\Programme\Internet\F-Secure\Anti-Virus\fsgk32st.exe

J:\Programme\Internet\F-Secure\Anti-Virus\FSGK32.EXE

J:\Programme\Internet\F-Secure\Common\FSMA32.EXE

J:\WINDOWS\system32\nvsvc32.exe

J:\Programme\Internet\F-Secure\Common\FSMB32.EXE

H:\Extras\Games\ProStreet\PB\PnkBstrA.exe

J:\WINDOWS\system32\svchost.exe

J:\Programme\Internet\F-Secure\Common\FCH32.EXE

J:\Programme\Internet\F-Secure\Common\FAMEH32.EXE

J:\Programme\Internet\F-Secure\Anti-Virus\fsqh.exe

J:\Programme\Internet\F-Secure\Anti-Virus\fssm32.exe

J:\Programme\Internet\F-Secure\FSAUA\program\fsaua.exe

J:\Programme\Internet\F-Secure\FWES\Program\fsdfwd.exe

J:\WINDOWS\Explorer.EXE

J:\WINDOWS\SOUNDMAN.EXE

J:\Programme\Internet\F-Secure\Common\FSM32.EXE

J:\WINDOWS\system32\RUNDLL32.EXE

J:\WINDOWS\system32\ctfmon.exe

J:\Programme\Logitech\SetPoint\SetPoint.exe

J:\Programme\Gemeinsame Dateien\Logitech\khalshared\KHALMNPR.EXE

J:\Programme\iPod\bin\iPodService.exe

J:\Programme\Internet\F-Secure\Anti-Virus\fsav32.exe

J:\Programme\Internet\F-Secure\FSGUI\fsguidll.exe

J:\Dokumente und Einstellungen\+++\Desktop\RSD 0.572\RSD 0.572\RSD.exe

J:\WINDOWS\system32\NOTEPAD.EXE

J:\Programme\Player\Winamp\winamp.exe

J:\Dokumente und Einstellungen\+++\Desktop\CandiSoft_Load_0.48.8\Load!0.48.8\Load.exe

J:\Programme\Opera\opera.exe

J:\Dokumente und Einstellungen\+++\Desktop\HiJackThis.exe
 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - J:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - J:\Programme\Java\jre1.5.0_09\bin\ssv.dll

O2 - BHO: (no name) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - (no file)

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - J:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - J:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - J:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [F-Secure Manager] "J:\Programme\Internet\F-Secure\Common\FSM32.EXE" /splash

O4 - HKLM\..\Run: [F-Secure TNB] "J:\Programme\Internet\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE J:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE J:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [iTunesHelper] "J:\Programme\iPod\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] J:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader - Schnellstart.lnk = J:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = J:\Programme\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O4 - Global Startup: Logitech SetPoint.lnk = ?

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://J:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Programme\Java\jre1.5.0_09\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - J:\Programme\Java\jre1.5.0_09\bin\ssv.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - J:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - J:\Programme\Internet\ICQLite\ICQLite.exe

O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - J:\Programme\Internet\ICQLite\ICQLite.exe

O9 - Extra button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - J:\Programme\PokerStars.NET\PokerStarsUpdate.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - J:\Programme\Messenger\msmsgs.exe

O16 - DPF: {9522589E-57B9-46C5-9A77-1F1C1CCBE550} (F-Secure Online Scanner 2.1 (CD version)) - file://J:\Dokumente und Einstellungen\+++\Lokale Einstellungen\Temp\OnlineScanner\is2007ols\fscax.cab

O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - J:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - J:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Autodesk Licensing Service - Autodesk - J:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - J:\Programme\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - J:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe

O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - J:\Programme\Internet\F-Secure\Anti-Virus\fsgk32st.exe

O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - J:\Programme\Internet\F-Secure\FSAUA\program\fsaua.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - J:\Programme\Internet\F-Secure\FWES\Program\fsdfwd.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - J:\Programme\Internet\F-Secure\Common\FSMA32.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - J:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - J:\Programme\iPod\bin\iPodService.exe

O23 - Service: MSSQL$AUTODESKVAULT - Unknown owner - J:\Programme\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlservr.exe (file missing)

O23 - Service: MSSQLServerADHelper - Unknown owner - J:\Programme\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - J:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PunkBuster (PnkBstrA) - Unknown owner - H:\Extras\Games\ProStreet\PB\PnkBstrA.exe

O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - J:\Programme\Safety\SiSoftware\SiSoftware Sandra Professional 2005.SR1\RpcDataSrv.exe

O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - J:\Programme\Safety\SiSoftware\SiSoftware Sandra Professional 2005.SR1\RpcSandraSrv.exe

O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - J:\Programme\Secrets\Spyware Doctor\svcntaux.exe

O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - J:\Programme\Secrets\Spyware Doctor\swdsvc.exe

O23 - Service: ServiceLayer - Nokia. - J:\Programme\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: SQLAgent$AUTODESKVAULT - Unknown owner - J:\Programme\Microsoft SQL Server\MSSQL$AUTODESKVAULT\Binn\sqlagent.EXE (file missing)

O23 - Service: Symantec Core LC - Symantec Corporation - J:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe