Hallo,

ich habe einen Hijacker eingefangen, der mich auf die Seite updatescenter.com entführt. Außerdem erhalte ich dauernd irgendwelche Warnungen "your computer is infected".
Spybot konnte den Kram auch nicht entfernen (hat aber das scheinbar mitgelieferte PSGuard gefunden und beseitigt), deshalb hier mein HJT Logfile mit der Bitte um Hilfe: Was muss ich tun, um den Mist loszuwerden?

Und bitte dran denken: ich bin technisch "unbedarft", daher für "Doofe" erklären, danke!


Logfile of HijackThis v1.99.1
Scan saved at 16:31:55, on 07.10.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\popuper.exe
C:\WINDOWS\System32\shnlog.exe
C:\WINDOWS\System32\msole32.exe
C:\WINDOWS\htpatch.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\Dit.exe
C:\Programme\Medion Home CinemaXL\PowerCinema\PCMService.exe
C:\Programme\Real\RealPlayer\RealPlay.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Programme\iSaver\iSaverCtrl.exe
C:\WINDOWS\System32\intell32.exe
C:\Programme\Messenger\msmsgs.exe
C:\WINDOWS\System32\intmonp.exe
C:\Programme\DT\T-Sinus 130data 11Mbps WLAN USB Adapter\monitordt.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\System32\intmon.exe
C:\WINDOWS\DitExp.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aldi-sued.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freenet.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
F2 - REG:system.ini: Shell=Explorer.exe, msmsgs.exe
O2 - BHO: HP Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\System32\hp6A23.tmp
O3 - Toolbar: teallcrobsc - {8737510a-7074-4f1d-b5d1-af11b2204d48} - C:\DOKUME~1\BARBAR~1\ANWEND~1\iedcofrouoo.dll (file missing)
O3 - Toolbar: GMX Toolbar - {2D1DDD38-CE4D-459b-A01C-F11BC92D5B69} - C:\Programme\GMX\GMX Toolbar\toolbar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [VOBRegCheck] C:\WINDOWS\System32\VOBREGCheck.exe -CheckReg
O4 - HKLM\..\Run: [PCMService] C:\Programme\Medion Home CinemaXL\PowerCinema\PCMService.exe
O4 - HKLM\..\Run: [RealTray] C:\Programme\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [MMTray] C:\Programme\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [iSaverCtrl] C:\Programme\iSaver\iSaverCtrl.exe --startup
O4 - HKLM\..\Run: [Disk Keeper] C:\WINDOWS\System32\Services\{38F5BF12-9D77-4393-9584-AD26382BEF55}\SECURITY.EXE
O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\System32\msmsgs.exe
O4 - HKLM\..\Run: [intell32.exe] C:\WINDOWS\System32\intell32.exe
O4 - HKLM\..\Run: [P.S.Guard] C:\Programme\P.S.Guard\PSGuard.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: T-Sinus 130data WLAN USB Monitor.lnk = ?
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: WebSpeech - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll (file missing)
O9 - Extra 'Tools' menuitem: Seite/Markierung vorlesen (WebSpeech) - {1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - C:\Programme\Gemeinsame Dateien\WebSpeech.4.0\LgxIEBar.dll (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra button: MedionShop - {01E9CF82-AE9D-42BA-A629-B23D51A4B86B} - http://www.medionshop.de/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.freenet.de
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-30.cab
O16 - DPF: {C36112BF-2FA3-4694-8603-3B510EA3B465} (Lycos File Upload Component) - http://f010.mail.lycos.de/app/uploader/FileUploader.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = U14785.tjgo.com
O17 - HKLM\Software\..\Telephony: DomainName = U14785.tjgo.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{0E6B4FCB-9F25-4B2F-92A0-D9BB7FDC8983}: Domain = U14785.tjgo.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{13C9FBEB-F2C8-46DC-AE86-AEB59B968791}: Domain = U14785.tjgo.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{A6115259-7D4A-4276-95D1-60BF6CB25D65}: Domain = U14785.tjgo.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{C1C14C50-9C36-452D-98D8-99194520AA95}: Domain = U14785.tjgo.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2EEB5B3-F42D-4213-AAE6-3A6EC2A52D17}: Domain = U14785.tjgo.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = U14785.tjgo.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{0E6B4FCB-9F25-4B2F-92A0-D9BB7FDC8983}: Domain = U14785.tjgo.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = U14785.tjgo.com
O17 - HKLM\System\CS2\Services\Tcpip\..\{0E6B4FCB-9F25-4B2F-92A0-D9BB7FDC8983}: Domain = U14785.tjgo.com
O18 - Filter: text/html - {3F88B720-CC91-4738-9671-2A75718FA614} - C:\WINDOWS\System32\fomg.dll
O18 - Filter: text/plain - {3F88B720-CC91-4738-9671-2A75718FA614} - C:\WINDOWS\System32\fomg.dll
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

Arbeite mal diese Anleitung ab:
http://www.trojaner-board.de/showthread.php?t=21709