Raze Adware , was kann ich tun?

DaGO

Hallo, ich komm mir vor wie beim Urologen "Ich hab mir was eingefangen..."

Ich denke, ihr habt schon davon gehört, auch wenn die Suche nichts hergegeben hat:
ich habe einen rot-schwarzen, blinkenden Hintergrund,
"DANGER:SPYWARE" mit dem zugegeben verlockenden Angebot, mich für 49 $ freikaufen zu dürfen...

Ich werde jetzt das editierte Log von HJT, neusete Version posten, es wäre ganz toll, wenn Ihr mir da mit Tupfer und Skalpell assistieren würdet!

Vielen Dank im Voraus!!!

Logfile of HijackThis v1.99.1
Scan saved at 18:35:34, on 26.01.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Sophos\Remote Update\cachemgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Programme\Sophos\SWNETSUP.EXE
C:\Programme\Sophos\SWEEPSRV.SYS
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Aware.exe
C:\HiJackThis\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://www.google.de
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.spiegel.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://www.google.de
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.spiegel.de/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 85.214.19.192:80
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: XBTB06823 - {D25BC07D-E25D-4e08-923D-022E60BD95FF} - C:\PROGRA~1\PROMOT~1\promobar.dll
O3 - Toolbar: Promotionbasis PromoBar - {C49DD894-C6DE-4910-8C41-BA20F852D8BC} - C:\Programme\Promotionbasis PromoBar\promobar.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\wcescomm.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Programme\Sophos\ICMON.EXE
O4 - Global Startup: Remote Update Monitor.lnk = C:\Programme\Sophos\Remote Update\imonitor.exe
O8 - Extra context menu item: Alles mit FlashGet laden - C:\Programme\FlashGet\jc_all.htm
O8 - Extra context menu item: Mit FlashGet laden - C:\Programme\FlashGet\jc_link.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_07\bin\npjpi142_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_07\bin\npjpi142_07.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {1C66D486-70EF-484F-9827-E6AAD0210C0B} - C:\Programme\PicGrab\iestarter.exe (HKCU)
O9 - Extra 'Tools' menuitem: &PicGrab starten - {1C66D486-70EF-484F-9827-E6AAD0210C0B} - C:\Programme\PicGrab\iestarter.exe (HKCU)
O9 - Extra button: PicGrab - {D41BA7CD-23F1-4955-B58D-12B86D36708D} - C:\Programme\PicGrab\iestarter.exe (HKCU)
O16 - DPF: {1C955F3B-5B32-4393-A05D-24B4970CD2A1} - http://streamhc.redhotnetworks.com/cabs/videox.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{58D28D35-CDE1-4AB4-AAE3-63929E71BB78}: NameServer = 85.255.116.150,85.255.112.175
O17 - HKLM\System\CCS\Services\Tcpip\..\{8773B051-0534-489E-9071-5C27C2C12131}: NameServer = 85.255.116.150,85.255.112.175
O17 - HKLM\System\CCS\Services\Tcpip\..\{9600F552-FA62-4474-A82B-83448929B870}: NameServer = 85.255.116.150,85.255.112.175
O17 - HKLM\System\CCS\Services\Tcpip\..\{D8748F5B-9AFB-41DB-A111-A9CE7DD242DF}: NameServer = 85.255.116.150,85.255.112.175
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = uni-bielefeld.de
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = uni-bielefeld.de
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: SearchList = uni-bielefeld.de
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = uni-bielefeld.de
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Sophos Cache Manager (CacheMgr) - SOPHOS Plc - C:\Programme\Sophos\Remote Update\cachemgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: LEC TranslateDotNet Server - Unknown owner - C:\Programme\Power Translator\LogoMedia TranslateDotNet Server.exe (file missing)
O23 - Service: Network Monitor - Unknown owner - C:\Programme\Network Monitor\netmon.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc - C:\Programme\Sophos\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Programme\Sophos\SWEEPSRV.SYS