Trojaner-Board - Startseite gehijackt

Liebe Community,

anbei meine Logfile. habe nicht sehr viel Ahnung von Viren und Trojanern, daher brauche ich Eure Hilfe. Ich habe schon einen Virenscan gemacht (Symantec), Spybot drüber laufen lassen und Hijackthis ebenfalls.
Folgende Startseite hat sich eingenistet: http://www.rover-host.com/infected.html. Habe dise schon probiert manuell aus der Registry zu ändern, jedoch ohne Erfolg.

Hier ist die Logfile von Hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 14:39:00, on 17.01.2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\SCardSvr.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\Programme\Intel\Wireless\Bin\EvtEng.exe
C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
C:\Programme\Intel\Wireless\Bin\WLKeeper.exe
C:\Programme\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Programme\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINNT\system32\spoolsv.exe
C:\Programme\Dell\Bluetooth Software\bin\btwdins.exe
C:\Programme\Symantec AntiVirus\DefWatch.exe
C:\WINNT\SYSTEM32\DWRCS.EXE
C:\WINNT\system32\svchost.exe
C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
C:\WINNT\system32\regsvc.exe
C:\Programme\Symantec AntiVirus\SavRoam.exe
C:\WINNT\system32\MSTask.exe
C:\Programme\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\bcmwltry.exe
C:\Programme\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Programme\CheckPoint\SecuRemote\bin\SR_GUI.Exe
C:\Programme\Apoint\Apoint.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programme\Apoint\Apntex.exe
C:\Programme\Java\jre1.5.0_10\bin\jusched.exe
C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Programme\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\Dell\Bluetooth Software\BTTray.exe
C:\Programme\PDF-XChange 2.5\pdfSaver.exe
C:\Programme\Lotus\Notes\NLNOTES.EXE
C:\Programme\Lotus\Notes\naldaemn.EXE
C:\Programme\Lotus\Notes\nxpcdmn.EXE
C:\Programme\Lotus\Notes\nhldaemn.EXE
C:\totalcmd\TOTALCMD.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
D:\Timur Gökler\7 PRIVAT\07. Tools\AntiWebsite Hijack Tool\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.rover-host.com/infected.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rover-host.com/infected.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.de
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://autoproxy.pg.com:8080
O1 - Hosts: Server-LAN
O1 - Hosts: Drucker, Fax
O1 - Hosts: MediaCom LAN Hamburg
O1 - Hosts: MediaCom LAN München
O1 - Hosts: Magic Poster
O1 - Hosts: MediaCom LAN Berlin
O1 - Hosts: DMZ Webzone
O1 - Hosts: DMZ Proxyzone
O1 - Hosts: DMZ DB-Zone
O1 - Hosts: VPN-Pool
O1 - Hosts: public IPs
O1 - Hosts: 195.234.80.3 Firewall-Cluster-DD
O1 - Hosts: 195.234.80.4 Firewall-GGG externes Interface
O1 - Hosts: 195.234.80.5 Firewall-MC externes Interface - all MediaCom Users
O1 - Hosts: 195.234.80.6 CEE-SMTP-01 #Mxtreme
O1 - Hosts: 195.234.80.7 CEE-SMTP-02 #Mxtreme
O1 - Hosts: 195.234.80.13 MCDE-Telefonanlage_HH
O1 - Hosts: 195.234.80.15 MC-DO-SMTP
O1 - Hosts: 195.234.80.16 MagicOrder
O1 - Hosts: 195.234.80.110 PCTV ISDN-Router
O1 - Hosts: 195.234.80.152 Linux Test
O1 - Hosts: 195.234.80.220 cam.virtualgrey.de
O1 - Hosts: 195.234.80.221 IP40 Budapest
O1 - Hosts: 195.234.80.231 GGGDE-D3
O1 - Hosts: 195.234.80.232 GGDE-Leading_Jobs_Testsystem
O1 - Hosts: 195.234.80.233 GGGDE-Siemens
O1 - Hosts: 195.234.80.234 TEMP_CEE-SMTP02
O1 - Hosts: 195.234.80.235 GGGDE-Intranet
O1 - Hosts: 195.234.80.236 GGGDE-Navision
O1 - Hosts: 195.234.80.237 GGGDE-Leading_Jobs
O1 - Hosts: 195.234.80.238 35mm.grey.de
O1 - Hosts: 195.234.80.239 GGGDE-GKA
O1 - Hosts: 195.234.80.240 GGGDE-Basis
O1 - Hosts: 195.234.80.241 GGGDE-Metaframe
O1 - Hosts: 195.234.80.242 Mail1
O1 - Hosts: 195.234.80.243 GGG-10.49.0.120
O1 - Hosts: 195.234.80.250 reserviert
O1 - Hosts: 195.234.80.251 reserviert
O1 - Hosts: 195.234.80.252 reserviert
O1 - Hosts: 195.234.80.253 reserviert
O1 - Hosts: Neues Lan
O1 - Hosts: Virtual Server
O1 - Hosts: Zutrittskontrolle:
O1 - Hosts: Kamera:
O1 - Hosts: Drucker
O1 - Hosts: Klimaanlagen
O1 - Hosts: Workstations
O1 - Hosts: DMZ
O1 - Hosts: 195.234.82.65 MCDE-MA-PIN-COP
O1 - Hosts: 195.234.82.66 MCDE-WEB-COP
O1 - Hosts: 195.234.82.69 MCDE-MPTools
O1 - Hosts: 195.234.82.82 MCDE-DB-COP
O1 - Hosts: 195.234.82.83 MCDE-WEB-COP2
O1 - Hosts: 195.234.82.132 MCDE-OBS
O1 - Hosts: 195.234.82.136 DUS-SAV101
O1 - Hosts: 195.234.82.137 DUS-TRM105
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: XBTP00885 - {54F33362-1828-4181-9CC7-4BC727C38B78} - C:\PROGRA~1\MEINPO~1\MEINPO~1.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: Mein PONSline - {A6F74643-242A-A7A4-8DD5-AB40B9E25345} - C:\Programme\Mein PONSline\MeinPONSline.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.5.0_10\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Bun] c:\windows\system32\crack.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: BTTray.lnk = C:\Programme\Dell\Bluetooth Software\BTTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: PDF-XChange Capture.lnk = C:\Programme\PDF-XChange 2.5\pdfSaver.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\Dell\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\Dell\Bluetooth Software\btsendto_ie.htm
O15 - Trusted Zone: http://ww-prj01.ad.insidemedia.net
O15 - Trusted Zone: http://ww-prj01.ad.insidemedia.net (HKLM)
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://appldnld.m7z.net/qtinstall.info.apple.com/pthalo/de/win/QuickTimeFullInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ad.insidemedia.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ad.insidemedia.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ad.insidemedia.net
O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINNT\system32\btxppanel.dll
O20 - Winlogon Notify: ckpNotify - C:\WINNT\SYSTEM32\ckpNotify.dll
O20 - Winlogon Notify: IntelWireless - C:\Programme\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O20 - Winlogon Notify: nwprovau - C:\WINNT\SYSTEM32\nwprovau.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Programme\Dell\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Programme\Symantec AntiVirus\DefWatch.exe
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development - C:\WINNT\SYSTEM32\DWRCS.EXE
O23 - Service: EvtEng - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Programme\Symantec AntiVirus\SavRoam.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Programme\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Programme\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Programme\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Programme\Intel\Wireless\Bin\WLKeeper.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINNT\System32\wltrysvc.exe

danke für Eure Hilfe im voraus,

Sheriff