Trojaner-Board - Hilfe !!!!

und er findet immer und immer wieder was meno.....

mllji.dll;c:\windows\system32;Trojan.Virtumod;Wird nach dem Neustart desinfiziert.;
sipdiven.dll;c:\windows\system32;Adware.Crew;Wird nach dem Neustart gelöscht.;
wvutrpm.dll;c:\windows\system32;Trojan.Virtumod;Wird nach dem Neustart desinfiziert.;

und wenn ich hijack umbennen sagt er mir virus ............

"Beginner" - 07-04-19 8:52:31 Service Pack 2
ComboFix 07-04-19.1V - Running from: C:\Dokumente und Einstellungen\Beginner\Desktop\

(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\ijllm.ini
C:\WINDOWS\system32\ijllm.ini2
C:\WINDOWS\system32\ijllm.bak1
C:\WINDOWS\system32\mllji.dll
C:\WINDOWS\system32\wvutrpm.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((( Files Created from 2007-03-19 to 2007-04-19 ))))))))))))))))))))))))))))))))))

2007-04-19 08:38 <DIR> d-------- C:\DOKUME~1\Beginner\DoctorWeb
2007-04-18 03:08 <DIR> d--hs---- C:\FOUND.001
2007-04-18 02:24 <DIR> d-------- C:\WINDOWS\system32\appmgmt
2007-04-18 02:24 <DIR> d-------- C:\DOKUME~1\Beginner\ANWEND~1\Leadertech
2007-04-18 02:04 125,460 --a------ C:\WINDOWS\system32\oypapkpo.dll
2007-04-18 02:04 <DIR> d-------- C:\Programme\HyCam2
2007-04-16 02:18 <DIR> d-------- C:\Programme\Google
2007-04-15 03:29 <DIR> d--hs---- C:\FOUND.000
2007-04-14 02:41 <DIR> d-------- C:\DOKUME~1\Beginner\ANWEND~1\Digital Red
2007-04-13 23:11 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-04-13 23:11 <DIR> dr-h----- C:\DOKUME~1\Beginner\ANWEND~1\SecuROM
2007-04-12 01:59 10 --a------ C:\WINDOWS\popcinfo.dat
2007-04-12 00:20 30,592 --a------ C:\WINDOWS\system32\drivers\ikhfile.sys
2007-04-11 23:58 <DIR> d-------- C:\DOKUME~1\Beginner\ANWEND~1\Adobe
2007-04-11 23:57 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-04-11 23:57 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Adobe
2007-04-11 23:56 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Adobe
2007-04-11 23:38 <DIR> d-------- C:\Programme\Zuma Deluxe
2007-04-11 23:28 <DIR> d-------- C:\DOKUME~1\ALLUSE~1\ANWEND~1\Trymedia
2007-03-20 14:14 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-03-20 14:13 <DIR> d-------- C:\Programme\Microsoft Works
2007-03-20 14:12 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-03-20 14:12 <DIR> d-------- C:\Programme\Microsoft.NET
2007-03-20 14:09 <DIR> d-------- C:\Programme\Lavalys

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-04-12 00:20 51072 --a------ C:\WINDOWS\system32\drivers\ikhlayer.sys
2007-03-17 15:44 293376 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-10 19:50 -------- d-------- C:\DOKUME~1\Beginner\ANWEND~1\dvdcss
2007-03-08 17:36 579072 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 17:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 17:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 17:32 1843712 --a------ C:\WINDOWS\system32\win32k.sys
2007-02-22 12:24 40 ---hs---- C:\DOKUME~1\Beginner\ANWEND~1\.zreglib
2007-02-22 01:09 -------- d-------- C:\DOKUME~1\Beginner\ANWEND~1\utorrent
2007-02-16 20:38 3367 --a------ C:\WINDOWS\mozver.dat
2007-02-05 22:18 185856 --a------ C:\WINDOWS\system32\upnphost.dll
2007-01-30 05:01 78360 --a------ C:\WINDOWS\system32\perfc007.dat
2007-01-30 05:01 442770 --a------ C:\WINDOWS\system32\perfh007.dat
2007-01-30 03:07 0 --a------ C:\WINDOWS\nsreg.dat
2007-01-30 03:06 99970 --a------ C:\WINDOWS\uninstallfirefox.exe
2007-01-29 23:29 0 -rahs---- C:\MSDOS.SYS
2007-01-29 23:29 0 -rahs---- C:\IO.SYS
2007-01-29 23:29 0 --a------ C:\CONFIG.SYS
2007-01-29 23:29 0 --a------ C:\AUTOEXEC.BAT
2007-01-29 23:26 21740 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-01-29 23:20 62 --ahs---- C:\DOKUME~1\Beginner\ANWEND~1\desktop.ini
2007-01-26 03:19 129784 --------- C:\WINDOWS\system32\pxafs.dll
2007-01-26 03:19 118520 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-01-19 12:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{1713B623-7B53-4013-A67E-F4E13C4D1447} C:\WINDOWS\system32\awvtt.dll [x]
{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Programme\Java\jre1.5.0_11\bin\ssv.dll
{B56A7D7D-6927-48C8-A975-17DF180C71AC} C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit"
"avgnt"="\"C:\\Programme\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
"DAEMON Tools"="\"C:\\Programme\\DAEMON Tools\\daemon.exe\" -lang 1033"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Spyware Doctor"=""

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader - Schnellstart.lnk]
"path"="C:\\Dokumente und Einstellungen\\All Users\\Startmenü\\Programme\\Autostart\\Adobe Reader - Schnellstart.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader - Schnellstart.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\READER~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader - Schnellstart"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Reader Synchronizer.lnk]
"path"="C:\\Dokumente und Einstellungen\\All Users\\Startmenü\\Programme\\Autostart\\Adobe Reader Synchronizer.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Synchronizer.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\READER~1.0\\Reader\\ADOBEC~1.EXE "
"item"="Adobe Reader Synchronizer"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="apdproxy"
"hkey"="HKLM"
"command"="\"C:\\Programme\\Adobe\\Photoshop Album Starter Edition\\3.0\\Apps\\apdproxy.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ Lite]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ICQLite"
"hkey"="HKLM"
"command"="C:\\Programme\\ICQLite\\ICQLite.exe -minimize"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="dumprep 0 -k"
"hkey"="HKLM"
"command"="%systemroot%\\system32\\dumprep 0 -k"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Programme\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="steam"
"hkey"="HKCU"
"command"="\"d:\\spiele\\steam\\steam.exe\" -silent"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="\"C:\\Programme\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0

hklm\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs*
UxTuneUp

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\1-Klick-Wartung.job

********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-19 9:01:02 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 07-04-19 09:01