Trojaner-Board - auch TR/Vundo.gen

so..2. report

nachdem ich nun vergeblich mit avanger und combofix versucht hab das ding loszuwerden, hab nun auch noch TR/Dldr.ConHook.Gen am hals..... unabhaengig davon...waer ich erstmal froh den ersten loszuwerden, denn das antivir geraeuch geht mir langsam auf die nerven :(
von daher waer ich sehr dankbar fuer schnelle hilfe :)
ach und: antivir zeigt mir C:\WINDOWS\system32\pmnllig.dll als pfad fuer vundo.gen an

hier noch kurz mein combifix log

ComboFix 07-12-16.4 - Administrator 2007-12-17 14:28:21.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.117 [GMT 0:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\WINDOWS\system32\pac.txt

.
((((((((((((((((((((((((( Files Created from 2007-11-17 to 2007-12-17 )))))))))))))))))))))))))))))))
.

2007-12-17 09:16 . 2007-12-17 09:16 <DIR> d-------- C:\VundoFix Backups
2007-12-16 13:40 . 2007-12-16 13:40 <DIR> d-------- C:\Program Files\Veoh Networks
2007-12-16 13:38 . 2007-12-16 13:38 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-12-13 17:48 . 2007-12-13 17:48 <DIR> d-------- C:\Program Files\Lavasoft
2007-12-13 17:48 . 2007-12-13 17:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-13 17:15 . 2007-12-13 17:15 <DIR> d-------- C:\WINDOWS\system32\ineWc01
2007-12-13 17:15 . 2007-12-13 17:15 <DIR> d-------- C:\Temp\tpBe12
2007-12-13 17:15 . 2007-12-13 17:15 40,448 --------- C:\WINDOWS\system32\pmnllig.dll
2007-12-11 22:34 . 2007-12-11 22:34 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-12-11 22:34 . 2007-12-11 22:34 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-12-10 16:20 . 2007-12-10 16:37 <DIR> d-------- C:\Program Files\QIP Infium
2007-12-01 04:30 . 2007-12-01 04:30 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Ventrilo
2007-11-25 14:42 . 2007-12-08 04:23 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-11-19 16:48 . 2007-11-19 16:48 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-11-19 16:44 . 2007-11-19 16:54 <DIR> d-------- C:\Program Files\Warcraft III
2007-11-19 16:00 . 2007-11-19 16:00 <DIR> d-------- C:\Program Files\iPod
2007-11-19 15:59 . 2007-11-19 23:53 <DIR> d-------- C:\Program Files\iTunes
2007-11-19 15:57 . 2007-11-19 15:58 <DIR> d-------- C:\Program Files\QuickTime
2007-11-18 13:51 . 2007-11-18 13:51 <DIR> d--h----- C:\WINDOWS\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-17 14:09 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Skype
2007-12-16 13:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-15 13:05 --------- d-----w C:\Program Files\TuneUp Utilities 2007
2007-12-13 17:45 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-12 23:20 --------- d-----w C:\Program Files\DivX
2007-12-02 22:49 21,600 ----a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2007-12-02 20:02 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Hamachi
2007-11-24 19:16 --------- d-----w C:\Program Files\TrackMania Nations ESWC
2007-11-21 16:59 --------- d-----w C:\Program Files\ICQLite
2007-11-12 22:15 --------- d-----w C:\Program Files\Yahoo!
2007-11-04 15:24 --------- d-----w C:\Documents and Settings\Administrator\Application Data\BitTorrent
2007-10-29 20:37 --------- d-----w C:\Program Files\SmartFTP Client
2007-10-29 20:37 --------- d-----w C:\Documents and Settings\Administrator\Application Data\SmartFTP
2007-10-29 20:27 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-10-29 20:27 --------- d-----w C:\Program Files\Hamachi
2007-10-28 02:54 --------- d-----w C:\Program Files\Coolstreaming_Tool-Bar_v1.0
2007-10-25 23:31 71,782 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2007-10-25 23:31 5,376 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2007-10-25 23:24 --------- d-----w C:\Program Files\Common Files\Stardock
2007-10-25 21:40 --------- d-----w C:\Documents and Settings\Administrator\Application Data\teamspeak2
2007-10-25 21:39 --------- d-----w C:\Program Files\Teamspeak2_RC2
2007-10-23 11:08 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-22 00:19 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Apple Computer
2007-10-19 09:14 --------- d-----w C:\Program Files\Stardock
2007-10-19 09:07 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-10-18 09:28 --------- d-----w C:\Documents and Settings\Administrator\Application Data\BitTorrent DNA
2007-10-18 02:11 --------- d-----w C:\Program Files\BitTorrent_DNA
2007-10-18 02:11 --------- d-----w C:\Program Files\BitTorrent
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FF64059D-4D2A-4D6B-AA0F-2EE4A2FE3856}]
2007-12-13 17:15 40448 --------- C:\WINDOWS\system32\pmnllig.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartFTP Drop]
@={EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD}

[HKEY_CLASSES_ROOT\CLSID\{EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD}]
2007-10-01 22:33 406840 --a------ C:\Program Files\SmartFTP Client\sfShellTools.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 14:16]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2007-12-03 13:21]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"ICQ Lite"="C:\Program Files\ICQLite\ICQLite.exe" [2006-07-11 10:15]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2004-08-24 18:18 C:\WINDOWS\AGRSMMSG.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-16 04:00]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 01:40]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 01:38]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [2004-12-03 20:24]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-12 00:10]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 08:02]
"snpstd3"="C:\WINDOWS\vsnpstd3.exe" [2006-09-19 16:07]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-10-06 23:05]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00]

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-18 22:05:02]
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 07:43:08]
Yahoo! Widget Engine.lnk - C:\Program Files\Yahoo!\Widgets\YahooWidgetEngine.exe [2007-07-20 17:57:16]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-06-03 00:48:22]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{FF64059D-4D2A-4D6B-AA0F-2EE4A2FE3856}"= C:\WINDOWS\system32\pmnllig.dll [2007-12-13 17:15 40448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll 2005-09-18 09:32 5376 C:\WINDOWS\system32\antiwpa.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnllig]
pmnllig.dll 2007-12-13 17:15 40448 C:\WINDOWS\system32\pmnllig.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Graphic Update]
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\msnmsgr.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
"BitTorrent DNA"="C:\Program Files\BitTorrent_DNA\dna.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"=C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 ALiIRDA;ALi Infrared Device Driver;C:\WINDOWS\system32\DRIVERS\alifir.sys
R3 CONAN;CONAN;C:\WINDOWS\system32\drivers\o2mmb.sys
R3 MbxStby;MbxStby;C:\WINDOWS\system32\drivers\MbxStby.sys
R3 WLAN_400_500_SERVICE;HP WLAN W400/W500 Wireless Network Adapter Service;C:\WINDOWS\system32\DRIVERS\ar5211.sys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2007-12-14 17:19:01 C:\WINDOWS\Tasks\1-Klick-Wartung.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-17 14:34:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-17 14:36:57