TR/Agent.ruo in C:\Windows\system32\ntnluj.dll

Boreas

Hallo, ich bin neu hier und habe gesehen, dass mehrere Leute probleme mit dme selben Trojaner haben, aber in anderen dateien ... wie auch einige der Vorposter hoffe ich daher, dass es in Ordnung ist, dass ich meinen eigenen Thread eröffne...

wie in diesem Thread beschrieben http://www.trojaner-board.de/69886-a...-beachten.html habe ich eine analyse meines systems ausgeführt und alles gelöscht:

Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3923
Windows 6.0.6000
Internet Explorer 7.0.6000.16890

28.03.2010 16:40:08
mbam-log-2010-03-28 (16-40-08).txt

Scan-Methode: Quick-Scan
Durchsuchte Objekte: 111370
Laufzeit: 6 minute(s), 50 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 3
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PlayMP3 (Adware.PLayMP3z) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{8f67e146-fb6c-418f-9fe5-37aa2206d92e} (Trojan.Vundo) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Windows\System32\h@tkeysh@@k.dll (Trojan.Agent) -> Quarantined and deleted successfully.


Und dann noch ein Scan mit OSAM:


Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 16:49:42 on 28.03.2010
OS: Windows Vista Home Premium Edition (Build 6000), 32-bit
Default Browser: Opera Software Opera Internet Browser 10.51

Scanner Settings
Rootkits detection (hidden registry)
Rootkits detection (hidden files)
Retrieve files information
Check Microsoft signatures

Filters
Trusted entries
Empty entries
Hidden registry entries (rootkit activity)
Exclusively opened files
Not found files
Files without detailed information
Existing files
Non-startable services
Non-startable drivers
Active entries
Disabled entries
Risk Name Publisher Full Path Status
Common
%SystemRoot%\Tasks
|||| "GoogleUpdateTaskMachineCore.job" "Google Inc." C:\Program Files\Google\Update\GoogleUpdate.exe File exists
|||| "GoogleUpdateTaskMachineUA.job" "Google Inc." C:\Program Files\Google\Update\GoogleUpdate.exe File exists
|||| "Google Software Updater.job" "Google" C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe File exists
Control Panel Objects
%SystemRoot%\system32
|||||| "BDEADMIN.CPL" C:\Windows\system32\BDEADMIN.CPL File exists
|||||| "PhysX.cpl" "NVIDIA Corporation" C:\Windows\system32\PhysX.cpl File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls
|||||| "Nero BurnRights" "Nero AG" C:\Program Files\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl File exists
|||||| "QuickTime" "Apple Inc." C:\Program Files\QuickTime\QTSystem\QuickTime.cpl File exists
|| "ToSysCnf" "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToSysCnf.cpl File exists
Drivers
HKLM\SYSTEM\CurrentControlSet\Services
|||||| "atksgt" (atksgt) C:\Windows\System32\DRIVERS\atksgt.sys File found, but it contains no detailed information
|||||| "avgio" (avgio) "Avira GmbH" C:\Program Files\Avira\AntiVir Desktop\avgio.sys File exists
"avgntflt" (avgntflt) "Avira GmbH" C:\Windows\System32\DRIVERS\avgntflt.sys File exists
"avipbb" (avipbb) "Avira GmbH" C:\Windows\System32\DRIVERS\avipbb.sys File exists
"EagleNT" (EagleNT) C:\Windows\system32\drivers\EagleNT.sys File not found
|||||| "Hamachi Network Interface" (hamachi) "LogMeIn, Inc." C:\Windows\System32\DRIVERS\hamachi.sys File exists
|||||| "HH9Help.sys" (HH9Help.sys) "H+H Software GmbH" C:\Windows\system32\drivers\HH9Help.sys File exists
"IP in IP Tunnel Driver" (IpInIp) C:\Windows\System32\DRIVERS\ipinip.sys File not found
"IPX Traffic Filter Driver" (NwlnkFlt) C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
"IPX Traffic Forwarder Driver" (NwlnkFwd) C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
|||||| "ISO DVD/CD-ROM Device Driver" (ISODrive) "EZB Systems, Inc." C:\Program Files\UltraISO\drivers\ISODrive.sys File exists
"kbdqgmj" (kbdqgmj) "Microsoft Corporation" C:\Windows\system32\drivers\kbdqgmj.sys File exists
|||||| "lirsgt" (lirsgt) C:\Windows\System32\DRIVERS\lirsgt.sys File found, but it contains no detailed information
|||||| "MBAMSwissArmy" (MBAMSwissArmy) "Malwarebytes Corporation" C:\Windows\system32\drivers\mbamswissarmy.sys File exists
"mdxgthkn" (mdxgthkn) C:\Users\CHRIST~1\AppData\Local\Temp\mdxgthkn.sys File not found
|||||| "MIINPazX NDIS Protocol Driver" (MIINPazX) "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" C:\PROGRA~1\COMMON~1\MARMIK~1\MInfraIS\MIINPazX.SYS File exists
|||||| "MTOnlPktAlyX NDIS Protocol Driver" (MTOnlPktAlyX) "Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH" C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS File exists
|||||| "REDLIGHT" (REDLIGHT) "BufferZone" C:\Windows\System32\drivers\REDLIGHT.SYS File exists
|||||| "sptd" (sptd) "Duplex Secure Ltd." C:\Windows\System32\Drivers\sptd.sys File is exclusively opened, access blocked
"ssmdrv" (ssmdrv) "Avira GmbH" C:\Windows\System32\DRIVERS\ssmdrv.sys File exists
|||||| "StarForce Protection Environment Driver v6" (prodrv06) "Protection Technology" C:\Windows\System32\drivers\prodrv06.sys File exists
|||||| "StarForce Protection Helper Driver" (sfhlp01) "Protection Technology" C:\Windows\System32\drivers\sfhlp01.sys File exists
|||||| "StarForce Protection Helper Driver v2" (prohlp02) "Protection Technology" C:\Windows\System32\drivers\prohlp02.sys File exists
|||||| "StarForce Protection Synchronization Driver v1" (prosync1) "Protection Technology" C:\Windows\System32\drivers\prosync1.sys File exists
|||||| "StyleXPHelper" (StyleXPHelper) "Windows (R) 2000 DDK provider" C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe File exists
|||||| "vdrv9000" (vdrv9000) "H+H Software GmbH" C:\Windows\System32\DRIVERS\vdrv9000.sys Hidden registry entry, rootkit activity | File signed by Microsoft
Explorer
HKLM\Software\Classes\Folder\shellex\ColumnHandlers
|||||| {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" "Adobe Systems, Inc." C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll File exists
HKLM\Software\Classes\Protocols\Filter
|||||| {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" "Microsoft Corporation" C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL File exists
HKLM\Software\Classes\Protocols\Handler
|||||| {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" "Microsoft Corporation" C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll File exists
|||||| {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" "Skype Technologies" C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL File exists
|||||| {0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" "Microsoft Corporation" C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" File not found | COM-object registry key not found
|||||| {23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" "Igor Pavlov" C:\Program Files\7-Zip\7-zip.dll File exists
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" File not found | COM-object registry key not found
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" File not found | COM-object registry key not found
|||||| {E2958773-ACDB-4553-A069-A1EEB4AFBA0F} "BufferZone context menu" C:\Windows\system32\RlShellExt.dll File exists
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" File not found | COM-object registry key not found
|||||| {94586423-855F-4EB2-9F6A-D9DA5658DBE3} "Context menu" C:\PROGRA~1\FREEM4~1\m4a_menu.dll File found, but it contains no detailed information
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" File not found | COM-object registry key not found
{00020d75-0000-0000-c000-000000000046} "lnkfile" File not found | COM-object registry key not found
|||||| {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\msohevi.dll File exists
|||||| {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" "Microsoft Corporation" C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll File exists
|||||| {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" "Microsoft Corporation" C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL File exists
|||||| {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" "Microsoft Corporation" C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll File exists
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" File not found | COM-object registry key not found
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" File not found | COM-object registry key not found
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" "Avira GmbH" C:\Program Files\Avira\AntiVir Desktop\shlext.dll File exists
|||||| {5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll File exists
|||||| {37ADBD0B-11EC-4A2C-9F93-5C3ACC7994DF} "SxBufferZoneOverlay" C:\Windows\system32\RlShellExt.dll File exists
|||||| {F594B094-8768-4632-8143-12852EBBD688} "SxConfidentialOverlay" C:\Windows\system32\RlShellExt.dll File exists
|||||| {F1A1DA12-E651-4AD0-A1A0-6214546B2F9D} "SxForbiddenOverlay" C:\Windows\system32\RlShellExt.dll File exists
|||||| {E4FC4B31-8A4F-45E6-BDAC-28F612371FE3} "SxUnknownOverlay" C:\Windows\system32\RlShellExt.dll File exists
|||||| {AD392E40-428C-459F-961E-9B147782D099} "UIContextMenu Class" "EZB Systems, Inc." C:\Program Files\UltraISO\isoshell.dll File exists
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" File not found | COM-object registry key not found
|||||| {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" C:\Program Files\WinRAR\rarext.dll File found, but it contains no detailed information
Internet Explorer
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
"ITBar7Layout" File not found | COM-object registry key not found
"{855F3B16-6D32-4FE6-8A56-BBB695989046}" File not found | COM-object registry key not found
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units
|||| {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.6.0_05"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\jp2iexp.dll File exists
|||| {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\jp2iexp.dll File exists
|||| {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\jp2iexp.dll File exists
|||| {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\jp2iexp.dll File exists
|||| {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15"
hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\npjpi160_15.dll File exists
HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
|||| {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" "Microsoft Corporation" C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll File exists
|||| "ICQ6" "ICQ, LLC." C:\Program Files\ICQ6.5\ICQ.exe File exists
|||| {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" "Microsoft Corporation" C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
|||||| {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" "Adobe Systems Incorporated" C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll File exists
|||| {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" "Google Inc." C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll File exists
|||| {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" "Sun Microsystems, Inc." C:\Program Files\Java\jre6\bin\jp2ssv.dll File exists
Logon
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
|||| "OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" "Microsoft Corporation" C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE Shortcut exists | File exists
|||||| "desktop.ini" C:\Users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini File exists
%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup
|||||| "desktop.ini" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini File exists
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
|| "T-Online_Software_6\WLAN-Access Finder" "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" C:\Program Files\T-Online\WLAN-Access Finder\ToWLaAcF.exe /StartMinimized File exists
HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd
"StartupPrograms" rdpclip File not found
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
|||| "Adobe Reader Speed Launcher" "Adobe Systems Incorporated" "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" File exists
"avgnt" "Avira GmbH" "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min File exists
|| "FreePDF Assistant" "shbox.de" C:\Program Files\FreePDF_XP\fpassist.exe File exists
|||| "NeroFilterCheck" "Nero AG" C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe File exists
|||| "QuickTime Task" "Apple Inc." "C:\Program Files\QuickTime\QTTask.exe" -atboottime File exists
|||| "StartCCC" c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe File found, but it contains no detailed information
|| "ToADiMon.exe" "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\ToADiMon.exe -TOnlineAutodialStart File exists
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
|||||| "Malwarebytes' Anti-Malware" "Malwarebytes Corporation" D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent File exists
Print Monitors
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
|||||| "PDFConverter" C:\Windows\system32\pdfmonnt.dll File found, but it contains no detailed information
|||||| "PDFCreator" C:\Windows\system32\pdfcmnnt.dll File found, but it contains no detailed information
|||||| "Redirected Port" C:\Windows\system32\redmonnt.dll File found, but it contains no detailed information
|||||| "Send To Microsoft OneNote Monitor" "Microsoft Corporation" C:\Windows\system32\msonpmon.dll File exists
Services
HKLM\SYSTEM\CurrentControlSet\Services
|||||| "Automatisches LiveUpdate - Scheduler" (Automatisches LiveUpdate - Scheduler) "Symantec Corporation" C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe File exists
"Avira AntiVir Guard" (AntiVirService) "Avira GmbH" C:\Program Files\Avira\AntiVir Desktop\avguard.exe File exists
"Avira AntiVir Planer" (AntiVirSchedulerService) "Avira GmbH" C:\Program Files\Avira\AntiVir Desktop\sched.exe File exists
|||||| "Cyberlink RichVideo Service(CRVS)" (RichVideo) C:\Program Files\CyberLink\Shared Files\RichVideo.exe File exists
|||||| "Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) "MAGIX®" D:\Program Files\MAGIX\Common\Database\bin\fbserver.exe File exists
|||||| "Fujitsu Siemens Computers Diagnostic Testhandler" (TestHandler) "Fujitsu Siemens Computers" C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe File exists
|||| "getPlus(R) Helper" (getPlus(R) Helper) "NOS Microsystems Ltd." C:\Program Files\NOS\bin\getPlus_HelperSvc.exe File exists
|||| "Google Software Updater" (gusvc) "Google" C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe File exists
|||| "Google Update Service (gupdate1c9907fa83fb576)" (gupdate1c9907fa83fb576) "Google Inc." C:\Program Files\Google\Update\GoogleUpdate.exe File exists
|||| "InstallDriver Table Manager" (IDriverT) "Macrovision Corporation" C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe File exists
|||||| "LiveUpdate" (LiveUpdate) "Symantec Corporation" C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE File exists
|| "LogMeIn Hamachi 2.0 Tunneling Engine" (Hamachi2Svc) "LogMeIn Inc." C:\Program Files\LogMeIn Hamachi\hamachi-2.exe File exists
|||||| "Microsoft Office Diagnostics Service" (odserv) "Microsoft Corporation" C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE File exists
|||||| "NMIndexingService" (NMIndexingService) "Nero AG" C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe File exists
"nProtect GameGuard Service" (npggsvc) "INCA Internet Co., Ltd." C:\Windows\system32\GameMon.des File exists
|||||| "Office Source Engine" (ose) "Microsoft Corporation" C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE File exists
|||||| "PnkBstrA" (PnkBstrA) C:\Windows\system32\PnkBstrA.exe File found, but it contains no detailed information
|||||| "StyleXPService" (StyleXPService) C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe File exists
"Symantec Lic NetConnect service" (CLTNetCnService) "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon File not found
|||||| "Virtual CD v9 Management Service" (VC9SecS) "H+H Software GmbH" C:\Program Files\Virtual CD v9\System\VC9SecS.exe File exists


If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru