| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: System32\kbdqelt.dll Virus oder unerwünschtes Programm TR/Agent.ruo [trojan] gefundenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
28.03.2010, 04:09
| #1 |
| | ![System32\kbdqelt.dll Virus oder unerwünschtes Programm TR/Agent.ruo [trojan] gefunden - Ausrufezeichen](images/icons/icon4.gif){kind=icon} System32\kbdqelt.dll Virus oder unerwünschtes Programm TR/Agent.ruo [trojan] gefunden HILFE! Mein Problem: In der Datei 'C:\Windows\System32\kbdqelt.dll' wurde ein Virus oder unerwünschtes Programm 'TR/Agent.ruo' [trojan] gefunden. Wie gehe ich vor und wie gefährlich ist die Sache? Bitte dringend um Rat, da ich mich damit null auskenne! Für Antworten bin ich sehr dankbar!!! EDIT: OTL logfile created on: 28.03.2010 05:17:05 - Run 1 OTL by OldTimer - Version 3.1.37.3 Folder = C:\Users\***\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18882) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 67,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 85,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 97,66 Gb Total Space | 24,92 Gb Free Space | 25,51% Space Free | Partition Type: NTFS Drive D: | 200,43 Gb Total Space | 198,80 Gb Free Space | 99,19% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: MAX Current User Name: *** Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\BillP Studios\WinPatrol\WinPatrol.exe (BillP Studios) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD) PRC - C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Programme\RocketDock\RocketDock.exe () PRC - C:\Programme\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated) ========== Modules (SafeList) ========== MOD - C:\Users\***\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Programme\BillP Studios\WinPatrol\patrolpro.dll (BillP Studios) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation) MOD - C:\Programme\RocketDock\RocketDock.dll () ========== Win32 Services (SafeList) ========== SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (wlidsvc) -- C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) SRV - (vsmon) -- C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek ) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (RTSTOR) -- C:\Windows\System32\drivers\RTSTOR.sys (Realtek Semiconductor Corp.) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (SiFilter) -- C:\Windows\system32\DRIVERS\SiWinAcc.sys (Silicon Image, Inc.) DRV - (SiRemFil) -- C:\Windows\system32\DRIVERS\SiRemFil.sys (Silicon Image, Inc.) DRV - (Si3531) -- C:\Windows\system32\DRIVERS\Si3531.sys (Silicon Image, Inc) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation) DRV - (Vsdatant) -- C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD) DRV - (UMPass) -- C:\Windows\System32\drivers\umpass.sys (Microsoft Corporation) DRV - (MegaSR) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = EE 50 1F 85 A1 8C CA 01 [binary data] IE - HKCU\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 192.168.100.254:3128 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.startup.homepage: "hxxp://xboxfront.de/" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1 FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5 FF - prefs.js..extensions.enabledItems: {9814c216-0476-4bcc-8f17-53978e414586}:0.9 FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.7 FF - prefs.js..extensions.enabledItems: dvscontextmenuy@dvdvideosoft.com:1.0 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.9.35 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0 FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.2 FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.4.0.4 FF - prefs.js..network.proxy.type: 4 FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009.07.01 00:07:56 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.02.16 03:24:44 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.02.07 17:51:47 | 000,000,000 | ---D | M] [2009.06.28 23:44:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Extensions [2010.03.28 00:31:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions [2009.06.28 23:49:14 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2009.06.28 23:49:14 | 000,000,000 | ---D | M] (PDF Download) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}(77) [2010.01.09 14:41:49 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232} [2009.06.28 23:49:14 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(2) [2009.06.28 23:49:14 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}(78) [2009.06.28 23:49:15 | 000,000,000 | ---D | M] (IE Tab) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9} [2009.06.28 23:49:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{9814c216-0476-4bcc-8f17-53978e414586} [2009.06.28 23:49:15 | 000,000,000 | ---D | M] (FireFTP) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}(13) [2009.08.13 16:23:06 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2009.10.18 20:19:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{dc572301-7619-498c-a57d-39143191b318} [2009.12.20 19:10:24 | 000,000,000 | ---D | M] (DownThemAll!) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8} [2010.01.13 18:43:41 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} [2009.06.28 23:51:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2009.06.28 23:49:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\eebn725r.default\extensions\temp [2009.06.28 23:49:23 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2008.03.15 15:56:14 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2008.10.13 20:34:40 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2008.02.19 16:40:48 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2006.12.03 17:59:22 | 000,000,986 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2006.11.17 13:19:24 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Programme\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.) O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe (BillP Studios) O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD) O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe () O4 - HKCU..\Run: [Steam] C:\Program Files\Valve\Steam\Steam.exe (Valve Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\***\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{036c1011-93d5-11de-82e6-001f3bbb6757}\Shell - "" = AutoRun O33 - MountPoints2\{036c1011-93d5-11de-82e6-001f3bbb6757}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found O33 - MountPoints2\{036c1012-93d5-11de-82e6-001f3bbb6757}\Shell - "" = AutoRun O33 - MountPoints2\{036c1012-93d5-11de-82e6-001f3bbb6757}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found O33 - MountPoints2\{036c1025-93d5-11de-82e6-001f3bbb6757}\Shell - "" = AutoRun O33 - MountPoints2\{036c1025-93d5-11de-82e6-001f3bbb6757}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found O33 - MountPoints2\{802d2b99-9394-11de-ab08-001f160451f5}\Shell - "" = AutoRun O33 - MountPoints2\{802d2b99-9394-11de-ab08-001f160451f5}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found O33 - MountPoints2\{802d2bb4-9394-11de-ab08-001f160451f5}\Shell - "" = AutoRun O33 - MountPoints2\{802d2bb4-9394-11de-ab08-001f160451f5}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.03.28 05:16:01 | 000,555,520 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe [2010.03.26 22:13:03 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\L&H [2010.03.26 22:12:30 | 000,057,436 | ---- | C] (Microsoft Corporation) -- C:\Windows\DASShp.dll [2010.03.26 22:12:30 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Reader [2010.03.20 15:41:42 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Leadertech [2010.03.20 14:51:15 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\gtk-2.0 [2010.03.20 14:51:02 | 000,000,000 | ---D | C] -- C:\Users\***\.thumbnails [2010.03.20 14:47:49 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\gegl-0.0 [2010.03.20 14:47:49 | 000,000,000 | ---D | C] -- C:\Users\***\.gimp-2.6 [2010.03.20 14:45:55 | 000,000,000 | ---D | C] -- C:\Programme\GIMP-2.0 [2010.03.08 18:33:01 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Battlefield 2 Demo [2010.03.08 18:12:11 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Battlefield 2 [2010.03.08 18:10:02 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe [2010.03.08 18:09:33 | 000,000,000 | ---D | C] -- C:\Programme\EA GAMES [2010.03.08 18:09:32 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\InstallShield Installation Information [2010.03.08 18:08:36 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\InstallShield [2010.03.08 14:55:56 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Updater5 [2010.03.08 14:55:56 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Adobe [2010.03.08 14:54:58 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe [2010.03.08 14:54:58 | 000,000,000 | ---D | C] -- C:\Programme\Adobe [2010.03.08 14:54:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2010.03.08 14:54:13 | 000,000,000 | ---D | C] -- C:\Windows\Downloaded Installations [2010.03.08 12:26:41 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\BEST OF BATTLEFIELD [2010.03.01 17:19:15 | 000,000,000 | ---D | C] -- C:\DVDVideoSoft [2010.02.27 13:44:28 | 000,726,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll [2010.02.27 13:44:20 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2010.02.27 13:44:10 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_isv.dll [2010.02.27 13:44:10 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc.dll [2010.02.27 13:44:09 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_isv.exe [2010.02.27 13:44:09 | 000,347,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp.exe [2010.02.27 13:44:09 | 000,346,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate_ssp_isv.exe [2010.02.27 13:44:08 | 000,518,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RMActivate.exe [2010.02.27 13:44:08 | 000,332,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msdrm.dll [2010.02.27 13:44:08 | 000,152,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp_isv.dll [2010.02.27 13:44:08 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\secproc_ssp.dll [2010.02.27 13:43:23 | 001,696,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gameux.dll [2010.02.27 13:43:22 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll [2010.02.27 13:43:22 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll [1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.03.28 05:16:47 | 002,359,296 | -HS- | M] () -- C:\Users\***\NTUSER.DAT [2010.03.28 05:16:03 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Users\Maximilian Frisch\Desktop\OTL.exe [2010.03.28 04:59:26 | 002,952,052 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.03.28 04:59:26 | 001,298,914 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.03.28 04:59:26 | 000,920,040 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010.03.28 04:59:26 | 000,887,452 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.03.28 04:59:26 | 000,784,186 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.03.28 04:55:43 | 000,288,624 | ---- | M] () -- C:\ProgramData\nvModes.dat [2010.03.28 04:55:43 | 000,288,624 | ---- | M] () -- C:\ProgramData\nvModes.001 [2010.03.28 04:55:11 | 000,352,615 | -H-- | M] () -- C:\Windows\System32\drivers\vsconfig.xml [2010.03.28 04:55:02 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010.03.28 04:55:02 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010.03.28 04:55:02 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010.03.28 04:54:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.03.28 04:54:52 | 3217,506,304 | -HS- | M] () -- C:\hiberfil.sys [2010.03.28 02:30:19 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2010.03.28 02:30:17 | 000,524,288 | -HS- | M] () -- C:\Users\***\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2010.03.28 02:30:17 | 000,065,536 | -HS- | M] () -- C:\Users\***\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010.03.28 02:30:13 | 002,581,151 | -H-- | M] () -- C:\Users\***\AppData\Local\IconCache.db [2010.03.27 02:21:18 | 000,057,048 | ---- | M] () -- C:\Users\***\AppData\Local\GDIPFONTCACHEV1.DAT [2010.03.27 02:20:05 | 000,262,568 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.03.26 22:55:14 | 000,000,476 | ---- | M] () -- C:\Users\***\Desktop\Text-in-Sprache - Verknüpfung.lnk [2010.03.26 19:22:00 | 000,007,860 | ---- | M] () -- C:\Users\***\.recently-used.xbel [2010.03.20 14:46:24 | 000,000,898 | ---- | M] () -- C:\Users\Public\Desktop\GIMP 2.lnk [2010.03.17 12:58:03 | 000,009,728 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.03.08 12:32:58 | 000,006,444 | -HS- | M] () -- C:\Users\***\Desktop\Folder.jpg [2010.03.08 12:32:58 | 000,001,782 | -HS- | M] () -- C:\Users\***\Desktop\AlbumArtSmall.jpg [2010.03.03 20:55:22 | 074,246,041 | ---- | M] () -- C:\Users\***\Desktop\Halo_Reach_Multiplayer_Trailer_ESRB_720p_ST.wmv [2010.03.03 20:46:33 | 061,413,237 | ---- | M] () -- C:\Users\***\Desktop\Halo_Reach_Trailer_ESRB_1280x720_2997_ST_6300kbps.wmv [2010.03.01 17:38:36 | 279,444,378 | ---- | M] () -- C:\Windows\MEMORY.DMP [1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.03.26 22:55:14 | 000,000,476 | ---- | C] () -- C:\Users\***\Desktop\Text-in-Sprache - Verknüpfung.lnk [2010.03.26 19:22:00 | 000,007,860 | ---- | C] () -- C:\Users\***\.recently-used.xbel [2010.03.20 14:46:24 | 000,000,898 | ---- | C] () -- C:\Users\Public\Desktop\GIMP 2.lnk [2010.03.08 12:32:58 | 000,006,444 | -HS- | C] () -- C:\Users\***\Desktop\Folder.jpg [2010.03.08 12:32:58 | 000,001,782 | -HS- | C] () -- C:\Users\***\Desktop\AlbumArtSmall.jpg [2010.03.03 20:53:23 | 074,246,041 | ---- | C] () -- C:\Users\***\Desktop\Halo_Reach_Multiplayer_Trailer_ESRB_720p_ST.wmv [2010.03.03 20:44:53 | 061,413,237 | ---- | C] () -- C:\Users\***\Desktop\Halo_Reach_Trailer_ESRB_1280x720_2997_ST_6300kbps.wmv [2009.12.03 10:27:28 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll [2009.12.01 22:01:16 | 000,000,324 | ---- | C] () -- C:\Windows\game.ini [2009.11.06 11:58:04 | 000,178,975 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat [2009.07.31 01:03:47 | 000,009,728 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.06.29 18:33:57 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.06.28 23:39:03 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2009.06.28 18:38:33 | 000,288,624 | ---- | C] () -- C:\ProgramData\nvModes.001 [2009.06.28 18:03:36 | 000,288,624 | ---- | C] () -- C:\ProgramData\nvModes.dat [2009.06.28 17:38:26 | 000,000,680 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat [2009.06.28 17:31:30 | 000,000,604 | ---- | C] () -- C:\Programme\Windows Live [2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll [2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2006.11.02 14:55:59 | 000,001,630 | ---- | C] () -- C:\Program Files\Media Center.lnk [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini < End of report > Geändert von maxfrisch117 (28.03.2010 um 04:48 Uhr) |
|
28.03.2010, 13:33
| #2 |
| | ![System32\kbdqelt.dll Virus oder unerwünschtes Programm TR/Agent.ruo [trojan] gefunden - Standard](images/icons/icon1.gif){kind=icon} System32\kbdqelt.dll Virus oder unerwünschtes Programm TR/Agent.ruo [trojan] gefunden Ist mein Log in Ordnung? Hatte noch nie ne Maleware, deswegen hoffe ich auf Rat
__________________ Das blöde Ding beunruhigt mich |
|
31.03.2010, 21:34
| #3 |
| | System32\kbdqelt.dll Virus oder unerwünschtes Programm TR/Agent.ruo [trojan] gefunden hallo, will nicht ungeduldig sein, ich will nur wissen ob ich die chance habe, irgendwann hier von euch geholfen zu bekommen. Ihr habt im moment hier viel zu tun, aber da ich mich mit diesem trojaner nicht auskenne hab ich ein schlechtes gefühl. könnt ihr mir vorläufig einfach nur sagen, ob diese trojaner auf dauer gefährlich ist? wäre dankbar für eine antwort... mfg
__________________ |
|
01.04.2010, 17:33
| #4 |
| | System32\kbdqelt.dll Virus oder unerwünschtes Programm TR/Agent.ruo [trojan] gefunden so wieder was neues: Jetzt steht da TR/Agent.ruo.4 anstatt TR/Agent.ruo langsam dreh ich durch... sorry für das 4-fach posting, ich will nur dass ihr alles wisst, wenn ihr euch mein thema durchlest. |
|
01.04.2010, 22:44
| #5 |
| | System32\kbdqelt.dll Virus oder unerwünschtes Programm TR/Agent.ruo [trojan] gefunden Mein problem wird ab jetzt beim Avira Support Forum weiterbehandelt! MfG |
|
| Themen zu System32\kbdqelt.dll Virus oder unerwünschtes Programm TR/Agent.ruo [trojan] gefunden |
| 0x00000001, adblock, avgnt.exe, avgntflt.sys, components, conduit, corp./icp, excel.exe, firefox.exe, fontcache, home premium, langs, location, nvlddmkm.sys, nvstor.sys, oldtimer, otl.exe, programdata, searchplugins |
![System32\kbdqelt.dll Virus oder unerwünschtes Programm TR/Agent.ruo [trojan] gefunden](iconimages/plagegeister-aller-art-deren-bekaempfung/system32-kbdqelt-dll-virus-unerwuenschtes-programm-tr-agent-ruo-trojan-gefunden_ltr.gif)
Linear-Darstellung
