HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+

serji · 2006-09-23T14:40:42.0000000+03:00

ÖNEMLİ: Sizlerden ricam yalnızca çok acil ve ihtiyacı olanların loglarını buraya göndermesi. Bunun dışındakiler http://www.hijackthis.de/en sayfasından tarama yaptırıp sonuçları alabilirler. http://www.buraksonmez.com/dosyalar/HiJackThis.exe * Programı masaüstünüze indirin. * Programı çift tıklayarak açın. * Do a system scan and save a log file seçeneğine tıklayın. Bilgisayarınız taranacak ve masaüstünüzde hijackthis.txt adında bir dosya oluşacaktır. O dosyayı mesajınıza ekleyerek gönderin. * Mesajınızda sorununuzu kısa da olsa bir şekilde belirtin. Hiç bir şekilde yorum yapılmayan, sadece log içeren mesajlar yanıtlanmayacaktır . * Logları gönderirken lütfen code etiketleri arasına alarak yollayın. Bunları kullanmadığınız takdirde sayfalar çok uzuyor ve hoş olmayan bir görüntünün oluşmasının yanında, logları okumak ve takip etmek de zorlaşıyor. code etiketleri arasına alınmayan mesajlar yanıtlanmayacaktır . NOT: Lütfen işlemlerden önce eğer önemli verileriniz varsa yedek alın. Bazen özellikle de ağır virüsler bulaşan sistemlerde istenmeyen sonuçlar oluşabiliyor. Bu gibi durumlarda sorumlu kullanıcının kendisidir. NOT1: Logları bıraktığınızda gecikmeli cevap yazabilirim. Lütfen biraz sabırlı olun. En kısa zamanda cevap vermeye çalışıyorum. Genelde toplu olarak cevap yazıyorum haftada bir kontrol ederek. Eğer toplu cevapları dikkatlice inceledikten sonra mesajınıza cevap yazılmadığını görürseniz tekrar gönderebilirsiniz.

merhaba ben yenı uye oldum ve bılg cpu gostergem %100 gpu %50 bundan sonra arastırdım ve programı ındırdım bor sorum olucak logları asagıda verıcem ıkı yerde analız yaptırdım bırı HijackThis.de Security SORUN YOK CIKTI Help2Go Detective - Free HijackThis Analyzer -burada bır trjan coktı anlamadım lutfen yardımcı olurmusunuz
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:16:44, on 17.03.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.21183)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Visual Task Tips\Visual Task Tips.exe
C:\Program Files\ULi5287\ULi5287.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Office Mouse\moffice.exe
C:\WINDOWS\emMon.exe
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Office Mouse\MOUSE32A.DAT
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\TopDesk\topdesk.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Common Files\BinarySense\hldasvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\BinarySense\hldasvc.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\BinarySense\HDDlife 3\HDDlifePro.exe
C:\Program Files\BinarySense\HDDlife 3\HDDlifePro.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\IObit\IObit Security 360\IS360srv.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Google\Chrome\Application\chrome.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\tbFre1.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (file missing)
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (file missing)
O3 - Toolbar: Free Lunch Design Toolbar - {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - C:\Program Files\Free_Lunch_Design\tbFre1.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Visual Task Tips] C:\Program Files\Visual Task Tips\Visual Task Tips.exe
O4 - HKLM\..\Run: [ULiRaid] C:\Program Files\ULi5287\ULi5287.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Office Mouse\moffice.exe
O4 - HKLM\..\Run: [emMonitor] C:\WINDOWS\emMon.exe
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe
O4 - HKCU\..\Run: [TopDesk] C:\Program Files\TopDesk\topdesk.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [TopDesk] C:\Program Files\TopDesk\topdesk.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: HDDlife.lnk = C:\Program Files\BinarySense\HDDlife 3\HDDlifePro.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Bunu Bloga Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Windows Live Writer içinde &Bunu Web Günlüğüne Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: ZDelete Auto-Cleaner - {EB7F329E-F14E-48ae-AB69-4E28C492D382} - C:\Program Files\LSoft Technologies\Active ZDelete\ZDelete.exe (file missing) (HKCU)
O16 - DPF: {0FC8B38E-9293-424C-9D0E-CE60775679CF} (SubClassEditCtrlContainer Class) -https://sube.garanti.com.tr/lib/JaguarEditControl.CAB
O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} (UploadListView Class) -http://picasaweb.google.com.tr/s/v/56.29/uploader2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) -http://messenger.zone.msn.com/TR-TR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) -http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) -http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) -http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D735FC3A-B009-4991-84AD-B8C422D970CA}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\Common Files\BinarySense\hlAPP.dll" (file missing)
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Google Güncelleme Hizmeti (gupdate1c9c418910addfc) (gupdate1c9c418910addfc) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Common Files\BinarySense\hldasvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

--
End of file - 13512 bytes
ve combofıx onuda aldım
ComboFix 10-03-16.03 - Admin 17.03.2010 2:01.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1254.90.1055.18.1527.858 [GMT 2:00]
Running from: c:\documents and settings\Admin\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Admin\Local Settings\Application Data\Bron.tok.A17.em.bin
c:\windows\system32\msconfig.exe
c:\windows\system32\scrrntr.dll
c:\windows\system32\vbbho.tlb

.
((((((((((((((((((((((((( Files Created from 2010-02-17 to 2010-03-17 )))))))))))))))))))))))))))))))
.

2010-03-16 20:02 . 2010-03-16 20:02 -------- d-----w- c:\documents and settings\Admin\Local Settings\Application Data\FreeFixer
2010-03-16 20:02 . 2010-03-16 20:02 -------- d-----w- c:\documents and settings\Admin\Application Data\FreeFixer
2010-03-16 20:01 . 2010-03-16 23:55 -------- d-----w- c:\program files\FreeFixer
2010-03-14 20:47 . 2010-03-14 20:47 -------- d-----w- C:\0a328155117e62ff4c799b
2010-03-13 22:07 . 2010-03-13 22:07 -------- d-----w- c:\documents and settings\Admin\Local Settings\Application Data\Opera
2010-03-13 22:04 . 2010-03-13 22:06 -------- d-----w- c:\program files\Opera
2010-03-13 16:59 . 2010-03-13 16:59 -------- d-----w- c:\documents and settings\Admin\Application Data\BinarySense
2010-03-13 16:58 . 2010-03-13 16:58 -------- d-----w- c:\program files\Common Files\BinarySense
2010-03-13 16:58 . 2010-03-13 16:58 -------- d-----w- c:\program files\BinarySense
2010-03-13 14:20 . 2010-03-15 23:56 -------- d-----w- c:\program files\SpeedFan
2010-03-12 23:00 . 2010-03-12 23:01 -------- d-----w- c:\windows\system32\NtmsData
2010-03-11 22:00 . 2010-03-11 22:00 -------- d-----w- c:\documents and settings\Admin\Application Data\IObit
2010-03-11 21:14 . 2007-09-13 13:54 12288 ----a-w- c:\windows\system32\drivers\EIO.sys
2010-03-11 21:11 . 2010-03-11 21:11 -------- d-----w- c:\program files\My Company Name
2010-03-11 21:00 . 2010-03-11 21:00 -------- d-----w- c:\program files\ASUS
2010-03-11 20:58 . 2010-03-11 20:58 -------- d-----w- c:\windows\nview
2010-03-11 20:58 . 2007-09-16 17:07 356352 ----a-w- c:\windows\system32\nvudisp.exe
2010-03-11 20:58 . 2007-09-17 00:10 356352 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-03-09 22:10 . 2009-10-23 15:28 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe
2010-02-23 23:35 . 2009-11-24 23:49 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-02-23 23:35 . 2009-11-24 23:48 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-02-23 23:35 . 2009-11-24 23:47 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-02-23 23:35 . 2009-11-24 23:47 97480 ----a-w- c:\windows\system32\AvastSS.scr
2010-02-23 23:35 . 2009-11-24 23:51 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-02-23 23:35 . 2009-11-24 23:50 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-02-23 23:35 . 2009-11-24 23:50 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-02-23 23:35 . 2009-11-24 23:50 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-02-23 23:34 . 2009-11-24 23:54 1280480 ----a-w- c:\windows\system32\aswBoot.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-16 23:33 . 2009-05-03 13:19 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-03-15 23:53 . 2010-01-23 00:27 -------- d-----w- c:\documents and settings\All Users\Application Data\TmForever
2010-03-15 22:19 . 2009-03-18 19:48 -------- d-----w- c:\program files\Google
2010-03-13 12:46 . 2010-03-11 21:00 196608 ----a-w- c:\windows\system32\drivers\nStandard.bin
2010-03-11 23:44 . 2009-09-25 22:00 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit
2010-03-11 22:00 . 2009-09-25 21:59 -------- d-----w- c:\program files\IObit
2010-03-11 21:12 . 2009-03-15 12:19 1648 ----a-w- c:\windows\system32\d3d8caps.dat
2010-03-11 21:11 . 2009-03-15 15:12 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-11 21:11 . 2008-04-15 12:00 75544 ----a-w- c:\windows\system32\perfc01F.dat
2010-03-11 21:11 . 2008-04-15 12:00 417530 ----a-w- c:\windows\system32\perfh01F.dat
2010-03-11 15:48 . 2009-11-23 18:16 79488 ----a-w- c:\documents and settings\Admin\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-02-07 20:24 . 2010-02-07 20:24 -------- d-----w- c:\program files\Alwil Software
2010-02-02 22:40 . 2009-12-30 22:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-02-02 22:39 . 2009-05-09 21:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2010-02-01 00:14 . 2010-02-01 00:14 -------- d-----w- c:\program files\Ask Search Assistant
2010-02-01 00:13 . 2009-05-09 21:19 -------- d-----w- c:\program files\Messenger Plus! Live
2010-01-25 22:12 . 2010-01-25 22:12 -------- d-----w- c:\documents and settings\Admin\Application Data\Apple Computer
2010-01-24 22:32 . 2009-08-27 20:37 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2010-01-23 09:22 . 2009-11-09 22:55 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-23 00:26 . 2010-01-23 00:22 -------- d-----w- c:\program files\TmNationsForever
2010-01-13 00:01 . 2010-01-13 00:01 836464 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\SecurityScan_Release.exe
2010-01-13 00:01 . 2010-01-13 00:01 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-01-05 09:47 . 2008-10-11 18:49 841216 ----a-w- c:\windows\system32\wininet.dll
2010-01-05 09:47 . 2008-10-11 17:58 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:47 . 2008-10-11 17:57 17408 ----a-w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2008-04-15 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-23 23:12 . 2009-12-23 23:12 0 ----a-w- c:\windows\nsreg.dat
2009-12-22 18:39 . 2008-10-11 18:00 922112 ----a-w- c:\windows\system32\imapi2fs.dll
2009-12-22 18:39 . 2008-10-11 18:00 426496 ----a-w- c:\windows\system32\imapi2.dll
2009-12-17 07:41 . 2009-03-15 12:02 343552 ----a-w- c:\windows\system32\mspaint.exe
2008-04-15 12:00 . 2008-04-15 12:00 1384479 --sh--r- c:\windows\system32\msvbvm60.dll
.

------- Sigcheck -------

[-] 2008-10-11 . 86F480D49A1AAA5E3A97B1D8C516B483 . 557056 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2008-10-11 . D1EB9389DFAA944F6B67CE68C41BD1E1 . 647680 . . [5.82] . . c:\windows\system32\comctl32.dll

[-] 2008-10-11 . 656F625D1CC2274E97F19EDBB438892F . 579072 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2008-10-11 . 021B5155C3D4D9359548C05434FAF33E . 1589760 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[-] 2008-10-11 . CBC8C36E4610EE06EBEBBEC153364B52 . 40960 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

c:\windows\System32\wscntfy.exe ... is missing !!
c:\windows\System32\schedsvc.dll ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}]
2010-02-18 21:50 2349080 ----a-w- c:\program files\Free_Lunch_Design\tbFre1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}"= "c:\program files\Free_Lunch_Design\tbFre1.dll" [2010-02-18 2349080]

[HKEY_CLASSES_ROOT\clsid\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC}"= "c:\program files\Free_Lunch_Design\tbFre1.dll" [2010-02-18 2349080]

[HKEY_CLASSES_ROOT\clsid\{57cc715d-37ca-44e4-9ec2-8c2cbddb25ec}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TopDesk"="c:\program files\TopDesk\topdesk.exe" [2007-11-14 1912832]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-18 39408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2006-12-08 1253888]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 1449984]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2010-02-08 2343632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"Visual Task Tips"="c:\program files\Visual Task Tips\Visual Task Tips.exe" [2006-05-28 36864]
"VistaDrive"="c:\windows\VistaDrive\VistaDrive.exe" [2006-10-05 280779]
"ULiRaid"="c:\program files\ULi5287\ULi5287.exe" [2005-08-23 409600]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-15 148888]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"nwiz"="nwiz.exe" [2007-09-16 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-16 81920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-16 8491008]
"IObit Security 360"="c:\program files\IObit\IObit Security 360\IS360tray.exe" [2009-09-02 1216272]
"FLMOFFICE4DMOUSE"="c:\program files\Office Mouse\moffice.exe" [2009-03-15 806912]
"emMonitor"="c:\windows\emMon.exe" [2005-01-06 32768]
"ASUSGamerOSD"="c:\program files\ASUS\GamerOSD\GamerOSD.exe" [2007-09-13 380928]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-10-11 40960]
"TopDesk"="c:\program files\TopDesk\topdesk.exe" [2007-11-14 1912832]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2006-12-08 1253888]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"_nltide_3"="advpack.dll" [2010-01-05 124928]

c:\documents and settings\Admin\Start Menu\Programlar\BaŸlang‡\
HDDlife.lnk - c:\program files\BinarySense\HDDlife 3\HDDlifePro.exe [2009-8-19 2252440]

c:\documents and settings\All Users\Start Menu\Programlar\BaŸlang‡\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
2009-03-15 12:07 210168 ----a-w- c:\program files\Stardock\Object Desktop\WindowBlinds\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"sdCoreService"=2 (0x2)
"sdAuxService"=2 (0x2)
"LexBceS"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Opera\\opera.exe"=

R0 m5287;m5287;c:\windows\system32\drivers\m5287.sys [11.10.2008 21:02 101120]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [24.02.2010 01:35 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [24.02.2010 01:35 20560]
R2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [26.01.2010 00:29 305936]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [27.08.2009 22:37 210216]
R3 ULI5261XP;ULi M526X Ethernet NT Driver;c:\windows\system32\drivers\ULILAN51.SYS [15.03.2009 17:24 28672]
S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [15.03.2009 14:06 717296]
S1 vcdrom;Virtual CD-ROM Device Driver;\??\c:\program files\System\CPL Bonus\Vcdrom.sys --> c:\program files\System\CPL Bonus\Vcdrom.sys [?]
S2 gupdate1c9c418910addfc;Google Güncelleme Hizmeti (gupdate1c9c418910addfc);c:\program files\Google\Update\GoogleUpdate.exe [23.04.2009 15:36 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{34A19196-274E-4D75-9D30-D7A45A0A4178}]
2004-08-03 15:07 11776 ----a-w- c:\program files\Windows Sidebar\regsvr32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6B9228DA-9C15-419e-856C-19E768A13BDC}]
2004-08-03 15:07 11776 ----a-w- c:\program files\Windows Sidebar\regsvr32.exe
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: {D735FC3A-B009-4991-84AD-B8C422D970CA} = 208.67.222.222,208.67.220.220
Handler: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - c:\program files\Common Files\BinarySense\hlAPP.dll
DPF: {0FC8B38E-9293-424C-9D0E-CE60775679CF} - hxxps://sube.garanti.com.tr/lib/JaguarEditControl.CAB
DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} - hxxp://picasaweb.google.com.tr/s/v/56.29/uploader2.cab
FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\spyxnbdq.default\
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.plusnetwork.com
FF - plugin: c:\program files\Google\Google Updater\2.4.1851.5542\npCIDetect14.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

BHO-{9133C0FE-F3E9-407A-B8A7-DC276A9A0EDA} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKU-Default-Run-LClock - c:\program files\LClock\LClock.exe
ActiveSetup-{D58F39FF-953E-4F45-898F-59F243B9A523} - c:\windows\system32\hidec

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net
Rootkit scan 2010-03-17 02:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(668)
c:\windows\system32\SETUPAPI.dll
c:\windows\SYSTEM32\Ati2evxx.dll
c:\windows\SYSTEM32\cscui.dll
c:\program files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll
c:\windows\SYSTEM32\COMRes.dll

- - - - - - - > 'lsass.exe'(724)
c:\windows\system32\SETUPAPI.dll
.
Completion time: 2010-03-17 02:13:56
ComboFix-quarantined-files.txt 2010-03-17 00:13

Pre-Run: 32.946.921.472 bayt boş
Post-Run: 32.965.197.824 bayt boş

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - E6839249E42956C0950EDEBBF8CAC225
sımdıden tsk ederım

mkrts

Yüzbaşı

685 Mesaj

HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+ (475. sayfa)