quote:

Orjinalden alıntı: serji

Fixten sonra yeniden baslatip bir log daha gonder cnku sistemde Trojan var

Dilimin ucunda hani, elimi uzatsam tutucakmıssın gibi...
Ama olmuyor, geri dolmuyor, nefes almıyor artık ben gibi...
Bir anlamı yok artık yaşmanın, tabi buna yaşam denilirse...
İnsan bazen iç çekiyor, keşke her giden...Geri dönse...

quote:

Orjinalden alıntı: Yuni

quote:

Orjinalden alıntı: peterfamilyguy

quote:

Orjinalden alıntı: peterfamilyguy

ComboFix 08-10-10.09 - Panturk 2008-10-11 16:44:00.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1254.1.1033.18.1473 [GMT 3:00]
Running from: C:\Documents and Settings\Panturk\Desktop\ComboFix.exe
 * Created a new restore point

[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\SkypeComm.dll
C:\WINDOWS\system32\wshell.dll
C:\WINDOWS\winhelp.ini

.
(((((((((((((((((((((((((   Files Created from 2008-09-11 to 2008-10-11  )))))))))))))))))))))))))))))))
.

2008-10-10 21:20 . 2008-10-10 21:20	<DIR>	d--------	C:\Documents and Settings\Panturk\Application Data\Leadertech
2008-10-04 23:32 . 2007-04-15 00:05	991,232	--a------	C:\WINDOWS\system32\imageviewer2.ocx
2008-10-04 23:32 . 2000-05-22 00:00	608,448	--a------	C:\WINDOWS\system32\comctl32.ocx
2008-10-04 23:32 . 2004-03-08 23:00	224,016	--a------	C:\WINDOWS\system32\tabctl32.ocx
2008-10-04 23:32 . 1996-01-12 00:00	200,704	--a------	C:\WINDOWS\system32\threed32.ocx
2008-10-04 23:32 . 1998-06-24 00:00	164,144	--a------	C:\WINDOWS\system32\comct232.ocx
2008-10-04 23:32 . 1999-09-16 09:04	151,552	--a------	C:\WINDOWS\system32\ccrpfd6.ocx
2008-10-04 23:32 . 2000-05-01 23:02	110,592	--a------	C:\WINDOWS\system32\ccrpbds6.dll
2008-10-04 23:32 . 2000-07-09 18:15	106,496	--a------	C:\WINDOWS\system32\mbprgbar.ocx
2008-10-04 23:27 . 2008-10-04 23:27	<DIR>	d--------	C:\WINDOWS\Downloaded Installations
2008-10-01 22:33 . 2008-10-01 22:33	47,784	--a------	C:\Documents and Settings\Panturk\Application Data\GDIPFONTCACHEV1.DAT
2008-09-16 21:25 . 2008-09-16 21:25	<DIR>	d--------	C:\Documents and Settings\Panturk\Application Data\TuneUp Software
2008-09-16 21:25 . 2008-09-16 21:25	306,432	--a------	C:\WINDOWS\system32\TuneUpDefragService.exe
2008-09-16 21:25 . 2007-12-20 10:41	29,440	--a------	C:\WINDOWS\system32\uxtuneup.dll
2008-09-16 21:24 . 2008-09-16 21:24	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-09-12 21:54 . 2008-09-12 21:57	<DIR>	d--------	C:\WINDOWS\NV3964676.TMP
2008-09-12 21:16 . 2008-09-12 21:16	<DIR>	dr-h-----	C:\Documents and Settings\Panturk\Application Data\SecuROM
2008-09-12 21:15 . 2008-09-12 23:07	669,184	--a------	C:\WINDOWS\system32\pbsvc.exe
2008-09-12 17:54 . 2003-03-19 06:14	499,712	--a------	C:\WINDOWS\system32\msvcp71.dll

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-11 13:48	---------	d-----w	C:\Program Files\cFosSpeed
2008-10-11 13:44	---------	d-----w	C:\Documents and Settings\Panturk\Application Data\DMCache
2008-10-11 12:35	24,944	----a-w	C:\WINDOWS\system32\drivers\GVTDrv.sys
2008-10-11 12:33	16,608	----a-w	C:\WINDOWS\gdrv.sys
2008-10-10 18:17	---------	d-----w	C:\Documents and Settings\Panturk\Application Data\LimeWire
2008-10-02 00:35	---------	d-----w	C:\Documents and Settings\Panturk\Application Data\Yahoo!
2008-10-02 00:35	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-09-16 18:23	---------	d-----w	C:\Program Files\Common Files\Wise Installation Wizard
2008-09-12 20:07	22,328	----a-w	C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-09-12 20:07	22,328	----a-w	C:\Documents and Settings\Panturk\Application Data\PnkBstrK.sys
2008-09-01 15:05	---------	d-----w	C:\Documents and Settings\Panturk\Application Data\Hamachi
2008-09-01 12:10	---------	d--h--w	C:\Program Files\InstallShield Installation Information
2008-08-31 22:04	---------	d-----w	C:\Program Files\Messenger Plus! Live
2008-08-31 22:03	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-19 22:57	---------	d-----w	C:\Documents and Settings\Panturk\Application Data\uTorrent
2008-08-18 19:01	---------	d-----w	C:\Program Files\Gigabyte
2008-08-16 19:20	---------	d-----w	C:\Documents and Settings\Panturk\Application Data\InterVideo
2008-08-16 19:18	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-16 19:17	---------	d-----w	C:\Program Files\InterVideo Information Service
2008-08-16 19:17	---------	d-----w	C:\Program Files\Common Files\Ulead
2008-08-16 19:16	---------	d-----w	C:\Program Files\InterVideo
2008-08-16 19:16	---------	d-----w	C:\Program Files\Common Files\InterVideo
2008-08-16 19:16	---------	d-----w	C:\Documents and Settings\All Users\Application Data\InstallShield
2008-08-16 19:15	---------	d-----w	C:\Program Files\Common Files\InstallShield
2008-08-14 22:32	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-14 21:22	---------	d-----w	C:\Program Files\Bret Taylor
2008-08-14 21:22	---------	d-----w	C:\Documents and Settings\Panturk\Application Data\Bret Taylor
2008-05-12 18:57	32,768	--sha-w	C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008051220080513\index.dat
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2007-12-13 1688872]
"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-13 68856]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [2008-06-21 2594224]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"Stickies"="C:\Program Files\Bret Taylor\Stickies\\Stickies.exe" [2007-03-14 335872]
"SkinClock"="E:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe" [2008-09-18 529408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 36864]
"36X Raid Configurer"="C:\WINDOWS\system32\JMRaidSetup.exe" [2007-02-06 1953792]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]
"iTunesHelper"="E:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="E:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 2213160]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"cFosSpeed"="C:\Program Files\cFosSpeed\cFosSpeed.exe" [2008-02-14 863448]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 36352]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 413696]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-05-09 1443072]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-03-20 213936]
"EasyTuneVPro"="C:\Program Files\Gigabyte\ET5Pro\ETcall.exe" [2007-07-26 20480]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe]

C:\Documents and Settings\Panturk\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
"msacm.divxa32"= msaud32_divx.acm
"msacm.ac3filter"= ac3filter.acm

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages	REG_MULTI_SZ   	msv1_0 nwprovau

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"E:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"E:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"E:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=

R1 nltdi;nltdi;C:\WINDOWS\system32\drivers\nltdi.sys [2007-04-23 82200]
R2 NwSapAgent;SAP Agent;C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 PD91Agent;PD91Agent;C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe [2008-04-16 689416]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R3 GVTDrv;GVTDrv;C:\WINDOWS\system32\Drivers\GVTDrv.sys [2008-10-11 24944]
R3 MarkFun_NT;MarkFun_NT;C:\Program Files\Gigabyte\ET5Pro\markfun.w32 [2007-08-21 17912]
S2 GEST Service;GEST Service for program management.;C:\Program Files\Gigabyte\EnergySaver\GSvr.exe [2008-07-18 80392]
S3 PD91Engine;PD91Engine;C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe [2008-04-16 894216]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-09-16 306432]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd385391-e70f-11dc-a9a3-001a4d461f82}]
\Shell\AutoRun\command - D:\Autorun.exe

*Newly Created Service* - MARKFUN_NT
.
Contents of the 'Scheduled Tasks' folder

2008-09-16 C:\WINDOWS\Tasks\1-Click Maintenance.job
- E:\Program Files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 15:17]

2008-10-02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-10-11 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Panturk\Application Data\Mozilla\Firefox\Profiles\z37unot0.default\
FF -: plugin - C:\Program Files\Adobe\Acrobat 5.0\Reader\Browser\nppdf32.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npdjvu.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\npdjvu.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\nppl3260.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\nprpjplug.dll
FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
FF -: plugin - E:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - e:\Program Files\Real Alternative\browser\plugins\nppl3260.dll
FF -: plugin - e:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista -