Üye Girişi
Bağlan Google+ ile Bağlan Facebook ile Bağlan
Yeni Kayıt
Tüm Forumlar
  • Tüm Forumlar
  • İşletim Sistemleri ve Yazılımlar
  • Yazılım Genel
  • Güvenlik Programları
  • Bu Konuda
Şimdi Ara

HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+ (286. sayfa)

Sıcak Fırsatlarda Tıklananlar
Editörün Seçtiği Fırsatlar
Daha Fazla
Bu Konudaki Kullanıcılar: Daha Az
3 Misafir - 3 Masaüstü
5 sn
9.878
Cevap
17
Favori
1.234.443
Tıklama
Daha Fazla
İstatistik
  • Konu İstatistikleri Yükleniyor
Konuya Özel
0 oy
Öne Çıkar
Cevapla
Sayfa: önceki 284285286287288
Sayfaya Git
Git
sonraki
Giriş
Mesaj
  • quote:

    Orjinalden alıntı: manve_13

    işte

    Soruyn cozulmus gozukuyor.
  • sildim simdi ne yapayım
  • Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:31:13, on 02.11.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16735)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\Gold\Desktop\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
    O1 - Hosts: 65.54.239.80 dp.msnmessenger.akadns.net
    O2 - BHO: Game.OS - {3A303EF6-2598-4D2D-B4DA-DEFA7CD0DC51} - C:\WINDOWS\system32\ifsndu.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) -http://musicmix.messenger.msn.com/Medialogic.CAB
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) -http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe



    Hocam Çok Acil ..!




  • quote:

    Orjinalden alıntı: burakarca

    sildim simdi ne yapayım



    quote:

    Orjinalden alıntı: pc.kopat
    Hocam Çok Acil ..!

    * HijackThis adlı programı açın.
    * Do a system scan only seçeneğine tıklayın.
    * Aşağıdaki satırları işaretleyin. 

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
      O1 - Hosts: 65.54.239.80 dp.msnmessenger.akadns.net 
      O2 - BHO: Game.OS - {3A303EF6-2598-4D2D-B4DA-DEFA7CD0DC51} - C:\WINDOWS\system32\ifsndu.dll 
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll 
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
      O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll  
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
      O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll 
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll 
      O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL  
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    * CTRL+ALT+DEL basıp işlemler sekmesine gelin. Kullanıcı Adınızın karşısındaki HijackThis.exe ve explorer.exe hariç tüm işlemleri sonlandırın. HijackThis hariç tüm programları, pencereleri kapatın ve Fix Checked butonuna tıklayın. Ardından bilgisayarınızı hemen yeniden başlatın.

    Combofix adli programi indirin.

    http://www.guvenlikuzmanim.com/dosyalar/ComboFix.exe

    1. Tüm açık pencerelerinizi ve programlarınızı kapatın.
    2. Antivirüs ve Antispyware programlarınızı geçici olarak kapatın veya devre dışı bırakın.
    3. ComboFix.exe üzerine çift tıklayın ve programı açın. Programı açtıktan sonra kesinlikle hiç bir işlem yapmayın. 1-2 dakikalık bir mola verin.
    4. ComboFix çalışmaya başladıktan sonra sizden 1 ya da 2 tuşuna basmanız istenecektir. Devam etmek için 1 tuşuna basın.
    5. ComboFix olası bir aksilik durumunda sistemizi geri yükleyebilmek amacıyla Kayıt Defterinizin bir yedeğini alacak ve bir sistem geri yükleme noktası oluşturacaktır.
    6. Bu işlemler sırasında internet bağlantınız kesilecektir. Bu normaldir. Ayrıca sistem saatiniz de değişecektir. Fakat tüm bunlar geçicidir. İşlemler bittikten sonra hepsi orjinal haline geri döndürülecektir.
    7. Biraz sabırlı olmanız gerekebilir çünkü tam 41 aşama söz konusudur.
    8. Son olarak ComboFix işlemlerin sonucunu içeren bir rapor hazırlayacaktır. Bu sırada masaüstünüz kaybolabilir. Fakat kısa sürede geri yüklenecektir. İşlemler bittikten sonra ComboFix kapanacak ve size bir rapor açılacaktır. Bu raporu C:\ComboFix.txt bulabilirsiniz.
    9. C:\ComboFix.txt dosyasını mesajınıza ekleyerek bize gönderin.




  • ComboFix 08-11-01.04 - Gold 2008-11-02 12:32:18.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1254.1.1055.18.713 [GMT 2:00]
    Running from: C:\Documents and Settings\Gold\Desktop\ComboFix.exe
    * Created a new restore point
    * Resident AV is active


    [COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Gold\Sık Kullanılanlar\Cheap Pharmacy Online.url
    C:\WINDOWS\OPTIONS\CABS\_desktop.ini

    .
    ((((((((((((((((((((((((( Files Created from 2008-10-02 to 2008-11-02 )))))))))))))))))))))))))))))))
    .

    2008-11-02 11:56 . 2008-11-02 11:56 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
    2008-11-02 11:56 . 2008-11-02 11:56 <DIR> d-------- C:\Documents and Settings\Gold\Application Data\SUPERAntiSpyware.com
    2008-11-02 11:56 . 2008-11-02 11:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
    2008-11-02 11:05 . 2008-11-02 11:05 <DIR> d-------- C:\Documents and Settings\Gold\Application Data\Malwarebytes
    2008-11-02 11:05 . 2008-11-02 11:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-11-02 10:50 . 2008-11-02 11:22 <DIR> d-------- C:\spywarebegone
    2008-11-02 10:50 . 2008-11-02 10:50 724,992 --a------ C:\WINDOWS\iun6002.exe
    2008-11-02 10:50 . 2008-11-02 10:50 2 --a------ C:\WINDOWS\spywarebegone-fullversion-installed.html
    2008-11-02 01:43 . 2008-11-02 11:20 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
    2008-11-02 01:37 . 2008-11-02 01:37 <DIR> d-------- C:\Program Files\Alwil Software
    2008-11-01 23:58 . 2008-11-01 23:58 <DIR> d-------- C:\Program Files\Lavasoft
    2008-11-01 23:58 . 2008-11-02 11:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-11-01 23:35 . 2008-10-03 19:02 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
    2008-11-01 23:35 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-11-01 23:35 . 2007-03-08 07:12 1,015,808 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-11-01 23:35 . 2008-08-26 10:11 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-11-01 23:35 . 2008-08-26 10:11 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-11-01 23:35 . 2008-08-26 10:11 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
    2008-11-01 23:35 . 2008-08-26 10:11 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
    2008-11-01 23:35 . 2008-08-26 10:11 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-11-01 23:35 . 2008-08-25 10:38 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-11-01 23:16 . 2008-11-01 23:16 121 --a------ C:\WINDOWS\bdagent.INI
    2008-11-01 21:46 . 2008-11-01 23:16 81,984 --a------ C:\WINDOWS\system32\bdod.bin
    2008-11-01 21:43 . 2008-11-01 23:21 <DIR> d-------- C:\Program Files\BitDefender
    2008-10-30 23:43 . 2008-10-30 23:43 <DIR> dr-h----- C:\Documents and Settings\Gold\Application Data\SecuROM
    2008-10-30 23:36 . 2008-03-05 15:56 3,786,760 --a------ C:\WINDOWS\system32\D3DX9_37.dll
    2008-10-30 23:36 . 2008-03-05 15:56 1,420,824 --a------ C:\WINDOWS\system32\D3DCompiler_37.dll
    2008-10-30 23:36 . 2008-03-05 16:03 479,752 --a------ C:\WINDOWS\system32\XAudio2_0.dll
    2008-10-30 23:36 . 2008-02-05 23:07 462,864 --a------ C:\WINDOWS\system32\d3dx10_37.dll
    2008-10-30 23:36 . 2008-03-05 16:03 238,088 --a------ C:\WINDOWS\system32\xactengine3_0.dll
    2008-10-30 23:36 . 2008-03-05 16:00 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_3.dll
    2008-10-30 23:34 . 2008-10-30 23:34 <DIR> d-------- C:\WINDOWS\system32\AGEIA
    2008-10-30 23:34 . 2008-11-02 11:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-10-30 23:34 . 2008-10-30 23:35 <DIR> d-------- C:\Program Files\AGEIA Technologies
    2008-10-30 23:19 . 2008-10-30 23:19 <DIR> d-------- C:\Documents and Settings\Gold\Application Data\2K Sports
    2008-10-29 20:25 . 2008-10-29 20:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\KONAMI
    2008-10-29 19:54 . 2008-10-29 19:54 223,128 --a------ C:\WINDOWS\system32\drivers\dtscsi.sys
    2008-10-28 20:02 . 2008-10-28 20:02 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
    2008-10-24 20:18 . 2008-10-15 18:36 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
    2008-10-23 23:35 . 2008-10-23 23:36 <DIR> d-------- C:\Program Files\Total Video Converter
    2008-10-23 23:35 . 2000-05-22 21:58 608,448 --a------ C:\WINDOWS\system32\comctl32.ocx
    2008-10-17 20:39 . 2008-10-31 00:34 <DIR> d-------- C:\Program Files\Windows Media Connect 2
    2008-10-17 20:39 . 2004-08-03 23:45 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2008-10-15 12:52 . 2008-08-14 15:23 2,191,104 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
    2008-10-15 12:52 . 2008-08-14 15:23 2,147,328 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
    2008-10-15 12:52 . 2008-08-14 15:23 2,067,968 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
    2008-10-15 12:52 . 2008-08-14 15:23 2,025,984 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
    2008-10-15 12:51 . 2008-09-08 12:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
    2008-10-15 12:50 . 2008-09-15 17:25 1,846,400 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
    2008-10-12 15:10 . 2008-10-12 15:10 <DIR> d-------- C:\Program Files\Common Files\Nullsoft
    2008-10-09 10:41 . 2008-10-09 10:41 3,932,214 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
    2008-10-09 10:39 . 2008-10-09 10:40 <DIR> d-------- C:\WINDOWS\Packs
    2008-10-09 10:34 . 2008-10-09 10:34 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-10-31 11:12 --------- d-----w C:\Program Files\Microsoft IntelliPoint
    2008-10-29 17:44 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
    2008-09-21 13:24 --------- d-----w C:\Program Files\Microsoft IntelliType Pro
    2008-09-20 20:37 --------- d-----w C:\Program Files\Foxit Software
    2008-09-15 15:25 1,846,400 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-09-12 20:25 --------- d-----w C:\Program Files\Messenger Plus! Live
    2008-09-12 20:25 --------- d-----w C:\Program Files\Circle Developement
    2008-09-10 22:39 --------- d-----w C:\Program Files\Java
    2008-09-10 22:38 --------- d-----w C:\Program Files\Common Files\Java
    2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
    2008-08-26 08:11 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-08-14 13:23 2,147,328 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
    2008-08-14 13:23 2,025,984 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 1506544]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-16 8491008]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^Gold^Start Menu^Programlar^Başlangıç^Adobe Gamma.lnk]
    path=C:\Documents and Settings\Gold\Start Menu\Programlar\Başlangıç\Adobe Gamma.lnk
    backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup

    [HKLM\~\startupfolder\C:^Documents and Settings^Gold^Start Menu^Programlar^Başlangıç^Ey DSL! 2.0.lnk]
    path=C:\Documents and Settings\Gold\Start Menu\Programlar\Başlangıç\Ey DSL! 2.0.lnk
    backup=C:\WINDOWS\pss\Ey DSL! 2.0.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    --a------ 2005-12-10 16:57 133016 E:\Deamon Tools\DAEMON Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
    --a------ 2007-12-13 18:10 1688872 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
    --a------ 2004-06-03 10:50 204800 C:\Program Files\Microsoft IntelliPoint\point32.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    --a------ 2007-03-01 13:57 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    --a------ 2007-09-16 19:07 81920 C:\WINDOWS\system32\nvmctray.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2008-09-11 00:39 77824 C:\Program Files\Java\jre1.6.0\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\type32]
    --a------ 2004-06-03 10:51 172032 C:\Program Files\Microsoft IntelliType Pro\type32.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
    --a------ 2008-04-14 08:00 110592 C:\WINDOWS\system32\bthprops.cpl

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Shenturk\\Ey DSL! 2.0\\JdxWeb.exe"=
    "C:\\WINDOWS\\system32\\ftp.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "E:\\Pes 2009\\pes2009.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

    R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2007-12-21 33800]
    S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys [2004-09-07 17664]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{36c5184a-707c-11dd-99f4-001a4d9d287a}]
    \Shell\AutoRun\command - J:\autorun_PES2008.exe

    *Newly Created Service* - CATCHME
    *Newly Created Service* - PROCEXP90
    .
    - - - - ORPHANS REMOVED - - - -

    Notify-WgaLogon - (no file)


    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Gold\Application Data\Mozilla\Firefox\Profiles\el9tfzo0.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com.tr
    FF -: plugin - C:\Program Files\Java\jre1.6.0\bin\npjava11.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0\bin\npjava12.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0\bin\npjava13.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0\bin\npjava14.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0\bin\npjava32.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0\bin\npoji610.dll
    FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
    FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net
    Rootkit scan 2008-11-02 12:33:33
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-11-02 12:34:18
    ComboFix-quarantined-files.txt 2008-11-02 10:34:07

    Pre-Run: 25.950.621.696 bayt boş
    Post-Run: 29,823,041,536 bayt boş

    172 --- E O F --- 2008-11-01 21:35:50



    Buyurun ;)




  • Burak Bey bailgisayarım eskisi gibi hızlı ve seri değil ; sizden ricam bana yol göstermenizdir, şimdiden teşekkürler...

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:27:46, on 02.11.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\ATKKBService.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\VMSnap3.EXE
    C:\WINDOWS\Domino.EXE
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\AdVantage\AdVantage.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://tr.msn.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
    O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.EXE
    O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.EXE
    O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html
    O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1214300563859
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://www.ktunnel.com/index.php/1010111A/5a982088c3ee9859419690366e92a8cd522b27a5dc2641eddbba4bb6f8aeab4b79adec28ece83830fd895fdc0d25bda1c3f3f4dde847d974eed5a52de45c309e5d3af016288
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = cc.metu.edu.tr,metu.edu.tr
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = cc.metu.edu.tr,metu.edu.tr
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = cc.metu.edu.tr,metu.edu.tr
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 7080 bytes




  • quote:

    Orjinalden alıntı: pc.kopat
    Buyurun ;)

    Perlovga Removal Tool adlı programı masaüstünüze indirin.

    http://www.guvenlikuzmanim.com/dosyalar/perlovga.exe

    Programı çalıştırıp Start tıklayın. Daha sonra bilgisayarınızı zaman kaybetmeden yeniden başlatın.

    SuperAntiSpyware adlı programı indirip kurun.

    http://www.superantispyware.com/downloads/SUPERAntiSpyware.exe

    * SUPERAntiSypware.exe çift tıklayın ve programı varsayılan ayarlarıyla kurun.
    * Masaüstünüzde programın ikonu oluşacaktır. Programı çalıştırmak için ikona çift tıklayın.
    * Eğer güncellemeniz için soru sorarsa Evet tıklayın. Eğer sormazsa, taratmadan önce kendiniz Check for Updates butonuna tıklayarak güncelleştirin.
    * Configuration and Preferences sekmesi altında Preferences butonuna tıklayın.
    * General and Startup sekmesine tıklayın ve Start-up Options altında Start SUPERAntiSpyware when Windows starts seçeneğinin seçili olmadığından emin olun.
    * Scanning Control sekmesine gelin ve Scanner Options altında yalnızca aşağıdakilerin işaretli olduğundan emin olun. (Diğerlerini işaretsiz bırakın.)

    # Close browsers before scanning.
    # Scan for tracking cookies.
    # Terminate memory threats before quarantining.
    * Close butonuna tıklayarak programı kapatın.
    * Henüz sisteminizi taratmayın.

    Şimdi tekrar programı çalıştırın:

    * Ana menüde Scan for Harmful Software altında Scan your computer tıklayın.
    * Sol tarafta C:\Fixed Drive işaretli olduğundan emin olun.
    * Sağ tarafta Complete Scan altında Perform Complete Scan seçin ve Next tıklayın.
    * Tarama işlemi bittikten sonra zararlı yazılımları içeren bir tarama özeti açılacak. OK tıklayın.
    * Herşeyin işaretli olduğundan emin olun ve Next tıklayın.
    * Quarantine and Removal is Complete şeklinde bir uyarı alacaksınız. OK tıklayın ve ana menüye dönmek için Finish tıklayın.
    * Eğer yeniden başlatmanız gerektiği söylenirse, Yes tıklayıp bilgisayarınızı yeniden başlatın.
    * İşlem sonuçlarını öğrenmek için:
    # Preferences tıklayın ve Statistics/Logs sekmesine gelin.
    # Scanner Logs altında SUPERAntiSpyware Scan Log çift tıklayın.
    # Eğer birden fazla log varsa, güncel olanı seçin ve View log tıklayın. Bir yazı dosyası açılacaktır.
    # Açılan dosyayı kaydedip mesajınıza ekleyerek bize gönderin.
    * Close tıklayarak programı kapatın.


    quote:

    Orjinalden alıntı: dt_emn

    Burak Bey bailgisayarım eskisi gibi hızlı ve seri değil ; sizden ricam bana yol göstermenizdir, şimdiden teşekkürler...

    Tabi ki liste asagida klay eglsin. 

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://tr.msn.com/ 
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local 
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll 
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll 
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
      O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
      O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll 
      O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll 
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"  
      O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.EXE 
      O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.EXE 
      O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)  
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe  
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
      O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe 
      O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\googletoolbar.dll/cmsearch.html 
      O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\googletoolbar.dll/cmbacklinks.html 
      O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\googletoolbar.dll/cmcache.html 
      O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 
      O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\googletoolbar.dll/cmsimilar.html 
      O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\googletoolbar.dll/cmtrans.html 
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll 
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll 
      O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL  
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe



    < Bu mesaj bu kişi tarafından değiştirildi serji -- 2 Kasım 2008; 15:16:43 >




  • slm iyi çalışmalar.sana daha önce msj attım ama cvp alamadım ve işin ilginç tarafı yolladığım msjı forumda da göremiyorum.avast4,8home edition kullanıyorum,pc de system32 de CKVO0.DLL isimli bir şey buluyor tavsiyeleri karantina,sil yada yoksay oluyor hepsini sırayla yapmama rağmen bu trojan tekrar peydah oluyor.

    log dosyam;

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:50:21, on 31.10.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.20900)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    E:\Program Files\Ad Aware-2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    E:\Program Files\Nero-8\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\SiteAdvisor\6065\SiteAdv.exe
    E:\Program Files\Ad Aware-2007\AAWTray.exe
    C:\Program Files\Elkotek\nanoMeter.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\SiteAdvisor\6065\SAService.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\Program Files\Google\Web Accelerator\googlewebaccclient.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    D:\Belgelerim\Download Programs\HiJackThis.exe
    C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\help.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL =http://localhost:9100/proxy.pac
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6065\SiteAdv.dll
    O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - (no file)
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: (no name) - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - (no file)
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6065\SiteAdv.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6065\SiteAdv.exe
    O4 - HKLM\..\Run: [AAWTray] E:\Program Files\Ad Aware-2007\AAWTray.exe
    O4 - HKLM\..\Run: [ElkotekMonitor] C:\Program Files\Elkotek\nanoMeter.exe
    O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [LClock] C:\Program Files\LClock\LClock.exe (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
    O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
    O8 - Extra context menu item: Microsoft Excel'e &Ver - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: OneNote'a Gönder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: OneNote'a G&önder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - E:\Program Files\Ad Aware-2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - E:\Program Files\Nero-8\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6065\SAService.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

    --
    End of file - 7832 bytes




  • Seçilileri Temizle yerine Seçilileri Kaldır vardı ona tıkladım. Şöyle dedi.

    Tüm Seçili Nesneler Başarı İle Kaldırıldı.Bir Girdi Dosyası Girdiler Klasörünüze Kaydedildi.

    Malwarebytes' Anti-Malware Logu 

     
      Malwarebytes' Anti-Malware 1.30 
      Veritabanı versiyonu: 1306 
      Windows 5.1.2600 Service Pack 3 
       
      02.11.2008 17:31:11 
      mbam-log-2008-11-02 (17-31-11).txt 
       
      Tarama şekli: Derin Tarama (C:\|) 
      Taranmış nesneler: 92783 
      Geçen zaman: 47 minute(s), 15 second(s) 
       
      Etkilenmiş Hafıza İşlemleri: 1 
      Etkilenmiş Hafıza Modülleri: 0 
      Etkilenmiş Kayıt Anahtarları: 0 
      Etkilenmiş Kayıt Değerleri: 1 
      Etkilenmiş Kayıt Veri Dosyaları: 0 
      Etkilenmiş Klasörler: 0 
      Etkilenmiş Dosyalar: 1 
       
      Etkilenmiş Hafıza İşlemleri: 
      C:\Documents and Settings\All Users\Application Data\microsoft\ctfmon.exe (Heuristics.Reserved.Word.Exploit) -> Unloaded process successfully. 
       
      Etkilenmiş Hafıza Modülleri: 
      (Tehlikeli nesne bulunmadı) 
       
      Etkilenmiş Kayıt Anahtarları: 
      (Tehlikeli nesne bulunmadı) 
       
      Etkilenmiş Kayıt Değerleri: 
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully. 
       
      Etkilenmiş Kayıt Veri Dosyaları: 
      (Tehlikeli nesne bulunmadı) 
       
      Etkilenmiş Klasörler: 
      (Tehlikeli nesne bulunmadı) 
       
      Etkilenmiş Dosyalar: 
      C:\Documents and Settings\All Users\Application Data\Microsoft\ctfmon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.



    Ayrıca Hijack This logundakileri de fix checked yapıp bilgisayarı yeniden başlattım.



    < Bu mesaj bu kişi tarafından değiştirildi Sirkadyen -- 2 Kasım 2008; 17:37:52 >




  • quote:

    Orjinalden alıntı: firstknigth

    slm iyi çalışmalar.sana daha önce msj attım ama cvp alamadım ve işin ilginç tarafı yolladığım msjı forumda da göremiyorum.avast4,8home edition kullanıyorum,pc de system32 de CKVO0.DLL isimli bir şey buluyor tavsiyeleri karantina,sil yada yoksay oluyor hepsini sırayla yapmama rağmen bu trojan tekrar peydah oluyor.

    log dosyam;

    Zaten cevaplamistim

    http://forum.donanimhaber.com/m_9478084/mpage_95/key_//tm.htm#27522893


    quote:

    Orjinalden alıntı: WizzY_WizarD

    Seçilileri Temizle yerine Seçilileri Kaldır vardı ona tıkladım. Şöyle dedi.

    Tüm Seçili Nesneler Başarı İle Kaldırıldı.Bir Girdi Dosyası Girdiler Klasörünüze Kaydedildi.

    Malwarebytes' Anti-Malware Logu
    Ayrıca Hijack This logundakileri de fix checked yapıp bilgisayarı yeniden başlattım.

    Hala devam ediyor mu sorunlar? Bir de sorunlari iceren bir alinti yapars misn ilk mesjaindan.




  • saolasin serji
  • quote:

    Orjinalden alıntı: manve_13

    saolasin serji

    rica ederim kolay eglsin.
  • Bilgisayarım bu günlerde acayip yavaşladı+ 2 günde kotam 400mb küsür olmuş bi bakarmısınız acaba,

    Teşekkürler.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:24:43, on 02.11.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
    C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\oodtray.exe
    C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\ZyXEL G-202\ZyXEL G-202.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Opera\opera.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =http://search.imesh.com/sidebar.html?src=ssb
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
    F2 - REG:system.ini: Shell=
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
    O1 - Hosts: 212.175.13.114 youtube.com
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun
    O4 - HKLM\..\Run: [flag loud mp3 bore] C:\Documents and Settings\All Users\Application Data\Phone store flag loud\Gpl Log.exe
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Multi Atom] C:\DOCUME~1\Emre\APPLIC~1\EXTRAG~1\Longwipeglobal.exe
    O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe
    O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: ZyXEL G-202 Wireless Adapter Utility.lnk = ?
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -http://download.bitdefender.com/resources/scan8/oscan8.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
    O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\system32\ZoneLabs\isafe.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5549 bytes




  • quote:

    Orjinalden alıntı: TheRed

    Bilgisayarım bu günlerde acayip yavaşladı+ 2 günde kotam 400mb küsür olmuş bi bakarmısınız acaba,

    Teşekkürler.

    * HijackThis adlı programı açın.
    * Do a system scan only seçeneğine tıklayın.
    * Aşağıdaki satırları işaretleyin. 

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =http://search.imesh.com/sidebar.html?src=ssb 
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
      F2 - REG:system.ini: Shell= 
      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe  
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx 
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll 
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
      O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
      O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll 
      O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll  
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"  
      O4 - HKLM\..\Run: [flag loud mp3 bore] C:\Documents and Settings\All Users\Application Data\Phone store flag loud\Gpl Log.exe  
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe 
      O4 - HKCU\..\Run: [Multi Atom] C:\DOCUME~1\Emre\APPLIC~1\EXTRAG~1\Longwipeglobal.exe 
      O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe 
      O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe 
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')  
      O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm 
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll 
      O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll  
      O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL 
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


    * CTRL+ALT+DEL basıp işlemler sekmesine gelin. Kullanıcı Adınızın karşısındaki HijackThis.exe ve explorer.exe hariç tüm işlemleri sonlandırın. HijackThis hariç tüm programları, pencereleri kapatın ve Fix Checked butonuna tıklayın. Ardından bilgisayarınızı hemen yeniden başlatın.

    Combofix adli programi indirin.

    http://www.guvenlikuzmanim.com/dosyalar/ComboFix.exe

    1. Tüm açık pencerelerinizi ve programlarınızı kapatın.
    2. Antivirüs ve Antispyware programlarınızı geçici olarak kapatın veya devre dışı bırakın.
    3. ComboFix.exe üzerine çift tıklayın ve programı açın. Programı açtıktan sonra kesinlikle hiç bir işlem yapmayın. 1-2 dakikalık bir mola verin.
    4. ComboFix çalışmaya başladıktan sonra sizden 1 ya da 2 tuşuna basmanız istenecektir. Devam etmek için 1 tuşuna basın.
    5. ComboFix olası bir aksilik durumunda sistemizi geri yükleyebilmek amacıyla Kayıt Defterinizin bir yedeğini alacak ve bir sistem geri yükleme noktası oluşturacaktır.
    6. Bu işlemler sırasında internet bağlantınız kesilecektir. Bu normaldir. Ayrıca sistem saatiniz de değişecektir. Fakat tüm bunlar geçicidir. İşlemler bittikten sonra hepsi orjinal haline geri döndürülecektir.
    7. Biraz sabırlı olmanız gerekebilir çünkü tam 41 aşama söz konusudur.
    8. Son olarak ComboFix işlemlerin sonucunu içeren bir rapor hazırlayacaktır. Bu sırada masaüstünüz kaybolabilir. Fakat kısa sürede geri yüklenecektir. İşlemler bittikten sonra ComboFix kapanacak ve size bir rapor açılacaktır. Bu raporu C:\ComboFix.txt bulabilirsiniz.
    9. C:\ComboFix.txt dosyasını mesajınıza ekleyerek bize gönderin.




  • Yazdıklarını Fix Checkledim. Malwarebytes' Anti-Malware logu aşağıda. 

     
       
      Malwarebytes' Anti-Malware 1.30 
      Veritabanı versiyonu: 1306 
      Windows 5.1.2600 Service Pack 3 
       
      02.11.2008 17:31:11 
      mbam-log-2008-11-02 (17-31-11).txt 
       
      Tarama şekli: Derin Tarama (C:\|) 
      Taranmış nesneler: 92783 
      Geçen zaman: 47 minute(s), 15 second(s) 
       
      Etkilenmiş Hafıza İşlemleri: 1 
      Etkilenmiş Hafıza Modülleri: 0 
      Etkilenmiş Kayıt Anahtarları: 0 
      Etkilenmiş Kayıt Değerleri: 1 
      Etkilenmiş Kayıt Veri Dosyaları: 0 
      Etkilenmiş Klasörler: 0 
      Etkilenmiş Dosyalar: 1 
       
      Etkilenmiş Hafıza İşlemleri: 
      C:\Documents and Settings\All Users\Application Data\microsoft\ctfmon.exe (Heuristics.Reserved.Word.Exploit) -> Unloaded process successfully. 
       
      Etkilenmiş Hafıza Modülleri: 
      (Tehlikeli nesne bulunmadı) 
       
      Etkilenmiş Kayıt Anahtarları: 
      (Tehlikeli nesne bulunmadı) 
       
      Etkilenmiş Kayıt Değerleri: 
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully. 
       
      Etkilenmiş Kayıt Veri Dosyaları: 
      (Tehlikeli nesne bulunmadı) 
       
      Etkilenmiş Klasörler: 
      (Tehlikeli nesne bulunmadı) 
       
      Etkilenmiş Dosyalar: 
      C:\Documents and Settings\All Users\Application Data\Microsoft\ctfmon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.




  • slm,cvp msjını birazgeç gördüm kusura bakma SERJI.yazdıklarını harfiyen yaptım,doğrumu yanlışmı yaptım bilmiyoru ama ilk başta yolunda gitmeyen bir şeyler olduğunu tahmin ediyorum.çünkü combofixi çalıştırdıktan sonra 1 yada2 diye bir şey sormadı,update yada upgrade gibi bir şey istedi anlamadım ama TAMAM dedim,komut penceresinin açılmasının ardından,tekrar bir şey sordu ama pencere komut penceresinin altında olduğu için göremedim,onada TAMAM dedim ve bir tane daha komut penceresi açıldı,bir süre sonra pc dondu,restart yaptım,yine 1yada2yi sormadı ama anlayamadığım bir şeyler oldu.boot yaptı, C:\WINDOWS\system32\ckvo0.dll de olan ve bir kaç tane daha buna benzer trojanı komut penceresinde sildi.umarım doğru olmuştur ki İNŞAALLAH olmuştur beni formattan kurtarırsın dostum.çünkü Crysis ve Carbon da ki kariyerlerimi kaybetmek ve onlarca programı tek tek geri yüklemek istemiyorum.tabi senin yardımlarınla.işte combofix-log;

    ComboFix 08-11-02.02 - Administrator 2008-11-02 22:14:42.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1254.1.1055.18.1666 [GMT 2:00]
    Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

    [COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Autorun.inf
    C:\WINDOWS\system32\ckvo.exe
    C:\WINDOWS\system32\ckvo0.dll
    C:\WINDOWS\system32\ckvo1.dll
    C:\WINDOWS\system32\mdhash.dll' C:\WINDOWS\system32\mdhsh.sys
    C:\xih9.cmd
    D:\Autorun.inf
    D:\xih9.cmd
    E:\Autorun.inf
    E:\xih9.cmd

    .
    ((((((((((((((((((((((((( Files Created from 2008-10-02 to 2008-11-02 )))))))))))))))))))))))))))))))
    .

    2008-11-02 19:48 . 2008-11-02 19:48 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\SiteAdvisor
    2008-11-01 00:09 . 2008-11-01 00:09 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
    2008-11-01 00:09 . 2008-10-22 16:27 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-11-01 00:09 . 2008-10-22 16:27 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-11-01 00:08 . 2008-11-01 00:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-10-28 22:43 . 2008-10-30 23:24 <DIR> d-------- C:\Documents and Settings\Administrator\Contacts
    2008-10-28 21:07 . 2008-11-02 12:13 25 --a------ C:\WINDOWS\GECKOS.INI
    2008-10-28 01:22 . 2008-10-28 01:25 <DIR> d--h----- C:\WINDOWS\$hf_mig$
    2008-10-28 00:44 . 2008-10-28 00:44 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
    2008-10-28 00:30 . 2008-10-28 00:43 2,102 --a------ C:\WINDOWS\EXTRADNS.INI
    2008-10-28 00:19 . 2008-10-03 18:22 6,068,224 --------- C:\WINDOWS\system32\dllcache\ieframe.dll
    2008-10-28 00:16 . 2008-05-09 12:55 512,000 --------- C:\WINDOWS\system32\dllcache\jscript.dll
    2008-10-28 00:16 . 2008-05-09 12:55 430,080 --------- C:\WINDOWS\system32\dllcache\vbscript.dll
    2008-10-28 00:16 . 2008-07-07 22:27 253,952 --------- C:\WINDOWS\system32\dllcache\es.dll
    2008-10-28 00:16 . 2008-05-09 12:55 180,224 --------- C:\WINDOWS\system32\dllcache\scrobj.dll
    2008-10-28 00:16 . 2008-05-09 12:55 172,032 --------- C:\WINDOWS\system32\dllcache\scrrun.dll
    2008-10-28 00:16 . 2008-05-08 13:24 155,648 --------- C:\WINDOWS\system32\dllcache\wscript.exe
    2008-10-28 00:16 . 2008-05-09 10:45 135,168 --------- C:\WINDOWS\system32\dllcache\cscript.exe
    2008-10-28 00:16 . 2008-05-09 12:55 90,112 --------- C:\WINDOWS\system32\dllcache\wshext.dll
    2008-10-28 00:15 . 2008-06-20 13:51 361,600 --------- C:\WINDOWS\system32\dllcache\tcpip.sys
    2008-10-28 00:15 . 2008-06-20 19:47 245,760 --------- C:\WINDOWS\system32\dllcache\mswsock.dll
    2008-10-28 00:15 . 2008-06-20 13:08 225,856 --------- C:\WINDOWS\system32\dllcache\tcpip6.sys
    2008-10-28 00:15 . 2008-06-20 19:47 147,968 --------- C:\WINDOWS\system32\dllcache\dnsapi.dll
    2008-10-28 00:15 . 2008-08-14 12:04 138,496 --------- C:\WINDOWS\system32\dllcache\afd.sys
    2008-10-28 00:06 . 2008-09-08 12:41 333,824 --------- C:\WINDOWS\system32\dllcache\srv.sys
    2008-10-28 00:03 . 2008-09-15 17:25 1,846,400 --------- C:\WINDOWS\system32\dllcache\win32k.sys
    2008-10-28 00:01 . 2008-08-14 15:23 2,191,104 --------- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
    2008-10-28 00:01 . 2008-08-14 15:23 2,147,328 --------- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
    2008-10-28 00:01 . 2008-08-14 15:23 2,067,968 --------- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
    2008-10-28 00:01 . 2008-08-14 15:23 2,025,984 --------- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
    2008-10-27 23:53 . 2008-05-08 16:02 203,136 --------- C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-10-27 23:52 . 2008-04-11 21:05 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2008-10-27 23:52 . 2008-05-01 16:35 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
    2008-10-27 23:45 . 2008-10-15 18:36 337,408 --------- C:\WINDOWS\system32\dllcache\netapi32.dll
    2008-10-27 23:18 . 2008-10-28 20:22 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-10-27 23:18 . 2008-10-28 19:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-10-27 23:15 . 1999-12-21 06:58 21,312 --a------ C:\WINDOWS\choice.exe
    2008-10-26 23:20 . 2008-10-26 23:20 <DIR> d-------- C:\Program Files\Elkotek
    2008-10-26 22:27 . 2008-10-26 22:27 268 --ah----- C:\sqmdata05.sqm
    2008-10-26 22:27 . 2008-10-26 22:27 244 --ah----- C:\sqmnoopt05.sqm
    2008-10-26 22:11 . 2008-10-26 22:11 244 --ah----- C:\sqmnoopt04.sqm
    2008-10-26 22:11 . 2008-10-26 22:11 232 --ah----- C:\sqmdata04.sqm
    2008-10-23 22:34 . 2008-10-23 22:34 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Nero
    2008-10-23 22:33 . 2008-10-23 22:34 <DIR> d-------- C:\Program Files\Common Files\Nero
    2008-10-23 22:33 . 2008-10-23 22:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
    2008-10-19 22:34 . 2008-10-19 22:34 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\TeamViewer
    2008-10-19 22:23 . 2008-10-19 22:30 <DIR> d-------- C:\Documents and Settings\Administrator\Mursit4
    2008-10-19 18:06 . 2008-10-30 22:40 <DIR> d-------- C:\Program Files\ComboMax
    2008-10-08 00:49 . 2008-10-08 00:49 <DIR> d-------- C:\WINDOWS\system32\NtmsData
    2008-10-02 18:47 . 2008-10-02 18:47 <DIR> d-------- C:\Program Files\NCH Swift Sound
    2008-10-02 18:43 . 2008-10-02 18:43 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sonic Foundry
    2008-10-02 18:43 . 2001-10-19 14:40 1,683,792 --a------ C:\WINDOWS\system32\wmvcore2.dll
    2008-10-02 18:43 . 2001-10-19 14:40 665,424 --a------ C:\WINDOWS\system32\wmv8dmoe.dll
    2008-10-02 18:43 . 2002-10-09 12:21 566,272 --a------ C:\WINDOWS\system32\wmvdmoe.dll
    2008-10-02 18:43 . 2001-10-19 14:40 438,608 --a------ C:\WINDOWS\system32\wmv8dmod.dll
    2008-10-02 18:43 . 2001-10-19 02:05 285,184 --a------ C:\WINDOWS\system32\wmidx2.ocx
    2008-10-02 18:43 . 2008-10-02 18:43 156,910 --a------ C:\WINDOWS\WMSysPr8.prx
    2008-10-02 18:19 . 1997-11-19 14:49 303,616 --a------ C:\WINDOWS\IsUninst.exe
    2008-10-02 17:39 . 2008-10-02 17:39 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
    2008-10-02 17:35 . 2008-10-27 19:53 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-10-02 17:35 . 2008-10-02 17:35 1,409 --a------ C:\WINDOWS\QTFont.for

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-11-02 14:22 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-10-30 21:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-10-27 16:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-10-27 16:54 --------- dc-h--w C:\Documents and Settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
    2008-10-26 20:11 --------- d-----w C:\Program Files\MSN Messenger
    2008-10-26 20:11 --------- d-----w C:\Program Files\Messenger Plus! Live
    2008-10-23 21:04 --------- d-----w C:\Documents and Settings\Administrator\Application Data\SiteAdvisor
    2008-10-05 09:51 --------- d-----w C:\Program Files\Google
    2008-09-29 18:51 --------- d--h--r C:\Documents and Settings\Administrator\Application Data\SecuROM
    2008-09-25 19:09 --------- d-----w C:\Program Files\3Planesoft Screensaver Manager
    2008-09-25 18:17 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2008-09-25 18:09 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-09-25 17:44 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-09-21 12:29 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
    2008-09-21 12:26 --------- d-----w C:\Program Files\microsoft frontpage
    2008-09-21 11:37 499,200 ----a-w C:\WINDOWS\system32\Harun Yahya Ekran Koruyucusu - 2 A.scr
    2008-09-21 11:37 29,184 ----a-w C:\WINDOWS\system32\sstunst2.exe
    2008-09-21 11:36 85,052 ----a-w C:\WINDOWS\osmanli2.scr
    2008-09-21 11:36 580,709 ----a-w C:\WINDOWS\osmanli2.exe
    2008-09-21 11:36 32,768 ----a-w C:\WINDOWS\kpscr.dll
    2008-09-21 10:15 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Winamp
    2008-09-18 20:10 --------- d-----w C:\Documents and Settings\LocalService\Application Data\SiteAdvisor
    2008-09-15 15:25 1,846,400 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys
    2008-09-07 21:10 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-09-07 21:10 22,328 ----a-w C:\Documents and Settings\Administrator\Application Data\PnkBstrK.sys
    2008-09-07 21:10 --------- d-----w C:\Program Files\GameSpy
    2008-09-07 21:09 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
    2008-09-07 21:09 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-09-07 21:09 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-09-07 20:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
    2008-09-07 20:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-09-07 20:12 --------- d-----w C:\Program Files\SiteAdvisor
    2008-09-07 20:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
    2008-09-07 20:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
    2008-09-07 19:54 --------- d-----w C:\Program Files\Apple Software Update
    2008-09-07 19:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-09-07 19:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
    2008-09-07 19:46 --------- d-----w C:\Program Files\Java
    2008-09-07 19:35 --------- d-----w C:\Program Files\MSBuild
    2008-09-07 19:35 --------- d-----w C:\Program Files\Microsoft Works
    2008-09-07 19:34 --------- d-----w C:\Program Files\Microsoft.NET
    2008-09-07 19:32 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
    2008-09-07 19:32 --------- d-----w C:\Program Files\Driver-Soft
    2008-09-07 15:41 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-09-07 01:04 --------- d-----w C:\Documents and Settings\Administrator\Application Data\InstallShield
    2008-09-07 01:01 --------- d-----w C:\Documents and Settings\Administrator\Application Data\URSoft
    2008-09-06 01:41 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Media Player Classic
    2008-09-06 01:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2008-09-04 12:16 --------- d-----w C:\Program Files\Alwil Software
    2008-09-04 12:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
    2008-09-04 12:04 --------- d-----w C:\Program Files\Windows Live
    2008-09-04 12:04 --------- d-----w C:\Program Files\Alcohol Soft
    2008-09-04 12:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
    2008-09-04 12:03 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Ahead
    2008-09-03 21:19 --------- d-----w C:\Program Files\K-Lite Codec Pack
    2008-09-03 21:19 --------- d-----w C:\Program Files\Haberler
    2008-09-03 21:18 --------- d-----w C:\Program Files\Foxit Software
    2008-09-03 21:18 --------- d-----w C:\Program Files\Common Files\Java
    2008-09-03 21:16 --------- d-----w C:\Program Files\Reference Assemblies
    2008-09-03 21:16 --------- d-----w C:\Program Files\MSXML 6.0
    2008-09-03 21:11 --------- d-----w C:\Program Files\LClock
    2008-09-03 21:11 --------- d-----w C:\Program Files\CCleaner
    2008-09-03 21:11 --------- d-----w C:\Program Files\Araçlar
    2008-09-03 21:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\GroupPolicy
    2008-09-03 21:10 --------- d-----w C:\Program Files\Windows Media Connect 2
    2008-09-03 21:10 --------- d-----w C:\Program Files\LiraConv
    2008-08-26 09:10 827,904 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-08-14 13:23 2,147,328 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
    2008-08-14 13:23 2,025,984 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
    2008-04-21 19:28 982,016 ----a-w C:\WINDOWS\inf\syssbck.dll
    .

    ------- Sigcheck -------

    2008-04-14 08:00 112128 c54f6c23403b1b0e8472e4cc0b3cafee C:\WINDOWS\ServicePackFiles\i386\wuauclt.exe
    2008-04-21 21:02 80216 1fa4b5a2899a41df1b0068e96b55e9c2 C:\WINDOWS\system32\wuauclt.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 8523776]
    "SiteAdvisor"="C:\Program Files\SiteAdvisor\6065\SiteAdv.exe" [2007-03-14 36904]
    "AAWTray"="E:\Program Files\Ad Aware-2007\AAWTray.exe" [2007-08-08 88024]
    "ElkotekMonitor"="C:\Program Files\Elkotek\nanoMeter.exe" [2007-04-05 1466368]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
    "nwiz"="nwiz.exe" [2007-12-05 C:\WINDOWS\system32\nwiz.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]
    "LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-19 65536]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "ShowDeskFix"="shell32" [X]
    "nltide_3"="advpack.dll" [2008-08-26 C:\WINDOWS\system32\advpack.dll]

    C:\Documents and Settings\All Users\Start Menu\Programlar\BaŸlang‡\
    Run Google Web Accelerator.lnk - C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe [2007-05-18 663552]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoDesktopCleanupWizard"= 1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoSMHelp"= 1 (0x1)
    "NoSMMyPictures"= 1 (0x1)
    "ForceClassicControlPanel"= 1 (0x1)

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "NoSMHelp"= 1 (0x1)
    "NoSMMyPictures"= 1 (0x1)
    "ForceClassicControlPanel"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
    --a------ 2008-04-14 08:00 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LClock]
    --a------ 2004-09-19 11:27 65536 C:\Program Files\LClock\LClock.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    --a------ 2007-12-05 03:41 8523776 C:\WINDOWS\system32\nvcpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
    --a------ 2007-12-05 03:41 81920 C:\WINDOWS\system32\nvmctray.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2008-02-22 03:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VistaDrive]
    --a------ 2006-10-05 19:56 280779 C:\WINDOWS\VistaDrive\VistaDrive.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
    --a------ 2005-05-03 19:43 69632 C:\WINDOWS\ALCMTR.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
    --a------ 2007-12-05 03:41 1626112 C:\WINDOWS\system32\nwiz.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
    --a------ 2008-01-29 16:47 16859648 C:\WINDOWS\RTHDCPL.EXE

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "E:\\Oyunlar\\Fear\\FEAR.exe"=
    "E:\\Oyunlar\\Ghost Recon\\Ghost Recon Advanced Warfighter 2\\graw2.exe"=
    "E:\\Oyunlar\\Ghost Recon\\Ghost Recon Advanced Warfighter 2\\graw2_dedicated.exe"=
    "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
    "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "E:\\Oyunlar\\Crysis\\Bin32\\Crysis.exe"=
    "E:\\Oyunlar\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\WINDOWS\\system32\\sessmgr.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
    R3 AtcL002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;C:\WINDOWS\system32\DRIVERS\l251x86.sys [2007-08-22 30208]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{40f05f99-7cf3-11dd-bd5a-001fc6ad66d0}]
    \Shell\AutoRun\command - H:\xih9.cmd
    \Shell\explore\Command - H:\xih9.cmd
    \Shell\open\Command - H:\xih9.cmd

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7ff0aa9a-7b65-11dd-ba4b-001fc6ad66d0}]
    \Shell\AutoRun\command - w0o.com
    \Shell\explore\Command - w0o.com
    \Shell\open\Command - w0o.com

    *Newly Created Service* - HELPSVC
    .
    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\63gokxqz.default\
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net
    Rootkit scan 2008-11-02 22:17:31
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    E:\Program Files\Ad Aware-2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    E:\Program Files\Nero-8\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\SiteAdvisor\6065\SAService.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Google\Web Accelerator\GoogleWebAccClient.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wscntfy.exe
    .
    **************************************************************************
    .
    Completion time: 2008-11-02 23:19:24 - machine was rebooted [Administrator]
    ComboFix-quarantined-files.txt 2008-11-02 21:19:21

    Pre-Run: 37,870,039,040 bayt boş
    Post-Run: 37,984,833,536 bayt boş

    276 --- E O F --- 2008-10-30 21:06:45

    şimdiden binlerce teşekkür.




  • O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    quote:

    Orjinalden alıntı: felcnoor

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:23:03, on 02.11.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0013)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Windows Live\installer\WLSetupSvc.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Documents and Settings\fatiha\Desktop\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Bluetooth.lnk = ?
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1225645187828
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    --
    End of file - 5419 bytes


    BİLGİSAYARIM BELLEK READ OLAMADI HATASI VERİYORDU FORMAT ATTIM VE FAZLA SÜRE GEÇMEDEN YİNE AYNI HATAYI VERDİ.COUNTER YÜKLÜYORUM VE ÇAKMA Bİ BOT YAMASI VAR ONDAN KAYNAKLANIYO OLABİLİRMİ YARDIMLARINIZI BEKLİYORUM SERJİ...VE YAPMAM GEREKENLERİ AÇIKCA YAZARSANIZ ÇOK MAKBULE GEÇER.ŞİMDİDEN TEŞEKKÜKLER




  • serji işin zor bu aralar abisi:)

    bu aralar virüs girmeyen xp yok gibi:D

    kolay gelsin

    eline sağlık
  • Hiç Ellemeden Kopyala Yapıştır Yaptım.Gerisi Sana Kalmış Usta 

    Logfile of Trend Micro HijackThis v2.0.2 
      Scan saved at 00:04:46, on 03.11.2008 
      Platform: Windows XP SP3 (WinNT 5.01.2600) 
      MSIE: Internet Explorer v7.00 (7.00.6000.16735) 
      Boot mode: Normal 
       
      Running processes: 
      C:\WINDOWS\System32\smss.exe 
      C:\WINDOWS\system32\winlogon.exe 
      C:\WINDOWS\system32\services.exe 
      C:\WINDOWS\system32\lsass.exe 
      C:\WINDOWS\system32\Ati2evxx.exe 
      C:\WINDOWS\system32\svchost.exe 
      C:\WINDOWS\System32\svchost.exe 
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
      C:\Program Files\Alwil Software\Avast4\ashServ.exe 
      C:\WINDOWS\system32\Ati2evxx.exe 
      C:\WINDOWS\system32\spoolsv.exe 
      C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe 
      C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe 
      C:\Program Files\cFosSpeed\spd.exe 
      C:\Program Files\Java\jre6\bin\jqs.exe 
      C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe 
      C:\WINDOWS\Explorer.EXE 
      C:\WINDOWS\system32\svchost.exe 
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
      C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe 
      C:\Program Files\cFosSpeed\cFosSpeed.exe 
      C:\Program Files\Java\jre6\bin\jusched.exe 
      C:\WINDOWS\VM303_STI.EXE 
      C:\WINDOWS\system32\ctfmon.exe 
      C:\Program Files\Internet Download Manager\IDMan.exe 
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 
      C:\WINDOWS\system32\wbem\wmiapsrv.exe 
      C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe 
      C:\Program Files\Internet Explorer\iexplore.exe 
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
      C:\Program Files\Windows Live\Messenger\usnsvc.exe 
      D:\Program CD[SETUP]\HiJackThis.exe 
       
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:9666 
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local 
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
      R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) 
      O1 - Hosts: TT Jacker :) 
      O1 - Hosts: 195.8.214.141 dailymotion.com 
      O1 - Hosts: 195.8.214.142 dailymotion.com 
      O1 - Hosts: 195.8.214.140 www.dailymotion.com 
      O1 - Hosts: 208.117.236.70 youtube.com 
      O1 - Hosts: 208.117.236.70 www.youtube.com 
      O1 - Hosts: 74.125.65.118 img.youtube.com 
      O1 - Hosts: 64.15.124.143 sjc-v1.sjc.youtube.com 
      O1 - Hosts: 64.15.124.144 sjc-v2.sjc.youtube.com 
      O1 - Hosts: 64.15.124.145 sjc-v3.sjc.youtube.com 
      O1 - Hosts: 64.15.124.146 sjc-v4.sjc.youtube.com 
      O1 - Hosts: 64.15.124.147 sjc-v5.sjc.youtube.com 
      O1 - Hosts: 64.15.124.148 sjc-v6.sjc.youtube.com 
      O1 - Hosts: 64.15.124.149 sjc-v7.sjc.youtube.com 
      O1 - Hosts: 64.15.124.150 sjc-v8.sjc.youtube.com 
      O1 - Hosts: 64.15.124.151 sjc-v9.sjc.youtube.com 
      O1 - Hosts: 67.228.223.62 mp3hanesi.com 
      O1 - Hosts: 67.228.223.62 mp3hanesi.net 
      O1 - Hosts: 67.228.223.62 mp3hanesi.org 
      O1 - Hosts: 67.228.223.62 www.mp3hanesi.com 
      O1 - Hosts: 67.228.223.62 www.mp3hanesi.net 
      O1 - Hosts: 67.228.223.62 www.mp3hanesi.org 
      O1 - Hosts: 75.126.2.88 forumtr.com 
      O1 - Hosts: 75.126.2.88 www.forumtr.com 
      O1 - Hosts: 64.15.124.152 sjc-v10.sjc.youtube.com 
      O1 - Hosts: 64.15.124.153 sjc-v11.sjc.youtube.com 
      O1 - Hosts: 64.15.124.154 sjc-v12.sjc.youtube.com 
      O1 - Hosts: 64.15.124.155 sjc-v13.sjc.youtube.com 
      O1 - Hosts: 64.15.124.156 sjc-v14.sjc.youtube.com 
      O1 - Hosts: 64.15.124.157 sjc-v15.sjc.youtube.com 
      O1 - Hosts: 64.15.124.158 sjc-v16.sjc.youtube.com 
      O1 - Hosts: 64.15.124.159 sjc-v17.sjc.youtube.com 
      O1 - Hosts: 64.15.124.160 sjc-v18.sjc.youtube.com 
      O1 - Hosts: 64.15.124.161 sjc-v19.sjc.youtube.com 
      O1 - Hosts: 64.15.124.162 sjc-v20.sjc.youtube.com 
      O1 - Hosts: 64.15.124.163 sjc-v21.sjc.youtube.com 
      O1 - Hosts: 64.15.124.164 sjc-v22.sjc.youtube.com 
      O1 - Hosts: 64.15.124.165 sjc-v23.sjc.youtube.com 
      O1 - Hosts: 64.15.124.166 sjc-v24.sjc.youtube.com 
      O1 - Hosts: 64.15.124.167 sjc-v25.sjc.youtube.com 
      O1 - Hosts: 64.15.124.168 sjc-v26.sjc.youtube.com 
      O1 - Hosts: 64.15.124.169 sjc-v27.sjc.youtube.com 
      O1 - Hosts: 64.15.124.170 sjc-v28.sjc.youtube.com 
      O1 - Hosts: 64.15.124.171 sjc-v29.sjc.youtube.com 
      O1 - Hosts: 64.15.124.172 sjc-v30.sjc.youtube.com 
      O1 - Hosts: 64.15.124.173 sjc-v31.sjc.youtube.com 
      O1 - Hosts: 64.15.124.174 sjc-v32.sjc.youtube.com 
      O1 - Hosts: 64.15.124.175 sjc-v33.sjc.youtube.com 
      O1 - Hosts: 64.15.124.176 sjc-v34.sjc.youtube.com 
      O1 - Hosts: 64.15.124.177 sjc-v35.sjc.youtube.com 
      O1 - Hosts: 64.15.124.178 sjc-v36.sjc.youtube.com 
      O1 - Hosts: 64.15.124.179 sjc-v37.sjc.youtube.com 
      O1 - Hosts: 64.15.124.180 sjc-v38.sjc.youtube.com 
      O1 - Hosts: 64.15.124.207 sjc-v39.sjc.youtube.com 
      O1 - Hosts: 64.15.124.208 sjc-v40.sjc.youtube.com 
      O1 - Hosts: 64.15.124.209 sjc-v41.sjc.youtube.com 
      O1 - Hosts: 64.15.124.210 sjc-v42.sjc.youtube.com 
      O1 - Hosts: 64.15.124.211 sjc-v43.sjc.youtube.com 
      O1 - Hosts: 64.15.124.212 sjc-v44.sjc.youtube.com 
      O1 - Hosts: 64.15.124.213 sjc-v45.sjc.youtube.com 
      O1 - Hosts: 64.15.124.214 sjc-v46.sjc.youtube.com 
      O1 - Hosts: 64.15.124.215 sjc-v47.sjc.youtube.com 
      O1 - Hosts: 64.15.124.216 sjc-v48.sjc.youtube.com 
      O1 - Hosts: 64.15.124.217 sjc-v49.sjc.youtube.com 
      O1 - Hosts: 64.15.124.218 sjc-v50.sjc.youtube.com 
      O1 - Hosts: 64.15.124.219 sjc-v51.sjc.youtube.com 
      O1 - Hosts: 64.15.124.220 sjc-v52.sjc.youtube.com 
      O1 - Hosts: 64.15.124.221 sjc-v53.sjc.youtube.com 
      O1 - Hosts: 64.15.124.222 sjc-v54.sjc.youtube.com 
      O1 - Hosts: 64.15.124.223 sjc-v55.sjc.youtube.com 
      O1 - Hosts: 64.15.124.224 sjc-v56.sjc.youtube.com 
      O1 - Hosts: 64.15.124.225 sjc-v57.sjc.youtube.com 
      O1 - Hosts: 64.15.124.226 sjc-v58.sjc.youtube.com 
      O1 - Hosts: 64.15.124.227 sjc-v59.sjc.youtube.com 
      O1 - Hosts: 64.15.124.228 sjc-v60.sjc.youtube.com 
      O1 - Hosts: 64.15.124.229 sjc-v61.sjc.youtube.com 
      O1 - Hosts: 64.15.124.230 sjc-v62.sjc.youtube.com 
      O1 - Hosts: 64.15.124.231 sjc-v63.sjc.youtube.com 
      O1 - Hosts: 64.15.124.232 sjc-v64.sjc.youtube.com 
      O1 - Hosts: 64.15.124.233 sjc-v65.sjc.youtube.com 
      O1 - Hosts: 64.15.124.234 sjc-v66.sjc.youtube.com 
      O1 - Hosts: 64.15.124.235 sjc-v67.sjc.youtube.com 
      O1 - Hosts: 64.15.124.236 sjc-v68.sjc.youtube.com 
      O1 - Hosts: 64.15.124.237 sjc-v69.sjc.youtube.com 
      O1 - Hosts: 64.15.124.238 sjc-v70.sjc.youtube.com 
      O1 - Hosts: 64.15.124.239 sjc-v71.sjc.youtube.com 
      O1 - Hosts: 64.15.124.240 sjc-v72.sjc.youtube.com 
      O1 - Hosts: 64.15.124.241 sjc-v73.sjc.youtube.com 
      O1 - Hosts: 64.15.124.242 sjc-v74.sjc.youtube.com 
      O1 - Hosts: 64.15.124.243 sjc-v75.sjc.youtube.com 
      O1 - Hosts: 64.15.124.244 sjc-v76.sjc.youtube.com 
      O1 - Hosts: 64.15.125.16 sjc-v77.sjc.youtube.com 
      O1 - Hosts: 64.15.125.17 sjc-v78.sjc.youtube.com 
      O1 - Hosts: 64.15.125.18 sjc-v79.sjc.youtube.com 
      O1 - Hosts: 64.15.125.19 sjc-v80.sjc.youtube.com 
      O1 - Hosts: 64.15.125.20 sjc-v81.sjc.youtube.com 
      O1 - Hosts: 64.15.125.21 sjc-v82.sjc.youtube.com 
      O1 - Hosts: 64.15.125.22 sjc-v83.sjc.youtube.com 
      O1 - Hosts: 64.15.125.23 sjc-v84.sjc.youtube.com 
      O1 - Hosts: 64.15.125.24 sjc-v85.sjc.youtube.com 
      O1 - Hosts: 64.15.125.25 sjc-v86.sjc.youtube.com 
      O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll 
      O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll 
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
      O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
      O2 - BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
      O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe 
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" 
      O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH) 
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
      O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot 
      O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe 
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
      O8 - Extra context menu item: Bütün linkleri IDM ile indir - C:\Program Files\Internet Download Manager\IEGetAll.htm 
      O8 - Extra context menu item: FLV video içeriğini IDM ile indir - C:\Program Files\Internet Download Manager\IEGetVL.htm 
      O8 - Extra context menu item: IDM ile indir - C:\Program Files\Internet Download Manager\IEExt.htm 
      O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
      O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe 
      O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe 
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe 
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe 
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe 
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 
      O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe 
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe 
      O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe 
      O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe 
      O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe 
      O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe 
       
      -- 
      End of file - 11713 bytes




  • arkadaşlar lütfen bana acil yardım edin.combofix log dosyam yukarıda.SERJİİİİİİİİİİİ.............
    • 
Sayfa: önceki 284285286287288
Sayfaya Git
Git
sonraki
- x
Bildirim
mesajınız kopyalandı (ctrl+v) yapıştırmak istediğiniz yere yapıştırabilirsiniz.
Hizmet kalitesi için çerezleri kullanabiliriz. DH’ye girerek kullanım izni vermiş sayılırsınız.
Anladım Veri Politikamız