HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+

serji · 2006-09-23T14:40:42.0000000+03:00

ÖNEMLİ: Sizlerden ricam yalnızca çok acil ve ihtiyacı olanların loglarını buraya göndermesi. Bunun dışındakiler http://www.hijackthis.de/en sayfasından tarama yaptırıp sonuçları alabilirler. http://www.buraksonmez.com/dosyalar/HiJackThis.exe * Programı masaüstünüze indirin. * Programı çift tıklayarak açın. * Do a system scan and save a log file seçeneğine tıklayın. Bilgisayarınız taranacak ve masaüstünüzde hijackthis.txt adında bir dosya oluşacaktır. O dosyayı mesajınıza ekleyerek gönderin. * Mesajınızda sorununuzu kısa da olsa bir şekilde belirtin. Hiç bir şekilde yorum yapılmayan, sadece log içeren mesajlar yanıtlanmayacaktır . * Logları gönderirken lütfen code etiketleri arasına alarak yollayın. Bunları kullanmadığınız takdirde sayfalar çok uzuyor ve hoş olmayan bir görüntünün oluşmasının yanında, logları okumak ve takip etmek de zorlaşıyor. code etiketleri arasına alınmayan mesajlar yanıtlanmayacaktır . NOT: Lütfen işlemlerden önce eğer önemli verileriniz varsa yedek alın. Bazen özellikle de ağır virüsler bulaşan sistemlerde istenmeyen sonuçlar oluşabiliyor. Bu gibi durumlarda sorumlu kullanıcının kendisidir. NOT1: Logları bıraktığınızda gecikmeli cevap yazabilirim. Lütfen biraz sabırlı olun. En kısa zamanda cevap vermeye çalışıyorum. Genelde toplu olarak cevap yazıyorum haftada bir kontrol ederek. Eğer toplu cevapları dikkatlice inceledikten sonra mesajınıza cevap yazılmadığını görürseniz tekrar gönderebilirsiniz.

Sirkadyen

Yarbay

7493 Mesaj

Tüm Başarılarını Gör

serji

Emekli Yönetici

9076 Mesaj

Tüm Başarılarını Gör

quote:

Orjinalden alıntı: FeCkhO

yardımcı olursanız sevınırım

* HijackThis adlı programı açın.
* Do a system scan only seçeneğine tıklayın.
* Aşağıdaki satırları işaretleyin.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute Renaissance/contributeieplugin.dll 
  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll 
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
  O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll 
  O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute Renaissance/contributeieplugin.dll  
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" 
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
  O4 - HKLM\..\Run: [Sound Card Driver] C:\Program Files\Common Files\Microsoft Shared\DAO\FECKHO\svchost.exe  
  O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" 
  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k  
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe  
  O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 
  O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

* CTRL+ALT+DEL basıp işlemler sekmesine gelin. Kullanıcı Adınızın karşısındaki HijackThis.exe ve explorer.exe hariç tüm işlemleri sonlandırın. HijackThis hariç tüm programları, pencereleri kapatın ve Fix Checked butonuna tıklayın. Ardından bilgisayarınızı hemen yeniden başlatın.

Combofix adli programi indirin.

http://www.guvenlikuzmanim.com/dosyalar/ComboFix.exe

1. Tüm açık pencerelerinizi ve programlarınızı kapatın.
2. Antivirüs ve Antispyware programlarınızı geçici olarak kapatın veya devre dışı bırakın.
3. ComboFix.exe üzerine çift tıklayın ve programı açın. Programı açtıktan sonra kesinlikle hiç bir işlem yapmayın. 1-2 dakikalık bir mola verin.
4. ComboFix çalışmaya başladıktan sonra sizden 1 ya da 2 tuşuna basmanız istenecektir. Devam etmek için 1 tuşuna basın.
5. ComboFix olası bir aksilik durumunda sistemizi geri yükleyebilmek amacıyla Kayıt Defterinizin bir yedeğini alacak ve bir sistem geri yükleme noktası oluşturacaktır.
6. Bu işlemler sırasında internet bağlantınız kesilecektir. Bu normaldir. Ayrıca sistem saatiniz de değişecektir. Fakat tüm bunlar geçicidir. İşlemler bittikten sonra hepsi orjinal haline geri döndürülecektir.
7. Biraz sabırlı olmanız gerekebilir çünkü tam 41 aşama söz konusudur.
8. Son olarak ComboFix işlemlerin sonucunu içeren bir rapor hazırlayacaktır. Bu sırada masaüstünüz kaybolabilir. Fakat kısa sürede geri yüklenecektir. İşlemler bittikten sonra ComboFix kapanacak ve size bir rapor açılacaktır. Bu raporu C:\ComboFix.txt bulabilirsiniz.
9. C:\ComboFix.txt dosyasını mesajınıza ekleyerek bize gönderin.

buyur serji yeni hjt logu

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:54:03, on 22.11.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\rsvp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: flashget2 urlcatch - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Download All by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm
O8 - Extra context menu item: &Download by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) -http://www.srtest.com/srl_bin/sysreqlab_srl.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) -http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) -http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0BB3ACE-4ED3-4D65-BB86-1A0C6CAF351F} (AvaLaunch Control) -http://212.175.239.246:81/avaLaunch94.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) -http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 4463 bytes

serji

Emekli Yönetici

9076 Mesaj

Tüm Başarılarını Gör

MerhabaLar.. benim Sorunum kaSperSky ı kuLLanamıyorum windowS otomatik oLarak devre dışı bırakıyor.. yıLLardır kaSperSky kuLLanırım iLk defa böyLe bir SorunLar karşıLaştım.. format atmıştım kurayım dedim bi baktım kendi kendine kapandı ve açıLmıyor artık.. ccleaner ıda uzun zamandır kuLLanırım ama onuda açamıyorum açıLıyor 2 Saniye Sonra kapanıyor.. yardımcı oLurSanız çok Sevinirim..

D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
F:\abk.bat
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\DOCUME~1\Acme-1\LOCALS~1\Temp\rlrj.exe
D:\DOCUME~1\Acme-1\LOCALS~1\Temp\mrcq.exe
D:\DOCUME~1\Acme-1\LOCALS~1\Temp\winwamt.exe
D:\Program Files\Unlocker\UnlockerAssistant.exe
F:\abk.bat
D:\Documents and Settings\Acme-1\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O2 - BHO: IE7Pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - D:\Program Files\IEPro\iepro.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [Flashget] "D:\Program Files\FlashGet\FlashGet.exe" /min
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kamsoft] D:\WINDOWS\system32\kamsoft.exe
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &FlashGet ile indir - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Tümünü FlashGet ile indir - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Add to Anti-Banner - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Add to Banner Ad Blocker - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - D:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - D:\Program Files\IEPro\iepro.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 4021 bytes

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:29:06, on 23.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\soundman.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\A4Tech\Mouse\Amoumain.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe
C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\:smss.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IDA\ida.exe
C:\WINDOWS\system32\services.exe
C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Downloads\Programs\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://www.fenerbahce.org/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IE 4.x-6.x BHO for Internet Download Accelerator - {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6} - C:\PROGRA~1\IDA\idaiehlp.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Internet Download Accelerator] C:\Program Files\IDA\ida.exe -autorun
O4 - HKCU\..\Run: [AdobeBridge] "C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe" -stealth
O4 - HKCU\..\Policies\Explorer\Run: [System Service Starter] C:\:smss.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Uninstall.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download ALL with IDA - C:\Program Files\IDA\idaieall.htm
O8 - Extra context menu item: Download with IDA - C:\Program Files\IDA\idaie.htm
O9 - Extra button: Internet Download Accelerator - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - C:\Program Files\IDA\ida.exe
O9 - Extra 'Tools' menuitem: &Internet Download Accelerator - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - C:\Program Files\IDA\ida.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1222554572343
O17 - HKLM\System\CCS\Services\Tcpip\..\{5402CEF1-1C17-4AAF-99B2-8AE55FD829E1}: NameServer = 208.67.222.222,208.67.220.220
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5703 bytes

sorunum bilgisayarım açıldıktan sonra geri sayım başlıyo ve kapanıyo yardımınızı bekliyorum :(

< Bu mesaj bu kişi tarafından değiştirildi monte41 -- 23 Kasım 2008; 1:04:43 >

sekunden137

Yüzbaşı

341 Mesaj

Tüm Başarılarını Gör

Merhaba;

Ben de bir tarattım silinmesi gerekenleri buldum ama bir dosya var isminden şüphelendim yanına da soru işareti koymuş. Bi' bakabilirseniz

resimler:

HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+

Fixledikten sonra tekrar kontrol ettim şimdi bunun yanındaki işaret çarpı olmuş

Belirtmemde fayda var ben bunu şu sorunumdan kurtulmak için yaptım.

devamlı açık olan 2 iexplorer.exe dosyası. Tabi bi de devamlı çıkan reklamlar vardı onlardan da kurtuldum

Ama bu iexplorer.exe sorunundan kurtulamadım

Log dosyası:

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 11:26:10, on 23.11.2008 
  Platform: Windows XP SP3 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) 
  Boot mode: Normal 
   
  Running processes: 
  C:\WINDOWS\System32\smss.exe 
  C:\WINDOWS\SYSTEM32\winlogon.exe 
  C:\WINDOWS\system32\services.exe 
  C:\WINDOWS\system32\lsass.exe 
  C:\WINDOWS\system32\Ati2evxx.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\WINDOWS\SYSTEM32\Ati2evxx.exe 
  C:\WINDOWS\Explorer.EXE 
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
  C:\Program Files\Alwil Software\Avast4\ashServ.exe 
  C:\WINDOWS\emMon.exe 
  C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe 
  C:\Program Files\Unlocker\UnlockerAssistant.exe 
  C:\Program Files\DU Meter\DUMeter.exe 
  C:\Program Files\Analog Devices\SoundMAX\smax4.exe 
  C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe 
  C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe 
  C:\Program Files\cFosSpeed\cFosSpeed.exe 
  C:\WINDOWS\system32\spoolsv.exe 
  C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe 
  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe 
  C:\Program Files\FarStone\GameDrive\GDP\GDTask.exe 
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
  C:\WINDOWS\system32\ctfmon.exe 
  C:\Documents and Settings\arısoy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe 
  C:\Program Files\eMule\emule.exe 
  C:\Program Files\Internet Explorer\iexplore.exe 
  C:\Program Files\Internet Explorer\iexplore.exe 
  C:\Program Files\Logitech\SetPoint\SetPoint.exe 
  C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe 
  C:\Program Files\Bonjour\mDNSResponder.exe 
  C:\Program Files\FarStone\GameDrive\LiveUpdate.exe 
  C:\Program Files\cFosSpeed\spd.exe 
  C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE 
  C:\WINDOWS\system32\inetsrv\inetinfo.exe 
  C:\Program Files\FarStone\GameDrive\NewEditionClew.exe 
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe 
  C:\Program Files\FarStone\GameDrive\GDP\Adver.exe 
  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\system32\UAService7.exe 
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 
  C:\Program Files\Common Files\Teleca Shared\Generic.exe 
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 
  C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe 
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe 
   
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  R3 - URLSearchHook: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file) 
  O2 - BHO: Alcohol Toolbar Helper - {0ACF00E0-C1E4-4F6B-B290-10AC7505C47A} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll 
  O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 
  O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll 
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll 
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll 
  O3 - Toolbar: Alcohol Toolbar - {DC59A0D4-0ED6-4A73-B356-1B977F2A7725} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll 
  O4 - HKLM\..\Run: [emMonitor] C:\WINDOWS\emMon.exe 
  O4 - HKLM\..\Run: [PRONoMgrWired] C:\Program Files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe 
  O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" 
  O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe 
  O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray 
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" 
  O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE 
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
  O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe 
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime 
  O4 - HKLM\..\Run: [UPLOAD 16 WIPE RULE] C:\Documents and Settings\All Users\Application Data\Drive frag upload 16\Title Grey.exe 
  O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions 
  O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" 
  O4 - HKLM\..\Run: [GameDrive] "C:\Program Files\FarStone\GameDrive\GDP\GDTask.exe" /AutoRestore 
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe 
  O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\arısoy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c 
  O4 - HKCU\..\Run: [Gpl Safe] C:\DOCUME~1\ARSOY~1\APPLIC~1\INSIDE~1\bird less bags.exe 
  O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart 
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe 
  O8 - Extra context menu item: &FlashGet ile indir - C:\Program Files\FlashGet\jc_link.htm 
  O8 - Extra context menu item: &Tümünü FlashGet ile indir - C:\Program Files\FlashGet\jc_all.htm 
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll 
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll 
  O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL 
  O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe 
  O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe 
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) -http://www.srtest.com/srl_bin/sysreqlab3.cab 
  O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) -http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab 
  O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) -http://messenger.zone.msn.com/TR-TR/a-UNO1/GAME_UNO1.cab 
  O16 - DPF: {78A60F7D-7231-4BB9-A045-3C8458494A10} (IaxClientOcx Control) -http://www.denizfeneri.org/click2call/elkotek19.CAB 
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab 
  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) -http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab 
  O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) -https://secure.gopetslive.com/dev/GoPetsWeb.cab 
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe 
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe 
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe 
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 
  O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe 
  O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe 
  O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 
  O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe 
  O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe 
  O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe 
  O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe 
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe 
  O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe 
  O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe 
  O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe 
  O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe 
   
  -- 
  End of file - 10765 bytes

< Bu mesaj bu kişi tarafından değiştirildi sekunden137 -- 23 Kasım 2008; 11:32:38 >

serji

Emekli Yönetici

9076 Mesaj

Tüm Başarılarını Gör

quote:

Orjinalden alıntı: monte41
sorunum bilgisayarım açıldıktan sonra geri sayım başlıyo ve kapanıyo yardımınızı bekliyorum :(

* HijackThis adlı programı açın.
* Do a system scan only seçeneğine tıklayın.
* Aşağıdaki satırları işaretleyin.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://www.fenerbahce.org/ 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll 
  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 
  O2 - BHO: IE 4.x-6.x BHO for Internet Download Accelerator - {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6} - C:\PROGRA~1\IDA\idaiehlp.dll 
  O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll 
  O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll 
  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll  
  O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin 
  O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" 
  O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" 
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe  
  O4 - HKCU\..\Run: [Internet Download Accelerator] C:\Program Files\IDA\ida.exe -autorun 
  O4 - HKCU\..\Run: [AdobeBridge] "C:\Program Files\Adobe\Adobe Bridge CS4\Bridge.exe" -stealth 
  O4 - HKCU\..\Policies\Explorer\Run: [System Service Starter] C:\:smss.exe 
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
  O4 - Global Startup: Uninstall.exe 
  O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html 
  O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html 
  O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html 
  O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html 
  O8 - Extra context menu item: Download ALL with IDA - C:\Program Files\IDA\idaieall.htm 
  O8 - Extra context menu item: Download with IDA - C:\Program Files\IDA\idaie.htm 
  O9 - Extra button: Internet Download Accelerator - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - C:\Program Files\IDA\ida.exe 
  O9 - Extra 'Tools' menuitem: &Internet Download Accelerator - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - C:\Program Files\IDA\ida.exe 
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

* CTRL+ALT+DEL basıp işlemler sekmesine gelin. Kullanıcı Adınızın karşısındaki HijackThis.exe ve explorer.exe hariç tüm işlemleri sonlandırın. HijackThis hariç tüm programları, pencereleri kapatın ve Fix Checked butonuna tıklayın. Ardından bilgisayarınızı hemen yeniden başlatın.

Combofix adli programi indirin.

http://www.guvenlikuzmanim.com/dosyalar/ComboFix.exe

1. Tüm açık pencerelerinizi ve programlarınızı kapatın.
2. Antivirüs ve Antispyware programlarınızı geçici olarak kapatın veya devre dışı bırakın.
3. ComboFix.exe üzerine çift tıklayın ve programı açın. Programı açtıktan sonra kesinlikle hiç bir işlem yapmayın. 1-2 dakikalık bir mola verin.
4. ComboFix çalışmaya başladıktan sonra sizden 1 ya da 2 tuşuna basmanız istenecektir. Devam etmek için 1 tuşuna basın.
5. ComboFix olası bir aksilik durumunda sistemizi geri yükleyebilmek amacıyla Kayıt Defterinizin bir yedeğini alacak ve bir sistem geri yükleme noktası oluşturacaktır.
6. Bu işlemler sırasında internet bağlantınız kesilecektir. Bu normaldir. Ayrıca sistem saatiniz de değişecektir. Fakat tüm bunlar geçicidir. İşlemler bittikten sonra hepsi orjinal haline geri döndürülecektir.
7. Biraz sabırlı olmanız gerekebilir çünkü tam 41 aşama söz konusudur.
8. Son olarak ComboFix işlemlerin sonucunu içeren bir rapor hazırlayacaktır. Bu sırada masaüstünüz kaybolabilir. Fakat kısa sürede geri yüklenecektir. İşlemler bittikten sonra ComboFix kapanacak ve size bir rapor açılacaktır. Bu raporu C:\ComboFix.txt bulabilirsiniz.
9. C:\ComboFix.txt dosyasını mesajınıza ekleyerek bize gönderin.

serji

Emekli Yönetici

9076 Mesaj

Tüm Başarılarını Gör

quote:

Orjinalden alıntı: mansur.arisoy

Merhaba;

Ben de bir tarattım silinmesi gerekenleri buldum ama bir dosya var isminden şüphelendim yanına da soru işareti koymuş. Bi' bakabilirseniz

resimler:

Bu tarz siteler %100 dogru sonuclar vermiyor maalesef.

* HijackThis adlı programı açın.
* Do a system scan only seçeneğine tıklayın.
* Aşağıdaki satırları işaretleyin.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  R3 - URLSearchHook: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file) 
  O2 - BHO: Alcohol Toolbar Helper - {0ACF00E0-C1E4-4F6B-B290-10AC7505C47A} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll 
  O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll 
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O3 - Toolbar: Alcohol Toolbar - {DC59A0D4-0ED6-4A73-B356-1B977F2A7725} - C:\Program Files\Alcohol Toolbar\v3.0.0.0\AudioGizmo_Toolbar.dll 
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" 
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
  O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe 
  O4 - HKLM\..\Run: [UPLOAD 16 WIPE RULE] C:\Documents and Settings\All Users\Application Data\Drive frag upload 16\Title Grey.exe 
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe 
  O4 - HKCU\..\Run: [Gpl Safe] C:\DOCUME~1\ARSOY~1\APPLIC~1\INSIDE~1\bird less bags.exe 
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

* CTRL+ALT+DEL basıp işlemler sekmesine gelin. Kullanıcı Adınızın karşısındaki HijackThis.exe ve explorer.exe hariç tüm işlemleri sonlandırın. HijackThis hariç tüm programları, pencereleri kapatın ve Fix Checked butonuna tıklayın. Ardından bilgisayarınızı hemen yeniden başlatın.

Combofix adli programi indirin.

http://www.guvenlikuzmanim.com/dosyalar/ComboFix.exe

1. Tüm açık pencerelerinizi ve programlarınızı kapatın.
2. Antivirüs ve Antispyware programlarınızı geçici olarak kapatın veya devre dışı bırakın.
3. ComboFix.exe üzerine çift tıklayın ve programı açın. Programı açtıktan sonra kesinlikle hiç bir işlem yapmayın. 1-2 dakikalık bir mola verin.
4. ComboFix çalışmaya başladıktan sonra sizden 1 ya da 2 tuşuna basmanız istenecektir. Devam etmek için 1 tuşuna basın.
5. ComboFix olası bir aksilik durumunda sistemizi geri yükleyebilmek amacıyla Kayıt Defterinizin bir yedeğini alacak ve bir sistem geri yükleme noktası oluşturacaktır.
6. Bu işlemler sırasında internet bağlantınız kesilecektir. Bu normaldir. Ayrıca sistem saatiniz de değişecektir. Fakat tüm bunlar geçicidir. İşlemler bittikten sonra hepsi orjinal haline geri döndürülecektir.
7. Biraz sabırlı olmanız gerekebilir çünkü tam 41 aşama söz konusudur.
8. Son olarak ComboFix işlemlerin sonucunu içeren bir rapor hazırlayacaktır. Bu sırada masaüstünüz kaybolabilir. Fakat kısa sürede geri yüklenecektir. İşlemler bittikten sonra ComboFix kapanacak ve size bir rapor açılacaktır. Bu raporu C:\ComboFix.txt bulabilirsiniz.
9. C:\ComboFix.txt dosyasını mesajınıza ekleyerek bize gönderin.

MerhabaLar.. benim Sorunum kaSperSky ı kuLLanamıyorum windowS otomatik oLarak devre dışı bırakıyor.. yıLLardır kaSperSky kuLLanırım iLk defa böyLe bir SorunLar karşıLaştım.. format atmıştım kurayım dedim bi baktım kendi kendine kapandı ve açıLmıyor artık.. ccleaner ıda uzun zamandır kuLLanırım ama onuda açamıyorum açıLıyor 2 Saniye Sonra kapanıyor.. yardımcı oLurSanız çok Sevinirim..

D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
F:\abk.bat
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\DOCUME~1\Acme-1\LOCALS~1\Temp\rlrj.exe
D:\DOCUME~1\Acme-1\LOCALS~1\Temp\mrcq.exe
D:\DOCUME~1\Acme-1\LOCALS~1\Temp\winwamt.exe
D:\Program Files\Unlocker\UnlockerAssistant.exe
F:\abk.bat
D:\Documents and Settings\Acme-1\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O2 - BHO: IE7Pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - D:\Program Files\IEPro\iepro.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [Flashget] "D:\Program Files\FlashGet\FlashGet.exe" /min
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kamsoft] D:\WINDOWS\system32\kamsoft.exe
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &FlashGet ile indir - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Tümünü FlashGet ile indir - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Add to Anti-Banner - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Add to Banner Ad Blocker - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - D:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - D:\Program Files\IEPro\iepro.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 4021 bytes

sekunden137

Yüzbaşı

341 Mesaj

Tüm Başarılarını Gör

Dediklerini yaptım @serji işte log dosyası: (Gerçi artık 2 tane iexplorer.exe dosyası kalmadı ama)

ComboFix 08-11-19.08 - arısoy 2008-11-23 13:32:07.1 - NTFSx86 
  Microsoft Windows XP Professional  5.1.2600.3.1254.1.1055.18.234 [GMT 2:00] 
  Running from: c:\documents and settings\arısoy\Desktop\ComboFix.exe 
   * Created a new restore point 
   
  [COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR] 
  . 
   
  (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
   
  c:\windows\IE4 Error Log.txt 
  c:\windows\install.exe 
  c:\windows\system32\softwares.dll 
   
  . 
  (((((((((((((((((((((((((   Files Created from 2008-10-23 to 2008-11-23  ))))))))))))))))))))))))))))))) 
  . 
   
  2008-11-23 10:58 . 2008-11-23 10:58	<DIR>	d--------	c:\program files\Trend Micro 
  2008-11-22 17:22 . 2008-11-22 17:22	<DIR>	dr-------	c:\documents and settings\NetworkService\Sık Kullanılanlar 
  2008-11-22 15:01 . 2008-11-22 15:01	<DIR>	d--------	c:\program files\Alwil Software 
  2008-11-22 13:11 . 2008-11-22 13:11	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\FarStone 
  2008-11-22 13:11 . 2008-11-22 13:11	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\FarStone 
  2008-11-22 13:11 . 2008-11-22 13:11	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\FarStone 
  2008-11-22 13:10 . 2008-11-22 13:10	65,536	--a------	c:\windows\system32\GDPersns.dat 
  2008-11-22 13:09 . 2008-11-22 13:09	<DIR>	d--------	c:\program files\FarStone 
  2008-11-22 13:09 . 2006-08-05 06:20	71,680	--a------	c:\windows\system32\drivers\fgxscsi.sys 
  2008-11-22 13:09 . 2006-07-12 06:17	69,632	--a------	c:\windows\GPlay08.exe 
  2008-11-22 13:09 . 2006-07-12 06:17	14,496	--a------	c:\windows\system32\GDI08X.dat 
  2008-11-22 13:09 . 2006-07-12 06:17	11,520	--a------	c:\windows\system32\drivers\fgdxbus.sys 
  2008-11-22 13:09 . 2006-07-12 06:17	2,238	--a------	c:\windows\Driver.ico 
  2008-11-22 13:08 . 2008-11-22 13:08	126,976	--a------	c:\windows\system32\DVC.dll 
  2008-11-22 13:08 . 2008-11-22 13:08	90,112	--a------	c:\windows\system32\Dversion.dll 
  2008-11-22 13:06 . 2006-07-12 06:17	53,248	---------	c:\windows\system32\RemFarStone.exe 
  2008-11-22 09:12 . 2008-11-22 09:12	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\AdobeUM 
  2008-11-22 09:12 . 2008-11-22 09:12	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\AdobeUM 
  2008-11-22 09:12 . 2008-11-22 09:12	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\AdobeUM 
  2008-11-22 09:12 . 2008-11-22 09:12	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\AdobeAUM 
  2008-11-22 09:12 . 2008-11-22 09:12	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\AdobeAUM 
  2008-11-22 09:12 . 2008-11-22 09:12	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\AdobeAUM 
  2008-11-20 20:12 . 2006-11-07 09:42	97,056	-ra------	c:\windows\system32\drivers\w200mdm.sys 
  2008-11-20 20:12 . 2006-11-07 09:42	88,560	-ra------	c:\windows\system32\drivers\w200mgmt.sys 
  2008-11-20 20:12 . 2006-11-07 09:42	86,368	-ra------	c:\windows\system32\drivers\w200obex.sys 
  2008-11-20 20:12 . 2006-11-07 09:42	61,504	-ra------	c:\windows\system32\drivers\w200bus.sys 
  2008-11-20 20:12 . 2006-11-07 09:42	9,328	-ra------	c:\windows\system32\drivers\w200mdfl.sys 
  2008-11-20 20:12 . 2006-11-07 09:42	6,208	-ra------	c:\windows\system32\drivers\w200cmnt.sys 
  2008-11-20 20:12 . 2006-11-07 09:42	6,208	-ra------	c:\windows\system32\drivers\w200cm.sys 
  2008-11-20 20:12 . 2006-11-07 09:42	5,840	-ra------	c:\windows\system32\drivers\w200whnt.sys 
  2008-11-20 20:12 . 2006-11-07 09:42	5,840	-ra------	c:\windows\system32\drivers\w200wh.sys 
  2008-11-20 20:07 . 2008-11-21 17:32	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\MyPhoneExplorer 
  2008-11-20 20:07 . 2008-11-21 17:32	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\MyPhoneExplorer 
  2008-11-20 20:07 . 2008-11-21 17:32	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\MyPhoneExplorer 
  2008-11-20 20:06 . 2008-11-20 20:06	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\FMA 
  2008-11-20 20:06 . 2008-11-20 20:06	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\FMA 
  2008-11-20 20:06 . 2008-11-20 20:06	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\FMA 
  2008-11-20 20:01 . 2008-11-20 20:01	<DIR>	d--------	c:\program files\Disc2Phone 
  2008-11-20 19:40 . 2008-11-20 19:40	<DIR>	d--------	c:\documents and settings\All Users\Documents 
  2008-11-20 19:38 . 2008-11-20 19:38	<DIR>	d--------	c:\program files\Sony Ericsson 
  2008-11-20 19:38 . 2008-11-20 19:40	<DIR>	d--------	c:\program files\Common Files\Teleca Shared 
  2008-11-20 19:38 . 2008-11-20 19:40	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Teleca 
  2008-11-20 19:38 . 2008-11-20 19:40	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Sony Ericsson 
  2008-11-20 19:22 . 2008-11-20 20:08	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\Teleca 
  2008-11-20 19:22 . 2008-11-20 20:08	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\Teleca 
  2008-11-20 19:22 . 2008-11-20 20:08	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\Teleca 
  2008-11-20 19:22 . 2008-11-20 19:22	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\Sony Ericsson 
  2008-11-20 19:22 . 2008-11-20 19:22	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\Sony Ericsson 
  2008-11-20 19:22 . 2008-11-20 19:22	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\Sony Ericsson 
  2008-11-20 19:02 . 2008-11-20 19:37	<DIR>	d--------	c:\windows\Downloaded Installations 
  2008-11-18 19:19 . 2008-11-18 19:19	<DIR>	d--------	c:\program files\MSXML 4.0 
  2008-11-17 17:54 . 2008-11-17 17:54	<DIR>	d--------	c:\program files\Alcohol Soft 
  2008-11-16 17:47 . 2008-11-16 17:47	<DIR>	d--------	c:\program files\Inside Thunk 
  2008-11-11 23:28 . 2008-09-04 19:16	1,106,944	-----c---	c:\windows\system32\dllcache\msxml3.dll 
  2008-11-11 23:28 . 2008-10-24 13:21	455,296	-----c---	c:\windows\system32\dllcache\mrxsmb.sys 
  2008-11-08 13:03 . 2008-11-08 13:04	<DIR>	d--------	c:\program files\IKEA 
  2008-11-07 18:25 . 2008-11-07 18:25	616	--a------	c:\windows\eReg.dat 
  2008-11-03 17:40 . 2008-11-06 18:29	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\My Battle for Middle-earth Files 
  2008-11-03 17:40 . 2008-11-06 18:29	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\My Battle for Middle-earth Files 
  2008-11-03 17:40 . 2008-11-06 18:29	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\My Battle for Middle-earth Files 
  2008-11-02 14:18 . 2008-11-02 14:18	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\Anix Software 
  2008-11-02 14:18 . 2008-11-02 14:18	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\Anix Software 
  2008-11-02 14:18 . 2008-11-02 14:18	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\Anix Software 
  2008-11-02 13:12 . 2008-11-02 13:12	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\3DFA 
  2008-11-02 13:12 . 2008-11-02 13:12	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\3DFA 
  2008-11-02 13:12 . 2008-11-02 13:12	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\3DFA 
  2008-11-02 12:57 . 2008-11-02 12:58	<DIR>	d--------	c:\program files\Scriptocean 
  2008-11-01 18:15 . 2008-11-01 18:16	<DIR>	d--------	c:\program files\QuickTime 
  2008-11-01 18:15 . 2008-11-01 18:15	<DIR>	d--------	c:\program files\Common Files\Apple 
  2008-11-01 18:15 . 2008-11-20 20:00	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Apple Computer 
  2008-11-01 18:13 . 2008-11-01 18:13	<DIR>	d--------	c:\program files\Apple Software Update 
  2008-11-01 18:13 . 2008-11-01 18:13	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Apple 
  2008-10-31 22:18 . 2008-11-01 00:39	<DIR>	d--------	c:\program files\Flash Slideshow Maker Professional 
  2008-10-29 16:07 . 2008-11-16 17:48	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Drive frag upload 16 
  2008-10-29 16:06 . 2008-11-23 00:10	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\Inside Thunk 
  2008-10-29 16:06 . 2008-11-23 00:10	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\Inside Thunk 
  2008-10-29 16:06 . 2008-11-23 00:10	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\Inside Thunk 
  2008-10-29 16:05 . 2008-11-22 17:43	<DIR>	d--------	c:\program files\Circle Developement 
  2008-10-28 17:35 . 2008-10-28 17:35	<DIR>	d--------	c:\windows\Favorites 
  2008-10-28 17:34 . 1999-12-17 11:13	86,016	--a------	c:\windows\unvise32.exe 
  2008-10-28 17:33 . 2002-03-27 14:54	217,088	--a------	c:\windows\system32\libmySQL.dll 
  2008-10-28 17:33 . 2002-03-29 10:13	102,400	--a------	c:\windows\system32\TrackerNET.dll 
  2008-10-28 17:31 . 2008-10-28 17:31	<DIR>	d--------	c:\windows\solcache 
  2008-10-28 17:30 . 1998-10-30 23:21	1,022,976	--a------	c:\windows\system32\SierraNW.dll 
  2008-10-28 17:30 . 1998-10-30 23:21	231,936	--a------	c:\windows\system32\SNWValid.dll 
  2008-10-26 22:46 . 2008-10-26 22:46	<DIR>	d--------	c:\documents and settings\All Users\Application Data\FLEXnet 
  2008-10-26 22:26 . 2008-10-26 22:26	<DIR>	d--------	c:\program files\Common Files\Macrovision Shared 
  2008-10-26 22:25 . 2008-10-26 22:25	<DIR>	d--------	c:\program files\Bonjour 
  2008-10-26 20:04 . 2008-10-26 20:10	<DIR>	d--------	C:\SobeeBilardo 
  2008-10-26 19:29 . 2006-12-15 19:29	354,315,499	--a------	C:\adobephotoshop_10_12-14-06.exe 
  2008-10-25 17:31 . 2008-10-25 17:31	<DIR>	d--------	c:\windows\system32\xircom 
  2008-10-25 17:24 . 2008-10-25 17:26	<DIR>	d--------	c:\documents and settings\Administrator\Sık Kullanılanlar 
  2008-10-25 17:24 . 2008-07-08 23:15	<DIR>	d--------	c:\documents and settings\Administrator\Belgelerim 
  2008-10-25 17:24 . 2008-08-01 20:29	<DIR>	d--------	c:\documents and settings\Administrator\Application Data\Avira 
  2008-10-25 17:24 . 2008-10-25 17:24	<DIR>	d--------	c:\documents and settings\Administrator 
  2008-10-25 16:43 . 2008-10-25 16:43	129	--a------	c:\windows\system32\280858.reg 
  2008-10-25 16:28 . 2008-10-25 17:09	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files 
  2008-10-25 15:15 . 2008-10-25 15:15	129	--a------	c:\windows\system32\767506.reg 
  2008-10-25 15:15 . 2008-10-25 15:15	129	--a------	c:\windows\system32\175301.reg 
  2008-10-25 15:14 . 2008-10-25 15:14	129	--a------	c:\windows\system32\970128.reg 
  2008-10-25 15:14 . 2008-10-25 15:14	129	--a------	c:\windows\system32\480393.reg 
  2008-10-25 14:16 . 2008-10-25 14:17	40	--a------	c:\windows\system32\value.ini 
  2008-10-24 15:34 . 2008-10-15 18:36	337,408	-----c---	c:\windows\system32\dllcache\netapi32.dll 
  2008-10-23 19:24 . 2008-10-23 19:27	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\mIRC 
  2008-10-23 19:24 . 2008-10-23 19:27	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\mIRC 
  2008-10-23 19:24 . 2008-10-23 19:27	<DIR>	d--------	c:\documents and settings\arısoy\Application Data\mIRC 
   
  . 
  ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  2008-11-23 11:34	---------	d-----w	c:\program files\cFosSpeed 
  2008-11-23 11:28	524,288	----a-w	c:\windows\system32\drivers\CnxE2FS.bin 
  2008-11-23 11:28	---------	d-----w	c:\program files\eMule 
  2008-11-23 11:17	---------	d-----w	c:\documents and settings\arısoy\Application Data\foobar2000 
  2008-11-23 11:17	---------	d-----w	c:\documents and settings\arısoy\Application Data\foobar2000 
  2008-11-23 11:17	---------	d-----w	c:\documents and settings\arısoy\Application Data\foobar2000 
  2008-11-23 00:16	---------	d-----w	c:\program files\SmartFTP Client 
  2008-11-22 16:36	---------	d-----w	c:\program files\SystemRequirementsLab 
  2008-11-22 16:35	---------	d-----w	c:\documents and settings\arısoy\Application Data\SystemRequirementsLab 
  2008-11-22 16:35	---------	d-----w	c:\documents and settings\arısoy\Application Data\SystemRequirementsLab 
  2008-11-22 16:35	---------	d-----w	c:\documents and settings\arısoy\Application Data\SystemRequirementsLab 
  2008-11-22 11:32	---------	d-----w	c:\documents and settings\arısoy\Application Data\uTorrent 
  2008-11-22 11:32	---------	d-----w	c:\documents and settings\arısoy\Application Data\uTorrent 
  2008-11-22 11:32	---------	d-----w	c:\documents and settings\arısoy\Application Data\uTorrent 
  2008-11-22 08:38	---------	d---a-w	c:\documents and settings\All Users\Application Data\TEMP 
  2008-11-20 17:55	---------	d-----w	c:\program files\Common Files\Adobe 
  2008-11-18 14:09	---------	d--h--w	c:\program files\InstallShield Installation Information 
  2008-11-15 17:36	---------	d-----w	c:\program files\FlashGet 
  2008-10-29 14:05	---------	d-----w	c:\program files\Messenger Plus! Live 
  2008-10-28 15:31	---------	d-----w	c:\program files\Sierra On-Line 
  2008-10-25 15:30	---------	d-----w	c:\program files\Conduit 
  2008-10-25 15:24	---------	d-----w	c:\documents and settings\All Users\Application Data\Avira 
  2008-10-25 15:17	---------	d-----w	c:\documents and settings\All Users\Application Data\Stardock 
  2008-10-25 15:16	---------	d-----w	c:\documents and settings\arısoy\Application Data\concept design 
  2008-10-25 15:16	---------	d-----w	c:\documents and settings\arısoy\Application Data\concept design 
  2008-10-25 15:16	---------	d-----w	c:\documents and settings\arısoy\Application Data\concept design 
  2008-10-24 11:21	455,296	----a-w	c:\windows\system32\drivers\mrxsmb.sys 
  2008-10-16 19:24	247,866	----a-w	c:\windows\Alcohol_Toolbar_Uninstaller_3046.exe 
  2008-10-16 19:24	---------	d-----w	c:\program files\Alcohol Toolbar 
  2008-10-16 19:03	716,272	----a-w	c:\windows\system32\drivers\sptd.sys 
  2008-10-04 19:10	---------	d-----w	c:\program files\Paint.NET 
  2008-10-02 12:37	102,400	----a-w	c:\windows\DUMP59e7.tmp 
  2008-10-02 11:52	102,400	----a-w	c:\windows\DUMP54c7.tmp 
  2008-09-30 22:44	---------	d-----w	c:\program files\Flash Player 
  2008-09-30 20:18	33,540	----a-w	c:\windows\system32\CoreFLACDecoder-uninstall.exe 
  2008-09-30 14:43	1,286,152	----a-w	c:\windows\system32\msxml4.dll 
  2008-09-29 20:13	---------	d-----w	c:\program files\Tenable 
  2008-09-27 19:02	---------	d-----w	c:\documents and settings\arısoy\Application Data\SmartFTP 
  2008-09-27 19:02	---------	d-----w	c:\documents and settings\arısoy\Application Data\SmartFTP 
  2008-09-27 19:02	---------	d-----w	c:\documents and settings\arısoy\Application Data\SmartFTP 
  2008-09-27 07:12	---------	d-----w	c:\program files\Google 
  2008-09-17 14:20	102,400	----a-w	c:\windows\DUMP4a76.tmp 
  2008-09-17 14:18	102,400	----a-w	c:\windows\DUMP4ad4.tmp 
  2008-09-15 15:25	1,846,400	----a-w	c:\windows\system32\win32k.sys 
  2008-09-11 12:40	102,400	----a-w	c:\windows\DUMP53fc.tmp 
  2008-09-11 09:19	102,400	----a-w	c:\windows\DUMP4c89.tmp 
  2008-09-10 01:14	1,307,648	------w	c:\windows\system32\msxml6.dll 
  2008-09-08 13:37	18,199	----a-w	c:\windows\system32\winwizard.dll 
  2008-09-06 08:07	102,400	----a-w	c:\windows\DUMP5a74.tmp 
  2008-09-06 08:05	102,400	----a-w	c:\windows\DUMP568c.tmp 
  2008-09-06 08:03	102,400	----a-w	c:\windows\DUMP5a83.tmp 
  2008-09-06 08:00	102,400	----a-w	c:\windows\DUMP5822.tmp 
  2008-09-04 17:16	1,106,944	----a-w	c:\windows\system32\msxml3.dll 
  2008-08-28 07:46	74,752	----a-w	c:\windows\system32\msw3prt.dll 
  2008-08-28 07:46	105,472	----a-w	c:\windows\system32\win32spl.dll 
  2008-08-27 13:58	21,840	----a-w	c:\windows\system32\SIntfNT.dll 
  2008-08-27 13:58	17,212	----a-w	c:\windows\system32\SIntf32.dll 
  2008-08-27 13:58	12,067	----a-w	c:\windows\system32\SIntf16.dll 
  . 
   
  (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  . 
  *Note* empty entries & legit default entries are not shown  
  REGEDIT4 
   
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "Google Update"="c:\documents and settings\arısoy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-02 133104] 
  "eMuleAutoStart"="c:\program files\eMule\emule.exe" [2008-08-01 5480448] 
   
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "emMonitor"="c:\windows\emMon.exe" [2005-01-06 32768] 
  "PRONoMgrWired"="c:\program files\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2004-11-18 86016] 
  "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-03-01 15872] 
  "DU Meter"="c:\program files\DU Meter\DUMeter.exe" [2006-11-27 1582616] 
  "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696] 
  "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744] 
  "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344] 
  "GameDrive"="c:\program files\FarStone\GameDrive\GDP\GDTask.exe" [2006-07-22 167936] 
  "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-18 81000] 
  "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-01-20 c:\windows\KHALMNPR.Exe] 
   
  c:\documents and settings\All Users\Start Menu\Programlar\BaŸlang‡\ 
  Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-07-08 532480] 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] 
  --a------ 2004-11-03 20:10 344064 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 
  --a------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX] 
  --------- 2004-09-23 12:41 860160 c:\program files\Analog Devices\SoundMAX\SMax4.exe 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP] 
  --------- 2004-10-14 09:11 1388544 c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer] 
  --a------ 2006-01-20 16:46 28160 c:\windows\KHALMNPR.Exe 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\security center] 
  "AntiVirusOverride"=dword:00000001 
  "FirewallOverride"=dword:00000001 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus] 
  "DisableMonitoring"=dword:00000001 
   
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] 
  "EnableFirewall"= 0 (0x0) 
   
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] 
  "%windir%\\system32\\sessmgr.exe"= 
  "c:\\Program Files\\eMule\\emule.exe"= 
  "c:\\Program Files\\FlashGet\\flashget.exe"= 
  "c:\\Program Files\\uTorrent\\uTorrent.exe"= 
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"= 
  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= 
  "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= 
  "c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"= 
  "c:\\Program Files\\Messenger\\msmsgs.exe"= 
  "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= 
   
  R0 FGXSCSI;FGXSCSI;c:\windows\system32\DRIVERS\fgxscsi.sys [2008-11-22 71680] 
  R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-11-23 110160] 
  R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-11-23 20560] 
  S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys [] 
  S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys [] 
  S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\c:\documents and settings\arısoy\Desktop\everest\kerneld.wnt [] 
  S3 NAL;Nal Service ;\??\c:\windows\system32\Drivers\iqvw32.sys [2004-11-02 19456] 
  S3 w200bus;Sony Ericsson W200 driver (WDM);c:\windows\system32\DRIVERS\w200bus.sys [2008-11-20 61504] 
  S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;c:\windows\system32\DRIVERS\w200mdfl.sys [2008-11-20 9328] 
  S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;c:\windows\system32\DRIVERS\w200mdm.sys [2008-11-20 97056] 
  S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\w200mgmt.sys [2008-11-20 88560] 
  S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\w200obex.sys [2008-11-20 86368] 
   
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] 
  \Shell\AutoRun\command - J:\Setup.exe 
  \Shell\setup\command - J:\setup.exe 
   
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\K] 
  \Shell\AutoRun\command - K:\_aom.exe 
   
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9943ffe2-b864-11dd-8352-00d0e8a18ff4}] 
  \Shell\AutoRun\command - J:\Setup.exe 
  \Shell\setup\command - J:\setup.exe 
   
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9943ffe3-b864-11dd-8352-00d0e8a18ff4}] 
  \Shell\AutoRun\command - K:\_aom.exe 
   
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d26b88e0-4dbb-11dd-8157-00d0e8a18ff4}] 
  \Shell\AutoRun\command - I:\yo2mq6.exe 
  \Shell\explore\Command - I:\yo2mq6.exe 
  \Shell\open\Command - I:\yo2mq6.exe 
   
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{de15696d-9bb6-11dd-82f6-00d0e8a18ff4}] 
  \Shell\AutoRun\command - G:\Setup.exe 
   
  *Newly Created Service* - PROCEXP90 
  . 
  Contents of the 'Scheduled Tasks' folder 
   
  2008-11-23 c:\windows\Tasks\B03FA01F906C5BBB.job 
  - c:\docume~1\arsoy~1\applic~1\inside~1\find axis date.exe [2008-11-16 17:49] 
   
  2008-11-23 c:\windows\Tasks\GoogleUpdateTaskUser.job 
  - c:\documents and settings\ar1 [] 
  . 
  - - - - ORPHANS REMOVED - - - - 
   
  WebBrowser-{ECDEE021-0D17-467F-A1FF-C7A115230949} - (no file) 
  Notify-WgaLogon - (no file) 
   
   
  . 
  ------- Supplementary Scan ------- 
  . 
  FireFox -: Profile - c:\documents and settings\arısoy\Application Data\Mozilla\Firefox\Profiles\fv7wz7wn.default\ 
  FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com.tr/ 
  FF -: plugin - c:\documents and settings\arÄ±soy\Local Settings\Application Data\Google\Update\1.2.131.27\npGoogleOneClick6.dll 
  FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll 
  FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll 
  FF -: plugin - c:\program files\Mozilla Firefox\plugins\NpFp41629.dll 
  FF -: plugin - c:\program files\Mozilla Firefox\plugins\NpFv41629.dll 
  FF -: plugin - c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll 
  . 
   
  ************************************************************************** 
   
  catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net 
  Rootkit scan 2008-11-23 13:34:45 
  Windows 5.1.2600 Service Pack 3 NTFS 
   
  scanning hidden processes ...  
   
  scanning hidden autostart entries ... 
   
  scanning hidden files ...  
   
  scan completed successfully 
  hidden files: 0 
   
  ************************************************************************** 
   
  [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\EverestDriver] 
  "ImagePath"="\??\c:\documents and settings\arısoy\Desktop\everest\kerneld.wnt" 
  . 
  Completion time: 2008-11-23 13:36:14 
  ComboFix-quarantined-files.txt  2008-11-23 11:35:48 
   
  Pre-Run: 2.229.911.552 bayt boş 
  Post-Run: 2,817,896,448 bayt boş 
   
  299	--- E O F ---	2008-11-18 17:20:33

serji

Emekli Yönetici

9076 Mesaj

Tüm Başarılarını Gör

quote:

Orjinalden alıntı: Acme91

MerhabaLar.. benim Sorunum kaSperSky ı kuLLanamıyorum windowS otomatik oLarak devre dışı bırakıyor.. yıLLardır kaSperSky kuLLanırım iLk defa böyLe bir SorunLar karşıLaştım.. format atmıştım kurayım dedim bi baktım kendi kendine kapandı ve açıLmıyor artık.. ccleaner ıda uzun zamandır kuLLanırım ama onuda açamıyorum açıLıyor 2 Saniye Sonra kapanıyor.. yardımcı oLurSanız çok Sevinirim..

HijackThis'in verdigi logu oldugu gibi buraya kopyalayin. herhangi bir yerini kesmeden.

quote:

Orjinalden alıntı: mansur.arisoy

Dediklerini yaptım @serji işte log dosyası: (Gerçi artık 2 tane iexplorer.exe dosyası kalmadı ama)

Kalmadi cunku virusleri temizledik

Ama son bir islem kaldi.

Perlovga Removal Tool adlı programı masaüstünüze indirin.

http://www.guvenlikuzmanim.com/dosyalar/perlovga.exe

Programı çalıştırıp Start tıklayın. Daha sonra bilgisayarınızı zaman kaybetmeden yeniden başlatın.

Malwarebytes Antimalware adlı programı indirin.

http://www.guvenlikuzmanim.com/dosyalar/mbam-setup.exe

* Programı kurmak için mbam-setup.exe üzerine çift tıklayın ve programı kurun.
* Malwarebytes Antimalware Güncelle ve Malwarebytes Programını Çalıştır seçeneklerini işaretleyip Finish tıklayın.
* Eğer bir güncelleştirme bulunursa, program otomatik olarak indirip güncelleştirecektir.
* Program yüklendiğinde Tam Tarama seçip Taramaya Başla butonuna tıklayın.
* Tarama işlemi biraz zaman alabilir, o yüzden lütfen biraz sabırlı olun.
* Tarama işlemi bittiğinde, Tamam tıklayın ve Sonuçları Göster tıklayın.
* Herşeyin işaretli olduğundan emin olun ve Seçilileri Temizle tıklayın.
* Temizleme işlemi bittiğinde bir notdefteri penceresi açılacaktır. (Bilgisayarınızı yeniden başlatmanız gerekebilir.)
* Notdefteri dosyasını kaydedip mesajınıza ekleyerek bize gönderin.

NOT: Eğer temizleme işlemi sırasında program bilgisayarı yeniden başlatmanızı isterse Tamam tıklayarak bilgisayarızı yeniden başlatın.

quote:

Orjinalden alıntı: nayt99

evet serji pcde gözle görülür bir hızlanma oldu çok saol yardımların için

rica ederim. Kolay gelsin.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:28:06, on 23.11.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\IoctlSvc.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\Java\jre6\bin\jusched.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
D:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
D:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
D:\Program Files\MessengerDiscovery\MessengerDiscovery Live.exe
D:\Program Files\Windows Live\Messenger\usnsvc.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\TEMP\winahcu.exe
D:\WINDOWS\TEMP\winomoi.exe
D:\Program Files\Mozilla Firefox\firefox.exe
F:\Acme\ProgramLar\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - D:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: IE7Pro BHO - {00011268-E188-40DF-A514-835FCD78B1BF} - D:\Program Files\IEPro\iepro.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - D:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\Program Files\FlashGet\getflash.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - D:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - D:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [Flashget] "D:\Program Files\FlashGet\FlashGet.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kamsoft] D:\WINDOWS\system32\kamsoft.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &FlashGet ile indir - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Tümünü FlashGet ile indir - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Windows Live Search - res://D:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Anti-Banner - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: Add to Banner Ad Blocker - D:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - D:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - D:\Program Files\IEPro\iepro.dll
O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) -http://javadl.sun.com/webapps/download/AutoDL?BundleId=24931
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - D:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - D:\WINDOWS\system32\IoctlSvc.exe

--
End of file - 7693 bytes

MerhabaLar.. benim Sorunum kaSperSky ı kuLLanamıyorum windowS otomatik oLarak devre dışı bırakıyor.. yıLLardır kaSperSky kuLLanırım iLk defa böyLe bir SorunLar karşıLaştım.. format atmıştım kurayım dedim bi baktım kendi kendine kapandı ve açıLmıyor artık.. ccleaner ıda uzun zamandır kuLLanırım ama onuda açamıyorum açıLıyor 2 Saniye Sonra kapanıyor.. yardımcı oLurSanız çok Sevinirim..
Not:işLetim SiStemim D: de yükLü

karacaardıç

Yarbay

2730 Mesaj

Tüm Başarılarını Gör

Running processes: 
  C:\WINDOWS\System32\smss.exe 
  C:\WINDOWS\system32\winlogon.exe 
  C:\WINDOWS\system32\services.exe 
  C:\WINDOWS\system32\lsass.exe 
  C:\WINDOWS\system32\Ati2evxx.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
  C:\Program Files\Alwil Software\Avast4\ashServ.exe 
  C:\WINDOWS\system32\Ati2evxx.exe 
  C:\WINDOWS\Explorer.EXE 
  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe 
  C:\Program Files\Java\jre6\bin\jusched.exe 
  C:\WINDOWS\VMSnap326.exe 
  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe 
  C:\WINDOWS\system32\spoolsv.exe 
  C:\Program Files\Java\jre6\bin\jqs.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 
  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 
  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe 
  C:\Program Files\Alwil Software\Avast4\ashSimpl.exe 
  C:\Program Files\MSN Messenger\usnsvc.exe 
  C:\Program Files\Mozilla Firefox\firefox.exe 
  C:\Program Files\Webteh\BSplayer\bsplayer.exe 
  C:\Documents and Settings\yasin&asiye\Desktop\HiJackThis.exe 
   
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://www.bsplayer-search.com/startpage 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll 
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll 
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
  O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll 
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll 
  O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll 
  O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" 
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" 
  O4 - HKLM\..\Run: [BigDogpath326] C:\WINDOWS\VMSnap326.exe PREMIER USB2.0 PC Kamera (VC0326) 
  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe 
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe 
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background 
  O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\kamsoft.exe 
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
  O4 - Global Startup: BIGDOGPATH326.lnk = C:\WINDOWS\VMSnap326.exe 
  O8 - Extra context menu item: &FlashGet ile indir - C:\Program Files\FlashGet\jc_link.htm 
  O8 - Extra context menu item: &Tümünü FlashGet ile indir - C:\Program Files\FlashGet\jc_all.htm 
  O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll 
  O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe 
  O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe 
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{7295AF3C-0637-4AAE-80B4-B0BFC04036C1}: NameServer = 4.2.2.1,4.2.2.2 
  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe 
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe 
  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe 
  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe 
  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe 
  O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe 
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe 
   
  -- 
  End of file - 5972 bytes

kardesım suna bırdaha bakarmısın pc manyaklasdı kaspersky calısmıyor avastı kurdum ( on sezgıleme ıle bır burus bulundu ) dıyor pc yı kapatıp tarama yapıyor orda da vırus

bulunmadı dıyor ve bırde msn calısmıyor soylekı acılıyor ama maus ımlecının yanında saat kadranı cıkıyor herhangı bır ıslem yapdırmıyor sonra msn cevap vermıyor yazıyor anlıcan

ocagına dusduk :) pc manyaklasdı

saygılar

dediğiinz tüm işlemleri yaptım ve combo fix programı bu texti çıkardı gönderiyorum
yardımlarınız için şimdiden sağolunnn

ComboFix 08-11-19.08 - tezer 2008-11-23 23:14:46.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1254.1.1055.18.738 [GMT 2:00]
Running from: c:\documents and settings\tezer\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active

[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.
ADS - WINDOWS: deleted 134 bytes in 1 streams.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ll.dll
c:\windows\system32\mssystem.dll
c:\windows\system32\tdll.dll

.
((((((((((((((((((((((((( Files Created from 2008-10-23 to 2008-11-23 )))))))))))))))))))))))))))))))
.

2008-11-23 23:18 . 0 c:\windows\system32\drivers\CnxE2FS2.bin
2008-11-23 23:02 . 2008-11-23 23:02 <DIR> d-------- c:\windows\system32\Shell32
2008-11-23 22:48 . 2008-11-23 22:48 <DIR> d--h----- c:\windows\system32\GroupPolicy
2008-11-22 02:07 . 2008-11-22 02:16 664 --a------ c:\windows\system32\d3d9caps.dat
2008-11-16 22:02 . 2008-11-18 12:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\FLEXnet
2008-11-16 20:39 . 2008-11-16 20:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\ALM
2008-11-16 20:02 . 2008-04-07 05:38 45,392 -ra------ c:\windows\system32\AdobePDF.dll
2008-11-16 20:02 . 2008-04-07 05:38 22,872 -ra------ c:\windows\system32\AdobePDFUI.dll
2008-11-16 18:47 . 2008-11-16 18:47 <DIR> d-------- c:\program files\Adobe Media Player
2008-11-16 18:44 . 2008-11-16 18:44 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2008-11-16 18:32 . 2008-11-16 18:32 <DIR> d-------- c:\program files\Common Files\Macrovision Shared
2008-11-16 18:32 . 2008-10-19 02:48 469,268 --a------ C:\Adobe CS4 MCL-KeyG.EXE
2008-11-16 16:58 . 2008-11-16 16:58 0 --a------ c:\windows\nsreg.dat
2008-11-05 00:33 . 2008-11-05 00:37 <DIR> d-------- C:\Downloads
2008-11-05 00:32 . 2008-11-05 00:32 <DIR> d-------- c:\program files\IDA
2008-11-05 00:32 . 2008-11-11 10:52 <DIR> d-------- c:\documents and settings\tezer\Application Data\Internet Download Accelerator
2008-10-29 21:38 . 2008-10-29 21:38 72,000 --a------ c:\windows\system32\drivers\vmi386_64.sys
2008-10-29 21:37 . 2008-10-29 21:37 26,848 --a------ c:\windows\system32\drivers\vmi386.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-23 21:18 524,288 ----a-w c:\windows\system32\drivers\CnxE2FS.bin
2008-11-23 17:44 --------- d-----w c:\program files\sXe Injected
2008-11-23 00:35 --------- d-----w c:\program files\ESET
2008-11-22 23:04 --------- d-----w c:\program files\Valve
2008-11-16 20:01 --------- d-----w c:\program files\Common Files\Adobe
2008-10-11 17:30 --------- d-----w c:\program files\A4Tech
2008-09-28 21:21 --------- d-----w c:\documents and settings\tezer\Application Data\Media Player Classic
2008-09-28 21:17 --------- d-----w c:\program files\K-Lite Codec Pack
2008-09-28 21:14 --------- d-----w c:\documents and settings\tezer\Application Data\BSplayer Pro
2008-09-27 22:58 --------- d--h--w c:\program files\InstallShield Installation Information
2008-09-27 22:40 --------- d-----w c:\program files\MSN Messenger
2008-09-27 22:20 512,096 ----a-w c:\windows\system32\drivers\amon.sys
2008-09-27 22:20 298,104 ----a-w c:\windows\system32\imon.dll
2008-09-27 22:20 15,424 ----a-w c:\windows\system32\drivers\nod32drv.sys
2008-09-27 22:00 --------- d-----w c:\program files\Webteh
2008-09-27 21:31 --------- d-----w c:\program files\Zoom
2008-09-27 20:51 --------- d-----w c:\documents and settings\tezer\Application Data\InterTrust
2008-09-27 20:37 --------- d-----w c:\documents and settings\tezer\Application Data\AdobeUM
2008-09-27 05:45 --------- d-----w c:\program files\Common Files\SWF Studio
2008-09-26 15:02 --------- d-----w c:\program files\Common Files\InstallShield
2008-09-26 14:41 --------- d-----w c:\program files\Intel
2008-09-26 14:32 --------- d-----w c:\program files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2008-09-28 949376]
"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2006-12-26 196608]
"nwiz"="nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Valve\\hl.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R2 adfs;adfs;c:\windows\system32\drivers\adfs.sys [2008-08-14 74720]
R2 vmi386;vmi386;c:\windows\system32\drivers\vmi386.sys [2008-10-29 26848]
R2 vmi386_64;vmi386_64;c:\windows\system32\drivers\vmi386_64.sys [2008-10-29 72000]
S3 Amps2prt;A4Tech PS/2 Port Mouse Driver;c:\windows\system32\DRIVERS\Amps2prt.sys [2006-05-09 13824]
S3 ddsxeiservice;ddsxeiservice2;\??\c:\program files\sXe Injected\ddsxei.sys [2008-09-16 46464]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\tezer\Application Data\Mozilla\Firefox\Profiles\so2ovlgt.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com
FF -: plugin - c:\program files\Adobe\Acrobat 5.0\Reader\browser\nppdf32.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net
Rootkit scan 2008-11-23 23:18:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\:smss.exe 227840 bytes executable
c:\windows\system32\drivers\CnxE2FS2.bin 458752 bytes

scan completed successfully
hidden files: 2

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: c:\windows\system32\lsass.exe
-> c:\program files\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\ESET\nod32krn.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\taskmgr.exe
c:\windows\system32\notepad.exe
.
**************************************************************************
.
Completion time: 2008-11-23 23:21:41 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-23 21:21:05

Pre-Run: 54.593.671.168 bayt boş
Post-Run: 54,653,927,424 bayt boş

126

Merhabalar

Benim Log Dosyam Ağagıdakı Gibidir

İlginize Teşekkürler

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:31:13, on 24.11.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
E:\Program Files\Spybot - Search & Destroy\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
Z:\LMAINENG.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Messenger\msmsgs.exe
E:\Program Files\MajorShare\msrsd.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - d:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download by Orbit - res://d:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://d:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://d:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://d:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) -https://secure.logmein.com/activex/RACtrl.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) -http://www.natro.com/player/ampx_en_dl.cab
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

serji

Emekli Yönetici

9076 Mesaj

Tüm Başarılarını Gör

quote:

Orjinalden alıntı: Acme91
MerhabaLar.. benim Sorunum kaSperSky ı kuLLanamıyorum windowS otomatik oLarak devre dışı bırakıyor.. yıLLardır kaSperSky kuLLanırım iLk defa böyLe bir SorunLar karşıLaştım.. format atmıştım kurayım dedim bi baktım kendi kendine kapandı ve açıLmıyor artık.. ccleaner ıda uzun zamandır kuLLanırım ama onuda açamıyorum açıLıyor 2 Saniye Sonra kapanıyor.. yardımcı oLurSanız çok Sevinirim..
Not:işLetim SiStemim D: de yükLü

* HijackThis adlı programı açın.
* Do a system scan only seçeneğine tıklayın.
* Aşağıdaki satırları işaretleyin.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - D:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL  
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll 
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - D:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL 
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll 
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\Windows Live Toolbar\msntb.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll  
  O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - D:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL 
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll 
  O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - D:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL 
  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - D:\Program Files\Windows Live Toolbar\msntb.dll  
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre6\bin\jusched.exe"  
  O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe 
  O4 - HKCU\..\Run: [kamsoft] D:\WINDOWS\system32\kamsoft.exe  
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')  
  O8 - Extra context menu item: &Windows Live Search - res://D:\Program Files\Windows Live Toolbar\msntb.dll/search.htm  
  O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000  
  O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL  
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

* CTRL+ALT+DEL basıp işlemler sekmesine gelin. Kullanıcı Adınızın karşısındaki HijackThis.exe ve explorer.exe hariç tüm işlemleri sonlandırın. HijackThis hariç tüm programları, pencereleri kapatın ve Fix Checked butonuna tıklayın. Ardından bilgisayarınızı hemen yeniden başlatın.

Combofix adli programi indirin.

http://www.guvenlikuzmanim.com/dosyalar/ComboFix.exe

1. Tüm açık pencerelerinizi ve programlarınızı kapatın.
2. Antivirüs ve Antispyware programlarınızı geçici olarak kapatın veya devre dışı bırakın.
3. ComboFix.exe üzerine çift tıklayın ve programı açın. Programı açtıktan sonra kesinlikle hiç bir işlem yapmayın. 1-2 dakikalık bir mola verin.
4. ComboFix çalışmaya başladıktan sonra sizden 1 ya da 2 tuşuna basmanız istenecektir. Devam etmek için 1 tuşuna basın.
5. ComboFix olası bir aksilik durumunda sistemizi geri yükleyebilmek amacıyla Kayıt Defterinizin bir yedeğini alacak ve bir sistem geri yükleme noktası oluşturacaktır.
6. Bu işlemler sırasında internet bağlantınız kesilecektir. Bu normaldir. Ayrıca sistem saatiniz de değişecektir. Fakat tüm bunlar geçicidir. İşlemler bittikten sonra hepsi orjinal haline geri döndürülecektir.
7. Biraz sabırlı olmanız gerekebilir çünkü tam 41 aşama söz konusudur.
8. Son olarak ComboFix işlemlerin sonucunu içeren bir rapor hazırlayacaktır. Bu sırada masaüstünüz kaybolabilir. Fakat kısa sürede geri yüklenecektir. İşlemler bittikten sonra ComboFix kapanacak ve size bir rapor açılacaktır. Bu raporu C:\ComboFix.txt bulabilirsiniz.
9. C:\ComboFix.txt dosyasını mesajınıza ekleyerek bize gönderin.

serji

Emekli Yönetici

9076 Mesaj

Tüm Başarılarını Gör

serji

Emekli Yönetici

9076 Mesaj

Tüm Başarılarını Gör

quote:

Orjinalden alıntı: lvluratt

Merhabalar

Benim Log Dosyam Ağagıdakı Gibidir

İlginize Teşekkürler

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - d:\Program Files\Orbitdownloader\orbitcth.dll 
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll  
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll 
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll  
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present 
  O8 - Extra context menu item: &Download by Orbit - res://d:\Program Files\Orbitdownloader\orbitmxt.dll/201 
  O8 - Extra context menu item: &Grab video by Orbit - res://d:\Program Files\Orbitdownloader\orbitmxt.dll/204 
  O8 - Extra context menu item: Do&wnload selected by Orbit - res://d:\Program Files\Orbitdownloader\orbitmxt.dll/203 
  O8 - Extra context menu item: Down&load all by Orbit - res://d:\Program Files\Orbitdownloader\orbitmxt.dll/202 
  O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+ (301. sayfa)