HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+ (442. sayfa)

quote:

Orijinalden alıntı: MrPesimist

Teşekkürler.

quote:

Orijinalden alıntı: drakin

serji hocam pc berbat durumda kis ile taramaya yaptığımda veya biraz fazla uygulama açtığımda tak kitleniyor.veya pc açılınca direk kitleniyor buda log:

quote:

ComboFix 09-10-22.01 - Administrator 23.10.2009 13:05.4.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1254.90.1055.18.2046.1590 [GMT 3:00]
Running from: c:\documents and settings\Administrator\Belgelerim\İndirilenler\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-09-23 to 2009-10-23 )))))))))))))))))))))))))))))))
.

2009-10-22 15:26 . 2009-10-22 15:26 604140 --sha-w- c:\windows\system32\drivers\ISwift3.dat
2009-10-22 15:21 . 2009-10-22 15:47 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2009-10-22 15:21 . 2009-10-22 15:47 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2009-10-19 15:01 . 2009-10-19 15:01 -------- d-----w- c:\windows\system32\wbem\Repository
2009-10-19 15:00 . 2009-10-19 15:00 -------- d-----w- c:\program files\AGEIA Technologies
2009-10-19 15:00 . 2009-10-19 15:00 -------- d-----w- c:\windows\system32\AGEIA
2009-10-19 15:00 . 2009-10-19 15:00 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-19 15:00 . 2009-10-19 15:00 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2009-10-19 14:59 . 2009-10-22 15:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-10-19 14:59 . 2009-10-19 14:59 -------- d-----w- c:\program files\Kaspersky Lab
2009-10-19 14:56 . 2009-10-19 14:59 -------- d-----w- c:\program files\ATI Technologies
2009-10-19 14:56 . 2009-10-19 14:56 -------- d-----w- C:\ATI
2009-10-19 14:38 . 2009-10-19 14:53 -------- d-----w- c:\program files\ATI(2)
2009-10-19 14:04 . 2009-10-19 14:54 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI(3)
2009-10-19 14:01 . 2009-10-19 14:55 -------- d-----w- c:\program files\ATI Technologies(3)
2009-10-19 14:00 . 2009-10-19 14:55 -------- d-----w- C:\ATI(3)
2009-10-19 13:57 . 2009-10-19 14:56 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI(2)
2009-10-19 13:54 . 2009-10-19 14:56 -------- d-----w- c:\program files\ATI Technologies(2)
2009-10-19 13:54 . 2009-10-19 14:56 -------- d-----w- C:\ATI(2)
2009-10-14 17:48 . 2009-10-14 17:48 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-10-14 15:49 . 2009-10-14 15:49 -------- d-----w- c:\windows\CatRoot
2009-10-14 15:49 . 2005-02-06 08:44 93664 ----a-w- c:\windows\system32\drivers\usbVM31b.sys
2009-10-14 15:49 . 2004-12-15 16:01 40960 ----a-w- c:\windows\VM_STI.EXE
2009-10-14 15:49 . 2004-12-10 11:30 61440 ----a-w- c:\windows\system32\VM31bSTI.dll
2009-10-14 15:49 . 2004-12-10 07:07 94208 ----a-w- c:\windows\VMCap.exe
2009-10-14 15:49 . 2004-12-09 12:41 57344 ----a-w- c:\windows\StillCap.exe
2009-10-14 15:49 . 2002-10-16 06:29 49152 ----a-w- c:\windows\amcap.exe
2009-10-14 15:49 . 2000-10-31 09:00 307200 ----a-w- c:\windows\vidcap32.Exe
2009-10-14 15:49 . 2009-10-14 15:49 -------- d-----w- c:\program files\Vimicro
2009-10-02 23:13 . 2009-10-23 10:10 -------- d-----w- c:\documents and settings\Administrator\Application Data\LimeWire
2009-10-02 23:12 . 2009-10-02 23:12 -------- d-----w- c:\program files\LimeWire
2009-09-26 21:37 . 2008-07-31 07:41 238088 ----a-w- c:\windows\system32\xactengine3_2.dll
2009-09-26 21:37 . 2008-07-31 07:41 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll
2009-09-26 21:37 . 2008-07-31 07:40 509448 ----a-w- c:\windows\system32\XAudio2_2.dll
2009-09-26 21:37 . 2008-07-12 05:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2009-09-26 21:37 . 2008-07-12 05:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2009-09-26 21:37 . 2008-07-12 05:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2009-09-26 21:36 . 2009-09-26 21:36 -------- d-----w- c:\windows\Logs
2009-09-26 21:23 . 2009-09-26 21:23 -------- d-----w- c:\program files\Activision
2009-09-26 21:20 . 2009-09-26 21:20 -------- d-----w- c:\program files\Common Files\EZB Systems
2009-09-26 21:20 . 2009-09-26 21:20 -------- d-----w- c:\program files\UltraISO
2009-09-26 20:02 . 2009-08-13 18:05 593920 ------w- c:\windows\system32\ati2sgag.exe
2009-09-25 20:47 . 2009-09-25 20:47 -------- d-----w- c:\documents and settings\LocalService\Application Data\Sony Ericsson
2009-09-25 01:56 . 2009-10-19 15:00 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-25 01:56 . 2009-10-19 15:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-25 01:45 . 2009-09-25 01:45 -------- d-----w- c:\windows\system32\xircom
2009-09-25 01:45 . 2009-09-25 01:45 -------- d-----w- c:\windows\system32\wbem\snmp
2009-09-25 01:45 . 2009-09-25 01:45 -------- d-----w- c:\program files\microsoft frontpage

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-23 09:46 . 2009-09-10 20:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-10-22 20:23 . 2009-09-20 10:06 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-22 20:22 . 2009-09-20 10:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\MyPhoneExplorer
2009-10-22 16:02 . 2009-09-11 07:55 -------- d-----w- c:\documents and settings\Administrator\Application Data\Winamp
2009-10-19 15:02 . 2009-09-13 14:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-19 15:01 . 2009-09-11 09:06 -------- d-----w- c:\documents and settings\Administrator\Application Data\Azureus
2009-10-15 19:16 . 2009-09-17 21:03 -------- d-----w- c:\program files\Vuze
2009-10-14 15:49 . 2009-09-10 20:19 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-14 15:49 . 2009-09-10 20:19 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-07 20:44 . 2009-09-10 21:36 -------- d-----w- c:\program files\The KMPlayer
2009-09-28 20:57 . 2009-09-14 23:53 -------- d-----w- c:\documents and settings\Administrator\Application Data\FileZilla
2009-09-26 12:28 . 2009-09-15 18:52 -------- d-----w- c:\program files\cFosSpeed
2009-09-25 22:48 . 2008-04-15 12:00 81332 ----a-w- c:\windows\system32\perfc01F.dat
2009-09-25 22:48 . 2008-04-15 12:00 427962 ----a-w- c:\windows\system32\perfh01F.dat
2009-09-25 22:30 . 2009-09-20 01:24 -------- d-----w- c:\program files\ApexDC++
2009-09-20 10:07 . 2009-09-20 10:06 -------- d-----w- c:\program files\MyPhoneExplorer
2009-09-18 07:56 . 2009-09-18 07:56 -------- d-----w- c:\documents and settings\Administrator\Application Data\Foxit
2009-09-18 07:55 . 2009-09-18 07:55 -------- d-----w- c:\program files\Foxit Software
2009-09-17 20:36 . 2009-09-10 20:22 15408 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-17 16:43 . 2009-09-17 16:43 67568 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-09-16 17:09 . 2009-09-16 17:09 -------- d-----w- c:\program files\Zoom
2009-09-15 23:25 . 2009-09-10 22:29 -------- d-----w- c:\program files\MSN Messenger
2009-09-15 23:25 . 2009-09-15 23:25 -------- d-----w- c:\program files\Microsoft
2009-09-15 23:25 . 2009-09-10 22:30 -------- d-----w- c:\program files\Windows Live
2009-09-15 23:25 . 2009-09-15 23:25 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-15 18:05 . 2009-09-15 18:05 -------- d-----w- c:\program files\FileZilla FTP Client
2009-09-15 13:48 . 2009-09-15 13:48 -------- d-----w- c:\documents and settings\All Users\Application Data\GlobalSCAPE
2009-09-15 13:44 . 2009-09-15 13:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\GlobalSCAPE
2009-09-15 13:44 . 2009-09-15 13:44 -------- d-----w- c:\program files\GlobalSCAPE
2009-09-13 23:32 . 2009-09-13 23:32 -------- d-----w- c:\documents and settings\Administrator\Application Data\Media Player Classic
2009-09-13 15:22 . 2009-09-13 15:22 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-09-13 15:22 . 2009-09-13 15:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-13 11:32 . 2009-09-13 11:32 -------- d-----w- c:\program files\ConvertHelper
2009-09-11 11:54 . 2009-09-11 11:53 -------- d-----w- c:\documents and settings\Administrator\Application Data\Teleca
2009-09-11 11:52 . 2009-09-11 11:48 -------- d-----w- c:\program files\Common Files\Teleca Shared
2009-09-11 11:48 . 2009-09-11 11:48 -------- d-----w- c:\documents and settings\Administrator\Application Data\Sony Ericsson
2009-09-11 11:48 . 2009-09-11 11:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Teleca
2009-09-11 11:48 . 2009-09-11 11:48 -------- d-----w- c:\program files\Common Files\Sony Ericsson Shared
2009-09-11 11:48 . 2009-09-11 11:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Sony Ericsson
2009-09-11 11:48 . 2009-09-11 11:48 -------- d-----w- c:\program files\Sony Ericsson
2009-09-11 09:06 . 2009-09-11 09:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Azureus
2009-09-11 07:56 . 2009-09-11 07:55 -------- d-----w- c:\program files\Winamp
2009-09-11 00:32 . 2009-09-11 00:32 -------- d-----w- c:\program files\MSXML 4.0
2009-09-11 00:29 . 2009-09-11 00:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-09-11 00:10 . 2009-09-11 00:11 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-11 00:10 . 2009-09-11 00:10 -------- d-----w- c:\program files\Java
2009-09-10 23:56 . 2009-09-10 23:21 -------- d-----w- c:\documents and settings\Administrator\Application Data\Nero
2009-09-10 23:55 . 2009-09-10 23:20 -------- d-----w- c:\program files\Nero
2009-09-10 23:21 . 2009-09-10 23:21 -------- d-----w- c:\program files\Common Files\Nero
2009-09-10 23:21 . 2009-09-10 23:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-09-10 22:54 . 2009-09-10 22:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\Vso
2009-09-10 22:54 . 2009-09-10 22:52 81920 ----a-w- c:\documents and settings\Administrator\Application Data\ezpinst.exe
2009-09-10 22:54 . 2009-09-10 22:52 47360 ----a-w- c:\documents and settings\Administrator\Application Data\pcouffin.sys
2009-09-10 22:52 . 2009-09-10 22:52 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2009-09-10 22:37 . 2009-09-10 22:37 0 ----a-w- c:\windows\nsreg.dat
2009-09-10 22:30 . 2009-09-10 22:30 -------- d-----w- c:\program files\Messenger Plus! Live
2009-09-10 22:28 . 2009-09-10 22:28 0 ----a-w- c:\windows\ativpsrm.bin
2009-09-10 21:47 . 2009-09-10 21:47 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-09-10 21:31 . 2009-09-10 21:18 -------- d-----w- c:\program files\GRETECH
2009-09-10 21:19 . 2009-09-10 21:19 -------- d-----w- c:\program files\Common Files\Windows Live
2009-09-10 20:50 . 2009-09-10 20:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\ATI
2009-09-10 20:42 . 2009-09-10 20:42 128016 ----a-w- c:\windows\system32\drivers\kl1.sys
2009-09-10 19:38 . 2009-09-10 19:38 -------- d-----w- c:\program files\MSBuild
2009-09-10 19:38 . 2009-09-10 19:38 -------- d-----w- c:\program files\Reference Assemblies
2009-09-10 19:33 . 2009-09-10 19:33 -------- d-----w- c:\documents and settings\All Users\Application Data\GroupPolicy
2009-09-10 19:33 . 2009-09-10 19:33 21736 ----a-w- c:\windows\system32\emptyregdb.dat
2009-09-10 19:32 . 2009-09-10 19:32 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-10 19:31 . 2009-09-10 19:31 -------- d-----w- c:\program files\Windows Media Connect 2
2009-09-10 19:31 . 2009-09-10 19:31 -------- d-----w- c:\program files\LiraConv
2009-09-10 11:54 . 2009-09-13 15:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 11:53 . 2009-09-13 14:57 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-16 15:08 . 2009-09-13 23:32 178176 ----a-w- c:\windows\system32\unrar.dll
2009-08-14 04:27 . 2009-07-15 04:20 4485632 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2009-08-14 02:28 . 2009-08-14 02:28 446464 ----a-w- c:\windows\system32\ATIDEMGX.dll
2009-08-14 02:27 . 2009-09-26 19:26 345600 ----a-w- c:\windows\system32\ati2dvag.dll
2009-08-14 02:27 . 2009-09-26 19:26 345600 ----a-w- c:\windows\system32\ati2dvag(6).dll
2009-08-14 02:27 . 2009-09-26 19:26 345600 ----a-w- c:\windows\system32\ati2dvag(5).dll
2009-08-14 02:27 . 2009-09-26 19:26 345600 ----a-w- c:\windows\system32\ati2dvag(4).dll
2009-08-14 02:27 . 2009-09-26 19:26 345600 ----a-w- c:\windows\system32\ati2dvag(3).dll
2009-08-14 02:27 . 2009-09-26 19:26 345600 ----a-w- c:\windows\system32\ati2dvag(2).dll
2009-08-14 02:10 . 2009-08-14 02:10 204800 ----a-w- c:\windows\system32\atipdlxx.dll
2009-08-14 02:10 . 2009-08-14 02:10 204800 ----a-w- c:\windows\system32\atipdlxx(6).dll
2009-08-14 02:10 . 2009-08-14 02:10 204800 ----a-w- c:\windows\system32\atipdlxx(5).dll
2009-08-14 02:10 . 2009-08-14 02:10 204800 ----a-w- c:\windows\system32\atipdlxx(4).dll
2009-08-14 02:10 . 2009-08-14 02:10 204800 ----a-w- c:\windows\system32\atipdlxx(3).dll
2009-08-14 02:10 . 2009-08-14 02:10 204800 ----a-w- c:\windows\system32\atipdlxx(2).dll
2009-08-14 02:10 . 2009-08-14 02:10 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2009-08-14 02:08 . 2009-08-14 02:08 602112 ----a-w- c:\windows\system32\ati2evxx.exe
2009-08-14 02:08 . 2009-08-14 02:08 602112 ----a-w- c:\windows\system32\ati2evxx(6).exe
2009-08-14 02:08 . 2009-08-14 02:08 602112 ----a-w- c:\windows\system32\ati2evxx(5).exe
2009-08-14 02:08 . 2009-08-14 02:08 602112 ----a-w- c:\windows\system32\ati2evxx(4).exe
2009-08-14 02:08 . 2009-08-14 02:08 602112 ----a-w- c:\windows\system32\ati2evxx(3).exe
2009-08-14 02:08 . 2009-08-14 02:08 602112 ----a-w- c:\windows\system32\ati2evxx(2).exe
2009-08-14 02:06 . 2009-08-14 02:06 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2009-08-14 02:00 . 2009-08-14 02:00 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2009-08-14 01:58 . 2009-09-26 19:26 3492576 ----a-w- c:\windows\system32\ati3duag.dll
2009-08-14 01:58 . 2009-09-26 19:26 3492576 ----a-w- c:\windows\system32\ati3duag(6).dll
2009-08-14 01:58 . 2009-09-26 19:26 3492576 ----a-w- c:\windows\system32\ati3duag(5).dll
2009-08-14 01:58 . 2009-09-26 19:26 3492576 ----a-w- c:\windows\system32\ati3duag(4).dll
2009-08-14 01:58 . 2009-09-26 19:26 3492576 ----a-w- c:\windows\system32\ati3duag(3).dll
.

------- Sigcheck -------

[-] 2008-05-20 . 356A9AA52B02AF8C6E0E2CC4B6C73998 . 1139200 . . [6.00.2900.5512] . . c:\windows\explorer.exe
.
((((((((((((((((((((((((((((( SnapShot_2009-10-22_16.19.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-23 10:09 . 2009-10-23 10:09 16384 c:\windows\temp\Perflib_Perfdata_148.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-09-21 133104]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-08-13 98304]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]
"avp"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-07-03 303376]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2008-04-10 16861184]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2009-03-08 128512]

c:\documents and settings\Administrator\Start Menu\Programlar\BaŸlang‡\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2009-9-30 503808]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMMyPictures"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Activision\\X-Men Origins - Wolverine(TM)\\Binaries\\Wolverine.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [15.12.2008 20:41 33808]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [13.09.2009 18:22 269648]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [13.05.2009 17:46 31760]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [16.05.2009 20:59 19472]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [13.09.2009 17:57 19160]
.
.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = hxxp://www.google.com.tr/
TCP: {795225C6-3E09-4565-BEA6-72D42631A926} = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\emu4q7zj.default\
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net
Rootkit scan 2009-10-23 13:09
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1390067357-861567501-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6b,65,1e,44,87,a0,eb,45,ac,45,ac,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,6b,65,1e,44,87,a0,eb,45,ac,45,ac,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1064)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3072)
c:\windows\system32\WININET.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\combofix\CF3874.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Common Files\Teleca Shared\Generic.exe
c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\combofix\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-23 13:12 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-23 10:12
ComboFix2.txt 2009-10-22 16:21
ComboFix3.txt 2009-10-02 22:13
ComboFix4.txt 2009-09-25 01:48

Pre-Run: 82.117.935.104 bayt boş
Post-Run: 87.376.637.952 bayt boş

- - End Of File - - 1B6D44460D54B5292AA0D4D2A4C22DB8

quote:

Orijinalden alıntı: satore

Görev Yöneticisi ve Kayıt defteri açılmıyor ve virüs programı kuramıyorum programı kurduğum anda kapanıyor virüs
ayrıca internete girdiğimde bir süre sonra hata veriyor runtime error gibi bişeydi sanırım tamam dedikten sonra hata raporu veriyor tam bunu yollamıştımki hata verdi aynen yazıyorum Runtime Error! program:c:\programfiles\internet explorer\ixplore.exe R6025 pure virtuel function call

quote:

Orijinalden alıntı: drakin
dediklerini fixledim sonrada combofixle tarama yaptım log yukarda.

quote:

ComboFix 09-10-24.03 - yakamoz 25.10.2009 16:30.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1254.90.1055.18.1022.541 [GMT 2:00]
Running from: c:\documents and settings\yakamoz\Belgelerim\İndirilenler\software\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\FlashGet Network
c:\windows\system32\scrrntr.dll
.
---- Previous Run -------
.
c:\documents and settings\yakamoz\Application Data\BITS
c:\documents and settings\yakamoz\Application Data\BITS\BITS.ini
c:\documents and settings\yakamoz\Application Data\BITS\DHTTable.dat
c:\documents and settings\yakamoz\Application Data\BITS\pl.dat
c:\documents and settings\yakamoz\Application Data\BITS\ProxyList.ini
c:\documents and settings\yakamoz\Application Data\BITS\Torrent\20091020160659.torrent
c:\documents and settings\yakamoz\Application Data\BITS\Torrent\20091020160659.torrent.filelist
c:\documents and settings\yakamoz\Application Data\BITS\UPnP.ini
c:\documents and settings\yakamoz\Application Data\FlashGetBHO
c:\documents and settings\yakamoz\Application Data\FlashGetBHO\FlashGetBHO3.dll
c:\documents and settings\yakamoz\Application Data\FlashGetBHO\GetAllUrl.htm
c:\documents and settings\yakamoz\Application Data\FlashGetBHO\GetUrl.htm
c:\program files\FlashGet Network\FlashGet 3\adns.dll
c:\program files\FlashGet Network\FlashGet 3\btcoreu.dll
c:\program files\FlashGet Network\FlashGet 3\BugReport.dll
c:\program files\FlashGet Network\FlashGet 3\BugReport.exe
c:\program files\FlashGet Network\FlashGet 3\cd1.ico
c:\program files\FlashGet Network\FlashGet 3\ckcore.dll
c:\program files\FlashGet Network\FlashGet 3\commonlib.dll
c:\program files\FlashGet Network\FlashGet 3\componentskrnl.dll
c:\program files\FlashGet Network\FlashGet 3\config\clients.met
c:\program files\FlashGet Network\FlashGet 3\config\clients.met.bak
c:\program files\FlashGet Network\FlashGet 3\config\cryptkey.dat
c:\program files\FlashGet Network\FlashGet 3\config\emfriends.met
c:\program files\FlashGet Network\FlashGet 3\config\key_index.dat
c:\program files\FlashGet Network\FlashGet 3\config\known.met
c:\program files\FlashGet Network\FlashGet 3\config\known2_64.met
c:\program files\FlashGet Network\FlashGet 3\config\load_index.dat
c:\program files\FlashGet Network\FlashGet 3\config\nodes.dat
c:\program files\FlashGet Network\FlashGet 3\config\preferences.dat
c:\program files\FlashGet Network\FlashGet 3\config\preferences.ini
c:\program files\FlashGet Network\FlashGet 3\config\preferencesKad.dat
c:\program files\FlashGet Network\FlashGet 3\config\server.met
c:\program files\FlashGet Network\FlashGet 3\config\server_met.old
c:\program files\FlashGet Network\FlashGet 3\config\src_index.dat
c:\program files\FlashGet Network\FlashGet 3\config\upload.met
c:\program files\FlashGet Network\FlashGet 3\corestat.dll
c:\program files\FlashGet Network\FlashGet 3\dat\Appsetting.cfg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\1.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\1.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\2.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\3.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\btn1.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\btn2.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\cig.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\cig1.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_1_2.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_2_2.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_3.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_4.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_5.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_5_2.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_icon01.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_icon02.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_icon03.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_icon04.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_WuBiaoTi-3.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\client_WuBiaoTi-3_1.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\dian.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\directui_new_1256291569.zip
c:\program files\FlashGet Network\FlashGet 3\dat\directui\down.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\game.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\game.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\game1.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\gameall.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\gametop.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\ico01.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\ico02.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\line.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\movie.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\movie1.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\new_rescenter.txt
c:\program files\FlashGet Network\FlashGet 3\dat\directui\newgame.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\newmovie.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p1.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p2.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p3.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p4.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p5.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p6.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p7.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\p8.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\pic_bg.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\preview.gif
c:\program files\FlashGet Network\FlashGet 3\dat\directui\reom.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\reom.jpg1
c:\program files\FlashGet Network\FlashGet 3\dat\directui\rescenter.txt
c:\program files\FlashGet Network\FlashGet 3\dat\directui\soft.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\soft_zhan.jpg
c:\program files\FlashGet Network\FlashGet 3\dat\directui\tab.gif
c:\program files\FlashGet Network\FlashGet 3\dat\FlashGet3db.bak
c:\program files\FlashGet Network\FlashGet 3\dat\FlashGet3db.db
c:\program files\FlashGet Network\FlashGet 3\dat\stat\advertisement\adconfig.ini
c:\program files\FlashGet Network\FlashGet 3\dat\stat\advertisement\port.ini
c:\program files\FlashGet Network\FlashGet 3\dbghelp.dll
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\css\lightbox.css
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\default.htm
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\banner.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\bullet.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\close.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\closelabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\download-icon.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\explorer.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\ftp.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\ftp_1.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\ftp_2.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\ftp_3.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\image.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\image_1.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\image_2.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\image_3.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\introTextBg.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\loading.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\nextlabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\prevlabel.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\software.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\software_1.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\software_2.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\software_3.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\vod.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\vod_1.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\vod_2.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\images\vod_3.gif
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\js\builder.js
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\js\effects.js
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\js\lightbox.js
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\js\prototype.js
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\data\js\scriptaculous.js
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\FGResDetector.exe
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\about.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\ftplist_tree_icon.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\option_icon.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\quickop_hide.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\quickop_show.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\statusbar_bk.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\tasktab_close.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_back.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_bk.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_close.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_forward.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\image\toolbar_refresh.png
c:\program files\FlashGet Network\FlashGet 3\FGResDetector_I\lang\l.eng.xml
c:\program files\FlashGet Network\FlashGet 3\Flashget3.exe
c:\program files\FlashGet Network\FlashGet 3\FlashGet3.xpi
c:\program files\FlashGet Network\FlashGet 3\FlashGetBHO3.dll
c:\program files\FlashGet Network\FlashGet 3\fnsArchive.dll
c:\program files\FlashGet Network\FlashGet 3\fnsDirectuix.dll
c:\program files\FlashGet Network\FlashGet 3\fnsLanguage_en.dll
c:\program files\FlashGet Network\FlashGet 3\fnsScheduler.dll
c:\program files\FlashGet Network\FlashGet 3\fnsSecurity.dll
c:\program files\FlashGet Network\FlashGet 3\fnsSkinX.dll
c:\program files\FlashGet Network\FlashGet 3\fnsStatistics.dll
c:\program files\FlashGet Network\FlashGet 3\game.ico
c:\program files\FlashGet Network\FlashGet 3\gdiplus.dll
c:\program files\FlashGet Network\FlashGet 3\GoogleToolbarInstaller_download_signed.exe
c:\program files\FlashGet Network\FlashGet 3\id3lib.dll
c:\program files\FlashGet Network\FlashGet 3\libem.dll
c:\program files\FlashGet Network\FlashGet 3\license.txt
c:\program files\FlashGet Network\FlashGet 3\lst_tz.bin
c:\program files\FlashGet Network\FlashGet 3\P2PCfg.ini
c:\program files\FlashGet Network\FlashGet 3\P2PCore.dll
c:\program files\FlashGet Network\FlashGet 3\P2SCore.dll
c:\program files\FlashGet Network\FlashGet 3\perf.ini
c:\program files\FlashGet Network\FlashGet 3\pncrt.dll
c:\program files\FlashGet Network\FlashGet 3\pstat.dat
c:\program files\FlashGet Network\FlashGet 3\pup.dat
c:\program files\FlashGet Network\FlashGet 3\RdOldDb.dll
c:\program files\FlashGet Network\FlashGet 3\RealMediaSplitter.ax
c:\program files\FlashGet Network\FlashGet 3\SamplerCli.dll
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\BarSet.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_check.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_normal.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\btn_radio.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\desktoplink.ico
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\login_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\menu_icon.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\option_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\option_page_line.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\skin.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\statusbar_ad_bk.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\statusbar_ad_bk_long.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\SuspendLogo.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\SuspendNoLogo.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_backgrand.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_cancle.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_catgroy.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_group.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_new.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_open.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_option.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_pause.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_recly.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbar_start.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_left.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_middle.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\toolbarbutton_right.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\top_logotitle.gif
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\torrent.ico
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\userinfo_head.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\image\VistaStyleListItems.bmp
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\preview.png
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\skin.xml
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\loginfailed.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\loginsucc.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\msgnotify.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\sound\notify.wav
c:\program files\FlashGet Network\FlashGet 3\skin\international\default\topmain.png
c:\program files\FlashGet Network\FlashGet 3\SnapShot.dll
c:\program files\FlashGet Network\FlashGet 3\storage.dll
c:\program files\FlashGet Network\FlashGet 3\SysOptimize.exe
c:\program files\FlashGet Network\FlashGet 3\uninst.exe
c:\program files\FlashGet Network\FlashGet 3\unrar.dll
c:\program files\FlashGet Network\FlashGet 3\VodCore.dll
c:\program files\FlashGet Network\FlashGet 3\zlib.dll
c:\windows\system32\ieuinit.inf
c:\windows\system32\scrrntr.dll
c:\windows\system32\secustat.dat

.
((((((((((((((((((((((((( Files Created from 2009-09-25 to 2009-10-25 )))))))))))))))))))))))))))))))
.

2009-10-25 13:40 . 2009-10-25 13:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-25 13:40 . 2009-10-25 13:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-25 13:14 . 2009-10-25 13:14 -------- d-----w- c:\documents and settings\yakamoz\Local Settings\Application Data\Adobe
2009-10-23 18:40 . 2009-10-23 18:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Panda Software
2009-10-23 13:23 . 2009-10-23 13:23 -------- d-----w- c:\documents and settings\yakamoz\Application Data\Apple Computer
2009-10-23 13:22 . 2009-10-23 13:22 -------- d-----w- c:\documents and settings\yakamoz\Local Settings\Application Data\Apple Computer
2009-10-23 04:18 . 2009-10-23 04:18 -------- d-----w- C:\Panda Software
2009-10-23 02:01 . 2009-10-23 02:01 -------- d-----w- c:\documents and settings\yakamoz\Local Settings\Application Data\Identities
2009-10-23 01:47 . 2009-10-23 01:47 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-10-23 01:20 . 2009-10-23 01:20 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit
2009-10-23 01:20 . 2009-10-23 01:20 -------- d-----w- c:\program files\IObit
2009-10-23 01:05 . 2009-10-23 01:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Backup
2009-10-23 01:05 . 2009-10-23 19:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Panda Security
2009-10-23 00:45 . 2009-10-23 00:45 12912 ----a-w- c:\documents and settings\yakamoz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-22 21:56 . 2009-10-22 21:56 -------- d-----w- c:\documents and settings\yakamoz\Local Settings\Application Data\Winamp Toolbar
2009-10-22 18:45 . 2009-10-22 18:45 -------- d-----w- c:\documents and settings\yakamoz\Local Settings\Application Data\AirTies
2009-10-22 18:43 . 2009-10-22 18:43 -------- d-----w- c:\documents and settings\yakamoz\Local Settings\Application Data\Mozilla
2009-10-21 14:49 . 2009-10-21 14:49 -------- d-----w- c:\documents and settings\All Users\Application Data\F-Secure
2009-10-20 11:04 . 2005-01-02 21:43 4682 ----a-w- c:\windows\system32\npptNT2.sys
2009-10-20 11:02 . 2009-10-20 11:02 -------- d-----w- c:\program files\Common Files\INCA Shared
2009-10-19 10:34 . 2009-10-19 10:34 -------- d-----w- c:\program files\Winamp Toolbar
2009-10-19 10:34 . 2009-10-19 10:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Winamp Toolbar
2009-10-19 10:33 . 2009-10-24 17:52 -------- d-----w- c:\documents and settings\yakamoz\Application Data\Winamp
2009-10-18 16:00 . 2009-10-18 16:00 -------- d-----w- c:\program files\QuickTime
2009-10-18 16:00 . 2009-10-18 16:00 -------- d-----w- c:\program files\Apple Software Update
2009-10-18 15:59 . 2009-10-18 16:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-10-18 15:56 . 2009-10-18 15:56 -------- d-----w- c:\program files\Webteh
2009-10-18 15:47 . 2009-10-18 15:47 -------- d-----w- c:\program files\Common Files\xing shared
2009-10-18 15:47 . 2009-10-18 15:47 499712 ----a-w- c:\windows\system32\msvcp71.dll
2009-10-18 15:47 . 2009-10-18 15:47 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-10-18 15:47 . 2009-10-18 15:47 -------- d-----w- c:\program files\Common Files\Real
2009-10-18 15:47 . 2009-10-18 15:47 -------- d-----w- c:\program files\Real
2009-10-18 15:39 . 2008-02-21 02:05 120056 ------w- c:\windows\system32\pxcpyi64.exe
2009-10-18 15:39 . 2008-02-21 02:05 118520 ------w- c:\windows\system32\pxinsi64.exe
2009-10-18 15:39 . 2009-10-23 13:23 -------- d-----w- c:\program files\DivX
2009-10-17 15:25 . 2009-10-25 14:10 7630 ----a-w- c:\windows\system32\secushr.dat
2009-10-14 16:32 . 2009-10-16 14:09 -------- d-----w- c:\program files\2Near
2009-10-13 11:12 . 2009-10-13 11:12 -------- d-----w- c:\program files\DVDVideoSoft
2009-10-07 16:25 . 2001-08-18 02:36 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2009-10-07 16:25 . 2001-08-18 02:36 8704 ----a-w- c:\windows\system32\kbdjpn.dll
2009-10-07 16:25 . 2001-08-18 02:36 8192 -c--a-w- c:\windows\system32\dllcache\kbdkor.dll
2009-10-07 16:25 . 2001-08-18 02:36 8192 ----a-w- c:\windows\system32\kbdkor.dll
2009-10-07 16:25 . 2001-08-17 18:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd106.dll
2009-10-07 16:25 . 2001-08-17 18:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd101c.dll
2009-10-07 16:25 . 2001-08-17 18:55 6144 -c--a-w- c:\windows\system32\dllcache\kbd101b.dll
2009-10-07 16:25 . 2001-08-17 18:55 6144 ----a-w- c:\windows\system32\kbd106.dll
2009-10-07 16:25 . 2001-08-17 18:55 6144 ----a-w- c:\windows\system32\kbd101c.dll
2009-10-07 16:25 . 2001-08-17 18:55 6144 ----a-w- c:\windows\system32\kbd101b.dll
2009-10-07 16:25 . 2001-08-17 18:55 5632 -c--a-w- c:\windows\system32\dllcache\kbd103.dll
2009-10-07 16:25 . 2001-08-17 18:55 5632 ----a-w- c:\windows\system32\kbd103.dll
2009-10-06 23:11 . 2009-10-08 10:37 -------- d-----w- c:\documents and settings\yakamoz\Application Data\MessengerDiscovery 2
2009-10-06 23:11 . 2009-10-13 07:29 -------- d-----w- c:\program files\MessengerDiscovery 2
2009-10-06 18:25 . 2009-10-13 07:28 -------- d-----w- c:\program files\Windows Media Connect 2
2009-10-06 18:24 . 2009-10-06 18:24 -------- d-----w- c:\windows\system32\drivers\UMDF
2009-10-06 18:24 . 2009-10-06 18:24 -------- d-----w- c:\windows\system32\LogFiles
2009-10-06 11:11 . 2009-10-06 11:11 -------- d--h--w- c:\windows\system32\GroupPolicy
2009-10-02 09:16 . 2005-07-01 13:56 2969600 ------w- c:\windows\UNNMP.exe
2009-10-02 09:15 . 2001-07-09 08:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe
2009-10-02 09:14 . 2009-10-02 09:14 -------- d-----w- c:\program files\Common Files\Nero
2009-10-02 09:13 . 2005-07-01 13:56 2969600 ------w- c:\windows\UNNeroVision.exe
2009-10-02 09:13 . 2001-03-08 16:30 24064 ------w- c:\windows\system32\msxml3a.dll
2009-10-02 09:12 . 2009-10-02 09:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Ahead
2009-10-02 09:12 . 2004-07-26 14:16 476320 ------w- c:\windows\system32\ImagXpr7.dll
2009-10-02 09:12 . 2004-07-26 14:16 471040 ------w- c:\windows\system32\ImagXRA7.dll
2009-10-02 09:12 . 2004-07-26 14:16 262144 ------w- c:\windows\system32\ImagXR7.dll
2009-10-02 09:12 . 2004-07-26 14:16 1568768 ------w- c:\windows\system32\ImagX7.dll
2009-10-02 09:12 . 2004-07-09 06:43 364544 ------w- c:\windows\system32\TwnLib4.dll
2009-10-02 09:12 . 2001-06-26 05:15 38912 ------w- c:\windows\system32\picn20.dll
2009-10-02 09:12 . 2000-06-26 08:45 106496 ----a-w- c:\windows\system32\TwnLib20.dll
2009-10-02 09:12 . 2009-10-02 09:12 -------- d-----w- c:\program files\Common Files\Ahead
2009-10-02 09:11 . 2009-10-02 09:16 -------- d-----w- c:\program files\Ahead
2009-10-01 13:21 . 2009-10-01 13:30 -------- d-----w- c:\documents and settings\yakamoz\Application Data\FastStone
2009-09-27 02:13 . 2009-09-27 02:13 -------- d-----w- c:\windows\Sun
2009-09-26 04:37 . 2009-10-16 11:59 -------- d-----w- c:\program files\Common Files\Akamai

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-25 14:21 . 2001-11-22 12:00 67968 ----a-w- c:\windows\system32\perfc01F.dat
2009-10-25 14:21 . 2001-11-22 12:00 381334 ----a-w- c:\windows\system32\perfh01F.dat
2009-10-25 13:26 . 2009-09-15 20:34 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-23 19:55 . 2009-09-15 20:25 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-23 14:21 . 2009-09-16 13:44 -------- d-----w- c:\program files\Eset
2009-10-19 10:35 . 2009-09-15 20:28 -------- d-----w- c:\program files\Winamp
2009-10-13 11:12 . 2009-09-15 20:31 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2009-09-23 23:36 . 2009-09-23 23:36 -------- d-----w- c:\program files\Common Files\snp2std
2009-09-23 23:12 . 2009-09-23 23:12 -------- d-----w- c:\program files\Vimicro
2009-09-23 23:12 . 2009-09-15 20:25 -------- d-----w- c:\program files\Common Files\InstallShield
2009-09-16 14:36 . 2009-09-16 14:36 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-16 14:36 . 2009-09-16 14:30 -------- d-----w- c:\program files\Windows Live
2009-09-16 14:33 . 2009-09-16 14:33 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-09-16 14:32 . 2009-09-16 14:32 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-09-16 14:31 . 2009-09-16 14:31 -------- d-----w- c:\program files\Microsoft
2009-09-16 14:30 . 2009-09-16 14:30 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-16 14:00 . 2009-09-16 14:00 -------- d-----w- c:\program files\Common Files\Windows Live
2009-09-16 13:23 . 2009-09-16 13:23 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-09-16 01:35 . 2009-09-15 21:41 -------- d-----w- c:\program files\AirTies
2009-09-15 21:02 . 2009-09-15 21:02 0 ----a-w- c:\windows\nsreg.dat
2009-09-15 20:35 . 2009-09-15 20:34 -------- d-----w- c:\program files\Java
2009-09-15 20:34 . 2009-09-15 20:34 -------- d-----w- c:\program files\Common Files\Java
2009-09-15 20:31 . 2009-09-15 20:31 -------- d-----w- c:\program files\CCleaner
2009-09-15 20:26 . 2009-09-15 20:26 -------- d-----w- c:\documents and settings\yakamoz\Application Data\InstallShield
2009-09-15 20:25 . 2009-09-15 20:25 -------- d-----w- c:\program files\Realtek
2009-09-15 20:25 . 2009-09-15 20:25 315392 ----a-w- c:\windows\HideWin.exe
2009-09-15 20:23 . 2009-09-15 20:23 -------- d-----w- c:\program files\Intel
2009-09-15 20:22 . 2009-09-15 20:22 16608 ----a-w- c:\windows\gdrv.sys
2009-09-15 20:22 . 2009-09-15 20:18 -------- d-----w- c:\program files\Vtune
2009-09-15 20:13 . 2009-09-15 20:13 -------- d-----w- c:\program files\microsoft frontpage
2009-09-15 20:11 . 2009-09-15 20:11 21736 ----a-w- c:\windows\system32\emptyregdb.dat
2009-08-05 19:48 . 2009-09-16 14:36 54752 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
.

------- Sigcheck -------

[-] 2006-10-18 18:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
[-] 2006-10-18 18:47 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\dllcache\mspmsnsv.dll
[7] 2004-08-03 21:45 . F94DE505F15DB220B139A1E60BE113C7 . 52224 . . [9.0.1.56] . . c:\windows\$NtUninstallWMFDist11$\mspmsnsv.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2009-05-06 1262888]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TBPanel"="c:\program files\Vtune\TBPanel.exe" [2008-07-10 2154496]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-10-06 3883856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-06-25 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-06-25 86016]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-07-01 37888]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_08\bin\jusched.exe" [2005-03-04 32881]
"tsnp2std"="c:\windows\tsnp2std.exe" [2006-11-29 258048]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-10-18 198160]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-09-01 282624]
"IObit Security 360"="c:\program files\IObit\IObit Security 360\IS360tray.exe" [2009-09-28 1241872]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-06-25 1630208]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-02-13 16857600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

c:\documents and settings\All Users\Start Menu\Programlar\BaŸlang‡\
AirTies ADSL Hizmet Program.lnk - c:\program files\AirTies\ADSL Hizmet Program\AirTies_util3.exe [2009-9-16 2853376]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\AirTies\\ADSL Hizmet Programı\\AirTies_util3.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"$INSTDIR\\FlvDetector.exe"= c:\\Program Files\\FlashGet Network\\FlashGet 3\\FlvDetector.exe

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [16.09.2009 16:36 54752]
R2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [23.10.2009 03:20 309008]
R3 TUSB1150;Airties WUS-300 USB Wireless Adapter (TNETW1450);c:\windows\system32\drivers\TUSB1150.sys [16.09.2009 03:34 450944]
S3 fsssvc;Windows Live Aile Koruması Hizmeti;c:\program files\Windows Live\Family Safety\fsssvc.exe [05.08.2009 21:48 704864]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 SOACS;SOACS Driver;\??\c:\windows\system32\drivers\soacs.sys --> c:\windows\system32\drivers\soacs.sys [?]
.
Contents of the 'Scheduled Tasks' folder

2009-10-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2006-08-29 11:21]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q=%s
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Download All by FlashGet3 - c:\documents and settings\yakamoz\Application Data\FlashGetBHO\GetAllUrl.htm
IE: Download by FlashGet3 - c:\documents and settings\yakamoz\Application Data\FlashGetBHO\GetUrl.htm
TCP: {3439E7C7-C8C0-4C2D-945A-053405ED003D} = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\documents and settings\yakamoz\Application Data\Mozilla\Firefox\Profiles\67tv36yc.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Winamp Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.tr/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - component: c:\documents and settings\yakamoz\Application Data\Mozilla\Firefox\Profiles\67tv36yc.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\documents and settings\yakamoz\Application Data\Mozilla\Firefox\Profiles\67tv36yc.default\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}\components\FlashgetXpi.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\Java\j2re1.4.2_08\bin\NPJava11.dll
FF - plugin: c:\program files\Java\j2re1.4.2_08\bin\NPJava12.dll
FF - plugin: c:\program files\Java\j2re1.4.2_08\bin\NPJava13.dll
FF - plugin: c:\program files\Java\j2re1.4.2_08\bin\NPJava14.dll
FF - plugin: c:\program files\Java\j2re1.4.2_08\bin\NPJava32.dll
FF - plugin: c:\program files\Java\j2re1.4.2_08\bin\NPJPI142_08.dll
FF - plugin: c:\program files\Java\j2re1.4.2_08\bin\NPOJI610.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-AirTiesWUS-300 - c:\program files\AirTies\AirTiesWUS-300\WUS300.exe
HKLM-Run-FixCamera - c:\windows\FixCamera.exe
AddRemove-FlashGet 3.0 Beta - c:\program files\FlashGet Network\FlashGet 3\uninst.exe
AddRemove-{BF231D4A-EFB4-14D5-92D4-8992D9158D5D}_is1 - c:\sobee_mynet\Istanbul Kiyamet Vakti\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net
Rootkit scan 2009-10-25 16:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(740)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\browselc.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
c:\progra~1\SPYBOT~1\SDHelper.dll
c:\program files\Common Files\Ahead\Lib\NeroDigitalExt.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wscntfy.exe
c:\combofix\CF14804.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\AirTies\ADSL Hizmet Programı\AirTies_util3.exe
c:\combofix\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-25 16:35 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-25 14:35

Pre-Run: 38.652.854.272 bayt boş
Post-Run: 38.624.243.712 bayt boş

- - End Of File - - 0D9B008D00C35FF3AFEA2DDEE318C7D4

quote:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:05:10, on 25.10.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\IObit\IObit Security 360\IS360srv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe
C:\WINDOWS\tsnp2std.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\IObit\IObit Security 360\IS360tray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vtune\TBPanel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\AirTies\ADSL Hizmet Programı\AirTies_util3.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\FlashGet Network\FlashGet 3\Flashget3.exe
C:\Documents and Settings\yakamoz\Belgelerim\İndirilenler\software\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://search.live.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q=
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL =http://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =http://search.live.com/sphome.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =http://toolbar.ask.com/toolbarv/askRedirect?o=13165&gct=&gc=1&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll (file missing)
O1 - Hosts: Youtube Dünya Capinda IP leri toplam 2859 adet ....
O1 - Hosts: 208.65.153.251 uk.youtube.com
O1 - Hosts: 208.65.153.253 de.youtube.com
O1 - Hosts: 208.117.236.70 youtube.com
O1 - Hosts: 208.117.236.70www.youtube.com
O1 - Hosts: 74.125.65.118 img.youtube.com
O1 - Hosts: 64.15.124.143 sjc-v1.sjc.youtube.com
O1 - Hosts: 64.15.124.144 sjc-v2.sjc.youtube.com
O1 - Hosts: 64.15.124.145 sjc-v3.sjc.youtube.com
O1 - Hosts: 64.15.124.146 sjc-v4.sjc.youtube.com
O1 - Hosts: 64.15.124.147 sjc-v5.sjc.youtube.com
O1 - Hosts: 64.15.124.148 sjc-v6.sjc.youtube.com
O1 - Hosts: 64.15.124.149 sjc-v7.sjc.youtube.com
O1 - Hosts: 64.15.124.150 sjc-v8.sjc.youtube.com
O1 - Hosts: 64.15.124.151 sjc-v9.sjc.youtube.com
O1 - Hosts: 64.15.124.152 sjc-v10.sjc.youtube.com
O1 - Hosts: 64.15.124.153 sjc-v11.sjc.youtube.com
O1 - Hosts: 64.15.124.154 sjc-v12.sjc.youtube.com
O1 - Hosts: 64.15.124.155 sjc-v13.sjc.youtube.com
O1 - Hosts: 64.15.124.156 sjc-v14.sjc.youtube.com
O1 - Hosts: 64.15.124.157 sjc-v15.sjc.youtube.com
O1 - Hosts: 64.15.124.158 sjc-v16.sjc.youtube.com
O1 - Hosts: 64.15.124.159 sjc-v17.sjc.youtube.com
O1 - Hosts: 64.15.124.160 sjc-v18.sjc.youtube.com
O1 - Hosts: 64.15.124.161 sjc-v19.sjc.youtube.com
O1 - Hosts: 64.15.124.162 sjc-v20.sjc.youtube.com
O1 - Hosts: 64.15.124.163 sjc-v21.sjc.youtube.com
O1 - Hosts: 64.15.124.164 sjc-v22.sjc.youtube.com
O1 - Hosts: 64.15.124.165 sjc-v23.sjc.youtube.com
O1 - Hosts: 64.15.124.166 sjc-v24.sjc.youtube.com
O1 - Hosts: 64.15.124.167 sjc-v25.sjc.youtube.com
O1 - Hosts: 64.15.124.168 sjc-v26.sjc.youtube.com
O1 - Hosts: 64.15.124.169 sjc-v27.sjc.youtube.com
O1 - Hosts: 64.15.124.170 sjc-v28.sjc.youtube.com
O1 - Hosts: 64.15.124.171 sjc-v29.sjc.youtube.com
O1 - Hosts: 64.15.124.172 sjc-v30.sjc.youtube.com
O1 - Hosts: 64.15.124.173 sjc-v31.sjc.youtube.com
O1 - Hosts: 64.15.124.174 sjc-v32.sjc.youtube.com
O1 - Hosts: 64.15.124.175 sjc-v33.sjc.youtube.com
O1 - Hosts: 64.15.124.176 sjc-v34.sjc.youtube.com
O1 - Hosts: 64.15.124.177 sjc-v35.sjc.youtube.com
O1 - Hosts: 64.15.124.178 sjc-v36.sjc.youtube.com
O1 - Hosts: 64.15.124.179 sjc-v37.sjc.youtube.com
O1 - Hosts: 64.15.124.180 sjc-v38.sjc.youtube.com
O1 - Hosts: 64.15.124.207 sjc-v39.sjc.youtube.com
O1 - Hosts: 64.15.124.208 sjc-v40.sjc.youtube.com
O1 - Hosts: 64.15.124.209 sjc-v41.sjc.youtube.com
O1 - Hosts: 64.15.124.210 sjc-v42.sjc.youtube.com
O1 - Hosts: 64.15.124.211 sjc-v43.sjc.youtube.com
O1 - Hosts: 64.15.124.212 sjc-v44.sjc.youtube.com
O1 - Hosts: 64.15.124.213 sjc-v45.sjc.youtube.com
O1 - Hosts: 64.15.124.214 sjc-v46.sjc.youtube.com
O1 - Hosts: 64.15.124.215 sjc-v47.sjc.youtube.com
O1 - Hosts: 64.15.124.216 sjc-v48.sjc.youtube.com
O1 - Hosts: 64.15.124.217 sjc-v49.sjc.youtube.com
O1 - Hosts: 64.15.124.218 sjc-v50.sjc.youtube.com
O1 - Hosts: 64.15.124.219 sjc-v51.sjc.youtube.com
O1 - Hosts: 64.15.124.220 sjc-v52.sjc.youtube.com
O1 - Hosts: 64.15.124.221 sjc-v53.sjc.youtube.com
O1 - Hosts: 64.15.124.222 sjc-v54.sjc.youtube.com
O1 - Hosts: 64.15.124.223 sjc-v55.sjc.youtube.com
O1 - Hosts: 64.15.124.224 sjc-v56.sjc.youtube.com
O1 - Hosts: 64.15.124.225 sjc-v57.sjc.youtube.com
O1 - Hosts: 64.15.124.226 sjc-v58.sjc.youtube.com
O1 - Hosts: 64.15.124.227 sjc-v59.sjc.youtube.com
O1 - Hosts: 64.15.124.228 sjc-v60.sjc.youtube.com
O1 - Hosts: 64.15.124.229 sjc-v61.sjc.youtube.com
O1 - Hosts: 64.15.124.230 sjc-v62.sjc.youtube.com
O1 - Hosts: 64.15.124.231 sjc-v63.sjc.youtube.com
O1 - Hosts: 64.15.124.232 sjc-v64.sjc.youtube.com
O1 - Hosts: 64.15.124.233 sjc-v65.sjc.youtube.com
O1 - Hosts: 64.15.124.234 sjc-v66.sjc.youtube.com
O1 - Hosts: 64.15.124.235 sjc-v67.sjc.youtube.com
O1 - Hosts: 64.15.124.236 sjc-v68.sjc.youtube.com
O1 - Hosts: 64.15.124.237 sjc-v69.sjc.youtube.com
O1 - Hosts: 64.15.124.238 sjc-v70.sjc.youtube.com
O1 - Hosts: 64.15.124.239 sjc-v71.sjc.youtube.com
O1 - Hosts: 64.15.124.240 sjc-v72.sjc.youtube.com
O1 - Hosts: 64.15.124.241 sjc-v73.sjc.youtube.com
O1 - Hosts: 64.15.124.242 sjc-v74.sjc.youtube.com
O1 - Hosts: 64.15.124.243 sjc-v75.sjc.youtube.com
O1 - Hosts: 64.15.124.244 sjc-v76.sjc.youtube.com
O1 - Hosts: 64.15.125.16 sjc-v77.sjc.youtube.com
O1 - Hosts: 64.15.125.17 sjc-v78.sjc.youtube.com
O1 - Hosts: 64.15.125.18 sjc-v79.sjc.youtube.com
O1 - Hosts: 64.15.125.19 sjc-v80.sjc.youtube.com
O1 - Hosts: 64.15.125.20 sjc-v81.sjc.youtube.com
O1 - Hosts: 64.15.125.21 sjc-v82.sjc.youtube.com
O1 - Hosts: 64.15.125.22 sjc-v83.sjc.youtube.com
O1 - Hosts: 64.15.125.23 sjc-v84.sjc.youtube.com
O1 - Hosts: 64.15.125.24 sjc-v85.sjc.youtube.com
O1 - Hosts: 64.15.125.25 sjc-v86.sjc.youtube.com
O1 - Hosts: 64.15.125.26 sjc-v87.sjc.youtube.com
O1 - Hosts: 64.15.125.27 sjc-v88.sjc.youtube.com
O1 - Hosts: 64.15.125.28 sjc-v89.sjc.youtube.com
O1 - Hosts: 64.15.125.29 sjc-v90.sjc.youtube.com
O1 - Hosts: 64.15.125.30 sjc-v91.sjc.youtube.com
O1 - Hosts: 64.15.125.31 sjc-v92.sjc.youtube.com
O1 - Hosts: 64.15.125.32 sjc-v93.sjc.youtube.com
O1 - Hosts: 64.15.125.33 sjc-v94.sjc.youtube.com
O1 - Hosts: 64.15.125.34 sjc-v95.sjc.youtube.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Documents and Settings\yakamoz\Application Data\FlashGetBHO\FlashGetBHO3.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_08\bin\jusched.exe
O4 - HKLM\..\Run: [AirTiesWUS-300] C:\Program Files\AirTies\AirTiesWUS-300\WUS300.exe
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IObit Security 360] C:\Program Files\IObit\IObit Security 360\IS360tray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TBPanel] C:\Program Files\Vtune\TBPanel.exe /A
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: AirTies ADSL Hizmet Programı.lnk = ?
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Download All by FlashGet3 - C:\Documents and Settings\yakamoz\Application Data\FlashGetBHO\GetAllUrl.htm
O8 - Extra context menu item: Download by FlashGet3 - C:\Documents and Settings\yakamoz\Application Data\FlashGetBHO\GetUrl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_08\bin\npjpi142_08.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_08\bin\npjpi142_08.dll
O9 - Extra button: Bunu Bloga Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: Windows Live Writer içinde &Bunu Web Günlüğüne Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3439E7C7-C8C0-4C2D-945A-053405ED003D}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CS1\Services\Tcpip\..\{3439E7C7-C8C0-4C2D-945A-053405ED003D}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CS2\Services\Tcpip\..\{3439E7C7-C8C0-4C2D-945A-053405ED003D}: NameServer = 208.67.222.222,208.67.220.220
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 13703 bytes

quote:

Orijinalden alıntı: tcebeci

Bilgisayarda messenger bazan açılıyor bazen açılırken kitlenip kalıyor.

quote:

Orijinalden alıntı: satore

combo fix raporu
şimdi ne yapmalıyım

quote:

Orijinalden alıntı: Onur Batın

Bunada bakabilir misiniz??

quote:

Orijinalden alıntı: No62

Dostum gene seni yoracağım,
Baya bir temizlik yaptım ama :/
Bu temizlikten sonra ufak bir sorunum çıktı.
Bazı dosyalarımın şekli şemali değişti Resimde göreceksin hocam

Üsteki gibi dosyalar alttaki gibi reg dosyası halinde gösteriyordu nasıl düzelte bilirim :) Olmasada olur ama göz aşinalığı olmayınca kötü oluyor insan bir çırpıda bulamıyor

quote:

Orijinalden alıntı: 51cent

kolay gelsin hocam banada
yardımcı olursan sevinirm..
laptop kullanıyorum son günlerde iyice yavaşladı..bir şey daha soracaktım,,netten bir dosya indirdim,açtıktan sonra kendiliginden kayboldu sanırım virüstü,pc im rundll32 ana bilgisayar kapama gibi bir şeyler yazıyor arada bu sorunu nasıl halledebilirim bir fikrin varmı..tşk ederm şimdididen kolay gelsn

quote:

Orijinalden alıntı: serji

quote: Orijinalden alıntı: tcebeci Bilgisayarda messenger bazan açılıyor bazen açılırken kitlenip kalıyor.

Burada bir problem gozukmuyor .MBAM ile taratin bi eger olmazsa WLM kaldirip application data klasorundeki kalintilari da silip tekrar kurun.

quote:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:26:59, on 27.10.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20935)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MK Free Techs\Asistan\Process Viewer.exe
D:\Program Files\FirefoxPortable 3.52 TR\FirefoxPortable.exe
D:\Program Files\FirefoxPortable 3.52 TR\App\firefox\firefox.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\DOCUME~1\Mkrts\LOCALS~1\Temp\pkkica.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Java\jre6\bin\javaw.exe
D:\Harman\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
O1 - Hosts: 84.44.114.44 sozluk.sourtimes.org
O1 - Hosts: 84.44.114.44www.sozluk.sourtimes.org
O1 - Hosts: 208.101.43.202 divxplanet.com
O1 - Hosts: 208.101.43.202www.divxplanet.com
O1 - Hosts: 208.101.43.202 forum.divxplanet.com
O1 - Hosts: 83.149.99.113 foreverdivx.net
O1 - Hosts: 83.149.99.113www.foreverdivx.net
O1 - Hosts: 69.5.88.72 megaupload.com
O1 - Hosts: 69.5.88.72www.megaupload.com
O1 - Hosts: 89.149.232.87 sharebus.com
O1 - Hosts: 89.149.232.87www.sharebus.com
O1 - Hosts: 208.117.236.70 youtube.com
O1 - Hosts: 208.117.236.70www.youtube.com
O1 - Hosts: 64.15.124.143 sjc-v1.sjc.youtube.com
O1 - Hosts: 64.15.124.144 sjc-v2.sjc.youtube.com
O1 - Hosts: 64.15.124.145 sjc-v3.sjc.youtube.com
O1 - Hosts: 64.15.124.146 sjc-v4.sjc.youtube.com
O1 - Hosts: 64.15.124.147 sjc-v5.sjc.youtube.com
O1 - Hosts: 64.15.124.148 sjc-v6.sjc.youtube.com
O1 - Hosts: 64.15.124.149 sjc-v7.sjc.youtube.com
O1 - Hosts: 64.15.124.150 sjc-v8.sjc.youtube.com
O1 - Hosts: 64.15.124.151 sjc-v9.sjc.youtube.com
O1 - Hosts: 64.15.124.152 sjc-v10.sjc.youtube.com
O1 - Hosts: 64.15.124.153 sjc-v11.sjc.youtube.com
O1 - Hosts: 64.15.124.154 sjc-v12.sjc.youtube.com
O1 - Hosts: 64.15.124.155 sjc-v13.sjc.youtube.com
O1 - Hosts: 64.15.124.156 sjc-v14.sjc.youtube.com
O1 - Hosts: 64.15.124.157 sjc-v15.sjc.youtube.com
O1 - Hosts: 64.15.124.158 sjc-v16.sjc.youtube.com
O1 - Hosts: 64.15.124.159 sjc-v17.sjc.youtube.com
O1 - Hosts: 64.15.124.160 sjc-v18.sjc.youtube.com
O1 - Hosts: 64.15.124.161 sjc-v19.sjc.youtube.com
O1 - Hosts: 64.15.124.162 sjc-v20.sjc.youtube.com
O1 - Hosts: 64.15.124.163 sjc-v21.sjc.youtube.com
O1 - Hosts: 64.15.124.164 sjc-v22.sjc.youtube.com
O1 - Hosts: 64.15.124.165 sjc-v23.sjc.youtube.com
O1 - Hosts: 64.15.124.166 sjc-v24.sjc.youtube.com
O1 - Hosts: 64.15.124.167 sjc-v25.sjc.youtube.com
O1 - Hosts: 64.15.124.168 sjc-v26.sjc.youtube.com
O1 - Hosts: 64.15.124.169 sjc-v27.sjc.youtube.com
O1 - Hosts: 64.15.124.170 sjc-v28.sjc.youtube.com
O1 - Hosts: 64.15.124.171 sjc-v29.sjc.youtube.com
O1 - Hosts: 64.15.124.172 sjc-v30.sjc.youtube.com
O1 - Hosts: 64.15.124.173 sjc-v31.sjc.youtube.com
O1 - Hosts: 64.15.124.174 sjc-v32.sjc.youtube.com
O1 - Hosts: 64.15.124.175 sjc-v33.sjc.youtube.com
O1 - Hosts: 64.15.124.176 sjc-v34.sjc.youtube.com
O1 - Hosts: 64.15.124.177 sjc-v35.sjc.youtube.com
O1 - Hosts: 64.15.124.178 sjc-v36.sjc.youtube.com
O1 - Hosts: 64.15.124.179 sjc-v37.sjc.youtube.com
O1 - Hosts: 64.15.124.180 sjc-v38.sjc.youtube.com
O1 - Hosts: 64.15.124.207 sjc-v39.sjc.youtube.com
O1 - Hosts: 64.15.124.208 sjc-v40.sjc.youtube.com
O1 - Hosts: 64.15.124.209 sjc-v41.sjc.youtube.com
O1 - Hosts: 64.15.124.210 sjc-v42.sjc.youtube.com
O1 - Hosts: 64.15.124.211 sjc-v43.sjc.youtube.com
O1 - Hosts: 64.15.124.212 sjc-v44.sjc.youtube.com
O1 - Hosts: 64.15.124.213 sjc-v45.sjc.youtube.com
O1 - Hosts: 64.15.124.214 sjc-v46.sjc.youtube.com
O1 - Hosts: 64.15.124.215 sjc-v47.sjc.youtube.com
O1 - Hosts: 64.15.124.216 sjc-v48.sjc.youtube.com
O1 - Hosts: 64.15.124.217 sjc-v49.sjc.youtube.com
O1 - Hosts: 64.15.124.218 sjc-v50.sjc.youtube.com
O1 - Hosts: 64.15.124.219 sjc-v51.sjc.youtube.com
O1 - Hosts: 64.15.124.220 sjc-v52.sjc.youtube.com
O1 - Hosts: 64.15.124.221 sjc-v53.sjc.youtube.com
O1 - Hosts: 64.15.124.222 sjc-v54.sjc.youtube.com
O1 - Hosts: 64.15.124.223 sjc-v55.sjc.youtube.com
O1 - Hosts: 64.15.124.224 sjc-v56.sjc.youtube.com
O1 - Hosts: 64.15.124.225 sjc-v57.sjc.youtube.com
O1 - Hosts: 64.15.124.226 sjc-v58.sjc.youtube.com
O1 - Hosts: 64.15.124.227 sjc-v59.sjc.youtube.com
O1 - Hosts: 64.15.124.228 sjc-v60.sjc.youtube.com
O1 - Hosts: 64.15.124.229 sjc-v61.sjc.youtube.com
O1 - Hosts: 64.15.124.230 sjc-v62.sjc.youtube.com
O1 - Hosts: 64.15.124.231 sjc-v63.sjc.youtube.com
O1 - Hosts: 64.15.124.232 sjc-v64.sjc.youtube.com
O1 - Hosts: 64.15.124.233 sjc-v65.sjc.youtube.com
O1 - Hosts: 64.15.124.234 sjc-v66.sjc.youtube.com
O1 - Hosts: 64.15.124.235 sjc-v67.sjc.youtube.com
O1 - Hosts: 64.15.124.236 sjc-v68.sjc.youtube.com
O1 - Hosts: 64.15.124.237 sjc-v69.sjc.youtube.com
O1 - Hosts: 64.15.124.238 sjc-v70.sjc.youtube.com
O1 - Hosts: 64.15.124.239 sjc-v71.sjc.youtube.com
O1 - Hosts: 64.15.124.240 sjc-v72.sjc.youtube.com
O1 - Hosts: 64.15.124.241 sjc-v73.sjc.youtube.com
O1 - Hosts: 64.15.124.242 sjc-v74.sjc.youtube.com
O1 - Hosts: 64.15.124.243 sjc-v75.sjc.youtube.com
O1 - Hosts: 64.15.124.244 sjc-v76.sjc.youtube.com
O1 - Hosts: 64.15.125.16 sjc-v77.sjc.youtube.com
O1 - Hosts: 64.15.125.17 sjc-v78.sjc.youtube.com
O1 - Hosts: 64.15.125.18 sjc-v79.sjc.youtube.com
O1 - Hosts: 64.15.125.19 sjc-v80.sjc.youtube.com
O1 - Hosts: 64.15.125.20 sjc-v81.sjc.youtube.com
O1 - Hosts: 64.15.125.21 sjc-v82.sjc.youtube.com
O1 - Hosts: 64.15.125.22 sjc-v83.sjc.youtube.com
O1 - Hosts: 64.15.125.23 sjc-v84.sjc.youtube.com
O1 - Hosts: 64.15.125.24 sjc-v85.sjc.youtube.com
O1 - Hosts: 64.15.125.25 sjc-v86.sjc.youtube.com
O1 - Hosts: 64.15.125.26 sjc-v87.sjc.youtube.com
O1 - Hosts: 64.15.125.27 sjc-v88.sjc.youtube.com
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Reklam Engelleyici'ye ekle - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
O20 - Winlogon Notify: AutorunsDisabled - C:\WINDOWS\
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 8865 bytes