HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+ (453. sayfa)

Selamlar sergi bu aralar bilgisayarımın performansından hiç memnun değilim.Combofix için söylediklerini aynı şekilde uyguladım.Rapor aşağıdadır.İlgilenirsen sevinirim

ComboFix 09-12-03.06 - Admin 04.12.2009 20:02.2.2 - x86 
  Microsoft Windows XP Professional  5.1.2600.2.1254.90.1055.18.2046.1547 [GMT 2:00] 
  Running from: c:\documents and settings\Admin\Desktop\ComboFix.exe 
  AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} 
  FW: ESET Personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0} 
   * Resident AV is active 
   
  . 
   
  (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  . 
  ---- Previous Run ------- 
  . 
  c:\documents and settings\Admin\Application Data\Desktopicon\eBayShortcuts.exe 
  c:\program files\ATI Technologies\ATI.ACE\Core-Static\atIAcmxx.dll 
  c:\windows\system32\7118402411.CPX 
  c:\windows\system32\71184024112.CPX 
  c:\windows\system32\71184024113.CPX 
  c:\windows\system32\711840241133.CPX 
  c:\windows\system32\7118402412.CPX 
  c:\windows\system32\7118402413.CPX 
  c:\windows\system32\71184024133.CPX 
  c:\windows\system32\7118402415.CPX 
  c:\windows\system32\71184024155.CPX 
  c:\windows\system32\scrrntr.dll 
  c:\windows\wuasirvy.dll 
   
  . 
  (((((((((((((((((((((((((((((((((((((((   Drivers/Services   ))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
   
  -------\Legacy_OREANS32 
  -------\Service_oreans32 
   
   
  (((((((((((((((((((((((((   Files Created from 2009-11-04 to 2009-12-04  ))))))))))))))))))))))))))))))) 
  . 
   
  2009-12-04 17:39 . 2009-12-04 17:39	4844296	----a-w-	c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 
  2009-12-04 17:38 . 2009-12-04 17:38	--------	d-----w-	c:\documents and settings\Admin\Application Data\Malwarebytes 
  2009-12-04 17:38 . 2009-12-03 14:14	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys 
  2009-12-04 17:38 . 2009-12-04 17:39	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware 
  2009-12-04 17:38 . 2009-12-04 17:38	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes 
  2009-12-04 17:38 . 2009-12-03 14:13	19160	----a-w-	c:\windows\system32\drivers\mbam.sys 
  2009-11-29 13:25 . 2009-11-29 13:25	--------	d-----w-	C:\found.000 
  2009-11-28 00:59 . 2009-11-28 00:59	--------	d-----w-	c:\program files\Aspyr 
  2009-11-26 17:13 . 2009-12-04 16:09	--------	d-----w-	c:\program files\WASP IRC 
  2009-11-20 14:51 . 2009-11-20 14:52	--------	d-----w-	c:\documents and settings\Admin\Application Data\Shenturk 
  2009-11-19 17:15 . 2008-04-13 15:26	36396	----a-w-	c:\documents and settings\Admin\Application Data\BSplayer\AC3 Filter\uninstall.exe 
  2009-11-19 17:15 . 2007-07-05 01:33	892928	----a-w-	c:\documents and settings\Admin\Application Data\BSplayer\AC3 Filter\iconv.dll 
  2009-11-19 17:15 . 2007-08-18 07:54	20480	----a-w-	c:\documents and settings\Admin\Application Data\BSplayer\AC3 Filter\ac3config.exe 
  2009-11-19 17:15 . 2007-08-18 07:53	16384	----a-w-	c:\documents and settings\Admin\Application Data\BSplayer\AC3 Filter\dialog_patch.exe 
  2009-11-19 17:13 . 2009-11-19 17:13	--------	d-----w-	c:\program files\Conduit 
  2009-11-19 17:13 . 2009-11-19 17:13	--------	d-----w-	c:\documents and settings\Admin\Local Settings\Application Data\Conduit 
  2009-11-19 17:13 . 2009-11-19 17:16	--------	d-----w-	c:\documents and settings\Admin\Local Settings\Application Data\BS_Player 
  2009-11-19 17:13 . 2009-11-19 17:13	--------	d-----w-	c:\program files\BS_Player 
  2009-11-19 17:12 . 2009-11-19 17:16	--------	d-----w-	c:\documents and settings\Admin\Application Data\BSplayer 
  2009-11-19 17:12 . 2009-11-19 17:12	--------	d-----w-	c:\documents and settings\Admin\Application Data\BSplayer Pro 
  2009-11-19 17:12 . 2009-11-19 17:12	--------	d-----w-	c:\program files\Webteh 
  2009-11-19 17:07 . 2009-11-19 17:07	--------	d-----w-	c:\program files\Action DVD Player 
  2009-11-19 14:54 . 2008-03-21 11:57	14640	------w-	c:\windows\system32\spmsgXP_2k3.dll 
  2009-11-15 13:21 . 2009-11-15 11:10	34085608	----a-w-	c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_tur_web.exe 
  2009-11-15 13:21 . 2009-11-15 13:21	95232	----a-w-	c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe 
  2009-11-15 13:21 . 2009-11-15 13:21	8192	----a-w-	c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe 
  2009-11-15 13:21 . 2009-11-15 13:21	61440	----a-w-	c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe 
  2009-11-15 13:21 . 2009-11-15 13:21	10240	----a-w-	c:\documents and settings\All Users\Application Data\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe 
  2009-11-15 13:20 . 2009-11-15 13:20	--------	d-----w-	c:\documents and settings\All Users\Application Data\Installations 
   
  . 
  ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  2009-12-04 17:59 . 2009-02-19 12:38	--------	d-----w-	c:\documents and settings\Admin\Application Data\DNA 
  2009-12-04 17:59 . 2009-05-08 18:24	--------	d-----w-	c:\documents and settings\Admin\Application Data\uTorrent 
  2009-12-04 17:55 . 2008-03-19 13:22	664	----a-w-	c:\windows\system32\d3d9caps.dat 
  2009-12-04 17:54 . 2009-02-19 12:38	--------	d-----w-	c:\program files\DNA 
  2009-12-04 17:40 . 2009-01-27 15:42	--------	d-----w-	c:\program files\sXe Injected 
  2009-12-04 17:32 . 2008-04-08 15:18	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP 
  2009-12-04 16:07 . 2008-09-18 15:15	--------	d-s---w-	c:\program files\HLSW 
  2009-11-19 14:56 . 2009-11-15 13:22	--------	d-----w-	c:\documents and settings\Admin\Application Data\Nokia 
  2009-11-19 14:54 . 2009-11-19 14:54	0	---ha-w-	c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf 
  2009-11-19 14:54 . 2009-11-19 14:54	0	---ha-w-	c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 
  2009-11-15 13:22 . 2009-11-15 13:22	--------	d-----w-	c:\documents and settings\Admin\Application Data\PC Suite 
  2009-11-15 13:22 . 2009-11-15 13:22	--------	d-----w-	c:\documents and settings\All Users\Application Data\PC Suite 
  2009-11-15 13:22 . 2009-11-15 13:22	--------	d-----w-	c:\program files\DIFX 
  2009-11-15 13:22 . 2009-11-15 13:22	--------	d-----w-	c:\program files\Common Files\PCSuite 
  2009-11-15 13:22 . 2009-11-15 13:22	--------	d-----w-	c:\program files\Common Files\Nokia 
  2009-11-15 13:22 . 2009-11-15 13:21	--------	d-----w-	c:\program files\Nokia 
  2009-11-15 13:21 . 2009-11-15 13:21	--------	d-----w-	c:\program files\PC Connectivity Solution 
  2009-11-10 13:08 . 2008-06-08 17:19	--------	d-----w-	c:\program files\Windows Live 
  2009-11-04 16:16 . 2008-01-16 21:37	--------	d--h--w-	c:\program files\InstallShield Installation Information 
  2009-11-04 16:16 . 2008-01-16 16:14	--------	d-----w-	c:\program files\CyberLink 
  2009-10-30 02:36 . 2009-07-29 09:37	--------	d-----w-	c:\program files\VDOWNLOADER 
  2009-10-15 13:31 . 2009-10-15 13:30	--------	d-----w-	c:\program files\MultiProxy 
  2009-10-10 13:00 . 2009-10-10 13:00	661	----a-w-	c:\windows\unins000.dat 
  2009-10-10 13:00 . 2002-02-09 23:00	72748	----a-w-	c:\windows\unins000.exe 
  2009-01-27 20:08 . 2009-01-27 20:08	135	----a-w-	c:\program files\masaüstü.scf 
  . 
   
  ------- Sigcheck ------- 
   
  [7] 2004-08-03 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\tcpip.sys 
  [-] 2004-08-03 . 6A603809F598332DBEDD535BDBCE313E . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\tcpip.sys 
  . 
  (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  . 
  *Note* empty entries & legit default entries are not shown  
  REGEDIT4 
   
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] 
  "{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_P.dll" [2009-07-02 2215960] 
   
  [HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}] 
   
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E601996F-E400-41CA-804B-CD6373A7EEE2}] 
  2009-05-20 04:26	429800	----a-w-	c:\program files\kikin\ie_kikin.dll 
   
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}] 
  2009-07-02 08:18	2215960	----a-w-	c:\program files\BS_Player\tbBS_P.dll 
   
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] 
  "{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}"= "c:\program files\BS_Player\tbBS_P.dll" [2009-07-02 2215960] 
   
  [HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}] 
   
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] 
  "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-09-29 325000] 
  "{FED66DC5-1B74-4A04-8F5C-15C5ACE2B9A5}"= "c:\program files\BS_Player\tbBS_P.dll" [2009-07-02 2215960] 
   
  [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] 
  [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] 
   
  [HKEY_CLASSES_ROOT\clsid\{fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5}] 
   
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1667584] 
  "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] 
  "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-07 323392] 
  "Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-04-30 2329936] 
  "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-05-23 39408] 
  "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-06-25 1414144] 
  "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-11-25 289584] 
  "Steam"="d:\program files\Steam\Steam.exe" [2009-11-26 1217808] 
   
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MSRun" [X] 
  "ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2007-10-04 307200] 
  "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-03-01 1443072] 
  "AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2006-02-22 344064] 
  "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-04-11 56080] 
   
  c:\documents and settings\All Users\Start Menu\Programlar\BaŸlang‡\ 
  Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-6-13 692224] 
   
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] 
  Authentication Packages	REG_MULTI_SZ   	msv1_0 nwprovau 
   
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] 
  @="" 
   
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] 
  @="" 
   
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] 
  @="Driver" 
   
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] 
  @="" 
   
  [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programlar^Başlangıç^Adobe Reader Hızlı Çalıştırma.lnk] 
  path=c:\documents and settings\All Users\Start Menu\Programlar\Başlangıç\Adobe Reader Hızlı Çalıştırma.lnk 
  backup=c:\windows\pss\Adobe Reader Hızlı Çalıştırma.lnkCommon Startup 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\security center] 
  "AntiVirusOverride"=dword:00000001 
   
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] 
  "EnableFirewall"= 0 (0x0) 
   
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] 
  "c:\\WINDOWS\\system32\\sessmgr.exe"= 
  "c:\\Program Files\\HLSW\\hlsw.exe"= 
  "c:\\Program Files\\Skype\\Skype\\Phone\\Skype.exe"= 
  "c:\\Program Files\\Java\\jre1.6.0_01\\bin\\javaw.exe"= 
  "c:\\WINDOWS\\system32\\PnkBstrA.exe"= 
  "c:\\WINDOWS\\system32\\PnkBstrB.exe"= 
  "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"= 
  "d:\\SIERRA\\Half-Life\\hl.exe"= 
  "c:\\Program Files\\Gamers.IRC\\mirc.exe"= 
  "c:\\Program Files\\DNA\\btdna.exe"= 
  "d:\\SIERRA\\Half-Life\\hltv.exe"= 
  "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= 
  "c:\\Program Files\\uTorrent\\uTorrent.exe"= 
  "c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"= 
  "c:\\Program Files\\Java\\jre6\\bin\\java.exe"= 
  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= 
  "d:\\Program Files\\Steam\\Steam.exe"= 
   
  R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\system32\drivers\sfdrv01a.sys [05.07.2006 14:46 63352] 
  R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [21.12.2007 08:21 468224] 
  R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [21.03.2009 14:40 54752] 
  R3 NVHDA;Service for NVIDIA HDMI Audio Driver;c:\windows\system32\drivers\nvhda32.sys [16.07.2007 11:38 26272] 
  S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [27.10.2008 17:26 717296] 
  S1 atitray;atitray;\??\c:\program files\Radeon Omega Drivers\v3.8.205\ATI Tray Tools\atitray.sys --> c:\program files\Radeon Omega Drivers\v3.8.205\ATI Tray Tools\atitray.sys [?] 
  S3 fsssvc;Windows Live Aile Koruması Hizmeti;c:\program files\Windows Live\Family Safety\fsssvc.exe [05.08.2009 22:48 704864] 
  S3 sdAuxService;PC Tools Auxiliary Service;d:\program files\Spyware Doctor\pctsAuxs.exe [26.02.2009 19:29 356920] 
  . 
  Contents of the 'Scheduled Tasks' folder 
   
  2009-12-04 c:\windows\Tasks\Google Software Updater.job 
  - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-08 18:25] 
  . 
  . 
  ------- Supplementary Scan ------- 
  . 
  uStart Page = hxxp://www.google.com.tr/ 
  uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} 
  uDefault_Search_URL = hxxp://www.google.com/ie 
  uInternet Settings,ProxyOverride = local 
  uSearchURL,(Default) = hxxp://www.google.com/search?q=%s 
  IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 
  IE: {{0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - {E601996F-E400-41CA-804B-CD6373A7EEE2} - c:\program files\kikin\ie_kikin.dll 
  DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab 
  DPF: {D0BB3ACE-4ED3-4D65-BB86-1A0C6CAF351F} - hxxp://212.175.239.246:81/avaLaunch95.cab 
  . 
  - - - - ORPHANS REMOVED - - - - 
   
  AddRemove-dBpoweramp Music Converter - c:\windows\system32\SpoonUninstall.exe <uninstall>c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat 
  AddRemove-NVIDIA Drivers - c:\windows\system32\NVUNINST.EXE UninstallGUI 
  AddRemove-Sierra Utilities - c:\program files\Sierra On-Line\sutil32.exe uninstall 
  AddRemove-Steam App 10 - d:\program files\Steam\steam.exe steam://uninstall/10 
   
   
   
  ************************************************************************** 
   
  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net 
  Rootkit scan 2009-12-04 20:07 
  Windows 5.1.2600 Service Pack 2 NTFS 
   
  scanning hidden processes ...   
   
  scanning hidden autostart entries ...  
   
  scanning hidden files ...   
   
  scan completed successfully 
  hidden files: 0 
   
  ************************************************************************** 
  . 
  --------------------- DLLs Loaded Under Running Processes --------------------- 
   
  - - - - - - - > 'winlogon.exe'(1164) 
  c:\windows\system32\Ati2evxx.dll 
  . 
  Completion time: 2009-12-04 20:08 
  ComboFix-quarantined-files.txt  2009-12-04 18:08 
   
  Pre-Run: 3.516.264.448 bayt boş 
  Post-Run: 3.480.350.720 bayt boş 
   
  - - End Of File - - 860A3DB4F40871B60A954B397A59A04E

ComboFix 09-12-05.01 - GTR2 05.12.2009 22:37.6.2 - x86 
  Microsoft Windows 7 Ultimate   6.1.7600.0.1254.90.1055.18.3067.2492 [GMT 2:00] 
  Running from: c:\users\GTR2\Desktop\ComboFix.exe 
  . 
   
  (((((((((((((((((((((((((   Files Created from 2009-11-05 to 2009-12-05  ))))))))))))))))))))))))))))))) 
  . 
   
  2009-12-05 20:45 . 2009-12-05 20:45	--------	d-----w-	c:\users\Public\AppData\Local\temp 
  2009-12-05 20:45 . 2009-12-05 20:45	--------	d-----w-	c:\users\Default\AppData\Local\temp 
  2009-12-05 13:52 . 2009-12-05 20:45	4096	d-----w-	c:\users\GTR2\AppData\Local\temp 
  2009-12-05 13:06 . 2009-12-05 13:06	4844296	----a-w-	c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 
  2009-12-05 01:08 . 2009-12-05 01:08	--------	d-----w-	c:\windows\system32\AGEIA 
  2009-12-05 01:08 . 2009-12-05 01:08	8192	d-----w-	c:\program files\AGEIA Technologies 
  2009-12-05 00:46 . 2009-12-05 00:46	--------	d-----w-	c:\users\GTR2\AppData\Local\NVIDIA Corporation 
  2009-12-04 23:23 . 2009-12-04 23:23	4096	d-----w-	C:\Fraps 
  2009-12-04 19:51 . 2009-11-12 04:14	66664	----a-w-	c:\windows\system32\drivers\nvhda32v.sys 
  2009-12-04 19:51 . 2009-11-12 01:09	57344	----a-w-	c:\windows\system32\nvapo32v.dll 
  2009-12-04 19:51 . 2009-11-12 01:08	19456	----a-w-	c:\windows\system32\nvhdap32.dll 
  2009-12-04 19:51 . 2009-11-10 23:15	182888	----a-w-	c:\windows\system32\nvcohda.dll 
  2009-12-03 21:23 . 2009-12-03 21:23	--------	d-----w-	c:\windows\B83FC356B7C0441F8A4DD71E088E7974.TMP 
  2009-11-30 21:02 . 2009-11-30 21:02	--------	d-----w-	c:\users\GTR2\AppData\Roaming\FastStone 
  2009-11-30 21:02 . 2009-11-30 21:02	4096	d-----w-	c:\program files\FastStone Capture 
  2009-11-30 17:31 . 2009-11-30 17:31	--------	d-----w-	c:\program files\Trend Micro 
  2009-11-30 10:52 . 2009-11-30 10:52	--------	d-----w-	c:\users\GTR2\AppData\Roaming\Nero 
  2009-11-30 10:52 . 2006-03-17 12:49	368640	----a-w-	c:\windows\system32\TwnLib4.dll 
  2009-11-30 10:52 . 2006-03-17 09:45	802816	----a-w-	c:\windows\system32\imagXRA7.dll 
  2009-11-30 10:52 . 2006-03-17 09:45	497296	----a-w-	c:\windows\system32\imagXpr7.dll 
  2009-11-30 10:52 . 2006-03-17 09:45	258048	----a-w-	c:\windows\system32\imagXR7.dll 
  2009-11-30 10:52 . 2009-11-30 10:52	--------	d-----w-	c:\program files\Nero 
  2009-11-30 10:52 . 2009-11-30 10:52	--------	d-----w-	c:\program files\Common Files\Nero 
  2009-11-30 10:52 . 2009-11-30 10:52	--------	d-----w-	c:\programdata\Nero 
  2009-11-30 10:52 . 2006-03-17 09:45	1757184	----a-w-	c:\windows\system32\imagX7.dll 
  2009-11-29 23:27 . 2009-08-28 03:41	155648	----a-w-	c:\windows\system32\nvcod164.dll 
  2009-11-28 20:45 . 2009-11-28 20:45	--------	d-----w-	c:\users\GTR2\AppData\Local\VMLite Workstation 
  2009-11-28 20:44 . 2009-11-28 20:45	--------	d-----w-	c:\users\GTR2\VMLites 
  2009-11-27 21:08 . 2009-11-27 21:14	--------	d-----w-	c:\windows\system32\RTCOM 
  2009-11-27 19:03 . 2009-11-27 19:03	--------	d-----w-	c:\program files\Realtek 
  2009-11-26 19:37 . 2009-11-26 19:37	--------	d-----w-	c:\program files\Common Files\PCSuite 
  2009-11-26 19:37 . 2009-11-26 19:37	--------	d-----w-	c:\program files\Common Files\Nokia 
  2009-11-26 19:37 . 2008-08-26 07:26	18816	----a-w-	c:\windows\system32\drivers\pccsmcfd.sys 
  2009-11-26 19:37 . 2009-11-26 19:37	12288	d-----w-	c:\program files\PC Connectivity Solution 
  2009-11-26 19:37 . 2009-11-26 19:37	33884480	----a-w-	c:\programdata\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Nokia_PC_Suite_7_1_40_1_tur_web.exe 
  2009-11-25 01:02 . 2009-11-25 01:02	339776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll 
  2009-11-24 18:39 . 2009-10-29 07:22	2048	----a-w-	c:\windows\system32\tzres.dll 
  2009-11-24 18:34 . 2009-11-24 18:34	--------	d-----w-	c:\programdata\Zbshareware Lab 
  2009-11-24 18:33 . 2009-11-24 18:34	4096	d-----w-	c:\program files\USB Disk Security 
  2009-11-23 21:23 . 2009-11-23 23:12	--------	d-----w-	c:\users\GTR2\Tracing 
  2009-11-23 20:41 . 2009-08-05 20:48	54632	----a-w-	c:\windows\system32\drivers\fssfltr.sys 
  2009-11-23 20:41 . 2009-11-23 20:41	--------	d-----w-	c:\program files\Microsoft Sync Framework 
  2009-11-23 20:40 . 2009-11-23 20:40	--------	d-----w-	c:\program files\Microsoft SQL Server Compact Edition 
  2009-11-23 20:39 . 2009-11-23 20:39	--------	d-----w-	c:\program files\Windows Live SkyDrive 
  2009-11-23 20:39 . 2009-11-23 20:41	4096	d-----w-	c:\program files\Windows Live 
  2009-11-23 19:56 . 2009-11-23 19:56	--------	d-----w-	c:\program files\Common Files\Windows Live 
  2009-11-23 19:55 . 2009-11-23 20:39	--------	d-----w-	c:\program files\Microsoft 
  2009-11-23 13:11 . 2009-11-23 13:11	--------	d-----w-	C:\BigFishGamesCache 
  2009-11-23 05:24 . 2009-11-23 05:24	--------	d-----w-	c:\users\GTR2\AppData\Roaming\PlayFirst 
  2009-11-23 05:24 . 2009-11-23 05:24	--------	d-----w-	c:\programdata\PlayFirst 
  2009-11-23 05:24 . 2009-11-23 09:49	4096	d-----w-	c:\program files\Diner Dash Hometown Hero 
  2009-11-23 03:43 . 2009-11-23 03:43	--------	d-----w-	c:\programdata\Fugazo 
  2009-11-23 03:13 . 2009-11-23 03:13	--------	d-----w-	c:\programdata\Office Genuine Advantage 
  2009-11-22 21:08 . 2009-11-22 21:07	920	----a-w-	c:\windows\system32\drivers\RtHdatEx.dat 
  2009-11-22 21:08 . 2009-11-22 21:07	8	----a-w-	c:\windows\system32\drivers\rtkhdaud.dat 
  2009-11-22 21:08 . 2009-11-22 21:07	520	----a-w-	c:\windows\system32\drivers\RTEQEX2.dat 
  2009-11-22 21:08 . 2009-11-22 21:07	520	----a-w-	c:\windows\system32\drivers\RTEQEX1.dat 
  2009-11-22 21:08 . 2009-11-22 21:07	520	----a-w-	c:\windows\system32\drivers\RTEQEX0.dat 
  2009-11-22 21:08 . 2009-11-22 21:07	156788	----a-w-	c:\windows\system32\drivers\RtConvEQ.DAT 
  2009-11-22 21:08 . 2009-11-27 21:08	--------	d--h--w-	c:\program files\Temp 
  2009-11-22 21:08 . 2009-11-22 21:08	--------	d-----w-	c:\program files\Common Files\InstallShield 
  2009-11-22 13:13 . 2009-11-23 09:49	4096	d-----w-	c:\program files\Cake Mania Main Street 
  2009-11-22 13:13 . 2009-11-22 13:13	--------	d-----w-	c:\program files\ReflexiveArcade 
  2009-11-22 00:39 . 2009-11-22 00:39	--------	d-----w-	c:\program files\Acer 
  2009-11-21 22:32 . 2009-11-25 21:51	4096	d-----w-	c:\program files\EA SPORTS 
  2009-11-21 22:32 . 2009-11-21 22:32	547	----a-w-	c:\windows\eReg.dat 
  2009-11-21 20:26 . 2009-11-21 20:26	--------	d-----w-	c:\users\GTR2\AppData\Roaming\ABBYY 
  2009-11-21 20:25 . 2009-11-21 20:25	--------	d-----w-	c:\program files\Common Files\ABBYY 
  2009-11-21 20:25 . 2009-12-05 13:05	163840	d-----w-	c:\program files\ABBYY FineReader 9.0 
  2009-11-21 20:25 . 2009-11-21 20:32	4096	d-----w-	c:\users\GTR2\AppData\Local\ABBYY 
  2009-11-21 20:25 . 2009-11-21 20:32	--------	d-----w-	c:\programdata\ABBYY 
  2009-11-21 20:23 . 2009-11-23 23:38	--------	d-----w-	C:\temp 
  2009-11-21 08:46 . 2009-11-21 08:46	86016	----a-w-	c:\windows\system32\frapsvid.dll 
  2009-11-21 03:56 . 2009-11-21 03:56	--------	d-----w-	c:\program files\uTorrent 
  2009-11-21 03:54 . 2009-12-05 20:33	4096	d-----w-	c:\users\GTR2\AppData\Roaming\uTorrent 
  2009-11-20 18:33 . 2009-11-20 18:33	87144	----a-w-	c:\windows\system32\nvhotkey.dll 
  2009-11-20 18:33 . 2009-11-20 18:33	812648	----a-w-	c:\windows\system32\nvsvc.dll 
  2009-11-20 18:33 . 2009-11-20 18:33	66664	----a-w-	c:\windows\system32\nvshext.dll 
  2009-11-20 18:33 . 2009-11-20 18:33	1323624	----a-w-	c:\windows\system32\nvsvcr.dll 
  2009-11-20 18:33 . 2009-11-20 18:33	12685928	----a-w-	c:\windows\system32\nvcpl.dll 
  2009-11-20 18:33 . 2009-11-20 18:33	122984	----a-w-	c:\windows\system32\nvvsvc.exe 
  2009-11-20 18:33 . 2009-11-20 18:33	110184	----a-w-	c:\windows\system32\nvmctray.dll 
  2009-11-19 20:22 . 2009-11-19 21:27	--------	d-----w-	c:\programdata\WinZip 
  2009-11-19 19:15 . 2009-11-19 19:21	4096	d-----w-	c:\program files\GTR2 
  2009-11-18 23:37 . 2009-11-18 23:37	--------	d-----w-	c:\program files\MSECache 
  2009-11-18 18:34 . 2009-11-28 16:50	8192	d-----w-	c:\users\GTR2\AppData\Roaming\LimeWire 
  2009-11-18 18:34 . 2009-11-18 18:34	20480	d-----w-	c:\program files\LimeWire 
  2009-11-17 23:34 . 2009-11-17 23:34	4096	d-----w-	c:\program files\SystemRequirementsLab 
  2009-11-17 23:34 . 2009-11-17 23:34	4096	d-----w-	c:\users\GTR2\AppData\Roaming\SystemRequirementsLab 
  2009-11-17 23:34 . 2009-11-17 23:34	247296	----a-w-	c:\users\GTR2\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4_0_11_0_d_ind.dll 
  2009-11-17 23:34 . 2009-11-17 23:34	247296	----a-w-	c:\users\GTR2\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4_0_11_0_c_ind.dll 
  2009-11-17 23:34 . 2009-11-17 23:34	247296	----a-w-	c:\users\GTR2\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4_0_11_0_b_ind.dll 
  2009-11-17 23:34 . 2009-11-17 23:34	247296	----a-w-	c:\users\GTR2\AppData\Roaming\SystemRequirementsLab\SRLProxy_srl_4_0_11_0_a_ind.dll 
  2009-11-16 22:26 . 2009-11-16 22:26	--------	d-----w-	c:\users\GTR2\DoctorWeb 
  2009-11-16 22:16 . 2009-11-16 22:12	22597512	----a-w-	C:\launch.exe 
  2009-11-16 02:42 . 2009-11-27 20:08	4096	d-----w-	c:\program files\Uninstall Plus v4.1 
  2009-11-16 02:39 . 2009-11-16 02:39	--------	d-----w-	c:\users\GTR2\AppData\Roaming\Win7codecs 
  2009-11-16 01:46 . 2009-11-21 20:28	--------	d-----w-	c:\users\GTR2\AppData\Local\Adobe 
  2009-11-16 01:46 . 2009-11-21 20:28	--------	d-----w-	c:\program files\Common Files\Adobe 
  2009-11-15 19:16 . 2009-11-15 19:16	33884480	----a-w-	c:\programdata\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Nokia_PC_Suite_7_1_40_1_tur.exe 
  2009-11-15 19:16 . 2009-11-15 19:16	95232	----a-w-	c:\programdata\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\pcswpcsi.exe 
  2009-11-15 19:16 . 2009-11-15 19:16	8192	----a-w-	c:\programdata\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstCCD.exe 
  2009-11-15 19:16 . 2009-11-15 19:16	61440	----a-w-	c:\programdata\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCSFEMsi.exe 
  2009-11-15 19:16 . 2009-11-15 19:16	10240	----a-w-	c:\programdata\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCS.exe 
  2009-11-15 18:36 . 2009-07-08 14:34	53248	----a-w-	c:\windows\system32\CSVer.dll 
  2009-11-15 18:35 . 2009-11-15 18:35	--------	d-----w-	C:\Intel 
  2009-11-15 18:35 . 2009-06-04 16:43	330264	----a-w-	c:\windows\system32\drivers\iaStor.sys 
  2009-11-15 18:35 . 2009-11-15 18:36	--------	d-----w-	c:\program files\Intel 
  2009-11-15 16:07 . 2009-11-15 16:08	--------	d-----w-	c:\users\GTR2\AppData\Roaming\PC Suite 
  2009-11-15 16:07 . 2009-11-15 16:08	4096	d-----w-	c:\users\GTR2\AppData\Roaming\Nokia 
  2009-11-15 16:07 . 2009-11-15 16:08	--------	d-----w-	c:\programdata\PC Suite 
  2009-11-15 16:06 . 2009-11-15 16:07	--------	d-----w-	c:\program files\DIFX 
  2009-11-15 16:06 . 2009-11-26 19:37	4096	dc----w-	c:\windows\system32\DRVSTORE 
  2009-11-15 16:06 . 2009-11-26 19:37	--------	d-----w-	c:\program files\Nokia 
  2009-11-15 16:06 . 2009-10-06 09:52	91136	----a-w-	c:\windows\system32\nmwcdcls.dll 
  2009-11-15 16:06 . 2009-10-31 12:53	34085608	----a-w-	c:\programdata\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Nokia_PC_Suite_7_1_30_9_tur_web.exe 
  2009-11-15 16:05 . 2009-11-15 16:05	95232	----a-w-	c:\programdata\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\pcswpcsi.exe 
  2009-11-15 16:05 . 2009-11-15 16:05	8192	----a-w-	c:\programdata\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstCCD.exe 
  2009-11-15 16:05 . 2009-11-15 16:05	61440	----a-w-	c:\programdata\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCSFEMsi.exe 
  2009-11-15 16:05 . 2009-11-15 16:05	10240	----a-w-	c:\programdata\Installations\{3D39E775-DDDA-4327-B747-0BDC5F191331}\Installer\CommonCustomActions\UninstPCS.exe 
  2009-11-15 16:05 . 2009-11-15 19:16	--------	d-----w-	c:\programdata\Installations 
  2009-11-14 23:30 . 2009-11-14 23:30	--------	d-----w-	c:\users\GTR2\AppData\Roaming\Malwarebytes 
  2009-11-14 23:30 . 2009-12-03 14:14	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys 
  2009-11-14 23:30 . 2009-12-05 13:06	4096	d-----w-	c:\program files\Malwarebytes' Anti-Malware 
  2009-11-14 23:30 . 2009-12-03 14:13	19160	----a-w-	c:\windows\system32\drivers\mbam.sys 
   
  . 
  ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  2009-12-05 20:40 . 2009-07-14 08:10	609888	----a-w-	c:\windows\system32\perfh01F.dat 
  2009-12-05 20:40 . 2009-07-14 08:10	118344	----a-w-	c:\windows\system32\perfc01F.dat 
  2009-11-17 18:46 . 2009-11-27 21:07	55328	----a-w-	c:\windows\system32\RtkCoInst.dll 
  2009-11-17 18:46 . 2009-11-27 21:07	346656	----a-w-	c:\windows\system32\RtkApoApi.dll 
  2009-11-17 18:46 . 2009-11-27 21:07	2795552	----a-w-	c:\windows\system32\RtkAPO.dll 
  2009-11-17 18:46 . 2009-11-27 21:07	1528864	----a-w-	c:\windows\system32\RtkPgExt.dll 
  2009-11-17 18:02 . 2009-11-27 21:07	2807392	----a-w-	c:\windows\system32\drivers\RTKVHDA.sys 
  2009-11-15 16:08 . 2009-11-15 16:08	0	---ha-w-	c:\windows\system32\drivers\Msft_User_PCCSWpdDriver_01_07_00.Wdf 
  2009-11-15 16:08 . 2009-11-15 16:08	0	---ha-w-	c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf 
  2009-11-15 16:03 . 2009-11-15 16:03	0	---ha-w-	c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 
  2009-11-13 13:16 . 2009-11-27 21:07	73216	----a-w-	c:\windows\system32\RTEEL32A.dll 
  2009-11-13 13:16 . 2009-11-27 21:07	59392	----a-w-	c:\windows\system32\RTEEG32A.dll 
  2009-11-13 13:16 . 2009-11-27 21:07	348160	----a-w-	c:\windows\system32\RTEEP32A.dll 
  2009-11-13 13:16 . 2009-11-27 21:07	165376	----a-w-	c:\windows\system32\RTEED32A.dll 
  2009-11-11 00:51 . 2009-11-11 00:51	--------	d-sh--we	c:\programdata\Sık Kullanılanlar 
  2009-11-11 00:51 . 2009-11-11 00:51	--------	d-sh--we	c:\programdata\Belgeler 
  2009-11-11 00:47 . 2009-11-11 00:47	0	---ha-w-	c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf 
  2009-11-02 11:48 . 2009-11-27 21:07	831488	----a-w-	c:\windows\RtlExUpd.dll 
  2009-10-30 16:56 . 2009-11-27 21:07	290816	----a-w-	c:\windows\system32\FMAPO.dll 
  2009-10-06 09:55 . 2009-10-06 09:55	1112288	----a-w-	c:\windows\system32\wdfcoinstaller01007.dll 
  2009-10-06 09:52 . 2009-10-06 09:52	7936	----a-w-	c:\windows\system32\drivers\usbser_lowerfltj.sys 
  2009-10-06 09:52 . 2009-10-06 09:52	660480	----a-w-	c:\windows\system32\nmwcdcocls.dll 
  2009-10-06 09:52 . 2009-10-06 09:52	7936	----a-w-	c:\windows\system32\drivers\usbser_lowerflt.sys 
  2009-10-06 09:52 . 2009-10-06 09:52	22016	----a-w-	c:\windows\system32\drivers\ccdcmbo.sys 
  2009-10-06 09:52 . 2009-10-06 09:52	17664	----a-w-	c:\windows\system32\drivers\ccdcmb.sys 
  2009-10-02 04:06 . 2009-11-11 02:02	728648	----a-w-	c:\windows\system32\drivers\dxgkrnl.sys 
  2009-09-15 17:40 . 2009-09-15 17:40	6114816	----a-w-	c:\windows\system32\drivers\NETw5s32.sys 
  2009-09-15 17:19 . 2009-09-15 17:19	2756608	----a-w-	c:\windows\system32\NETw5r32.dll 
  2009-09-15 17:18 . 2009-09-15 17:18	675840	----a-w-	c:\windows\system32\NETw5c32.dll 
  2009-09-15 11:59 . 2009-09-15 11:59	38248	----a-w-	c:\windows\system32\drivers\nvoclock.sys 
  2009-09-15 11:59 . 2009-09-15 11:59	162408	----a-w-	c:\windows\system32\nvcoclk.dll 
  2009-09-07 01:13 . 2009-09-07 01:13	69382	----a-w-	c:\windows\system32\pthreadGC2.dll 
  2009-06-10 21:26 . 2009-07-14 02:04	9633792	--sha-r-	c:\windows\Fonts\StaticCache.dat 
  2009-07-14 01:14 . 2009-07-13 23:42	396800	--sha-w-	c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe 
  . 
   
  (((((((((((((((((((((((((((((   SnapShot_2009-12-05_13.51.16   ))))))))))))))))))))))))))))))))))))))))) 
  . 
  + 2009-11-11 01:48 . 2009-12-05 20:35	29984              c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin 
  - 2009-07-14 04:55 . 2009-12-05 13:45	39954              c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin 
  + 2009-07-14 04:55 . 2009-12-05 20:36	39954              c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin 
  + 2009-11-11 01:12 . 2009-12-05 20:36	10484              c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3670235152-447272939-4044406595-1000_UserData.bin 
  - 2009-11-11 00:50 . 2009-12-03 21:25	16384              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 
  + 2009-11-11 00:50 . 2009-12-05 18:40	16384              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 
  - 2009-11-11 00:50 . 2009-12-03 21:25	32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 
  + 2009-11-11 00:50 . 2009-12-05 18:40	32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 
  + 2009-07-14 04:41 . 2009-12-05 18:40	16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 
  - 2009-07-14 04:41 . 2009-12-03 21:25	16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 
  - 2009-11-11 01:04 . 2009-12-05 13:03	16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 
  + 2009-11-11 01:04 . 2009-12-05 20:37	16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 
  - 2009-11-11 02:03 . 2009-12-05 02:06	32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat 
  + 2009-11-11 02:03 . 2009-12-05 19:01	32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat 
  - 2009-11-11 02:03 . 2009-12-05 02:06	16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat 
  + 2009-11-11 02:03 . 2009-12-05 19:01	16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat 
  + 2009-11-11 02:03 . 2009-12-05 19:01	16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat 
  - 2009-11-11 02:03 . 2009-12-05 02:06	16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat 
  + 2009-11-11 01:04 . 2009-12-05 20:37	32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 
  - 2009-11-11 01:04 . 2009-12-05 13:03	32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 
  + 2009-11-11 01:04 . 2009-12-05 20:37	16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 
  - 2009-11-11 01:04 . 2009-12-05 13:03	16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 
  - 2009-12-05 13:43 . 2009-12-05 13:43	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat 
  + 2009-12-05 20:34 . 2009-12-05 20:34	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat 
  - 2009-12-05 13:43 . 2009-12-05 13:43	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat 
  + 2009-12-05 20:34 . 2009-12-05 20:34	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat 
  - 2009-07-14 02:05 . 2009-12-05 13:48	607190              c:\windows\System32\perfh009.dat 
  + 2009-07-14 02:05 . 2009-12-05 20:40	607190              c:\windows\System32\perfh009.dat 
  - 2009-07-14 02:05 . 2009-12-05 13:48	103568              c:\windows\System32\perfc009.dat 
  + 2009-07-14 02:05 . 2009-12-05 20:40	103568              c:\windows\System32\perfc009.dat 
  - 2009-07-14 02:03 . 2009-12-05 01:23	6815744              c:\windows\System32\SMI\Store\Machine\schema.dat 
  + 2009-07-14 02:03 . 2009-12-05 20:31	6815744              c:\windows\System32\SMI\Store\Machine\schema.dat 
  . 
  (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  . 
  *Note* empty entries & legit default entries are not shown  
  REGEDIT4 
   
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-11-21 289584] 
   
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904] 
  "USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2009-11-24 815104] 
  "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-11-17 8092192] 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] 
  "ConsentPromptBehaviorAdmin"= 0 (0x0) 
  "ConsentPromptBehaviorUser"= 3 (0x3) 
  "EnableLUA"= 0 (0x0) 
  "EnableUIADesktopToggle"= 0 (0x0) 
  "PromptOnSecureDesktop"= 0 (0x0) 
   
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] 
  Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp 
   
  R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\System32\drivers\vwififlt.sys [14.07.2009 01:52 48128] 
  R3 NETw5s32;Windows 7 32 Bit için Intel(R) Wireless WiFi Link Bağdaştırıcı Sürücüsü ;c:\windows\System32\drivers\NETw5s32.sys [15.09.2009 19:40 6114816] 
  R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [04.12.2009 21:51 66664] 
  R3 nvoclock;NVIDIA Enthusiasts Platform KDM;c:\windows\System32\drivers\nvoclock.sys [15.09.2009 13:59 38248] 
  R3 SrvHsfHDA;SrvHsfHDA;c:\windows\System32\drivers\VSTAZL3.SYS [14.07.2009 00:13 207360] 
  R3 SrvHsfV92;SrvHsfV92;c:\windows\System32\drivers\VSTDPV3.SYS [14.07.2009 00:13 980992] 
  R3 SrvHsfWinac;SrvHsfWinac;c:\windows\System32\drivers\VSTCNXT3.SYS [14.07.2009 00:13 661504] 
  R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [28.03.2007 07:51 43008] 
  S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [12.11.2009 01:05 691696] 
  S3 fssfltr;fssfltr;c:\windows\System32\drivers\fssfltr.sys [23.11.2009 22:41 54632] 
  S3 fsssvc;Windows Live Aile Koruması Hizmeti;c:\program files\Windows Live\Family Safety\fsssvc.exe [05.08.2009 22:48 704864] 
  S3 netw5v32;Windows Vista 32 Bit için Intel(R) Wireless WiFi Link 5000 Serisi Bağdaştırıcı Sürücüsü;c:\windows\System32\drivers\netw5v32.sys [10.06.2009 23:18 4231168] 
  S4 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0 PE Licensing Service;c:\program files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [27.10.2008 18:03 759072] 
  S4 Jasmio.MediaCenter.Service;Media Center Support Service;c:\program files\Jasmio\Media Center Support Service\Jasmio.MediaCenter.Service.exe [29.10.2009 20:05 73144] 
  S4 TunerFreeMCEService;TunerFreeMCEService;c:\program files\MillieSoft\TunerFreeMCE\TunerFreeMCEService.exe [28.10.2009 09:03 9216] 
  . 
  ------- Supplementary Scan ------- 
  . 
  uStart Page = hxxp://www.google.com.tr/ 
  TCP: {00428595-D26E-49E8-89BD-381FC3CB180B} = 4.2.2.3,4.2.2.4 
  DPF: {D5D17C21-1719-4640-B0B2-4F3262419920} - hxxps://www.isbank.com.tr/Internet/lib/JaguarEdit4ISBv27.CAB 
  FF - ProfilePath - c:\users\GTR2\AppData\Roaming\Mozilla\Firefox\Profiles\09tz7buf.default\ 
  FF - prefs.js: browser.search.selectedEngine - Google 
  FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.tr/ 
  FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= 
  FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll 
  FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll 
  FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll 
  FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll 
  FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll 
  FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll 
   
  ---- FIREFOX POLICIES ---- 
  c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); 
  . 
  . 
  --------------------- LOCKED REGISTRY KEYS --------------------- 
   
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] 
  @Denied: (A) (Users) 
  @Denied: (A) (Everyone) 
  @Allowed: (B 1 2 3 4 5) (S-1-5-20) 
  "BlindDial"=dword:00000000 
   
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] 
  @Denied: (A) (Users) 
  @Denied: (A) (Everyone) 
  @Allowed: (B 1 2 3 4 5) (S-1-5-20) 
  "BlindDial"=dword:00000000 
   
  [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] 
  @Denied: (Full) (Everyone) 
  . 
  Completion time: 2009-12-05 22:46 
  ComboFix-quarantined-files.txt  2009-12-05 20:46 
  ComboFix2.txt  2009-12-05 13:52 
  ComboFix3.txt  2009-12-03 21:37 
  ComboFix4.txt  2009-11-15 00:24 
  ComboFix5.txt  2009-12-05 20:35 
   
  Pre-Run: 105.507.540.992 bayt boş 
  Post-Run: 105.455.493.120 bayt boş 
   
  - - End Of File - - 5F1C91C141A89934FF114B46A623A563 
  

 
  Malwarebytes' Anti-Malware 1.41 
  Veritabanı sürümü: 3278 
  Windows 6.1.7600 
   
  02.12.2009 20:56:10 
  mbam-log-2009-12-02 (20-56-10).txt 
   
  Tarama biçimi: Gelişmiş Tarama (C:\|D:\|E:\|I:\|) 
  Taranan öğeler: 454999 
  Geçen süre: 1 hour(s), 44 minute(s), 52 second(s) 
   
  Etkilenmiş Hafıza İşlemleri: 0 
  Etkilenmiş Hafıza Modülleri: 0 
  Etkilenmiş Kayıt Anahtarları: 0 
  Etkilenmiş Kayıt Değerleri: 0 
  Etkilenmiş Kayıt Verisi Öğeleri: 0 
  Etkilenmiş Klasörler: 0 
  Etkilenmiş Dosyalar: 14 
   
  Etkilenmiş Hafıza İşlemleri: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Hafıza Modülleri: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Kayıt Anahtarları: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Kayıt Değerleri: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Kayıt Verisi Öğeleri: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Klasörler: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Dosyalar: 
  C:\Program Files\WinRAR\Patch.exe (Trojan.Agent) -> Quarantined and deleted successfully. 
  E:\Cep Arşiv\Nokia\N82 için programlar\Best Crypto v1.0\keygen.exe (Trojan.Agent) -> Quarantined and deleted successfully. 
  E:\Cep Arşiv\Nokia\N82 için programlar\Handy Calendar\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully. 
  E:\Program Arşivi\CD-DVD\AnyReader_v3.02.40 Bozuk cd dvd okuma\nfoviewer.exe (Trojan.Agent) -> Quarantined and deleted successfully. 
  E:\Program Arşivi\CD-DVD\Nero\NERO 9.4.13.2d FINAL (Multilanguage)\KEYGEN\KEYGEN.exe (Trojan.Agent) -> Quarantined and deleted successfully. 
  E:\Program Arşivi\Güvenlik\Malwarebytes\Malwarebytes.Anti-Malware.v1.37.Multilingual.Win2kXP2k3Vista.Incl.Keygen-CRD\keygen\yaya.exe (Dont.Steal.Our.Software.A) -> Quarantined and deleted successfully. 
  E:\Program Arşivi\Karışık\Product.Key.Explorer\KGN\keygen.exe (Malware.Packer) -> Quarantined and deleted successfully. 
  E:\Program Arşivi\Karışık\Recover My Files\Cure\KeyMaker.exe (Trojan.Downloader) -> Quarantined and deleted successfully. 
  E:\Program Arşivi\Karışık\Teleport Pro\Teleport.Pro.v1.60.Incl.Keymaker-AGAiN\keymaker.exe (Trojan.Agent) -> Quarantined and deleted successfully. 
  E:\Program Arşivi\Müzik\Winamp\Winamp 5.35 Pro Türkçe\Winamp 5.xx KeyGen.exe (Malware.Packer) -> Quarantined and deleted successfully. 
  E:\Program Arşivi\Performans\Your uninstaller\Your Uninstaller! PRO 2008 6.2.1331 Multilingual Christmas Edition\Keygen-Pack\Keygen-SND\YourUninstaller2008keygen.#xe (Trojan.Downloader) -> Quarantined and deleted successfully. 
  E:\Program Arşivi\Performans\Your uninstaller\yu2008setup\KeyGen\Keygen-SND\YourUninstaller2008keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully. 
  E:\Program Arşivi\Ses-Video\Oynatıcılar\Power DVD Deluxe 9\CyberLink.PowerDVD.Deluxe.v9.0.1428.Multilingual.Incl.Keymaker\KGN\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully. 
  E:\Program Arşivi\Sıkıştırma\rar\Keygen.exe (Trojan.Dropper) -> Quarantined and deleted successfully. 
  

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 16:59:17, on 06.12.2009 
  Platform: Windows XP SP3 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v8.00 (8.00.6001.18702) 
  Boot mode: Normal 
   
  Running processes: 
  C:\WINDOWS\System32\smss.exe 
  C:\WINDOWS\system32\winlogon.exe 
  C:\WINDOWS\system32\services.exe 
  C:\WINDOWS\system32\lsass.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\WINDOWS\system32\spoolsv.exe 
  C:\WINDOWS\system32\acs.exe 
  C:\WINDOWS\Explorer.EXE 
  C:\Program Files\DAEMON Tools\daemon.exe 
  C:\WINDOWS\system32\rundll32.exe 
  C:\Program Files\Java\jre6\bin\jusched.exe 
  C:\Program Files\iTunes\iTunesHelper.exe 
  C:\Program Files\ESET\ESET Smart Security\egui.exe 
  C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe 
  C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe 
  C:\Program Files\Messenger\msmsgs.exe 
  C:\WINDOWS\system32\ctfmon.exe 
  C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe 
  C:\Program Files\Orbitdownloader\orbitdm.exe 
  C:\Program Files\Orbitdownloader\orbitnet.exe 
  C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe 
  C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe 
  C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe 
  C:\WINDOWS\system32\agrsmsvc.exe 
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
  C:\Program Files\Bonjour\mDNSResponder.exe 
  C:\Program Files\ESET\ESET Smart Security\ekrn.exe 
  C:\Program Files\Java\jre6\bin\jqs.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe 
  C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe 
  C:\Program Files\iPod\bin\iPodService.exe 
  C:\WINDOWS\system32\wscntfy.exe 
  C:\WINDOWS\system32\wuauclt.exe 
  C:\downloads\HiJackThis.exe 
   
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll 
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll 
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
  O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll 
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe 
  O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 
  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent 
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" 
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime 
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" 
  O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice 
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background 
  O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" 
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background 
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
  O4 - Global Startup: Bluetooth Manager.lnk = ? 
  O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe 
  O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201 
  O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204 
  O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203 
  O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202 
  O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 
  O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL 
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll 
  O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) -http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab 
  O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab 
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1236535293950 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{27A1E318-90F5-4D90-80C4-D3514E80E68E}: NameServer = 4.2.2.5,4.2.2.3 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{6B481F0D-3065-46AD-AA5B-094735CB4165}: NameServer = 4.2.2.5,4.2.2.3 
  O17 - HKLM\System\CS1\Services\Tcpip\..\{27A1E318-90F5-4D90-80C4-D3514E80E68E}: NameServer = 4.2.2.5,4.2.2.3 
  O17 - HKLM\System\CS2\Services\Tcpip\..\{27A1E318-90F5-4D90-80C4-D3514E80E68E}: NameServer = 4.2.2.5,4.2.2.3 
  O17 - HKLM\System\CS3\Services\Tcpip\..\{27A1E318-90F5-4D90-80C4-D3514E80E68E}: NameServer = 4.2.2.5,4.2.2.3 
  O17 - HKLM\System\CS4\Services\Tcpip\..\{27A1E318-90F5-4D90-80C4-D3514E80E68E}: NameServer = 4.2.2.5,4.2.2.3 
  O17 - HKLM\System\CS5\Services\Tcpip\..\{27A1E318-90F5-4D90-80C4-D3514E80E68E}: NameServer = 4.2.2.5,4.2.2.3 
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL 
  O23 - Service: Atheros Yapılandırma Hizmeti (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe 
  O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe 
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
  O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe 
  O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe 
  O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe 
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe 
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe 
  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe 
  O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe 
   
  -- 
  End of file - 8549 bytes 
  

ComboFix 09-11-20.02 - Funda Aydoğdu 06.12.2009 17:03.1.2 - x86 
  Microsoft Windows XP Professional  5.1.2600.3.1254.90.1055.18.1014.548 [GMT 2:00] 
  Running from: c:\downloads\ComboFix.exe 
  AV: ESET Smart Security 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} 
  FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0} 
   * Resident AV is active 
   
   
  WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! 
  . 
  - REDUCED FUNCTIONALITY MODE - 
  . 
   
  (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
   
  c:\windows\system32\drivers\pciide.sys 
  c:\windows\system32\scrrntr.dll 
   
  . 
  (((((((((((((((((((((((((   Files Created from 2009-11-06 to 2009-12-06  ))))))))))))))))))))))))))))))) 
  . 
   
  2009-12-06 14:12 . 2009-12-06 14:12	4844296	----a-w-	c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 
  2009-12-06 14:11 . 2009-12-03 14:14	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys 
  2009-12-06 14:11 . 2009-12-06 14:11	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes 
  2009-12-06 14:11 . 2009-12-03 14:13	19160	----a-w-	c:\windows\system32\drivers\mbam.sys 
  2009-12-06 14:11 . 2009-12-06 14:12	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware 
  2009-12-02 00:37 . 2009-12-02 00:37	--------	d-----w-	c:\windows\system32\LogFiles 
  2009-11-26 21:03 . 2008-04-13 09:46	37888	-c--a-w-	c:\windows\system32\dllcache\bthmodem.sys 
  2009-11-26 21:03 . 2008-04-13 09:46	37888	----a-w-	c:\windows\system32\drivers\bthmodem.sys 
  2009-11-26 19:19 . 2009-06-05 13:43	621056	----a-w-	c:\windows\system32\drivers\mod7700.sys 
  2009-11-26 19:19 . 2009-06-05 13:43	24448	----a-w-	c:\windows\system32\drivers\ewdcsc.sys 
  2009-11-26 19:19 . 2009-06-05 13:43	112640	----a-w-	c:\windows\system32\drivers\ewusbnet.sys 
  2009-11-26 19:19 . 2009-06-05 13:43	102656	----a-w-	c:\windows\system32\drivers\ewusbfake.sys 
  2009-11-26 19:19 . 2009-06-05 13:43	102400	----a-w-	c:\windows\system32\drivers\ewusbmdm.sys 
  2009-11-26 19:18 . 2009-11-26 19:19	--------	d-----w-	c:\program files\Turkcell Connect 
  2009-11-26 07:18 . 2008-04-13 09:45	32128	-c--a-w-	c:\windows\system32\dllcache\usbccgp.sys 
  2009-11-26 07:18 . 2008-04-13 09:45	32128	----a-w-	c:\windows\system32\drivers\usbccgp.sys 
  2009-11-23 10:46 . 2009-11-23 10:46	56	---ha-w-	c:\windows\system32\ezsidmv.dat 
  2009-11-23 10:31 . 2009-11-23 10:31	--------	d-----w-	c:\program files\Common Files\Skype 
  2009-11-23 10:31 . 2009-11-23 10:32	--------	d-----r-	c:\program files\Skype 
  2009-11-23 10:31 . 2009-11-23 10:31	--------	d-----w-	c:\documents and settings\All Users\Application Data\Skype 
  2009-11-16 07:06 . 2009-11-16 07:06	55768	----a-w-	c:\windows\system32\drivers\epfwtdi.sys 
  2009-11-16 07:06 . 2009-11-16 07:06	135048	----a-w-	c:\windows\system32\drivers\epfw.sys 
  2009-11-16 07:03 . 2009-11-16 07:03	108792	----a-w-	c:\windows\system32\drivers\ehdrv.sys 
  2009-11-16 06:56 . 2009-11-16 06:56	116520	----a-w-	c:\windows\system32\drivers\eamon.sys 
   
  . 
  ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  2009-12-06 14:18 . 2009-03-08 20:01	--------	d-----w-	c:\program files\Orbitdownloader 
  2009-12-06 12:29 . 2009-03-08 17:57	--------	d-----w-	c:\program files\ESET 
  2009-12-06 12:29 . 2009-03-08 17:57	--------	d-----w-	c:\documents and settings\All Users\Application Data\ESET 
  2009-11-29 22:03 . 2008-05-01 12:00	45784	----a-w-	c:\windows\system32\perfc01F.dat 
  2009-11-29 22:03 . 2008-05-01 12:00	300326	----a-w-	c:\windows\system32\perfh01F.dat 
  2009-11-05 23:46 . 2009-11-05 23:46	--------	d-----w-	c:\program files\Microsoft 
  2009-11-05 23:45 . 2009-11-05 23:45	--------	d-----w-	c:\program files\Windows Live SkyDrive 
  2009-11-05 23:45 . 2009-03-08 19:35	--------	d-----w-	c:\program files\Windows Live 
  2009-11-05 23:30 . 2009-11-05 23:30	--------	d-----w-	c:\program files\Common Files\Windows Live 
  2009-10-28 21:37 . 2009-10-09 18:46	--------	d-----w-	c:\program files\EViews5 
  2009-10-26 22:09 . 2009-03-31 20:11	--------	d-----w-	c:\program files\CollinsCoBuild 
  2009-10-17 18:13 . 2009-10-17 18:12	--------	d-----w-	c:\program files\iTunes 
  2009-10-17 18:13 . 2009-10-17 18:12	--------	d-----w-	c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD} 
  2009-10-17 18:12 . 2009-10-17 18:12	--------	d-----w-	c:\program files\iPod 
  2009-10-17 18:12 . 2009-07-01 14:38	--------	d-----w-	c:\program files\Common Files\Apple 
  2009-10-17 18:09 . 2009-10-17 18:09	--------	d-----w-	c:\program files\QuickTime 
  2009-10-17 17:58 . 2009-10-17 17:58	79144	----a-w-	c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.1.8\SetupAdmin.exe 
  2009-10-14 13:32 . 2009-03-08 18:10	--------	d-----w-	c:\program files\Java 
  2009-10-09 18:46 . 2009-10-09 18:46	47	---h--r-	c:\windows\ghdc.dat 
  2009-10-09 18:46 . 2009-03-08 17:12	--------	d--h--w-	c:\program files\InstallShield Installation Information 
  2009-09-11 14:18 . 2008-05-01 12:00	136192	----a-w-	c:\windows\system32\msv1_0.dll 
  2004-06-03 10:53 . 2009-10-09 18:52	724	----a-w-	c:\program files\Eviews 5.reg 
  2004-06-03 07:11 . 2009-10-09 18:52	6598656	----a-w-	c:\program files\EViews5.exe 
  . 
   
  (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  . 
  *Note* empty entries & legit default entries are not shown  
  REGEDIT4 
   
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-07-26 3883856] 
  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\lib\NMBgMonitor.exe" [2006-03-01 90112] 
  "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] 
   
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648] 
  "DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016] 
  "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280] 
  "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792] 
  "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440] 
  "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-11-16 2054360] 
  "BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-05-01 110592] 
   
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] 
  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-05-01 15360] 
   
  c:\documents and settings\All Users\Start Menu\Programlar\BaŸlang‡\ 
  Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-5-22 2756608] 
  Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2009-3-8 1707208] 
   
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] 
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"= 
  "%windir%\\system32\\sessmgr.exe"= 
  "c:\\Program Files\\Orbitdownloader\\orbitdm.exe"= 
  "c:\\Program Files\\Orbitdownloader\\orbitnet.exe"= 
  "c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= 
  "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"= 
  "c:\\Program Files\\LimeWire\\LimeWire.exe"= 
  "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= 
  "c:\\Program Files\\iTunes\\iTunes.exe"= 
  "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= 
  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= 
  "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= 
  "c:\\Program Files\\Skype\\Phone\\Skype.exe"= 
   
  R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [22.03.2009 22:42 643072] 
  R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [16.11.2009 09:03 108792] 
  R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16.11.2009 09:04 735960] 
   
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac9623f0-479a-11de-bec5-0016d4f815e2}] 
  \Shell\AutoRun\command - G:\LaunchU3.exe -a 
  . 
  Contents of the 'Scheduled Tasks' folder 
   
  2009-11-30 c:\windows\Tasks\AppleSoftwareUpdate.job 
  - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 09:34] 
  . 
  . 
  ------- Supplementary Scan ------- 
  . 
  uStart Page = hxxp://www.google.com.tr/ 
  uInternet Connection Wizard,ShellNext = iexplore 
  uInternet Settings,ProxyOverride = *.local 
  IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201 
  IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204 
  IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203 
  IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202 
  IE: Microsoft Excel'e Gö&nder - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 
  TCP: {27A1E318-90F5-4D90-80C4-D3514E80E68E} = 4.2.2.5,4.2.2.3 
  TCP: {6B481F0D-3065-46AD-AA5B-094735CB4165} = 4.2.2.5,4.2.2.3 
  FF - ProfilePath - c:\documents and settings\Funda Aydoğdu\Application Data\Mozilla\Firefox\Profiles\rcdsugk5.default\ 
  FF - prefs.js: browser.startup.homepage - www.google.com.tr 
  FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll 
   
  ---- FIREFOX POLICIES ---- 
  c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); 
  . 
   
  ************************************************************************** 
   
  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net 
  Rootkit scan 2009-12-06 17:06 
  Windows 5.1.2600 Service Pack 3 NTFS 
   
  scanning hidden processes ...   
   
  scanning hidden autostart entries ...  
   
  scanning hidden files ...   
   
  scan completed successfully 
  hidden files: 0 
   
  ************************************************************************** 
   
  Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer,http://www.gmer.net 
   
  device: opened successfully 
  user: MBR read successfully 
  called modules: ntoskrnl.exe >>UNKNOWN [0x873D4BF8]<<  
  kernel: MBR read successfully 
  detected MBR rootkit hooks: 
  \Driver\Disk -> 0x873d4bf8 
  \Driver\ACPI -> ACPI.sys @ 0xf761acb8 
  \Driver\atapi -> atapi.sys @ 0xf7591b40 
  IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e 
   ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1 
  \Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805e668e 
   ParseProcedure -> ntoskrnl.exe @ 0x8057b6b1 
  NDIS: Realtek RTL8139/810x Family Fast Ethernet NIC -> SendCompleteHandler -> NDIS.sys @ 0xf749abb0 
   PacketIndicateHandler -> NDIS.sys @ 0xf7489a0d 
   SendHandler -> NDIS.sys @ 0xf749db40 
  Warning: possible MBR rootkit infection ! 
  user & kernel MBR OK  
   
  ************************************************************************** 
  . 
  --------------------- DLLs Loaded Under Running Processes --------------------- 
   
  - - - - - - - > 'explorer.exe'(3996) 
  c:\windows\system32\WININET.dll 
  c:\windows\system32\webcheck.dll 
  c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll 
  . 
  ------------------------ Other Running Processes ------------------------ 
  . 
  c:\windows\system32\agrsmsvc.exe 
  c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
  c:\program files\Bonjour\mDNSResponder.exe 
  c:\windows\system32\rundll32.exe 
  c:\program files\Java\jre6\bin\jqs.exe 
  c:\program files\Orbitdownloader\orbitnet.exe 
  c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe 
  c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe 
  c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe 
  c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe 
  c:\program files\iPod\bin\iPodService.exe 
  c:\windows\system32\wscntfy.exe 
  . 
  ************************************************************************** 
  . 
  Completion time: 2009-12-06 17:10 - machine was rebooted 
  ComboFix-quarantined-files.txt  2009-12-06 15:10 
   
  Pre-Run: 19 954 954 240 bayt boş 
  Post-Run: 19 927 674 880 bayt boş 
   
  Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5 
  - - End Of File - - 5E5D33BC819071A20ED2E82219696B23 
  

Malwarebytes' Anti-Malware 1.42 
  Veritabanı sürümü: 3303 
  Windows 5.1.2600 Service Pack 3 
  Internet Explorer 8.0.6001.18702 
   
  06.12.2009 16:54:48 
  mbam-log-2009-12-06 (16-54-48).txt 
   
  Tarama biçimi: Gelişmiş Tarama (C:\|D:\|) 
  Taranan öğeler: 162214 
  Geçen süre: 36 minute(s), 51 second(s) 
   
  Etkilenmiş Hafıza İşlemleri: 0 
  Etkilenmiş Hafıza Modülleri: 0 
  Etkilenmiş Kayıt Anahtarları: 0 
  Etkilenmiş Kayıt Değerleri: 0 
  Etkilenmiş Kayıt Verisi Öğeleri: 1 
  Etkilenmiş Klasörler: 0 
  Etkilenmiş Dosyalar: 1 
   
  Etkilenmiş Hafıza İşlemleri: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Hafıza Modülleri: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Kayıt Anahtarları: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Kayıt Değerleri: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Kayıt Verisi Öğeleri: 
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. 
   
  Etkilenmiş Klasörler: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Dosyalar: 
  C:\Documents and Settings\Funda Aydoğdu\Application Data\wiaserva.log (Malware.Trace) -> Quarantined and deleted successfully. 
  

 
  Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 00:30:18, on 07.12.2009 
  Platform: Windows XP SP2 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v7.00 (7.00.6000.16915) 
  Boot mode: Normal 
   
  Running processes: 
  C:\WINDOWS\System32\smss.exe 
  C:\WINDOWS\system32\winlogon.exe 
  C:\WINDOWS\system32\services.exe 
  C:\WINDOWS\system32\lsass.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\WINDOWS\Explorer.EXE 
  C:\WINDOWS\system32\spoolsv.exe 
  C:\WINDOWS\system32\ctfmon.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
  C:\Program Files\Windows Media Player\wmplayer.exe 
  C:\Program Files\Windows Live\Contacts\wlcomm.exe 
  C:\Program Files\Mozilla Firefox\firefox.exe 
  C:\Documents and Settings\Ahmet\Belgelerim\Karşıdan Yüklenenler\HiJackThis.exe 
   
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =  
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file) 
  O2 - BHO: Adobe PDF Reader Bağı Yardımı - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll 
  O2 - BHO: DownloadGuardBHO - {20C1A7F0-528E-444F-BAC5-5804A61CCA7F} - C:\Program Files\Lavasoft\Download Guard for Internet Explorer\DownloadGuardBHO.dll 
  O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll 
  O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll 
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
  O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll 
  O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file) 
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE 
  O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" 
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
  O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
  O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm 
  O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm 
  O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html 
  O8 - Extra context menu item: Banner Ad Blocker’a ekle - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm 
  O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html 
  O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 
  O9 - Extra button: Web trafiği koruması istatistikleri - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll 
  O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL 
  O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe 
  O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe 
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab 
  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{CBAE4EDD-DAA5-4FBB-988C-78E02A8F8AC2}: NameServer = 208.67.222.222,208.67.220.220 
  O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe 
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe 
  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe 
  O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - NetGroup - Politecnico di Torino - C:\Program Files\WinPcap\rpcapd.exe 
   
  -- 
  End of file - 6077 bytes 
  

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 02:04:10, on 07.12.2009 
  Platform: Windows XP SP3 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v8.00 (8.00.6001.18702) 
  Boot mode: Normal 
   
  Running processes: 
  C:\windows\System32\smss.exe 
  C:\windows\system32\winlogon.exe 
  C:\windows\system32\services.exe 
  C:\windows\system32\lsass.exe 
  C:\windows\system32\svchost.exe 
  C:\windows\System32\svchost.exe 
  C:\windows\system32\svchost.exe 
  C:\windows\system32\spoolsv.exe 
  C:\windows\Explorer.EXE 
  C:\windows\system32\TPSMain.exe 
  C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe 
  C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe 
  C:\Program Files\ESET\ESET Smart Security\egui.exe 
  C:\WINDOWS\system32\hkcmd.exe 
  C:\WINDOWS\system32\igfxext.exe 
  C:\WINDOWS\system32\igfxsrvc.exe 
  C:\WINDOWS\system32\igfxpers.exe 
  C:\WINDOWS\VMSnap3.EXE 
  C:\Program Files\TOSHIBA\Controls\VolumeIndicator.exe 
  C:\windows\system32\ctfmon.exe 
  C:\Program Files\Windows Media Player\WMPNSCFG.exe 
  C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe 
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
  C:\Program Files\ESET\ESET Smart Security\ekrn.exe 
  C:\windows\System32\svchost.exe 
  C:\Program Files\Java\jre6\bin\jqs.exe 
  C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe 
  C:\windows\system32\svchost.exe 
  C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe 
  C:\windows\system32\SearchIndexer.exe 
  C:\WINDOWS\system32\wbem\wmiapsrv.exe 
  C:\windows\system32\TPSBattM.exe 
  C:\Program Files\Mozilla Firefox\firefox.exe 
  C:\windows\system32\wuauclt.exe 
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe 
   
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  O1 - Hosts: ::1 localhost 
  O1 - Hosts: 74.125.13.80 v1.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.83 v2.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.86 v3.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.89 v4.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.92 v5.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.95 v6.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.98 v7.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.101 v8.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.97.17 v9.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.97.84 v10.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.87 v11.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.90 v12.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.93 v13.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.96 v14.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.99 v15.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.97.38 v16.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.82 v17.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.85 v18.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.88 v19.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.91 v20.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.94 v21.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.97 v22.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.100 v23.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.103 v24.lscache1.c.youtube.com 
  O1 - Hosts: 74.125.13.80 v1.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.83 v2.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.86 v3.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.89 v4.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.92 v5.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.95 v6.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.98 v7.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.101 v8.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.81 v9.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.84 v10.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.87 v11.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.90 v12.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.93 v13.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.96 v14.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.99 v15.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.102 v16.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.82 v17.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.85 v18.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.88 v19.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.91 v20.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.94 v21.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.97 v22.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.100 v23.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.13.103 v24.lscache2.c.youtube.com 
  O1 - Hosts: 74.125.99.80 v1.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.83 v2.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.86 v3.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.89 v4.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.92 v5.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.95 v6.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.98 v7.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.101 v8.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.81 v9.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.84 v10.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.87 v11.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.90 v12.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.93 v13.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.97.32 v14.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.99 v15.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.102 v16.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.82 v17.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.85 v18.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.88 v19.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.91 v20.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.94 v21.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.97 v22.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.100 v23.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.103 v24.lscache3.c.youtube.com 
  O1 - Hosts: 74.125.99.80 v1.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.83 v2.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.86 v3.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.89 v4.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.92 v5.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.95 v6.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.98 v7.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.101 v8.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.81 v9.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.84 v10.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.87 v11.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.90 v12.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.93 v13.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.96 v14.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.99 v15.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.102 v16.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.82 v17.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.85 v18.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.88 v19.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.91 v20.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.94 v21.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.97 v22.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.100 v23.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.103 v24.lscache4.c.youtube.com 
  O1 - Hosts: 74.125.99.16 v1.lscache5.c.youtube.com 
  O1 - Hosts: 74.125.99.19 v2.lscache5.c.youtube.com 
  O1 - Hosts: 74.125.99.22 v3.lscache5.c.youtube.com 
  O1 - Hosts: 74.125.99.25 v4.lscache5.c.youtube.com 
  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 
  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
  O4 - HKLM\..\Run: [TPSMain] TPSMain.exe 
  O4 - HKLM\..\Run: [Toshiba Hotkey Utility] "C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe" /lang TR 
  O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start 
  O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice 
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe 
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe 
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe 
  O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.EXE 
  O4 - HKLM\..\Run: [Toshiba Controls Utility] "C:\Program Files\TOSHIBA\Controls\VolumeIndicator.exe" 
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime 
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe 
  O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe 
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
  O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 
  O8 - Extra context menu item: Microsoft Excel'e &Ver - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 
  O9 - Extra button: Rip YouTube File - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll 
  O9 - Extra 'Tools' menuitem: Rip YouTube file embedded in this page - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll 
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\windows\bdoscandel.exe 
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\windows\bdoscandel.exe 
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL 
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) -http://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab 
  O16 - DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} (System Requirements Lab) -http://intel-drv-cdn.systemrequirementslab.com/multi/bin/sysreqlab_srlx.cab 
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab 
  O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) -http://download.divx.com/player/DivXBrowserPlugin.cab 
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1251916262390 
  O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) -http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab 
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab 
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab 
  O16 - DPF: {D5D17C21-1719-4640-B0B2-4F3262419920} (JaguarEditControl-ISBANK) -https://www.isbank.com.tr/Internet/lib/JaguarEdit4ISBv27.CAB 
  O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab 
  O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) -http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab 
  O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) -http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{53F30CCF-1E2B-42FD-8873-BBC1125786B2}: NameServer = 4.2.2.1,4.2.2.2 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{9FBF50D1-5497-42F0-9BA7-1E910807893A}: NameServer = 208.67.222.222,208.67.220.220 
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
  O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe 
  O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe 
  O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe 
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe 
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe 
  O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe 
  O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing) 
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe 
  O23 - Service: SoundMovieServer - SoundMovieServer - C:\WINDOWS\system32\snmvtsvc.exe 
  O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe 
   
  -- 
  End of file - 14528 bytes