HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+ (465. sayfa)

------- Sigcheck ------- 
   
  [-] 2009-04-05 . 11267785F7DF1B0A2B4F8615E8A13B21 . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe 
  . 
  (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  . 
  *Note* empty entries & legit default entries are not shown  
  REGEDIT4 
   
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408] 
  "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872] 
  "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] 
   
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 61952] 
  "SoundMan"="SOUNDMAN.EXE" [2006-07-21 86016] 
  "AlcWzrd"="ALCWZRD.EXE" [2006-05-04 2808832] 
  "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] 
  "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168] 
  "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440] 
   
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] 
  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360] 
   
  c:\documents and settings\All Users\Start Menu\Programlar\BaŸlang‡\ 
  Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048] 
  Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872] 
  Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360] 
   
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] 
  "%windir%\\system32\\sessmgr.exe"= 
  "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= 
  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= 
  "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= 
   
  R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [01.07.2008 08:04 34312] 
  R2 ekrn;Eset Service;c:\program files\eset\ESET NOD32 Antivirus\ekrn.exe [01.07.2008 08:02 468224] 
  R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [05.04.2009 22:48 55152] 
  S3 fsssvc;Windows Live Aile Koruması;c:\program files\Windows Live\Family Safety\fsssvc.exe [06.02.2009 17:08 533360] 
  . 
  . 
  ------- Supplementary Scan ------- 
  . 
  uStart Page = hxxp://www.google.com.tr/ 
  IE: Microsoft Excel'e Gö&nder - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000 
  . 
   
  ************************************************************************** 
   
  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net 
  Rootkit scan 2010-01-17 17:42 
  Windows 5.1.2600 Service Pack 2 NTFS 
   
  scanning hidden processes ...   
   
  scanning hidden autostart entries ...  
   
  scanning hidden files ...   
   
  scan completed successfully 
  hidden files: 0 
   
  ************************************************************************** 
  . 
  --------------------- DLLs Loaded Under Running Processes --------------------- 
   
  - - - - - - - > 'winlogon.exe'(744) 
  c:\windows\system32\Ati2evxx.dll 
   
  - - - - - - - > 'explorer.exe'(3776) 
  c:\windows\system32\ieframe.dll 
  c:\windows\system32\WPDShServiceObj.dll 
  c:\windows\system32\PortableDeviceTypes.dll 
  c:\windows\system32\PortableDeviceApi.dll 
  . 
  ------------------------ Other Running Processes ------------------------ 
  . 
  c:\windows\system32\Ati2evxx.exe 
  c:\windows\system32\Ati2evxx.exe 
  c:\windows\SOUNDMAN.EXE 
  c:\windows\ALCWZRD.EXE 
  c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 
  c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe 
  c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 
  c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe 
  c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe 
  c:\windows\system32\wscntfy.exe 
  . 
  ************************************************************************** 
  . 
  Completion time: 2010-01-17  17:43:44 - machine was rebooted 
  ComboFix-quarantined-files.txt  2010-01-17 15:43 
   
  Pre-Run: 56.581.169.152 bayt boş 
  Post-Run: 57.259.393.024 bayt boş 
   
  WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe 
  [boot loader] 
  timeout=2 
  default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS 
  [operating systems] 
  c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 
  multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 
   
  - - End Of File - - 0447C58428826CE03A0E28FCDDDB3411

merhaba serji kardeş combofix ile oluşturulan logu veriyorum programı çalıştırınca bir hata verdi doğru bir log mu tam bilemiyorum yardımcı olursan sevinirim aslında sorunum şu çok aşırı kota gidiyor acaba buna neden olan olumsuz bir sorun varmı sistemde neleri silmem gerektiğini ve nasıl silmem gerektiğini söylersen sevinirim kolay gelsin. ayrıca premieropinium diye bir zımbırtı var onu silemiyorum. teşekkür ederim 
   
  ComboFix 08-08-03.05 - EVREN 2010-01-18  0:31:21.1 - NTFSx86 
  Microsoft Windows XP Professional  5.1.2600.2.1254.90.1055.18.647 [GMT 2:00] 
  Running from: C:\Documents and Settings\EVREN\Desktop\18628-ComboFix.exe 
   * Created a new restore point 
   
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] 
  . 
  - REDUCED FUNCTIONALITY MODE - 
  . 
   
  (((((((((((((((((((((((((((((((((((((((   Other Deletions   ))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
   
  C:\WINDOWS\temp\perflib_perfdata_1cc.dat 
   
  . 
  (((((((((((((((((((((((((   Files Created from 2009-12-17 to 2010-01-17  ))))))))))))))))))))))))))))))) 
  . 
   
  2010-01-17 01:51 . 2010-01-17 01:51	0	--a------	C:\WINDOWS\nsreg.dat 
  2010-01-15 01:07 . 2010-01-17 23:14	<DIR>	d--------	C:\Program Files\PremierOpinion 
  2010-01-15 01:07 . 2010-01-15 01:07	<DIR>	d--------	C:\Documents and Settings\EVREN\Application Data\nswb 
  2010-01-13 03:44 . 2010-01-13 03:44	<DIR>	d--------	C:\Program Files\MSN Messenger 
  2009-12-29 22:15 . 2009-12-30 00:27	<DIR>	d--------	C:\Program Files\Total Video Converter 
  2009-12-29 22:15 . 2000-05-22 22:58	608,448	--a------	C:\WINDOWS\system32\comctl32.ocx 
  2009-12-29 21:54 . 2009-12-29 21:57	<DIR>	d--------	C:\Documents and Settings\EVREN\Application Data\Nero 
  2009-12-29 21:53 . 2009-12-29 22:00	<DIR>	d--------	C:\Program Files\Common Files\Nero 
  2009-12-29 21:53 . 2009-12-29 21:59	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Nero 
  2009-12-29 20:11 . 2010-01-17 02:18	<DIR>	d--------	C:\Program Files\Windows Media Connect 2 
  2009-12-29 20:10 . 2009-12-29 20:10	<DIR>	d--------	C:\WINDOWS\system32\LogFiles 
  2009-12-29 20:10 . 2009-12-29 20:10	<DIR>	d--------	C:\WINDOWS\system32\drivers\UMDF 
  2009-12-27 00:44 . 2009-12-27 11:04	21	--a------	C:\WINDOWS\1 Click & Lock.dat 
  2009-12-26 22:10 . 2009-12-18 22:26	8,101,951	--a------	C:\WINDOWS\system32\idtsg.cpl 
  2009-12-26 22:10 . 2009-12-18 22:26	2,314,240	--a------	C:\WINDOWS\system32\stlang.dll 
  2009-12-26 22:10 . 2009-12-18 22:26	442,433	--a------	C:\WINDOWS\sttray.exe 
  2009-12-26 22:10 . 2009-12-18 22:26	221,239	--a------	C:\WINDOWS\system32\stacsv.exe 
  2009-12-26 03:12 . 2010-01-17 23:11	<DIR>	d--------	C:\Documents and Settings\EVREN\Application Data\LimeWire 
  2009-12-26 01:59 . 2009-12-26 01:59	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Adobe Systems 
  2009-12-26 01:40 . 2010-01-10 03:19	<DIR>	d--------	C:\Program Files\LimeWire 
  2009-12-26 00:22 . 2009-12-26 00:22	535	--a------	C:\WINDOWS\eReg.dat 
  2009-12-24 21:50 . 2010-01-16 00:11	116	--a------	C:\WINDOWS\NeroDigital.ini 
  2009-12-24 00:37 . 2009-12-24 00:37	<DIR>	d--------	C:\Documents and Settings\EVREN\temp 
  2009-12-24 00:32 . 2009-12-24 00:32	<DIR>	d--------	C:\Program Files\ShowMyPCService 
  2009-12-24 00:30 . 2009-12-24 00:33	<DIR>	d--------	C:\Program Files\Skype 
  2009-12-24 00:30 . 2009-12-24 00:30	<DIR>	d--------	C:\Program Files\Common Files\Skype 
  2009-12-24 00:30 . 2009-12-26 22:33	<DIR>	d--------	C:\Documents and Settings\EVREN\Application Data\Skype 
  2009-12-23 02:08 . 2009-12-24 00:29	<DIR>	d--------	C:\Program Files\Skype(2) 
  2009-12-23 02:06 . 2009-12-24 00:29	<DIR>	d--------	C:\Documents and Settings\EVREN\Application Data\Skype(2) 
  2009-12-22 22:49 . 2009-12-23 23:05	<DIR>	d--------	C:\Documents and Settings\EVREN\Application Data\HpUpdate 
  2009-12-22 22:36 . 2009-12-22 22:36	<DIR>	d--------	C:\SWSetup 
  2009-12-22 21:45 . 2009-12-24 00:29	<DIR>	d--------	C:\Documents and Settings\LocalService\UserData 
  2009-12-22 21:45 . 2009-12-22 21:45	<DIR>	dr-------	C:\Documents and Settings\LocalService\Sık Kullanılanlar 
  2009-12-22 21:45 . 2009-12-22 21:45	<DIR>	d--------	C:\Documents and Settings\LocalService\PrivacIE 
  2009-12-22 21:45 . 2009-12-22 21:45	<DIR>	d--------	C:\Documents and Settings\LocalService\IECompatCache 
  2009-12-22 13:22 . 2010-01-13 03:08	<DIR>	d--------	C:\Program Files\Windows Live Safety Center 
  2009-12-22 13:18 . 2009-12-22 13:18	<DIR>	d--------	C:\Program Files\TeamViewer 
  2009-12-22 13:18 . 2009-12-22 13:32	<DIR>	d--------	C:\Documents and Settings\EVREN\Application Data\TeamViewer 
  2009-12-22 02:20 . 2009-12-27 23:05	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\SpeakyChat 
  2009-12-22 02:07 . 2009-12-22 02:07	<DIR>	d--------	C:\Documents and Settings\EVREN\Application Data\Media Player Classic 
  2009-12-22 01:23 . 2009-12-26 22:09	<DIR>	d--------	C:\Documents and Settings\EVREN\Application Data\skypePM 
  2009-12-22 01:23 . 2009-12-22 01:23	56	--ah-----	C:\WINDOWS\system32\ezsidmv.dat 
  2009-12-22 01:22 . 2009-12-24 00:30	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Skype 
  2009-12-22 00:49 . 2009-12-22 00:49	<DIR>	d--------	C:\Program Files\BonkEnc 
  2009-12-22 00:49 . 2009-12-22 00:51	<DIR>	d--------	C:\Documents and Settings\EVREN\Application Data\BonkEnc 
  2009-12-22 00:46 . 2004-06-03 16:51	360,504	--a------	C:\WINDOWS\system32\QTPlugin.ocx 
  2009-12-22 00:46 . 2009-12-22 00:46	98,304	--a------	C:\WINDOWS\system32\qttask.exe 
  2009-12-22 00:46 . 2009-12-22 01:00	56	--a------	C:\WINDOWS\system32\QuickTime.qtp 
  2009-12-22 00:38 . 1999-09-17 10:56	118,784	--a------	C:\WINDOWS\system32\mp3dec.dll 
  2009-12-22 00:38 . 2001-12-12 10:42	40,960	--a------	C:\WINDOWS\system32\MDec.ocx 
  2009-12-21 20:41 . 2009-12-21 20:41	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 
  2009-12-21 20:40 . 2009-12-21 20:40	<DIR>	d--------	C:\WINDOWS\speech 
  2009-12-21 20:39 . 2009-12-21 20:39	<DIR>	d--------	C:\Program Files\Common Files\Wise Installation Wizard 
  2009-12-21 20:39 . 2009-12-21 20:39	<DIR>	d--------	C:\Program Files\Common Files\Ahead 
  2009-12-21 20:38 . 2009-12-21 20:38	<DIR>	d--------	C:\Program Files\Microsoft Works 
  2009-12-20 19:57 . 2009-12-21 20:41	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage(2) 
  2009-12-20 19:57 . 2009-12-21 20:41	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage(2) 
  2009-12-20 01:35 . 2009-12-21 20:41	<DIR>	d--------	C:\Program Files\Adobe(2) 
  2009-12-19 21:57 . 2010-01-08 18:02	16	--a------	C:\WINDOWS\popcinfo.dat 
  2009-12-19 21:18 . 2009-12-19 21:18	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\MumboJumbo 
  2009-12-19 16:48 . 2009-12-22 01:31	<DIR>	d--------	C:\Program Files\Pool 'm Up 
  2009-12-19 16:48 . 2009-12-26 17:56	488	--a------	C:\WINDOWS\Poolemup.ini 
  2009-12-19 16:47 . 2009-12-21 20:40	<DIR>	d--------	C:\Program Files\Bejeweled 2 Deluxe 
  2009-12-19 16:47 . 2009-12-21 20:40	<DIR>	d--------	C:\Program Files\Age of Empires II 
  2009-12-19 16:47 . 2009-12-19 16:47	720,896	--a------	C:\WINDOWS\iun6002ev.exe 
  2009-12-19 16:46 . 2010-01-05 03:17	<DIR>	d--------	C:\Program Files\Luxor 3 
  2009-12-19 16:41 . 2008-09-24 20:41	839,680	--a------	C:\WINDOWS\system32\lameACM.acm 
  2009-12-19 16:41 . 2009-08-16 17:08	178,176	--a------	C:\WINDOWS\system32\unrar.dll 
  2009-12-19 16:41 . 2008-10-03 14:30	414	--a------	C:\WINDOWS\system32\lame_acm.xml 
  2009-12-19 16:41 . 2008-07-30 21:09	38	--a------	C:\WINDOWS\avisplitter.ini 
  2009-12-19 16:40 . 2009-12-19 16:40	<DIR>	d--------	C:\Program Files\Lavasoft 
  2009-12-19 16:40 . 2009-12-21 20:39	<DIR>	d--------	C:\Program Files\K-Lite Codec Pack 
  2009-12-19 16:40 . 2009-12-21 20:39	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Lavasoft 
  2009-12-19 16:39 . 2009-12-21 20:39	<DIR>	d--------	C:\Program Files\Ahead 
  2009-12-19 16:39 . 2004-07-26 16:16	1,568,768	---------	C:\WINDOWS\system32\ImagX7.dll 
  2009-12-19 16:39 . 2004-07-26 16:16	476,320	---------	C:\WINDOWS\system32\ImagXpr7.dll 
  2009-12-19 16:39 . 2004-07-26 16:16	471,040	---------	C:\WINDOWS\system32\ImagXRA7.dll 
  2009-12-19 16:39 . 2004-07-09 08:43	364,544	---------	C:\WINDOWS\system32\TwnLib4.dll 
  2009-12-19 16:39 . 2004-07-26 16:16	262,144	---------	C:\WINDOWS\system32\ImagXR7.dll 
  2009-12-19 16:39 . 2001-07-09 10:50	155,648	--a------	C:\WINDOWS\system32\NeroCheck.exe 
  2009-12-19 16:39 . 2005-09-01 11:03	127,488	---------	C:\WINDOWS\system32\drivers\imagesrv.sys 
  2009-12-19 16:39 . 2000-06-26 10:45	106,496	--a------	C:\WINDOWS\system32\TwnLib20.dll 
  2009-12-19 16:39 . 2005-09-01 11:03	5,888	---------	C:\WINDOWS\system32\drivers\imagedrv.sys 
  2009-12-19 16:36 . 2009-12-19 16:36	<DIR>	d--------	C:\WINDOWS\Logs 
  2009-12-19 16:35 . 2009-12-26 03:09	<DIR>	d--------	C:\Program Files\Common Files\Adobe 
  2009-12-19 16:35 . 2009-12-19 16:35	<DIR>	d--------	C:\EXA 
  2009-12-19 13:38 . 2003-06-19 01:31	17,920	--a------	C:\WINDOWS\system32\mdimon.dll 
  2009-12-19 13:38 . 2009-12-19 13:38	396	--a------	C:\WINDOWS\ODBC.INI 
  2009-12-19 13:37 . 2009-12-19 13:37	<DIR>	d--------	C:\WINDOWS\SHELLNEW 
  2009-12-19 13:25 . 2001-11-21 19:12	12,160	--a------	C:\WINDOWS\system32\drivers\mouhid.sys 
  2009-12-19 13:25 . 2001-11-21 19:12	12,160	--a--c---	C:\WINDOWS\system32\dllcache\mouhid.sys 
  2009-12-19 13:25 . 2001-08-17 21:02	9,600	--a------	C:\WINDOWS\system32\drivers\hidusb.sys 
  2009-12-19 13:25 . 2001-08-17 21:02	9,600	--a--c---	C:\WINDOWS\system32\dllcache\hidusb.sys 
  2009-12-19 11:42 . 2009-12-19 11:42	<DIR>	d--------	C:\Program Files\Common Files\Nullsoft 
  2009-12-19 01:03 . 2009-12-19 01:03	<DIR>	d--hs----	C:\Documents and Settings\EVREN\PrivacIE 
  2009-12-19 01:03 . 2009-12-19 01:03	<DIR>	d--hs----	C:\Documents and Settings\EVREN\IECompatCache 
  2009-12-19 01:02 . 2009-12-19 01:02	<DIR>	d--hs----	C:\Documents and Settings\LocalService\IETldCache 
  2009-12-19 01:01 . 2009-12-19 01:01	<DIR>	d--hs----	C:\Documents and Settings\EVREN\IETldCache 
  2009-12-19 00:58 . 2009-12-19 00:58	<DIR>	d--------	C:\WINDOWS\ie8updates 
  2009-12-19 00:58 . 2009-10-29 09:41	11,069,952	-----c---	C:\WINDOWS\system32\dllcache\ieframe.dll 
  2009-12-19 00:58 . 2009-10-29 09:41	1,985,536	-----c---	C:\WINDOWS\system32\dllcache\iertutil.dll 
  2009-12-19 00:58 . 2009-10-29 09:41	594,432	-----c---	C:\WINDOWS\system32\dllcache\msfeeds.dll 
  2009-12-19 00:58 . 2009-10-29 09:41	246,272	-----c---	C:\WINDOWS\system32\dllcache\ieproxy.dll 
  2009-12-19 00:58 . 2009-10-02 06:44	92,160	-----c---	C:\WINDOWS\system32\dllcache\iecompat.dll 
  2009-12-19 00:58 . 2009-10-29 09:41	55,296	-----c---	C:\WINDOWS\system32\dllcache\msfeedsbs.dll 
  2009-12-19 00:58 . 2009-10-29 09:41	12,800	-----c---	C:\WINDOWS\system32\dllcache\xpshims.dll 
  2009-12-19 00:57 . 2009-12-19 00:57	<DIR>	d--------	C:\WINDOWS\system32\tr-TR 
  2009-12-19 00:57 . 2009-12-21 20:38	<DIR>	d--h-c---	C:\WINDOWS\ie8 
  2009-12-19 00:26 . 2009-08-06 19:23	274,288	--a------	C:\WINDOWS\system32\mucltui.dll 
  2009-12-19 00:26 . 2009-08-06 19:23	215,920	--a------	C:\WINDOWS\system32\muweb.dll 
  2009-12-19 00:26 . 2009-08-06 19:23	17,776	--a------	C:\WINDOWS\system32\mucltui.dll.mui 
  2009-12-19 00:00 . 2009-12-19 00:00	<DIR>	d--------	C:\WINDOWS\Sun 
  2009-12-19 00:00 . 2009-12-18 23:59	411,368	--a------	C:\WINDOWS\system32\deploytk.dll 
  2009-12-19 00:00 . 2009-12-18 23:59	73,728	--a------	C:\WINDOWS\system32\javacpl.cpl 
  2009-12-18 23:59 . 2009-12-18 23:59	<DIR>	d--------	C:\Program Files\Java 
  2009-12-18 22:27 . 2009-12-18 22:26	442,439	--a------	C:\WINDOWS\system32\stacapi.dll 
  2009-12-18 21:58 . 2004-08-03 23:08	31,616	--a------	C:\WINDOWS\system32\drivers\usbccgp.sys 
  2009-12-18 21:58 . 2004-08-03 23:08	31,616	--a--c---	C:\WINDOWS\system32\dllcache\usbccgp.sys 
  2009-12-18 21:54 . 2009-12-19 00:31	<DIR>	d--------	C:\WINDOWS\system32\CatRoot_bak 
  2009-12-18 21:52 . 2008-06-14 19:59	272,000	---------	C:\WINDOWS\system32\drivers\bthport.sys 
  2009-12-18 21:52 . 2008-06-14 19:59	272,000	-----c---	C:\WINDOWS\system32\dllcache\bthport.sys 
  2009-12-18 21:40 . 2010-01-18 00:10	<DIR>	d--------	C:\Documents and Settings\EVREN\Tracing 
  2009-12-18 21:39 . 2008-10-24 13:10	453,632	-----c---	C:\WINDOWS\system32\dllcache\mrxsmb.sys 
  2009-12-18 21:38 . 2009-12-18 21:38	<DIR>	d--------	C:\Program Files\Windows Live SkyDrive 
  2009-12-18 21:38 . 2009-12-18 21:38	<DIR>	d--------	C:\Program Files\Windows Live 
   
  . 
  ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  2010-01-17 22:29	---------	d-----w	C:\Program Files\Spyware Doctor 
  2010-01-17 21:21	---------	d---a-w	C:\Documents and Settings\All Users\Application Data\TEMP 
  2009-12-25 22:20	---------	d--h--w	C:\Program Files\InstallShield Installation Information 
  2009-12-25 22:20	---------	d-----w	C:\Program Files\Common Files\InstallShield 
  2009-12-19 14:42	---------	d-----w	C:\Program Files\Google 
  2009-12-18 20:27	---------	d-----w	C:\Program Files\IDT 
  2009-12-18 20:26	150,016	----a-w	C:\WINDOWS\system32\staco.dll 
  2009-12-18 20:26	1,292,888	----a-w	C:\WINDOWS\system32\drivers\sthda.sys 
  2009-12-18 19:30	570	----a-w	C:\WINDOWS\system32\drivers\stwrte.log 
  2009-12-18 18:38	---------	d-----w	C:\Documents and Settings\All Users\Application Data\NOS 
  2009-12-18 18:18	---------	d-----w	C:\Program Files\Common Files\PC Tools 
  2009-12-18 18:15	---------	d-----w	C:\Documents and Settings\EVREN\Application Data\PC Tools 
  2009-12-18 18:15	---------	d-----w	C:\Documents and Settings\All Users\Application Data\PC Tools 
  2009-12-18 17:30	---------	d-----w	C:\Program Files\Intel 
  2009-12-18 17:14	---------	d-----w	C:\Program Files\microsoft frontpage 
  2009-11-10 08:28	165,840	----a-w	C:\WINDOWS\PCTBDRes.dll 
  2009-11-10 08:28	149,456	----a-w	C:\WINDOWS\SGDetectionTool.dll 
  2009-11-10 08:28	1,640,400	----a-w	C:\WINDOWS\PCTBDCore.dll 
  2009-11-10 08:26	767,952	----a-w	C:\WINDOWS\BDTSupport.dll 
  2009-10-29 07:41	916,480	----a-w	C:\WINDOWS\system32\wininet.dll 
  2009-10-27 23:36	1,152,444	----a-w	C:\WINDOWS\UDB.zip 
  . 
   
  (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  . 
  *Note* empty entries & legit default entries are not shown  
  REGEDIT4 
   
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] 
  "{472734EA-242A-422B-ADF8-83D1E48CC825}"= "C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll" [2009-11-10 10:28 395216] 
   
  [HKEY_CLASSES_ROOT\clsid\{472734ea-242a-422b-adf8-83d1e48cc825}] 
  [HKEY_CLASSES_ROOT\BrowserDefender.BDToolbar.1] 
  [HKEY_CLASSES_ROOT\TypeLib\{175B7885-28AB-4D18-8773-7A13A99980A4}] 
  [HKEY_CLASSES_ROOT\BrowserDefender.BDToolbar] 
   
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] 
  "{472734EA-242A-422B-ADF8-83D1E48CC825}"= "C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll" [2009-11-10 10:28 395216] 
   
  [HKEY_CLASSES_ROOT\clsid\{472734ea-242a-422b-adf8-83d1e48cc825}] 
  [HKEY_CLASSES_ROOT\BrowserDefender.BDToolbar.1] 
  [HKEY_CLASSES_ROOT\TypeLib\{175B7885-28AB-4D18-8773-7A13A99980A4}] 
  [HKEY_CLASSES_ROOT\BrowserDefender.BDToolbar] 
   
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-18 19:51 39408] 
  "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2009-12-19 21:05 3883856] 
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:45 15360] 
   
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-12-19 05:08 135168] 
  "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-12-19 05:08 159744] 
  "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-12-19 05:07 131072] 
  "ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2009-11-18 12:47 1243088] 
  "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2009-07-01 18:37 37888] 
  "SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2009-12-18 23:59 149280] 
  "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048] 
  "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] 
  "QuickTime Task"="C:\WINDOWS\system32\qttask.exe" [2009-12-22 00:46 98304] 
   
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] 
  "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:45 15360] 
   
  C:\Documents and Settings\EVREN\Start Menu\Programlar\BaŸlang�‡\ 
  LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe [2009-12-16 18:34:56 503808] 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] 
  "EnableLUA"= 0 (0x0) 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] 
  "HonorAutoRunSetting"= 1 (0x1) 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PremierOpinion] 
  2009-12-22 01:31 386376 c:\Program Files\PremierOpinion\pmls.dll 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] 
  "VIDC.YV12"= yv12vfw.dll 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\security center] 
  "AntiVirusDisableNotify"=dword:00000001 
  "UpdatesDisableNotify"=dword:00000001 
   
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] 
  "EnableFirewall"= 0 (0x0) 
   
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] 
  "C:\\WINDOWS\\system32\\usmt\\migwiz.exe"= 
  "C:\\WINDOWS\\system32\\sessmgr.exe"= 
  "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= 
  "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= 
  "C:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"= 
  "C:\\Program Files\\Skype\\Phone\\Skype.exe"= 
  "C:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"= 
  "C:\\Program Files\\PremierOpinion\\pmropn.exe"= 
   
  R0 PCTCore;PCTools KDS;C:\WINDOWS\system32\drivers\PCTCore.sys [2009-11-09 11:20] 
  R2 Browser Defender Update Service;Browser Defender Update Service;C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe [2009-11-10 10:28] 
  R2 JavaQuickStarterService;Java Quick Starter;C:\Program Files\Java\jre6\bin\jqs.exe [2009-12-18 23:59] 
   
  *Newly Created Service* - CATCHME 
   
  [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] 
  "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP 
  . 
  - - - - ORPHANS REMOVED - - - - 
   
  BHO-{5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
  HKCU-Run-Skype - D:\Skype\Phone\Skype.exe 
  HKCU-Run-MSMSGS - C:\Program Files\Messenger\msmsgs.exe 
   
   
  . 
  ------- Supplementary Scan ------- 
  . 
  FireFox -: Profile - C:\Documents and Settings\EVREN\Application Data\Mozilla\Firefox\Profiles\xwyjnxnd.default\ 
  FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com.tr/ 
  FF -: plugin - C:\Program Files\Java\jre6\bin\new_plugin\npdeploytk.dll 
  FF -: plugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll 
  FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll 
  FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll 
   
   
  ************************************************************************** 
   
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net 
  Rootkit scan 2010-01-18 00:31:50 
  Windows 5.1.2600 Service Pack 2 NTFS 
   
  scanning hidden processes ...  
   
  scanning hidden autostart entries ... 
   
  scanning hidden files ...  
   
  scan completed successfully 
  hidden files: 0 
   
  ************************************************************************** 
  . 
  Completion time: 2010-01-18  0:32:24 
  ComboFix-quarantined-files.txt  2010-01-17 22:32:22 
   
  Pre-Run: 38,037,405,696 bayt boş 
  Post-Run: 38,743,859,200 bayt boş 
   
  256	--- E O F ---	2009-12-18 22:58:44 
  
[/code]
                                        

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 15:15:18, on 18.01.2010 
  Platform: Unknown Windows (WinNT 6.01.3504) 
  MSIE: Internet Explorer v8.00 (8.00.7600.16385) 
  Boot mode: Normal 
   
  Running processes: 
  C:\Windows\system32\Dwm.exe 
  C:\Windows\system32\taskhost.exe 
  C:\Windows\Explorer.EXE 
  C:\Program Files\Winamp\winampa.exe 
  C:\Program Files\ESET\ESET Smart Security\egui.exe 
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
  C:\Program Files\Windows Sidebar\sidebar.exe 
  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe 
  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe 
  C:\Program Files\Windows Live\Contacts\wlcomm.exe 
  C:\Program Files\Mozilla Firefox\firefox.exe 
  C:\Program Files\Windows Media Player\wmplayer.exe 
  C:\Users\akinGTi\Desktop\HiJackThis.exe 
   
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://search.imesh.com/ 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =  
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =  
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =  
  O1 - Hosts: {\rtf1\ansi\ansicpg1252\deff0{\fonttbl{\f0\fnil\fcharset0 Courier New;}{\f1\fnil Segoe UI;}} 
  O1 - Hosts: {\colortbl ;\red0\green0\blue255;\red51\green51\blue51;} 
  O1 - Hosts: {\*\generator Msftedit 5.41.21.2509;}\viewkind4\uc1\pard\lang1033\f0\fs22 # Copyright (c) 1993-2009 Microsoft Corp.\par 
  O1 - Hosts: \par 
  O1 - Hosts: \cf0\f0\fs22\par 
  O1 - Hosts: \par 
  O1 - Hosts: } 
  O2 - BHO: UrlHelper Class - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\iMesh\iMeshIEHelper.dll 
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
  O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" 
  O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice 
  O4 - HKLM\..\Run: [ComboMAX] C:\Program Files\ComboMax\\ComboMaxUpdater.exe 
  O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun 
  O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe" 
  O4 - HKLM\..\Run: [TRKY-DnsAyar] C:\Program Files\TRKY-DnsAyar\TRKY-DnsAyar.exe 
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background 
  O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun 
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000 
  O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll 
  O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll 
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL 
  O13 - Gopher Prefix:  
  O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-5/myWebFaceInitialSetup1.0.1.3.exe 
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{1F7465F3-1234-4AE2-BEF4-81EF0AD04452}: NameServer = 213.243.1.42,212.175.13.113,194.196.235.135 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{C4D5E270-928D-4F0F-8E9E-5F0A214320F7}: NameServer = 213.243.1.42,212.175.13.113,194.196.235.135 
  O17 - HKLM\System\CS1\Services\Tcpip\..\{1F7465F3-1234-4AE2-BEF4-81EF0AD04452}: NameServer = 213.243.1.42,212.175.13.113,194.196.235.135 
  O17 - HKLM\System\CS2\Services\Tcpip\..\{1F7465F3-1234-4AE2-BEF4-81EF0AD04452}: NameServer = 213.243.1.42,212.175.13.113,194.196.235.135 
  O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll 
  O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe 
  O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe 
  O23 - Service: SW Distributed TS Coordinator Service (CoordinatorServiceHost) - Dassault Systèmes SolidWorks Corp. - C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe 
  O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe 
  O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe 
  O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe 
  O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe 
  O23 - Service: lxdnCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdnserv.exe 
  O23 - Service: lxdn_device -   - C:\Windows\system32\lxdncoms.exe 
  O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe 
  O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe 
  O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe 
  O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe 
   
  -- 
  End of file - 6749 bytes 
  

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 19:17:21, on 19.01.2010 
  Platform: Unknown Windows (WinNT 6.01.3504) 
  MSIE: Internet Explorer v8.00 (8.00.7600.16385) 
  Boot mode: Normal 
   
  Running processes: 
  C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe 
  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe 
  C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe 
  C:\Program Files (x86)\Internet Explorer\iexplore.exe 
  C:\Program Files (x86)\Internet Explorer\iexplore.exe 
  C:\Windows\SysWOW64\NOTEPAD.EXE 
  D:\Program Setup\HiJackThis.exe 
   
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =  
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =  
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =  
  F2 - REG:system.ini: UserInit=userinit.exe 
  O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll 
  O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" 
  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'Local Service') 
  O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'Local Service') 
  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE') 
  O4 - Global Startup: Bluetooth.lnk = ? 
  O8 - Extra context menu item: Açılır Pencere Engelleyicisine ekle - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm 
  O8 - Extra context menu item: Görüntüyü &Bluetooth Aygıtına Gönder... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm 
  O8 - Extra context menu item: Sayfayı &Bluetooth Aygıtına Gönder... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm 
  O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll 
  O9 - Extra button: Bluetooth'a Gönder - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm 
  O9 - Extra 'Tools' menuitem: &Bluetooth Aygıtına Gönder... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm 
  O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll 
  O13 - Gopher Prefix:  
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab 
  O20 - AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~2\KASPER~1\KASPER~1\sbhook.dll 
  O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) 
  O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing) 
  O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe 
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe 
  O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) 
  O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) 
  O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe 
  O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) 
  O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) 
  O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) 
  O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) 
  O23 - Service: Rezip - Unknown owner - C:\Windows\SysWOW64\Rezip.exe 
  O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) 
  O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) 
  O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) 
  O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\wlms\wlms.exe,-1 (WLMS) - Unknown owner - C:\Windows\system32\wlms\wlms.exe (file missing) 
  O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) 
  O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) 
   
  -- 
  End of file - 7145 bytes 
  

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 22:11:57, on 20.01.2010 
  Platform: Windows XP SP3 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v8.00 (8.00.6001.18702) 
  Boot mode: Normal 
   
  Running processes: 
  C:\WINDOWS\System32\smss.exe 
  C:\WINDOWS\system32\winlogon.exe 
  C:\WINDOWS\system32\services.exe 
  C:\WINDOWS\system32\lsass.exe 
  C:\WINDOWS\system32\Ati2evxx.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe 
  C:\WINDOWS\system32\Ati2evxx.exe 
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 
  C:\WINDOWS\system32\spoolsv.exe 
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
  C:\Program Files\Bonjour\mDNSResponder.exe 
  C:\WINDOWS\System32\GEARSec.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\Program Files\Java\jre6\bin\jqs.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\Program Files\Norton Ghost\Agent\VProSvc.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\WINDOWS\Explorer.EXE 
  C:\WINDOWS\system32\rundll32.exe 
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe 
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
  C:\WINDOWS\system32\ctfmon.exe 
  C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe 
  C:\Program Files\Windows Live\Contacts\wlcomm.exe 
  C:\Program Files\Mozilla Firefox\firefox.exe 
  C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtblfs.exe 
  C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe 
  C:\Program Files\Internet Explorer\iexplore.exe 
  C:\Program Files\Internet Explorer\iexplore.exe 
  C:\Program Files\Internet Explorer\iexplore.exe 
  C:\Program Files\Internet Explorer\iexplore.exe 
  D:\BELGELERİM\Shared\Mozilla Shared\HiJackThis.exe 
   
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll 
  O2 - BHO: Adobe PDF Reader Bağı Yardımı - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll 
  O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll 
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
  O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Documents and Settings\Tolga DEMIREL\Application Data\FlashGetBHO\FlashGetBHO3.dll 
  O2 - BHO: Ask.com Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
  O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll 
  O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) 
  O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" 
  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent 
  O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup 
  O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH) 
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background 
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
  O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe 
  O8 - Extra context menu item: Download all by FlashGet3 - C:\Documents and Settings\Tolga DEMIREL\Application Data\FlashGetBHO\GetAllUrl.htm 
  O8 - Extra context menu item: Download by FlashGet3 - C:\Documents and Settings\Tolga DEMIREL\Application Data\FlashGetBHO\GetUrl.htm 
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 
  O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll 
  O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll 
  O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll 
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL 
  O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll 
  O9 - Extra button: HP Smart Web Printing göster veya gizle - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll 
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll 
  O15 - Trusted Zone:http://software.kuaiche.com 
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1262996423890 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{743A94E7-FB80-4C2A-8633-60308094C0EB}: NameServer = 208.67.220.220,208.67.222.222 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{A6A969A0-C651-4D02-87F7-6D279940E096}: NameServer = 208.67.220.220,208.67.222.222 
  O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL 
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL 
  O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL 
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe 
  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe 
  O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe 
  O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe 
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 
  O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe 
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe 
  O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe 
  O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe 
  O23 - Service: Google Desktop Yöneticisi 5.9.909.30391 (GoogleDesktopManager-093009-130223) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe 
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe 
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe 
  O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe 
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe 
   
  -- 
  End of file - 9655 bytes 
  

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 14:28:05, on 20.01.2010 
  Platform: Windows XP SP3 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v8.00 (8.00.6001.18702) 
  Boot mode: Normal 
   
  Running processes: 
  C:\WINDOWS\System32\smss.exe 
  C:\WINDOWS\system32\winlogon.exe 
  C:\WINDOWS\system32\services.exe 
  C:\WINDOWS\system32\lsass.exe 
  C:\WINDOWS\system32\nvsvc32.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\system32\spoolsv.exe 
  C:\WINDOWS\Explorer.EXE 
  C:\Program Files\Eset\nod32kui.exe 
  C:\WINDOWS\RTHDCPL.EXE 
  C:\WINDOWS\SOUNDMAN.EXE 
  C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe 
  C:\Program Files\cFosSpeed\cFosSpeed.exe 
  C:\Program Files\Portrait Displays\Pivot Software\floater.exe 
  C:\Program Files\Common Files\Java\Java Update\jusched.exe 
  C:\Program Files\Winamp\winampa.exe 
  C:\Program Files\Babylon\Babylon-Pro\Babylon.exe 
  C:\WINDOWS\system32\RUNDLL32.EXE 
  C:\WINDOWS\system32\ctfmon.exe 
  C:\Program Files\Internet Download Manager\IDMan.exe 
  C:\program files\steam\steam.exe 
  C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe 
  C:\Program Files\cFosSpeed\spd.exe 
  C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe 
  C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe 
  C:\Program Files\LogMeIn Hamachi\hamachi-2.exe 
  C:\Program Files\Java\jre6\bin\jqs.exe 
  C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 
  C:\Program Files\Microsoft LifeCam\MSCamS32.exe 
  C:\Program Files\Eset\nod32krn.exe 
  C:\Program Files\Norton Ghost\Agent\VProSvc.exe 
  C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe 
  C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe 
  C:\WINDOWS\system32\PnkBstrA.exe 
  C:\WINDOWS\system32\PnkBstrB.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe 
  C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe 
  C:\WINDOWS\system32\wbem\wmiapsrv.exe 
  C:\Program Files\Internet Download Manager\IEMonitor.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\Program Files\Babylon\Babylon-Pro\Agent\BabylonAgent.exe 
  C:\WINDOWS\system32\wscntfy.exe 
  C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe 
  C:\Program Files\Mozilla Firefox\firefox.exe 
  D:\Programlar\HijackThis.exe 
   
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =  
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =  
  O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll 
  O2 - BHO: Babylon IE plugin - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
  O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE 
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE 
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE 
  O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE 
  O4 - HKLM\..\Run: [DT PHL] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -PHL 
  O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" 
  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k 
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime 
  O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe 
  O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray 
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" 
  O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" 
  O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart 
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet 
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup 
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit 
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
  O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot 
  O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent 
  O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\DOCUME~1\Ev\LOCALS~1\Temp\E_S66A.tmp" /EF "HKCU" 
  O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm 
  O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm 
  O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm 
  O8 - Extra context menu item: Translate this web page with Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm 
  O8 - Extra context menu item: Translate with Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm 
  O9 - Extra button: OneNote'a Gönder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll 
  O9 - Extra 'Tools' menuitem: OneNote'a G&önder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll 
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL 
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll 
  O9 - Extra 'Tools' menuitem: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll 
  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) -http://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab 
  O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) -http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab 
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1251470904984 
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{72D8E278-20CF-455E-9CBB-358937289715}: NameServer = 208.67.222.222,208.67.220.220 
  O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll 
  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe 
  O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe 
  O23 - Service: Dragon Age: Origins - Content Updater (DAUpdaterSvc) - BioWare - C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe 
  O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe 
  O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe 
  O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe 
  O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe 
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe 
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe 
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE 
  O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 
  O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe 
  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe 
  O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe 
  O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe 
  O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing) 
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe 
  O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - PC Tools - C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe 
  O23 - Service: Portrait Displays SDK Service (PdiService) - Portrait Displays, Inc. - C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe 
  O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe 
  O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe 
  O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe 
  O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpDefragService.exe 
  O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe 
   
  -- 
  End of file - 10237 bytes 
  

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 17:54:59, on 20.01.2010 
  Platform: Unknown Windows (WinNT 6.01.3504) 
  MSIE: Internet Explorer v8.00 (8.00.7600.16385) 
  Boot mode: Normal 
   
  Running processes: 
  C:\Windows\system32\taskhost.exe 
  C:\Windows\system32\Dwm.exe 
  C:\Windows\Explorer.EXE 
  C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 
  C:\Program Files\Java\jre6\bin\jusched.exe 
  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe 
  C:\Program Files\Garena\Garena.exe 
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
  C:\Program Files\Windows Live\Contacts\wlcomm.exe 
  C:\Program Files\Windows Media Player\wmplayer.exe 
  C:\Program Files\Mozilla Firefox\firefox.exe 
  C:\Users\ahmet\Downloads\HiJackThis.exe 
   
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://search.localstrike.com.ar/ 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://search.localstrike.com.ar/ 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://search.localstrike.com.ar/ 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://search.localstrike.com.ar/ 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://search.localstrike.com.ar/ 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://search.localstrike.com.ar/ 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =  
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =  
  O1 - Hosts: ::1 localhost 
  O2 - BHO: (no name) - {00B89E11-7155-4F13-9EF5-A69307051E60} - C:\Windows\System32\btpanui32.dll 
  O2 - BHO: (no name) - {00C8A90B-9B1E-4DEA-83A8-E68A759E8147} - C:\Windows\System32\capisp32.dll (file missing) 
  O2 - BHO: (no name) - {01713C22-7155-4F13-9EF5-A69307051E60} - C:\Windows\System32\atioglxx32.dll (file missing) 
  O2 - BHO: (no name) - {01915216-9B1E-4DEA-83A8-E68A759E8147} - C:\Windows\System32\capisp32.dll (file missing) 
  O2 - BHO: (no name) - {02E27844-7155-4F13-9EF5-A69307051E60} - C:\Windows\System32\DevicePairingHandler32.dll (file missing) 
  O2 - BHO: (no name) - {0322A42C-9B1E-4DEA-83A8-E68A759E8147} - C:\Windows\System32\DevicePairingHandler32.dll (file missing) 
  O2 - BHO: (no name) - {05C4F088-7155-4F13-9EF5-A69307051E60} - C:\Windows\System32\DevicePairingHandler32.dll (file missing) 
  O2 - BHO: (no name) - {075901D2-CC78-4E23-886D-49E9CDC89CDa} - C:\Windows\System32\DevicePairingHandler32.dll (file missing) 
  O2 - BHO: (no name) - {0C8A90B1-9B1E-4DEA-83A8-E68A759E8147} - C:\Windows\System32\DevicePairingHandler32.dll (file missing) 
  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
  O2 - BHO: (no name) - {6454858F-9B1E-4DEA-83A8-E68A759E8147} - C:\Windows\System32\DevicePairingHandler32.dll (file missing) 
  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll 
  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll 
  O4 - HKLM\..\Run: [mspaint] "C:\Windows\system32\Paint.exe" -autocheck 
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min 
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
  O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" 
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime 
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background 
  O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" 
  O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'Local Service') 
  O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'Local Service') 
  O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE') 
  O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe 
  O4 - Startup: NamazVakti.lnk = C:\NamazVakti\NamazVakti.exe 
  O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html 
  O9 - Extra button: Bunu Bloga Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll 
  O9 - Extra 'Tools' menuitem: Windows Live Writer içinde &Bunu Web Günlüğüne Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll 
  O9 - Extra button: OneNote'a Gönder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll 
  O9 - Extra 'Tools' menuitem: OneNote'a G&önder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll 
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL 
  O13 - Gopher Prefix:  
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab 
  O23 - Service: AMD External Events Utility - AMD - C:\Windows\system32\atiesrxx.exe 
  O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe 
  O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe 
  O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe 
  O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE 
  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe 
   
  -- 
  End of file - 6768 bytes 
  

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 19:09:07, on 21.01.2010 
  Platform: Windows XP SP2 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) 
  Boot mode: Normal 
   
  Running processes: 
  C:\WINDOWS\System32\smss.exe 
  C:\WINDOWS\system32\winlogon.exe 
  C:\WINDOWS\system32\services.exe 
  C:\WINDOWS\system32\lsass.exe 
  C:\WINDOWS\system32\Ati2evxx.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\WINDOWS\system32\Ati2evxx.exe 
  C:\WINDOWS\system32\spoolsv.exe 
  C:\WINDOWS\system32\kernel.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 
  C:\WINDOWS\system32\PnkBstrA.exe 
  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\RTHDCPL.EXE 
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
  C:\Program Files\uTorrent\uTorrent.exe 
  C:\WINDOWS\system32\ctfmon.exe 
  D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe 
  C:\DOCUME~1\XP\LOCALS~1\Temp\winhopdn.exe 
  C:\DOCUME~1\XP\LOCALS~1\Temp\winblnjn.exe 
  C:\Documents and Settings\XP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe 
  C:\Program Files\Windows Live\Contacts\wlcomm.exe 
  C:\Documents and Settings\XP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe 
  C:\Documents and Settings\XP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe 
  C:\Documents and Settings\XP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe 
  C:\Documents and Settings\XP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe 
  C:\Program Files\DAEMON Tools Pro\DTProShellHlp.exe 
  C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 
  C:\Documents and Settings\XP\Desktop\Genel Virüs Çözümleri.exe 
  C:\DOCUME~1\XP\LOCALS~1\Temp\ir_ext_temp_1\autorun.exe 
  C:\WINDOWS\explorer.exe 
  C:\DOCUME~1\XP\LOCALS~1\Temp\ir_ext_temp_1\AutoPlay\Docs\Autorun Remover_.exe 
  C:\DOCUME~1\XP\LOCALS~1\Temp\ir_ext_temp_1\AutoPlay\Docs\HijackThis_.exe 
   
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll 
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll 
  R3 - URLSearchHook: Wisdom-soft toolbar - {6dfc55bb-bfff-485a-9709-90c3fdf6db58} - C:\Program Files\Wisdom-soft\tbWisd.dll 
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\kernel.exe 
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll 
  O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll 
  O2 - BHO: Adobe PDF Reader Bağı Yardımı - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll 
  O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll 
  O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file) 
  O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll 
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
  O2 - BHO: Wisdom-soft toolbar - {6dfc55bb-bfff-485a-9709-90c3fdf6db58} - C:\Program Files\Wisdom-soft\tbWisd.dll 
  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll 
  O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare\BearShareIEHelper.dll 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll 
  O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll 
  O2 - BHO: XBTBPos00 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - (no file) 
  O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll 
  O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll 
  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll 
  O3 - Toolbar: Fast Browser Search Toolbar - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file) 
  O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll 
  O3 - Toolbar: Wisdom-soft toolbar - {6dfc55bb-bfff-485a-9709-90c3fdf6db58} - C:\Program Files\Wisdom-soft\tbWisd.dll 
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE 
  O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" 
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background 
  O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" 
  O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" -autorun 
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
  O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') 
  O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 
  O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html 
  O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 
  O9 - Extra button: Bunu Bloga Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll 
  O9 - Extra 'Tools' menuitem: Windows Live Writer içinde &Bunu Web Günlüğüne Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll 
  O9 - Extra button: &Sanal klavye - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll 
  O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL 
  O9 - Extra button: URL ko&ntrolü - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll 
  O9 - Extra button: HP Akıllı Seçim - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll 
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) -http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab 
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll 
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{56A8B7BF-BAD2-43B9-8E2D-68F3159A0C2E}: NameServer = 208.67.222.222,208.67.220.220 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{CCB5AF8F-0208-49C0-B318-A150374B7799}: NameServer = 208.67.222.222,208.67.220.220 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{EEC97720-071F-4132-84E4-C46B9A604A24}: NameServer = 4.2.2.1,4.2.2.2 
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL 
  O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll 
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe 
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 
  O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe 
   
  -- 
  End of file - 9013 bytes 
  

 
   
  Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 01:57:By Leo Brain, on 22.01.2010 
  Platform: Windows XP SP3 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v7.00 (7.00.6000.20935) 
  Boot mode: Normal 
   
  Running processes: 
  C:\WINDOWS\System32\smss.exe 
  C:\WINDOWS\system32\winlogon.exe 
  C:\WINDOWS\system32\services.exe 
  C:\WINDOWS\system32\lsass.exe 
  C:\WINDOWS\system32\Ati2evxx.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\WINDOWS\system32\Ati2evxx.exe 
  C:\WINDOWS\Explorer.EXE 
  C:\WINDOWS\system32\spoolsv.exe 
  C:\WINDOWS\RTHDCPL.EXE 
  C:\WINDOWS\system32\mmm.exe 
  C:\Program Files\XPlus Live! 2009\vistart\vistart.exe 
  C:\Program Files\XPlus Live! 2009\VisualTask\VisualTask.exe 
  C:\Program Files\RocketDock\RocketDock.exe 
  C:\Program Files\Windows Sidebar\sidebar.exe 
  C:\Program Files\ESET\ESET Smart Security\ekrn.exe 
  C:\WINDOWS\system32\ctfmon.exe 
  C:\Program Files\AirTies\Adsl Hizmet Programı\AdslUtility.exe 
  C:\Program Files\Shenturk\Ey DSL! 3\EyDSL.exe 
  C:\Program Files\Windows Sidebar\sidebar.exe 
  C:\Program Files\Windows Sidebar\sidebar.exe 
  C:\Documents and Settings\XPlus 2009\Local Settings\Application Data\Google\Chrome\Application\chrome.exe 
  C:\Documents and Settings\XPlus 2009\Local Settings\Application Data\Google\Chrome\Application\chrome.exe 
  C:\Documents and Settings\XPlus 2009\Local Settings\Application Data\Google\Chrome\Application\chrome.exe 
  C:\Documents and Settings\XPlus 2009\Local Settings\Application Data\Google\Chrome\Application\chrome.exe 
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe 
   
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =https://www.cleverbridge.com/342/?scope=checkout&cart=29945 
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = •·.·´¯`·.·•Windows XPlus Live! 2009•·.·´¯`·.·• by Ultimatefe 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE 
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE 
  O4 - HKLM\..\Run: [RightClick Menu] C:\WINDOWS\system32\mmm.exe 
  O4 - HKLM\..\Run: [Vistart] C:\Program Files\XPlus Live! 2009\vistart\vistart.exe 
  O4 - HKLM\..\Run: [Visual Task] C:\Program Files\XPlus Live! 2009\VisualTask\VisualTask.exe 
  O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\DOCUME~1\XPLUS2~1\LOCALS~1\Temp\Malwarebytes\mbam.exe" /runcleanupscript 
  O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" 
  O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice 
  O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" 
  O4 - HKCU\..\Run: [TransBar] C:\Program Files\XPlus Live! 2009\TransBar\TransBar.exe /s 
  O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun 
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
  O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\XPlus 2009\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c 
  O4 - HKUS\S-1-5-18\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" (User 'SYSTEM') 
  O4 - HKUS\S-1-5-18\..\Run: [TransBar] C:\Program Files\XPlus Live! 2009\TransBar\TransBar.exe /s (User 'SYSTEM') 
  O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" (User 'Default user') 
  O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') 
  O4 - Global Startup: Adsl Hizmet Programı.lnk = ? 
  O4 - Global Startup: Ey DSL! 3.lnk = C:\Program Files\Shenturk\Ey DSL! 3\EyDSL.exe 
  O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{8BB29697-C85D-45C2-86CF-180ABAB06892}: NameServer = 208.67.222.222,208.67.220.220 
  O17 - HKLM\System\CS1\Services\Tcpip\..\{8BB29697-C85D-45C2-86CF-180ABAB06892}: NameServer = 208.67.222.222,208.67.220.220 
  O17 - HKLM\System\CS2\Services\Tcpip\..\{8BB29697-C85D-45C2-86CF-180ABAB06892}: NameServer = 208.67.222.222,208.67.220.220 
  O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Unknown owner - C:\Program Files\Avira\AntiVir Desktop\sched.exe (file missing) 
  O23 - Service: Avira AntiVir Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (file missing) 
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe 
  O23 - Service: CiSvc - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing) 
  O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe 
  O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe 
  O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe 
  O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe 
   
  -- 
  End of file - 6231 bytes 
   
  

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 14:45:53, on 22.01.2010 
  Platform: Windows XP SP3 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v8.00 (8.00.6001.18702) 
  Boot mode: Normal 
   
  Running processes: 
  D:\WINDOWS\System32\smss.exe 
  D:\WINDOWS\system32\winlogon.exe 
  D:\WINDOWS\system32\services.exe 
  D:\WINDOWS\system32\lsass.exe 
  D:\WINDOWS\system32\svchost.exe 
  D:\WINDOWS\System32\svchost.exe 
  D:\WINDOWS\system32\spoolsv.exe 
  D:\WINDOWS\Explorer.EXE 
  D:\WINDOWS\system32\RUNDLL32.EXE 
  D:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe 
  D:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe 
  D:\Program Files\Synaptics\SynTP\SynTPEnh.exe 
  D:\Program Files\Microsoft IntelliPoint\ipoint.exe 
  D:\WINDOWS\RTHDCPL.EXE 
  D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe 
  D:\WINDOWS\system32\ctfmon.exe 
  D:\Program Files\Messenger\msmsgs.exe 
  D:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe 
  D:\Program Files\Rainmeter\Rainmeter.exe 
  D:\Program Files\Stardock\ObjectDock\ObjectDock.exe 
  D:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe 
  D:\Program Files\Java\jre6\bin\jqs.exe 
  D:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 
  D:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe 
  D:\WINDOWS\system32\nvsvc32.exe 
  D:\WINDOWS\system32\svchost.exe 
  D:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe 
  D:\WINDOWS\system32\wbem\wmiapsrv.exe 
  D:\WINDOWS\system32\wscntfy.exe 
  D:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE 
  D:\Program Files\Internet Download Manager\IDMan.exe 
  D:\Program Files\Java\jre6\bin\javaw.exe 
  D:\Program Files\Windows Live\Messenger\msnmsgr.exe 
  D:\Program Files\Windows Live\Contacts\wlcomm.exe 
  D:\Program Files\Windows Media Player\wmplayer.exe 
  E:\Program Setupları\AntiVirus Programları\HiJackThis.exe 
   
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://search.localstrike.com.ar/ 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://search.localstrike.com.ar/ 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://search.localstrike.com.ar/ 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://search.localstrike.com.ar/ 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://search.localstrike.com.ar/ 
  O1 - Hosts: 208.65.153.251 uk.youtube.com 
  O1 - Hosts: 208.65.153.253 de.youtube.com 
  O1 - Hosts: 208.117.236.70 youtube.com 
  O1 - Hosts: 208.117.236.70 www.youtube.com 
  O1 - Hosts: 74.125.65.118 img.youtube.com 
  O1 - Hosts: 64.15.124.143 sjc-v1.sjc.youtube.com 
  O1 - Hosts: 64.15.124.144 sjc-v2.sjc.youtube.com 
  O1 - Hosts: 64.15.124.145 sjc-v3.sjc.youtube.com 
  O1 - Hosts: 64.15.124.146 sjc-v4.sjc.youtube.com 
  O1 - Hosts: 64.15.124.147 sjc-v5.sjc.youtube.com 
  O1 - Hosts: 64.15.124.148 sjc-v6.sjc.youtube.com 
  O1 - Hosts: 64.15.124.149 sjc-v7.sjc.youtube.com 
  O1 - Hosts: 64.15.124.150 sjc-v8.sjc.youtube.com 
  O1 - Hosts: 64.15.124.151 sjc-v9.sjc.youtube.com 
  O1 - Hosts: 64.15.124.152 sjc-v10.sjc.youtube.com 
  O1 - Hosts: 64.15.124.153 sjc-v11.sjc.youtube.com 
  O1 - Hosts: 64.15.124.154 sjc-v12.sjc.youtube.com 
  O1 - Hosts: 64.15.124.155 sjc-v13.sjc.youtube.com 
  O1 - Hosts: 64.15.124.156 sjc-v14.sjc.youtube.com 
  O1 - Hosts: 64.15.124.157 sjc-v15.sjc.youtube.com 
  O1 - Hosts: 64.15.124.158 sjc-v16.sjc.youtube.com 
  O1 - Hosts: 64.15.124.159 sjc-v17.sjc.youtube.com 
  O1 - Hosts: 64.15.124.160 sjc-v18.sjc.youtube.com 
  O1 - Hosts: 64.15.124.161 sjc-v19.sjc.youtube.com 
  O1 - Hosts: 64.15.124.162 sjc-v20.sjc.youtube.com 
  O1 - Hosts: 64.15.124.163 sjc-v21.sjc.youtube.com 
  O1 - Hosts: 64.15.124.164 sjc-v22.sjc.youtube.com 
  O1 - Hosts: 64.15.124.165 sjc-v23.sjc.youtube.com 
  O1 - Hosts: 64.15.124.166 sjc-v24.sjc.youtube.com 
  O1 - Hosts: 64.15.124.167 sjc-v25.sjc.youtube.com 
  O1 - Hosts: 64.15.124.168 sjc-v26.sjc.youtube.com 
  O1 - Hosts: 64.15.124.169 sjc-v27.sjc.youtube.com 
  O1 - Hosts: 64.15.124.170 sjc-v28.sjc.youtube.com 
  O1 - Hosts: 64.15.124.171 sjc-v29.sjc.youtube.com 
  O1 - Hosts: 64.15.124.172 sjc-v30.sjc.youtube.com 
  O1 - Hosts: 64.15.124.173 sjc-v31.sjc.youtube.com 
  O1 - Hosts: 64.15.124.174 sjc-v32.sjc.youtube.com 
  O1 - Hosts: 64.15.124.175 sjc-v33.sjc.youtube.com 
  O1 - Hosts: 64.15.124.176 sjc-v34.sjc.youtube.com 
  O1 - Hosts: 64.15.124.177 sjc-v35.sjc.youtube.com 
  O1 - Hosts: 64.15.124.178 sjc-v36.sjc.youtube.com 
  O1 - Hosts: 64.15.124.179 sjc-v37.sjc.youtube.com 
  O1 - Hosts: 64.15.124.180 sjc-v38.sjc.youtube.com 
  O1 - Hosts: 64.15.124.207 sjc-v39.sjc.youtube.com 
  O1 - Hosts: 64.15.124.208 sjc-v40.sjc.youtube.com 
  O1 - Hosts: 64.15.124.209 sjc-v41.sjc.youtube.com 
  O1 - Hosts: 64.15.124.210 sjc-v42.sjc.youtube.com 
  O1 - Hosts: 64.15.124.211 sjc-v43.sjc.youtube.com 
  O1 - Hosts: 64.15.124.212 sjc-v44.sjc.youtube.com 
  O1 - Hosts: 64.15.124.213 sjc-v45.sjc.youtube.com 
  O1 - Hosts: 64.15.124.214 sjc-v46.sjc.youtube.com 
  O1 - Hosts: 64.15.124.215 sjc-v47.sjc.youtube.com 
  O1 - Hosts: 64.15.124.216 sjc-v48.sjc.youtube.com 
  O1 - Hosts: 64.15.124.217 sjc-v49.sjc.youtube.com 
  O1 - Hosts: 64.15.124.218 sjc-v50.sjc.youtube.com 
  O1 - Hosts: 64.15.124.219 sjc-v51.sjc.youtube.com 
  O1 - Hosts: 64.15.124.220 sjc-v52.sjc.youtube.com 
  O1 - Hosts: 64.15.124.221 sjc-v53.sjc.youtube.com 
  O1 - Hosts: 64.15.124.222 sjc-v54.sjc.youtube.com 
  O1 - Hosts: 64.15.124.223 sjc-v55.sjc.youtube.com 
  O1 - Hosts: 64.15.124.224 sjc-v56.sjc.youtube.com 
  O1 - Hosts: 64.15.124.225 sjc-v57.sjc.youtube.com 
  O1 - Hosts: 64.15.124.226 sjc-v58.sjc.youtube.com 
  O1 - Hosts: 64.15.124.227 sjc-v59.sjc.youtube.com 
  O1 - Hosts: 64.15.124.228 sjc-v60.sjc.youtube.com 
  O1 - Hosts: 64.15.124.229 sjc-v61.sjc.youtube.com 
  O1 - Hosts: 64.15.124.230 sjc-v62.sjc.youtube.com 
  O1 - Hosts: 64.15.124.231 sjc-v63.sjc.youtube.com 
  O1 - Hosts: 64.15.124.232 sjc-v64.sjc.youtube.com 
  O1 - Hosts: 64.15.124.233 sjc-v65.sjc.youtube.com 
  O1 - Hosts: 64.15.124.234 sjc-v66.sjc.youtube.com 
  O1 - Hosts: 64.15.124.235 sjc-v67.sjc.youtube.com 
  O1 - Hosts: 64.15.124.236 sjc-v68.sjc.youtube.com 
  O1 - Hosts: 64.15.124.237 sjc-v69.sjc.youtube.com 
  O1 - Hosts: 64.15.124.238 sjc-v70.sjc.youtube.com 
  O1 - Hosts: 64.15.124.239 sjc-v71.sjc.youtube.com 
  O1 - Hosts: 64.15.124.240 sjc-v72.sjc.youtube.com 
  O1 - Hosts: 64.15.124.241 sjc-v73.sjc.youtube.com 
  O1 - Hosts: 64.15.124.242 sjc-v74.sjc.youtube.com 
  O1 - Hosts: 64.15.124.243 sjc-v75.sjc.youtube.com 
  O1 - Hosts: 64.15.124.244 sjc-v76.sjc.youtube.com 
  O1 - Hosts: 64.15.125.16 sjc-v77.sjc.youtube.com 
  O1 - Hosts: 64.15.125.17 sjc-v78.sjc.youtube.com 
  O1 - Hosts: 64.15.125.18 sjc-v79.sjc.youtube.com 
  O1 - Hosts: 64.15.125.19 sjc-v80.sjc.youtube.com 
  O1 - Hosts: 64.15.125.20 sjc-v81.sjc.youtube.com 
  O1 - Hosts: 64.15.125.21 sjc-v82.sjc.youtube.com 
  O1 - Hosts: 64.15.125.22 sjc-v83.sjc.youtube.com 
  O1 - Hosts: 64.15.125.23 sjc-v84.sjc.youtube.com 
  O1 - Hosts: 64.15.125.24 sjc-v85.sjc.youtube.com 
  O1 - Hosts: 64.15.125.25 sjc-v86.sjc.youtube.com 
  O1 - Hosts: 64.15.125.26 sjc-v87.sjc.youtube.com 
  O1 - Hosts: 64.15.125.27 sjc-v88.sjc.youtube.com 
  O1 - Hosts: 64.15.125.28 sjc-v89.sjc.youtube.com 
  O1 - Hosts: 64.15.125.29 sjc-v90.sjc.youtube.com 
  O1 - Hosts: 64.15.125.30 sjc-v91.sjc.youtube.com 
  O1 - Hosts: 64.15.125.31 sjc-v92.sjc.youtube.com 
  O1 - Hosts: 64.15.125.32 sjc-v93.sjc.youtube.com 
  O1 - Hosts: 64.15.125.33 sjc-v94.sjc.youtube.com 
  O1 - Hosts: 64.15.125.34 sjc-v95.sjc.youtube.com 
  O1 - Hosts: 64.15.125.35 sjc-v96.sjc.youtube.com 
  O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup 
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install 
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit 
  O4 - HKLM\..\Run: [SMSERIAL] D:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe 
  O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start 
  O4 - HKLM\..\Run: [SynTPEnh] D:\Program Files\Synaptics\SynTP\SynTPEnh.exe 
  O4 - HKLM\..\Run: [IntelliPoint] "D:\Program Files\Microsoft IntelliPoint\ipoint.exe" 
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE 
  O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray 
  O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe 
  O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background 
  O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background 
  O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot 
  O4 - Startup: Adobe Gamma.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe 
  O4 - Startup: Rainmeter.lnk = D:\Program Files\Rainmeter\Rainmeter.exe 
  O4 - Startup: Stardock ObjectDock.lnk = D:\Program Files\Stardock\ObjectDock\ObjectDock.exe 
  O4 - Global Startup: Bluetooth.lnk = ? 
  O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm 
  O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm 
  O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm 
  O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://D:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 
  O8 - Extra context menu item: Send To &Bluetooth - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm 
  O9 - Extra button: Add to VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - D:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL 
  O9 - Extra 'Tools' menuitem: Add to &VideoGet - {88CFA58B-A63F-4A94-9C54-0C7A58E3333E} - D:\PROGRA~1\NUCLEA~1\VideoGet\Plugins\VIDEOG~1.DLL 
  O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL 
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm 
  O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm 
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1259313081515 
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1259313139968 
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{C58050A0-504C-46E8-A006-C411EBA10841}: NameServer = 4.2.2.2,4.2.2.3 
  O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - D:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe 
  O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe 
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe 
  O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - D:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe 
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe 
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe 
  O23 - Service: MBAMService - Malwarebytes Corporation - D:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 
  O23 - Service: MSCSPTISRV - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe 
  O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - D:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe 
  O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - D:\WINDOWS\system32\GameMon.des.exe (file missing) 
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe 
  O23 - Service: PACSPTISVR - Unknown owner - D:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe 
  O23 - Service: SonicStage Back-End Service - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe 
  O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe 
  O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - D:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe 
   
  -- 
  End of file - 13073 bytes 
  

 
  Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 22:31:22, on 23.01.2010 
  Platform: Windows XP SP2 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v8.00 (8.00.6001.18702) 
  Boot mode: Normal 
   
  Running processes: 
  C:\WINDOWS\System32\smss.exe 
  C:\WINDOWS\system32\winlogon.exe 
  C:\WINDOWS\system32\services.exe 
  C:\WINDOWS\system32\lsass.exe 
  C:\WINDOWS\system32\nvsvc32.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe 
  C:\WINDOWS\Explorer.EXE 
  C:\WINDOWS\system32\spoolsv.exe 
  C:\WINDOWS\system32\wscntfy.exe 
  C:\WINDOWS\RTHDCPL.EXE 
  C:\Program Files\Java\jre6\bin\jusched.exe 
  C:\WINDOWS\system32\RUNDLL32.EXE 
  C:\WINDOWS\system32\ctfmon.exe 
  C:\Program Files\Messenger\msmsgs.exe 
  C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe 
  C:\Program Files\Mozilla Firefox\firefox.exe 
  C:\WINDOWS\system32\msiexec.exe 
  C:\Documents and Settings\RR\Desktop\HiJackThis.exe 
   
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://search.localstrike.com.ar/ 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://search.localstrike.com.ar/ 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://search.localstrike.com.ar/ 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://search.localstrike.com.ar/ 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://search.localstrike.com.ar/ 
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  O1 - Hosts: 208.131.134.76 www.ateizm2.org 
  O1 - Hosts: 64.132.44.149 www.pornotube.com 
  O1 - Hosts: 64.132.44.149 pornotube.com 
  O1 - Hosts: 64.132.44.148 photo.pornotube.com 
  O1 - Hosts: 64.132.47.111 video2.pornotube.com 
  O1 - Hosts: 64.132.47.109 video.pornotube.com 208.217.256.90 testtesttest.com 
  O1 - Hosts: 208.117.236.70 youtube.com 
  O1 - Hosts: 208.117.236.70 www.youtube.com 
  O1 - Hosts: 64.15.124.143 sjc-v1.sjc.youtube.com 
  O1 - Hosts: 64.15.124.144 sjc-v2.sjc.youtube.com 
  O1 - Hosts: 64.15.124.145 sjc-v3.sjc.youtube.com 
  O1 - Hosts: 64.15.124.146 sjc-v4.sjc.youtube.com 
  O1 - Hosts: 64.15.124.147 sjc-v5.sjc.youtube.com 
  O1 - Hosts: 64.15.124.148 sjc-v6.sjc.youtube.com 
  O1 - Hosts: 64.15.124.149 sjc-v7.sjc.youtube.com 
  O1 - Hosts: 64.15.124.150 sjc-v8.sjc.youtube.com 
  O1 - Hosts: 64.15.124.151 sjc-v9.sjc.youtube.com 
  O1 - Hosts: 64.15.124.152 sjc-v10.sjc.youtube.com 
  O1 - Hosts: 64.15.124.153 sjc-v11.sjc.youtube.com 
  O1 - Hosts: 64.15.124.154 sjc-v12.sjc.youtube.com 
  O1 - Hosts: 64.15.124.155 sjc-v13.sjc.youtube.com 
  O1 - Hosts: 64.15.124.156 sjc-v14.sjc.youtube.com 
  O1 - Hosts: 64.15.124.157 sjc-v15.sjc.youtube.com 
  O1 - Hosts: 64.15.124.158 sjc-v16.sjc.youtube.com 
  O1 - Hosts: 64.15.124.159 sjc-v17.sjc.youtube.com 
  O1 - Hosts: 64.15.124.160 sjc-v18.sjc.youtube.com 
  O1 - Hosts: 64.15.124.161 sjc-v19.sjc.youtube.com 
  O1 - Hosts: 64.15.124.162 sjc-v20.sjc.youtube.com 
  O1 - Hosts: 64.15.124.163 sjc-v21.sjc.youtube.com 
  O1 - Hosts: 64.15.124.164 sjc-v22.sjc.youtube.com 
  O1 - Hosts: 64.15.124.165 sjc-v23.sjc.youtube.com 
  O1 - Hosts: 64.15.124.166 sjc-v24.sjc.youtube.com 
  O1 - Hosts: 64.15.124.167 sjc-v25.sjc.youtube.com 
  O1 - Hosts: 64.15.124.168 sjc-v26.sjc.youtube.com 
  O1 - Hosts: 64.15.124.169 sjc-v27.sjc.youtube.com 
  O1 - Hosts: 64.15.124.170 sjc-v28.sjc.youtube.com 
  O1 - Hosts: 64.15.124.171 sjc-v29.sjc.youtube.com 
  O1 - Hosts: 64.15.124.172 sjc-v30.sjc.youtube.com 
  O1 - Hosts: 64.15.124.173 sjc-v31.sjc.youtube.com 
  O1 - Hosts: 64.15.124.174 sjc-v32.sjc.youtube.com 
  O1 - Hosts: 64.15.124.175 sjc-v33.sjc.youtube.com 
  O1 - Hosts: 64.15.124.176 sjc-v34.sjc.youtube.com 
  O1 - Hosts: 64.15.124.177 sjc-v35.sjc.youtube.com 
  O1 - Hosts: 64.15.124.178 sjc-v36.sjc.youtube.com 
  O1 - Hosts: 64.15.124.179 sjc-v37.sjc.youtube.com 
  O1 - Hosts: 64.15.124.180 sjc-v38.sjc.youtube.com 
  O1 - Hosts: 64.15.124.207 sjc-v39.sjc.youtube.com 
  O1 - Hosts: 64.15.124.208 sjc-v40.sjc.youtube.com 
  O1 - Hosts: 64.15.124.209 sjc-v41.sjc.youtube.com 
  O1 - Hosts: 64.15.124.210 sjc-v42.sjc.youtube.com 
  O1 - Hosts: 64.15.124.211 sjc-v43.sjc.youtube.com 
  O1 - Hosts: 64.15.124.212 sjc-v44.sjc.youtube.com 
  O1 - Hosts: 64.15.124.213 sjc-v45.sjc.youtube.com 
  O1 - Hosts: 64.15.124.214 sjc-v46.sjc.youtube.com 
  O1 - Hosts: 64.15.124.215 sjc-v47.sjc.youtube.com 
  O1 - Hosts: 64.15.124.216 sjc-v48.sjc.youtube.com 
  O1 - Hosts: 64.15.124.217 sjc-v49.sjc.youtube.com 
  O1 - Hosts: 64.15.124.218 sjc-v50.sjc.youtube.com 
  O1 - Hosts: 64.15.124.219 sjc-v51.sjc.youtube.com 
  O1 - Hosts: 64.15.124.220 sjc-v52.sjc.youtube.com 
  O1 - Hosts: 64.15.124.221 sjc-v53.sjc.youtube.com 
  O1 - Hosts: 64.15.124.222 sjc-v54.sjc.youtube.com 
  O1 - Hosts: 64.15.124.223 sjc-v55.sjc.youtube.com 
  O1 - Hosts: 64.15.124.224 sjc-v56.sjc.youtube.com 
  O1 - Hosts: 64.15.124.225 sjc-v57.sjc.youtube.com 
  O1 - Hosts: 64.15.124.226 sjc-v58.sjc.youtube.com 
  O1 - Hosts: 64.15.124.227 sjc-v59.sjc.youtube.com 
  O1 - Hosts: 64.15.124.228 sjc-v60.sjc.youtube.com 
  O1 - Hosts: 64.15.124.229 sjc-v61.sjc.youtube.com 
  O1 - Hosts: 64.15.124.230 sjc-v62.sjc.youtube.com 
  O1 - Hosts: 64.15.124.231 sjc-v63.sjc.youtube.com 
  O1 - Hosts: 64.15.124.232 sjc-v64.sjc.youtube.com 
  O1 - Hosts: 64.15.124.233 sjc-v65.sjc.youtube.com 
  O1 - Hosts: 64.15.124.234 sjc-v66.sjc.youtube.com 
  O1 - Hosts: 64.15.124.235 sjc-v67.sjc.youtube.com 
  O1 - Hosts: 64.15.124.236 sjc-v68.sjc.youtube.com 
  O1 - Hosts: 64.15.124.237 sjc-v69.sjc.youtube.com 
  O1 - Hosts: 64.15.124.238 sjc-v70.sjc.youtube.com 
  O1 - Hosts: 64.15.124.239 sjc-v71.sjc.youtube.com 
  O1 - Hosts: 64.15.124.240 sjc-v72.sjc.youtube.com 
  O1 - Hosts: 64.15.124.241 sjc-v73.sjc.youtube.com 
  O1 - Hosts: 64.15.124.242 sjc-v74.sjc.youtube.com 
  O1 - Hosts: 64.15.124.243 sjc-v75.sjc.youtube.com 
  O1 - Hosts: 64.15.124.244 sjc-v76.sjc.youtube.com 
  O1 - Hosts: 64.15.125.16 sjc-v77.sjc.youtube.com 
  O1 - Hosts: 64.15.125.17 sjc-v78.sjc.youtube.com 
  O1 - Hosts: 64.15.125.18 sjc-v79.sjc.youtube.com 
  O1 - Hosts: 64.15.125.19 sjc-v80.sjc.youtube.com 
  O1 - Hosts: 64.15.125.20 sjc-v81.sjc.youtube.com 
  O1 - Hosts: 64.15.125.21 sjc-v82.sjc.youtube.com 
  O1 - Hosts: 64.15.125.22 sjc-v83.sjc.youtube.com 
  O1 - Hosts: 64.15.125.23 sjc-v84.sjc.youtube.com 
  O1 - Hosts: 64.15.125.24 sjc-v85.sjc.youtube.com 
  O1 - Hosts: 64.15.125.25 sjc-v86.sjc.youtube.com 
  O1 - Hosts: 64.15.125.26 sjc-v87.sjc.youtube.com 
  O1 - Hosts: 64.15.125.27 sjc-v88.sjc.youtube.com 
  O1 - Hosts: 64.15.125.28 sjc-v89.sjc.youtube.com 
  O1 - Hosts: 64.15.125.29 sjc-v90.sjc.youtube.com 
  O1 - Hosts: 64.15.125.30 sjc-v91.sjc.youtube.com 
  O1 - Hosts: 64.15.125.31 sjc-v92.sjc.youtube.com 
  O1 - Hosts: 64.15.125.32 sjc-v93.sjc.youtube.com 
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE 
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE 
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" 
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet 
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup 
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit 
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe 
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background 
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background 
  O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Program Files\Common Files\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI" TRANSFORMS="C:\Program Files\Common Files\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST" WISE_SETUP_EXE_PATH="c:\nvidia\winxp\182.08\english\PhysX_9.09.0203_SystemSoftware.exe" 
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') 
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{97106968-09F7-4A2B-9569-BF0A0E4FE0D2}: NameServer = 208.67.222.222,208.67.220.220 
  O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe 
  O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe 
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe 
   
  -- 
  End of file - 9582 bytes 
  

 
  Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 10:58:24, on 1/25/2010 
  Platform: Windows XP SP3 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v7.00 (7.00.6000.20772) 
  Boot mode: Normal 
   
  Running processes: 
  C:\WINDOWS\System32\smss.exe 
  C:\WINDOWS\system32\winlogon.exe 
  C:\WINDOWS\system32\services.exe 
  C:\WINDOWS\system32\lsass.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\WINDOWS\system32\spoolsv.exe 
  C:\WINDOWS\Explorer.EXE 
  C:\WINDOWS\system32\RUNDLL32.EXE 
  C:\WINDOWS\RTHDCPL.EXE 
  C:\Program Files\D-Tools\daemon.exe 
  C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe 
  C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe 
  C:\WINDOWS\FixCamera.exe 
  C:\Program Files\Canon\MyPrinter\BJMyPrt.exe 
  C:\Program Files\Java\jre6\bin\jusched.exe 
  C:\WINDOWS\system32\ctfmon.exe 
  C:\Program Files\CursorXP\CursorXP.exe 
  C:\Program Files\DNA\btdna.exe 
  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 
  C:\Program Files\Bonjour\mDNSResponder.exe 
  C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe 
  C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE 
  C:\Program Files\Java\jre6\bin\jqs.exe 
  C:\WINDOWS\system32\nvsvc32.exe 
  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\Program Files\PC Connectivity Solution\ServiceLayer.exe 
  C:\WINDOWS\system32\wbem\wmiapsrv.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\WINDOWS\system32\defrag.exe 
  C:\Program Files\Internet Explorer\IEXPLORE.EXE 
  C:\Program Files\Windows Live\Toolbar\wltuser.exe 
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe 
  C:\Program Files\Windows Live\Contacts\wlcomm.exe 
  C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe 
   
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =http://www.mirarsearch.com/?useie5=1&q= 
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://www.mynet.com/ 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://www.yahoo.com 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =http://www.mirarsearch.com/?useie5=1&q= 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://www.yahoo.com 
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Sık Kullanılanlar 
  O1 - Hosts: Youtube Dünya Capinda IP leri toplam 2859 adet .... 
  O1 - Hosts: 208.65.153.251 uk.youtube.com 
  O1 - Hosts: 208.65.153.253 de.youtube.com 
  O1 - Hosts: 208.117.236.70 youtube.com 
  O1 - Hosts: 208.117.236.70 www.youtube.com 
  O1 - Hosts: 74.125.65.118 img.youtube.com 
  O1 - Hosts: 64.15.124.143 sjc-v1.sjc.youtube.com 
  O1 - Hosts: 64.15.124.144 sjc-v2.sjc.youtube.com 
  O1 - Hosts: 64.15.124.145 sjc-v3.sjc.youtube.com 
  O1 - Hosts: 64.15.124.146 sjc-v4.sjc.youtube.com 
  O1 - Hosts: 64.15.124.147 sjc-v5.sjc.youtube.com 
  O1 - Hosts: 64.15.124.148 sjc-v6.sjc.youtube.com 
  O1 - Hosts: 64.15.124.149 sjc-v7.sjc.youtube.com 
  O1 - Hosts: 64.15.124.150 sjc-v8.sjc.youtube.com 
  O1 - Hosts: 64.15.124.151 sjc-v9.sjc.youtube.com 
  O1 - Hosts: 64.15.124.152 sjc-v10.sjc.youtube.com 
  O1 - Hosts: 64.15.124.153 sjc-v11.sjc.youtube.com 
  O1 - Hosts: 64.15.124.154 sjc-v12.sjc.youtube.com 
  O1 - Hosts: 64.15.124.155 sjc-v13.sjc.youtube.com 
  O1 - Hosts: 64.15.124.156 sjc-v14.sjc.youtube.com 
  O1 - Hosts: 64.15.124.157 sjc-v15.sjc.youtube.com 
  O1 - Hosts: 64.15.124.158 sjc-v16.sjc.youtube.com 
  O1 - Hosts: 64.15.124.159 sjc-v17.sjc.youtube.com 
  O1 - Hosts: 64.15.124.160 sjc-v18.sjc.youtube.com 
  O1 - Hosts: 64.15.124.161 sjc-v19.sjc.youtube.com 
  O1 - Hosts: 64.15.124.162 sjc-v20.sjc.youtube.com 
  O1 - Hosts: 64.15.124.163 sjc-v21.sjc.youtube.com 
  O1 - Hosts: 64.15.124.164 sjc-v22.sjc.youtube.com 
  O1 - Hosts: 64.15.124.165 sjc-v23.sjc.youtube.com 
  O1 - Hosts: 64.15.124.166 sjc-v24.sjc.youtube.com 
  O1 - Hosts: 64.15.124.167 sjc-v25.sjc.youtube.com 
  O1 - Hosts: 64.15.124.168 sjc-v26.sjc.youtube.com 
  O1 - Hosts: 64.15.124.169 sjc-v27.sjc.youtube.com 
  O1 - Hosts: 64.15.124.170 sjc-v28.sjc.youtube.com 
  O1 - Hosts: 64.15.124.171 sjc-v29.sjc.youtube.com 
  O1 - Hosts: 64.15.124.172 sjc-v30.sjc.youtube.com 
  O1 - Hosts: 64.15.124.173 sjc-v31.sjc.youtube.com 
  O1 - Hosts: 64.15.124.174 sjc-v32.sjc.youtube.com 
  O1 - Hosts: 64.15.124.175 sjc-v33.sjc.youtube.com 
  O1 - Hosts: 64.15.124.176 sjc-v34.sjc.youtube.com 
  O1 - Hosts: 64.15.124.177 sjc-v35.sjc.youtube.com 
  O1 - Hosts: 64.15.124.178 sjc-v36.sjc.youtube.com 
  O1 - Hosts: 64.15.124.179 sjc-v37.sjc.youtube.com 
  O1 - Hosts: 64.15.124.180 sjc-v38.sjc.youtube.com 
  O1 - Hosts: 64.15.124.207 sjc-v39.sjc.youtube.com 
  O1 - Hosts: 64.15.124.208 sjc-v40.sjc.youtube.com 
  O1 - Hosts: 64.15.124.209 sjc-v41.sjc.youtube.com 
  O1 - Hosts: 64.15.124.210 sjc-v42.sjc.youtube.com 
  O1 - Hosts: 64.15.124.211 sjc-v43.sjc.youtube.com 
  O1 - Hosts: 64.15.124.212 sjc-v44.sjc.youtube.com 
  O1 - Hosts: 64.15.124.213 sjc-v45.sjc.youtube.com 
  O1 - Hosts: 64.15.124.214 sjc-v46.sjc.youtube.com 
  O1 - Hosts: 64.15.124.215 sjc-v47.sjc.youtube.com 
  O1 - Hosts: 64.15.124.216 sjc-v48.sjc.youtube.com 
  O1 - Hosts: 64.15.124.217 sjc-v49.sjc.youtube.com 
  O1 - Hosts: 64.15.124.218 sjc-v50.sjc.youtube.com 
  O1 - Hosts: 64.15.124.219 sjc-v51.sjc.youtube.com 
  O1 - Hosts: 64.15.124.220 sjc-v52.sjc.youtube.com 
  O1 - Hosts: 64.15.124.221 sjc-v53.sjc.youtube.com 
  O1 - Hosts: 64.15.124.222 sjc-v54.sjc.youtube.com 
  O1 - Hosts: 64.15.124.223 sjc-v55.sjc.youtube.com 
  O1 - Hosts: 64.15.124.224 sjc-v56.sjc.youtube.com 
  O1 - Hosts: 64.15.124.225 sjc-v57.sjc.youtube.com 
  O1 - Hosts: 64.15.124.226 sjc-v58.sjc.youtube.com 
  O1 - Hosts: 64.15.124.227 sjc-v59.sjc.youtube.com 
  O1 - Hosts: 64.15.124.228 sjc-v60.sjc.youtube.com 
  O1 - Hosts: 64.15.124.229 sjc-v61.sjc.youtube.com 
  O1 - Hosts: 64.15.124.230 sjc-v62.sjc.youtube.com 
  O1 - Hosts: 64.15.124.231 sjc-v63.sjc.youtube.com 
  O1 - Hosts: 64.15.124.232 sjc-v64.sjc.youtube.com 
  O1 - Hosts: 64.15.124.233 sjc-v65.sjc.youtube.com 
  O1 - Hosts: 64.15.124.234 sjc-v66.sjc.youtube.com 
  O1 - Hosts: 64.15.124.235 sjc-v67.sjc.youtube.com 
  O1 - Hosts: 64.15.124.236 sjc-v68.sjc.youtube.com 
  O1 - Hosts: 64.15.124.237 sjc-v69.sjc.youtube.com 
  O1 - Hosts: 64.15.124.238 sjc-v70.sjc.youtube.com 
  O1 - Hosts: 64.15.124.239 sjc-v71.sjc.youtube.com 
  O1 - Hosts: 64.15.124.240 sjc-v72.sjc.youtube.com 
  O1 - Hosts: 64.15.124.241 sjc-v73.sjc.youtube.com 
  O1 - Hosts: 64.15.124.242 sjc-v74.sjc.youtube.com 
  O1 - Hosts: 64.15.124.243 sjc-v75.sjc.youtube.com 
  O1 - Hosts: 64.15.124.244 sjc-v76.sjc.youtube.com 
  O1 - Hosts: 64.15.125.16 sjc-v77.sjc.youtube.com 
  O1 - Hosts: 64.15.125.17 sjc-v78.sjc.youtube.com 
  O1 - Hosts: 64.15.125.18 sjc-v79.sjc.youtube.com 
  O1 - Hosts: 64.15.125.19 sjc-v80.sjc.youtube.com 
  O1 - Hosts: 64.15.125.20 sjc-v81.sjc.youtube.com 
  O1 - Hosts: 64.15.125.21 sjc-v82.sjc.youtube.com 
  O1 - Hosts: 64.15.125.22 sjc-v83.sjc.youtube.com 
  O1 - Hosts: 64.15.125.23 sjc-v84.sjc.youtube.com 
  O1 - Hosts: 64.15.125.24 sjc-v85.sjc.youtube.com 
  O1 - Hosts: 64.15.125.25 sjc-v86.sjc.youtube.com 
  O1 - Hosts: 64.15.125.26 sjc-v87.sjc.youtube.com 
  O1 - Hosts: 64.15.125.27 sjc-v88.sjc.youtube.com 
  O1 - Hosts: 64.15.125.28 sjc-v89.sjc.youtube.com 
  O1 - Hosts: 64.15.125.29 sjc-v90.sjc.youtube.com 
  O1 - Hosts: 64.15.125.30 sjc-v91.sjc.youtube.com 
  O1 - Hosts: 64.15.125.31 sjc-v92.sjc.youtube.com 
  O1 - Hosts: 64.15.125.32 sjc-v93.sjc.youtube.com 
  O1 - Hosts: 64.15.125.33 sjc-v94.sjc.youtube.com 
  O1 - Hosts: 64.15.125.34 sjc-v95.sjc.youtube.com 
  O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll 
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
  O2 - BHO: EvenMoreMegaSwellAdsForYou - {EB692FE4-6873-09E0-C127-95E8BA2F94FF} - C:\Program Files\EvenMoreMegaSwellAdsForYou\EvenMoreMegaSwellAdsForYou.dll 
  O2 - BHO: Mirar - {F4249F0D-41A2-4828-AB8E-78664467D719} - C:\WINDOWS\system32\9578.dll 
  O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll 
  O3 - Toolbar: Mirar - {F4249F0C-41A2-4828-AB8E-78664467D719} - C:\WINDOWS\system32\9578.dll 
  O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll 
  O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) 
  O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll 
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup 
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install 
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit 
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE 
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE 
  O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033 
  O4 - HKLM\..\Run: [Flashget] "C:\Program Files\FlashGet\FlashGet.exe" /min 
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe 
  O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice 
  O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.EXE 
  O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup 
  O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe 
  O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe 
  O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon 
  O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon 
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime 
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
  O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" 
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
  O4 - HKCU\..\Run: [CursorXP] C:\Program Files\CursorXP\CursorXP.exe 
  O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" 
  O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" 
  O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') 
  O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') 
  O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user') 
  O8 - Extra context menu item: &FlashGet ile indir - C:\Program Files\FlashGet\jc_link.htm 
  O8 - Extra context menu item: &Tümünü FlashGet ile indir - C:\Program Files\FlashGet\jc_all.htm 
  O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 
  O9 - Extra button: Bunu Bloga Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll 
  O9 - Extra 'Tools' menuitem: Windows Live Writer içinde &Bunu Web Günlüğüne Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll 
  O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL 
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll 
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{5A10AB9F-2408-4E0A-A894-4469C3CF86B1}: NameServer = 4.2.2.0,4.2.2.1 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{693F226F-6A2F-49A3-8201-58E506D36FEA}: NameServer = 4.2.2.2,4.2.2.1 
  O17 - HKLM\System\CS1\Services\Tcpip\..\{5A10AB9F-2408-4E0A-A894-4469C3CF86B1}: NameServer = 4.2.2.0,4.2.2.1 
  O17 - HKLM\System\CS2\Services\Tcpip\..\{5A10AB9F-2408-4E0A-A894-4469C3CF86B1}: NameServer = 4.2.2.0,4.2.2.1 
  O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe 
  O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe 
  O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe 
  O23 - Service: Inkjet Printer/Scanner Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE 
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe 
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe 
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe 
   
  -- 
  End of file - 14948 bytes