DonanımHaber'de AraYENİ GELİŞMİŞ ARAMA
ForumBu Bölümde Ara
Yeni DH Portal arayüzümüz herkese açık ALFA sürümüne girmiştir, siz de bu deneyime davetlisiniz. Gizle Detaylar ve Geri Bildirim
HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+
Daha Fazla
Bu Konudaki Kullanıcılar: Daha Az
1 Misafir Kullanıcı
9.877
Cevap
20
Favori
1.195.021
Tıklama
Tüm Forumlar >> İşletim Sistemleri ve Yazılımlar >> Yazılım Genel >> Güvenlik Programları >> HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+
Sayfaya Git:
Sayfa:
Giriş
Mesaj
    • Yüzbaşı
      619 Mesaj
      03 Mayıs 2010 00:47:12
      arkadaşlar kendimde kontrol ettim ama emin olmaadım en iyi sonuç bir başkasınında incelemesi olacak ilgilenirseniz sevinirim kodları veriyorum:

      Logfile of Trend Micro HijackThis v2.0.2 
      Scan saved at 00:42:34, on 03.05.2010
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Avira\AntiVir Desktop\sched.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
      C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe
      C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
      C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      D:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
      C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\WINDOWS\system32\wbem\wmiapsrv.exe
      C:\WINDOWS\system32\wbem\unsecapp.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Windows Live\Contacts\wlcomm.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      D:\Program Files\HiJackThis.exe

      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
      http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
      http://go.microsoft.com/fwlink/?LinkId=54896&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
      http://go.microsoft.com/fwlink/?LinkId=54896&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
      O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
      O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
      O2 - BHO: SMTTB2009 - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\Splitcam Toolbar\tbcore3.dll
      O3 - Toolbar: Splitcam Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\Splitcam Toolbar\tbcore3.dll
      O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
      O4 - HKCU\..\Run: [Gadwin PrintScreen] "C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe" /nosplash
      O4 - HKCU\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
      O8 - Extra context menu item: Bütün linkleri IDM ile indir - C:\Program Files\Internet Download Manager\IEGetAll.htm
      O8 - Extra context menu item: FLV video içeriğini IDM ile indir - C:\Program Files\Internet Download Manager\IEGetVL.htm
      O8 - Extra context menu item: IDM ile indir - C:\Program Files\Internet Download Manager\IEExt.htm
      O8 - Extra context menu item: Send To &Bluetooth - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
      O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
      O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {34635AA6-B593-4F06-9EDD-5FF60FC13310} (Speaky Chat) -
      http://download.speakyweb.com/speakyldr.cab
      O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) -
      http://dlm.tools.akamai.../dlm-activex-2.2.5.0.cab
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
      http://messenger.zone.m...atsPAClient.cab56907.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{99B6B072-E7D6-44F0-87B6-E71A864FD96E}: NameServer = 8.8.8.8,8.8.4.4
      O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
      O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
      O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
      O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

      --
      End of file - 6592 bytes



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Süresiz olarak uzaklaştırıldı.
      03 Mayıs 2010 12:26:27
      @express

      Loglarınız temiz gözükmekte.



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Onbaşı
      22 Mesaj
      03 Mayıs 2010 12:56:11
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 12:37:33, on 5/3/2010
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v8.00 (8.00.6001.18702)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      C:\Program Files\Alwil Software\Avast4\ashServ.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\WINDOWS\system32\PSIService.exe
      C:\Program Files\Sygate\SPF\smc.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\PS Tray Factory\PSTrayFactory.exe
      C:\WINDOWS\system32\wbem\wmiapsrv.exe
      C:\Program Files\Microsoft IntelliType Pro\type32.exe
      C:\Program Files\Microsoft IntelliPoint\point32.exe
      C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
      C:\Program Files\Analog Devices\Core\smax4pnp.exe
      C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      C:\Program Files\Common Files\Java\Java Update\jusched.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\uTorrent\uTorrent.exe
      C:\Program Files\AIMP2\AIMP2.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\Rhinoceros 4.0\System\Rhino4.exe
      C:\Program Files\Common Files\McNeel Shared\License Manager\RhinoLM.exe
      D:\murat\Z#murat\yedek\####\HiJackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
      O1 - Hosts: 85.17.216.45www.easy-share.com easy-share.com
      O1 - Hosts: 85.17.223.193 d01.easy-share.com
      O1 - Hosts: 85.17.230.87 d02.easy-share.com
      O1 - Hosts: 94.75.223.81 d03.easy-share.com
      O1 - Hosts: 85.17.250.177 d04.easy-share.com
      O1 - Hosts: 85.17.230.66 d05.easy-share.com
      O1 - Hosts: 94.75.223.57 d06.easy-share.com
      O1 - Hosts: 94.75.232.145 d07.easy-share.com
      O1 - Hosts: 94.75.232.41 d08.easy-share.com
      O1 - Hosts: Dns 127.0.0.1 adobe 2.adobe.com
      O1 - Hosts: Dns 127.0.0.1 adobe 3.adobe.com
      O1 - Hosts: 192.121.86.15http://www.thepiratebay.org
      O1 - Hosts: 91.191.138.15 thepiratebay.org
      O1 - Hosts: 91.191.138.15www.thepiratebay.org
      O1 - Hosts: 91.191.138.18 static.thepiratebay.org
      O1 - Hosts: 91.191.138.2 eztv.tracker.thepiratebay.org vip.tracker.thepiratebay.org
      O1 - Hosts: 91.191.138.4 vtv.tracker.thepiratebay.org tv.tracker.thepiratebay.org
      O1 - Hosts: 91.191.138.5 open.tracker.thepiratebay.org tpb.tracker.thepiratebay.org
      O1 - Hosts: 91.191.138.6 a.tracker.thepiratebay.org
      O1 - Hosts: 91.191.138.8 tracker.thepiratebay.org
      O1 - Hosts: 91.191.138.19 torrents.thepiratebay.org
      O1 - Hosts: 91.191.138.17 rss.thepiratebay.org
      O1 - Hosts: 91.191.138.17 captcha.thepiratebay.org
      O1 - Hosts: 91.191.138.16 upload.thepiratebay.org
      O1 - Hosts: 194.71.107.15 thepiratebay.org
      O1 - Hosts: 194.71.107.15http://www.thepiratebay.org
      O1 - Hosts: 194.71.107.18 static.thepiratebay.org
      O1 - Hosts: 194.71.107.2 eztv.tracker.thepiratebay.org
      O1 - Hosts: 194.71.107.2 vip.tracker.thepiratebay.org
      O1 - Hosts: 194.71.107.4 vtv.tracker.thepiratebay.org
      O1 - Hosts: 194.71.107.4 tv.tracker.thepiratebay.org
      O1 - Hosts: 194.71.107.5 open.tracker.thepiratebay.org
      O1 - Hosts: 194.71.107.5 tpb.tracker.thepiratebay.org
      O1 - Hosts: 194.71.107.6 a.tracker.thepiratebay.org
      O1 - Hosts: 194.71.107.8 tracker.thepiratebay.org
      O1 - Hosts: 194.71.107.19 torrents.thepiratebay.org
      O1 - Hosts: 194.71.107.17 rss.thepiratebay.org
      O1 - Hosts: 194.71.107.17 captcha.thepiratebay.org
      O1 - Hosts: 194.71.107.16 upload.thepiratebay.org
      O1 - Hosts: 192.121.86.15 thepiratebay.org
      O1 - Hosts: 192.121.86.15www.thepiratebay.org
      O1 - Hosts: 192.121.86.18 static.thepiratebay.org
      O1 - Hosts: 192.121.86.3 open.tracker.thepiratebay.org
      O1 - Hosts: 192.121.86.2 tracker.thepiratebay.org
      O1 - Hosts: 192.121.86.3 tracker.thepiratebay.org
      O1 - Hosts: 192.121.86.4 tracker.thepiratebay.org
      O1 - Hosts: 192.121.86.5 tracker.thepiratebay.org
      O1 - Hosts: 192.121.86.6 tracker.thepiratebay.org
      O1 - Hosts: 192.121.86.7 tracker.thepiratebay.org
      O1 - Hosts: 192.121.86.8 tracker.thepiratebay.org
      O2 - BHO: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
      O2 - BHO: Adobe PDF Reader Bağı Yardımı - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
      O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
      O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
      O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
      O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
      O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
      O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
      O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
      O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
      O4 - HKLM\..\Run: [TrayFactory] C:\Program Files\PS Tray Factory\PSTrayFactory.exe /start
      O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
      O4 - HKLM\..\Run: [smss] C:\WINDOWS\security\smss.exe
      O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
      O4 - HKLM\..\Run: [PrintDisp] C:\WINDOWS\system32\PrintDisp.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
      O4 - HKLM\..\Run: [Rhino 4-5 Recent] C:\WINDOWS\recent.bat
      O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
      O4 - HKLM\..\RunServices: [Microsoft Update Machine] hydubl.exe
      O4 - HKLM\..\RunOnce: [TrayFactory] C:\Program Files\PS Tray Factory\PSTrayFactory.exe /start
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
      O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
      O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
      O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
      O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
      O8 - Extra context menu item: FlashGet'i kullanarak indir - C:\Program Files\FlashGet\jc_link.htm
      O8 - Extra context menu item: Tümünü FlashGet'i kullanarak indir - C:\Program Files\FlashGet\jc_all.htm
      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
      O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
      O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing)
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
      O15 - Trusted IP range:http://88.247.60.84
      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -http://download.bitdefe...rces/en/scan8/oscan8.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -http://www.update.micro...b_site.cab?1230967027375
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -http://www.update.micro...b_site.cab?1230966696046
      O16 - DPF: {7E866715-C9B6-4C64-AAB8-342E0D137212} (Net Client Control) -http://192.168.2.41/EDVR.CAB
      O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) -http://messenger.zone.m...nary/ZIntro.cab56649.cab
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.m...atsPAClient.cab56907.cab
      O16 - DPF: {D5D17C21-1719-4640-B0B2-4F3262419920} (JaguarEditControl-ISBANK) -https://www.isbank.com....ib/JaguarEdit4ISBv27.CAB
      O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) -http://messenger.zone.m...inary/Chess.cab57176.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{69EE3CF6-7AFA-47A5-8AFA-FD01C3AA3512}: NameServer = 8.8.8.8,8.8.4.4
      O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
      O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
      O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
      O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
      O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
      O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
      O23 - Service: McNeel Update (32-bit) (McNeelUpdates32) - Unknown owner - C:\Program Files\Rhinoceros 5.0 WIP\System\RhinoVersionCheckSvc32.exe (file missing)
      O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
      O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
      O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

      --
      End of file - 12736 bytes



      C:\WINDOWS\System32\smss.exe dosyasından kıllandım ama.....



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

      kimse eşit doğmaz.
      ama herkes eşit ölür.
      işte onun için
      ölüm, acı bir son değildir.
      hayatımızın yegane adil başlangıcı ve biricik fırsat eşitliğidir.(E.Y.)
    • Süresiz olarak uzaklaştırıldı.
      03 Mayıs 2010 15:36:20
      C:\Program Files\Rhinoceros 4.0\System\Rhino4.exe
      C:\Program Files\Common Files\McNeel Shared\License Manager\RhinoLM.exe
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
      O4 - HKLM\..\Run: [smss] C:\WINDOWS\security\smss.exe
      O4 - HKLM\..\RunServices: [Microsoft Update Machine] hydubl.exe
      O16 - DPF: {7E866715-C9B6-4C64-AAB8-342E0D137212} (Net Client Control) -http://192.168.2.41/EDVR.CAB
      O23 - Service: McNeel Update (32-bit) (McNeelUpdates32) - Unknown owner - C:\Program Files\Rhinoceros 5.0 WIP\System\RhinoVersionCheckSvc32.exe (file missing)

      Satırlarını fix'leyip.HostXpert programıyla hosts dosyanızı restore edip.Sisteminizi MalwareBytes ile taratırmısınız.Birde OpenDNS kullanırsanız yasaklı sitelere girebilirsiniz.Hosts dosyanızı hiç bir zaman değiştiricek programlar kullanmayın.



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Onbaşı
      22 Mesaj
      03 Mayıs 2010 16:19:13
      etc/host dosyasını elle değiştirdim.

      RhinoVersionCheckSvc32.exe kulladığım 3D cad yazılımının programcıklarından biri.

      satırlarını seçip fix yapacam

      8.8.8.8 & 8.8.4.4 google DNS sıkıntı yaratırmı?



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

      kimse eşit doğmaz.
      ama herkes eşit ölür.
      işte onun için
      ölüm, acı bir son değildir.
      hayatımızın yegane adil başlangıcı ve biricik fırsat eşitliğidir.(E.Y.)
    • Süresiz olarak uzaklaştırıldı.
      03 Mayıs 2010 16:26:25
      Google DNS hizmeti sıkıntı yapmaz.


      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Yarbay
      3238 Mesaj
      03 Mayıs 2010 23:41:59
      benim sonucuda bi analiz edelim lütfen.

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 23:36:38, on 03.05.2010
      Platform: Unknown Windows (WinNT 6.01.3504)
      MSIE: Internet Explorer v8.00 (8.00.7600.16385)
      Boot mode: Normal

      Running processes:
      C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
      C:\Program Files (x86)\Opera\Opera.exe
      C:\Users\Xanadu\Desktop\HiJackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      F2 - REG:system.ini: UserInit=userinit.exe
      O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
      O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
      O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
      O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
      O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'Local Service')
      O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'Local Service')
      O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
      O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
      O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000
      O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
      O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL
      O9 - Extra button: HP Smart Web Printing göster veya gizle - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
      O13 - Gopher Prefix:
      O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload2.macr...e/cabs/flash/swflash.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{AA248F22-1A0C-4C6A-8B31-3F0FF35876F6}: NameServer = 4.2.2.1,4.2.2.2
      O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
      O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
      O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
      O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
      O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
      O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
      O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
      O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
      O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
      O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
      O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
      O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
      O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
      O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
      O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
      O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
      O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
      O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
      O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
      O23 - Service: @C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe
      O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
      O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
      O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
      O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
      O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
      O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
      O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
      O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

      --
      End of file - 7451 bytes



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Yarbay
      2807 Mesaj
      04 Mayıs 2010 00:30:35
      omboFix 10-05-03.02 - ACER 03.05.2010 23:29:06.2.1 - FAT32x86
      Microsoft Windows XP Home Edition 5.1.2600.2.1254.90.1055.18.758.348 [GMT 3:00]
      Running from: c:\documents and settings\ACER\Belgelerim\Karşıdan Yüklenenler\ComboFix.exe
      .

      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      c:\program files\WindowsUpdate

      .
      ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      -------\Legacy_DAC970NT
      -------\Legacy_NVMINI
      -------\Service_dac970nt


      ((((((((((((((((((((((((( Files Created from 2010-04-03 to 2010-05-03 )))))))))))))))))))))))))))))))
      .

      2010-04-17 05:49 . 2010-04-17 05:49 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
      2010-04-17 05:49 . 2010-04-17 05:49 -------- d-----w- c:\program files\DVDVideoSoft

      .
      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2010-05-03 20:36 . 2010-03-14 19:38 5637 ----a-w- c:\windows\system32\drivers\jmdiko.sys
      2010-05-03 20:27 . 2008-11-03 14:28 3890890 ----a-w- c:\windows\setupconfig.dat
      2010-03-30 18:29 . 2009-05-24 21:28 19124 ------w- c:\windows\system32\wincab.sys
      2010-02-20 18:12 . 2006-09-29 18:31 104816 ----a-w- c:\documents and settings\ACER\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
      2008-11-03 14:28 . 2008-11-03 14:28 155648 --sha-r- c:\windows\myproc.dll
      2007-02-25 10:06 . 2009-05-24 15:59 122880 --sha-r- c:\windows\system32\blat.dll
      1997-06-23 00:00 . 1997-06-23 00:00 123664 --sha-w- c:\windows\system32\Msjint35.dll
      1997-06-23 09:06 . 1997-06-23 09:06 24848 --sha-w- c:\windows\system32\Msjter35.dll
      1997-07-21 16:30 . 1997-07-21 16:30 1045776 --sha-w- c:\windows\system32\Msjet35.dll
      1997-06-23 09:06 . 1997-06-23 09:06 252176 --sha-w- c:\windows\system32\Msrd2x35.dll
      1997-06-23 09:06 . 1997-06-23 09:06 287504 --sha-w- c:\windows\system32\Msxbse35.dll
      2008-11-03 14:28 . 2008-11-03 14:28 20480 --sha-r- c:\windows\security\services.exe
      .

      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* empty entries & legit default entries are not shown
      REGEDIT4

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "preload"="c:\windows\RUNXMLPL.exe" [2005-05-19 106496]
      "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
      "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
      "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
      "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
      "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-08-24 167936]
      "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-08-24 77824]
      "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-08-24 114688]
      "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-04 102490]
      "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-04 708698]
      "SoundMan"="SOUNDMAN.EXE" [2005-04-15 77824]
      "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 73728]
      "LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2005-07-25 73728]
      "PowerKey"="c:\program files\Launch Manager\PowerKey.exe" [2002-08-30 135168]
      "LManager"="c:\program files\Launch Manager\HotkeyApp.exe" [2005-11-08 184320]
      "CtrlVol"="c:\program files\Launch Manager\CtrlVol.exe" [2003-09-16 61440]
      "LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2005-07-25 282624]
      "Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2005-11-08 122880]
      "EPM-DM"="c:\acer\Empowering Technology\ePower\epm-dm.exe" [2005-11-10 253952]
      "Acer ePower Management"="c:\acer\Empowering Technology\ePower\Acer ePower Management.exe" [2005-11-09 3122688]
      "eRecoveryService"="c:\acer\Empowering Technology\eRecovery\Monitor.exe" [2006-01-02 438272]
      "ADMTray.exe"="c:\acer\Empowering Technology\admtray.exe" [2005-10-24 2501120]
      "eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2005-07-26 188416]
      "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 90112]
      "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_09\bin\jusched.exe" [2006-09-07 49263]
      "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 233472]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

      c:\documents and settings\All Users\Start Menu\Programlar\BaŸlang‡\
      Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 138240]
      AirTies ADSL Hizmet Program.lnk - c:\program files\AirTies\ADSL Hizmet Program\AirTies_util3.exe [2007-9-20 2886144]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
      "EnableLUA"= 0 (0x0)

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
      "DisableTaskMgr"= 1 (0x1)
      "DisableRegistryTools"= 1 (0x1)

      [HKEY_LOCAL_MACHINE\software\microsoft\security center]
      "AntiVirusOverride"=dword:00000001
      "FirewallOverride"=dword:00000001

      [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
      "AntiVirusOverride"=dword:00000001
      "AntiVirusDisableNotify"=dword:00000001
      "FirewallDisableNotify"=dword:00000001
      "FirewallOverride"=dword:00000001
      "UpdatesDisableNotify"=dword:00000001
      "UacDisableNotify"=dword:00000001

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
      "EnableFirewall"= 0 (0x0)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"=
      "c:\\Program Files\\Messenger\\msmsgs.exe"=
      "c:\\Program Files\\AirTies\\ADSL Hizmet Programı\\AirTies_util3.exe"=
      "c:\\WINDOWS\\System32\\SPOOL\\drivers\\W32X86\\3\\HP1006MC.EXE"=
      "c:\\WINDOWS\\system32\\igfxtray.exe"=
      "c:\\WINDOWS\\security\\services.exe"=
      "c:\\Windows\\RUNXMLPL.exe"=
      "c:\\WINDOWS\\system32\\NeroCheck.exe"=
      "c:\\WINDOWS\\system32\\netsh.exe"=
      "c:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"=
      "c:\\Program Files\\Launch Manager\\LaunchAp.exe"=
      "c:\\WINDOWS\\system32\\wuauclt.exe"=
      "c:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\reader_sl.exe"=
      "c:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd.exe"=
      "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
      "c:\\WINDOWS\\system32\\regsvr32.exe"=
      "c:\\Acer\\Empowering Technology\\eDataSecurity\\eDSloader.exe"=
      "c:\\Acer\\Empowering Technology\\eRecovery\\Monitor.exe"=
      "c:\\Program Files\\JetAudio\\jetAudio.exe"=
      "c:\\Program Files\\Launch Manager\\HotkeyApp.exe"=
      "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
      "c:\\WINDOWS\\system32\\igfxsrvc.exe"=
      "c:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"=

      R3 POWERKEY;POWERKEY;c:\program files\Launch Manager\POWERKEY.SYS [13.08.2006 21:33 2343]
      S1 mailKmd;mailKmd; [x]

      --- Other Services/Drivers In Memory ---

      *NewlyCreated* - DAC970NT
      *NewlyCreated* - NVMINI
      *Deregistered* - nvmini
      .
      .
      ------- Supplementary Scan -------
      .
      uStart Page = hxxp://search.babylon.com/home
      uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
      IE: &Sample Toolband Serach - c:\windows\system32\ToolBand.dll/MENUSEARCH.HTM
      IE: Microsoft Excel'e Gö&nder - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
      TCP: {076C99B3-6CD1-46CF-95C2-CE92A3C0872E} = 4.2.2.1,4.2.2.2
      FF - ProfilePath - c:\documents and settings\ACER\Application Data\Mozilla\Firefox\Profiles\yd1b3o8i.default\
      FF - prefs.js: browser.search.defaulturl - hxxp://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
      FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
      FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.tr/
      FF - plugin: c:\program files\Java\jre1.5.0_09\bin\NPJPI150_09.dll

      ---- FIREFOX POLICIES ----
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
      c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
      c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
      c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
      c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
      c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
      c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
      c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
      c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
      c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
      .
      - - - - ORPHANS REMOVED - - - -

      HKLM-Run-UnlockerAssistant - c:\program files\Unlocker\UnlockerAssistant.exe
      AddRemove-ComandoMPDDeinstKey - c:\program files\Eidos Interactive\Pyro\Commandos
      AddRemove-Der Vokabulator II - c:\progra~1\VOKABELN\UNWISE32



      **************************************************************************

      catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net
      Rootkit scan 2010-05-03 23:36
      Windows 5.1.2600 Service Pack 2 FAT NTAPI

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************

      [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nvmini]
      "ImagePath"="system32\DRIVERS\nvmini.sys"
      .
      --------------------- DLLs Loaded Under Running Processes ---------------------

      - - - - - - - > 'explorer.exe'(328)
      c:\windows\system32\MSNChatHook.dll
      c:\windows\system32\sysenv.dll
      c:\windows\system32\MSVCR71.dll
      c:\windows\system32\msi.dll
      .
      ------------------------ Other Running Processes ------------------------
      .
      c:\acer\Empowering Technology\admServ.exe
      c:\windows\System32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
      c:\windows\SOUNDMAN.EXE
      c:\program files\AirTies\ADSL Hizmet Programı\AirTies_util3.exe
      .
      **************************************************************************
      .
      Completion time: 2010-05-03 23:38:43 - machine was rebooted
      ComboFix-quarantined-files.txt 2010-05-03 20:38

      Pre-Run: 1.181.925.376 bayt boş
      Post-Run: 2.961.833.984 bayt boş

      - - End Of File - - 35551261DAA908CF61726B0B2D44F9BD

      arkadaslar benım combo fıx log sayfam şimdi ne yapmam gerkır,gorev yonetıcımın acılması için,ayrıca gızlı dosyalar da gozukmemekte...



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Süresiz olarak uzaklaştırıldı.
      04 Mayıs 2010 12:22:28
      @faust13

      Log'unuz temiz.

      @b_sevki

      Flash Disinfector programını indirin.Daha sonra tüm flash bellek,harici harddiski bilgisayarınıza takın ve programı çalıştırın.Zararlıları kendisi temizliyecektir.Görev yöneticisini açmanız içinde aşağıdaki yönergeleri takip edin.



      gpedit.msc yazıp enterlayın.



      Buradan sirayla kullanici yapilandirmasi-yonetim sablonlari-sistem-ctrl+alt+del seceneklerini isaretliyoruz.

      Burada gorev yoneticisini devre kaldir ozelliklerini tikliyoruz.3.yeri isaretliyoruz uygula tamam.

      Ayrıca Hijackthis logu vermeniz mümkünmü.Sisteminizde zararlılar bulunuyor.



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Er
      1 Mesaj
      04 Mayıs 2010 13:25:25
      Ustam. Benim problemden aldığım dosya şu şekilde benim için Maya klavyesi gibi bir şey yardımın için teşekürlerim peşinLogfile of Trend Micro HijackThis v2.0.2
      Scan saved at 13:21, on 2010-05-04
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v8.00 (8.00.6001.18702)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\System32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\AVG\AVG9\avgchsvx.exe
      C:\Program Files\AVG\AVG9\avgrsx.exe
      C:\Program Files\AVG\AVG9\avgcsrvx.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\AVANQU~1\Fix-It\mxtask.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
      C:\Program Files\Microsoft LifeCam\MSCamS32.exe
      C:\PROGRA~1\AVANQU~1\Fix-It\mxtask.exe
      C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Common Files\AntiVirus\SBAMSvc.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
      C:\Program Files\Windows Live\Contacts\wlcomm.exe
      C:\Program Files\internet explorer\iexplore.exe
      C:\Program Files\internet explorer\iexplore.exe
      C:\Program Files\internet explorer\iexplore.exe
      C:\Documents and Settings\Administrator\Desktop\HiJackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://search.conduit.c...Source=10&ctid=CT1750559
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =http://developer.intel....software/EN.htm#D102GGC2
      R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.8.0.41\coIEPlg.dll
      O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.8.0.41\IPSBHO.DLL
      O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - (no file)
      O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
      O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
      O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\coIEPlg.dll
      O3 - Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -http://go.microsoft.com/fwlink/?linkid=39204
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -http://update.microsoft...b_site.cab?1229608846187
      O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.m...atsPAClient.cab56907.cab
      O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} -http://platformdl.adobe...S/getPlusPlus/1.6/gp.cab
      O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
      O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.0.41\coIEPlg.dll
      O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
      O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
      O23 - Service: Fix-It Task Manager - Avanquest North America, Inc. - C:\PROGRA~1\AVANQU~1\Fix-It\mxtask.exe
      O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
      O23 - Service: Inkjet Printer/Scanner Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe
      O23 - Service: Sunbelt VIPRE Antivirus Service (SBAMSvc) - Sunbelt Software - C:\Program Files\Common Files\AntiVirus\SBAMSvc.exe

      --
      End of file - 6316 bytes



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

      Saygılarımla
      Celal Öztürk
    • Süresiz olarak uzaklaştırıldı.
      04 Mayıs 2010 15:09:23
      @Dinozorus

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://search.conduit.c...Source=10&ctid=CT1750559
      R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - (no file)
      O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
      O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
      O3 - Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - (no file)

      Satırlarını fix'lermisiniz.Ayrıca MalwareBytes ile sisteminizi komple taratırmısınız.



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Er
      10 Mesaj
      04 Mayıs 2010 16:24:11
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 16:20:32, on 04.05.2010
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.17023)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
      C:\WINDOWS\RTHDCPL.EXE
      C:\windows\system32\wuaucldt.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Internet Download Manager\IDMan.exe
      C:\WINDOWS\ATKKBService.exe
      C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
      C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Internet Download Manager\IEMonitor.exe
      C:\WINDOWS\system32\wbem\wmiapsrv.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Windows Live\Toolbar\wltuser.exe
      C:\Documents and Settings\erdem\Desktop\HiJackThis.exe

      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://gooogla.net/seek.htm
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
      R3 - URLSearchHook: Gecekondu.org Toolbar - {a17d37b8-3768-4afb-a7b6-51d021abf32b} - C:\Program Files\Gecekondu.org\tbGec1.dll
      O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
      O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
      O2 - BHO: Gecekondu.org Toolbar - {a17d37b8-3768-4afb-a7b6-51d021abf32b} - C:\Program Files\Gecekondu.org\tbGec1.dll
      O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O3 - Toolbar: Gecekondu.org Toolbar - {a17d37b8-3768-4afb-a7b6-51d021abf32b} - C:\Program Files\Gecekondu.org\tbGec1.dll
      O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
      O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
      O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [syncman] c:\windows\system32\wuaucldt.exe
      O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
      O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
      O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [syncman] c:\documents and settings\erdem\wuaucldt.exe
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
      O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
      O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
      O9 - Extra button: Bunu Bloga Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: Windows Live Writer içinde &Bunu Web Günlüğüne Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: OneNote'a Gönder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra 'Tools' menuitem: OneNote'a G&önder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) -http://lads.myspace.com...oad/MySpaceUploader2.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{03F18FA7-E4AC-4687-AF67-1C3AD28B45A2}: NameServer = 208.67.222.222,208.67.220.220
      O17 - HKLM\System\CCS\Services\Tcpip\..\{09EC2516-233B-4DCD-8C5A-1E51723125E7}: NameServer = 208.67.222.222,208.67.220.220
      O17 - HKLM\System\CCS\Services\Tcpip\..\{4F48EEF4-C8DB-4C59-80E8-D1EE8582BC8A}: NameServer = 208.67.222.222,208.67.220.220
      O17 - HKLM\System\CS1\Services\Tcpip\..\{03F18FA7-E4AC-4687-AF67-1C3AD28B45A2}: NameServer = 208.67.222.222,208.67.220.220
      O17 - HKLM\System\CS2\Services\Tcpip\..\{03F18FA7-E4AC-4687-AF67-1C3AD28B45A2}: NameServer = 208.67.222.222,208.67.220.220
      O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
      O20 - AppInit_DLLs:
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
      O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
      O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
      O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
      O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
      O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

      --
      End of file - 8706 bytes



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Er
      10 Mesaj
      04 Mayıs 2010 16:26:18
      inş. sayenızde kurtulacam bu vırusten yoksa pc yı kıracam ilgilerınıze cok tesekkur ederım gercekten ılk defa bı sıte bu kadar yardımcı olundugunu gordum sagolun
      SAYGILAR...!



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Yarbay
      3238 Mesaj
      04 Mayıs 2010 17:11:48
      cevap için teşekkürler
      kolay gelsin



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Süresiz olarak uzaklaştırıldı.
      04 Mayıs 2010 17:15:12
      @erdem0618

      İlk önce Program Ekle/Kaldır'dan Ask Toolbar'ı kaldırın.Daha sonra aşağıdaki satırları fix'leyiniz.

      C:\windows\system32\wuaucldt.exe
      R3 - URLSearchHook: Gecekondu.org Toolbar - {a17d37b8-3768-4afb-a7b6-51d021abf32b} - C:\Program Files\Gecekondu.org\tbGec1.dll
      O2 - BHO: Gecekondu.org Toolbar - {a17d37b8-3768-4afb-a7b6-51d021abf32b} - C:\Program Files\Gecekondu.org\tbGec1.dll
      O3 - Toolbar: Gecekondu.org Toolbar - {a17d37b8-3768-4afb-a7b6-51d021abf32b} - C:\Program Files\Gecekondu.org\tbGec1.dll
      O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
      O4 - HKCU\..\Run: [syncman] c:\documents and settings\erdem\wuaucldt.exe
      O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) -http://lads.myspace.com...oad/MySpaceUploader2.cab
      O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe

      Daha sonra sisteminizi MalwareBytes ile taratırmısınız.

      @faust13

      Ben teşekkür ederim.



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Yüzbaşı
      429 Mesaj
      04 Mayıs 2010 19:02:16
      Siteden kontrol ettiğimde bir tanesinin üzerinde kırmızı çarpı işareti var ama

      Logfile of Trend Micro HijackThis v2.0.2 
      Scan saved at 19:00:43, on 04.05.2010
      Platform: Unknown Windows (WinNT 6.01.3504)
      MSIE: Internet Explorer v8.00 (8.00.7600.16385)
      Boot mode: Normal

      Running processes:
      C:\windows\system32\taskhost.exe
      C:\windows\system32\Dwm.exe
      C:\windows\Explorer.EXE
      C:\windows\system32\taskeng.exe
      C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
      C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
      C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
      C:\Program Files\ESET\ESET Smart Security\egui.exe
      C:\Program Files\DU Meter\DUMeter.exe
      C:\Program Files\Internet Download Manager\IDMan.exe
      C:\Program Files\Internet Download Manager\IEMonitor.exe
      C:\windows\system32\taskhost.exe
      C:\Program Files\Windows Live\Messenger\msnmsgr.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe
      C:\Program Files\Windows Live\Contacts\wlcomm.exe
      C:\Users\M\Documents\Downloads\Programs\HiJackThis.exe
      C:\windows\system32\SearchFilterHost.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
      http://go.microsoft.com/fwlink/?LinkId=54896&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=54896&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=54896&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
      http://go.microsoft.com/fwlink/?LinkId=69157&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
      http://go.microsoft.com/fwlink/?LinkId=54896&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=54896&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=54896&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
      http://go.microsoft.com/fwlink/?LinkId=54896&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=54896&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=54896&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
      http://go.microsoft.com/fwlink/?LinkId=69157&utm_campaign=DonanimHaber&utm_medium=referral&utm_source=DonanimHaber">
      http://go.microsoft.com/fwlink/?LinkId=69157
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
      O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
      O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
      O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - (no file)
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
      O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
      O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - (no file)
      O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
      O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
      O4 - HKCU\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
      O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'Local Service')
      O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'Local Service')
      O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
      O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
      O8 - Extra context menu item: Bütün linkleri IDM ile indir - C:\Program Files\Internet Download Manager\IEGetAll.htm
      O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
      O8 - Extra context menu item: FLV video içeriğini IDM ile indir - C:\Program Files\Internet Download Manager\IEGetVL.htm
      O8 - Extra context menu item: Görüntüyü &Bluetooth Aygıtına Gönder... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
      O8 - Extra context menu item: IDM ile indir - C:\Program Files\Internet Download Manager\IEExt.htm
      O8 - Extra context menu item: Sayfayı &Bluetooth Aygıtına Gönder... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
      O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
      O9 - Extra button: Bunu Bloga Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: Windows Live Writer içinde &Bunu Web Günlüğüne Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
      O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
      O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
      O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
      O9 - Extra button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
      O9 - Extra 'Tools' menuitem: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
      O9 - Extra button: HP Smart Web Printing göster veya gizle - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
      O13 - Gopher Prefix:
      O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)
      O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
      O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
      O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - LSI Corporation - C:\Program Files\LSI SoftModem\agrsmsvc.exe
      O23 - Service: AMD External Events Utility - AMD - C:\windows\system32\atiesrxx.exe
      O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
      O23 - Service: DU Meter Service (DUMeterSvc) - Hagel Technologies Ltd - C:\Program Files\DU Meter\DUMeterSvc.exe
      O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
      O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
      O23 - Service: Google Güncelleme Hizmeti (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
      O23 - Service: Rezip - Unknown owner - C:\windows\SYSTEM32\Rezip.exe
      O23 - Service: TeamViewer 5 (TeamViewer5) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe

      --
      End of file - 7413 bytes



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Süresiz olarak uzaklaştırıldı.
      04 Mayıs 2010 19:18:36
      @iyinin kötüsü

      O23 - Service: Rezip - Unknown owner - C:\windows\SYSTEM32\Rezip.exe
      O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - (no file)
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - (no file)
      O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)

      Satırlarını fix'leyip MalwareBytes ile komple sisteminizi taratırmısınız.



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Er
      10 Mesaj
      04 Mayıs 2010 19:28:33
      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 16:20:32, on 04.05.2010
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.17023)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\system32\Ati2evxx.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\WINDOWS\system32\rundll32.exe
      C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
      C:\WINDOWS\RTHDCPL.EXE
      C:\windows\system32\wuaucldt.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Internet Download Manager\IDMan.exe
      C:\WINDOWS\ATKKBService.exe
      C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
      C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Internet Download Manager\IEMonitor.exe
      C:\WINDOWS\system32\wbem\wmiapsrv.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Windows Live\Toolbar\wltuser.exe
      C:\Documents and Settings\erdem\Desktop\HiJackThis.exe

      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://gooogla.net/seek.htm
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar
      R3 - URLSearchHook: Gecekondu.org Toolbar - {a17d37b8-3768-4afb-a7b6-51d021abf32b} - C:\Program Files\Gecekondu.org\tbGec1.dll
      O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
      O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
      O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
      O2 - BHO: Gecekondu.org Toolbar - {a17d37b8-3768-4afb-a7b6-51d021abf32b} - C:\Program Files\Gecekondu.org\tbGec1.dll
      O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
      O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
      O3 - Toolbar: Gecekondu.org Toolbar - {a17d37b8-3768-4afb-a7b6-51d021abf32b} - C:\Program Files\Gecekondu.org\tbGec1.dll
      O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
      O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
      O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [syncman] c:\windows\system32\wuaucldt.exe
      O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
      O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
      O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
      O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
      O4 - HKCU\..\Run: [syncman] c:\documents and settings\erdem\wuaucldt.exe
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
      O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
      O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
      O9 - Extra button: Bunu Bloga Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra 'Tools' menuitem: Windows Live Writer içinde &Bunu Web Günlüğüne Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
      O9 - Extra button: OneNote'a Gönder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra 'Tools' menuitem: OneNote'a G&önder - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) -http://lads.myspace.com...oad/MySpaceUploader2.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{03F18FA7-E4AC-4687-AF67-1C3AD28B45A2}: NameServer = 208.67.222.222,208.67.220.220
      O17 - HKLM\System\CCS\Services\Tcpip\..\{09EC2516-233B-4DCD-8C5A-1E51723125E7}: NameServer = 208.67.222.222,208.67.220.220
      O17 - HKLM\System\CCS\Services\Tcpip\..\{4F48EEF4-C8DB-4C59-80E8-D1EE8582BC8A}: NameServer = 208.67.222.222,208.67.220.220
      O17 - HKLM\System\CS1\Services\Tcpip\..\{03F18FA7-E4AC-4687-AF67-1C3AD28B45A2}: NameServer = 208.67.222.222,208.67.220.220
      O17 - HKLM\System\CS2\Services\Tcpip\..\{03F18FA7-E4AC-4687-AF67-1C3AD28B45A2}: NameServer = 208.67.222.222,208.67.220.220
      O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
      O20 - AppInit_DLLs:
      O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
      O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
      O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
      O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
      O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
      O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
      O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
      O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

      --



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Süresiz olarak uzaklaştırıldı.
      04 Mayıs 2010 19:43:24
      @erdem0618

      Yukarıda ne yapmanız gerektiğini belirttim.



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

    • Yüzbaşı
      429 Mesaj
      04 Mayıs 2010 21:11:52
      quote:

      Orijinalden alıntı: Eraybar

      @iyinin kötüsü

      O23 - Service: Rezip - Unknown owner - C:\windows\SYSTEM32\Rezip.exe
      O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - (no file)
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - (no file)
      O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)

      Satırlarını fix'leyip MalwareBytes ile komple sisteminizi taratırmısınız.


      Dediklerinizi yaptım. 2 tane trojan downloader bulup sildi. Ayrıca görev yöneticisinden baktığımda rezip görünmüyor artık. Normalde 30mb ram yiyordu.

      Teşekkür ederim.



      < Bu mesaj bir yönetici tarafından değiştirilmiştir >
      |
      |
      _____________________________

Reklamlar
- x
Bildirim
mesajınız kopyalandı (ctrl+v) yapıştırmak istediğiniz yere yapıştırabilirsiniz.