folder Tahribat.com Forumları
linefolder Virüs - Trojan - Keylogger - BotNet
linefolder Pcye Bulaşan Lanet Virüsü Silme Öneriniz?



Pcye Bulaşan Lanet Virüsü Silme Öneriniz?

  1. KısayolKısayol reportŞikayet pmÖzel Mesaj
    canerator
    canerator's avatar
    Kayıt Tarihi: 14/Haziran/2006
    Erkek

    Olay şöyle 2 gün önce pc aşırı yavaşladı hiçbişey açık olmadığı halde birden 2gb ram ve %80 cpu kullanmaya başladı,bende vardır bişe die bilgilerimi harici bi harddiske yedekledim ve format attıktan sonra geri aldım.Tekrar aynı problem baş gösterdi ve o harici belleği kullanan arkadaşımın bilgisayarındada aynı olay açığa çıktı.İlk başta Kaspersky internet security 2010 vardı tam tarama yaptım bişey çıkmadı,formattan sonra Kaspersky Pure yükledim gene bişe çıkmadı,kısaca kaspersky ı atlatıo bu virüs veya herneyse

    Bunu hangi programlarla tespit edebilirim önerileriniz varmı?

    Not:Görev yöneticisine baktım cpu u sömüren bişey gözükmüor.Ağ iletişimindede birşey gözükmüyor.

  2. KısayolKısayol reportŞikayet pmÖzel Mesaj
    Chip
    Chip's avatar
    Kayıt Tarihi: 13/Eylül/2007
    Erkek

    hijackthis raporunu buraya kopyalarmısın.

  3. KısayolKısayol reportŞikayet pmÖzel Mesaj
    canerator
    canerator's avatar
    Kayıt Tarihi: 14/Haziran/2006
    Erkek

    Saol ilgilendiğin için.Şu an pc normal farkedermi bilmiorm.

     

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 14:19:57, on 30.05.2010
    Platform: Windows 7  (WinNT 6.00.3504)
    MSIE: Internet Explorer v8.00 (8.00.7600.16385)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Apoint2K\ApMsgFwd.exe
    C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Windows\system32\conhost.exe
    C:\Program Files\DAEMON Tools Lite\DTLite.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtblfs.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Users\caner\Desktop\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\ievkbd.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MIF5BA~1\Office12\GR469A~1.DLL
    O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
    O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe"
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
    O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MIF5BA~1\Office12\EXCEL.EXE/3000
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MIF5BA~1\Office12\ONBttnIE.dll
    O9 - Extra button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIF5BA~1\Office12\REFIEBAR.DLL
    O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky PURE\klwtbbho.dll
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2bd1fd81-ef1d-49b7-abc0-a019be5f2ebf}: NameServer = 92.63.15.3
    O17 - HKLM\System\CS1\Services\Tcpip\..\{2bd1fd81-ef1d-49b7-abc0-a019be5f2ebf}: NameServer = 92.63.15.3
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MIF5BA~1\Office12\GRA32A~1.DLL
    O23 - Service: Kaspersky PURE (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky PURE\avp.exe
    O23 - Service: CryptoStorage control service (CSObjectsSrv) - Infowatch - C:\Program Files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

    --
    End of file - 6240 bytes

  4. KısayolKısayol reportŞikayet pmÖzel Mesaj
    carnager
    carnager's avatar
    Kayıt Tarihi: 27/Ağustos/2009
    Erkek

    ordaki programın biçoğu boşa çalışıyo, bilmediklerini işaretleyip fix checked yap, bide combofix le bi tarattır bakalım..


    EVERY MAN DIES, NOT EVERY MAN REALLY LIVES ...
  5. KısayolKısayol reportŞikayet pmÖzel Mesaj
    Chip
    Chip's avatar
    Kayıt Tarihi: 13/Eylül/2007
    Erkek

    log temiz gözüküyor.

  6. KısayolKısayol reportŞikayet pmÖzel Mesaj
    sanacasta
    sanacasta's avatar
    Kayıt Tarihi: 01/Ağustos/2003
    Erkek

    comodo yükle. virüsten kaynaklı birşeyse sorununu çözmede yardımcı olacaktır.


    https://twitter.com/ElliotticianRB
  7. KısayolKısayol reportŞikayet pmÖzel Mesaj
    Asker
    Asker's avatar
    Banlanmış Üye
    Kayıt Tarihi: 02/Ekim/2005
    Erkek

    anti virüs olarak şiddetle gdata öneriyorum trial resetle 1 senedir kullanıyorum

  8. KısayolKısayol reportŞikayet pmÖzel Mesaj
    anarsistherif
    anarsistherif's avatar
    Kayıt Tarihi: 27/Ağustos/2009
    Erkek

    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\SearchFilterHost.exe
    Şu dosyaları bir virustotalde tarat. 
    Ayrıca windows7de görev yöneticisinde sol alt köşede bir tık olur tüm işlemleri göster diye. ona tıklarsan cpu harcayan şeyi görürsün. Belki kaspersky kastırıyordur? :D


    =)
  9. KısayolKısayol reportŞikayet pmÖzel Mesaj
    canerator
    canerator's avatar
    Kayıt Tarihi: 14/Haziran/2006
    Erkek

    Buda combofix

    ComboFix 10-05-30.08 - caner 30.05.2010  15:22:33.1.2 - x86
    Microsoft Windows 7 Ultimate   6.1.7600.0.1254.90.1033.18.3062.2251 [GMT -7:00]
    Running from: c:\users\caner\Desktop\ComboFix.exe
    .

    (((((((((((((((((((((((((   Files Created from 2010-04-28 to 2010-05-30  )))))))))))))))))))))))))))))))
    .

    2010-05-30 22:29 . 2010-05-30 22:29    --------    d-----w-    c:\users\Default\AppData\Local\temp
    2010-05-30 01:39 . 2010-05-30 01:39    --------    d-----w-    c:\program files\QuickTime
    2010-05-30 01:39 . 2010-05-30 01:39    --------    d-----w-    c:\programdata\Apple Computer
    2010-05-30 01:38 . 2010-05-30 01:38    --------    d-----w-    c:\program files\Common Files\Apple
    2010-05-30 01:37 . 2010-05-30 01:37    --------    d-----w-    c:\users\caner\AppData\Local\Apple
    2010-05-30 01:37 . 2010-05-30 01:37    --------    d-----w-    c:\program files\Apple Software Update
    2010-05-30 01:37 . 2010-05-30 01:37    --------    d-----w-    c:\programdata\Apple
    2010-05-29 23:10 . 2010-05-29 23:19    21840    ----atw-    c:\windows\system32\SIntfNT.dll
    2010-05-29 23:10 . 2010-05-29 23:19    17212    ----atw-    c:\windows\system32\SIntf32.dll
    2010-05-29 23:10 . 2010-05-29 23:19    12067    ----atw-    c:\windows\system32\SIntf16.dll
    2010-05-29 22:54 . 2010-05-29 22:54    --------    d-----w-    c:\program files\online-mir.org.ua
    2010-05-29 22:45 . 2010-05-29 22:51    34866    ----a-w-    c:\windows\DIIUnin.dat
    2010-05-29 22:45 . 2010-05-29 22:45    94208    ----a-w-    c:\windows\DIIUnin.exe
    2010-05-29 22:45 . 2010-05-29 22:45    2829    ----a-w-    c:\windows\DIIUnin.pif
    2010-05-29 22:42 . 2010-05-29 23:03    --------    d-----w-    c:\program files\Diablo II
    2010-05-29 22:25 . 2006-10-27 02:56    33104    ----a-w-    c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
    2010-05-29 22:25 . 2006-10-27 02:56    32592    ----a-w-    c:\windows\system32\msonpmon.dll
    2010-05-29 22:23 . 2010-05-29 22:23    --------    d-----w-    c:\program files\Microsoft Works
    2010-05-29 22:22 . 2010-05-29 22:22    --------    d-----w-    c:\program files\Microsoft.NET
    2010-05-29 22:20 . 2010-05-29 22:20    --------    d-----w-    c:\program files\Microsoft Visual Studio 8
    2010-05-29 22:19 . 2010-05-29 22:19    --------    d-----w-    c:\users\caner\AppData\Local\Microsoft Help
    2010-05-29 22:19 . 2010-05-29 22:25    --------    d-----w-    c:\programdata\Microsoft Help
    2010-05-29 22:18 . 2010-05-29 22:18    --------    d-----r-    C:\MSOCache
    2010-05-29 13:42 . 2010-05-29 13:42    --------    d-----w-    C:\Backup
    2010-05-29 01:09 . 2010-05-30 22:15    --------    d-----w-    c:\program files\sXe Injected
    2010-05-29 00:36 . 2010-05-29 00:36    --------    d-----w-    c:\program files\EA GAMES
    2010-05-29 00:36 . 2005-05-26 22:34    2297552    ----a-w-    c:\windows\system32\d3dx9_26.dll
    2010-05-29 00:30 . 2010-05-30 21:34    --------    d-----w-    c:\program files\Valve
    2010-05-29 00:30 . 2010-05-29 00:30    --------    d--h--w-    c:\program files\InstallShield Installation Information
    2010-05-29 00:29 . 2010-05-29 00:29    --------    d-----w-    c:\program files\Common Files\InstallShield
    2010-05-28 23:31 . 2010-05-30 05:18    --------    d-----w-    c:\programdata\FLEXnet
    2010-05-28 23:28 . 2010-05-28 23:29    --------    d-----w-    c:\program files\Nero
    2010-05-28 23:28 . 2010-05-28 23:28    --------    d-----w-    c:\programdata\Nero
    2010-05-28 23:28 . 2010-05-28 23:28    --------    d-----w-    c:\program files\Common Files\Nero
    2010-05-28 23:24 . 2010-05-28 23:24    --------    d-----w-    c:\program files\Common Files\Macrovision Shared
    2010-05-28 23:13 . 2010-05-28 23:13    932368    ----a-w-    c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\profiles-1-6.dll
    2010-05-28 23:13 . 2010-05-28 23:13    678416    ----a-w-    c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\content_interpreter-1-1.dll
    2010-05-28 23:13 . 2010-05-28 23:13    604688    ----a-w-    c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\gsg-3-9.dll
    2010-05-28 23:13 . 2010-05-28 23:13    522768    ----a-w-    c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\database-1-5.dll
    2010-05-28 23:13 . 2010-05-28 23:13    1096208    ----a-w-    c:\programdata\Kaspersky Lab\AVP9\Data\KasFlt\Plugins\filtration-4-6.dll
    2010-05-28 23:04 . 2010-05-28 23:13    97549    ----a-w-    c:\windows\system32\drivers\klick.dat
    2010-05-28 23:04 . 2010-05-28 23:13    113933    ----a-w-    c:\windows\system32\drivers\klin.dat
    2010-05-28 23:04 . 2009-12-14 19:44    88632    ----a-w-    c:\windows\system32\drivers\CSCrySec.sys
    2010-05-28 23:04 . 2009-12-14 19:44    39352    ----a-w-    c:\windows\system32\drivers\CSVirtualDiskDrv.sys
    2010-05-28 23:04 . 2010-05-28 23:04    --------    dc----w-    c:\windows\system32\DRVSTORE
    2010-05-28 23:04 . 2010-05-30 22:18    --------    d-----w-    c:\programdata\Kaspersky Lab
    2010-05-28 23:04 . 2010-05-28 23:04    --------    d-----w-    c:\program files\Kaspersky Lab
    2010-05-28 23:04 . 2010-05-28 23:04    --------    d-----w-    c:\program files\Common Files\InfoWatch
    2010-05-28 23:02 . 2010-05-28 23:02    --------    d-----w-    c:\programdata\Kaspersky Lab Setup Files
    2010-05-28 22:23 . 2010-05-28 22:23    691696    ----a-w-    c:\windows\system32\drivers\sptd.sys
    2010-05-28 22:22 . 2010-05-28 22:23    --------    d-----w-    c:\program files\DAEMON Tools Lite
    2010-05-28 22:22 . 2010-05-29 00:05    --------    d-----w-    c:\users\caner\AppData\Roaming\DAEMON Tools Lite
    2010-05-28 22:22 . 2010-05-28 22:22    --------    d-----w-    c:\programdata\DAEMON Tools Lite
    2010-05-28 22:19 . 2010-05-28 22:19    --------    d-----w-    c:\program files\uTorrent
    2010-05-28 22:18 . 2010-05-29 01:01    --------    d-----w-    c:\users\caner\AppData\Roaming\uTorrent
    2010-05-28 22:11 . 2010-05-28 23:11    --------    d-----w-    C:\Dosyalarım
    2010-05-28 22:07 . 2010-05-28 22:07    --------    d-----w-    c:\users\caner\AppData\Roaming\Media Player Classic
    2010-05-28 21:42 . 2010-03-15 09:31    165376    ----a-w-    c:\windows\system32\unrar.dll
    2010-05-28 21:42 . 2010-05-27 08:00    108032    ----a-w-    c:\windows\system32\ff_vfw.dll
    2010-05-28 21:42 . 2009-05-29 21:37    205824    ----a-w-    c:\windows\system32\xvidvfw.dll
    2010-05-28 21:42 . 2009-05-29 21:31    881664    ----a-w-    c:\windows\system32\xvidcore.dll
    2010-05-28 21:42 . 2004-01-25 16:18    217088    ----a-w-    c:\windows\system32\yv12vfw.dll
    2010-05-28 21:42 . 2010-05-28 21:43    --------    d-----w-    c:\program files\K-Lite Codec Pack
    2010-05-28 21:23 . 2010-05-28 23:39    --------    d-----w-    c:\program files\Common Files\Adobe
    2010-05-28 21:23 . 2009-09-05 00:29    1892184    ----a-w-    c:\windows\system32\D3DX9_42.dll
    2010-05-28 21:23 . 2006-09-28 23:05    2414360    ----a-w-    c:\windows\system32\d3dx9_31.dll
    2010-05-28 21:23 . 2010-05-28 21:23    --------    d-----w-    c:\program files\Common Files\PX Storage Engine
    2010-05-28 21:23 . 2010-05-28 22:07    --------    d-----w-    c:\users\caner\AppData\Roaming\Winamp
    2010-05-28 21:23 . 2010-05-28 21:25    --------    d-----w-    c:\program files\Winamp
    2010-05-28 21:22 . 2010-02-01 01:45    38784    ----a-w-    c:\users\caner\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
    2010-05-28 21:22 . 2010-05-28 21:22    --------    d-----w-    c:\program files\Common Files\Adobe AIR
    2010-05-28 21:22 . 2010-02-01 01:45    38784    ----a-w-    c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
    2010-05-28 21:21 . 2010-05-28 23:31    --------    d-----w-    c:\users\caner\AppData\Local\Adobe
    2010-05-28 21:21 . 2010-05-28 21:21    86016    ----a-w-    c:\programdata\NOS\Adobe_Downloads\arh.exe
    2010-05-28 21:18 . 2010-05-28 22:59    --------    d-----w-    c:\programdata\NOS
    2010-05-28 21:16 . 2010-05-28 21:16    --------    d-----w-    c:\program files\Common Files\Java
    2010-05-28 21:15 . 2010-05-28 21:15    411368    ----a-w-    c:\windows\system32\deployJava1.dll
    2010-05-28 21:15 . 2010-05-28 21:15    --------    d-----w-    c:\program files\Java
    2010-05-28 21:13 . 2010-05-28 21:31    --------    d-----w-    c:\programdata\Messenger Plus!
    2010-05-28 21:10 . 2010-05-28 21:10    --------    d-----w-    c:\program files\Messenger Plus! Live
    2010-05-28 21:00 . 2010-05-28 21:00    0    ----a-w-    c:\windows\nsreg.dat
    2010-05-28 21:00 . 2010-05-28 21:00    --------    d-----w-    c:\users\caner\AppData\Local\Mozilla
    2010-05-28 20:51 . 2010-05-28 19:59    --------    d-----w-    c:\windows\Panther
    2010-05-28 20:46 . 2010-05-28 20:46    --------    d-----w-    c:\windows\system32\Lang
    2010-05-28 20:46 . 2009-09-23 18:50    398336    ----a-w-    c:\windows\system32\TVWizudlg.exe
    2010-05-28 20:46 . 2009-09-23 18:49    140288    ----a-w-    c:\windows\system32\igfxtvcx.dll
    2010-05-28 20:46 . 2010-05-28 20:46    --------    d-----w-    c:\program files\Intel
    2010-05-28 20:45 . 2010-05-30 22:26    611520    ----a-w-    c:\windows\system32\perfh01F.dat
    2010-05-28 20:45 . 2010-05-30 22:26    118916    ----a-w-    c:\windows\system32\perfc01F.dat
    2010-05-28 20:45 . 2010-05-28 20:39    37160    ----a-w-    c:\windows\system32\perfd01F.dat
    2010-05-28 20:45 . 2010-05-28 20:39    285034    ----a-w-    c:\windows\system32\perfi01F.dat
    2010-05-28 20:43 . 2010-05-28 20:43    --------    d-----w-    c:\windows\tr-TR
    2010-05-28 20:42 . 2010-05-28 20:42    --------    d-----w-    c:\windows\system32\XPSViewer
    2010-05-28 20:42 . 2010-05-28 20:42    --------    d-----w-    c:\windows\system32\tr
    2010-05-28 20:42 . 2010-05-28 20:42    --------    d-----w-    c:\windows\system32\wbem\tr-TR
    2010-05-28 20:42 . 2010-05-28 20:42    --------    d-----w-    c:\windows\system32\Spool\prtprocs\w32x86\tr-TR
    2010-05-28 20:42 . 2010-05-28 20:42    --------    d-----w-    c:\windows\system32\Wat
    2010-05-28 20:35 . 2010-05-28 20:35    --------    d-----w-    c:\program files\Apoint2K
    2010-05-28 20:34 . 2010-05-28 20:34    --------    d-----w-    c:\windows\system32\x64
    2010-05-28 20:34 . 2009-09-24 02:30    1002008    ----a-w-    c:\windows\system32\igxpun.exe
    2010-05-28 20:33 . 2010-05-28 20:34    --------    d-----w-    c:\program files\CONEXANT
    2010-05-28 20:33 . 2010-05-28 20:33    --------    d-----w-    c:\program files\Microsoft Silverlight
    2010-05-28 20:22 . 2010-03-04 07:33    740864    ----a-w-    c:\windows\system32\inetcomm.dll
    2010-05-28 20:20 . 2009-12-29 06:55    172032    ----a-w-    c:\windows\system32\wintrust.dll
    2010-05-28 20:20 . 2010-01-09 06:52    132608    ----a-w-    c:\windows\system32\cabview.dll
    2010-05-28 20:19 . 2010-05-21 21:14    221568    ------w-    c:\windows\system32\MpSigStub.exe
    2010-05-28 20:17 . 2010-05-30 22:19    --------    d-----w-    c:\users\caner\Tracing
    2010-05-28 20:16 . 2006-11-29 20:06    3426072    ----a-w-    c:\windows\system32\d3dx9_32.dll
    2010-05-28 20:16 . 2010-05-28 20:16    --------    d-----w-    c:\program files\Microsoft SQL Server Compact Edition
    2010-05-28 20:16 . 2010-05-28 20:16    --------    d-----w-    c:\program files\Microsoft
    2010-05-28 20:15 . 2010-05-28 20:15    --------    d-----w-    c:\program files\Windows Live SkyDrive
    2010-05-28 20:15 . 2010-05-28 20:17    --------    d-----w-    c:\program files\Windows Live
    2010-05-28 20:15 . 2010-05-28 20:15    --------    d-----w-    c:\windows\PCHEALTH
    2010-05-28 20:15 . 2010-05-30 01:39    --------    d-sh--w-    c:\windows\Installer
    2010-05-28 20:12 . 2010-05-28 20:12    --------    d-----w-    c:\windows\system32\Macromed
    2010-05-28 20:09 . 2010-05-28 20:09    --------    d-----w-    c:\program files\Common Files\Windows Live
    2010-05-28 20:09 . 2010-05-30 01:10    108824    ----a-w-    c:\users\caner\AppData\Local\GDIPFONTCACHEV1.DAT
    2010-05-28 20:05 . 2010-05-30 22:26    --------    d-----w-    c:\windows\system32\wbem\Performance
    2010-05-28 20:01 . 2010-05-28 23:30    --------    d-----r-    c:\users\caner\Virtual Machines
    2010-05-28 20:01 . 2010-05-28 20:01    --------    d-----w-    c:\users\caner\AppData\Local\VirtualStore
    2010-05-28 19:59 . 2010-05-28 19:59    --------    d-----w-    C:\Recovery

    .
    ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-05-30 01:54 . 2009-07-14 04:52    --------    d-----w-    c:\program files\Windows Sidebar
    2010-05-30 01:54 . 2009-07-14 02:37    --------    d-----w-    c:\program files\Windows Mail
    2010-05-30 01:54 . 2009-07-14 07:50    --------    d-----w-    c:\program files\Windows Journal
    2010-05-30 01:54 . 2009-07-14 04:52    --------    d-----w-    c:\program files\Windows Photo Viewer
    2010-05-30 01:54 . 2009-07-14 04:52    --------    d-----w-    c:\program files\Windows Defender
    2010-05-29 22:23 . 2009-07-14 04:52    --------    d-----w-    c:\program files\MSBuild
    2010-05-28 21:38 . 2010-05-28 21:38    0    ---ha-w-    c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf
    2010-05-28 20:43 . 2009-07-14 04:52    --------    d-----w-    c:\program files\DVD Maker
    2010-05-28 20:39 . 2010-05-28 20:43    37160    ----a-w-    c:\windows\inf\PERFLIB\041F\perfd.dat
    2010-05-28 20:39 . 2010-05-28 20:43    37160    ----a-w-    c:\windows\inf\PERFLIB\041F\perfc.dat
    2010-05-28 20:39 . 2010-05-28 20:43    285034    ----a-w-    c:\windows\inf\PERFLIB\041F\perfi.dat
    2010-05-28 20:39 . 2010-05-28 20:43    285034    ----a-w-    c:\windows\inf\PERFLIB\041F\perfh.dat
    2010-05-28 20:35 . 2010-05-28 20:35    0    ---ha-w-    c:\windows\system32\drivers\Msft_Kernel_Apfiltr_01005.Wdf
    2010-04-23 07:13 . 2010-05-28 20:22    2048    ----a-w-    c:\windows\system32\tzres.dll
    2010-04-17 08:01 . 2010-04-17 08:01    306544    ----a-w-    c:\windows\WLXPGSS.SCR
    2010-04-17 05:12 . 2010-04-17 05:12    48464    ----a-w-    c:\windows\system32\sirenacm.dll
    2010-03-24 18:17 . 2010-03-24 08:04    952768    ----a-w-    c:\programdata\Adobe\Reader\9.3\ARM\31605\AdobeARM.exe
    2010-03-24 18:17 . 2010-03-24 08:04    70584    ----a-w-    c:\programdata\Adobe\Reader\9.3\ARM\31605\AdobeExtractFiles.dll
    2010-03-24 18:17 . 2010-03-24 08:04    326056    ----a-w-    c:\programdata\Adobe\Reader\9.3\ARM\31605\ReaderUpdater.exe
    2010-03-24 18:17 . 2010-03-24 08:04    326056    ----a-w-    c:\programdata\Adobe\Reader\9.3\ARM\31605\AcrobatUpdater.exe
    2010-03-08 21:33 . 2010-05-28 20:22    427520    ----a-w-    c:\windows\system32\vbscript.dll
    2009-06-10 21:26 . 2009-07-14 02:04    9633792    --sha-r-    c:\windows\Fonts\StaticCache.dat
    2009-07-14 01:14 . 2009-07-13 23:42    396800    --sha-w-    c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
    .

    (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\KAVOverlayIcon]
    @="{dd230880-495a-11d1-b064-008048ec2fc5}"
    [HKEY_CLASSES_ROOT\CLSID\{dd230880-495a-11d1-b064-008048ec2fc5}]
    2009-12-25 23:42    129552    ----a-w-    c:\program files\Kaspersky Lab\Kaspersky PURE\shellex.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-05-28 3872080]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-24 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-24 173592]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-24 150552]
    "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-10-25 212992]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
    "AVP"="c:\program files\Kaspersky Lab\Kaspersky PURE\avp.exe" [2009-12-25 340456]
    "AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
    "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 0 (0x0)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)
    "PromptOnSecureDesktop"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv

    [HKLM\~\startupfolder\C:^Users^caner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^ServerList.lnk]
    path=c:\users\caner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ServerList.lnk
    backup=c:\windows\pss\ServerList.lnk.Startup
    backupExtension=.Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
    "DisableMonitoring"=dword:00000001

    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]
    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]
    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]
    R3 WatAdminSvc;Windows Etkinleştirme Teknolojileri Hizmeti;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-28 1343400]
    R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-05-28 691696]
    S0 CSCrySec;InfoWatch Encrypt Sector Library driver;c:\windows\system32\DRIVERS\CSCrySec.sys [2009-12-14 88632]
    S0 KLBG;Kaspersky Lab Boot Guard Driver;c:\windows\system32\DRIVERS\klbg.sys [2009-10-15 36880]
    S1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver;c:\windows\system32\DRIVERS\CSVirtualDiskDrv.sys [2009-12-14 39352]
    S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-09-14 21520]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
    S2 CSObjectsSrv;CryptoStorage control service;c:\program files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [2009-12-22 743992]
    S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 20992]
    S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-10-03 19472]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HsfXAudioService    REG_MULTI_SZ       HsfXAudioService
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = about:blank
    IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
    TCP: {2bd1fd81-ef1d-49b7-abc0-a019be5f2ebf} = 92.63.15.3
    FF - ProfilePath - c:\users\caner\AppData\Roaming\Mozilla\Firefox\Profiles\ke4q7u68.default\
    FF - prefs.js: browser.startup.homepage -
    FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
    FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

    ---- FIREFOX POLICIES ----
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'Explorer.exe'(1628)
    c:\program files\Microsoft Office\Office12\1033\GrooveIntlResource.dll
    .
    Completion time: 2010-05-30  15:32:57
    ComboFix-quarantined-files.txt  2010-05-30 22:32

    Pre-Run: 89.121.419.264 bayt boş
    Post-Run: 89.085.894.656 bayt boş

    - - End Of File - - 4BC88B825194C4D9D07F029C6C5622A4

  10. KısayolKısayol reportŞikayet pmÖzel Mesaj
    canerator
    canerator's avatar
    Kayıt Tarihi: 14/Haziran/2006
    Erkek

    Şöle olaylar olmakta bide.Bazı dosyalar kitlenio kullanımda dio.Mesela firefox açtım firefoxun bazı dosyaları kullanımda dedi.Kaspersky blacklist hatası verdi.Pc yi yeniden başlatırken ekran kartı sürücüsü iptal olmuş gibi ufaldı ekran.

     

    x3uqm4 taratayım tmm banada şüpeli geldi. 

    Asker kasperden memnunum ya bence hepsi aynı zaten az çok.

    sanacasta tmm saolasın deneyim bi bakalım nolcak.

  11. KısayolKısayol reportŞikayet pmÖzel Mesaj
    canerator
    canerator's avatar
    Kayıt Tarihi: 14/Haziran/2006
    Erkek

    x3uqm4 bunu yazdı:
    -----------------------------

    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\SearchFilterHost.exe
    Şu dosyaları bir virustotalde tarat. 
    Ayrıca windows7de görev yöneticisinde sol alt köşede bir tık olur tüm işlemleri göster diye. ona tıklarsan cpu harcayan şeyi görürsün. Belki kaspersky kastırıyordur? :D


    -----------------------------

    Temiz çıktılar.

Toplam Hit: 7403 Toplam Mesaj: 17