Ben sizin yerinizde olsam şansa bırakmadan direk format atardım.

Merhabalar arkadaşlar. Bir arkadaşıma emanet ettiğim bilgisayarıma oyunda hile kuracağım diyerek birisi Windows Güvenlik Duvarını kapatıp System32 ve SysWOW64 klasörlerinde bazı DLL ve OCX dosyalarını değiştirmiş. 3 Gün önce Instagram hesabıma giriş yapıldığı Gmail hesabıma da giriş yapılması denendiğine dair bir mail geldi. Windows Defender ile tarattım bir sorun bulunamadi. Hijackthis programından log aldım Kod:Panoya kopyala Logfile of HiJackThis Fork by Alex Dragokas v.2.9.0.26 Platform: x64 Windows 8.1 (Embedded Industry , 6.3.9600.19893, Service Pack: 0 Time: 05.01.2021 - 13:44 (UTC+03:00) Language: OS: Turkish (0x41F). Display: Turkish (0x41F). Non-Unicode: Turkish (0x41F) Elevated: Yes Ran by: Talha on KJUBIXHUNTER, FirstRun: yes Chrome: 87.0.4280.88 Internet Explorer: 11.0.9600.19036 Default: "C:\Program Files (x86)\Google\Chrome\Application\chrome. exe" --single-argument %1 Boot mode: Normal Running processes: Number | Path 1 C:\Program Files (x86)\Creative\Sound Blaster Cinema\Sound Blaster Cinema\SBCinema. exe 32 C:\Program Files (x86)\Google\Chrome\Application\chrome. exe 1 C:\Program Files (x86)\Google\Update\1.3.36.52\GoogleCrashHandler. exe 1 C:\Program Files (x86)\Google\Update\1.3.36.52\GoogleCrashHandler64. exe 1 C:\Program Files (x86)\TeamViewer\TeamViewer_Service. exe 1 C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun. exe 1 C:\Program Files\Elantech\ETDCtrl. exe 1 C:\Program Files\Elantech\ETDCtrlHelper. exe 1 C:\Program Files\Elantech\ETDService. exe 1 C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService. exe 1 C:\Program Files\Logitech Gaming Software\LAClient\laclient. exe 1 C:\Program Files\Logitech Gaming Software\LCore. exe 2 C:\Program Files\NVIDIA Corporation\Display. NvContainer\NVDisplay. Container. exe 1 C:\Program Files\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer. exe 1 C:\Program Files\Realtek\Audio\HDA\RAVCpl64. exe 1 C:\Program Files\Windows Defender\MSASCui. exe 1 C:\Program Files\Windows Defender\MpCmdRun. exe 1 C:\Program Files\Windows Defender\MsMpEng. exe 1 C:\Program Files\Windows Defender\NisSrv. exe 1 C:\Program Files\Windows Media Player\wmpnetwk. exe 1 C:\Users\Talha\Downloads\HiJackThis. exe 1 C:\Users\Talha\Downloads\VisualBasic6-KB896559-v1-ENU (1). exe 1 C:\Windows\Microsoft. NET\Framework64\v3.0\WPF\PresentationFontCache. exe 1 C:\Windows\System32\RuntimeBroker. exe 1 C:\Windows\System32\SearchIndexer. exe 1 C:\Windows\System32\SearchProtocolHost. exe 1 C:\Windows\System32\conhost. exe 2 C:\Windows\System32\csrss. exe 1 C:\Windows\System32\dasHost. exe 1 C:\Windows\System32\dllhost. exe 1 C:\Windows\System32\dwm. exe 1 C:\Windows\System32\igfxCUIService. exe 1 C:\Windows\System32\igfxEM. exe 1 C:\Windows\System32\igfxHK. exe 1 C:\Windows\System32\lsass. exe 1 C:\Windows\System32\notepad. exe 1 C:\Windows\System32\rundll32. exe 1 C:\Windows\System32\services. exe 1 C:\Windows\System32\smss. exe 1 C:\Windows\System32\spoolsv. exe 13 C:\Windows\System32\svchost. exe 1 C:\Windows\System32\taskhost. exe 1 C:\Windows\System32\taskhostex. exe 1 C:\Windows\System32\wininit. exe 1 C:\Windows\System32\winlogon. exe 1 C:\Windows\explorer. exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main: = https://www.yandex.com.tr/?win=411&clid=2257151-10 R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\ : = https://suggest.yandex.com.tr/suggest-ff. cgi?uil=ru&part= - Yandex R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\ : = https://yandex.com.tr/search/?win=411&clid=2257152-10&text= - Yandex O1 - Hosts: is empty O4 - HKCU\..\Run: = C:\Users\Talha\AppData\Local\Blitz\Update. exe --processStart "Blitz. exe" --process-start-args "--hidden" O4 - HKCU\..\StartupApproved\Run: = C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher. exe -silent (2020/06/20) O4 - HKCU\..\StartupApproved\Run: = C:\Program Files (x86)\Steam\steam. exe -silent (2018/07/13) O4 - HKLM\..\Run: = C:\Program Files\Elantech\ETDCtrl. exe O4 - HKLM\..\Run: = C:\Program Files\Logitech Gaming Software\LCore. exe /minimized O4 - HKLM\..\Run: = C:\Windows\system32\MBCfg64. dll C:\Windows\system32\MBCfg64. dll, RunDLLEntry MBCfg64 O4 - HKLM\..\Run: = C:\Program Files\Realtek\Audio\HDA\RAVCpl64. exe -s O4 - HKLM\..\StartupApproved\Run: = C:\Program Files\Windows Defender\MSASCuiL. exe (2018/07/13) O4-32 - HKLM\..\Run: = C:\Program Files (x86)\Creative\Sound Blaster Cinema\Sound Blaster Cinema\SBCinema. exe /r O4-32 - HKLM\..\Run: = C:\Windows\UpdReg. EXE O16-32 - DPF: HKLM\..\ \DownloadInformation: Creative Software AutoUpdate = http://files.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng. cab O16-32 - DPF: HKLM\..\ \DownloadInformation: Creative Software AutoUpdate Support Package 2 = http://files.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE. cab O16-32 - DPF: HKLM\..\ \DownloadInformation: Creative Software AutoUpdate Support Package = http://files.creative.com/Web/softwareupdate/ocx/150323/CTPID. cab O17 - DHCP DNS 1: 8.8.8.8 O17 - DHCP DNS 2: 8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\..\ : = 8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\..\ : = 8.8.8.8 O20 - HKLM\..\Windows: = C:\Windows\system32\nvinitx. dll O20-32 - HKLM\..\Windows: = C:\Windows\SysWOW64\nvinit. dll O22 - Task: NvTmMon_ - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon. exe O22 - Task: NvTmRepCR1_ - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep. exe /noshim O22 - Task: NvTmRepCR2_ - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep. exe /noshim O22 - Task: NvTmRepCR3_ - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep. exe /noshim O22 - Task: NvTmRep_ - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep. exe O22 - Task: \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - C:\Windows\system32\CompatTelRunner. exe O22 - Task: \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - C:\Windows\system32\compattel\DiagTrackRunner. exe /UploadEtlFilesOnly O22 - Task: \Microsoft\Windows\Application Experience\ProgramDataUpdater - C:\Windows\system32\CompatTelRunner. exe -maintenance O22 - Task: \Microsoft\Windows\Customer Experience Improvement Program\ScheduleWepCEIP - C:\Windows\system32\WepsqmTask. exe O22 - Task: \Microsoft\Windows\Customer Experience Improvement Program\Uploader - C:\Windows\system32\WSqmCons. exe -u O22 - Task: GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate. exe /c O22 - Task: GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate. exe /ua /installsource scheduler O22 - Task: NvProfileUpdaterDaily_ - C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64. exe O22 - Task: NvProfileUpdaterOnLogon_ - C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64. exe O22 - Task: \Microsoft\Office\Office Feature Updates - C:\Program Files\Microsoft Office\root\Office16\sdxhelper. exe O22 - Task: \Microsoft\Office\Office Feature Updates Logon - C:\Program Files\Microsoft Office\root\Office16\sdxhelper. exe /onlogon O22 - Task: klcp_update - C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool. exe /verysilent /update /freq=30 O23 - Service R2: Diagnostics Tracking Service - - C:\Windows\System32\svchost. exe -k utcsvc; "ServiceDll" = C:\Windows\system32\diagtrack. dll O23 - Service R2: Elan Service - - C:\Program Files\Elantech\ETDService. exe O23 - Service R2: Intel HD Graphics Control Panel Service - (igfxCUIService1.0.0.0) - C:\Windows\system32\igfxCUIService. exe O23 - Service R2: Logitech Gaming Registry Service - - C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService. exe O23 - Service R2: NVIDIA Display Container LS - - C:\Program Files\NVIDIA Corporation\Display. NvContainer\NVDisplay. Container. exe -s NVDisplay. ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay. ContainerLocalSystem. log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display. NvContainer\plugins\LocalSystem" -r -p 30000 O23 - Service R2: NVIDIA Telemetry Container - - C:\Program Files\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer. exe -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer. log" -l 3 -d "C:\Program Files\NVIDIA Corporation\NvTelemetry\plugins" -r O23 - Service R2: TeamViewer - C:\Program Files (x86)\TeamViewer\TeamViewer_Service. exe O23 - Service S2: Google Güncelleme Hizmeti - - C:\Program Files (x86)\Google\Update\GoogleUpdate. exe /svc O23 - Service S3: BattlEye Service - - C:\Program Files (x86)\Common Files\BattlEye\BEService. exe O23 - Service S3: EasyAntiCheat - C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat. exe O23 - Service S3: Google Chrome Elevation Service - - C:\Program Files (x86)\Google\Chrome\Application\87.0.4280.88\elevation_service. exe O23 - Service S3: Google Güncelleme Hizmeti - - C:\Program Files (x86)\Google\Update\GoogleUpdate. exe /medsvc O23 - Service S3: Office 64 Source Engine - (ose64) - c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE. EXE O23 - Service S3: Steam Client Service - C:\Program Files (x86)\Common Files\Steam\SteamService. exe /RunAsService O23 - Service S3: nProtect GameGuard Service - - C:\Windows\SysWOW64\GameMon. des -service -- End of file - Time spent: 15,1 sec. - 21312 bytes, CRC32: FFFFFFFF. Sign: ᦭ぶ Değiştirilen DLL ve OCX dosyaları ektedir. Bunlar System32 ve SysWOW64 klasörüne atılıp 32 Bit. bat ve 64 Bit. bat çalıştırılmış. Normalde güvenlik kısmına çok dikkat ediyorum fakat ciddi endişelerim var, yardımcı olabilir misiniz? @Murat5038 Dosya Ekleri Adsız11. png 245,4 KB · Görüntüleme: 52 Adsız2. png 96,5 KB · Görüntüleme: 59 Adsız3. png 70,8 KB · Görüntüleme: 46 Son düzenleyen: Moderatör: 5 Ocak 2021

bat dosyasına düzenle diyip buraya kod olarak atar mısın?

Başkalarının şeylerini kendi konunuzda paylaşmayın. Rapor sonucuna göre yorum yapacağım. Bunları fixleyin: Kod:Panoya kopyala R0 - HKCU\Software\Microsoft\Internet Explorer\Main: = https://www.yandex.com.tr/?win=411&clid=2257151-10 R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\ : = https://suggest.yandex.com.tr/suggest-ff. cgi?uil=ru&part= - Yandex R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\ : = https://yandex.com.tr/search/?win=411&clid=2257152-10&text= - Yandex O1 - Hosts: is empty O20 - HKLM\..\Windows: = C:\Windows\system32\nvinitx. dll O20-32 - HKLM\..\Windows: = C:\Windows\SysWOW64\nvinit. dll O22 - Task: \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - C:\Windows\system32\CompatTelRunner. exe O22 - Task: \Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - C:\Windows\system32\compattel\DiagTrackRunner. exe /UploadEtlFilesOnly O22 - Task: \Microsoft\Windows\Application Experience\ProgramDataUpdater - C:\Windows\system32\CompatTelRunner. exe -maintenance O22 - Task: \Microsoft\Windows\Customer Experience Improvement Program\ScheduleWepCEIP - C:\Windows\system32\WepsqmTask. exe O22 - Task: \Microsoft\Windows\Customer Experience Improvement Program\Uploader - C:\Windows\system32\WSqmCons. exe -u Sistemde zararlı gözükmüyor belirgin olarak. Şüpheniz varsa imzamdan KIS 2021 ile güvenliğinizi sağlayabilirsiniz.

Bu resimdekiler mi sadece vardı yanında içinde yazan dosyalar yoksa sorun olmaz.

Atılan dosya varsa dediğim gibi zararlıda olabilir zararsızda. AV kullanın.

Dll, ocx dediklerin, dediğim gibi başkasının verisine dayanarak bir şey diyemem. Sakıncaları tabi olur zararlılarsa.

Sadece bu dosyalar system32 ve SysWOW64 klasörleri içerisine atılıp bat dosyasından çalışıtırılmış

Hijackthis, Malwarebytes, KIS2021 kurup tarattırdım herhangi bir şey yok gözüküyor. @Murat5038

O dosyaları sildim gelince direkt internette bulduğum bir videodan kesitler ekledim MalwareBytes tarama sonuçları ve bulunan öğeler ektedir. Kod:Panoya kopyala Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 1/5/21 Scan Time: 2:22 PM Log File: 55ba2c6c-4f48-11eb-89d5-000000000000. json -Software Information- Version: 4.3.0.98 Components Version: 1.0.1130 Update Package Version: 1.0.35309 License: Trial -System Information- OS: Windows 8.1 CPU: x64 File System: NTFS User: KjubiXhunter\Talha -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 241182 Threats Detected: 5 Threats Quarantined: 0 Time Elapsed: 1 min, 40 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Detect PUM: Detect -Scan Details- Process: 0 Module: 0 Registry Key: 1 Adware. RussAd, HKU\S-1-5-21-2267927869-3042648487-1562112351-1001\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\ibknafobnmndicojahlppolcaaibngjf, No Action By User, 8607, 585110, , , , , , Registry Value: 1 Adware. RussAd, HKU\S-1-5-21-2267927869-3042648487-1562112351-1001\SOFTWARE\GOOGLE\CHROME\PREFERENCEMACS\Default\extensions. settings|ibknafobnmndicojahlppolcaaibngjf, No Action By User, 8607, 585110, , , , , , Registry Data: 0 Data Stream: 0 Folder: 1 Adware. RussAd, C:\USERS\TALHA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\EXTENSIONS\IBKNAFOBNMNDICOJAHLPPOLCAAIBNGJF, No Action By User, 8607, 585110, 1.0.35309, , ame, , , File: 2 Adware. RussAd, C:\USERS\TALHA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Secure Preferences, No Action By User, 8607, 585110, , , , , 4D009DCC97F77474908DB078142B2489, ABC1A55F5D41C2A7C24387C11D0CFEBE14BA2EA810D95EB904D961A7DF73F569 Adware. RussAd, C:\USERS\TALHA\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Preferences, No Action By User, 8607, 585110, , , , , 44CC7916FA4BD8E06FC3C09F638D79CC, 11B4163D8E2A3661B9A28045E05B51D2FBD5187859E9F02FDE7DB4705B662951 Physical Sector: 0 WMI: 0 Dosya Ekleri Adsız4. png 50,2 KB · Görüntüleme: 24

Bilgisayar benim Murat abi. Maalesef emanet edip verdim hata bende. Dediğiniz dizinleri fixledim. Bu dll ve ocx dosyalarının değişmesi sakıncalı mıdır?

Bu dosyaları size ulaştırsam zararları var mıdır bilgilendirebilir misiniz? Birde bu dll ve ocx dosyalarının temiz halini bulmamız mümkün mü?

Ben değiştirmedim sorun orada üstadım. Bu bat dosyalarının düzenlenmiş halidir. Dosya Ekleri 1212. png 27,5 KB · Görüntüleme: 28

Birdahakine değiştirdiğin dosyaların yedeğini almayı unutma.

Hile ise muhtemelen bilinçli kapatılmıştır, hile geliştiricileri hileyi korumak için bazı yazılımlar kullanıyorlar onları virüs programları virüs olarak algılıyor. Ha bir de bunların içine ekstra keylogger, trojan gibi yazılım gömmüş olma ihtimalleri de var tabii. Hepsi sütten çıkmış ak kaşık değil. DLL'ler hileyi algılamaması için patchlenmiş olabilir, böyle bakarak bir şey söylenemez. Bahsi geçen DLL'ler incelenmesi lazım.