Bir sorun gözükmüyor. Bilgisayarı yeniden başlatıp kullanmaya devam edebilirsiniz.

Resimde gördüğünüz 2. exe uzantılı dosyayı Malwarebytes backdoor. bot olarak algılıyor. Bunları karantinaya aldığım zaman yok olup gidiyorlar. Ancak bilgisayarı yeniden başlattığımda görev yöneticisinde yine çalıştıklarını görüyorum. Bu dosyalar hakkında bilgisi olan var mı bunları nasıl yok edebilirim?

HijackThis'e ait, birkaç gün sonra silin.

dediğiniz işlemleri yapıyorum hocam. masaüstünde backups diye bir dosya oluştu onu ne yapmalıyım?

Gerek yok. Raporu kontrol amaçlı bir kere daha paylaşabilirsiniz.

Raporu buraya paylaşın. HijackThis Log Paylaşımı ve Çözümleri | Technopat Sosyal

hayır yüklemedim

tamamdır yapıp paylaşıcam

Sildim. Tekrar taratma yapmalı mıyım? Son düzenleyen: Moderatör: 18 Nisan 2023

@acv'nin attığı rehberi inceleyin ve sonucu bizimle paylaşın.

Hocam galiba Sonic gibi bir oyun mu yüklemeye çalıştınız? Hocam bir de sağ tıklayıp dosya konumunu aç deyin. Son düzenleyen: Moderatör: 8 Ocak 2022

Tamamdır hocam teşekkür ederim yardımlarınız için. Son düzenleyen: Moderatör: 18 Nisan 2023

Bulunanları silin.

Kod:Panoya kopyala Logfile of HiJackThis Fork by Alex Dragokas v.2.10.0.14 Platform: x64 Windows 10 , 10.0.19043.1415 (ReleaseId: 2009, 21H1), Service Pack: 0 Time: 08.01.2022 - 13:22 (UTC+03:00) Language: OS: Turkish (0x41F). Display: Turkish (0x41F). Non-Unicode: Turkish (0x41F) Elevated: Yes Ran by: Recep Can Yıldırım on RECEP, FirstRun: yes Chrome: 97.0.4692.71 Internet Explorer: 11.0.19041.1202 Default: "C:\Program Files\Google\Chrome\Application\chrome. exe" --single-argument %1 Boot mode: Normal Running processes: Number | Path 1 C:\Program Files (x86)\Common Files\Java\Java Update\jusched. exe 1 C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler. exe 1 C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler64. exe 1 C:\Program Files (x86)\Google\Update\GoogleUpdate. exe 1 C:\Program Files (x86)\Rampage Gaming Headset\Rampage Gaming Headset. exe 1 C:\Program Files\AMD\CNext\CNext\CPUMetricsServer. exe 1 C:\Program Files\AMD\Performance Profile Client\AUEPDU. exe 1 C:\Program Files\AMD\Performance Profile Client\AUEPMaster. exe 1 C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun. exe 10 C:\Program Files\Google\Chrome\Application\chrome. exe 1 C:\Program Files\Riot Vanguard\vgtray. exe 1 C:\Program Files\WindowsApps\Microsoft. GamingServices_3.60.12001.0_x64 8wekyb3d8bbwe\gamingservices. exe 1 C:\Program Files\WindowsApps\Microsoft. GamingServices_3.60.12001.0_x64 8wekyb3d8bbwe\gamingservicesnet. exe 1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\MsMpEng. exe 1 C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2111.5-0\NisSrv. exe 1 C:\Users\Recep Can Yıldırım\Desktop\HiJackThis. exe 1 C:\Windows\explorer. exe 1 C:\Windows\servicing\TrustedInstaller. exe 1 C:\Windows\System32\amdfendrsr. exe 1 C:\Windows\System32\AudioDeviceService. exe 2 C:\Windows\System32\csrss. exe 1 C:\Windows\System32\ctfmon. exe 2 C:\Windows\System32\dllhost. exe 1 C:\Windows\System32\DriverStore\FileRepository\u0374383. inf_amd64_12cfd68385ecddd5\B374323\atieclxx. exe 1 C:\Windows\System32\DriverStore\FileRepository\u0374383. inf_amd64_12cfd68385ecddd5\B374323\atiesrxx. exe 1 C:\Windows\System32\dwm. exe 2 C:\Windows\System32\fontdrvhost. exe 1 C:\Windows\System32\lsass. exe 1 C:\Windows\System32\MoUsoCoreWorker. exe 2 C:\Windows\System32\RtkAudUService64. exe 3 C:\Windows\System32\RuntimeBroker. exe 1 C:\Windows\System32\SearchIndexer. exe 1 C:\Windows\System32\SecurityHealthService. exe 1 C:\Windows\System32\SecurityHealthSystray. exe 1 C:\Windows\System32\services. exe 1 C:\Windows\System32\SgrmBroker. exe 1 C:\Windows\System32\sihost. exe 1 C:\Windows\System32\smartscreen. exe 1 C:\Windows\System32\smss. exe 1 C:\Windows\System32\spoolsv. exe 73 C:\Windows\System32\svchost. exe 2 C:\Windows\System32\taskhostw. exe 3 C:\Windows\System32\wbem\WmiPrvSE. exe 1 C:\Windows\System32\wininit. exe 1 C:\Windows\System32\winlogon. exe 1 C:\Windows\SystemApps\Microsoft. Windows. Search_cw5n1h2txyewy\SearchApp. exe 1 C:\Windows\SystemApps\Microsoft. Windows. StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost. exe 1 C:\Windows\SystemApps\MicrosoftWindows. Client. CBS_cw5n1h2txyewy\InputApp\TextInputHost. exe 1 C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1371_none_7e1bd7147c8285b0\TiWorker. exe R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\ : = https://suggest.yandex.com.tr/suggest-ff. cgi?srv=ie11&uil=tr&part= &clid=2233630 - Yandex R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\ : = https://yandex.com.tr/search/?text= &clid=2233630 - Yandex O2 - HKLM\..\BHO: Java Plug-In 2 SSV Helper - - C:\Program Files\Java\jre1.8.0_311\bin\jp2ssv. dll O2 - HKLM\..\BHO: Java Plug-In SSV Helper - - C:\Program Files\Java\jre1.8.0_311\bin\ssv. dll O4 - HKCU\..\StartupApproved\Run: = C:\Program Files (x86)\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher. exe -silent (2020/12/26) O4 - HKLM\..\Run: = C:\Program Files\Riot Vanguard\vgtray. exe O4 - HKLM\..\Run: = C:\WINDOWS\System32\RtkAudUService64. exe -background O4 - HKU\S-1-5-19\..\RunOnce: = C:\Program Files\Windows Mail\wab. exe /Upgrade O4 - HKU\S-1-5-20\..\RunOnce: = C:\Program Files\Windows Mail\wab. exe /Upgrade O4-32 - HKLM\..\Run: = C:\Program Files (x86)\Microsoft Office\Office14\BCSSync. exe /DelayServices O4-32 - HKLM\..\Run: = C:\Program Files (x86)\Rampage Gaming Headset\Rampage Gaming Headset. exe -boot O4-32 - HKLM\..\Run: = C:\Program Files (x86)\Common Files\Java\Java Update\jusched. exe O17 - DHCP DNS 1: 192.168.1.1 O22 - Task : CreateExplorerShellUnelevatedTask. job - C:\Windows\explorer. exe O22 - Task: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Avast Software O22 - Task: \Agent Activation Runtime\S-1-5-21-2014669194-791579289-1044259415-1001 - C:\WINDOWS\System32\AgentActivationRuntimeStarter. exe O22 - Task: \Microsoft\Windows\Management\Provisioning\Retry - C:\WINDOWS\system32\ProvTool. exe /turn 5 /source ProvRetryTask O22 - Task: \Microsoft\Windows\Management\Provisioning\RunOnReboot - C:\WINDOWS\system32\ProvTool. exe /turn 5 /source ContinueSessionTask O22 - Task: \Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work - C:\WINDOWS\system32\usoclient. exe StartMaintenanceWork O22 - Task: \Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work - C:\WINDOWS\system32\usoclient. exe StartWork O22 - Task: \S-1-5-21-2014669194-791579289-1044259415-1001\DataSenseLiveTileTask - C:\WINDOWS\System32\DataUsageLiveTileTask. exe O22 - Task: \Microsoft\Windows\Application Experience\PcaPatchDbTask - C:\WINDOWS\system32\rundll32. exe C:\WINDOWS\system32\PcaSvc. dll, PcaPatchSdbTask O22 - Task: AMDInstallLauncher - C:\Program Files\AMD\CIM\Bin64\InstallManagerApp. exe /InstallAUEP O22 - Task: AMDLinkUpdate - C:\Program Files\AMD\CIM\Bin64\InstallManagerApp. exe -AMDLinkUpdate O22 - Task: AMDRyzenMasterSDKTask - C:\Program Files\AMD\CNext\CNext\cpumetricsserver. exe O22 - Task: BlueStacksHelper_nxt - C:\Program Files\BlueStacks_nxt\BlueStacksHelper. exe -sr O22 - Task: GoogleUpdateTaskMachineCore - C:\Program Files (x86)\Google\Update\GoogleUpdate. exe /c O22 - Task: GoogleUpdateTaskMachineUA - C:\Program Files (x86)\Google\Update\GoogleUpdate. exe /ua /installsource scheduler O22 - Task: ModifyLinkUpdate - C:\Program Files\AMD\CIM\Bin64\InstallManagerApp. exe -UpdateCurrentUser O22 - Task: StartAUEP - C:\Program Files\AMD\Performance Profile Client\AUEPMaster. exe O22 - Task: StartCN - C:\Program Files\AMD\CNext\CNext\cncmd. exe startwithdelay O22 - Task: StartCNBM - C:\Program Files\AMD\CNext\CNext\cncmd. exe benchmark O22 - Task: StartDVR - C:\Program Files\AMD\CNext\CNext\RSServCmd. exe O23 - Service R2: AMD Crash Defender Service - C:\WINDOWS\System32\amdfendrsr. exe O23 - Service R2: AMD External Events Utility - C:\WINDOWS\System32\DriverStore\FileRepository\u0374383. inf_amd64_12cfd68385ecddd5\B374323\atiesrxx. exe O23 - Service R2: AMD User Experience Program Data Uploader - - C:\Program Files\AMD\CIM\..\Performance Profile Client\AUEPDU. exe O23 - Service R2: AudioDeviceService - C:\WINDOWS\system32\AudioDeviceService. exe O23 - Service R2: Gaming Services - - C:\Program Files\WindowsApps\Microsoft. GamingServices_3.60.12001.0_x64 8wekyb3d8bbwe\GamingServices. exe O23 - Service R2: Gaming Services - - C:\Program Files\WindowsApps\Microsoft. GamingServices_3.60.12001.0_x64 8wekyb3d8bbwe\GamingServicesNet. exe O23 - Service R2: Realtek Audio Universal Service - - C:\WINDOWS\System32\RtkAudUService64. exe O23 - Service S2: Google Güncelleme Hizmeti - - C:\Program Files (x86)\Google\Update\GoogleUpdate. exe /svc O23 - Service S2: KMService - C:\WINDOWS\system32\srvany. exe O23 - Service S3: BattlEye Service - - C:\Program Files (x86)\Common Files\BattlEye\BEService. exe O23 - Service S3: EasyAntiCheat - C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat. exe O23 - Service S3: Epic Online Services - - C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost. exe O23 - Service S3: Google Chrome Elevation Service - - C:\Program Files\Google\Chrome\Application\97.0.4692.71\elevation_service. exe O23 - Service S3: Google Güncelleme Hizmeti - - C:\Program Files (x86)\Google\Update\GoogleUpdate. exe /medsvc O23 - Service S3: Malwarebytes Service - - C:\Program Files\Malwarebytes\Anti-Malware\MBAMService. exe O23 - Service S3: Rockstar Game Library Service - - C:\Program Files\Rockstar Games\Launcher\RockstarService. exe O23 - Service S3: Steam Client Service - C:\Program Files (x86)\Common Files\Steam\SteamService. exe /RunAsService O23 - Service S3: Uncheater for BattleGroundsLite_SE - - C:\Program Files\Common Files\Uncheater\uncheater_bgl. exe O23 - Service S3: vgc - C:\Program Files\Riot Vanguard\vgc. exe -- End of file - Time spent: 16,8 sec. - 20114 bytes, CRC32: FFFFFFFF. Sign: � Buraya tekrar kontrol yapıp attım. Son düzenleyen: Moderatör: 18 Nisan 2023

hocam tam tarama yaptım tasketcurv ve taskwintuu yu yeniden buldu. Dosyalar temp dosyasının içinde bulunuyor. Şimdi ne yapmalıyım? Cidden canımı sıkmaya başladı bu iki malware en sonunda temiz bi format çektiricekler bana

Görev yöneticisinden MonectServer ve MonectServerService işlemleriyle beraber gördüğünüz diğer şüpheli işlemleri kapatın. Sonrasında bunları fixleyin. Kod:Panoya kopyala O4 - HKCU\..\StartupApproved\Run: = C:\Users\Recep Can Yıldırım\AppData\Local\Microsoft\Teams\Update. exe --processStart "Teams. exe" --process-start-args "--system-initiated" (2020/12/08) O4 - HKU\S-1-5-19\..\RunOnce: = C:\Program Files\Windows Mail\wab. exe /Upgrade O4 - HKU\S-1-5-20\..\RunOnce: = C:\Program Files\Windows Mail\wab. exe /Upgrade O15 - Trusted Zone: . localhost O15 - Trusted Zone: http://webcompanion.com O21 - HKLM\..\ShellIconOverlayIdentifiers\00asw: - - O22 - Task: \Microsoft\Windows\Application Experience\PcaPatchDbTask - C:\WINDOWS\system32\rundll32. exe C:\WINDOWS\system32\PcaSvc. dll, PcaPatchSdbTask O22 - Task: \Avast Software\Overseer - C:\Program Files\Common Files\Avast Software\Overseer\overseer. exe /from_scheduler:1 O22 - Task: \Microsoft\Windows\SMB\UninstallSMB1ClientTask - C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell. exe -ExecutionPolicy Unrestricted -NonInteractive -NoProfile -WindowStyle Hidden "& C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\SmbShare\DisableUnusedSmb1. ps1 -Scenario Client" O22 - Task: \Microsoft\Windows\SMB\UninstallSMB1ServerTask - C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell. exe -ExecutionPolicy Unrestricted -NonInteractive -NoProfile -WindowStyle Hidden "& C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\SmbShare\DisableUnusedSmb1. ps1 -Scenario Server" O22 - Task: Avast Emergency Update - C:\Program Files\Avast Software\Avast\AvEmUpdate. exe O23 - Service R2: MonectServerService - C:\Program Files\PC Remote Receiver\MonectServerService. exe O23 - Service R2: tasketcurv - C:\taskkurvafaezm\tasketcurv. exe O23 - Service R2: taskwintuu - C:\tasktwcacbrcwe\taskwintuu. exe O23 - Service S3: tasklogvcj - C:\taskvfoosotlqm\tasklogvcj. exe O23 - Service S3: tasksysgza - C:\taskpbvabufsch\tasksysgza. exe O23 - Service S3: tasksysvyz - C:\tasknvfuafhbzs\tasksysvyz. exe Aşağıdaki programı indirip güncelleştirme yaptıktan sonra tam tarama gerçekleştirin. Emsisoft - Emergency Kit: Free Portable Malware Scan and Removal Emsisoft Emergency Kit is the ultimate free anti-malware and antivirus tool to scan, detect and remove viruses, keyloggers and other malware threats. www.emsisoft.com