HijackThis sonuçları: Kod:Panoya kopyala Logfile of Trend Micro HijackThis v2.0.5 Scan saved at 15:44:41, on 04.08.2014 Platform: Windows 7 SP1 (WinNT 6.00.3505) MSIE: Internet Explorer v9.00 (9.00.8112.16457) Boot mode: Normal Running processes: C:\Users\USER\AppData\Roaming\DRPSu\DrvUpdater. exe C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr. exe C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl. exe C:\Users\USER\Desktop\HijackThis. exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main, Search Page = http://go. microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main, Start Page = http://www.yandex.com.tr/?win=135&clid=1979776 R1 - HKLM\Software\Microsoft\Internet Explorer\Main, Search Page = http://go. microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main, Start Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search, SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search, CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main, Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar, LinksFolderName = F2 - REG:system. ini: UserInit=userinit. exe O2 - BHO: Bitdefender Wallet - - C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxie. dll O2 - BHO: Java Plug-In SSV Helper - - C:\Program Files (x86)\Java\jre7\bin\ssv. dll O2 - BHO: - - O2 - BHO: Görsel favoriler - - O2 - BHO: Java Plug-In 2 SSV Helper - - C:\Program Files (x86)\Java\jre7\bin\jp2ssv. dll O3 - Toolbar: - - O3 - Toolbar: Yandex Elements - - O4 - HKLM\..\Run: "C:\Program Files (x86)\ATI Technologies\ATI. ACE\Core-Static\CLIStart. exe" MSRun O4 - HKLM\..\Run: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM. exe" O4 - HKCU\..\Run: C:\Users\USER\AppData\Roaming\DRPSu\DrvUpdater. exe /hide O4 - HKCU\..\Run: "C:\Program Files\Bitdefender\Bitdefender\pmbxag. exe" O4 - HKCU\..\Run: "C:\Program Files\Bitdefender\Bitdefender\pwdmanui. exe" --hidden --nowizard O4 - HKCU\..\Run: "C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr. exe" O4 - HKCU\..\Run: "C:\Program Files (x86)\DAEMON Tools Lite\DTLite. exe" -autorun O4 - HKUS\S-1-5-18\..\Run: "C:\Program Files\Bitdefender\Bitdefender\pmbxag. exe" O4 - HKUS\S-1-5-18\..\Run: "C:\Program Files\Bitdefender\Bitdefender\pwdmanui. exe" --hidden --nowizard O4 - HKUS\S-1-5-18\..\Run: "C:\Program Files\Bitdefender\Bitdefender\antispam32\bdapppassmgr. exe" O4 - HKUS\. DEFAULT\..\Run: "C:\Program Files\Bitdefender\Bitdefender\pmbxag. exe" O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA 2\MICROS 2\OFFICE11\EXCEL. EXE/3000 O9 - Extra button: Add to VideoGet - - C:\PROGRA 2\NUCLEA 1\VideoGet\Plugins\VIDEOG 1. DLL O9 - Extra 'Tools' menuitem: Add to &VideoGet - - C:\PROGRA 2\NUCLEA 1\VideoGet\Plugins\VIDEOG 1. DLL O9 - Extra button: Araştır - - C:\PROGRA 2\MICROS 2\OFFICE11\REFIEBAR. DLL O11 - Options group: Accelerated graphics O17 - HKLM\System\CCS\Services\Tcpip\..\ : NameServer = 198.153.192.1,198.153.194.1 O23 - Service: Adobe Acrobat Update Service - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc. exe O23 - Service: Adobe Flash Player Update Service - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService. exe O23 - Service: @%SystemRoot%\system32\Alg. exe,-112 - Unknown owner - C:\Windows\System32\alg. exe O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI. ACE\Fuel\Fuel. Service. exe O23 - Service: @%SystemRoot%\system32\efssvc. dll,-100 - Unknown owner - C:\Windows\System32\lsass. exe O23 - Service: ESET Service - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn. exe O23 - Service: @%systemroot%\system32\fxsresm. dll,-118 - Unknown owner - C:\Windows\system32\fxssvc. exe O23 - Service: Google Güncelleme Hizmeti - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate. exe O23 - Service: Google Güncelleme Hizmeti - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate. exe O23 - Service: IePlugin Service - Cherished Technololgy LIMITED - C:\ProgramData\IePluginService\PluginService. exe O23 - Service: @keyiso. dll,-100 - Unknown owner - C:\Windows\system32\lsass. exe O23 - Service: @comres. dll,-2797 - Unknown owner - C:\Windows\System32\msdtc. exe O23 - Service: @%SystemRoot%\System32\netlogon. dll,-102 - Unknown owner - C:\Windows\system32\lsass. exe O23 - Service: nProtect GameGuard Service - Unknown owner - C:\Windows\system32\GameMon. des. exe O23 - Service: NVIDIA Display Driver Service - Unknown owner - C:\Windows\system32\nvvsvc. exe O23 - Service: @%systemroot%\system32\psbase. dll,-300 - Unknown owner - C:\Windows\system32\lsass. exe O23 - Service: @%systemroot%\system32\Locator. exe,-2 - Unknown owner - C:\Windows\system32\locator. exe O23 - Service: @%SystemRoot%\system32\samsrv. dll,-1 - Unknown owner - C:\Windows\system32\lsass. exe O23 - Service: @%SystemRoot%\system32\snmptrap. exe,-3 - Unknown owner - C:\Windows\System32\snmptrap. exe O23 - Service: @%systemroot%\system32\spoolsv. exe,-1 - Unknown owner - C:\Windows\System32\spoolsv. exe O23 - Service: @%SystemRoot%\system32\sppsvc. exe,-101 - Unknown owner - C:\Windows\system32\sppsvc. exe O23 - Service: NVIDIA Stereoscopic 3D Driver Service - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr. exe O23 - Service: @%SystemRoot%\system32\ui0detect. exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect. exe O23 - Service: Bitdefender Desktop Update Service - Bitdefender - C:\Program Files\Bitdefender\Bitdefender\updatesrv. exe O23 - Service: @%SystemRoot%\system32\vaultsvc. dll,-1003 - Unknown owner - C:\Windows\system32\lsass. exe O23 - Service: @%SystemRoot%\system32\vds. exe,-100 - Unknown owner - C:\Windows\System32\vds. exe O23 - Service: @%systemroot%\system32\vssvc. exe,-102 - Unknown owner - C:\Windows\system32\vssvc. exe O23 - Service: Bitdefender Virus Shield - Bitdefender - C:\Program Files\Bitdefender\Bitdefender\vsserv. exe O23 - Service: @%SystemRoot%\system32\Wat\WatUX. exe,-601 - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc. exe O23 - Service: @%systemroot%\system32\wbengine. exe,-104 - Unknown owner - C:\Windows\system32\wbengine. exe O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv. exe,-110 - Unknown owner - C:\Windows\system32\wbem\WmiApSrv. exe O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk. exe,-101 - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk. exe -- End of file - 8157 bytes Son düzenleyen: Moderatör: 19 Ağustos 2014

Musallat gibi dandik editlenmiş virüslerden tut sağlam trojanlara kadar sistemine bulaşmış. 1. Adım: http://download.geo. drweb.com/pub/drweb/livecd/drweb-livecd-602. iso indirip CD veya USB ye yazdırın. Bootable edip sisteminizi boot üzerinden tam tarama gerçekleştirin. 2. Adım: HijackThis Log Paylaşımı ve Çözümleri | Technopat Sosyal ilgili logu ekleyiniz.

Verdiğim satırları işaretleyip fixleyiniz. Kod:Panoya kopyala C:\Users\USER\AppData\Roaming\DRPSu\DrvUpdater. exe C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl. exe O2 - BHO: Bitdefender Wallet - - C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxie. dll O2 - BHO: Java Plug-In SSV Helper - - C:\Program Files (x86)\Java\jre7\bin\ssv. dll O2 - BHO: - - O2 - BHO: Java Plug-In 2 SSV Helper - - C:\Program Files (x86)\Java\jre7\bin\jp2ssv. dll O3 - Toolbar: - - O3 - Toolbar: Yandex Elements - - O4 - HKLM\..\Run: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM. exe" O4 - HKCU\..\Run: C:\Users\USER\AppData\Roaming\DRPSu\DrvUpdater. exe /hide O9 - Extra button: Add to VideoGet - - C:\PROGRA 2\NUCLEA 1\VideoGet\Plugins\VIDEOG 1. DLL O9 - Extra 'Tools' menuitem: Add to &VideoGet - - C:\PROGRA 2\NUCLEA 1\VideoGet\Plugins\VIDEOG 1. DLL O9 - Extra button: Ara&

Verdiğim satırları işaretleyip fixleyiniz. Kod:Panoya kopyala C:\Users\USER\AppData\Roaming\DRPSu\DrvUpdater. exe C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl. exe O2 - BHO: Bitdefender Wallet - - C:\Program Files\Bitdefender\Bitdefender\Antispam32\pmbxie. dll O2 - BHO: Java Plug-In SSV Helper - - C:\Program Files (x86)\Java\jre7\bin\ssv. dll O2 - BHO: - - O2 - BHO: Java Plug-In 2 SSV Helper - - C:\Program Files (x86)\Java\jre7\bin\jp2ssv. dll O3 - Toolbar: - - O3 - Toolbar: Yandex Elements - - O4 - HKLM\..\Run: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM. exe" O4 - HKCU\..\Run: C:\Users\USER\AppData\Roaming\DRPSu\DrvUpdater. exe /hide O9 - Extra button: Add to VideoGet - - C:\PROGRA 2\NUCLEA 1\VideoGet\Plugins\VIDEOG 1. DLL O9 - Extra 'Tools' menuitem: Add to &VideoGet - - C:\PROGRA 2\NUCLEA 1\VideoGet\Plugins\VIDEOG 1. DLL O9 - Extra button: Ara&#351;t&#305;r - - C:\PROGRA 2\MICROS 2\OFFICE11\REFIEBAR. DLL O23 - Service: Adobe Acrobat Update Service - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc. exe O23 - Service: Adobe Flash Player Update Service - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService. exe O23 - Service: IePlugin Service - Cherished Technololgy LIMITED - C:\ProgramData\IePluginService\PluginService. exe O23 - Service: nProtect GameGuard Service - Unknown owner - C:\Windows\system32\GameMon. des. exe Aktif olarak BitDefender ve Eset yazılımları gözükmekte 2 yazılım çakışma yaratır. Tavsiyem ikisini de kaldırıp 360 Internet Security kurmanızdan yanadır. AdwCleaner ile Reklam Temizliği | Technopat Sosyal Yönergeye uygun olarak uygulayınız. Oluşan raporu buraya ekleyin. Malwarebytes : Free anti-malware download buradan AntiMalwareyi indirip, güncelle ve kur. Kurulumun sonunda Pro seçeneği aktif edilsin tiki işaretlidir. O tiki kaldırıp öyle kurulumu tamamlayın. Yani free olarak kullanın. İnternet bağlantısını kesin. Derin Tarama yapıp tarama sonucunda bulunan zararlıları "Seçimi kaldır" diyerek temizleyin. Temizleme sonucunda oluşan raporu buraya ekleyin.

1. adım yeterli oacaktır ancak Mıller'in 2. adımının yanında şunları da yaparsan iyi olur: Herdprotect txt Raporu Oluşturma | Technopat Sosyal GetSystemİnfo Rapor Oluşturma Resimli Anlatım | Technopat Sosyal

Arkadaşlar bilgisayarımda görev yöneticisi yöneticiniz tarafından devre dışı bırakıldı, kayıt defteri yöneticiniz tarafından devre dışı bırakıldı diyor. Combofix ile tarattı. İşte sonuçlar: Kod:Panoya kopyala ComboFix 14-08-02.02 - USER 02.08.2014 17:06:10.2.4 - x64 Microsoft Windows 7 Ultimate 6.1.7601.1.1254.90.1055.18.4078.2595 Running from: c:\users\USER\Downloads\ComboFix. exe AV: ESET NOD32 Antivirus 7.0 Disabled/Updated SP: ESET NOD32 Antivirus 7.0 Disabled/Updated SP: Windows Defender Enabled/Outdated . . . . C:\aqbhi. pif C:\autorun. inf C:\evhqm. pif C:\gviw. pif C:\hqam. pif C:\kmfiuv. pif C:\ktkhpt. pif c:\programdata\AMMYY c:\programdata\AMMYY\settings3. bin C:\qfwe. pif C:\smgbhx. pif C:\tpvyt. pif C:\uhssn. pif c:\users\USER\AppData\Roaming\Adobe\ndsm. exe c:\users\USER\AppData\Roaming\Identities\ndsm. exe C:\usqxrc. pif C:\vitoug. pif C:\xybu. pif D:\autorun. inf. File Replicators. c:\users\USER\AppData\Roaming\MusaLLaT. exe c:\users\USER\Desktop\Pro Evolution Soccer 2013\Pro Evolution Soccer 2013. exe c:\users\USER\Desktop\Pro Evolution Soccer 2013\save\save. exe c:\users\USER\Documents\AutomaticSolution Software\GSAutoClicker\conf\conf. exe c:\users\USER\Documents\Belgelerim. exe c:\users\USER\Documents\Ghost Games\Need for Speed Rivals\settings\settings. exe c:\users\USER\Documents\KONAMI\Pro Evolution Soccer 2013\Pro Evolution Soccer 2013. exe c:\users\USER\Documents\KONAMI\Pro Evolution Soccer 2013\save\save. exe c:\users\USER\Documents\KONAMI\Pro Evolution Soccer 2013\save1\save. exe c:\users\USER\Documents\KONAMI\Pro Evolution Soccer 2013\save1\save1. exe c:\users\USER\Documents\My Downloaded Video\My Downloaded Video. exe c:\users\USER\Documents\My Games\Far Cry 3\Far Cry 3. exe c:\users\USER\Documents\My Games\Skyrim\Saves\Saves. exe c:\users\USER\Documents\My Games\Skyrim\Skyrim. exe c:\users\USER\Documents\My Games\Watch_Dogs\RLD!\RLD!. exe c:\users\USER\Pictures\Resimlerim. exe d:\pes13\Pro. Evolution. Soccer.2013. Proper-RELOADED\Pro. Evolution. Soccer.2013. Proper-RELOADED. exe d:\watch. dogs-reloaded\DVD1\DVD1. exe d:\watch. dogs-reloaded\DVD2\DVD2. exe d:\watch. dogs-reloaded\DVD3\DVD3. exe d:\watch. dogs-reloaded\Watch. Dogs-RELOADED. exe d:\watch_dogs\bin\bin. exe d:\watch_dogs\data_win64\data_win64. exe d:\watch_dogs\data_win64\worlds\windy_city\windy_city. exe d:\watch_dogs\Support\DirectX\DirectX. exe d:\watch_dogs\Support\dotNetFramework\dotNetFramework. exe d:\watch_dogs\Support\dotNetFramework\dotNetFX35\ia64\ia64. exe d:\watch_dogs\Support\dotNetFramework\dotNetFX35\x64\x64. exe d:\watch_dogs\Support\dotNetFramework\dotNetFX35\x86\x86. exe d:\watch_dogs\Support\dotNetFramework\dotNetMSP\dotNetMSP. exe d:\watch_dogs\Support\dotNetFramework\dotNetMSP\ia64\ia64. exe d:\watch_dogs\Support\dotNetFramework\dotNetMSP\x64\x64. exe d:\watch_dogs\Support\dotNetFramework\dotNetMSP\x86\x86. exe d:\watch_dogs\Support\dotNetFramework\Tools\Tools. exe d:\watch_dogs\Support\GameLauncher\GameLauncher. exe d:\watch_dogs\Support\Icons\Icons. exe d:\watch_dogs\Support\KB971512\KB971512. exe d:\watch_dogs\Support\License\Chinese\Chinese. exe d:\watch_dogs\Support\License\Czech\Czech. exe d:\watch_dogs\Support\License\Danish\Danish. exe d:\watch_dogs\Support\License\Dutch\Dutch. exe d:\watch_dogs\Support\License\English \English . exe d:\watch_dogs\Support\License\English \English . exe d:\watch_dogs\Support\License\English \English . exe d:\watch_dogs\Support\License\English\English. exe d:\watch_dogs\Support\License\Finnish\Finnish. exe d:\watch_dogs\Support\License\French \French . exe d:\watch_dogs\Support\License\French\French. exe d:\watch_dogs\Support\License\German\German. exe d:\watch_dogs\Support\License\Hungarian\Hungarian. exe d:\watch_dogs\Support\License\Italian\Italian. exe d:\watch_dogs\Support\License\Japanese\Japanese. exe d:\watch_dogs\Support\License\Korean\Korean. exe d:\watch_dogs\Support\License\Norwegian\Norwegian. exe d:\watch_dogs\Support\License\Polish\Polish. exe d:\watch_dogs\Support\License\Portuguese \Portuguese . exe d:\watch_dogs\Support\License\Portuguese\Portuguese. exe d:\watch_dogs\Support\License\Russian\Russian. exe d:\watch_dogs\Support\License\Spanish\Spanish. exe d:\watch_dogs\Support\License\Swedish\Swedish. exe d:\watch_dogs\Support\Manual\Chinese\Chinese. exe d:\watch_dogs\Support\Manual\Czech\Czech. exe d:\watch_dogs\Support\Manual\Danish\Danish. exe d:\watch_dogs\Support\Manual\Dutch\Dutch. exe d:\watch_dogs\Support\Manual\English\English. exe d:\watch_dogs\Support\Manual\Finnish\Finnish. exe d:\watch_dogs\Support\Manual\French\French. exe d:\watch_dogs\Support\Manual\German\German. exe d:\watch_dogs\Support\Manual\Hungarian\Hungarian. exe d:\watch_dogs\Support\Manual\Italian\Italian. exe d:\watch_dogs\Support\Manual\Japanese\Japanese. exe d:\watch_dogs\Support\Manual\Korean\Korean. exe d:\watch_dogs\Support\Manual\Norwegian\Norwegian. exe d:\watch_dogs\Support\Manual\Polish\Polish. exe d:\watch_dogs\Support\Manual\Portuguese \Portuguese . exe d:\watch_dogs\Support\Manual\Portuguese\Portuguese. exe d:\watch_dogs\Support\Manual\Russian\Russian. exe d:\watch_dogs\Support\Manual\Spanish\Spanish. exe d:\watch_dogs\Support\Manual\Swedish\Swedish. exe d:\watch_dogs\Support\Readme\Chinese\Chinese. exe d:\watch_dogs\Support\Readme\Czech\Czech. exe d:\watch_dogs\Support\Readme\Danish\Danish. exe d:\watch_dogs\Support\Readme\Dutch\Dutch. exe d:\watch_dogs\Support\Readme\English\English. exe d:\watch_dogs\Support\Readme\Finnish\Finnish. exe d:\watch_dogs\Support\Readme\French\French. exe d:\watch_dogs\Support\Readme\German\German. exe d:\watch_dogs\Support\Readme\Hungarian\Hungarian. exe d:\watch_dogs\Support\Readme\Italian\Italian. exe d:\watch_dogs\Support\Readme\Japanese\Japanese. exe d:\watch_dogs\Support\Readme\Korean\Korean. exe d:\watch_dogs\Support\Readme\Norwegian\Norwegian. exe d:\watch_dogs\Support\Readme\Polish\Polish. exe d:\watch_dogs\Support\Readme\Portuguese \Portuguese . exe d:\watch_dogs\Support\Readme\Portuguese\Portuguese. exe d:\watch_dogs\Support\Readme\Russian\Russian. exe d:\watch_dogs\Support\Readme\Spanish\Spanish. exe d:\watch_dogs\Support\Readme\Swedish\Swedish. exe d:\watch_dogs\Support\VCRedist\VCRedist. exe. . ((((((((((((((((((((((((( Files Created from 2014-07-02 to 2014-08-02 ))))))))))))))))))))))))))))))) . . 2014-08-02 14:10. 2014-08-02 14:10 d w- c:\users\Public\AppData\Local\temp 2014-08-02 14:10. 2014-08-02 14:10 d w- c:\users\Default\AppData\Local\temp 2014-08-02 14:10. 2014-08-02 14:10 d w- c:\users\AppData\AppData\Local\temp 2014-08-02 13:18. 2014-08-02 13:19 d w- c:\program files\CCleaner 2014-07-30 15:05. 2014-07-30 15:05 d w- c:\users\USER\AppData\Roaming\Unity 2014-07-30 15:03. 2014-07-30 15:03 d w- c:\users\USER\AppData\Local\Unity 2014-07-14 16:37. 2014-07-14 16:54 d w- c:\users\USER\AppData\Local\dof 2014-07-11 19:17. 2014-07-11 19:17 d w- c:\windows\Sun. . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-07-11 13:17. 2014-06-10 08:28 281688 a-w- c:\windows\SysWow64\PnkBstrB. xtr 2014-07-09 08:44. 2014-05-13 10:12 699056 a-w- c:\windows\SysWow64\FlashPlayerApp. exe 2014-07-09 08:44. 2014-01-24 09:04 71344 a-w- c:\windows\SysWow64\FlashPlayerCPLApp. cpl 2014-07-07 13:17. 2014-06-10 08:28 281688 a-w- c:\windows\SysWow64\PnkBstrB. ex0 2014-05-16 19:02. 2014-05-16 19:02 7680 a-w- c:\windows\SysWow64\engine. dll 2014-05-13 17:26. 2014-05-13 17:26 103140 --sh--r- C:\mvaja. exe 2014-05-13 17:26. 2014-05-13 17:26 7876 a-w- c:\windows\zmbr. vbs. . . . Note empty entries & legit default entries are not shown REGEDIT4. 2014-04-11 02:05 513648 a-w- c:\program files (x86)\SupTab\SupTab. dll. "DrvUpdater"="c:\users\USER\AppData\Roaming\DRPSu\DrvUpdater. exe" "Keyboard Inf."="c:\users\USER\AppData\Roaming\Media Center Programs\ndsm. exe" . "StartCCC"="c:\program files (x86)\ATI Technologies\ATI. ACE\Core-Static\CLIStart. exe" "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM. exe" . "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) . "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM. exe" "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched. exe" . "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 "UacDisableNotify"=dword:00000001. "AntiVirusOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "FirewallDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "UacDisableNotify"=dword:00000001. R2 clr_optimization_v4.0.30319_64;Microsoft. NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft. NET\Framework64\v4.0.30319\mscorsvw. exe;c:\windows\Microsoft. NET\Framework64\v4.0.30319\mscorsvw. exe R2 IePluginService;IePlugin Service;c:\programdata\IePluginService\PluginService. exe;c:\programdata\IePluginService\PluginService. exe R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc. sys;c:\windows\SYSNATIVE\drivers\dmvsc. sys R3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs. sys;c:\windows\SYSNATIVE\drivers\massfilter_hs. sys R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon. des;c:\windows\SYSNATIVE\GameMon. des R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport. sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport. sys R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60. sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60. sys R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620. sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620. sys R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc. sys;c:\windows\SYSNATIVE\drivers\synth3dvsc. sys R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60. sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60. sys R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt. sys;c:\windows\SYSNATIVE\drivers\terminpt. sys R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt. sys;c:\windows\SYSNATIVE\drivers\tsusbflt. sys R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD. sys;c:\windows\SYSNATIVE\drivers\TsUsbGD. sys R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub. sys;c:\windows\SYSNATIVE\drivers\tsusbhub. sys R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd. sys;c:\windows\SYSNATIVE\drivers\rdvgkmd. sys R3 WatAdminSvc;Windows Etkinleştirme Teknolojileri Hizmeti;c:\windows\system32\Wat\WatAdminSvc. exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc. exe R3 zghsmdm;ZTE General Handset USB Modem Proprietary;c:\windows\system32\DRIVERS\zghsmdm. sys;c:\windows\SYSNATIVE\DRIVERS\zghsmdm. sys R5 ekrn;ESET Service2 ;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn. exe;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn. exe S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd. sys;c:\windows\\SystemRoot\System32\Drivers\sptd. sys S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01. sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01. sys S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm. sys;c:\windows\SYSNATIVE\DRIVERS\eamonm. sys S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv. sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv. sys S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI. ACE\Fuel\Fuel. Service. exe;c:\program files\ATI Technologies\ATI. ACE\Fuel\Fuel. Service. exe S2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI. ACE\Fuel\amd64\AODDriver2. sys;c:\program files\ATI Technologies\ATI. ACE\Fuel\amd64\AODDriver2. sys S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60. sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60. sys S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr. exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr. exe S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64. sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64. sys S3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C60x64. sys;c:\windows\SYSNATIVE\DRIVERS\L1C60x64. sys S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter. sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter. sys . . 2014-07-18 17:56 1104200 a-w- c:\program files (x86)\Google\Chrome\Application\36.0.1985.125\Installer\chrmstp. exe. Contents of the 'Scheduled Tasks' folder. 2014-08-02 c:\windows\Tasks\Adobe Flash Player Updater. job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService. exe . 2014-07-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2480348906-3920511546-3670573113-1000Core. job - c:\users\USER\AppData\Local\Facebook\Update\FacebookUpdate. exe . 2014-08-01 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2480348906-3920511546-3670573113-1000UA. job - c:\users\USER\AppData\Local\Facebook\Update\FacebookUpdate. exe . 2014-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore. job - c:\program files (x86)\Google\Update\GoogleUpdate. exe . 2014-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA. job - c:\program files (x86)\Google\Update\GoogleUpdate. exe . . X64 Entries. . "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64. exe" "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui. exe" . Supplementary Scan. uLocal Page = c:\windows\system32\blank.htm uStart Page = www.google.com.tr mDefault_Search_URL = hxxp://istart. webssearches.com/web/?type=ds&ts=1399976280&from=amt&uid=ST250DM001XHD253GJ_S24JJX0D801826&q= mDefault_Page_URL = hxxp://istart. webssearches.com/?type=hp&ts=1399976280&from=amt&uid=ST250DM001XHD253GJ_S24JJX0D801826 mStart Page = hxxp://istart. webssearches.com/?type=hp&ts=1399976280&from=amt&uid=ST250DM001XHD253GJ_S24JJX0D801826 mLocal Page = c:\windows\SysWOW64\blank.htm mSearch Page = hxxp://istart. webssearches.com/web/?type=ds&ts=1399976280&from=amt&uid=ST250DM001XHD253GJ_S24JJX0D801826&q= IE: Microsoft Excel'e Gö&nder - c:\progra 2\MICROS 2\OFFICE11\EXCEL. EXE/3000 TCP: DhcpNameServer = 192.168.1.1 TCP: Interfaces\ : NameServer = 198.153.192.1,198.153.194.1. - - - - ORPHANS REMOVED - - - - . BHO- - Toolbar- - Toolbar- - Wow6432Node-HKCU-Run-MusaLLaT - c:\users\USER\AppData\Roaming\MusaLLaT. exe AddRemove-Uplay - c:\program files (x86)\Ubisoft\Ubisoft Game Launcher\Uninstall. exe AddRemove-Uplay Install 274 - c:\program files (x86)\Ubisoft\Ubisoft Game Launcher\Uplay. exe. . . "ImagePath"="c:\windows\system32\GameMon. des -service" . LOCKED REGISTRY KEYS. @Denied: (A 2) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX. exe,-101" . "Enabled"=dword:00000001. @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX. exe" . @=" " . @Denied: (A 2) @="IFlashBroker5" . @=" " . @=" " "Version"="1.0" . @Denied: (A 2) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX. exe,-101" . "Enabled"=dword:00000001. @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX. exe" . @=" " . @Denied: (A 2) @="Shockwave Flash Object" . @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145. ocx" "ThreadingModel"="Apartment" . @="0" . @="ShockwaveFlash. ShockwaveFlash.14" . @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145. ocx, 1" . @=" " . @="1.0" . @="ShockwaveFlash. ShockwaveFlash" . @Denied: (A 2) @="Macromedia Flash Factory Object" . @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145. ocx" "ThreadingModel"="Apartment" . @="FlashFactory. FlashFactory.1" . @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145. ocx, 1" . @=" " . @="1.0" . @="FlashFactory. FlashFactory" . @Denied: (A 2) @="IFlashBroker5" . @=" " . @=" " "Version"="1.0" . @Denied: @Denied: @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000. @Denied: . Other Running Processes. c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc. exe c:\users\USER\AppData\Local\Temp\kryxblvmtcmu\ofbxozgfziel. exe. . Completion time: 2014-08-02 17:14:41 - machine was rebooted ComboFix-quarantined-files. txt 2014-08-02 14:14 ComboFix2. txt 2014-05-02 12:55 ComboFix3. txt 2014-04-24 15:09. Pre-Run: 84.112.875.520 bayt boş Post-Run: 83.809.832.960 bayt boş. - - End Of File - - 6E13ACB907F5C6E998DC22BE9D470D0E A36C5E4F47E84449FF07ED3517B43A31 Yardımcı olabilecek var mı? Son düzenleyen: Moderatör: 19 Ağustos 2014