YARDIM LÜTFEN
COMBOFİX TARAFINDAN ULAŞILAN SONUÇ
ComboFix 08-10-17.01 - H Z E 2009-02-07 22:55:59.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1254.1.1055.18.493 [GMT 2:00]
Running from: C:\Documents and Settings\H Zr E\Desktop\Programlar\ComboFix.exe
[COLOR=RED]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/COLOR]
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\Turkojan
C:\Program Files\Turkojan\Binder & zibabina_MAINICON.ico
C:\Program Files\Turkojan\Client.exe
C:\Program Files\Turkojan\Client_MAINICON.ico
C:\Program Files\Turkojan\English.lng
C:\Program Files\Turkojan\exe2jpg_1.ico
C:\Program Files\Turkojan\German.lng
C:\Program Files\Turkojan\Launcher_128.ico
C:\Program Files\Turkojan\MESAJ.DAT
C:\Program Files\Turkojan\msnmsgr_1.ico
C:\Program Files\Turkojan\Piano Kristal_MAINICON.ico
C:\Program Files\Turkojan\Portuguese.lng
C:\Program Files\Turkojan\readme.rtf
C:\Program Files\Turkojan\Spanish.lng
C:\Program Files\Turkojan\Turkce.lng
C:\Program Files\Turkojan\turkojan.ini
C:\Program Files\Turkojan\unins000.dat
C:\Program Files\Turkojan\unins000.exe
C:\WINDOWS\system32\ckvo.exe
C:\WINDOWS\system32\ckvo0.dll
C:\WINDOWS\system32\ckvo1.dll
C:\WINDOWS\system32\winio.vxd
.
((((((((((((((((((((((((( Files Created from 2009-01-07 to 2009-02-07 )))))))))))))))))))))))))))))))
.
2009-02-07 18:23 . 2008-06-18 20:14
d-------- C:\Documents and Settings\Administrator\Sık Kullanılanlar
2009-02-07 18:23 . 2008-06-18 20:14 d-------- C:\Documents and Settings\Administrator\Belgelerim
2009-02-07 18:23 . 2009-02-07 18:23 d-------- C:\Documents and Settings\Administrator
2009-02-05 19:24 . 2009-02-07 22:38 d--hs---- C:\WINDOWS\system32\Sys32
2009-02-05 18:03 . 2009-02-07 22:08 d-------- C:\Program Files\Metin2_Turkey
2009-02-04 19:56 . 2009-02-04 19:56 d--hs---- C:\Documents and Settings\H Z E\UserData
2009-02-04 17:20 . 2001-08-10 09:15 8,025 --a------ C:\kill_amvo_virus_usb_en.vbs
2009-02-04 17:12 . 2008-05-30 20:00 5,572 --a------ C:\sil_01062008.bat
2009-02-03 14:27 . 2009-02-03 14:27 d-------- C:\Program Files\Opera
2009-02-02 16:13 . 2009-02-02 16:14 d-------- C:\Program Files\InstantDemo
2009-02-02 15:56 . 2009-02-02 15:56 d-------- C:\Program Files\SnadBoy's Revelation v2
2009-02-02 15:51 . 2009-02-02 16:20 d-------- C:\Program Files\SuperScan
2009-01-23 03:18 . 2009-01-23 03:18 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2009-01-17 14:11 . 2009-01-17 14:11 d-------- C:\Program Files\AirTies
2009-01-17 14:11 . 2009-01-17 14:11 d-------- C:\Documents and Settings\All Users\Application Data\AirTies
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-07 20:53 --------- d-----w C:\Program Files\FlashGet
2009-02-07 19:24 196,608 ----a-w C:\WINDOWS\system32\drivers\aStandard.bin
2009-02-05 12:04 --------- d-----w C:\Documents and Settings\H Z E\Application Data\Xfire
2009-02-05 11:44 188,848 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2009-02-05 11:44 138,064 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2009-02-03 09:58 --------- d-----w C:\Program Files\WinPcap
2009-01-30 14:12 --------- d-----w C:\Program Files\Xfire
2009-01-27 08:22 72,748 ----a-w C:\WINDOWS\unins000.exe
2009-01-26 12:51 --------- d-----w C:\Documents and Settings\H Z E\Application Data\FileZilla
2009-01-26 10:47 --------- d-----w C:\Program Files\Dynamic HTML Editor
2009-01-24 14:38 --------- d-----w C:\Program Files\CCleaner
2009-01-17 12:11 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-12-20 16:19 70,968 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-12-08 09:24 --------- d-----w C:\Documents and Settings\H Z E\Application Data\XnView
2008-10-27 16:10 59,216 ----a-w C:\Documents and Settings\H Z E\Application Data\GDIPFONTCACHEV1.DAT
.
------- Sigcheck -------
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 6a603809f598332dbedd535bdbce313e C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-06-20 921600]
"Flashget"="C:\Program Files\FlashGet\FlashGet.exe" [2007-09-25 2007088]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"VAKK Agent"="C:\WINDOWS\system32\Sys32\VAKK.exe" [2009-02-05 486912]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]
C:\Documents and Settings\All Users\Start Menu\Programlar\BaŸlang#141;‡Adsl Hizmet Program#141;.lnk - C:\Program Files\AirTies\Adsl Hizmet Program#141;\AdslUtility.exe [2009-01-17 4450304]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm
"VIDC.XFR1"= xfcodec.dll
[HKLM\~\startupfolder\C:^Documents and Settings^H Z E^Start Menu^Programlar^Başlangıç^Xfire.lnk]
path=C:\Documents and Settings\H Z E\Start Menu\Programlar\Başlangıç\Xfire.lnk
backup=C:\WINDOWS\pss\Xfire.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\antisansurv1.1]
--a------ 2008-07-16 07:38 248832 C:\Program Files\Anti Sansur\antisansur.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
--a------ 2008-02-20 16:33 963072 C:\Program Files\Ares\Ares.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
--a------ 2006-09-25 08:12 90112 C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-07-24 17:02 490952 C:\Program Files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2008-09-03 13:28 133104 C:\Documents and Settings\H Z E\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ManyCam]
--a------ 2008-06-10 07:57 1692968 C:\Program Files\ManyCam 2.2\ManyCam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-08-03 23:57 1667584 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-01-19 11:55 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
--a------ 2008-06-17 15:00 1249280 C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
--a------ 2008-08-11 07:31 1124352 C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-03-25 03:28 144784 C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
-r------- 2005-05-03 12:43 69632 C:\WINDOWS\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
-r------- 2006-11-14 11:21 16270848 C:\WINDOWS\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
-r------- 2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Ares\\Ares.exe"=
"C:\\Program Files\\Hamachi\\hamachi.exe"=
"C:\\Program Files\\FlashGet\\flashget.exe"=
"C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
R2 NtfsSvc;Microsoft NtfsSvc Manager Service;C:\WINDOWS\System\updates.exe [2009-02-07 36864]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;C:\WINDOWS\system32\DRIVERS\ManyCam.sys [2008-01-14 21632]
R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2006-09-29 10752]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-11-14 34448]
S3 XDva136;XDva136;C:\WINDOWS\system32\XDva136.sys [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5b119df4-42b7-11dd-ad1a-0016e6dfb425}]
\Shell\AutoRun\command - q.com
\Shell\explore\Command - q.com
\Shell\open\Command - q.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5fd5c41d-7a5d-11dd-ada9-0016e6dfb425}]
\Shell\AutoRun\command - H:\81d9.exe
\Shell\explore\Command - H:\81d9.exe
\Shell\open\Command - H:\81d9.exe
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
2009-02-07 C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-842925246-854245398-682003330-1003.job
- C:\Documents and Settings\H Z E\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 13:28]
.
- - - - ORPHANS REMOVED - - - -
BHO-{140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
BHO-{4B0FAF5A-67C4-4625-AE07-B0DBADA16EBF} - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Hasan Zafer Elcik\Application Data\Mozilla\Firefox\Profiles\v62zqj5d.defaultFireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com.tr/
FF -: plugin - C:\Documents and Settings\Hasan Zafer Elcik\Application Data\Mozilla\Firefox\Profiles\v62zqj5d.default\extensions\[email=yyginstantplay@yoyogames.com]yyginstantplay@yoyogames.com[/email]\plugins\NPYYGInstantPlay.dll
FF -: plugin - C:\Documents and Settings\H Z E\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NpFp415.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NpFp501.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NpFv415.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NpFv41629.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-07 22:56:25
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gaopdxserv.sys]
"imagepath"="\systemroot\system32\drivers\gaopdxqlamttko.sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2009-02-07 22:57:44
ComboFix-quarantined-files.txt 2009-02-07 20:57:42
Pre-Run: 24.669.204.480 bayt boş
Post-Run: 24,721,809,408 bayt boş
arkadaşım ya sen kaşınmışsın turkojen programını yüklemişsin yada biri sana keylogge göndermiş eset 3.0 veya kis09 la tara
