Kardeşim ben yokken dosya indirip trojan yemiş..
msconfig den exeyi bulup başlangıcta kapattım ve sildim.
Combofix ile tarattım silindiğine nasıl emin olabiliriz ?
Görev yöneticisindeki işlemler..
ComboFix 14-06-12.01 - efe 13.06.2014 18:57:01.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1254.90.1055.18.8190.6575 [GMT 3:00]
Running from: c:\users\efe\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
SP: Kaspersky Anti-Virus *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Duman
c:\programdata\Duman\setup.rar
c:\programdata\Duman\unrar.exe
c:\users\efe\AppData\Roaming\Complitly
c:\users\efe\AppData\Roaming\Complitly\64\Complitly64.dll
c:\users\efe\AppData\Roaming\Complitly\64\KeepMeUpdated.exe
c:\users\efe\AppData\Roaming\Complitly\Complitly.dll
c:\users\efe\AppData\Roaming\Complitly\KeepMeUpdated.exe
.
.
((((((((((((((((((((((((( Files Created from 2014-05-13 to 2014-06-13 )))))))))))))))))))))))))))))))
.
.
2014-06-13 16:04 . 2014-06-13 16:04 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-06-13 16:04 . 2014-06-13 16:04 -------- d-----w- c:\users\HomeGroupUser$\AppData\Local\temp
2014-06-13 16:04 . 2014-06-13 16:04 -------- d-----w- c:\users\Guest\AppData\Local\temp
2014-06-13 16:04 . 2014-06-13 16:04 -------- d-----w- c:\users\gh\AppData\Local\temp
2014-06-13 16:04 . 2014-06-13 16:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-06-13 16:04 . 2014-06-13 16:04 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2014-06-13 15:53 . 2014-06-13 15:53 -------- d-----w- c:\users\efe\AppData\Roaming\TestApp
2014-06-13 15:53 . 2014-06-13 15:53 -------- d-----w- c:\programdata\PC Tools
2014-06-13 15:52 . 2014-06-13 15:52 -------- d-----w- c:\program files (x86)\MyPC Backup
2014-06-13 15:50 . 2014-06-13 15:50 -------- d-----w- c:\program files (x86)\KeyCryptSDK
2014-06-13 15:50 . 2014-05-07 09:51 25568 ----a-w- c:\windows\system32\drivers\KeyCrypt64.sys
2014-06-13 15:50 . 2014-06-13 15:50 -------- d-----w- c:\users\efe\AppData\Local\AntiLogger Free
2014-06-13 15:50 . 2014-06-13 15:50 -------- d-----w- c:\program files (x86)\Zemana AntiLogger Free
2014-06-13 15:49 . 2014-06-13 15:49 -------- d-----w- c:\program files (x86)\Trojan Remover
2014-06-13 15:49 . 2014-06-13 15:49 -------- d-----w- c:\programdata\Simply Super Software
2014-06-12 14:42 . 2012-06-13 05:00 74344 ----a-w- c:\windows\system32\RtNicProp64.dll
2014-06-12 14:42 . 2012-06-13 05:00 726160 ----a-w- c:\windows\system32\drivers\Rt64win7.sys
2014-06-12 14:16 . 2014-06-12 14:17 -------- d-----w- c:\users\1
2014-06-11 06:14 . 2014-06-11 06:14 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-06-11 06:14 . 2014-06-11 06:14 699056 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-06-09 05:50 . 2014-06-09 05:50 -------- d-----w- c:\users\efe\AppData\Roaming\Hotspot Shield
2014-06-05 03:47 . 2014-06-05 03:47 -------- d-----w- c:\users\efe\AppData\Local\Octoshape
2014-06-04 23:21 . 2014-06-04 23:21 0 ---ha-w- c:\users\efe\AppData\Local\BITB1F2.tmp
2014-06-03 14:21 . 2014-06-03 14:21 -------- d-----w- c:\programdata\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2014-06-03 14:17 . 2014-06-03 14:17 1021916 ----a-w- c:\programdata\Microsoft\Windows\Librarys\wutt.exe
2014-06-02 16:53 . 2014-06-13 09:50 -------- d-----w- c:\users\efe\AppData\Local\DoNotTrackPlus
2014-05-31 17:16 . 2014-06-04 23:19 412672 ----a-w- c:\windows\SysWow64\winnet.exe
2014-05-31 17:16 . 2014-05-31 17:16 413184 ----a-w- c:\windows\system32\winnet.exe
2014-05-31 17:16 . 2014-05-31 17:16 401408 ----a-w- c:\windows\system32\wget.exe
2014-05-31 17:16 . 2014-05-31 17:16 266240 ----a-w- c:\windows\system32\unrar.exe
2014-05-31 15:31 . 2014-05-31 15:31 -------- d-----w- c:\programdata\Yandex
2014-05-31 15:31 . 2014-05-31 15:31 -------- d-----w- c:\users\efe\AppData\Roaming\Opera Software
2014-05-31 15:29 . 2014-05-31 15:29 -------- d-----w- c:\users\efe\AppData\Local\Skillbrains
2014-05-31 15:29 . 2014-01-20 12:26 145792 ----a-w- c:\users\efe\AppData\Local\downloader.exe
2014-05-31 13:21 . 2014-05-31 13:21 1456128 ----a-w- c:\windows\system32\AdobeSystems.exe
2014-05-25 22:27 . 2014-05-17 02:35 44744 ----a-w- c:\windows\system32\drivers\hssdrv6.sys
2014-05-20 23:05 . 2014-05-20 23:05 -------- d-----w- c:\program files (x86)\Common Files\Skype
2014-05-20 15:44 . 2014-06-13 16:06 -------- d-----w- c:\programdata\SafetyNut
2014-05-18 20:15 . 2014-05-18 20:21 -------- d-----w- C:\Rikku Twitter
2014-05-18 15:21 . 2014-05-18 15:21 -------- d-----w- c:\users\efe\AppData\Roaming\SmartFTP
2014-05-18 15:21 . 2014-05-18 15:21 -------- d-----w- c:\program files\SmartFTP Client
2014-05-16 20:43 . 2014-05-16 20:43 -------- d-----w- c:\program files (x86)\Duman
2014-05-16 13:25 . 2014-05-16 13:25 -------- d-----w- c:\users\efe\AppData\Local\Max Secure Software
2014-05-16 13:24 . 2014-05-16 13:25 -------- d-----w- c:\users\efe\AppData\Roaming\GetRightToGo
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-22 10:41 . 2014-04-22 11:40 40792 ----a-w- c:\windows\system32\drivers\iSafeKrnlBoot.sys
2014-05-14 00:01 . 2013-05-14 18:01 17938608 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-04-29 10:20 . 2013-05-02 02:22 19120 ----a-w- c:\windows\system32\roboot64.exe
2014-04-11 17:20 . 2014-04-11 17:20 283064 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2014-04-03 12:09 . 2014-04-03 12:09 4096000 ----a-w- c:\program files (x86)\GUTD1EA.tmp
2014-03-19 17:54 . 2014-03-19 17:54 42184 ----a-w- c:\windows\system32\drivers\taphss6.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110311551178}]
c:\program files (x86)\Torntv 2\Torntv 2-bho.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{1D962FE5-D6D7-850C-A0BA-2A57145F5B52}]
2013-08-04 06:48 118784 ----a-w- c:\programdata\Searchh-NNEwTyaB\51fdf9301a1cd.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{2A5A2A90-3B30-4E6E-A955-2F232C6EF517}]
2013-08-13 10:26 200984 ----a-w- c:\program files (x86)\Movdap\WebCakeIEClient.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
2014-04-11 02:07 513648 ----a-w- c:\program files (x86)\SupTab\SupTab.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{5DC04E0D-575A-6707-16DE-4AC5587B409C}]
2013-08-04 06:50 118784 ----a-w- c:\programdata\SavEnsohhare\51fdf9a06c1b7.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{69EAACF6-14F5-A622-FAAD-5CE129E3CA3E}]
2013-08-04 06:46 118784 ----a-w- c:\programdata\SavEnsohhare\51fdf8e16c383.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{7c11f506-523f-4755-b8f3-a8343d606f2c}]
2014-04-10 08:59 423744 ----a-w- c:\users\efe\AppData\LocalLow\Kurulum_New\prxtbKur2.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{9cf699ca-2174-4ed8-bec1-ba82095edce0}]
c:\program files (x86)\DealPly\DealPlyIE.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}]
2013-03-13 11:00 251288 ----a-w- c:\program files (x86)\Delta\delta\1.8.16.16\bh\delta.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2014-01-31 08:03 1521080 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-06-28 14:46 279552 ----a-w- c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2014-01-31 1521080]
"{91397D20-1446-11D4-8AF4-0040CA1127B6}"= "c:\program files (x86)\Yandex\Elements\bartabhost.dll" [2014-03-25 305952]
"{82E1477C-B154-48D3-9891-33D83C26BCD3}"= "c:\program files (x86)\Delta\delta\1.8.16.16\deltaTlbr.dll" [2013-03-13 325016]
"{7c11f506-523f-4755-b8f3-a8343d606f2c}"= "c:\users\efe\AppData\LocalLow\Kurulum_New\prxtbKur2.dll" [2014-04-10 423744]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{91397d20-1446-11d4-8af4-0040ca1127b6}]
[HKEY_CLASSES_ROOT\Yandex.Toolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{91397D13-1446-11D4-8AF4-0040CA1127B6}]
[HKEY_CLASSES_ROOT\Yandex.Toolbar]
.
[HKEY_CLASSES_ROOT\clsid\{82e1477c-b154-48d3-9891-33d83c26bcd3}]
[HKEY_CLASSES_ROOT\delta.deltadskBnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[HKEY_CLASSES_ROOT\delta.deltadskBnd]
.
[HKEY_CLASSES_ROOT\clsid\{7c11f506-523f-4755-b8f3-a8343d606f2c}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-05-08 21444224]
"YandexElements"="c:\program files (x86)\Yandex\Common\elements64.exe" [2014-03-25 444192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ZALFree"="c:\program files (x86)\Zemana AntiLogger Free\AntiLogger Free.exe" [2014-05-07 12751784]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\progra~2\KEYCRY~1\KeyCrypt32(1).dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
R2 AntiVirSchedulerService;Avira Zamanlayıcı;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
R2 BackupStack;Computer Backup (MyPC Backup);c:\program files (x86)\MyPC Backup\BackupStack.exe;c:\program files (x86)\MyPC Backup\BackupStack.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 dealplylive;Google Güncelleme Hizmeti (dealplylive);c:\program files (x86)\DealPlyLive\Update\DealPlyLive.exe;c:\program files (x86)\DealPlyLive\Update\DealPlyLive.exe [x]
R2 IDMWFP;IDMWFP;c:\windows\system32\DRIVERS\idmwfp.sys;c:\windows\SYSNATIVE\DRIVERS\idmwfp.sys [x]
R3 dealplylivem;Google Güncelleme Hizmeti (dealplylivem);c:\program files (x86)\DealPlyLive\Update\DealPlyLive.exe;c:\program files (x86)\DealPlyLive\Update\DealPlyLive.exe [x]
R3 iSafeKrnlBoot;iSafeKrnl Boot Driver;c:\windows\system32\DRIVERS\iSafeKrnlBoot.sys;c:\windows\SYSNATIVE\DRIVERS\iSafeKrnlBoot.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe;c:\program files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.2);c:\windows\system32\DRIVERS\RtVlan620.sys;c:\windows\SYSNATIVE\DRIVERS\RtVlan620.sys [x]
R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys;c:\windows\SYSNATIVE\DRIVERS\RtTeam60.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R4 Apache2.2;Apache2.2;c:\appserv\Apache2.2\bin\httpd.exe;c:\appserv\Apache2.2\bin\httpd.exe [x]
R4 APNMCP;Ask Update Service;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x]
R4 IePluginService;IePlugin Service;c:\programdata\IePluginService\PluginService.exe;c:\programdata\IePluginService\PluginService.exe [x]
R4 serverqqs;serverqqs;c:\program files (x86)\QQS\serverqqs.exe;c:\program files (x86)\QQS\serverqqs.exe [x]
R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R4 SpliCamService;SplitCamService;c:\splitcam\SplitCamService.exe;c:\splitcam\SplitCamService.exe [x]
R4 TBSrv;Toolbar Service;c:\program files (x86)\Tbccint\ToolbarService\ToolbarService.exe;c:\program files (x86)\Tbccint\ToolbarService\ToolbarService.exe [x]
R4 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
R4 WebCakeUpdater;WebCakeUpdater;c:\program files (x86)\Movdap\WBDesktop.Updater.exe;c:\program files (x86)\Movdap\WBDesktop.Updater.exe [x]
R4 Wpm;Wpm Service;c:\programdata\WPM\wprotectmanager.exe;c:\programdata\WPM\wprotectmanager.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 F06DEFF2-5B9C-490D-910F-35D3A91196222;F06DEFF2-5B9C-490D-910F-35D3A91196222;c:\program files (x86)\Movies Toolbar\SafetyNut\x64\configmgrc1.cfg;c:\program files (x86)\Movies Toolbar\SafetyNut\x64\configmgrc1.cfg [x]
S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys;c:\windows\SYSNATIVE\DRIVERS\hssdrv6.sys [x]
S1 iSafeKrnlKit;iSafeKrnl Kit Driver;c:\program files (x86)\iSafe\iSafeKrnlKit.sys;c:\program files (x86)\iSafe\iSafeKrnlKit.sys [x]
S1 iSafeNetFilter;iSafeNetFilter;c:\program files (x86)\iSafe\iSafeNetFilter.sys;c:\program files (x86)\iSafe\iSafeNetFilter.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 CGVPNCliService;CyberGhost VPN 5 Client Service;c:\program files\CyberGhost 5\Service.exe;c:\program files\CyberGhost 5\Service.exe [x]
S2 desksvc;Desk 365 service;c:\program files (x86)\Desk 365\deskSvc.exe;c:\program files (x86)\Desk 365\deskSvc.exe [x]
S2 hshld;Hotspot Shield Service;c:\program files (x86)\Hotspot Shield\bin\cmw_srv.exe;c:\program files (x86)\Hotspot Shield\bin\cmw_srv.exe [x]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [x]
S2 iSafeService;iSafeService;c:\program files (x86)\iSafe\iSafeSvc.exe;c:\program files (x86)\iSafe\iSafeSvc.exe [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys;c:\windows\SYSNATIVE\drivers\npf.sys [x]
S2 RtNdPt60;Realtek NDIS Protocol Driver;c:\windows\system32\DRIVERS\RtNdPt60.sys;c:\windows\SYSNATIVE\DRIVERS\RtNdPt60.sys [x]
S2 SafetyNutManager;SafetyNut Manager;c:\program files (x86)\Movies Toolbar\SafetyNut\SafetyNutManager.exe;c:\program files (x86)\Movies Toolbar\SafetyNut\SafetyNutManager.exe [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys;c:\windows\SYSNATIVE\DRIVERS\amdiox64.sys [x]
S3 iSafeKrnl;iSafeKrnl;c:\program files (x86)\iSafe\iSafeKrnl.sys;c:\program files (x86)\iSafe\iSafeKrnl.sys [x]
S3 keycrypt;keycrypt;c:\windows\system32\DRIVERS\KeyCrypt64.sys;c:\windows\SYSNATIVE\DRIVERS\KeyCrypt64.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\DRIVERS\mcvidrv.sys;c:\windows\SYSNATIVE\DRIVERS\mcvidrv.sys [x]
S3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv_x64.sys;c:\windows\SYSNATIVE\drivers\mcaudrv_x64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 scvad_simple;SplitCam Virtual Microphone (WDM);c:\windows\system32\drivers\SplitCamAudio.sys;c:\windows\SYSNATIVE\drivers\SplitCamAudio.sys [x]
S3 splitcam_hd_driver;SplitCam Virtual Video Driver;c:\windows\system32\DRIVERS\splitcam_hd_driver.sys;c:\windows\SYSNATIVE\DRIVERS\splitcam_hd_driver.sys [x]
S3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
S3 tapSF0901;Spotflux Virtual Network Device Driver;c:\windows\system32\DRIVERS\tapSF0901.sys;c:\windows\SYSNATIVE\DRIVERS\tapSF0901.sys [x]
S3 VCam_WDM;Virtual Webcam 8.0;c:\windows\system32\DRIVERS\VCam_WDM.sys;c:\windows\SYSNATIVE\DRIVERS\VCam_WDM.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-03-15 22:52 1150280 ----a-w- c:\program files (x86)\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-06-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-06-11 06:14]
.
2014-06-13 c:\windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
- c:\program files (x86)\DealPlyLive\Update\DealPlyLive.exe [2013-08-09 01:10]
.
2014-06-13 c:\windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
- c:\program files (x86)\DealPlyLive\Update\DealPlyLive.exe [2013-08-09 01:10]
.
2014-06-13 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3130709480-2463230449-2478238706-1000Core.job
- c:\users\efe\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-01-08 14:15]
.
2014-06-13 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3130709480-2463230449-2478238706-1000UA.job
- c:\users\efe\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-01-08 14:15]
.
2014-06-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-14 04:45]
.
2014-06-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-03-14 04:45]
.
2014-06-13 c:\windows\Tasks\RegClean Pro_DEFAULT.job
- c:\program files (x86)\RegClean Pro\RegCleanPro.exe [2013-05-02 13:01]
.
2014-06-11 c:\windows\Tasks\RegClean Pro_UPDATES.job
- c:\program files (x86)\RegClean Pro\RegCleanPro.exe [2013-05-02 13:01]
.
2014-06-13 c:\windows\Tasks\Registry Optimizer_DEFAULT.job
- c:\program files (x86)\WinZip Registry Optimizer\Winzipro.exe [2013-06-14 10:20]
.
2014-06-10 c:\windows\Tasks\Registry Optimizer_UPDATES.job
- c:\program files (x86)\WinZip Registry Optimizer\Winzipro.exe [2013-06-14 10:20]
.
2014-06-13 c:\windows\Tasks\RtlNICDiagVistaStart.job
- c:\program files (x86)\Realtek\Realtek Ethernet Diagnostic Utility\8169Diag.exe [2013-03-11 07:13]
.
2014-06-13 c:\windows\Tasks\Torntv 2-codedownloader.job
- c:\program files (x86)\Torntv 2\Torntv 2-codedownloader.exe [2013-08-09 01:06]
.
2014-06-13 c:\windows\Tasks\Torntv 2-enabler.job
- c:\program files (x86)\Torntv 2\Torntv 2-enabler.exe [2013-08-09 14:06]
.
2014-06-13 c:\windows\Tasks\Torntv 2-updater.job
- c:\program files (x86)\Torntv 2\Torntv 2-updater.exe [2013-08-09 01:06]
.
2014-06-13 c:\windows\Tasks\update-S-1-5-21-3130709480-2463230449-2478238706-1000.job
- c:\program files (x86)\Skillbrains\Updater\Updater.exe [2013-03-12 15:44]
.
2014-06-13 c:\windows\Tasks\update-sys.job
- c:\program files (x86)\Skillbrains\Updater\Updater.exe [2013-03-12 15:44]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-06-28 14:46 339456 ----a-w- c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
c:\program files (x86)\Hotspot Shield\HssIE\HssIE_64.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{91397D20-1446-11D4-8AF4-0040CA1127B6}"= "c:\program files (x86)\Yandex\Elements\bartab64host.dll" [2014-03-25 350496]
.
[HKEY_CLASSES_ROOT\CLSID\{91397D20-1446-11D4-8AF4-0040CA1127B6}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-01-30 13:05 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-01-30 13:05 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-01-30 13:05 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-01-30 13:05 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-01-30 13:05 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-01-30 13:05 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IDM Shell Extension]
@="{CDC95B92-E27C-4745-A8C5-64A52A78855D}"
[HKEY_CLASSES_ROOT\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}]
2012-11-15 23:07 23496 ----a-w- c:\program files (x86)\Internet Download Manager\IDMShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\progra~2\KEYCRY~1\KeyCrypt64(1).dll
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.search-v9.com/
uDefault_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=ild&from=ild&uid=SAMSUNGXHD103SJ_S246J9KB925271&ts=1376010430
uDefault_Search_URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1388681988&from=wpm0102&uid=SAMSUNGXHD103SJ_S246J9KB925271&q={searchTerms}
mDefault_Search_URL = hxxp://search.sxe-anticheat.com/
mDefault_Page_URL = hxxp://search.sxe-anticheat.com/
mStart Page = hxxp://search.sxe-anticheat.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://search.sxe-anticheat.com/
uInternet Settings,ProxyOverride = local
IE: Bütün linkleri IDM ile indir - c:\program files (x86)\Internet Download Manager\IEGetAll.htm
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: IDM ile indir - c:\program files (x86)\Internet Download Manager\IEExt.htm
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\efe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IMVU\Run IMVU.lnk
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{2BF9828D-09D7-49A5-A23A-10C2B1B7AADC}: NameServer = 74.207.247.4,64.0.55.201
TCP: Interfaces\{9F4B4A2A-0EBB-4542-99D2-896FC55B5904}: NameServer = 74.207.247.4,64.0.55.201
TCP: Interfaces\{AAA1C6F8-5F2E-424C-BEF3-BFD8D0EC8CFA}: NameServer = 141.211.144.15
FF - ProfilePath - c:\users\efe\AppData\Roaming\Mozilla\Firefox\Profiles\zbyixot9.default-1402467521390\
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run- - (no file)
WebBrowser-{7C11F506-523F-4755-B8F3-A8343D606F2C} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-FM Genie Scout 14_is1 - c:\fm genie scout 14\unins000.exe
AddRemove-RaidCall - c:\program files (x86)\RaidCall\uninst.exe
AddRemove-sXe Injected - c:\program files (x86)\sXe Injected\uninstall.exe
AddRemove-{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693} - c:\programdata\BrowserProtect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe
AddRemove-{4FFBB818-B13C-11E0-931D-B2664824019B}_is1 - c:\program files (x86)\Complitly\unins000.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3130709480-2463230449-2478238706-1000\Software\G*e*n*i*e*"!\FM Genie Scout 14]
"GameDir"="c:\\FM Genie Scout 14\\games"
"ShortlistDir"="c:\\FM Genie Scout 14\\shortlists"
"FMPath"=""
"ScreenshotsDir"="c:\\FM Genie Scout 14"
"SaveDir"="c:\\FM Genie Scout 14\\"
"HistoryDir"="c:\\FM Genie Scout 14\\History Points"
"HistoryAutoTracking"=dword:00000000
"LangDB"="c:\\FM Genie Scout 14\\lang_db.dat"
"LastSaveGame"=""
"Language"="English"
"LoadLangDB"=dword:00000001
"CompressHistoryPoints"=dword:00000000
"HighlightedAttributes"=dword:00000000
"MinCondition"=dword:00000050
"GraphStep"=dword:00000000
"SkinName"="Steklo Black"
"LastUpdateCheck"=dword:0000a2b4
"VersionOf201"=dword:0000007b
"HighQualityGUI"=dword:00000001
"AutomaticallyUpdateCheck"=dword:00000001
"AdvancedGeneration"=dword:00000000
"TranslateStaffSkills"=dword:00000001
"TranslatePlayerSkills"=dword:00000001
"TranslatePositions"=dword:00000001
"ShowHistory"=dword:00000001
"ShowGuidNotification2"=dword:00000000
"ShowQuickGuideNotification"=dword:00000000
"ShowDonateNotification"=dword:00000000
"Version"=dword:0000019c
"UniqueID"="E4-F555-2083"
"UseProxy"=dword:00000000
"ProxyHost"=""
"ProxyPort"=""
"UseAuthentication"=dword:00000000
"UserName"=""
"UserPassword"=""
"PlayerSearchFeatureNum"=dword:00000003
"StaffSearchFeatureNum"=dword:00000002
"ClubSearchFeatureNum"=dword:00000000
"FilterByClubFeatureNum"=dword:00000000
"CompareFeatureNum"=dword:00000000
"ShortlistFeatureNum"=dword:00000000
"ExportFeatureNum"=dword:00000000
"HistoryFeatureNum"=dword:00000000
"LanguageDBFeatureNum"=dword:00000000
"HintsFeatureNum"=dword:00000000
"GenieReportFeatureNum"=dword:00000002
"TopFormationFeatureNum"=dword:00000000
"ScreenshotFeatureNum"=dword:00000000
"AdClicksNum"=dword:00000000
"AdImpressionsNum"=dword:0000001d
"GameLoadedCounter"=dword:00000000
"Currency"=dword:00000056
.
[HKEY_USERS\S-1-5-21-3130709480-2463230449-2478238706-1000\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{9cf699ca-2174-4ed8-bec1-ba82095edce0}"=hex:51,66,7a,6c,4c,1d,3b,1b,da,84,e5,
86,43,75,b7,0a,a6,c2,f8,c2,0b,19,9f,ff
"{11111111-1111-1111-1111-110311551178}"=hex:51,66,7a,6c,4c,1d,3b,1b,01,0c,02,
0b,26,45,7e,55,09,12,53,43,13,12,52,67
"{338A754C-B46E-4BF2-8AC8-23DE36862AD3}"=hex:51,66,7a,6c,4c,1d,38,12,22,76,99,
37,5c,fa,9c,0e,f5,de,60,9e,33,d8,6e,c7
.
[HKEY_USERS\S-1-5-21-3130709480-2463230449-2478238706-1000_Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"scansk"=hex(0):6e,7f,57,5c,c0,08,b5,03,59,4b,01,e7,6f,09,2b,c5,a6,a3,2f,a6,30,
43,7c,34,9d,29,02,56,17,02,16,98,98,52,16,f0,0c,c6,7b,a5,00,00,00,00,00,00,\
.
[HKEY_USERS\S-1-5-21-3130709480-2463230449-2478238706-1000_Classes\Wow6432Node\CLSID\{c772bad0-334a-43eb-ad93-ad2212cf3898}]
@Denied: (Full) (Everyone)
@Allowed: (Read) (RestrictedCode)
"Model"=dword:0000007a
"Therad"=dword:00000020
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,3c,f9,ee,1b,0d,99,e4,d6,74,5e,0c,22,f6,c9,17,b0,e1,a9,a1,64,97,40,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\iSafe\iSafeSvc2.exe
c:\program files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe
c:\program files (x86)\Desk 365\desk365.exe
c:\appserv\MySQL\bin\mysqld.exe
c:\program files (x86)\Movies Toolbar\SafetyNut\safetynut.exe
c:\users\efe\AppData\Local\FilesFrog Update Checker\update_checker.exe
c:\windows\SysWOW64\runonce.exe
.
**************************************************************************
.
Completion time: 2014-06-13 19:10:04 - machine was rebooted
ComboFix-quarantined-files.txt 2014-06-13 16:10
ComboFix2.txt 2014-05-16 13:57
.
Pre-Run: 18.312.454.144 bayt boş
Post-Run: 18.405.687.296 bayt boş
.
- - End Of File - - 0A1011C70CF27B26D44531D091149FD7
A36C5E4F47E84449FF07ED3517B43A31
Combofix logları
