Combofix le pc mi tarattım.

2008'den beri4.007 mesaj

#1
11.04.2009 17:11

Arkadaşlar başlıktaki gibi combofixle pc mi tarattım böle bi sonuç geldi burda yazan tüm dosyalar silindimi yani :S

ComboFix 09-04-04.01 - Administrator 2009-04-11 17:04:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1254.90.1055.18.2047.1655 [GMT 3:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-03-11 to 2009-04-11 )))))))))))))))))))))))))))))))
.

2009-04-08 03:43 . 2009-04-08 03:43 <DIR> d-------- c:\program files\uTorrent
2009-04-08 03:42 . 2009-04-08 04:18 <DIR> d-------- c:\documents and settings\Administrator\Application Data\uTorrent
2009-04-06 04:21 . 2009-04-06 04:21 <DIR> d-------- c:\program files\MajorShare
2009-04-06 04:21 . 2009-04-09 18:11 <DIR> d-------- C:\MS Rapid Downloads
2009-04-04 11:52 . 2009-04-04 11:52 2,932,736 --a------ c:\documents and settings\Administrator\BvtLiveTv.exe
2009-04-02 22:36 . 2009-04-02 22:36 <DIR> d-------- c:\program files\Teamspeak2_RC2
2009-03-29 13:26 . 2009-03-29 13:26 <DIR> d-------- c:\program files\Webteh
2009-03-29 13:26 . 2009-03-29 13:27 <DIR> d-------- c:\documents and settings\Administrator\Application Data\BSplayer
2009-03-28 04:28 . 2009-04-07 19:14 <DIR> d-------- c:\program files\sXe Injected
2009-03-26 17:06 . 2009-03-09 16:27 4,178,264 --a------ c:\windows\system32\D3DX9_41.dll
2009-03-26 17:06 . 2009-03-09 16:27 1,846,632 --a------ c:\windows\system32\D3DCompiler_41.dll
2009-03-26 17:06 . 2009-03-16 15:18 517,448 --a------ c:\windows\system32\XAudio2_4.dll
2009-03-26 17:06 . 2009-03-09 16:27 453,456 --a------ c:\windows\system32\d3dx10_41.dll
2009-03-26 17:06 . 2009-03-16 15:18 235,352 --a------ c:\windows\system32\xactengine3_4.dll
2009-03-26 17:06 . 2009-03-16 15:18 69,448 --a------ c:\windows\system32\XAPOFX1_3.dll
2009-03-26 17:06 . 2009-03-16 15:18 22,360 --a------ c:\windows\system32\X3DAudio1_6.dll
2009-03-26 17:04 . 2009-03-26 17:04 <DIR> d-------- c:\program files\CCleaner
2009-03-25 19:53 . 2009-03-25 19:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-03-24 16:40 . 2009-03-24 16:40 <DIR> d-------- c:\program files\Messenger Plus! Live
2009-03-20 04:14 . 2009-03-20 04:14 <DIR> d--hs---- c:\documents and settings\Administrator\IECompatCache
2009-03-20 04:13 . 2009-03-20 04:13 <DIR> d--hs---- c:\documents and settings\Administrator\PrivacIE
2009-03-20 04:12 . 2009-03-20 04:12 <DIR> d--hs---- c:\documents and settings\NetworkService\IETldCache
2009-03-20 04:12 . 2009-03-20 04:12 <DIR> d--hs---- c:\documents and settings\Administrator\IETldCache
2009-03-20 03:51 . 2009-03-20 03:52 <DIR> d--h-c--- c:\windows\ie8
2009-03-19 10:10 . 2009-02-25 16:15 593,920 --------- c:\windows\system32\ati2sgag.exe
2009-03-19 10:05 . 2009-03-19 10:05 <DIR> d-------- c:\program files\Defraggler

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-11 11:09 --------- d-----w c:\program files\a-squared Free
2009-04-07 11:52 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-06 12:32 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 12:32 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-05 08:59 --------- d-----w c:\documents and settings\Administrator\Application Data\teamspeak2
2009-03-29 10:34 --------- d-----w c:\program files\Java
2009-03-27 06:32 --------- d-----w c:\documents and settings\Administrator\Application Data\LimeWire
2009-03-27 06:00 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-14 05:52 --------- d-----w c:\program files\Common Files\Adobe
2009-03-09 02:19 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-03-08 02:34 914,944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 02:34 43,008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 02:33 420,352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 02:33 18,944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 02:32 72,704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 02:32 71,680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 02:31 48,128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 02:31 45,568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 02:31 34,816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 02:22 156,160 ----a-w c:\windows\system32\msls31.dll
2009-02-26 07:54 --------- d-----w c:\program files\Common Files\Adobe AIR
2009-02-26 07:51 --------- d-----w c:\documents and settings\Administrator\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-02-25 22:58 3,565,568 ----a-w c:\windows\system32\drivers\ati2mtag.sys
2009-02-25 21:42 442,368 ----a-w c:\windows\system32\ATIDEMGX.dll
2009-02-25 21:41 325,120 ----a-w c:\windows\system32\ati2dvag.dll
2009-02-25 21:30 204,800 ----a-w c:\windows\system32\atipdlxx.dll
2009-02-25 21:30 11,841,536 ----a-w c:\windows\system32\atioglxx.dll
2009-02-25 21:29 43,520 ----a-w c:\windows\system32\ati2edxx.dll
2009-02-25 21:29 26,112 ----a-w c:\windows\system32\Ati2mdxx.exe
2009-02-25 21:29 155,648 ----a-w c:\windows\system32\Oemdspif.dll
2009-02-25 21:29 155,648 ----a-w c:\windows\system32\ati2evxx.dll
2009-02-25 21:27 602,112 ----a-w c:\windows\system32\ati2evxx.exe
2009-02-25 21:26 53,248 ----a-w c:\windows\system32\ATIDDC.DLL
2009-02-25 21:16 3,817,984 ----a-w c:\windows\system32\ati3duag.dll
2009-02-25 21:09 307,200 ----a-w c:\windows\system32\atiiiexx.dll
2009-02-25 20:59 2,670,080 ----a-w c:\windows\system32\ativvaxx.dll
2009-02-25 20:44 49,664 ----a-w c:\windows\system32\amdpcom32.dll
2009-02-25 20:40 475,136 ----a-w c:\windows\system32\atikvmag.dll
2009-02-25 20:38 17,408 ----a-w c:\windows\system32\atitvo32.dll
2009-02-25 20:38 126,976 ----a-w c:\windows\system32\atiadlxx.dll
2009-02-25 20:37 53,248 ----a-w c:\windows\system32\drivers\ati2erec.dll
2009-02-25 20:35 290,816 ----a-w c:\windows\system32\atiok3x2.dll
2009-02-25 20:32 626,688 ----a-w c:\windows\system32\ati2cqag.dll
2009-02-25 20:32 45,056 ----a-w c:\windows\system32\aticalrt.dll
2009-02-25 20:32 45,056 ----a-w c:\windows\system32\aticalcl.dll
2009-02-25 20:30 3,227,648 ----a-w c:\windows\system32\aticaldd.dll
2009-02-24 06:57 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-16 03:57 --------- d-----w c:\documents and settings\Administrator\Application Data\Leadertech
2009-02-13 22:36 --------- d-----w c:\program files\NOS
2009-02-13 22:36 --------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-02-13 15:19 --------- d-----w c:\program files\Adobe Reader 9 Installer
2009-02-13 07:28 --------- d-----w c:\program files\K-Lite Codec Pack
2009-02-09 18:56 67,584 ----a-w c:\windows\system32\ff_vfw.dll
2009-02-09 14:05 1,846,784 ----a-w c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"CameraFixer"="c:\windows\CameraFixer.exe" [2005-10-03 20480]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2005-11-04 90112]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-07-23 c:\windows\RTHDCPL.exe]
"SoundMan"="SOUNDMAN.EXE" [2008-06-18 c:\windows\SoundMan.exe]
"AlcWzrd"="ALCWZRD.EXE" [2008-06-19 c:\windows\alcwzrd.exe]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\oyunlarım\\Valve\\hl.exe"=
"c:\\Program Files\\MessengerDiscovery\\MessengerDiscovery Live.exe"=
"d:\\oyunlarım\\Softnyx\\WolfTeam\\Wolfteam.bin"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"d:\\oyunlarım\\alaplaya\\S4League\\S4Client.exe"=
"c:\\Program Files\\Hamachi\\hamachi.exe"=
"d:\\oyunlarım\\Counter-Strike Source\\hl2.exe"=
"d:\\oyunlarım\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"d:\\oyunlarım\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"d:\\oyunlarım\\EA Sports\\FIFA 08\\FIFA08.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com.tr/
TCP: {FE0ECAFC-C799-4673-A9D4-30659445B111} = 208.67.222.222,208.67.220.220
DPF: {D0BB3ACE-4ED3-4D65-BB86-1A0C6CAF351F} - hxxp://212.175.239.246:81/avaLaunch94.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\in58dcc1.default\
FF - prefs.js: browser.startup.homepage - Google
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-11 17:05:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-484763869-362288127-682003330-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c1,85,95,d7,3c,20,ee,4b,87,5b,89,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,c1,85,95,d7,3c,20,ee,4b,87,5b,89,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(764)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-04-11 17:06:26
ComboFix-quarantined-files.txt 2009-04-11 14:06:24

Pre-Run: 33.622.474.752 bayt boş
Post-Run: 33,652,101,120 bayt boş

185 --- E O F --- 2009-03-15 13:55:58

Programı kurduktan sonra varsayılan tarayıcım sıfırlandı firefoxu açınca uyarı verdi tekrar ayarladım ve güvenlik duvarım kapandı,tekrar açtım şimdiye kadar 2 tane etkisini gördüm :S şimdi bu rapordaki dosyalara noldu onu merak ediyorum :S

Rom.

2008'den beri15 bin mesaj

#2
11.04.2009 17:13

combofix'le tarttığın an diğer antivirüs programlarını kapattıysan herhangi bi aksalklık olmamıştır ama sen yine de bi güvenli modda açıp tarat bilgisayarı çünkü bormal oturumda faaliyette olan virüs, solucan v.b mahluklar çalıştığı için silinmemiş de olabiliyor...

acabuco4 Konuyu açan

2008'den beri4.007 mesaj

#3
11.04.2009 17:14

RoMaNTiC ReBeLLiOuS dedi: ↑
combofix'le tarttığın an diğer antivirüs programlarını kapattıysan herhangi bi aksalklık olmamıştır ama sen yine de bi güvenli modda açıp tarat bilgisayarı çünkü bormal oturumda faaliyette olan virüs, solucan v.b mahluklar çalıştığı için silinmemiş de olabiliyor...

ya bnm virüs şikayetim yoktu ölesine canım sıkıldı taratıyım dedim,bu sonuç çıktı ? şimdi orda yazılan tüm exeler dll ler fln silindimi ?

Darknes$

2008'den beri18 bin mesaj

#4
11.04.2009 17:30

acabuco4 dedi: ↑
ya bnm virüs şikayetim yoktu ölesine canım sıkıldı taratıyım dedim,bu sonuç çıktı ? şimdi orda yazılan tüm exeler dll ler fln silindimi ?

Hayır,Raporda Şuan çalışan program vs. ve System32 dosyasindaki exe. , dll'leri ve bunların hangi tarihler arasıdna kurulduğu gösteriyor

Silinen birşey olsaydi Deletions diye yazardi.

acabuco4 Konuyu açan

2008'den beri4.007 mesaj

#5
11.04.2009 17:30

Darknes$ dedi: ↑
Hayır,Raporda Şuan çalışan program vs. ve System32 dosyasindaki exe. , dll'leri ve bunların hangi tarihler arasıdna kurulduğu gösteriyor

Silinen birşey olsaydi Deletions diye yazardi.

peki varsayılan tarayıcım neden değişti ve güvenlik duvarım ndn kapandı ?

PC MERAKLISI

2008'den beri5.530 mesaj

#6
11.04.2009 17:32

sadece nereleri taradıgını göstermiş o kadar

bende geçen bi tarattım avmo virüsünü(gizli klasörleri engelleyen virüs )temizledim

Darknes$

2008'den beri18 bin mesaj

#7
11.04.2009 17:59

acabuco4 dedi: ↑
peki varsayılan tarayıcım neden değişti ve güvenlik duvarım ndn kapandı ?

Combofix ile tarama yaptırdığında Antivirüsünün kapalı olmasi gerekir Combofix tarama yaptığı sırada antivürüsünü devre dışı bırakmıştır, Güvenlik merkezi uyari vermiştir.

Tarayıcı ise sadece değil herkesde oluyor.Masaüstüne İe'simgesini getiriyor.

Sorun yok yani......

tonce

2007'den beri2.796 mesaj

#8
11.04.2009 18:49

Combo Fix'i hiç sevemedim ben şimdiye kadar sistemileri ne zaman taratsam hepi kıyameti kopardı birşey vamış gibi. Amvo Kill bu konularda daha başarılı. Gizli klasötleri gösterme, HDD birlikte aç hatsı giderme, HDD ayrı pencerelerde açılma hatası gibi hatalara birebir ve kurulum gerektirmeyen anında çözüm. ;)

NikeSteeL

2009'den beri8.421 mesaj

#9
11.04.2009 19:44

Windows u Korsan Ayarlar Uygulamasından Etkilenmesin Die Varsayılan Tarayıcı Gibi Değerleri Sıfırlıyor DNS kullanıyorsan Kapatıyor.!!

NikeSteeL

2009'den beri8.421 mesaj

#10
11.04.2009 19:46

2009-03-26 17:06 . 2009-03-16 15:18 517,448 --a------ c:\windows\system32\XAudio2_4.dll
[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSe tup SIGNUP
Bunları Fix'Le

Combofix le pc mi tarattım.

Cevabını yaz