Merhaba çıkan sonuç.


ComboFix 13-09-08.02 - KoRSaN 09.09.2013 1:54.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1254.90.1055.18.893.310 [GMT 3:00]
Running from: c:\documents and settings\KoRSaN\Belgelerim\Downloads\ComboFix.exe
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\KoRSaN\Application Data\Declare.ini
c:\windows\regopt.log
c:\windows\SET1A8.tmp
.
.
((((((((((((((((((((((((( Files Created from 2013-08-08 to 2013-09-08 )))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"AzMixerSel"="c:\program files\Realtek\Audio\Drivers\AzMixerSel.exe" [2009-12-11 59936]
"RTHDCPL"="RTHDCPL.EXE" [2008-10-28 17331712]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2005-12-07 131072]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-09-16 143360]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-09-16 172032]
"Persistence"="c:\windows\system32\igfxpers.ex e" [2008-09-16 143360]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2013-03-21 5078504]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programlar^Başlangıç^Ralink Wireless Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programlar\Başlangıç\Ralink Wireless Utility.lnk
backup=c:\windows\pss\Ralink Wireless Utility.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2010-08-03 15:17 84584 ----a-w- c:\windows\SOUNDMAN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"McTaskManager"=2 (0x2)
"McShield"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [10.01.2013 09:25 122240]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfw tdir.sys [10.01.2013 09:25 105784]
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mv stdi5x.sys [09.09.2013 00:54 58464]
RUnknown ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [21.03.2013 15:19 1341664]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfil t.sys [09.09.2013 00:46 1691480]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - EAMON
*NewlyCreated* - EHDRV
*NewlyCreated* - EKRN
*NewlyCreated* - EPFWTDIR
*NewlyCreated* - NAIAVTDI1
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-08 22:12 1177552 ----a-w- c:\program files\Google\Chrome\Application\29.0.1547.66\Insta ller\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-09-08 22:10]
.
2013-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-09-08 22:10]
.
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{54C4252A-2937-41E6-AA00-D16A3408D8FA}: NameServer = 8.8.8.8,8.8.4.4
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-MusaLLaT - c:\documents and settings\KoRSaN\Application Data\MusaLLaT.exe
.
.
.
************************************************** ************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-09 01:57
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
************************************************** ************************
.
Completion time: 2013-09-09 01:59:23
ComboFix-quarantined-files.txt 2013-09-08 22:59
.
Pre-Run: 58.768.584.704 bayt boş
Post-Run: 58.837.348.352 bayt boş
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 24511581FD5F92A57221CE146CA27DC8
988ED281FD011A58DAB7E4AE71DED8F5