Lütfen yardım virüsten kurtulamıyorum.

Merhaba arkadaşlar,

Bilgisayarıma virüs girdi ama ne görev yöneticisini nede farklı birşeyi çalıştırabiliyorum.

Bilgisayarıma 15 dakika önce format attım ve driverları kurdum yine aynı şekilde bu konuda bilgisi olan rica etsem yardım edebilirmi.

full format atsaydın

Hocam diğer D ile ayrılmış bölümde yedeklerim var onun için full format atamıyorum.

yedeklerini başka yere all full format at d deki dosyalarına bulaşmışsa format atmanın yararı olmaz

Hocam bütün yedekleri bir ftpye atsam ve sonrasında oradan geri çeksem yine aynı virüs bulaşmazmı ?

Yedekleri al, format at her tarafa, sonra sağlam bir antivirüs kurup yedeklerini indir.

Bu arada yılların Goblin'i bile virüs yediyse halimiz yaman

Yaklaşık olarak 7 saattir uğraşıyorum ama nasıl bir virüs halen çözemedim.

Combofix ile bilgisayarınızı taratın bakalım ne çıkacak

Merhaba çıkan sonuç.


ComboFix 13-09-08.02 - KoRSaN 09.09.2013 1:54.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1254.90.1055.18.893.310 [GMT 3:00]
Running from: c:\documents and settings\KoRSaN\Belgelerim\Downloads\ComboFix.exe
* Resident AV is active
.
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\KoRSaN\Application Data\Declare.ini
c:\windows\regopt.log
c:\windows\SET1A8.tmp
.
.
((((((((((((((((((((((((( Files Created from 2013-08-08 to 2013-09-08 )))))))))))))))))))))))))))))))
.
.
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"AzMixerSel"="c:\program files\Realtek\Audio\Drivers\AzMixerSel.exe" [2009-12-11 59936]
"RTHDCPL"="RTHDCPL.EXE" [2008-10-28 17331712]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2005-12-07 131072]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-09-16 143360]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-09-16 172032]
"Persistence"="c:\windows\system32\igfxpers.ex e" [2008-09-16 143360]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2013-03-21 5078504]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programlar^Başlangıç^Ralink Wireless Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programlar\Başlangıç\Ralink Wireless Utility.lnk
backup=c:\windows\pss\Ralink Wireless Utility.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2010-08-03 15:17 84584 ----a-w- c:\windows\SOUNDMAN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"McTaskManager"=2 (0x2)
"McShield"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [10.01.2013 09:25 122240]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfw tdir.sys [10.01.2013 09:25 105784]
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mv stdi5x.sys [09.09.2013 00:54 58464]
RUnknown ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [21.03.2013 15:19 1341664]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfil t.sys [09.09.2013 00:46 1691480]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - EAMON
*NewlyCreated* - EHDRV
*NewlyCreated* - EKRN
*NewlyCreated* - EPFWTDIR
*NewlyCreated* - NAIAVTDI1
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-08 22:12 1177552 ----a-w- c:\program files\Google\Chrome\Application\29.0.1547.66\Insta ller\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-09-08 22:10]
.
2013-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-09-08 22:10]
.
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{54C4252A-2937-41E6-AA00-D16A3408D8FA}: NameServer = 8.8.8.8,8.8.4.4
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-MusaLLaT - c:\documents and settings\KoRSaN\Application Data\MusaLLaT.exe
.
.
.
************************************************** ************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-09-09 01:57
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
************************************************** ************************
.
Completion time: 2013-09-09 01:59:23
ComboFix-quarantined-files.txt 2013-09-08 22:59
.
Pre-Run: 58.768.584.704 bayt boş
Post-Run: 58.837.348.352 bayt boş
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 24511581FD5F92A57221CE146CA27DC8
988ED281FD011A58DAB7E4AE71DED8F5