ComboFix 08-12-26.03 - nurgül şahin 2008-12-27 13:55:27.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1254.1.1055.18.502.168 [GMT 2:00]
Running from: c:\documents and settings\nurgül şahin\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Outdated)
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-11-27 to 2008-12-27 )))))))))))))))))))))))))))))))
.
2008-12-27 00:12 . 2008-12-27 00:12 275,456 --a------ c:\windows\dxdrv.exe
2008-12-27 00:12 . 2008-12-27 00:13 1,545 --a------ c:\windows\sunx.reg
2008-12-27 00:12 . 2008-12-27 12:44 498 --a------ c:\windows\shost.erp
2008-12-26 20:26 . 2008-12-26 20:27 1,576 --a------ C:\system.hta
2008-12-21 18:22 . 2004-08-04 00:45 221,184 --a------ c:\windows\system32\wmpns.dll
2008-12-20 19:58 . 2008-12-20 19:58 <DIR> d-------- c:\program files\Common Files\Adobe
2008-12-19 21:46 . 2008-12-19 21:46 <DIR> d-------- c:\program files\LimeWire
2008-12-19 21:46 . 2008-12-23 20:26 <DIR> d-------- c:\documents and settings\nurgül şahin\Application Data\LimeWire
2008-12-14 15:24 . 2008-12-14 15:24 <DIR> d---s---- c:\documents and settings\nurgül şahin\UserData
2008-12-14 15:24 . 2008-12-14 15:24 <DIR> d---s---- c:\documents and settings\nurgül şahin\UserData
2008-12-13 19:07 . 1999-12-17 09:13 86,016 --a------ c:\windows\unvise32.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-12-16 17:18 --------- d-----w c:\program files\MSN Messenger
2008-12-13 16:57 --------- d-----w c:\program files\ESET
2008-12-13 16:57 --------- d-----w c:\documents and settings\All Users\Application Data\ESET
2008-12-13 16:51 --------- d-----w c:\program files\Sierra On-Line
2008-12-13 16:41 410,984 ----a-w c:\windows\system32\deploytk.dll
2008-12-13 16:41 --------- d-----w c:\program files\Java
2008-12-13 16:36 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-13 16:34 --------- d-----w c:\program files\MSBuild
2008-12-13 16:34 --------- d-----w c:\program files\Microsoft Works
2008-12-13 15:46 --------- d-----w c:\program files\AirTies
2008-12-13 15:17 --------- d-----w c:\program files\Realtek
2008-12-13 15:09 --------- d-----w c:\program files\Synaptics
2008-12-13 15:08 --------- d-----w c:\program files\CONEXANT
2008-12-13 15:08 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-13 15:06 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-13 15:06 --------- d-----w c:\documents and settings\nurgül şahin\Application Data\Acer
2008-12-13 15:06 --------- d-----w c:\documents and settings\All Users\Application Data\Acer
2008-12-13 15:03 --------- d-----w c:\program files\Intel
2008-12-13 15:01 --------- d-----w c:\program files\WIDCOMM
2008-12-13 14:59 --------- d-----w c:\program files\Acer Inc
2008-12-13 14:58 --------- d-----w c:\program files\Common Files\Logitech
2008-12-13 14:58 --------- d-----w c:\program files\Common Files\Acer
2008-12-13 14:57 --------- d-----w c:\program files\Acer
2008-12-13 14:46 --------- d-----w c:\program files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2008-12-16 5674352]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"LogitechCommunicationsManager"="c:\program files\Common Files\Logitech\LComMgr\Communications_Helper.exe" [2006-10-31 304664]
"AcerOrbicamRibbon"="c:\program files\Acer\OrbiCam10\OrbiCam.exe" [2006-11-28 754712]
"LVCOMSX"="c:\program files\Common Files\Logitech\LComMgr\LVComSX.exe" [2006-11-28 244512]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-12-21 53248]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2005-12-27 69632]
"ADMTray.exe"="c:\acer\Empowering Technology\admtray.exe" [2005-10-24 2462208]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761946]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-13 136600]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168]
"DirectX For Microsoft® Windows"="c:\windows\dxdrv.exe" [2008-12-27 275456]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
c:\documents and settings\All Users\Start Menu\Programlar\BaŸlang‡\
AirTies ADSL Hizmet Program.lnk - c:\program files\AirTies\ADSL Hizmet Program\AirTies_util3.exe [2008-12-13 3655168]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-01-17 618557]
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\SIERRA\\Half-Life\\hl.exe"=
"c:\\Program Files\\AirTies\\ADSL Hizmet Programı\\AirTies_util3.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfw tdir.sys [2008-07-01 34312]
R1 OsaFsLoc;OsaFsLoc;\??\c:\windows\system32\drivers\ OsaFsLoc.sys [2008-12-13 12106]
R2 ekrn;Eset Service;"c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe" [2008-07-01 468224]
R2 osaio;osaio;\??\c:\windows\system32\drivers\osaio. sys [2008-12-13 7296]
R2 osanbm;osanbm;\??\c:\windows\system32\drivers\osan bm.sys [2008-12-13 4010]
R3 lv321av;Logitech USB PC Camera (VC0321);c:\windows\system32\DRIVERS\lv321av.sys [2008-12-13 847392]
R3 NdisFilt;OSA NdisFilter Protocol;c:\windows\system32\Drivers\NdisFilt.sys [2008-12-13 4392]
*Newly Created Service* - PROCEXP90
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google74.com/
mLocal Page = hxxp://www.google74.com
mStart Page = hxxp://www.google74.com
mSearch Bar = hxxp://www.google74.com
IE: Microsoft Excel'e &Ver - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
.
************************************************** ************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-12-27 13:58:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(652)
c:\windows\system32\igfxdev.dll
.
Completion time: 2008-12-27 13:58:56
ComboFix-quarantined-files.txt 2008-12-27 11:58:54
Pre-Run: 27.538.939.904 bayt boş
Post-Run: 28,783,329,280 bayt boş
128
Üyeliği durdurulduSonuç olarak bu metin belgesi çıktı ne yapmalıyım veya ne olmuş anlayamadım.Herşey hala eskisi gibi...Yine açılış sayfamda reklamlar çıkıyor.Yine pc başladığında o reklam resmi çıkıyor....?
o yüzden biraz şaşkınım...
