bir bilen aranıyor acil bilgisayar teknik yardım
merhaba arkadaşlar isyerimdeki bilgisayarımda ciddi bir problem var fakat nette bununla ilgili cozume ulaqsan ya yok yada ben bulamadım. sorun su c surucusu kendi kendine doluyor yani c şişiyor. guncel kasper lkullanmaktaım ustelikte lisanslı fakat sanırım bir usb den bulasan virus var ne odlugu belli değil. simdiye kadar c de pev.exe. zip. exe sed.exe swreg.exe swsc,swxacls grep mbr dosyalrını buldum bunların guvenlik acıgı oldugunu gördum ve sildim tabi bunları silmekle iş bitmedi c dolmaya devam ediyor combofix ile taratınca log dosyası asagıdaki gibi geldi . bu konuda uzman olan arkadaslar bana ne onerebilriler. Lütfen format atın demeyin:))
ComboFix 11-03-28.05 - akcay 29.03.2011 15:03:45.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1254.90.1055.18.1270.897 [GMT 3:00]
Running : c:\documents and settings\akcay\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\1055
c:\windows\system32\1055\dwintl.dll
.
.
((((((((((((((((((((((((( Files Created 2011-02-28 to 2011-03-29 )))))))))))))))))))))))))))))))
.
.
2011-03-29 12:09 . 2011-03-29 12:09 -------- d-----w- c:\windows\system32\wbem\snmp
2011-03-29 12:09 . 2011-03-29 12:09 -------- d-----w- c:\windows\system32\xircom
2011-03-29 12:09 . 2011-03-29 12:09 -------- d-----w- c:\windows\system32\1055
2011-03-29 12:09 . 2011-03-29 12:09 -------- d-----w- c:\program files\microsoft frontpage
2011-03-29 11:49 . 2011-03-29 11:50 -------- d-----w- C:\18628-ComboFix-020410
2011-03-29 09:32 . 2011-03-29 11:35 -------- d-----w- c:\documents and settings\Administrator
2011-03-29 08:46 . 2011-03-29 08:57 -------- d-----w- c:\program files\Total Video Converter
2011-03-18 13:24 . 2011-03-18 13:24 -------- d--h--w- c:\windows\PIF
2011-03-18 13:21 . 2011-03-18 13:21 -------- d-----w- c:\program files\WinDirStat
2011-02-28 14:14 . 2010-05-07 10:37 150200 ----a-w- c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\compone nts\kavlinkfilter.dll
2011-02-28 14:14 . 2010-05-07 10:37 109240 ----a-w- c:\program files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru\comp onents\abhelperxpcom.dll
2011-02-28 14:14 . 2011-02-28 14:51 97859 ----a-w- c:\windows\system32\drivers\klick.dat
2011-02-28 14:14 . 2011-02-28 14:51 114243 ----a-w- c:\windows\system32\drivers\klin.dat
2011-02-28 14:11 . 2011-03-29 12:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2011-02-28 14:11 . 2011-02-28 14:11 -------- d-----w- c:\program files\Kaspersky Lab
2011-02-28 14:07 . 2011-02-28 14:07 -------- d-----w- c:\documents and settings\akcay\Local Settings\Application Data\WMTools Downloaded Files
.
.
(((((((((((((((((((((((((((((((((((((((( 3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2011-02-09 13:53 . 2008-04-15 12:00 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2008-04-15 12:00 186880 ----a-w- c:\windows\system32\encdec.dll
2011-01-21 14:42 . 2008-04-15 12:00 439808 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2008-04-15 12:00 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 14:02 . 2009-09-30 00:17 1864064 ----a-w- c:\windows\system32\win32k.sys
2007-10-26 07:11 . 2010-12-01 09:06 66408 -c--a-w- c:\program files\mozilla firefox\components\jar50.dll
2007-10-26 07:11 . 2010-12-01 09:06 54112 -c--a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2007-10-26 07:11 . 2010-12-01 09:06 34688 -c--a-w- c:\program files\mozilla firefox\components\myspell.dll
2007-10-26 07:11 . 2010-12-01 09:06 46456 -c--a-w- c:\program files\mozilla firefox\components\spellchk.dll
2007-10-26 07:11 . 2010-12-01 09:06 171880 -c--a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.
.
------- Sigcheck -------
.
[-] 2009-09-30 . E47D77A2F5D64974D9B6724552EB44AD . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"msnmsgr"="c:\program files\Windows \Messenger\msnmsgr.exe" [2010-04-16 3872080]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-08-15 1404928]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-13 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-13 163840]
"Persistence"="c:\windows\system32\igfxpers.ex e" [2007-01-13 135168]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"Ulead Photo Express Calendar Checker"="c:\program files\Ulead Systems\Ulead Photo Express 5 SE\calcheck.exe" [2004-01-12 69632]
"USB Antivirus"="c:\program files\USB Disk Security\USBGuard.exe" [2008-04-28 798720]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2006-04-29 94208]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-05-07 344736]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-15 15360]
.
c:\documents and settings\All Users\Start Menu\Programlar\BaŸlang‡\
EPSON Status Monitor 3 Environment Check(2).lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV0 2.EXE [2010-12-29 131584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows \\Messenger\\msnmsgr.exe"=
.
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [14.09.2009 15:42 32272]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [02.11.2009 21:27 19472]
S1 kl2;Kl2;c:\windows\system32\drivers\kl2.sys [07.05.2010 01:19 132184]
.
*******s of the 'Scheduled Tasks' folder
.
2011-03-29 c:\windows\Tasks\User_Feed_Synchronization-{741FC8BF-E304-450D-BE1C-A4D4B8C0B689}.job
- c:\windows\system32\msfeedssync.exe [2009-09-30 00:27]
.
2011-03-29 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-12-08 20:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: Microsoft Excel'e Gö&nder - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
DPF: {6F0892F7-0D44-41C3-BF07-7599873FAA04} - hxxp://reporteokul.meb.gov.tr/crystalreportviewers115/ActiveXControls/activexviewer.cab
FF - ProfilePath - c:\documents and settings\akcay\Application Data\Mozilla\Firefox\Profiles\9h5dxgn0.default\
.
.
************************************************** ************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, https://www.gmer.net
Rootkit scan 2011-03-29 15:11
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63 A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macrome d\\Flash\\FlashUtil10n_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63 A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63 A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUt il10n_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63 A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F 2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F 2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F 2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1392)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
c:\windows\system32\portabledeviceapi.dll
c:\windows\system32\portabledevicetypes.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\imapi.exe
.
************************************************** ************************
.
Completion time: 2011-03-29 15:14:19 - machine was rebooted
ComboFix-quarantined-files.txt 2011-03-29 12:14
.
Pre-Run: 644.411.392 bayt boş
Post-Run: 569.094.144 bayt boş
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 9798A33CC8BD725F466E2430B9813094
