hijackthis log'um

[Mavi]

Logfile of HijackThis v1.99.1
Scan saved at 04:16 Mavi, on 27.10.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSsystem32rundll32.exe
C:WINDOWSExplorer.EXE
C:WINDOWSTWF2aQAAcommand.exe
C:WINDOWSsystem32nvsvc32.exe
C:WINDOWSsystem32CTHELPER.EXE
C:Program FilesMessengerPlus! 3MsgPlus.exe
C:WINDOWSSOUNDMAN.EXE
C:Program FilesMicrosoft HardwareMousepoint32.exe
C:WINDOWSsystem32rundll32.exe
C:Program FilesMicrosoft HardwareKeyboardtype32.exe
C:Program FilesJavajre1.5.0_04binjusched.exe
C:WINDOWSsystem32RUNDLL32.EXE
C:Program FilesNetLimiterNetLimiter.exe
C:WINDOWSVM_STI.EXE
C:WINDOWSSystem32svchost.exe
C:Program FilesMSN Messengermsnmsgr.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:WINDOWSsystem32wuauclt.exe
D:HijackThis.exe

R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page =
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page =
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Window Title = Microsoft Internet Explorer
R0 - HKCUSoftwareMicrosoftInternet ExplorerToolbar,LinksFolderName = Bağlantılar
O4 - HKLM..Run: [SiSUSBRG] C:WINDOWSSiSUSBrg.exe
O4 - HKLM..Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM..Run: [UpdReg] C:WINDOWSUpdReg.EXE
O4 - HKLM..Run: [Jet Detection] "C:Program FilesCreativeSBLivePROGRAMADGJDet.exe"
O4 - HKLM..Run: [CTStartup] C:Program FilesCreativeSplash ScreenCTEaxSpl.EXE /run
O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe
O4 - HKLM..Run: [MessengerPlus3] "C:Program FilesMessengerPlus! 3MsgPlus.exe"
O4 - HKLM..Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM..Run: [KAVPersonal50] "C:Program FilesKaspersky LabKaspersky Anti-Virus Personal Prokav.exe" /minimize
O4 - HKLM..Run: [POINTER] point32.exe
O4 - HKLM..Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM..Run: [IntelliType] "C:Program FilesMicrosoft HardwareKeyboardtype32.exe"
O4 - HKLM..Run: [SunJavaUpdateSched] C:Program FilesJavajre1.5.0_04binjusched.exe
O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 - HKLM..Run: [nwiz] nwiz.exe /install
O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 - HKLM..Run: [NetLimiter] C:Program FilesNetLimiterNetLimiter.exe /s
O4 - HKLM..Run: [BigDogPath] C:WINDOWSVM_STI.EXE USB PC Camera 301P
O4 - HKLM..Run: [Kaspersky] C:Documents and SettingsAll UsersApplication DataKaspersky LabKAV Personal Pro5.0Save Kaspersky.bat
O4 - HKCU..Run: [MessengerPlus3] "C:Program FilesMessengerPlus! 3MsgPlus.exe" /WinStart
O4 - HKCU..Run: [msnmsgr] "C:Program FilesMSN Messengermsnmsgr.exe" /background
O4 - HKCU..Run: [eMuleAutoStart] H:emuleemule.exe -AutoStart
O17 - HKLMSystemCCSServicesTcpip..{C9C9C477-5D4C-4821-9CC8-21AE916AB93B}: NameServer = 10.0.0.2
O20 - Winlogon Notify: BITS - C:WINDOWSsystem32fpn6035se.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:WINDOWSTWF2aQAAcommand.exe
O23 - Service: kavsvc - Kaspersky Lab - C:Program FilesKaspersky LabKaspersky Anti-Virus Personal Prokavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSsystem32nvsvc32.exe

020 ile 023 ten şüpheleniyorum biri yardımcı olabilir mi ?[signature][hline]''You will always be in my heart''
- George Hagi-april,24 2001

[Mavi]

O20 - Winlogon Notify: BITS - C:WINDOWSsystem32fpn6035se.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:WINDOWSTWF2aQAAcommand.exe
Bunları fixliyorum tekrar aktif oluyorlar.

Ve casino bilmem ne diye pop up açılıyor sürekli.
ad aware bulmuyor ne yapabilirim.
kaspersky ile de tarattım.[signature][hline]''You will always be in my heart''
- George Hagi-april,24 2001

[Rahan]

uu galiba rootkit denen şeylerden biri bu, geçende bi tanesiyle 3-4 gün uğraştım ama temizleyemedim. format atmak daha kolay bi çözüm bile olabilir. eğer atamam diyorsan bi kaç öneri daha getirebilirim.[signature][hline]Try Reality!
the invisibile and the non-existent look very much alike!

[Mavi]

yok temizlenmiyor.
çıldırıcam.[signature][hline]''You will always be in my heart''
- George Hagi-april,24 2001

[Mavi]

Program ekle kaldıra command isimli bir dosya geldi o da silinmiyor sistemden.

[spo1=Burdan bakabilirsiniz.][/spo]

ve sürekli bu tip sayfalar açılıyor.
[spo2=Bakınız][/spo]

Güvenli kipte.

Kaspersky anti virus ile tarattım. Bulmadı.
Ad aware ile tarattım bulmadı.
Spybot searxh - Destroy ile tarattım bulmadı.

Hijackthis fixleyemiyor.[signature][hline]''You will always be in my heart''
- George Hagi-april,24 2001

[Rahan]

şununla bi tarattırmayı dener misin? çıkan sonuçlara göre bişiler yapabiliriz belki
http://www.sysinternals.com/Files/RootkitRevealer.zip[signature][hline]Try Reality!
the invisibile and the non-existent look very much alike!

[Rahan]

ehu bu da yeni çıkmış kendi bilgisayarımı tarattım bişi bulamadı, beta falan ama denemeye değer.
http://www.f-secure.com/blacklight/try.shtml[signature][hline]Try Reality!
the invisibile and the non-existent look very much alike!

[Mavi]

ne yapsam hiç bir işe yaramıyor.[signature][hline]''You will always be in my heart''
- George Hagi-april,24 2001