Bilgisayar Kendikendine Upload Yapıyor Lütfen Bilen El Atsın (wdc.exe)

Aşağı Git Tüm Forumlar İşletim Sistemleri ve Yazılımlar Yazılım Genel Güvenlik Programları Bilgisayar Kendikendine Upload Yapıyor Lütfen Bilen El Atsın (wdc.exe)

Bu konudaki kullanıcılar: 1 misafir, 1 mobil kullanıcı

5
Cevap 5424
Tıklama 0
Öne Çıkarma

1. sayfa

Bilgisayar Kendikendine Upload Yapıyor Lütfen Bilen El Atsın (wdc.exe)

Cevap Yaz

#berk

15 yıl

Yüzbaşı

Konu Sahibi

Selamlar.
Chatroulet ve omegle sitelerini önermişti arkadaşım. Ama sanırım o sitelere girmeye başladıktan sonra firefoxta çökmeler sistem kilitlenmeleri olmaya başladı. Sadece o sitelere girerken oluyordu. Sonra farkettimki o kilitlenmelerden sonra upload yapıyor bilgisayar sürekli.
Bilgisayarı açıp kapayınca düzeliyordu. Ama arada tekrar başlıyor ve bazen 20 kb'a kadar veri gönderiliyor.
O sırada aviranın firewall ayarlarından kontrol ettim kaynağı belli olmayan bir dosyanın veri alıp gönderdiği orda da belli. Ama "acces deny" diye seçsem bile veri alışverişi durmuyor.
Virüs taraması yaptım ama birşey çıkmamıştı. Geçen avira uyarı verdi update.exe diye bir dosya tcp'yi kullanmak istiyor izin verilsinmi diye. Ama kaynağı filan belli olmadığı için izin vermedim. Araştırayım dedim sonra baktım görev yöneticisinde 1-2 yabancı şey belirmiş.

WDC.exe --- Bu direk zararlı olarak tanımlanmış internette
csrss.exe --- Bu microsoftun bir hizmeti ama solucanlar trojenler buna yapışıp aynı anda çalışabiliyormuş
atieclxx.exe --- Bunu tam olarak çözemedim zararsız gözüküyor.

Bunların ortak noktası görev yöneticisinde özelliklerine veya dosya konumlarına ulaşamam. Özel görev yönetici program indirip kapatmaya çalıştım ama yine hata verdi. Gücenli kipte açınca da gözükmediği için müdahele edemedim.

Sözde arka planda çalışan wdc.exe keylogger gibi bişeymiş ki bilgisayarın 2-3 gündür kendi kendine upload yapması yüzünden kesin keylogger diye düşündüm. Ama Avira birşey bulamadı.

Bu Avira ile sistem klasörü taraması log verileri - registry taramasıda yapıyor aynı zamanda sanırım.

 
   
  Premium Security Suite 
  Report file date: 27 Mart 2010 Cumartesi  00:19 
   
  Scanning for 1931788 virus strains and unwanted programs. 
   
  The program is running as an unrestricted full version. 
  Online services are available: 
   
  Licensee        : Hakan Yok 
  Serial number   : 2206969367-ISECE-0000001 
  Platform        : Windows 7 x64 
  Windows version : (plain)  [6.1.7600] 
  Boot mode       : Normally booted 
  Username        : Berk 
  Computer name   : YOK 
   
  Version information: 
  BUILD.DAT       : 10.0.0.536     43195 Bytes  18.03.2010 15:44:00 
  AVSCAN.EXE      : 10.0.2.3      433832 Bytes  23.03.2010 15:13:59 
  AVSCAN.DLL      : 10.0.2.2       45928 Bytes  23.03.2010 15:13:58 
  LUKE.DLL        : 10.0.2.3      104296 Bytes  23.03.2010 15:14:44 
  LUKERES.DLL     : 10.0.0.1       12648 Bytes  23.03.2010 15:14:44 
  VBASE000.VDF    : 7.10.0.0    19875328 Bytes  06.11.2009 15:12:59 
  VBASE001.VDF    : 7.10.1.0     1372672 Bytes  19.11.2009 15:13:03 
  VBASE002.VDF    : 7.10.3.1     3143680 Bytes  20.01.2010 15:13:10 
  VBASE003.VDF    : 7.10.3.75     996864 Bytes  26.01.2010 15:13:13 
  VBASE004.VDF    : 7.10.4.203   1579008 Bytes  05.03.2010 15:13:17 
  VBASE005.VDF    : 7.10.4.204      2048 Bytes  05.03.2010 15:13:17 
  VBASE006.VDF    : 7.10.4.205      2048 Bytes  05.03.2010 15:13:17 
  VBASE007.VDF    : 7.10.4.206      2048 Bytes  05.03.2010 15:13:17 
  VBASE008.VDF    : 7.10.4.207      2048 Bytes  05.03.2010 15:13:17 
  VBASE009.VDF    : 7.10.4.208      2048 Bytes  05.03.2010 15:13:17 
  VBASE010.VDF    : 7.10.4.209      2048 Bytes  05.03.2010 15:13:17 
  VBASE011.VDF    : 7.10.4.210      2048 Bytes  05.03.2010 15:13:18 
  VBASE012.VDF    : 7.10.4.211      2048 Bytes  05.03.2010 15:13:18 
  VBASE013.VDF    : 7.10.4.242    153088 Bytes  08.03.2010 15:13:18 
  VBASE014.VDF    : 7.10.5.17      99328 Bytes  10.03.2010 15:13:19 
  VBASE015.VDF    : 7.10.5.44     107008 Bytes  11.03.2010 15:13:19 
  VBASE016.VDF    : 7.10.5.69      92672 Bytes  12.03.2010 15:13:20 
  VBASE017.VDF    : 7.10.5.91     119808 Bytes  15.03.2010 15:13:20 
  VBASE018.VDF    : 7.10.5.121    112640 Bytes  18.03.2010 15:13:21 
  VBASE019.VDF    : 7.10.5.138    139776 Bytes  18.03.2010 15:13:21 
  VBASE020.VDF    : 7.10.5.164    113152 Bytes  22.03.2010 15:13:22 
  VBASE021.VDF    : 7.10.5.182    108032 Bytes  23.03.2010 21:26:51 
  VBASE022.VDF    : 7.10.5.199    123904 Bytes  24.03.2010 21:26:52 
  VBASE023.VDF    : 7.10.5.217    279552 Bytes  25.03.2010 22:59:14 
  VBASE024.VDF    : 7.10.5.234    202240 Bytes  26.03.2010 21:14:47 
  VBASE025.VDF    : 7.10.5.235      2048 Bytes  26.03.2010 21:14:47 
  VBASE026.VDF    : 7.10.5.236      2048 Bytes  26.03.2010 21:14:47 
  VBASE027.VDF    : 7.10.5.237      2048 Bytes  26.03.2010 21:14:48 
  VBASE028.VDF    : 7.10.5.238      2048 Bytes  26.03.2010 21:14:48 
  VBASE029.VDF    : 7.10.5.239      2048 Bytes  26.03.2010 21:14:48 
  VBASE030.VDF    : 7.10.5.240      2048 Bytes  26.03.2010 21:14:48 
  VBASE031.VDF    : 7.10.5.241      2048 Bytes  26.03.2010 21:14:48 
  Engineversion   : 8.2.1.204  
  AEVDF.DLL       : 8.1.1.3       106868 Bytes  23.03.2010 15:13:36 
  AESCRIPT.DLL    : 8.1.3.23     1278331 Bytes  26.03.2010 21:14:52 
  AESCN.DLL       : 8.1.5.0       127347 Bytes  23.03.2010 15:13:34 
  AESBX.DLL       : 8.1.2.1       254323 Bytes  23.03.2010 15:13:37 
  AERDL.DLL       : 8.1.4.3       541043 Bytes  23.03.2010 15:13:34 
  AEPACK.DLL      : 8.2.1.1       426358 Bytes  23.03.2010 15:13:33 
  AEOFFICE.DLL    : 8.1.0.41      201083 Bytes  23.03.2010 15:13:32 
  AEHEUR.DLL      : 8.1.1.16     2503031 Bytes  26.03.2010 21:14:51 
  AEHELP.DLL      : 8.1.10.2      237941 Bytes  23.03.2010 15:13:27 
  AEGEN.DLL       : 8.1.3.2       373108 Bytes  23.03.2010 15:13:27 
  AEEMU.DLL       : 8.1.1.0       393587 Bytes  23.03.2010 15:13:26 
  AECORE.DLL      : 8.1.12.3      188789 Bytes  23.03.2010 15:13:25 
  AEBB.DLL        : 8.1.0.3        53618 Bytes  23.03.2010 15:13:25 
  AVWINLL.DLL     : 10.0.0.0       19304 Bytes  23.03.2010 15:12:04 
  AVPREF.DLL      : 10.0.0.0       44904 Bytes  23.03.2010 15:13:57 
  AVREP.DLL       : 10.0.0.8       62209 Bytes  23.03.2010 15:15:18 
  AVREG.DLL       : 10.0.1.2       52072 Bytes  23.03.2010 15:15:17 
  AVSCPLR.DLL     : 10.0.2.3       83304 Bytes  23.03.2010 15:15:18 
  AVARKT.DLL      : 10.0.0.13     227176 Bytes  23.03.2010 15:13:42 
  AVEVTLOG.DLL    : 10.0.0.8      203112 Bytes  23.03.2010 15:13:46 
  SQLITE3.DLL     : 3.6.19.0      355688 Bytes  23.03.2010 15:14:51 
  AVSMTP.DLL      : 10.0.0.17      63848 Bytes  23.03.2010 15:14:01 
  NETNT.DLL       : 10.0.0.0       11624 Bytes  23.03.2010 15:14:45 
  RCIMAGE.DLL     : 10.0.0.26    2899304 Bytes  23.03.2010 15:12:07 
  RCTEXT.DLL      : 10.0.46.0      97128 Bytes  23.03.2010 15:12:07 
   
  Configuration settings for the scan: 
  Jobname.............................: Windows System Directory 
  Configuration file..................: C:\program files (x86)\avira\antivir desktop\sysdir.avp 
  Logging.............................: low 
  Primary action......................: interactive 
  Secondary action....................: ignore 
  Scan master boot sector.............: on 
  Scan boot sector....................: on 
  Boot sectors........................: C:,  
  Process scan........................: on 
  Scan registry.......................: on 
  Search for rootkits.................: off 
  Integrity checking of system files..: off 
  Scan all files......................: Intelligent file selection 
  Scan archives.......................: on 
  Recursion depth.....................: 20 
  Smart extensions....................: on 
  Macro heuristic.....................: on 
  File heuristic......................: medium 
  Skipped files.......................: C:\Users\Berk\CryptLoad_1.1.5, F:\Programlar\Ad-Aware8.0.3_Pro_3_Crys_www.cshtr.com_.rar, F:\Programlar\Avast.rar, F:\Programlar\Internet_Download_Manager_v5.17_Build_2__2942009_.rar, F:\Programlar\NERO 9.4.26.0 FINAL (Multilanguage), F:\Programlar\Norton.rar, F:\Programlar\Virüs Temizliği,  
  Deviating risk categories...........: +APPL,+PCK,+PFS,+SPR, 
   
  Start of the scan: 27 Mart 2010 Cumartesi  00:19 
   
  The scan of running processes will be started 
  Scan process 'avscan.exe' - '1' Module(s) have been scanned 
  Scan process 'IDMan.exe' - '1' Module(s) have been scanned 
  Scan process 'avcenter.exe' - '1' Module(s) have been scanned 
  Scan process 'firefox.exe' - '1' Module(s) have been scanned 
  Scan process 'AVWEBGRD.EXE' - '1' Module(s) have been scanned 
  Scan process 'avmailc.exe' - '1' Module(s) have been scanned 
  Scan process 'WDC.exe' - '1' Module(s) have been scanned 
  Scan process 'ATKOSD.exe' - '1' Module(s) have been scanned 
  Scan process 'HCSynApi.exe' - '1' Module(s) have been scanned 
  Scan process 'avgnt.exe' - '1' Module(s) have been scanned 
  Scan process 'HControlUser.exe' - '1' Module(s) have been scanned 
  Scan process 'jusched.exe' - '1' Module(s) have been scanned 
  Scan process 'IAAnotif.exe' - '1' Module(s) have been scanned 
  Scan process 'IAANTMon.exe' - '1' Module(s) have been scanned 
  Scan process 'avguard.exe' - '1' Module(s) have been scanned 
  Scan process 'avfwsvc.exe' - '1' Module(s) have been scanned 
  Scan process 'EcoBtn.exe' - '1' Module(s) have been scanned 
  Scan process 'GoogleUpdate.exe' - '1' Module(s) have been scanned 
  Scan process 'MsgTranAgt.exe' - '1' Module(s) have been scanned 
  Scan process 'Hcontrol.exe' - '1' Module(s) have been scanned 
  Scan process 'sched.exe' - '1' Module(s) have been scanned 
  Scan process 'ASLDRSrv.exe' - '1' Module(s) have been scanned 
   
  Starting master boot sector scan: 
  Master boot sector HD0 
      [INFO]      No virus was found! 
   
  Start scanning boot sectors: 
  Boot sector 'C:\' 
      [INFO]      No virus was found! 
   
  Starting to scan executable files (registry). 
  The registry was scanned ( '192' files ). 
   
   
  Starting the file scan: 
   
  Begin scan in 'C:\Windows\system32' 
   
   
  End of the scan: 27 Mart 2010 Cumartesi  00:21 
  Used time: 02:32 Minute(s) 
   
  The scan has been done completely. 
   
     1261 Scanned directories 
    15454 Files were scanned 
        0 Viruses and/or unwanted programs were found 
        0 Files were classified as suspicious 
        0 files were deleted 
        0 Viruses and unwanted programs were repaired 
        0 Files were moved to quarantine 
        0 Files were renamed 
        0 Files cannot be scanned 
    15454 Files not concerned 
        7 Archives were scanned 
        0 Warnings 
        0 Notes

Bu ise hijackthis programı ile tarama sonucu log verileri

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 00:45:03, on 27.03.2010 
  Platform: Unknown Windows (WinNT 6.01.3504) 
  MSIE: Internet Explorer v8.00 (8.00.7600.16385) 
  Boot mode: Normal 
   
  Running processes: 
  C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe 
  C:\Program Files (x86)\Java\jre6\bin\jusched.exe 
  C:\Program Files (x86)\ATK Hotkey\HControlUser.exe 
  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe 
  C:\Program Files (x86)\ATK Hotkey\HCSynApi.exe 
  C:\Program Files (x86)\Internet Download Manager\IDMan.exe 
  C:\Program Files (x86)\Mozilla Firefox\firefox.exe 
  F:\İndirilenler\HijackThis.exe 
   
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =  
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =  
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm 
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =  
  F2 - REG:system.ini: UserInit=userinit.exe 
  O1 - Hosts: 205.188.234.120 shoutcast.com 
  O1 - Hosts: 205.188.234.120 www.shoutcast.com 
  O1 - Hosts: 67.221.174.30 tagged.com 
  O1 - Hosts: 67.221.174.30 www.tagged.com 
  O1 - Hosts: 209.222.148.138 megaupload.com 
  O1 - Hosts: 209.222.148.138 www.megaupload.com 
  O1 - Hosts: 85.17.90.3 wwwstatic.megaupload.com 
  O1 - Hosts: 209.222.148.142 www1.megaupload.com 
  O1 - Hosts: 209.222.148.142 www2.megaupload.com 
  O1 - Hosts: 209.222.148.142 www3.megaupload.com 
  O1 - Hosts: 209.222.148.142 www4.megaupload.com 
  O1 - Hosts: 209.222.148.142 www5.megaupload.com 
  O1 - Hosts: 209.222.148.142 www6.megaupload.com 
  O1 - Hosts: 209.222.148.142 www7.megaupload.com 
  O1 - Hosts: 209.222.148.142 www8.megaupload.com 
  O1 - Hosts: 209.222.148.142 www9.megaupload.com 
  O1 - Hosts: 64.72.115.198 www10.megaupload.com 
  O1 - Hosts: 64.72.115.4 www11.megaupload.com 
  O1 - Hosts: 64.72.115.5 www12.megaupload.com 
  O1 - Hosts: 64.72.115.6 www13.megaupload.com 
  O1 - Hosts: 64.72.115.31 www14.megaupload.com 
  O1 - Hosts: 64.72.115.32 www15.megaupload.com 
  O1 - Hosts: 64.72.115.33 www16.megaupload.com 
  O1 - Hosts: 64.72.115.34 www17.megaupload.com 
  O1 - Hosts: 64.72.115.7 www18.megaupload.com 
  O1 - Hosts: 64.72.115.8 www19.megaupload.com 
  O1 - Hosts: 64.72.115.9 www20.megaupload.com 
  O1 - Hosts: 64.72.115.10 www21.megaupload.com 
  O1 - Hosts: 64.72.115.11 www22.megaupload.com 
  O1 - Hosts: 64.72.115.12 www23.megaupload.com 
  O1 - Hosts: 64.72.115.13 www24.megaupload.com 
  O1 - Hosts: 64.72.115.14 www25.megaupload.com 
  O1 - Hosts: 64.72.115.15 www26.megaupload.com 
  O1 - Hosts: 64.72.115.16 www27.megaupload.com 
  O1 - Hosts: 64.72.115.17 www28.megaupload.com 
  O1 - Hosts: 64.72.115.18 www29.megaupload.com 
  O1 - Hosts: 64.72.115.19 www30.megaupload.com 
  O1 - Hosts: 64.72.115.20 www31.megaupload.com 
  O1 - Hosts: 64.72.115.21 www32.megaupload.com 
  O1 - Hosts: 64.72.115.22 www33.megaupload.com 
  O1 - Hosts: 64.72.115.23 www34.megaupload.com 
  O1 - Hosts: 64.72.115.2 www35.megaupload.com 
  O1 - Hosts: 64.72.115.3 www36.megaupload.com 
  O1 - Hosts: 64.72.115.24 www37.megaupload.com 
  O1 - Hosts: 64.72.115.25 www38.megaupload.com 
  O1 - Hosts: 64.72.115.26 www39.megaupload.com 
  O1 - Hosts: 64.72.115.27 www40.megaupload.com 
  O1 - Hosts: 64.72.115.28 www41.megaupload.com 
  O1 - Hosts: 64.72.115.29 www42.megaupload.com 
  O1 - Hosts: 64.72.115.30 www43.megaupload.com 
  O1 - Hosts: 64.72.115.40 www44.megaupload.com 
  O1 - Hosts: 64.72.115.37 www45.megaupload.com 
  O1 - Hosts: 64.72.115.38 www46.megaupload.com 
  O1 - Hosts: 64.72.115.39 www47.megaupload.com 
  O1 - Hosts: 64.72.115.35 www48.megaupload.com 
  O1 - Hosts: 64.72.115.36 www49.megaupload.com 
  O1 - Hosts: 87.255.33.129 www50.megaupload.com 
  O1 - Hosts: 87.255.33.130 www51.megaupload.com 
  O1 - Hosts: 87.255.33.131 www52.megaupload.com 
  O1 - Hosts: 87.255.33.132 www53.megaupload.com 
  O1 - Hosts: 87.255.33.133 www54.megaupload.com 
  O1 - Hosts: 87.255.33.134 www55.megaupload.com 
  O1 - Hosts: 87.255.33.135 www56.megaupload.com 
  O1 - Hosts: 87.255.33.136 www57.megaupload.com 
  O1 - Hosts: 87.255.33.137 www58.megaupload.com 
  O1 - Hosts: 87.255.33.138 www59.megaupload.com 
  O1 - Hosts: 69.5.88.66 www60.megaupload.com 
  O1 - Hosts: 69.5.88.67 www61.megaupload.com 
  O1 - Hosts: 69.5.88.89 www62.megaupload.com 
  O1 - Hosts: 69.5.88.91 www63.megaupload.com 
  O1 - Hosts: 69.5.88.92 www64.megaupload.com 
  O1 - Hosts: 69.5.88.94 www65.megaupload.com 
  O1 - Hosts: 64.72.115.199 www66.megaupload.com 
  O1 - Hosts: 64.72.115.200 www67.megaupload.com 
  O1 - Hosts: 64.72.115.201 www68.megaupload.com 
  O1 - Hosts: 64.72.115.202 www69.megaupload.com 
  O1 - Hosts: 87.255.33.140 www70.megaupload.com 
  O1 - Hosts: 87.255.33.141 www71.megaupload.com 
  O1 - Hosts: 87.255.33.142 www72.megaupload.com 
  O1 - Hosts: 87.255.33.143 www73.megaupload.com 
  O1 - Hosts: 87.255.33.144 www74.megaupload.com 
  O1 - Hosts: 87.255.33.145 www75.megaupload.com 
  O1 - Hosts: 87.255.33.146 www76.megaupload.com 
  O1 - Hosts: 87.255.33.147 www77.megaupload.com 
  O1 - Hosts: 87.255.33.148 www78.megaupload.com 
  O1 - Hosts: 87.255.33.149 www79.megaupload.com 
  O1 - Hosts: 85.17.190.1 www80.megaupload.com 
  O1 - Hosts: 85.17.190.2 www81.megaupload.com 
  O1 - Hosts: 85.17.190.3 www82.megaupload.com 
  O1 - Hosts: 85.17.190.4 www83.megaupload.com 
  O1 - Hosts: 85.17.190.5 www84.megaupload.com 
  O1 - Hosts: 85.17.190.6 www85.megaupload.com 
  O1 - Hosts: 85.17.190.7 www86.megaupload.com 
  O1 - Hosts: 85.17.190.8 www87.megaupload.com 
  O1 - Hosts: 85.17.190.9 www88.megaupload.com 
  O1 - Hosts: 85.17.190.10 www89.megaupload.com 
  O1 - Hosts: 64.72.115.203 www90.megaupload.com 
  O1 - Hosts: 64.72.115.204 www91.megaupload.com 
  O1 - Hosts: 64.72.115.205 www92.megaupload.com 
  O1 - Hosts: 64.72.115.206 www93.megaupload.com 
  O1 - Hosts: 64.72.115.207 www94.megaupload.com 
  O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll 
  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll 
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" 
  O4 - HKLM\..\Run: [HControlUser] "C:\Program Files (x86)\ATK Hotkey\HcontrolUser.exe" 
  O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min 
  O4 - HKLM\..\Run: [VM_STI] C:\Windows\VM_STI.exe Philips SPC300NC Webcam 
  O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun 
  O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\Windows\SysWOW64\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/5.0_(Windows;_U;_Windows_NT_6.1;_tr;_rv:1.9.2)_Gecko/20100115_Firefox/3.6" -"http://www.britannica.com/EBchecked/topic-art/41549/18135/Thomson-atomic-model-William-Thomson-envisioned-the-atom-as-a" 
  O8 - Extra context menu item: Download all links with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm 
  O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetVL.htm 
  O8 - Extra context menu item: Download with IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm 
  O8 - Extra context menu item: Microsoft Excel'e &Ver - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL 
  O10 - Broken Internet access because of LSP provider 'c:\program files (x86)\bonjour\mdnsnsp.dll' missing 
  O13 - Gopher Prefix:  
  O16 - DPF: {0FC8B38E-9293-424C-9D0E-CE60775679CF} (SubClassEditCtrlContainer Class) -https://sube.garanti.com.tr/lib/JaguarEditControl.CAB 
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab 
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab 
  O16 - DPF: {F9043C85-F6F2-101A-A3C9-08002B2F49FB} (Microsoft Common Dialog Control, version 6.0 (SP6)) -http://www.eczacibasikariyer.com/comdlg32.cab 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{15DBA6F1-130D-481D-ABD1-79DB34996695}: NameServer = 8.8.8.8,8.8.4.4 
  O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) 
  O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing) 
  O23 - Service: Avira FireWall (AntiVirFirewallService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe 
  O23 - Service: Avira AntiVir MailGuard (AntiVirMailService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe 
  O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe 
  O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe 
  O23 - Service: Avira AntiVir WebGuard (AntiVirWebService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE 
  O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files (x86)\ATK Hotkey\ASLDRSrv.exe 
  O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) 
  O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) 
  O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe 
  O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) 
  O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) 
  O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) 
  O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) 
  O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) 
  O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) 
  O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) 
  O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) 
  O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) 
  O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) 
  O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) 
   
  -- 
  End of file - 12851 bytes

Hadi bu wdc.exe yararlı bile olsa sileyim dedim ama bulamadım. Görev yöneticisi ve daha ayrıntılı görev yönetici programları bunun çalıştığını gösteriyor ama ne kaynak dosya var nede başka bilgi. Avira tarama bilgi dosyasında da kaynağı yazmıyor. Bilgisayarda normal aratma yaptım çıkmadı. Güvenli kipte açınca görev yöneticisinde gözükmüyor ve yine bulamıyor. Sistem dosyalarını gösterip de arattım yine yok.

Lütfen biri bana bu konu hakkında bilgi versin.

#berk

15 yıl

Yüzbaşı

Konu Sahibi

Dostum haklıymışsın host dosyası çöplük olmuş oraya hiç bakmamıştım. Garip garip siteler 127.1.1.0 gibi bir adrese yönlendirilmiş. Sildim dosyayıda okunabilir yaptım sadece.

Bu arada dediğin program bişey bulamadı sanırım. İnternet explorer la ilgili bulduklarını anlamadım gerçi ama diğerinin zararı yok zaten 1 yıldır ellememiştim onu hiç açmamıştım.

Aşağıda tarama sonuçları var.

Malwarebytes' Anti-Malware 1.45 
  www.malwarebytes.org 
   
  Veritabanı sürümü: 3947 
   
  Windows 6.1.7600 
  Internet Explorer 8.0.7600.16385 
   
  02.04.2010 23:48:52 
  mbam-log-2010-04-02 (23-48-52).txt 
   
  Tarama kipi: Derin tarama (C:\|) 
  Taranmış öğeler: 282862 
  Geçen süre: 55 dakika, 59 saniye 
   
  Etkilenmiş Hafıza İşlemleri: 0 
  Etkilenmiş Hafıza Modülleri: 0 
  Etkilenmiş Kayıt Anahtarları: 0 
  Etkilenmiş Kayıt Değerleri: 0 
  Etkilenmiş Veri Öğeleri: 2 
  Etkilenmiş Klasörler: 0 
  Etkilenmiş Dosyalar: 1 
   
  Etkilenmiş Hafıza İşlemleri: 
  ( Zararlı öğe tespit edilmedi) 
   
  Etkilenmiş Hafıza Modülleri: 
  ( Zararlı öğe tespit edilmedi) 
   
  Etkilenmiş Kayıt Anahtarları: 
  ( Zararlı öğe tespit edilmedi) 
   
  Etkilenmiş Kayıt Değerleri: 
  ( Zararlı öğe tespit edilmedi) 
   
  Etkilenmiş Veri Öğeleri: 
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. 
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. 
   
  Etkilenmiş Klasörler: 
  ( Zararlı öğe tespit edilmedi) 
   
  Etkilenmiş Dosyalar: 
  C:\Users\Berk\CryptLoad_1.1.5\ocr\netload.in\asmCaptcha\test.exe (Malware.Packer) -> Quarantined and deleted successfully.

Bu mesaja 1 cevap geldi.

Cevap Yaz

1. sayfa

Tüm Forumlar İşletim Sistemleri ve Yazılımlar Yazılım Genel Güvenlik Programları Bilgisayar Kendikendine Upload Yapıyor Lütfen Bilen El Atsın (wdc.exe)