help please with spyware !!
hi i am ozgur ,
and i think my pc is infected.. since it is acting weird, slows down occasioanlly ,sometimes erorrs occurs before i do restart etc.( btw i have spybot -search and destroy 1.6.2. but it couldnt find them, nevermind. )
here are the DDS and aswMBR logs :
DDS:
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 7.0.6000.16915 BrowserJavaVersion: 1.6.0_37
Run by mask at 22:32:21 on 2013-01-06
Microsoft Windows XP Professional 5.1.2600.3.1254.90.1055.18.2046.1272 [GMT 2:00]
.
AV: avast! antivirus 4.8.1335 [VPS 100305-0] *Enabled/Outdated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: COMODO Firewall *Enabled*
.
============== Running Processes ================
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\PAStiSvc.exe
C:\PROGRA~1\KURYAZ~1\SAYISA~1\Saat.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Real\RealPlayer\update\realsched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\GRETECH\GomPlayer\GOM.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.as-ya.com/arabul.html
uInternet Connection Wizard,ShellNext = iexplore
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: IeCatch2 Class: {A5366673-E8CA-11D3-9CD9-0090271D075B} - c:\program files\flashget\Jccatch.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: FlashGet Bar: {E0E899AB-F487-11D5-8D29-0050BA6940E3} - c:\program files\flashget\fgiebar.dll
uRun: [DAEMON Tools Pro Agent] "c:\program files\daemon tools pro\DTProAgent.exe"
uRun: [Facebook Update] "c:\documents and settings\mask\local settings\application data\facebook\update\FacebookUpdate.exe" /c /nocrashserver
mRun: [Alarmli Sayisal Saat 2.11] c:\progra~1\kuryaz~1\sayisa~1\Saat.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [AutorunRemover.exe] c:\program files\autorunremover\AutorunRemover.exe -Hide
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
StartupFolder: c:\docume~1\mask\startm~1\progra~1\balang~1\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:255
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: Download All by FlashGet - c:\progra~1\flashget\jc_all.htm
IE: Download using FlashGet - c:\progra~1\flashget\jc_link.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - c:\progra~1\flashget\flashget.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} - hxxps://webiq005.webiqonline.com/WebIQ/DataServer/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9}
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 192.168.2.1
TCP: Interfaces\{5BD6F888-C2DD-4C6E-AEB1-35239B12252E} : NameServer = 4.2.2.1,4.2.2.2,4.2.2.2,4.4.2.2
TCP: Interfaces\{5BD6F888-C2DD-4C6E-AEB1-35239B12252E} : DHCPNameServer = 192.168.2.1
TCP: Interfaces\{9FB36C43-0510-4F28-93F7-CD4919229FF2} : NameServer = 8.8.8.8,8.8.4.4,8.8.8.8,8.8.8.4
Handler: ebk - {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} - c:\windows\system32\ebkp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
AppInit_DLLs= , c:\windows\system32\guard32.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 127.0.0.1 mpa.one.microsoft.com
Hosts: 127.0.0.1 www.spywareinfo.com
Hosts: 209.85.229.99 www.youtube.com
Hosts: 209.85.229.99 youtube.com
Hosts: 74.125.43.103 docs.google.com
.
Note: multiple HOSTS entries found. Please refer to Attach.txt
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\mask\application data\mozilla\firefox\profiles\qstv0i50.default\
FF - prefs.js: browser.startup.homepage - hxxp://isearch.avg.com?cid=%7B5f63a3f3-29e2-4b45-8a55-64870a31e66d%7D&mid=d51cb7009a0f47d0b5b4d189d93fb6df-10cafb425e3ac088a8e2cec640d05209b4f76c18&ds=gm011&v=11.1.0.7&lang=tr&pr=sa&d=2012-05-22%2012%3A59%3A15&sap=hp
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B5f63a3f3-29e2-4b45-8a55-64870a31e66d%7D&mid=d51cb7009a0f47d0b5b4d189d93fb6df-10cafb425e3ac088a8e2cec640d05209b4f76c18&ds=gm011&v=11.1.0.7&lang=tr&pr=sa&d=2012-05-22%2012%3A59%3A15&sap=ku&q=
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nprpplugin.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_5_502_135.dll
FF - plugin: c:\windows\system32\npdeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
FF - ExtSQL: 2012-11-30 01:37; {0153E448-190B-4987-BDE1-F256CADA672F}; c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\Ext
FF - ExtSQL: !HIDDEN! 2009-09-02 09:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
.
---- FIREFOX POLICIES ----
FF - user.js: network.proxy.type - 0
FF - user.js: network.proxy.http -
user_pref(network.proxy.http_port,);
FF - user.js: network.proxy.no_proxies_on -
.
============= SERVICES / DRIVERS ===============
.
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-4-11 114768]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2009-4-18 133064]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2009-4-18 25160]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-4-11 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-4-11 138680]
R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2009-4-18 723632]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2011-11-8 12184]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-4-11 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-4-11 352920]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-11-9 160944]
S3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2011-6-28 9216]
S3 PAC207;PC CHIPS USB Camera;c:\windows\system32\drivers\pfc027.sys [2005-5-27 162304]
.
=============== Created Last 30 ================
.
2012-12-25 15:28:28 -------- d-----w- c:\program files\Superstar
2012-12-13 11:53:22 -------- d-----w- c:\program files\Isotx
.
==================== Find3M ====================
.
2012-12-30 22:32:11 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-30 22:32:11 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-11-12 14:25:02 286720 ----a-w- c:\windows\iun507.exe
2012-11-04 20:56:27 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
.
============= FINISH: 22:37:00,27 ===============
------------------------------------------------------------------
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-01-06 22:43:56
-----------------------------
22:43:56.150 OS Version: Windows 5.1.2600 Service Pack 3
22:43:56.150 Number of processors: 1 586 0xD08
22:43:56.150 ComputerName: MATRIX UserName: mask
22:44:04.302 Initialize success
22:48:24.516 AVAST engine defs: 13010601
22:52:53.172 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
22:52:53.172 Disk 0 Vendor: SAMSUNG_HM080JI YC100-04 Size: 76319MB BusType: 3
22:52:53.273 Disk 0 MBR read successfully
22:52:53.273 Disk 0 MBR scan
22:52:53.353 Disk 0 Windows XP default MBR code
22:52:53.383 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 46304 MB offset 63
22:52:53.393 Disk 0 Partition - 00 0F Extended LBA 30004 MB offset 94831695
22:52:53.423 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 30004 MB offset 94831758
22:52:53.473 Disk 0 scanning sectors +156280320
22:52:53.573 Disk 0 scanning C:\WINDOWS\system32\drivers
22:53:19.891 Service scanning
22:53:40.380 Service sptd C:\WINDOWS\System32\Drivers\sptd.sys **LOCKED** 32
22:53:47.400 Modules scanning
22:53:56.193 Disk 0 trace - called modules:
22:53:56.213 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll sfsync02.sys atapi.sys sptd.sys >>UNKNOWN [0x8a6fd8ac]<<
22:53:56.223 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a6abab8]
22:53:56.223 3 CLASSPNP.SYS[ba908fd7] -> nt!IofCallDriver -> \Device\0000007c[0x8a62e9e8]
22:53:56.223 5 ACPI.sys[ba67d620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a62ed98]
22:53:56.223 \Driver\atapi[0x8a6b2738] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> sfsync02.sys[0xbab38d60]
22:53:56.704 AVAST engine scan C:\WINDOWS
22:54:08.601 AVAST engine scan C:\WINDOWS\system32
22:58:42.895 AVAST engine scan C:\WINDOWS\system32\drivers
22:59:15.702 AVAST engine scan C:\Documents and Settings\mask
23:33:24.158 AVAST engine scan C:\Documents and Settings\All Users
23:34:47.137 Scan finished successfully
01:38:24.884 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\mask\Desktop\MBR.dat"
01:38:24.904 The log file has been saved successfully to "C:\Documents and Settings\mask\Desktop\aswMBR1.txt"
------------------
thanks
and the OTL and Extra logs
Otl log:
OTL logfile created on: 1/16/2013 23:08:14 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\mask\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 0000041F | Country: Türkiye | Language: TRK | Date Format: M/d/yyyy
2,00 Gb Total Physical Memory | 1,53 Gb Available Physical Memory | 76,72% Memory free
3,35 Gb Paging File | 2,83 Gb Available in Paging File | 84,58% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 45,22 Gb Total Space | 5,44 Gb Free Space | 12,04% Space Free | Partition Type: NTFS
Drive D: | 29,30 Gb Total Space | 0,36 Gb Free Space | 1,23% Space Free | Partition Type: NTFS
Drive L: | 638,73 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive M: | 587,27 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive N: | 658,47 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive S: | 3,47 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: MATRIX | User Name: mask | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\mask\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\KUR YAZILIM\Sayisal Saat\Saat.exe (KUR YAZILIM)
PRC - C:\WINDOWS\system32\PAStiSvc.exe ()
========== Modules (No Company Name) ==========
MOD - C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll ()
MOD - C:\Program Files\COMODO\COMODO Internet Security\scanners\mach32.dll ()
MOD - C:\WINDOWS\system32\PAStiSvc.exe ()
========== Services (SafeList) ==========
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (LBTServ) -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (cmdAgent) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (STI Simulator) -- C:\WINDOWS\system32\PAStiSvc.exe ()
========== Driver Services (SafeList) ==========
DRV - (WDICA) -- File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (i2omgmt) -- File not found
DRV - (Changer) -- File not found
DRV - (afs4ckg1) -- File not found
DRV - (LUsbFilt) -- C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LBeepKE) -- C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (massfilter) -- C:\WINDOWS\system32\drivers\massfilter.sys (MBB Incorporated)
DRV - (SCDEmu) -- C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (hamachi) -- C:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (Inspect) -- C:\WINDOWS\system32\drivers\inspect.sys (COMODO)
DRV - (cmdHlp) -- C:\WINDOWS\system32\drivers\cmdhlp.sys (COMODO)
DRV - (cmdGuard) -- C:\WINDOWS\system32\drivers\cmdguard.sys (COMODO)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (sptd) -- C:\WINDOWS\system32\drivers\sptd.sys ()
DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) -- C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (tifm21) -- C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (PAC207) -- C:\WINDOWS\system32\drivers\pfc027.sys ()
DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation )
DRV - (sfdrv01) -- C:\WINDOWS\system32\drivers\sfdrv01.sys (Protection Technology)
DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows (R) Server 2003 DDK provider)
DRV - (sfsync02) -- C:\WINDOWS\system32\drivers\sfsync02.sys (Protection Technology)
DRV - (w29n51) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (sfhlp02) -- C:\WINDOWS\system32\drivers\sfhlp02.sys (Protection Technology)
DRV - (rtl8139) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.as-ya.com/arabul.html
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/ie.aspx?q={searchTerms}
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={BCCA24B5-B0E3-42E5-8F94-77102400A4A9}&mid=&lang=&ds=&pr=&d=&v=&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.startup.homepage: "http://isearch.avg.com?cid=%7B5f63a3f3-29e2-4b45-8a55-64870a31e66d%7D&mid=d51cb7009a0f47d0b5b4d189d93fb6df-10cafb425e3ac088a8e2cec640d05209b4f76c18&ds=gm011&v=11.1.0.7&lang=tr&pr=sa&d=2012-05-22%2012%3A59%3A15&sap=hp"
FF - prefs.js..extensions.enabledAddons: %7B0153E448-190B-4987-BDE1-F256CADA672F%7D:15.0.6
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0035-ABCDEFFEDCBA%7D:6.0.35
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0037-ABCDEFFEDCBA%7D:6.0.37
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7B5f63a3f3-29e2-4b45-8a55-64870a31e66d%7D&mid=d51cb7009a0f47d0b5b4d189d93fb6df-10cafb425e3ac088a8e2cec640d05209b4f76c18&ds=gm011&v=11.1.0.7&lang=tr&pr=sa&d=2012-05-22%2012%3A59%3A15&sap=ku&q="
FF - prefs.js..network.proxy.autoconfig_url: "http://go.navige.com/"
FF - prefs.js..network.proxy.type: 0
FF - user.js..network.proxy.type: 0
FF - user.js..network.proxy.http: ""
FF - user.js..network.proxy.http_port:
FF - user.js..network.proxy.no_proxies_on: ""
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\mask\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll File not found
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/11/30 01:37:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/01/11 11:01:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/01/11 11:00:45 | 000,000,000 | ---D | M]
[2009/03/28 20:03:18 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Extensions
[2013/01/05 20:38:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Firefox\Profiles\qstv0i50.default\extensions
[2013/01/05 20:38:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Firefox\Profiles\qstv0i50.default\extensions\trash
[2012/02/01 19:31:36 | 000,020,591 | ---- | M] () (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Firefox\Profiles\qstv0i50.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
[2013/01/05 20:38:49 | 000,220,411 | ---- | M] () (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Firefox\Profiles\qstv0i50.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
[2012/11/24 00:50:58 | 000,804,627 | ---- | M] () (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Firefox\Profiles\qstv0i50.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/08/30 22:33:15 | 000,199,396 | ---- | M] () (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Firefox\Profiles\qstv0i50.default\extensions\trash\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
[2013/01/11 11:00:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/01/11 11:00:35 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/01/11 11:00:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013/01/11 11:00:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2012/11/30 01:37:38 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2013/01/11 11:01:00 | 000,262,704 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/11/30 01:37:14 | 000,129,176 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/07/14 15:01:10 | 000,003,659 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/12/05 09:09:42 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-tr.xml
[2012/12/05 09:09:42 | 000,002,702 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yandex-tr.xml
========== Chrome ==========
CHR - homepage: http://www.google.com
CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = http://isearch.avg.com/search?cid={BCCA24B5-B0E3-42E5-8F94-77102400A4A9}&mid=&lang=&ds=&pr=&d=&v=&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = http://clients5.google.com/complete/search?hl={language}&q={searchTerms}&client=ie8&inputencoding={inputEncoding}&outputencoding={outputEncoding}
CHR - homepage: http://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.60\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.60\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.60\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.60\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Documents and Settings\mask\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U33 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.330.5 (Enabled) = C:\WINDOWS\system32\npdeployJava1.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
O1 HOSTS File: ([2013/01/07 03:23:25 | 000,446,353 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 209.85.229.99 www.youtube.com
O1 - Hosts: 209.85.229.99 youtube.com
O1 - Hosts: 74.125.43.103 docs.google.com
O1 - Hosts: 74.125.43.103 translate.google.com
O1 - Hosts: 74.125.43.103 code.google.com
O1 - Hosts: 74.125.43.103 pages.google.com
O1 - Hosts: 74.125.43.103 video.google.com
O1 - Hosts: 74.125.43.103 translate.google.com.tr
O1 - Hosts: 74.125.43.103 docs.google.com
O1 - Hosts: 74.125.43.103 sites.google.com
O1 - Hosts: 74.125.43.103 books.google.com
O1 - Hosts: 74.125.43.103 chrome.google.com
O1 - Hosts: 74.125.43.103 sketchup.google.com
O1 - Hosts: 74.125.43.103 froogle.google.com
O1 - Hosts: 74.125.43.103 labs.google.com
O1 - Hosts: 74.125.43.103 mars.google.com
O1 - Hosts: 74.125.43.103 moon.google.com
O1 - Hosts: 74.125.43.103 notebook.google.com
O1 - Hosts: 74.125.43.103 toolbar.google.com
O1 - Hosts: 74.125.43.103 browsersync.google.com
O1 - Hosts: 74.125.43.103 catalog.google.com
O1 - Hosts: 74.125.43.103 codesearch.google.com
O1 - Hosts: 74.125.43.103 dir.google.com
O1 - Hosts: 74.125.43.103 earth.google.com
O1 - Hosts: 15355 more lines...
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (IeCatch2 Class) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\Program Files\FlashGet\Jccatch.dll (Amaze Soft)
O3 - HKLM\..\Toolbar: (FlashGet Bar) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll (Amaze Soft)
O3 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [Alarmli Sayisal Saat 2.11] C:\Program Files\KUR YAZILIM\Sayisal Saat\Saat.exe (KUR YAZILIM)
O4 - HKLM..\Run: [AutorunRemover.exe] C:\Program Files\AutorunRemover\AutorunRemover.exe ()
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTProAgent.exe (DT Soft Ltd.)
O4 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003..\Run: [Facebook Update] "C:\Documents and Settings\mask\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver File not found
O4 - Startup: C:\Documents and Settings\mask\Start Menu\Programlar\Başlangıç\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm ()
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm ()
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (Amaze Soft)
O9 - Extra 'Tools' menuitem : &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (Amaze Soft)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} https://webiq005.webiqonline.com/WebIQ/DataServer/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9} (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/ge...sh/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5BD6F888-C2DD-4C6E-AEB1-35239B12252E}: NameServer = 4.2.2.1,4.2.2.2,4.2.2.2,4.4.2.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9FB36C43-0510-4F28-93F7-CD4919229FF2}: NameServer = 8.8.8.8,8.8.4.4,8.8.8.8,8.8.8.4
O18 - Protocol\Handler\ebk {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} - C:\WINDOWS\system32\ebkp.dll ()
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL File not found
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) - C:\WINDOWS\system32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop Components:0 (Geçerli Giriş Sayfam) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\mask\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\mask\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/03/28 18:47:48 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2000/09/20 19:55:56 | 000,827,392 | R--- | M] () - L:\AUTORUN.EXE -- [ CDFS ]
O32 - AutoRun File - [2000/07/06 19:04:48 | 000,000,135 | R--- | M] () - L:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2000/09/20 19:55:56 | 000,827,392 | R--- | M] () - M:\AUTORUN.EXE -- [ CDFS ]
O32 - AutoRun File - [2000/09/24 18:34:44 | 000,000,135 | R--- | M] () - M:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2001/09/25 13:08:44 | 001,572,864 | R--- | M] () - N:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2001/09/25 13:08:44 | 000,000,135 | R--- | M] () - N:\Autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2005/10/13 23:23:46 | 000,045,056 | R--- | M] () - S:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2005/10/13 23:19:48 | 000,000,146 | R--- | M] () - S:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{229b97b2-2a0b-11de-94ef-00c09fdb5f2c}\Shell\AutoRun\command - "" = em8tqm.cmd
O33 - MountPoints2\{229b97b2-2a0b-11de-94ef-00c09fdb5f2c}\Shell\open\Command - "" = em8tqm.cmd
O33 - MountPoints2\{503c9ae0-a1b3-11e0-95d3-00c09fdb5f2c}\Shell - "" = AutoRun
O33 - MountPoints2\{503c9ae0-a1b3-11e0-95d3-00c09fdb5f2c}\Shell\AutoRun\command - "" = T:\AutoRun.exe
O33 - MountPoints2\{503c9ae2-a1b3-11e0-95d3-00c09fdb5f2c}\Shell - "" = AutoRun
O33 - MountPoints2\{503c9ae2-a1b3-11e0-95d3-00c09fdb5f2c}\Shell\AutoRun\command - "" = T:\AutoRun.exe
O33 - MountPoints2\{b8733713-26d4-11e2-9623-00c09fdb5f2c}\Shell - "" = AutoRun
O33 - MountPoints2\{b8733713-26d4-11e2-9623-00c09fdb5f2c}\Shell\AutoRun\command - "" = T:\Autorun.exe
O33 - MountPoints2\L\Shell - "" = AutoRun
O33 - MountPoints2\L\Shell\AutoRun\command - "" = L:\AUTORUN.EXE -- [2000/09/20 19:55:56 | 000,827,392 | R--- | M] ()
O33 - MountPoints2\L\Shell\readit\command - "" = notepad readme.doc
O33 - MountPoints2\M\Shell - "" = AutoRun
O33 - MountPoints2\M\Shell\AutoRun\command - "" = M:\AUTORUN.EXE -- [2000/09/20 19:55:56 | 000,827,392 | R--- | M] ()
O33 - MountPoints2\M\Shell\readit\command - "" = notepad readme.doc
O33 - MountPoints2\N\Shell - "" = AutoRun
O33 - MountPoints2\N\Shell\AutoRun\command - "" = N:\Autorun.exe -- [2001/09/25 13:08:44 | 001,572,864 | R--- | M] ()
O33 - MountPoints2\N\Shell\readit\command - "" = notepad readme.doc
O33 - MountPoints2\S\Shell - "" = AutoRun
O33 - MountPoints2\S\Shell\AutoRun\command - "" = S:\Autorun.exe -- [2005/10/13 23:23:46 | 000,045,056 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2013/01/16 22:44:56 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\mask\Desktop\OTL.exe
[2013/01/16 22:42:36 | 002,213,976 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\mask\Desktop\tdsskiller.exe
[2013/01/16 21:49:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mask\Belgelerim\GTA San Andreas User Files
[2013/01/16 21:27:45 | 000,000,000 | ---D | C] -- C:\Program Files\Rockstar Games
[2013/01/16 21:27:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programlar\Rockstar Games
[2013/01/11 11:00:32 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/01/07 01:54:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mask\Desktop\bakım
[2012/12/25 17:28:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programlar\Superstar
[2012/12/25 17:28:28 | 000,000,000 | ---D | C] -- C:\Program Files\Superstar
[2012/12/25 13:37:01 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013/01/16 22:56:40 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1343024091-1957994488-2147049779-1003.job
[2013/01/16 22:55:58 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1343024091-1957994488-2147049779-1003.job
[2013/01/16 22:55:39 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/01/16 22:51:49 | 000,000,408 | ---- | M] () -- C:\WINDOWS\tasks\RNUpgradeHelperLogonPrompt_mask.job
[2013/01/16 22:51:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/01/16 22:51:19 | 2145,505,280 | -HS- | M] () -- C:\hiberfil.sys
[2013/01/16 22:47:31 | 000,000,538 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\Kısayol Yedek C masaütüsnden.lnk
[2013/01/16 22:44:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mask\Desktop\OTL.exe
[2013/01/16 22:42:45 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2013/01/16 22:42:38 | 002,213,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\mask\Desktop\tdsskiller.exe
[2013/01/16 22:12:49 | 000,000,430 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\Kısayol pskyatrı adhd and osho.lnk
[2013/01/16 22:11:52 | 000,000,329 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\Kısayol Yol.lnk
[2013/01/16 22:11:50 | 000,000,370 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\Kısayol Turnuvalar.lnk
[2013/01/16 21:21:00 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1343024091-1957994488-2147049779-1003UA.job
[2013/01/16 11:20:06 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/01/16 03:21:00 | 000,001,072 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1343024091-1957994488-2147049779-1003Core.job
[2013/01/15 17:48:11 | 000,000,402 | ---- | M] () -- C:\WINDOWS\tasks\ReclaimerUpdateFiles_mask.job
[2013/01/15 17:48:11 | 000,000,398 | ---- | M] () -- C:\WINDOWS\tasks\ReclaimerUpdateXML_mask.job
[2013/01/14 15:00:28 | 000,000,278 | ---- | M] () -- C:\WINDOWS\ChssBase.ini
[2013/01/07 03:23:25 | 000,446,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2013/01/07 02:47:05 | 000,446,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130107-032325.backup
[2013/01/07 02:31:25 | 000,441,458 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/01/07 02:31:25 | 000,428,638 | ---- | M] () -- C:\WINDOWS\System32\perfh01F.dat
[2013/01/07 02:31:25 | 000,081,464 | ---- | M] () -- C:\WINDOWS\System32\perfc01F.dat
[2013/01/07 02:31:25 | 000,071,394 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/01/07 01:50:23 | 000,446,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130107-024705.backup
[2013/01/07 01:41:03 | 000,446,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130107-015023.backup
[2013/01/07 01:38:24 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\MBR.dat
[2013/01/05 16:56:45 | 000,446,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130107-014102.backup
[2013/01/05 15:36:22 | 000,446,249 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130105-165645.backup
[2012/12/31 00:32:11 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/12/31 00:32:11 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/12/27 01:35:06 | 000,000,531 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\Kısayol Timers.lnk
[2012/12/26 02:51:20 | 000,000,976 | ---- | M] () -- C:\Documents and Settings\mask\Application Data\Microsoft\Internet Explorer\Quick Launch\Kısayol CBase9.lnk
[2012/12/25 03:20:54 | 000,446,249 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130105-153622.backup
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013/01/16 22:47:31 | 000,000,538 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\Kısayol Yedek C masaütüsnden.lnk
[2013/01/16 22:12:49 | 000,000,430 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\Kısayol pskyatrı adhd and osho.lnk
[2013/01/16 22:11:52 | 000,000,329 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\Kısayol Yol.lnk
[2013/01/16 22:11:50 | 000,000,370 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\Kısayol Turnuvalar.lnk
[2013/01/07 01:38:24 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\MBR.dat
[2012/12/27 01:35:06 | 000,000,531 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\Kısayol Timers.lnk
[2012/12/26 02:51:20 | 000,000,976 | ---- | C] () -- C:\Documents and Settings\mask\Application Data\Microsoft\Internet Explorer\Quick Launch\Kısayol CBase9.lnk
[2012/12/22 04:46:02 | 000,000,408 | ---- | C] () -- C:\WINDOWS\tasks\RNUpgradeHelperLogonPrompt_mask.job
[2012/12/22 04:46:01 | 000,000,402 | ---- | C] () -- C:\WINDOWS\tasks\ReclaimerUpdateFiles_mask.job
[2012/12/22 04:46:01 | 000,000,398 | ---- | C] () -- C:\WINDOWS\tasks\ReclaimerUpdateXML_mask.job
[2012/11/12 16:30:22 | 000,000,132 | ---- | C] () -- C:\WINDOWS\GECKOS.INI
[2012/07/21 09:38:08 | 000,000,020 | ---- | C] () -- C:\WINDOWS\level.ini
[2012/05/22 12:12:44 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2011/12/20 02:50:45 | 000,000,507 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2011/09/07 00:15:16 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\AGS_SQLite.dll
[2011/05/13 17:23:18 | 000,025,088 | ---- | C] () -- C:\WINDOWS\System32\ebkp.dll
[2011/03/18 23:14:00 | 000,295,424 | ---- | C] () -- C:\WINDOWS\unin0411.exe
[2009/03/30 23:51:03 | 000,083,968 | ---- | C] () -- C:\Documents and Settings\mask\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/03/28 19:21:04 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\mask\Local Settings\Application Data\fusioncache.dat
========== ZeroAccess Check ==========
[2009/03/28 19:09:41 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 18:00:24 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 12:52:35 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 18:00:27 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
< End of report >
------------------------------------------------------
OTL Extras logfile created on: 1/16/2013 23:08:14 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\mask\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 0000041F | Country: Türkiye | Language: TRK | Date Format: M/d/yyyy
2,00 Gb Total Physical Memory | 1,53 Gb Available Physical Memory | 76,72% Memory free
3,35 Gb Paging File | 2,83 Gb Available in Paging File | 84,58% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 45,22 Gb Total Space | 5,44 Gb Free Space | 12,04% Space Free | Partition Type: NTFS
Drive D: | 29,30 Gb Total Space | 0,36 Gb Free Space | 1,23% Space Free | Partition Type: NTFS
Drive L: | 638,73 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive M: | 587,27 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive N: | 658,47 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive S: | 3,47 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: MATRIX | User Name: mask | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"57635:TCP" = 57635:TCP:*:Enabled:Pando Media Booster
"57635:UDP" = 57635:UDP:*:Enabled:Pando Media Booster
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"8394:TCP" = 8394:TCP:*:Enabled:League of Legends Launcher
"8394:UDP" = 8394:UDP:*:Enabled:League of Legends Launcher
"6908:TCP" = 6908:TCP:*:Enabled:League of Legends Launcher
"6908:UDP" = 6908:UDP:*:Enabled:League of Legends Launcher
"6978:TCP" = 6978:TCP:*:Enabled:League of Legends Launcher
"6978:UDP" = 6978:UDP:*:Enabled:League of Legends Launcher
"6966:TCP" = 6966:TCP:*:Enabled:League of Legends Launcher
"6966:UDP" = 6966:UDP:*:Enabled:League of Legends Launcher
"6887:TCP" = 6887:TCP:*:Enabled:League of Legends Launcher
"6887:UDP" = 6887:UDP:*:Enabled:League of Legends Launcher
"8395:TCP" = 8395:TCP:*:Enabled:League of Legends Launcher
"8395:UDP" = 8395:UDP:*:Enabled:League of Legends Launcher
"6943:TCP" = 6943:TCP:*:Enabled:League of Legends Launcher
"6943:UDP" = 6943:UDP:*:Enabled:League of Legends Launcher
"6901:TCP" = 6901:TCP:*:Enabled:League of Legends Launcher
"6901:UDP" = 6901:UDP:*:Enabled:League of Legends Launcher
"6895:TCP" = 6895:TCP:*:Enabled:League of Legends Launcher
"6895:UDP" = 6895:UDP:*:Enabled:League of Legends Launcher
"57635:TCP" = 57635:TCP:*:Enabled:Pando Media Booster
"57635:UDP" = 57635:UDP:*:Enabled:Pando Media Booster
"8396:TCP" = 8396:TCP:*:Enabled:League of Legends Launcher
"8396:UDP" = 8396:UDP:*:Enabled:League of Legends Launcher
"6963:TCP" = 6963:TCP:*:Enabled:League of Legends Launcher
"6963:UDP" = 6963:UDP:*:Enabled:League of Legends Launcher
"6993:TCP" = 6993:TCP:*:Enabled:League of Legends Launcher
"6993:UDP" = 6993:UDP:*:Enabled:League of Legends Launcher
"6974:TCP" = 6974:TCP:*:Enabled:League of Legends Launcher
"6974:UDP" = 6974:UDP:*:Enabled:League of Legends Launcher
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\EA GAMES\The Battle for Middle-earth (tm)\game.dat" = C:\Program Files\EA GAMES\The Battle for Middle-earth (tm)\game.dat:*:Enabled:The Battle for Middle-earth (tm)
"C:\Program Files\League of Legends\Air\LolClient.exe" = C:\Program Files\League of Legends\Air\LolClient.exe:*:Enabled:League of Legends Lobby
"C:\Program Files\League of Legends\Game\League of Legends.exe" = C:\Program Files\League of Legends\Game\League of Legends.exe:*:Enabled:League of Legends Game Client
"C:\Program Files\Pando Networks\Media Booster\PMB.exe" = C:\Program Files\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
"C:\Program Files\League of Legends\League Of Legends\air\LolClient.exe" = C:\Program Files\League of Legends\League Of Legends\air\LolClient.exe:*:Enabled:League of Legends Lobby
"C:\Program Files\League of Legends\League Of Legends\game\League of Legends.exe" = C:\Program Files\League of Legends\League Of Legends\game\League of Legends.exe:*:Enabled:League of Legends Game Client
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Documents and Settings\mask\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe" = C:\Documents and Settings\mask\Local Settings\Application Data\Facebook\Video\Skype\FacebookVideoCalling.exe:*:Enabled:Facebook Video Calling Plugin
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe" = C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger
"C:\Program Files\Opera\pluginwrapper\opera_plugin_wrapper.exe" = C:\Program Files\Opera\pluginwrapper\opera_plugin_wrapper.exe:*:Enabled:Opera Internet Browser - Plugin wrapper -- (Opera Software)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"{0830FBE8-A848-4A37-BF62-D89CB3EF0F60}" = Fritz8
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 37
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{28DA872A-0848-48CF-B749-19A198157A2A}" = mDriver
"{2B7BC7C5-CE5F-373A-A1E7-37A5B909D933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - TRK
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C941f-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{406A5ABF-CA65-4E11-95C7-52228FE48F58}" = TIxx21
"{42E25176-3F0C-4466-BEF2-8B3633FE1835}" = Turkcell 3G VINN
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5709AA0A-FEAC-11D7-A675-AB5A481BAC79}" = USB Vibration Joystick
"{5F18FDF7-D061-403E-95F9-2FFC39DE8ECD}" = PC CHIPS USB Camera
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{70D9854A-CEF5-4BCF-B37A-0AA1AB0A83CF}" = Playchess
"{749A90DA-425F-4191-AFE4-7D1FA5EBAED1}_is1" = Chess Eye
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8C3727F2-8E37-49E4-820C-03B1677F53B6}" = Stronghold Crusader
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{93CF9FA6-2A5E-4F8E-923E-F7D8741CB312}" = BabasChess
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97DB07C0-7E43-4C4A-8766-26396935F177}" = Playchess
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9CAF9762-B107-4E7B-A459-68F083298C58}" = Rybka 4
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A642BB6B-CA1D-4142-8DD4-318C3F3DC834}" = Rome - Total War(TM)
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.2
"{ACFD4C9A-931B-3CAB-9F72-78FDE810F394}" = Microsoft .NET Framework 3.5 Language Pack SP1 - trk
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{C0698BDA-0D29-40EE-8570-A31106DF9AB1}" = Medieval II Total War
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C18F4235-BF97-4284-8318-7EFF20B0D07B}" = ATI Catalyst Control Center
"{C5DCB7E0-2ECB-4341-AAF7-424A4DBCEC9C}_is1" = makat v3
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}" = GTA San Andreas
"{E1674673-0F0D-3D81-B2A0-9842A986C1D6}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - TRK
"{E34E9B33-46EC-4252-A52F-DDA3978CC0AF}" = Syberia
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F9683839-1A7F-4874-91B7-64CDF4AC4679}" = Rybka 4
"{FD69C8CB-6964-432C-98AB-A5A09ED50EEA}" = Barbarian Invasion
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Advanced Chess School" = Advanced Chess School
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Alarmli Sayisal Saat 2.11" = Alarmlı Sayısal Saat Kaldır
"All ATI Software" = ATI - Yazılım Kaldır Yardımcı Programı
"ATI Display Driver" = ATI Display Driver
"Autorun Virus Remover_is1" = Autorun Virus Remover 2.3
"avast!" = avast! Antivirus
"Başlangıç Düzey Satranç Okulu" = Başlangıç Düzey Satranç Okulu
"Bookup 2000 Express_is1" = Bookup 2000 Express build 29
"BrainWave Generator" = BrainWave Generator
"BSPlayerp" = BS.Player PRO
"CBReader " = CBReader
"Chess Assistant 7.1 Light" = Chess Assistant 7.1 Light
"Chess Opening Trainer" = Chess Opening Trainer 1.1
"Chess Vision Trainer" = Chess Vision Trainer 3.0
"Chessmaster Challenge_is1" = Chessmaster Challenge
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"COMODO Internet Security" = COMODO Internet Security
"Dasher" = Dasher
"DemonStarDeinstKey" = DemonStar
"Dracula Virüs Temizleyici 2010" = Dracula Virüs Temizleyici 2010
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"FinalAlert 2 Yuri's Revenge" = FinalAlert 2 Yuri's Revenge
"FlashGet(JetCar)" = FlashGet(JetCar)
"GOM Player" = GOM Player
"Heroes of Might and Magic IV" = Heroes of Might and Magic IV
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"IGZones_is1" = IGZ Lobby System
"İleri Düzey Satranç Okulu" = İleri Düzey Satranç Okulu
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"InstallShield_{406A5ABF-CA65-4E11-95C7-52228FE48F58}" = Texas Instruments PCIxx21/x515 drivers.
"InstallShield_{5F18FDF7-D061-403E-95F9-2FFC39DE8ECD}" = PC CHIPS USB Camera
"InstallShield_{A642BB6B-CA1D-4142-8DD4-318C3F3DC834}" = Rome - Total War(TM)
"Kasparov Chessmate_is1" = Kasparov Chessmate
"KLiteCodecPack_is1" = K-Lite Codec Pack 8.8.0 (Basic)
"Magic The Gathering - Duels of the Planeswalkers 2012_is1" = Magic The Gathering - Duels of the Planeswalkers 2012
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mate Studies" = Mate Studies
"MeHeR OYUNSOFT" = MeHeR OYUNSOFT
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - trk" = Microsoft .NET Framework 3.5 Dil Paketi SP1 - trk
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 18.0 (x86 tr)" = Mozilla Firefox 18.0 (x86 tr)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NeroMultiInstaller!UninstallKey" = Nero Suite
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Opera 12.00.1467" = Opera 12.00
"Personal Chess Trainer" = Personal Chess Trainer 2.00.29
"PlayChess" = PlayChess
"PowerISO" = PowerISO
"Product_Name" = Siber Loto
"ProInst" = Intel(R) PROSet/Wireless Software
"RealPlayer 15.0" = RealPlayer
"Red Alert 2" = Command & Conquer Red Alert 2
"Risk WarZone Client" = Risk WarZone Client
"RomStation" = RomStation
"ScummVM_is1" = ScummVM 1.0.0
"sp6" = Logitech SetPoint 6.32
"ST6UNST #1" = MateMaster 1.5
"STRATEGY 2.0" = STRATEGY 2.0
"Superstar" = Superstar
"Switch" = Switch Sound File Converter
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"uTorrent" = µTorrent
"Voobly_is1" = Voobly
"Warkeys" = Warkeys 1.13.1.0b
"WarZone Client v1.0.41" = WarZone Client v1.0.41
"WarZone Client v1.0.44" = WarZone Client v1.0.44
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"WOLAPI" = Westwood Shared Internet Components
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xfire" = Xfire (remove only)
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Yuri's Revenge" = Command && Conquer Red Alert 2 - Yuri's Revenge
"ZTE USB Driver" = ZTE USB Driver
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1343024091-1957994488-2147049779-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent
========== Last 20 Event Log Errors ==========
Error: Unable to start EventLog service!
< End of report >
------------------------------------------------------
thanks
(btw i play chess and study on the "Torre attack" lately, it's great :).)
hi again i am back to town :D.
ok i did uninstalled utorrent . and then did an otl search i couldnt find the extras.txt on my desktop this time :s . i dont know why? and then i did the mgadiag and cksscanner .here is all the logs i have :
OTL logfile created on: 1/17/2013 23:50:01 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\mask\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 0000041F | Country: Türkiye | Language: TRK | Date Format: M/d/yyyy
2,00 Gb Total Physical Memory | 1,42 Gb Available Physical Memory | 71,02% Memory free
3,35 Gb Paging File | 2,65 Gb Available in Paging File | 79,20% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 45,22 Gb Total Space | 5,45 Gb Free Space | 12,06% Space Free | Partition Type: NTFS
Drive D: | 29,30 Gb Total Space | 0,36 Gb Free Space | 1,23% Space Free | Partition Type: NTFS
Drive L: | 638,73 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive M: | 587,27 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive N: | 658,47 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive S: | 3,47 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: MATRIX | User Name: mask | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\mask\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\GRETECH\GomPlayer\GOM.EXE (Gretech Corp.)
PRC - C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - C:\Program Files\Winamp\winamp.exe (Nullsoft)
PRC - C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
PRC - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\KUR YAZILIM\Sayisal Saat\Saat.exe (KUR YAZILIM)
PRC - C:\WINDOWS\system32\PAStiSvc.exe ()
========== Modules (No Company Name) ==========
MOD - C:\Program Files\K-Lite Codec Pack\ffdshow\ffdshow.ax ()
MOD - C:\Program Files\K-Lite Codec Pack\ffdshow\ff_libmad.dll ()
MOD - C:\Program Files\K-Lite Codec Pack\Filters\LAV\libbluray.dll ()
MOD - C:\Program Files\K-Lite Codec Pack\Filters\LAV\avcodec-lav-54.dll ()
MOD - C:\Program Files\K-Lite Codec Pack\Filters\LAV\avformat-lav-54.dll ()
MOD - C:\Program Files\K-Lite Codec Pack\Filters\LAV\avutil-lav-51.dll ()
MOD - C:\Program Files\GRETECH\GomPlayer\GSFU.ax ()
MOD - C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll ()
MOD - C:\Program Files\K-Lite Codec Pack\Filters\Haali\splitter.ax ()
MOD - C:\Program Files\K-Lite Codec Pack\Filters\Haali\mkzlib.dll ()
MOD - C:\Program Files\K-Lite Codec Pack\Filters\Haali\mkunicode.dll ()
MOD - C:\Program Files\GRETECH\GomPlayer\GVF.ax ()
MOD - C:\Program Files\GRETECH\GomPlayer\libavcodec.dll ()
MOD - C:\Program Files\GRETECH\GomPlayer\GRFU.ax ()
MOD - C:\Program Files\GRETECH\GomPlayer\GomTVStrm.dll ()
MOD - C:\Program Files\GRETECH\GomPlayer\GAF.ax ()
MOD - C:\Program Files\COMODO\COMODO Internet Security\scanners\mach32.dll ()
MOD - C:\Program Files\Winamp\Plugins\gen_ff.dll ()
MOD - C:\Program Files\Winamp\Plugins\gen_hotkeys.dll ()
MOD - C:\Program Files\Winamp\Plugins\gen_ml.dll ()
MOD - C:\Program Files\Winamp\Plugins\gen_tray.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_cdda.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_linein.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_midi.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_mod.dll ()
MOD - C:\Program Files\Winamp\Plugins\ml_rg.dll ()
MOD - C:\Program Files\Winamp\Plugins\ml_impex.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_mp3.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_mp4.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_nsv.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_vorbis.dll ()
MOD - C:\Program Files\Winamp\System\timer.w5s ()
MOD - C:\Program Files\Winamp\Plugins\ml_wire.dll ()
MOD - C:\Program Files\Winamp\Plugins\out_ds.dll ()
MOD - C:\Program Files\Winamp\Plugins\out_wave.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_dshow.dll ()
MOD - C:\Program Files\Winamp\System\jnetlib.w5s ()
MOD - C:\Program Files\Winamp\Plugins\in_wm.dll ()
MOD - C:\Program Files\Winamp\Plugins\out_disk.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_wave.dll ()
MOD - C:\Program Files\Winamp\System\tagz.w5s ()
MOD - C:\Program Files\Winamp\Plugins\ml_pmp.dll ()
MOD - C:\Program Files\Winamp\Plugins\pmp_ipod.dll ()
MOD - C:\Program Files\Winamp\Plugins\pmp_njb.dll ()
MOD - C:\Program Files\Winamp\Plugins\pmp_p4s.dll ()
MOD - C:\Program Files\Winamp\Plugins\ml_online.dll ()
MOD - C:\Program Files\Winamp\System\xml.w5s ()
MOD - C:\Program Files\Winamp\System\png.w5s ()
MOD - C:\Program Files\Winamp\Plugins\ml_bookmarks.dll ()
MOD - C:\Program Files\Winamp\Plugins\ml_disc.dll ()
MOD - C:\Program Files\Winamp\Plugins\ml_history.dll ()
MOD - C:\Program Files\Winamp\Plugins\ml_nowplaying.dll ()
MOD - C:\Program Files\Winamp\Plugins\ml_local.dll ()
MOD - C:\Program Files\Winamp\Plugins\ml_playlists.dll ()
MOD - C:\Program Files\Winamp\System\playlist.w5s ()
MOD - C:\Program Files\Winamp\Plugins\gen_dropbox.dll ()
MOD - C:\Program Files\Winamp\System\filereader.w5s ()
MOD - C:\Program Files\Winamp\Plugins\pmp_usb.dll ()
MOD - C:\Program Files\Winamp\Plugins\ml_dash.dll ()
MOD - C:\Program Files\Winamp\System\jpeg.w5s ()
MOD - C:\Program Files\Winamp\System\primo.w5s ()
MOD - C:\Program Files\Winamp\Plugins\ml_transcode.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_flac.dll ()
MOD - C:\Program Files\Winamp\System\bmp.w5s ()
MOD - C:\Program Files\Winamp\System\gif.w5s ()
MOD - C:\Program Files\Winamp\Plugins\ml_orb.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_swf.dll ()
MOD - C:\Program Files\Winamp\Plugins\in_flv.dll ()
MOD - C:\Program Files\Winamp\System\gracenote.w5s ()
MOD - C:\Program Files\Winamp\Plugins\ml_plg.dll ()
MOD - C:\Program Files\Winamp\Plugins\ml_autotag.dll ()
MOD - C:\Program Files\Winamp\System\dlmgr.w5s ()
MOD - C:\Program Files\Winamp\tataki.dll ()
MOD - C:\Program Files\Winamp\nde.dll ()
MOD - C:\Program Files\Winamp\libsndfile.dll ()
MOD - C:\Program Files\Winamp\Plugins\gen_jumpex.dll ()
MOD - C:\Program Files\WinRAR\RarExt.dll ()
MOD - C:\WINDOWS\system32\mpg2splt.ax ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\system32\PAStiSvc.exe ()
========== Services (SafeList) ==========
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (SkypeUpdate) -- C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (LBTServ) -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (cmdAgent) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe (ALWIL Software)
SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (ALWIL Software)
SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (ALWIL Software)
SRV - (aswUpdSv) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (ALWIL Software)
SRV - (STI Simulator) -- C:\WINDOWS\system32\PAStiSvc.exe ()
========== Driver Services (SafeList) ==========
DRV - (WDICA) -- File not found
DRV - (PDRFRAME) -- File not found
DRV - (PDRELI) -- File not found
DRV - (PDFRAME) -- File not found
DRV - (PDCOMP) -- File not found
DRV - (PCIDump) -- File not found
DRV - (lbrtfdc) -- File not found
DRV - (i2omgmt) -- File not found
DRV - (Changer) -- File not found
DRV - (afs4ckg1) -- File not found
DRV - (LUsbFilt) -- C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LBeepKE) -- C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (massfilter) -- C:\WINDOWS\system32\drivers\massfilter.sys (MBB Incorporated)
DRV - (SCDEmu) -- C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (hamachi) -- C:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (Inspect) -- C:\WINDOWS\system32\drivers\inspect.sys (COMODO)
DRV - (cmdHlp) -- C:\WINDOWS\system32\drivers\cmdhlp.sys (COMODO)
DRV - (cmdGuard) -- C:\WINDOWS\system32\drivers\cmdguard.sys (COMODO)
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (sptd) -- C:\WINDOWS\system32\drivers\sptd.sys ()
DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (ALWIL Software)
DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswFsBlk) -- C:\WINDOWS\system32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (ALWIL Software)
DRV - (NwlnkIpx) -- C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (tifm21) -- C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (PAC207) -- C:\WINDOWS\system32\drivers\pfc027.sys ()
DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation )
DRV - (sfdrv01) -- C:\WINDOWS\system32\drivers\sfdrv01.sys (Protection Technology)
DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows (R) Server 2003 DDK provider)
DRV - (sfsync02) -- C:\WINDOWS\system32\drivers\sfsync02.sys (Protection Technology)
DRV - (w29n51) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
DRV - (sfhlp02) -- C:\WINDOWS\system32\drivers\sfhlp02.sys (Protection Technology)
DRV - (rtl8139) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (NwlnkNb) -- C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) -- C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.as-ya.com/arabul.html
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/ie.aspx?q={searchTerms}
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={BCCA24B5-B0E3-42E5-8F94-77102400A4A9}&mid=&lang=&ds=&pr=&d=&v=&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.startup.homepage: "http://isearch.avg.com?cid=%7B5f63a3f3-29e2-4b45-8a55-64870a31e66d%7D&mid=d51cb7009a0f47d0b5b4d189d93fb6df-10cafb425e3ac088a8e2cec640d05209b4f76c18&ds=gm011&v=11.1.0.7&lang=tr&pr=sa&d=2012-05-22%2012%3A59%3A15&sap=hp"
FF - prefs.js..extensions.enabledAddons: %7B0153E448-190B-4987-BDE1-F256CADA672F%7D:15.0.6
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0035-ABCDEFFEDCBA%7D:6.0.35
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0037-ABCDEFFEDCBA%7D:6.0.37
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7B5f63a3f3-29e2-4b45-8a55-64870a31e66d%7D&mid=d51cb7009a0f47d0b5b4d189d93fb6df-10cafb425e3ac088a8e2cec640d05209b4f76c18&ds=gm011&v=11.1.0.7&lang=tr&pr=sa&d=2012-05-22%2012%3A59%3A15&sap=ku&q="
FF - prefs.js..network.proxy.autoconfig_url: "http://go.navige.com/"
FF - prefs.js..network.proxy.type: 0
FF - user.js..network.proxy.type: 0
FF - user.js..network.proxy.http: ""
FF - user.js..network.proxy.http_port:
FF - user.js..network.proxy.no_proxies_on: ""
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_135.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_37: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.6.14: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.6.14: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.6.14: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpplugin;version=15.0.6.14: C:\Program Files\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Documents and Settings\mask\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll File not found
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0153E448-190B-4987-BDE1-F256CADA672F}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2012/11/30 01:37:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/01/11 11:01:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/01/11 11:00:45 | 000,000,000 | ---D | M]
[2009/03/28 20:03:18 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Extensions
[2013/01/05 20:38:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Firefox\Profiles\qstv0i50.default\extensions
[2013/01/05 20:38:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Firefox\Profiles\qstv0i50.default\extensions\trash
[2012/02/01 19:31:36 | 000,020,591 | ---- | M] () (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Firefox\Profiles\qstv0i50.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi
[2013/01/05 20:38:49 | 000,220,411 | ---- | M] () (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Firefox\Profiles\qstv0i50.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
[2012/11/24 00:50:58 | 000,804,627 | ---- | M] () (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Firefox\Profiles\qstv0i50.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012/08/30 22:33:15 | 000,199,396 | ---- | M] () (No name found) -- C:\Documents and Settings\mask\Application Data\Mozilla\Firefox\Profiles\qstv0i50.default\extensions\trash\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
[2013/01/11 11:00:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/01/11 11:00:35 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013/01/11 11:00:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013/01/11 11:00:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2012/11/30 01:37:38 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2013/01/11 11:01:00 | 000,262,704 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/11/30 01:37:14 | 000,129,176 | ---- | M] (RealPlayer) -- C:\Program Files\mozilla firefox\plugins\nprpplugin.dll
[2012/07/14 15:01:10 | 000,003,659 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/12/05 09:09:42 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-tr.xml
[2012/12/05 09:09:42 | 000,002,702 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yandex-tr.xml
========== Chrome ==========
CHR - homepage: http://www.google.com
CHR - default_search_provider: AVG Secure Search (Enabled)
CHR - default_search_provider: search_url = http://isearch.avg.com/search?cid={BCCA24B5-B0E3-42E5-8F94-77102400A4A9}&mid=&lang=&ds=&pr=&d=&v=&sap=dsp&q={searchTerms}
CHR - default_search_provider: suggest_url = http://clients5.google.com/complete/search?hl={language}&q={searchTerms}&client=ie8&inputencoding={inputEncoding}&outputencoding={outputEncoding}
CHR - homepage: http://www.google.com
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.60\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.60\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.60\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.60\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft Office 2003 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.2 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Documents and Settings\mask\Local Settings\Application Data\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U33 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 6.0.330.5 (Enabled) = C:\WINDOWS\system32\npdeployJava1.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
O1 HOSTS File: ([2013/01/07 03:23:25 | 000,446,353 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 209.85.229.99 www.youtube.com
O1 - Hosts: 209.85.229.99 youtube.com
O1 - Hosts: 74.125.43.103 docs.google.com
O1 - Hosts: 74.125.43.103 translate.google.com
O1 - Hosts: 74.125.43.103 code.google.com
O1 - Hosts: 74.125.43.103 pages.google.com
O1 - Hosts: 74.125.43.103 video.google.com
O1 - Hosts: 74.125.43.103 translate.google.com.tr
O1 - Hosts: 74.125.43.103 docs.google.com
O1 - Hosts: 74.125.43.103 sites.google.com
O1 - Hosts: 74.125.43.103 books.google.com
O1 - Hosts: 74.125.43.103 chrome.google.com
O1 - Hosts: 74.125.43.103 sketchup.google.com
O1 - Hosts: 74.125.43.103 froogle.google.com
O1 - Hosts: 74.125.43.103 labs.google.com
O1 - Hosts: 74.125.43.103 mars.google.com
O1 - Hosts: 74.125.43.103 moon.google.com
O1 - Hosts: 74.125.43.103 notebook.google.com
O1 - Hosts: 74.125.43.103 toolbar.google.com
O1 - Hosts: 74.125.43.103 browsersync.google.com
O1 - Hosts: 74.125.43.103 catalog.google.com
O1 - Hosts: 74.125.43.103 codesearch.google.com
O1 - Hosts: 74.125.43.103 dir.google.com
O1 - Hosts: 74.125.43.103 earth.google.com
O1 - Hosts: 15355 more lines...
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (IeCatch2 Class) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\Program Files\FlashGet\Jccatch.dll (Amaze Soft)
O3 - HKLM\..\Toolbar: (FlashGet Bar) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program Files\FlashGet\fgiebar.dll (Amaze Soft)
O3 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O4 - HKLM..\Run: [Alarmli Sayisal Saat 2.11] C:\Program Files\KUR YAZILIM\Sayisal Saat\Saat.exe (KUR YAZILIM)
O4 - HKLM..\Run: [AutorunRemover.exe] C:\Program Files\AutorunRemover\AutorunRemover.exe ()
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE (PowerISO Computing, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTProAgent.exe (DT Soft Ltd.)
O4 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003..\Run: [Facebook Update] "C:\Documents and Settings\mask\Local Settings\Application Data\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver File not found
O4 - Startup: C:\Documents and Settings\mask\Start Menu\Programlar\Başlangıç\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1343024091-1957994488-2147049779-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm ()
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm ()
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (Amaze Soft)
O9 - Extra 'Tools' menuitem : &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\flashget.exe (Amaze Soft)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} https://webiq005.webiqonline.com/WebIQ/DataServer/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9} (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/ge...sh/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5BD6F888-C2DD-4C6E-AEB1-35239B12252E}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5BD6F888-C2DD-4C6E-AEB1-35239B12252E}: NameServer = 4.2.2.1,4.2.2.2,4.2.2.2,4.4.2.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9FB36C43-0510-4F28-93F7-CD4919229FF2}: NameServer = 8.8.8.8,8.8.4.4,8.8.8.8,8.8.8.4
O18 - Protocol\Handler\ebk {1E411CE8-FE8B-4973-B8E0-6EA2CC3C6B06} - C:\WINDOWS\system32\ebkp.dll ()
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL File not found
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) - C:\WINDOWS\system32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop Components:0 (Geçerli Giriş Sayfam) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\mask\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\mask\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/03/28 18:47:48 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2000/09/20 19:55:56 | 000,827,392 | R--- | M] () - L:\AUTORUN.EXE -- [ CDFS ]
O32 - AutoRun File - [2000/07/06 19:04:48 | 000,000,135 | R--- | M] () - L:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2000/09/20 19:55:56 | 000,827,392 | R--- | M] () - M:\AUTORUN.EXE -- [ CDFS ]
O32 - AutoRun File - [2000/09/24 18:34:44 | 000,000,135 | R--- | M] () - M:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2001/09/25 13:08:44 | 001,572,864 | R--- | M] () - N:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2001/09/25 13:08:44 | 000,000,135 | R--- | M] () - N:\Autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2005/10/13 23:23:46 | 000,045,056 | R--- | M] () - S:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2005/10/13 23:19:48 | 000,000,146 | R--- | M] () - S:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{229b97b2-2a0b-11de-94ef-00c09fdb5f2c}\Shell\AutoRun\command - "" = em8tqm.cmd
O33 - MountPoints2\{229b97b2-2a0b-11de-94ef-00c09fdb5f2c}\Shell\open\Command - "" = em8tqm.cmd
O33 - MountPoints2\{503c9ae0-a1b3-11e0-95d3-00c09fdb5f2c}\Shell - "" = AutoRun
O33 - MountPoints2\{503c9ae0-a1b3-11e0-95d3-00c09fdb5f2c}\Shell\AutoRun\command - "" = T:\AutoRun.exe
O33 - MountPoints2\{503c9ae2-a1b3-11e0-95d3-00c09fdb5f2c}\Shell - "" = AutoRun
O33 - MountPoints2\{503c9ae2-a1b3-11e0-95d3-00c09fdb5f2c}\Shell\AutoRun\command - "" = T:\AutoRun.exe
O33 - MountPoints2\{b8733713-26d4-11e2-9623-00c09fdb5f2c}\Shell - "" = AutoRun
O33 - MountPoints2\{b8733713-26d4-11e2-9623-00c09fdb5f2c}\Shell\AutoRun\command - "" = T:\Autorun.exe
O33 - MountPoints2\L\Shell - "" = AutoRun
O33 - MountPoints2\L\Shell\AutoRun\command - "" = L:\AUTORUN.EXE -- [2000/09/20 19:55:56 | 000,827,392 | R--- | M] ()
O33 - MountPoints2\L\Shell\readit\command - "" = notepad readme.doc
O33 - MountPoints2\M\Shell - "" = AutoRun
O33 - MountPoints2\M\Shell\AutoRun\command - "" = M:\AUTORUN.EXE -- [2000/09/20 19:55:56 | 000,827,392 | R--- | M] ()
O33 - MountPoints2\M\Shell\readit\command - "" = notepad readme.doc
O33 - MountPoints2\N\Shell - "" = AutoRun
O33 - MountPoints2\N\Shell\AutoRun\command - "" = N:\Autorun.exe -- [2001/09/25 13:08:44 | 001,572,864 | R--- | M] ()
O33 - MountPoints2\N\Shell\readit\command - "" = notepad readme.doc
O33 - MountPoints2\S\Shell - "" = AutoRun
O33 - MountPoints2\S\Shell\AutoRun\command - "" = S:\Autorun.exe -- [2005/10/13 23:23:46 | 000,045,056 | R--- | M] ()
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2013/01/17 23:41:35 | 002,031,992 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\mask\Desktop\MGADiag.exe
[2013/01/16 22:44:56 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\mask\Desktop\OTL.exe
[2013/01/16 22:42:36 | 002,213,976 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\mask\Desktop\tdsskiller.exe
[2013/01/16 21:49:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mask\Belgelerim\GTA San Andreas User Files
[2013/01/16 21:27:45 | 000,000,000 | ---D | C] -- C:\Program Files\Rockstar Games
[2013/01/16 21:27:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programlar\Rockstar Games
[2013/01/11 11:00:32 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/01/07 01:54:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\mask\Desktop\bakım
[2012/12/25 17:28:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programlar\Superstar
[2012/12/25 17:28:28 | 000,000,000 | ---D | C] -- C:\Program Files\Superstar
[2012/12/25 13:37:01 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013/01/17 23:42:06 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2013/01/17 23:41:55 | 000,681,984 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\CKScanner.exe
[2013/01/17 23:41:37 | 002,031,992 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\mask\Desktop\MGADiag.exe
[2013/01/17 12:21:00 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1343024091-1957994488-2147049779-1003UA.job
[2013/01/17 03:21:00 | 000,001,072 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-1343024091-1957994488-2147049779-1003Core.job
[2013/01/16 22:56:40 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1343024091-1957994488-2147049779-1003.job
[2013/01/16 22:55:58 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1343024091-1957994488-2147049779-1003.job
[2013/01/16 22:55:39 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/01/16 22:51:49 | 000,000,408 | ---- | M] () -- C:\WINDOWS\tasks\RNUpgradeHelperLogonPrompt_mask.job
[2013/01/16 22:51:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/01/16 22:51:19 | 2145,505,280 | -HS- | M] () -- C:\hiberfil.sys
[2013/01/16 22:47:31 | 000,000,538 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\Kısayol Yedek C masaütüsnden.lnk
[2013/01/16 22:44:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\mask\Desktop\OTL.exe
[2013/01/16 22:42:38 | 002,213,976 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\mask\Desktop\tdsskiller.exe
[2013/01/16 22:12:49 | 000,000,430 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\Kısayol pskyatrı adhd and osho.lnk
[2013/01/16 22:11:52 | 000,000,329 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\Kısayol Yol.lnk
[2013/01/16 22:11:50 | 000,000,370 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\Kısayol Turnuvalar.lnk
[2013/01/16 11:20:06 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2013/01/15 17:48:11 | 000,000,402 | ---- | M] () -- C:\WINDOWS\tasks\ReclaimerUpdateFiles_mask.job
[2013/01/15 17:48:11 | 000,000,398 | ---- | M] () -- C:\WINDOWS\tasks\ReclaimerUpdateXML_mask.job
[2013/01/14 15:00:28 | 000,000,278 | ---- | M] () -- C:\WINDOWS\ChssBase.ini
[2013/01/07 03:23:25 | 000,446,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2013/01/07 02:47:05 | 000,446,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130107-032325.backup
[2013/01/07 02:31:25 | 000,441,458 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/01/07 02:31:25 | 000,428,638 | ---- | M] () -- C:\WINDOWS\System32\perfh01F.dat
[2013/01/07 02:31:25 | 000,081,464 | ---- | M] () -- C:\WINDOWS\System32\perfc01F.dat
[2013/01/07 02:31:25 | 000,071,394 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/01/07 01:50:23 | 000,446,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130107-024705.backup
[2013/01/07 01:41:03 | 000,446,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130107-015023.backup
[2013/01/07 01:38:24 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\MBR.dat
[2013/01/05 16:56:45 | 000,446,353 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130107-014102.backup
[2013/01/05 15:36:22 | 000,446,249 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130105-165645.backup
[2012/12/31 00:32:11 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/12/31 00:32:11 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/12/27 01:35:06 | 000,000,531 | ---- | M] () -- C:\Documents and Settings\mask\Desktop\Kısayol Timers.lnk
[2012/12/26 02:51:20 | 000,000,976 | ---- | M] () -- C:\Documents and Settings\mask\Application Data\Microsoft\Internet Explorer\Quick Launch\Kısayol CBase9.lnk
[2012/12/25 03:20:54 | 000,446,249 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20130105-153622.backup
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013/01/17 23:41:54 | 000,681,984 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\CKScanner.exe
[2013/01/16 22:47:31 | 000,000,538 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\Kısayol Yedek C masaütüsnden.lnk
[2013/01/16 22:12:49 | 000,000,430 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\Kısayol pskyatrı adhd and osho.lnk
[2013/01/16 22:11:52 | 000,000,329 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\Kısayol Yol.lnk
[2013/01/16 22:11:50 | 000,000,370 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\Kısayol Turnuvalar.lnk
[2013/01/07 01:38:24 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\MBR.dat
[2012/12/27 01:35:06 | 000,000,531 | ---- | C] () -- C:\Documents and Settings\mask\Desktop\Kısayol Timers.lnk
[2012/12/26 02:51:20 | 000,000,976 | ---- | C] () -- C:\Documents and Settings\mask\Application Data\Microsoft\Internet Explorer\Quick Launch\Kısayol CBase9.lnk
[2012/12/22 04:46:02 | 000,000,408 | ---- | C] () -- C:\WINDOWS\tasks\RNUpgradeHelperLogonPrompt_mask.job
[2012/12/22 04:46:01 | 000,000,402 | ---- | C] () -- C:\WINDOWS\tasks\ReclaimerUpdateFiles_mask.job
[2012/12/22 04:46:01 | 000,000,398 | ---- | C] () -- C:\WINDOWS\tasks\ReclaimerUpdateXML_mask.job
[2012/11/12 16:30:22 | 000,000,132 | ---- | C] () -- C:\WINDOWS\GECKOS.INI
[2012/07/21 09:38:08 | 000,000,020 | ---- | C] () -- C:\WINDOWS\level.ini
[2012/05/22 12:12:44 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2011/12/20 02:50:45 | 000,000,507 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2011/09/07 00:15:16 | 000,233,472 | ---- | C] () -- C:\WINDOWS\System32\AGS_SQLite.dll
[2011/05/13 17:23:18 | 000,025,088 | ---- | C] () -- C:\WINDOWS\System32\ebkp.dll
[2011/03/18 23:14:00 | 000,295,424 | ---- | C] () -- C:\WINDOWS\unin0411.exe
[2009/03/30 23:51:03 | 000,083,968 | ---- | C] () -- C:\Documents and Settings\mask\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/03/28 19:21:04 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\mask\Local Settings\Application Data\fusioncache.dat
========== ZeroAccess Check ==========
[2009/03/28 19:09:41 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 18:00:24 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009/02/09 12:52:35 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 18:00:27 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
< End of report >
------------------------
Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
Validation Status: Genuine
Validation Code: 0
Cached Validation Code: N/A
Windows Product Key: *****-*****-Q7P48-WGW88-CD9X8
Windows Product Key Hash: GyPRhiI+v22KcoIaGftZLSKshCw=
Windows Product ID: 55896-640-1127996-23606
Windows Product ID Type: 1
Windows License Type: Volume
Windows OS version: 5.1.2600.2.00010100.3.0.pro
ID: {7BB1DE35-991C-4872-BD53-79798886CE62}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.40.0
Signed By: Microsoft
Product Name: N/A
Architecture: N/A
Build lab: N/A
TTS Error: N/A
Validation Diagnostic: 025D1FF3-230-1_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-8009_E2AD56EA-766-2efd_E2AD56EA-148-80004005_16E0B333-89-80004005
Resolution Status: N/A
Vista WgaER Data-->
ThreatID(s): N/A
Version: N/A
Windows XP Notifications Data-->
Cached Result: 0
File Exists: Yes
Version: 1.9.40.0
WgaTray.exe Signed By: Microsoft
WgaLogon.dll Signed By: Microsoft
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
OGA Data-->
Office Status: 100 Genuine
Microsoft Office Professional Edition 2003 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-230-1_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-8009_E2AD56EA-766-2efd_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32)
Default Browser: C:\Program Files\Opera\Opera.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
File Scan Data-->
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{7BB1DE35-991C-4872-BD53-79798886CE62}</UGUID><Version>1.9.0027.0</Version><OS>5.1.2600.2.00010100.3.0.pro</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-CD9X8</PKey><PID>55896-640-1127996-23606</PID><PIDType>1</PIDType><SID>S-1-5-21-1343024091-1957994488-2147049779</SID><SYSTEM><Manufacturer>NEC Computers International </Manufacturer><Model>EASYNOTE PB37R00229</Model></SYSTEM><BIOS><Manufacturer>NEC Computers International </Manufacturer><Version>NOTE BIOS Version Q3A05 </Version><SMBIOSVersion major="2" minor="31"/><Date>20050930000000.000000+000</Date></BIOS><HWID>A6263F07018400F2</HWID><UserLCID>041F</UserLCID><SystemLCID>041F</SystemLCID><TimeZone>GTB Standart Saati(GMT+02:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification><File Name="WgaTray.exe" Version="1.9.40.0"/><File Name="WgaLogon.dll" Version="1.9.40.0"/></GANotification></MachineData><Software><Office><Result>100</Result><Products><Product GUID="{90110409-6000-11D3-8CFE-0150048383C9}"><LegitResult>100</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>B4731799DF39D00</Val><Hash>TE2IkmLeZINNu18+rAJgSV4jzMk=</Hash><Pid>73931-640-1790864-57711</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="100"/><App Id="16" Version="11" Result="100"/><App Id="18" Version="11" Result="100"/><App Id="19" Version="11" Result="100"/><App Id="1A" Version="11" Result="100"/><App Id="1B" Version="11" Result="100"/><App Id="44" Version="11" Result="100"/></Applications></Office></Software></GenuineResults>
Licensing Data-->
N/A
Windows Activation Technologies-->
N/A
HWID Data-->
N/A
OEM Activation 1.0 Data-->
BIOS string matches: yes
Marker string from BIOS: 1FFA0:NEC Corporation|14C0B:Packard Bell B.V|14C0B:Packard Bell B.V|1FFA0:Packard Bell B.V
Marker string from OEMBIOS.DAT: N/A, hr = 0x80004005
OEM Activation 2.0 Data-->
N/A
---------------------------------------------------------------------
CKScanner 2.1 - Additional Security Risks - These are not necessarily bad
c:\dosg\mk2\fx\skcrack1.u8
c:\dosg\mm2\micro2\il-crack.com
c:\dosg\starw\swchess\captures\crackle.dsf
c:\program files\activision\rome - total war\crack\rometw-alx.exe
c:\program files\activision\rome - total war\crack\rometw-bi.exe
c:\program files\activision\rome - total war\crack\rometw.exe
c:\program files\age of empires 2 & the conquerors expansion - full game - [hussey]\crack.zip
c:\program files\age of empires 2 & the conquerors expansion - full game - [hussey]\crack\empires2.exe
c:\program files\alcohol soft\alcohol 120\crack.exe
c:\program files\autorunremover\lz0\keygen.exe
c:\program files\ea games\command and conquer generals\crack\deviance.nfo
c:\program files\ea games\command and conquer generals\crack\game.dat
c:\program files\ea games\command and conquer generals\crack\generals.exe
c:\program files\ea games\command and conquer generals\crack\generals_code.exe
c:\program files\firefly studios\stronghold crusader\gm\cracks.gm1
c:\program files\rockstar games\gta san andreas\data\decision\craig\crack1.ped
c:\program files\sega\medieval ii total war\crack\medieval2.exe
c:\program files\sega\medieval ii total war\crack\sfx.dat
c:\westwood\ra2\(2-4)cracked.yrm
c:\westwood\ra2\(2-4)crackedint.yrm
hosts 127.0.0.1 activate.adobe.com
scanner sequence 3.ZZ.11.EINAKQ
----- EOF -----
---------------------------------------------
thanks
