DARKCOMET VİRÜSÜ SİLMEE YARDIM!!

evet beyler bilgisayarda darkcomet virüsü vardı format attırdım ama adam masaüstündeki bir tane dosyayı silmemiş yereldisk d ye atmış şimdi bende avast ile tam tarama yaptım çıkan virüsleri sildim sonra combofix ile tarattım bu raporu aldım kurtuldum mu ?

ComboFix 14-05-29.01 - AA 30.05.2014 20:14:18.1.4 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1254.90.1055.18.3071.2226 [GMT 3:00]
Running from: c:\users\AA\Downloads\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
FW: avast! Antivirus *Disabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ddsxeiservice
-------\Service_ddsxeiservice
.
.
((((((((((((((((((((((((( Files Created from 2014-04-28 to 2014-05-30 )))))))))))))))))))))))))))))))
.
.
2014-05-25 14:46 . 2014-05-25 14:59 -------- d-----w- c:\users\AA\AppData\Roaming\TeamViewer
2014-05-25 14:46 . 2014-05-25 14:46 -------- d-----w- c:\program files\TeamViewer
2014-05-25 05:53 . 2014-05-25 05:53 -------- d-----w- C:\Fraps
2014-05-24 09:26 . 2014-05-25 05:11 -------- d-----w- c:\users\AA\AppData\Local\CrashDumps
2014-05-23 19:41 . 2014-05-23 19:45 -------- d-----w- c:\program files\RaidCall
2014-05-22 16:46 . 2014-05-22 16:46 -------- d-----w- c:\users\AA\AppData\Roaming\AVAST Software
2014-05-22 16:43 . 2014-05-22 16:45 68312 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-05-22 16:43 . 2014-05-22 16:43 180632 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-05-22 16:43 . 2014-05-22 16:45 777488 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-05-22 16:43 . 2014-05-22 16:45 411680 ----a-w- c:\windows\system32\drivers\aswsp.sys
2014-05-22 16:43 . 2014-05-22 16:43 67824 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-05-22 16:43 . 2014-05-22 16:43 49944 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-05-22 16:43 . 2014-05-22 16:43 81768 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-05-22 16:43 . 2014-05-22 16:43 24184 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-05-22 16:43 . 2014-05-22 16:43 26136 ----a-w- c:\windows\system32\drivers\aswKbd.sys
2014-05-22 16:43 . 2014-05-22 16:43 271264 ----a-w- c:\windows\system32\aswBoot.exe
2014-05-22 16:43 . 2014-05-22 16:43 43152 ----a-w- c:\windows\avastSS.scr
2014-05-22 16:43 . 2014-05-22 16:45 270240 ----a-w- c:\windows\system32\drivers\aswNdisFlt.sys
2014-05-22 16:21 . 2014-05-22 16:21 -------- d-----w- c:\program files\AVAST Software
2014-05-18 12:52 . 2014-05-19 07:20 -------- d-----w- c:\users\AA\AppData\Roaming\OpenCandy
2014-05-18 12:52 . 2014-05-19 07:35 -------- d-----w- c:\users\AA\AppData\Roaming\uTorrent
2014-05-18 09:06 . 2014-05-18 09:06 -------- d-----w- c:\users\AA\AppData\Local\Torch
2014-05-18 09:06 . 2014-05-18 09:06 -------- d-----w- c:\programdata\6985d26ae3e44712
2014-05-18 09:06 . 2014-05-18 09:06 -------- d-----w- c:\users\HomeGroupUser$
2014-05-18 09:06 . 2014-05-18 09:06 -------- d-----w- c:\users\Guest
2014-05-18 09:06 . 2014-05-18 09:06 -------- d-----w- c:\users\Administrator
2014-05-18 09:06 . 2014-05-18 09:06 -------- d-----w- c:\users\AA\AppData\Local\Comodo
2014-05-18 09:05 . 2014-05-18 09:05 -------- d-----w- c:\programdata\InstallMate
2014-05-18 07:41 . 2014-05-18 07:41 30976 ----a-w- c:\windows\system32\drivers\hitmanpro37.sys
2014-05-18 07:24 . 2014-05-18 07:40 -------- d-----w- c:\programdata\HitmanPro
2014-05-18 07:10 . 2014-05-18 09:25 -------- d-----w- c:\users\AA\AppData\Roaming\Yandex
2014-05-18 06:25 . 2014-05-19 05:47 -------- d-----w- C:\NPE
2014-05-18 06:21 . 2014-05-22 17:11 -------- d-----w- c:\users\AA\AppData\Local\NPE
2014-05-18 06:21 . 2014-05-18 06:21 -------- d-----w- c:\programdata\Norton
2014-05-17 17:07 . 2014-05-17 17:07 -------- d-----w- c:\users\AA\AppData\Roaming\GetRightToGo
2014-05-17 16:35 . 2014-05-18 09:23 -------- d-----w- c:\program files\Google
2014-05-13 16:03 . 2014-05-19 14:03 -------- d-----w- c:\users\AA\AppData\Local\Diagnostics
2014-05-13 05:19 . 2014-05-08 14:53 52928 ----a-w- c:\windows\system32\drivers\{f9d2f209-1697-4837-85f2-d88e4c9f7c81}Gw.sys
2014-05-12 14:48 . 2014-05-12 14:48 -------- d-----w- c:\users\AA\AppData\Roaming\raidcall
2014-05-10 20:05 . 2014-05-10 20:05 -------- d-----w- c:\users\AA\AppData\Local\Gameforge4d
2014-05-10 20:04 . 2014-05-11 06:57 -------- d-----w- c:\program files\GameforgeLive
2014-05-08 17:29 . 2014-05-08 17:29 -------- d-----w- c:\users\AA\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
2014-05-05 16:46 . 2014-05-06 15:38 -------- d-----w- c:\windows\AF54923662584AC6A0435B5B89C6EB61.TMP
2014-05-05 16:46 . 2014-05-05 16:46 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2014-05-04 18:11 . 2014-05-04 18:11 -------- d-----w- c:\program files\Microsoft
2014-05-01 13:01 . 2014-05-04 13:57 -------- d-----w- c:\programdata\PMB Files
2014-05-01 08:54 . 2014-05-01 08:55 107736 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-01 08:54 . 2014-05-01 08:54 -------- d-----w- c:\programdata\Malwarebytes
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-22 16:43 . 2014-05-22 16:43 776976 ----a-w- c:\windows\system32\drivers\aswsnx.sys.1400777133375
2014-05-22 16:43 . 2014-05-22 16:43 411552 ----a-w- c:\windows\system32\drivers\aswsp.sys.1400777133375
2014-04-25 18:11 . 2014-04-25 18:11 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-04-23 13:37 . 2014-04-23 13:37 776976 ----a-w- c:\windows\system32\drivers\aswsnx.sys.1400167290687
2014-04-23 13:37 . 2014-04-23 13:37 411552 ----a-w- c:\windows\system32\drivers\aswsp.sys.1400167290687
2014-04-23 13:37 . 2014-04-23 13:37 269728 ----a-w- c:\windows\system32\drivers\aswndisflt.sys.1400167290687
2014-04-06 17:11 . 2014-04-06 17:11 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2014-04-06 17:11 . 2014-04-06 17:11 161792 ----a-w- c:\windows\system32\msls31.dll
2014-04-06 17:11 . 2014-04-06 17:11 86528 ----a-w- c:\windows\system32\iesysprep.dll
2014-04-06 17:11 . 2014-04-06 17:11 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2014-04-06 17:11 . 2014-04-06 17:11 48640 ----a-w- c:\windows\system32\mshtmler.dll
2014-04-06 17:11 . 2014-04-06 17:11 1129472 ----a-w- c:\windows\system32\wininet.dll
2014-04-06 17:11 . 2014-04-06 17:11 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2014-04-06 17:11 . 2014-04-06 17:11 63488 ----a-w- c:\windows\system32\tdc.ocx
2014-04-06 17:11 . 2014-04-06 17:11 74752 ----a-w- c:\windows\system32\iesetup.dll
2014-04-06 17:11 . 2014-04-06 17:11 367104 ----a-w- c:\windows\system32\html.iec
2014-04-06 17:11 . 2014-04-06 17:11 23552 ----a-w- c:\windows\system32\licmgr10.dll
2014-04-06 17:11 . 2014-04-06 17:11 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2014-04-06 17:11 . 2014-04-06 17:11 421376 ----a-w- c:\windows\system32\vbscript.dll
2014-04-06 17:11 . 2014-04-06 17:11 152064 ----a-w- c:\windows\system32\wextract.exe
2014-04-06 17:11 . 2014-04-06 17:11 150528 ----a-w- c:\windows\system32\iexpress.exe
2014-04-06 17:11 . 2014-04-06 17:11 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2014-04-06 17:11 . 2014-04-06 17:11 35840 ----a-w- c:\windows\system32\imgutil.dll
2014-04-06 17:11 . 2014-04-06 17:11 1806848 ----a-w- c:\windows\system32\jscript9.dll
2014-04-06 17:11 . 2014-04-06 17:11 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2014-04-06 17:11 . 2014-04-06 17:11 11776 ----a-w- c:\windows\system32\mshta.exe
2014-04-06 17:11 . 2014-04-06 17:11 101888 ----a-w- c:\windows\system32\admparse.dll
2014-04-06 17:09 . 2014-04-06 17:09 801792 ----a-w- c:\windows\system32\FntCache.dll
2014-04-06 17:09 . 2014-04-06 17:09 728448 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2014-04-06 17:09 . 2014-04-06 17:09 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2014-04-06 17:09 . 2014-04-06 17:09 3181568 ----a-w- c:\windows\system32\mf.dll
2014-04-06 17:09 . 2014-04-06 17:09 283648 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2014-04-06 17:09 . 2014-04-06 17:09 219008 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2014-04-06 17:09 . 2014-04-06 17:09 196608 ----a-w- c:\windows\system32\mfreadwrite.dll
2014-04-06 17:09 . 2014-04-06 17:09 1619456 ----a-w- c:\windows\system32\WMVDECOD.DLL
2014-04-06 17:09 . 2014-04-06 17:09 1495040 ----a-w- c:\windows\system32\ExplorerFrame.dll
2014-04-06 17:09 . 2014-04-06 17:09 135168 ----a-w- c:\windows\system32\XpsRasterService.dll
2014-04-06 17:09 . 2014-04-06 17:09 107520 ----a-w- c:\windows\system32\cdd.dll
2014-03-31 06:35 . 2014-03-22 11:14 231584 ------w- c:\windows\system32\MpSigStub.exe
2014-03-22 10:41 . 2014-03-22 10:41 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-03-22 10:41 . 2014-03-22 10:41 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-03-17 08:16 . 2014-04-06 17:44 7969936 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F767DC45-326F-4A98-88B9-5E3272C3E34B}\mpengine.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-05-22 16:43 260976 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-10 61440]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2013-10-24 12017368]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-05-26 3888648]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 12:54 91520 ----a-w- c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidCall]
2014-05-04 09:29 3444424 ----a-w- c:\program files\RaidCall\raidcall.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-02-28 17:00 18642024 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
R2 LiveUpdateSvc;LiveUpdate;c:\program files\IObit\LiveUpdate\LiveUpdate.exe [2013-12-03 2151200]
R2 Update wisen wizard;Update wisen wizard;c:\program files\wisen wizard\updatewisenwizard.exe [x]
R2 Util wisen wizard;Util wisen wizard;c:\program files\wisen wizard\bin\utilwisenwizard.exe [x]
R3 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\7.1.362.0\SeaPort.exe [2012-02-13 240408]
R3 dajvktqz;dajvktqz; [x]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 hitmanpro37;HitmanPro 3.7 Support Driver;c:\windows\system32\drivers\hitmanpro37.sys [2014-05-18 30976]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2014-05-01 107736]
S0 aswNdisFlt;Avast! Firewall Driver;c:\windows\system32\DRIVERS\aswNdisFlt.sys [2014-05-22 270240]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 {f9d2f209-1697-4837-85f2-d88e4c9f7c81}Gw;{f9d2f209-1697-4837-85f2-d88e4c9f7c81}Gw;c:\windows\system32\drivers\{f9d2f209-1697-4837-85f2-d88e4c9f7c81}Gw.sys [2014-05-08 52928]
S1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [2014-05-22 26136]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2014-05-22 777488]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2014-05-22 411680]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2014-05-22 24184]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2014-05-22 67824]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2014-05-22 68312]
S2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [2014-05-22 109048]
S2 BBSvc;BingBar Service;c:\program files\Microsoft\BingBar\7.1.362.0\BBSvc.exe [2012-02-13 193816]
S2 TeamViewer9;TeamViewer 9;c:\program files\TeamViewer\Version9\TeamViewer_Service.exe [2014-04-25 5024576]
S3 RTL8167;Realtek 8167 NT Sürücüsü;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-22 21:30 1091912 ----a-w- c:\program files\Google\Chrome\Application\35.0.1916.114\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-05-30 c:\windows\Tasks\AutoKMS.job
- c:\windows\AutoKMS\AutoKMS.exe [2014-03-22 11:08]
.
2014-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-05-18 09:15]
.
2014-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2014-05-18 09:15]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yandex.com.tr/?clid=1818323
mStart Page = hxxp://www.google.com
IE: Microsoft Excel'e &Ver - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
IE: OneNote'a G&önder - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
TCP: DhcpNameServer = 176.240.150.227 46.196.235.116
TCP: Interfaces\{321A2B3E-8AF4-4C72-82BE-6510B2A202E2}: NameServer = 208.67.222.222,208.67.220.220
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{10921475-03CE-4E04-90CE-E2E7EF20C814} - c:\program files\IObit\IObit Uninstaller\UninstallExplorer32.dll
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Google\Update\1.3.24.7\GoogleCrashHandler.exe
c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
c:\windows\system32\WUDFHost.exe
c:\windows\system32\sppsvc.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2014-05-30 20:33:30 - machine was rebooted
ComboFix-quarantined-files.txt 2014-05-30 17:33
.
Pre-Run: 75.134.803.968 bayt boş
Post-Run: 76.601.118.720 bayt boş
.
- - End Of File - - AB43DA01FBBDE940FCA78D91C94AD053
A36C5E4F47E84449FF07ED3517B43A31

DARKCOMET VİRÜSÜ SİLMEE YARDIM!!

Benzer içerikler