Virustemizligi

BlockWatcher

2009-10-30T22:33:00.004+02:00

Bu program bir rogue (sahte) yazılımdır.
Nedir Rogue (Sahte) Yazılım ?
Sahte güvenlik programı olarak adlandırdığımız bu programlar kötü niyetli programlardır.
Olmayan zararlıları var gibi göstermek,
sürekli system alert ,
your computer infected vs. uyarıları vermek ,
reklam pencereleri veya site yönlendirmeleri yaparak
sizi kendi sitesine veya bazı porno ve crack sitelerine
yönlendirmek ,sizi dolandırmayı amaçlamak vs. bu tip programların genel özellikleridir.

Hijackthis Raporunda Görünen Girdileri :

O4 - HKCU\..\Run: [yxh5.tmp.exe] C:\WINDOWS\system32\yxh5.tmp.exe
O4 - HKCU\..\Run: [BlockWatcher] C:\Program Files\BlockWatcher Software\BlockWatcher\BlockWatcher.exe -min

Etiketler :

Insecure Internet activity. Threat of virus attack!

Due to insecure Internet browsing your PC can easily get infected with viruses, worms and trojans without your knowledge, which can lead to system slowdowns, freezes and crashes. Also insecure Internet activity can result in revealing your personal information.
To get full advanced real-time protection for PC and Internet activity, register BlockWatcher. We recommend you to protect your PC now and continue safe Internet browsing.

Temizlik

http://www.malwarebytes.org/mbam/program/mbam-setup.exe
veya
http://rapidshare.com/files/278308278/mbam-setup1.41.zip

İlk olarak yukarıdan Malwarebytes'Anti Malware'i indirin.(4 mb)
Programı kurun.

Update bölümünden güncelleyin.

Perform full scan diyip bütün sürücüleri işaretleyip ; taramanın bitmesini bekliyorsunuz.

Tarama bittiğinde show results diyince bulduğu zararlıları görebilirsiniz.

Remove selected deyip ; biraz bekliyorsunuz.

Bilgisayarınızı yeniden başlatın.
Restart sonunda Bulduğu nesneler karantinaya geldi..
Buradakileri de delete all diyerek silebilirsiniz..
Eğer varsa Başlat > Programlar menüsünde kalan artıkları ( tıklanınca hatalı kısayol uyarısı veren kısayol ve klasörü el ile silin)

Malwarebytes' Anti-Malware ile temizleyebileceğiniz BlockWatcher girdileri

Kayıt Defteri Girdileri
HKEY_CURRENT_USER\Software\BlockWatcher
HKEY_LOCAL_MACHINE\SOFTWARE\BlockWatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BlockWatcher
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "BlockWatcher"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "yxh5.tmp.exe"

Klasör ve Dosyalar:
c:\Documents and Settings\All Users\Desktop\BlockWatcher.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\BlockWatcher
c:\Documents and Settings\All Users\Start Menu\Programs\BlockWatcher\1 BlockWatcher.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\BlockWatcher\2 Homepage.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\BlockWatcher\3 Uninstall.lnk
%Temp%\yxh5.tmp.exe
c:\Program Files\BlockWatcher Software
c:\Program Files\BlockWatcher Software\BlockWatcher
c:\Program Files\BlockWatcher Software\BlockWatcher\BlockWatcher.exe
c:\WINDOWS\10068tro9zd85.exe
c:\WINDOWS\10258z9amb5t73a.bin
c:\WINDOWS\10518virzs5f9.ocx
c:\WINDOWS\system32\19z89s5y663.dll
c:\WINDOWS\system32\1a605tzal32359.dll
c:\WINDOWS\system32\1aa8tzi952064.cpl

Google Chrome 4.0.213.1 Beta

2009-09-25T18:38:00.000+03:00

Google'ın internet tarayıcısı olan
Google Chrome'nin beta 4 versiyonunun
yeni sürümü çıktı.

Download Google Chrome 4.0.213.1 Beta (12 mb)

http://dl.google.com/chrome/install/213.1/chrome_installer.exe

TrustWarrior

2009-09-18T00:49:00.005+03:00

Hijackthis Raporunda Görünen Girdileri :

O4 - HKCU\..\Run: [xinoprpc.exe] C:\WINDOWS\system32\xinoprpc.exe
O4 - HKCU\..\Run: [TrustWarrior] C:\Program Files\TrustWarrior Software\TrustWarrior\TrustWarrior.exe -min
O23 - Service: TrustWarrior Security Service (TrustWarriorSvc) - Unknown owner - C:\Program Files\TrustWarrior Software\TrustWarrior\TrustWarriorSvc.exe (file missing)

Temizlik

Malwarebytes' Anti-Malware ile temizleyebileceğiniz TrustWarrior girdileri

Kayıt Defteri Girdileri
HKEY_CURRENT_USER\Software\TrustWarrior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TrustWarrior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Reporting\RebootWatch
HKEY_LOCAL_MACHINE\SOFTWARE\TrustWarrior
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TRUSTWARRIORSVC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustWarriorSvc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "TrustWarrior"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "xinoprpc.exe"

Klasör ve Dosyalar:
c:\Program Files\TrustWarrior Software
c:\Program Files\TrustWarrior Software\TrustWarrior
c:\Program Files\TrustWarrior Software\TrustWarrior\TrustWarrior.exe
c:\Program Files\TrustWarrior Software\TrustWarrior\uninstall.exe
c:\WINDOWS\1074hazktool7905.bin
c:\WINDOWS\10a89acz5oor1785.cpl
c:\WINDOWS\10z58s9ambo54d0.exe
c:\WINDOWS\system32\52d39tea522z.cpl
c:\WINDOWS\system32\52z6ba5kdoor21529.dll
c:\WINDOWS\system32\5309zddwar5515.cpl
c:\Documents and Settings\All Users\Desktop\TrustWarrior.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\TrustWarrior
c:\Documents and Settings\All Users\Start Menu\Programs\TrustWarrior\1 TrustWarrior.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\TrustWarrior\2 Homepage.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\TrustWarrior\3 Uninstall.lnk
%Temp%\Local Settings\Temp\xinoprpc.exe

Windows Pc Defender

2009-09-16T21:13:00.002+03:00

Hijackthis Raporunda Görünen Girdileri :

O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O4 - HKCU\..\Run: [Windows PC Defender] "C:\Documents and Settings\All Users\Application Data\345d567\WP345d.exe" /s /d

Temizlik

Malwarebytes' Anti-Malware ile temizleyebileceğiniz Windows Pc Defender girdileri

Kayıt Defteri Girdileri
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\WP345d.DocHostUIHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" => "http://search-gala.com/?&uid=201&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer "PRS" = "http://127.0.0.1:27777/?inj=%ORIGINAL%"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings "UID" = "201"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "89770891803"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windows PC Defender"

Klasör ve Dosyalar:
c:\Documents and Settings\All Users\Application Data\345d567
c:\Documents and Settings\All Users\Application Data\345d567\8424.mof
c:\Documents and Settings\All Users\Application Data\345d567\mozcrt19.dll
c:\Documents and Settings\All Users\Application Data\345d567\sqlite3.dll
c:\Documents and Settings\All Users\Application Data\345d567\WP345d.exe
c:\Documents and Settings\All Users\Application Data\345d567\WPCD.ico
c:\Documents and Settings\All Users\Application Data\345d567\WPCDSys
c:\Documents and Settings\All Users\Application Data\345d567\WPCDSys\vd952342.bd
c:\Documents and Settings\All Users\Application Data\WPCDSys
c:\Documents and Settings\All Users\Application Data\WPCDSys\wpcd.cfg
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows PC Defender.lnk
%UserProfile%\Application Data\Windows PC Defender
%UserProfile%\Application Data\Windows PC Defender\cookies.sqlite
%UserProfile%\Application Data\Windows PC Defender\Instructions.ini
%UserProfile%\Desktop\Windows PC Defender.lnk
%UserProfile%\Recent\cid.dll
%UserProfile%\Recent\CLSV.tmp
%UserProfile%\Recent\ddv.dll
%UserProfile%\Recent\eb.exe
%UserProfile%\Recent\eb.sys
%UserProfile%\Recent\energy.sys
%UserProfile%\Recent\exec.tmp
%UserProfile%\Recent\fix.exe
%UserProfile%\Recent\FS.drv
%UserProfile%\Recent\kernel32.drv
%UserProfile%\Recent\PE.drv
%UserProfile%\Recent\PE.tmp
%UserProfile%\Recent\ppal.exe
%UserProfile%\Recent\runddlkey.drv
%UserProfile%\Recent\tempdoc.dll
%UserProfile%\Start Menu\Windows PC Defender.lnk
%UserProfile%\Start Menu\Programs\Windows PC Defender.lnk
c:\Program Files\Mozilla Firefox\searchplugins\search.xml

SoftSafeness

2009-09-14T20:30:00.004+03:00

Hijackthis Raporunda Görünen Girdileri :

O4 - HKCU\..\Run: [ozn695m5.exe] C:\WINDOWS\system32\ozn695m5.exe
O4 - HKCU\..\Run: [SoftSafeness] C:\Program Files\SoftSafeness Software\SoftSafeness\SoftSafeness.exe -min
O23 - Service: SoftSafeness Security Service (SoftSafenessSvc) - Unknown owner - C:\Program Files\SoftSafeness Software\SoftSafeness\SoftSafenessSvc.exe (file missing)

Temizlik

Malwarebytes' Anti-Malware ile temizleyebileceğiniz SoftSafeness girdileri

Kayıt Defteri Girdileri
HKEY_CURRENT_USER\Software\SoftSafeness
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SoftSafeness
HKEY_LOCAL_MACHINE\SOFTWARE\SoftSafeness
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SOFTSAFENESSSVC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SoftSafenessSvc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "ozn695m5.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "SoftSafeness"

Klasör ve Dosyalar:
c:\Documents and Settings\All Users\Desktop\SoftSafeness.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SoftSafeness
c:\Documents and Settings\All Users\Start Menu\Programs\SoftSafeness\1 SoftSafeness.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SoftSafeness\2 Homepage.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SoftSafeness\3 Uninstall.lnk
%Temp%\ozn695m5.exe
c:\Program Files\SoftSafeness Software
c:\Program Files\SoftSafeness Software\SoftSafeness
c:\Program Files\SoftSafeness Software\SoftSafeness\SoftSafeness.exe
c:\Program Files\SoftSafeness Software\SoftSafeness\uninstall.exe
c:\WINDOWS\10081not-z-vi5us3999.dll
c:\WINDOWS\10191spy595z.dll
c:\WINDOWS\1039sz5c5.dll
c:\WINDOWS\system32\2fz7downloader2985.ocx
c:\WINDOWS\system32\2z118w95m312.cpl
c:\WINDOWS\system32\2z125spambot679.exe

Norton Removal Tool 2010.0.0.98

2009-09-12T19:52:00.005+03:00

Bu program aracılığıyla normal yollardan kaldıramadığınız
Norton (symantec) programlarını kaldırabilirsiniz.

Desteklenen bazı versiyonlar şunlar
Norton Antispam 2004 - 2005
Norton Antivirus 2003 - 2004 -2005-2006-2007-2008-2009-2010
Norton Ghost 10 - 12 - 14
Norton 360 1.0- 2.0-3.0
Norton internet Security 2003 - 2004 -2005-2006-2007-2008-2009-2010

Download Norton Removal Tool 2010.0.0.98 ( 1 mb)

ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe

Omega Antivir

2009-09-11T23:20:00.002+03:00

Hijackthis Raporunda Görünen Girdileri :

O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O4 - HKCU\..\Run: [Omega AntiVir] "C:\Documents and Settings\All Users\Application Data\61a60\OM83b.exe" /s

Temizlik

http://www.malwarebytes.org/mbam/program/mbam-setup.exe
veya
http://rapidshare.com/files/278308278/mbam-setup1.41.zip

İlk olarak yukarıdan Malwarebytes'Anti Malware'i indirin.(4 mb)
Programı kurun.

Update bölümünden güncelleyin.

Perform full scan diyip bütün sürücüleri işaretleyip ; taramanın bitmesini bekliyorsunuz.

Tarama bittiğinde show results diyince bulduğu zararlıları görebilirsiniz.

Remove selected deyip ; biraz bekliyorsunuz.

Bilgisayarınızı yeniden başlatın.
Restart sonunda Bulduğu nesneler karantinaya geldi..
Buradakileri de delete all diyerek silebilirsiniz..
Başlat > Programlar menüsünde kalan artıkları ( tıklanınca hatalı kısayol uyarısı veren kısayol ve klasörü el ile silin)

Malwarebytes' Anti-Malware ile temizleyebileceğiniz Omega Antivir girdileri

Kayıt Defteri Girdileri
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Omega AntiVir
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\SetupPack.DocHostUIHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "8789107703"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Omega AntiVir"

Klasör ve Dosyalar:
c:\Documents and Settings\All Users\Application Data\OAV
c:\Documents and Settings\All Users\Application Data\OAV\oav.cfg
c:\Documents and Settings\Bleeping\Application Data\Microsoft\Internet Explorer\Quick Launch\Omega AntiVir.lnk
c:\Documents and Settings\Bleeping\Application Data\Omega AntiVir
c:\Documents and Settings\Bleeping\Application Data\Omega AntiVir\cookies.sqlite
c:\Documents and Settings\Bleeping\Desktop\Omega AntiVir.lnk
c:\Documents and Settings\All Users\Application Data\61a60
c:\Documents and Settings\All Users\Application Data\61a60\mozcrt19.dll
c:\Documents and Settings\All Users\Application Data\61a60\OM83b.exe
c:\Documents and Settings\All Users\Application Data\61a60\OMEGA-AV.ico
c:\Documents and Settings\All Users\Application Data\61a60\sqlite3.dll
c:\Documents and Settings\Bleeping\Start Menu\Omega AntiVir.lnk
c:\Documents and Settings\Bleeping\Start Menu\Programs\Omega AntiVir.lnk

C:\WINDOWS\msa.exe Zararlısı Temizliği

2009-09-11T03:01:00.006+03:00

Nedir Rogue (Sahte) Yazılım ?
C:\WINDOWS\msa.exe bir trojandır.
Msa.exe kendini sahte siteler ve programlar
aracılığı ile yükleten bir zararlıdır.
Mesela biraz aşağıda yer alan örnekte
facebook'a benzer temalı bir sahte sitede
flash player ile ilgili bir uyarı yer almakta.
Bu sahte uyarıya ve ardından indirilen dosyaya
tıklandığında bu zararlı sisteme bulaşmaktadır.
Zararlı beraberinde b.exe adında bir dosyayı da
getirmektedir.
Bu zararlı yüklendikten sonra hijackthis logunda
aşağıdaki girdiler görülebilir.

O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll
O4 - HKCU\..\Run: [PopRock] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\b.exe

Bu zararlı bu konuda sayfanın aşağısında yer alan temizlik yöntemi ile sistemden tamamen kaldırılabilmektedir.

Örnek : Sahte site ve kullanıcıyı aldatmaya yönelik bir uyarı. bu dosya çalıştırıldığında bu zararlı sisteme bulaşıyor

Temizlik

http://www.malwarebytes.org/mbam/program/mbam-setup.exe
veya
http://rapidshare.com/files/278308278/mbam-setup1.41.zip

İlk olarak yukarıdan Malwarebytes'Anti Malware'i indirin.(4 mb)
Programı kurun.

Update bölümünden güncelleyin.

Perform full scan diyip bütün sürücüleri işaretleyip ; taramanın bitmesini bekliyorsunuz.

Tarama bittiğinde show results diyince bulduğu zararlıları görebilirsiniz.

Remove selected deyip ; biraz bekliyorsunuz.

Bilgisayarınızı yeniden başlatın.
Restart sonunda Bulduğu nesneler karantinaya geldi..
Buradakileri de delete all diyerek silebilirsiniz..
Başlat > Programlar menüsünde kalan artıkları ( tıklanınca hatalı kısayol uyarısı veren kısayol ve klasörü el ile silin)

Malwarebytes' Anti-Malware ile temizleyebileceğiniz msa.exe girdileri

Kayıt Defteri Girdileri
HKEY_CURRENT_USER\SOFTWARE\NordBull
HKEY_CURRENT_USER\SOFTWARE\poprock
HKEY_CURRENT_USER\SOFTWARE\XML
HKEY_CLASSES_ROOT\xml.xml (Worm.Allaple)
HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d}
HKEY_CLASSES_ROOT\xml.xml.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{500bca15-57a7-4eaf-8143-8c619470b13d}
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\poprock

Klasör ve Dosyalar
C:\WINDOWS\msa.exe
C:\WINDOWS\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job
C:\WINDOWS\Tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job
C:\Documents and Settings\Administrator\Local Settings\Temp\b.exe
C:\WINDOWS\system32\msxml71.dll

Malwarebytes' Anti-Malware 1.41

2009-09-11T01:32:00.001+03:00

Başarılı bir güvenlik yazılımı olan Malwarebytes' Anti Malware'nin yeni sürümü çıktı.

Download (4 mb):

http://www.malwarebytes.org/mbam/program/mbam-setup.exe
veya
http://rapidshare.com/files/278308278/mbam-setup1.41.zip

SafetyKeeper

2009-09-10T19:32:00.004+03:00

Hijackthis Raporunda Görünen Girdileri :

O4 - HKCU\..\Run: [gbn976rl.exe] C:\WINDOWS\system32\gbn976rl.exe
O4 - HKCU\..\Run: [SafetyKeeper] C:\Program Files\SafetyKeeper Software\SafetyKeeper\SafetyKeeper.exe -min
O23 - Service: SafetyKeeper Security Service (SafetyKeeperSvc) - Unknown owner - C:\Program Files\SafetyKeeper Software\SafetyKeeper\SafetyKeeperSvc.exe (file missing)

Temizlik

http://www.malwarebytes.org/mbam/program/mbam-setup.exe
veya
http://rapidshare.com/files/263385259/mbam-setup1.40.zip

İlk olarak yukarıdan Malwarebytes'Anti Malware'i indirin.(3 mb)
Programı kurun.

Update bölümünden güncelleyin.

Perform full scan diyip bütün sürücüleri işaretleyip ; taramanın bitmesini bekliyorsunuz.

Tarama bittiğinde show results diyince bulduğu zararlıları görebilirsiniz.

Remove selected deyip ; biraz bekliyorsunuz.

Bilgisayarınızı yeniden başlatın.
Restart sonunda Bulduğu nesneler karantinaya geldi..
Buradakileri de delete all diyerek silebilirsiniz..
Başlat > Programlar menüsünde kalan artıkları ( tıklanınca hatalı kısayol uyarısı veren kısayol ve klasörü el ile silin)

Malwarebytes' Anti-Malware ile temizleyebileceğiniz SafetyKeeper girdileri

Kayıt Defteri Girdileri
HKEY_CURRENT_USER\Software\SafetyKeeper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyKeeper
HKEY_LOCAL_MACHINE\SOFTWARE\SafetyKeeper
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SAFETYKEEPERSVC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SafetyKeeperSvc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "gbn976rl.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "SafetyKeeper"

Klasör ve Dosyalar:
c:\Documents and Settings\All Users\Desktop\SafetyKeeper.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SafetyKeeper
c:\Documents and Settings\All Users\Start Menu\Programs\SafetyKeeper\1 SafetyKeeper.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SafetyKeeper\2 Homepage.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SafetyKeeper\3 Uninstall.lnk
c:\Program Files\SafetyKeeper Software
c:\Program Files\SafetyKeeper Software\SafetyKeeper
c:\Program Files\SafetyKeeper Software\SafetyKeeper\SafetyKeeper.exe
c:\Program Files\SafetyKeeper Software\SafetyKeeper\uninstall.exe
c:\WINDOWS\1059ztr9j470.bin
c:\WINDOWS\1155backdoor929z.ocx
c:\WINDOWS\118019ot-a-virus5ez.exe
C:\Windows\System32\gbn976rl.exe
c:\WINDOWS\system32\90a3t5ief225z.ocx
c:\WINDOWS\system32\9207znot-a-v5rus2f7.bin
c:\WINDOWS\system32\923bspyw5rez493.exe
c:\WINDOWS\system32\925855ot-a-virus31z.exe
c:\Documents and Settings\Kullanıcı Adı\Local Settings\Temp\gbn976rl.exe

Proof Defender 2009

2009-09-10T02:32:00.003+03:00

Hijackthis Raporunda Görünen Girdileri :

O4 - HKLM\..\Run: [Proof Defender 2009] "C:\Program Files\Proof Defender 2009\pdfndr.exe"

Temizlik

Malwarebytes' Anti-Malware ile temizleyebileceğiniz Proof Defender 2009 girdileri

Kayıt Defteri Girdileri
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PDefender
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PDefender
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Proof Defender 2009"

Klasör ve Dosyalar:
c:\Program Files\Proof Defender 2009
c:\Program Files\Proof Defender 2009\dbbase.div
c:\Program Files\Proof Defender 2009\pd.dll
c:\Program Files\Proof Defender 2009\pdfndr.exe
c:\Program Files\Proof Defender 2009\UnInstall.exe
c:\Documents and Settings\All Users\Start Menu\Programs\Proof Defender 2009
c:\Documents and Settings\All Users\Start Menu\Programs\Proof Defender 2009\Proof Defender 2009.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\Proof Defender 2009\Uninstall Proof Defender 2009.lnk

Personal Guard 2009

2009-09-09T02:09:00.003+03:00

Hijackthis Raporunda Görünen Girdileri :

O4 - HKLM\..\Run: [personalguard] C:\Program Files\Personal Guard 2009\personalguard.exe

Etiketler:
All protection modules are turned off. Your PC is currently exposed to viruses, adware and spyware. Turn all modules on to achieve best protection and safety.

Temizlik

Malwarebytes' Anti-Malware ile temizleyebileceğiniz Personal Guard 2009 girdileri

Kayıt Defteri Girdileri

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Personal Guard 2009
HKEY_LOCAL_MACHINE\SOFTWARE\Personal Guard 2009
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "personalguard"

Klasör ve Dosyalar:
%UserProfile%\Desktop\Personal Guard 2009.lnk
%UserProfile%\Start Menu\Programs\Personal Guard 2009
%UserProfile%\Start Menu\Programs\Personal Guard 2009\Personal Guard 2009.lnk
%UserProfile%\Start Menu\Programs\Personal Guard 2009\Uninstall.lnk
c:\Program Files\Personal Guard 2009
c:\Program Files\Personal Guard 2009\config.cnf
c:\Program Files\Personal Guard 2009\mainbase.adb
c:\Program Files\Personal Guard 2009\personalguard.exe
c:\Program Files\Personal Guard 2009\q.adb
c:\Program Files\Personal Guard 2009\queue.vdb
c:\Program Files\Personal Guard 2009\uninstall.exe
c:\Program Files\Personal Guard 2009\virusbase.adb
c:\Program Files\Personal Guard 2009\quarantine

SaveKeeper

2009-09-08T03:17:00.005+03:00

Hijackthis Raporunda Görünen Girdileri :

O4 - HKCU\..\Run: [pswqn242.exe] C:\WINDOWS\system32\pswqn242.exe
O4 - HKCU\..\Run: [SaveKeeper] C:\Program Files\SaveKeeper Software\SaveKeeper\SaveKeeper.exe -min
O23 - Service: SaveKeeper Security Service (SaveKeeperSvc) - Unknown owner - C:\Program Files\SaveKeeper Software\SaveKeeper\SaveKeeperSvc.exe (file missing)

Temizlik

Malwarebytes' Anti-Malware ile temizleyebileceğiniz SaveKeeper girdileri

Kayıt Defteri Girdileri:

HKEY_CURRENT_USER\Software\SaveKeeper
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SaveKeeper
HKEY_LOCAL_MACHINE\SOFTWARE\SaveKeeper
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SAVEKEEPERSVC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SaveKeeperSvc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “ha8tozmj.exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “SaveKeeper”

Klasör ve Dosyalar:

%Program Files%\SaveKeeper Software
%Program Files%\SaveKeeper Software\SaveKeeper
%Program Files%\SaveKeeper Software\SaveKeeper\license.txt
%Program Files%\SaveKeeper Software\SaveKeeper\savekeeper.exe
%Program Files%\SaveKeeper Software\SaveKeeper\uninstall.exe
%WINDOWS%\102z6w59m3c4.cpl
%WINDOWS%\1044zhackt9ol5b2.dll
%WINDOWS%\10683v9rzs656.cpl
%WINDOWS%\10915hief309z.cpl
%Documents and Settings%\All Users\Desktop\SaveKeeper.lnk
%Documents and Settings%\All Users\Start Menu\Programs\SaveKeeper
%Documents and Settings%\All Users\Start Menu\Programs\SaveKeeper\1 SaveKeeper.lnk
%Documents and Settings%\All Users\Start Menu\Programs\SaveKeeper\2 Homepage.lnk
%Documents and Settings%\All Users\Start Menu\Programs\SaveKeeper\3 Uninstall.lnk

Ultimate System Guard

2009-09-07T19:31:00.004+03:00

Temizlik

Malwarebytes' Anti-Malware ile temizleyebileceğiniz Ultimate System Guard girdileri

Kayıt Defteri Girdileri:
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" => "http://search-gala.com/?&uid=7&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "78890603"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Ultimate System Guard"

Klasör ve Dosyalar:
c:\Documents and Settings\All Users\Application Data\39d2
c:\Documents and Settings\All Users\Application Data\39d2\5228.mof
c:\Documents and Settings\All Users\Application Data\39d2\MainFAVProj.exe
c:\Documents and Settings\All Users\Application Data\39d2\mozcrt19.dll
c:\Documents and Settings\All Users\Application Data\39d2\sqlite3.dll
c:\Documents and Settings\All Users\Application Data\39d2\unins000.dat
c:\Documents and Settings\All Users\Application Data\39d2\USYSG.ico
c:\Documents and Settings\All Users\Application Data\39d2\ULTGSys
c:\Documents and Settings\All Users\Application Data\39d2\ULTGSys\vd952342.bd
c:\Documents and Settings\All Users\Application Data\ULTGSys
c:\Documents and Settings\All Users\Application Data\ULTGSys\ultg.cfg
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Ultimate System Guard.lnk
%UserProfile%\Application Data\Ultimate System Guard
%UserProfile%\Application Data\Ultimate System Guard\cookies.sqlite
%UserProfile%\Desktop\Ultimate System Guard.lnk
%UserProfile%\Start Menu\Ultimate System Guard.lnk
%UserProfile%\Start Menu\Programs\Ultimate System Guard.lnk
c:\Program Files\Mozilla Firefox\searchplugins\search.xml

Windows Guard Pro

2009-09-07T19:24:00.004+03:00

Temizlik

Malwarebytes' Anti-Malware ile temizleyebileceğiniz Windows Guard Pro girdileri

Kayıt Defteri Girdileri:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Windows Guard Pro
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\WindowsGP.DocHostUIHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" => "http://search-gala.com/?&uid=7&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "787917903"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windows Guard Pro"

Klasör ve Dosyalar:
c:\Documents and Settings\All Users\Application Data\9201
c:\Documents and Settings\All Users\Application Data\9201\1527.mof
c:\Documents and Settings\All Users\Application Data\9201\mozcrt19.dll
c:\Documents and Settings\All Users\Application Data\9201\sqlite3.dll
c:\Documents and Settings\All Users\Application Data\9201\unins000.dat
c:\Documents and Settings\All Users\Application Data\9201\WindowsGP.exe
c:\Documents and Settings\All Users\Application Data\9201\WINGP.ico
c:\Documents and Settings\All Users\Application Data\9201\WINGPSys
c:\Documents and Settings\All Users\Application Data\9201\WINGPSys\vd952342.bd
c:\Documents and Settings\All Users\Application Data\WINGPSys
c:\Documents and Settings\All Users\Application Data\WINGPSys\winpg.cfg
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Guard Pro.lnk
%UserProfile%\Application Data\Windows Guard Pro
%UserProfile%\Application Data\Windows Guard Pro\cookies.sqlite
%UserProfile%\Desktop\Windows Guard Pro.lnk
%UserProfile%\Start Menu\Windows Guard Pro.lnk
%UserProfile%\Start Menu\Programs\Windows Guard Pro.lnk
c:\Program Files\Mozilla Firefox\searchplugins\search.xml

Windows Additional Guard

2009-09-07T19:17:00.003+03:00

Hijackthis Raporunda Görünen Girdileri:
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O4 - HKCU\..\Run: [Windows Additional Guard] "C:\Documents and Settings\All Users\Application Data\345d567\WI345d.exe" /s /d

Temizlik

Malwarebytes' Anti-Malware ile temizleyebileceğiniz Windows Additional Guard girdileri

Kayıt Defteri Girdileri:
HKEY_CLASSES_ROOT\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}
HKEY_CLASSES_ROOT\WI345d.DocHostUIHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes "URL" => "http://search-gala.com/?&uid=7&q={searchTerms}"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform "967907703"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "Windows

Klasör ve Dosyalar:
c:\Documents and Settings\All Users\Application Data\345d567
c:\Documents and Settings\All Users\Application Data\345d567\578.mof
c:\Documents and Settings\All Users\Application Data\345d567\mozcrt19.dll
c:\Documents and Settings\All Users\Application Data\345d567\sqlite3.dll
c:\Documents and Settings\All Users\Application Data\345d567\WI345d.exe
c:\Documents and Settings\All Users\Application Data\345d567\WINAG.ico
c:\Documents and Settings\All Users\Application Data\345d567\WINAGSys
c:\Documents and Settings\All Users\Application Data\345d567\WINAGSys\vd952342.bd
c:\Documents and Settings\All Users\Application Data\WINAGSys
c:\Documents and Settings\All Users\Application Data\WINAGSys\winag.cfg
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Additional Guard.lnk
%UserProfile%\Application Data\Windows Additional Guard
%UserProfile%\Application Data\Windows Additional Guard\cookies.sqlite
%UserProfile%\Desktop\Windows Additional Guard.lnk
%UserProfile%\Recent\ANTIGEN.tmp
%UserProfile%\Recent\cb.exe
%UserProfile%\Recent\CLSV.tmp
%UserProfile%\Recent\ddv.dll
%UserProfile%\Recent\dudl.drv
%UserProfile%\Recent\energy.dll
%UserProfile%\Recent\energy.sys
%UserProfile%\Recent\exec.exe
%UserProfile%\Recent\fan.drv
%UserProfile%\Recent\FS.dll
%UserProfile%\Recent\PE.drv
%UserProfile%\Recent\ppal.exe
%UserProfile%\Recent\SICKBOY.tmp
%UserProfile%\Recent\tjd.sys
%UserProfile%\Start Menu\Windows Additional Guard.lnk
%UserProfile%\Start Menu\Programs\Windows Additional Guard.lnk
c:\Program Files\Mozilla Firefox\searchplugins\search.xml

Antivirus Pro 2010

2009-09-07T19:14:00.004+03:00

Hijackthis Raporunda Görünen Girdileri

O4 - HKLM\..\Run: [Antivirus Pro 2010] "C:\Program Files\AntivirusPro_2010\AntivirusPro_2010.exe" /hide

Temizlik

Aşama 1

Aşama 2

--> Aşağıdan SmitFraudFix'i indirin.

http://siri.urz.free.fr/Fix/SmitfraudFix.exe

(SmitfraudFix özel olarak geliştirilmiş bir remove tooldurAntivirus programınız birçok işlem yapabilmesinden dolayı potansiyel tehlike vs. diye uyarı verebilir.Bu uyarıları kaale almayın )
İndirdiğiniz dosyayı masaüstüne çıkarın.
Bilgisayarınızı kapatıp , Güvenli Mod'da açın.

SmitFraudFix.exe dosyasını çalıştırın

Klavyeden herhangi bir tuşa basın.

Gelen ekranda 2 yazıp enter'layın.

Do you want to clean the registry ? sorusuna Y yazıp enter diyerek cevaplayın.

Eğer Replace infected file ? diye uyarı alırsanız ona da aynı şekilde Y yazıp enter'layın.

İşlem bittikten sonra (bir .txt dosyası açtıktan sonra) bilgisayarınızı kapatabilirsiniz.

Malwarebytes' Anti-Malware ile temizleyebileceğiniz Antivirus Pro 2010 girdileri

Kayıt Defteri Girdileri:
HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusPro_2010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntivirusPro_2010
HKEY_CURRENT_USER\Control Panel\don't load "scui.cpl"
HKEY_CURRENT_USER\Control Panel\don't load "wscui.cpl"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Antivirus Pro 2010"
Klasör ve Dosyalar :
c:\Documents and Settings\All Users\Documents\usurav.lib
%UserProfile%\Application Data\azuloge.scr
%UserProfile%\Application Data\efenyrygi.dl
%UserProfile%\Application Data\sonisozivo.vbs
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro_2010.lnk
%UserProfile%\Cookies\mucipi.lib
%UserProfile%\Cookies\tacogijine.scr
%UserProfile%\Cookies\titotico._sy
%UserProfile%\Cookies\weryna.inf
%UserProfile%\Desktop\AntivirusPro_2010.lnk
%UserProfile%\Local Settings\Application Data\dexohoty.reg
%UserProfile%\Local Settings\Application Data\yvolij.dll
%UserProfile%\Local Settings\Application Data\yxine.exe
%UserProfile%\Start Menu\Programs\AntivirusPro_2010
%UserProfile%\Start Menu\Programs\AntivirusPro_2010\AntivirusPro_2010.lnk
%UserProfile%\Start Menu\Programs\AntivirusPro_2010\Uninstall.lnk
c:\Program Files\AntivirusPro_2010
c:\Program Files\AntivirusPro_2010\AntivirusPro_2010.cfg
c:\Program Files\AntivirusPro_2010\AntivirusPro_2010.exe
c:\Program Files\AntivirusPro_2010\AVEngn.dll
c:\Program Files\AntivirusPro_2010\htmlayout.dll
c:\Program Files\AntivirusPro_2010\pthreadVC2.dll
c:\Program Files\AntivirusPro_2010\Uninstall.exe
c:\Program Files\AntivirusPro_2010\wscui.cpl
c:\Program Files\AntivirusPro_2010\data
c:\Program Files\AntivirusPro_2010\data\daily.cvd
c:\Program Files\AntivirusPro_2010\Microsoft.VC80.CRT
c:\Program Files\AntivirusPro_2010\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
c:\Program Files\AntivirusPro_2010\Microsoft.VC80.CRT\msvcm80.dll
c:\Program Files\AntivirusPro_2010\Microsoft.VC80.CRT\msvcp80.dll
c:\Program Files\AntivirusPro_2010\Microsoft.VC80.CRT\msvcr80.dll
c:\Program Files\Common Files\aqicituzap.pif
c:\Program Files\Common Files\fijunuso.inf
c:\Program Files\Common Files\goke.scr
c:\WINDOWS\bawuge._dl
c:\WINDOWS\bezonyx.ban
c:\WINDOWS\qacigyjuw.bin
c:\WINDOWS\ruja.dl
c:\WINDOWS\system32\_scui.cpl
c:\WINDOWS\system32\epivafym._dl
c:\WINDOWS\system32\pocec.lib

sdra64.exe temizliği

2009-09-05T23:09:00.009+03:00

sdra64.exe bir trojandır.
C:\WINDOWS\system32\sdra64.exe
(Trojan.FakeAlert)

Hijackthis Logunda görünen girdileri

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,

Temizlik

http://www.malwarebytes.org/mbam/program/mbam-setup.exe
veya
http://rapidshare.com/files/263385259/mbam-setup1.40.zip

İlk olarak yukarıdan Malwarebytes'Anti Malware'i indirin.(3 mb)
Programı kurun.

Update bölümünden güncelleyin.

Perform full scan diyip bütün sürücüleri işaretleyip ; taramanın bitmesini bekliyorsunuz.

Tarama bittiğinde show results diyince bulduğu zararlıları görebilirsiniz.

Remove selected deyip ; biraz bekliyorsunuz.

Gelen uyarıya evet diyerek
Bilgisayarınızı yeniden başlatın.
Restart sonunda Bulduğu nesneler karantinaya geldi..
Buradakileri de delete all diyerek silebilirsiniz..
Başlat > Programlar menüsünde kalan artıkları ( tıklanınca hatalı kısayol uyarısı veren kısayol ve klasörü el ile silin)

Malwarebytes' Anti-Malware ile temizleyebileceğiniz sdra64.exe girdileri

Kayıt Defteri Girdileri:

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7}
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6}
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7}
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\sdra64.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: system32\sdra64.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe)

Klasör ve Dosyalar :
C:\WINDOWS\system32\lowsec
C:\WINDOWS\system32\lowsec\local.ds
C:\WINDOWS\system32\lowsec\user.ds
C:\WINDOWS\system32\sdra64.exe

Google Chrome 4.0.206.1 Beta

2009-09-05T19:29:00.000+03:00

Google'ın internet tarayıcısı olan
Google Chrome'nin beta 4 versiyonunun
yeni sürümü çıktı.

Download Google Chrome 4.0.206.1 Beta (11 mb)

http://dl.google.com/chrome/install/206.1/chrome_installer.exe

SUPERAntiSpyware Free Edition 4.28.1010 Final

2009-09-05T19:21:00.001+03:00

SuperAntispyware 4.28 final sürümü çıktı

Download SUPERAntiSpyware Free Edition 4.28.1010 Final ( 6.8 mb)

http://www.superantispyware.com/downloads/SUPERAntiSpyware.exe

QuickHealCleaner

2009-09-05T02:33:00.003+03:00

Temizlik

Aşama 1

Aşama 2

Malwarebytes' Anti-Malware ile temizleyebileceğiniz QuickHealCleaner girdileri

Kayıt Defteri Girdileri:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\quickhealcleanersvc
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QuickHealCleaner
HKEY_LOCAL_MACHINE\SOFTWARE\QuickHealCleaner
HKEY_CURRENT_USER\SOFTWARE\QuickHealCleaner
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QuickHealCleaner

Klasör ve Dosyalar :
C:\Documents and Settings\All Users\Start Menu\Programs\QuickHealCleaner
C:\Program Files\QuickHealCleaner Software
C:\Program Files\QuickHealCleaner Software\QuickHealCleaner
C:\Program Files\QuickHealCleaner Software\QuickHealCleaner\QuickHealCleaner.exe
C:\Documents and Settings\All Users\Start Menu\Programs\QuickHealCleaner\1 QuickHealCleaner.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\QuickHealCleaner\2 Homepage.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\QuickHealCleaner\3 Uninstall.lnk
C:\Program Files\QuickHealCleaner Software\QuickHealCleaner\license.txt
C:\Program Files\QuickHealCleaner Software\QuickHealCleaner\uninstall.exe
C:\Documents and Settings\All Users\Desktop\QuickHealCleaner.LNK

SUPERAntiSpyware Free Edition 4.28.1008 Final

2009-09-04T02:09:00.001+03:00

SuperAntispyware 4.28 final sürümü çıktı

Download SUPERAntiSpyware Free Edition 4.28.1008 Final ( 6.8 mb)

http://www.superantispyware.com/downloads/SUPERAntiSpyware.exe

SUPERAntiSpyware 4.28.1008 Beta

2009-09-02T23:57:00.001+03:00

Başarılı bir antispyware programı olan SuperAntispyware'in yeni beta versiyonu çıktı.
SuperAntispyware Free Edition 4.28'i bu konuda yer alan download bölümünden
indirebilirsiniz. Program ücretsizdir.

Download SuperAntispyware Free Edition 4.28.1008 (7 mb)

http://www.superantispyware.com/prerelease/SUPERAntiSpyware.exe

SystemCop

2009-09-02T01:51:00.007+03:00

Hijackthis Raporunda Görünen Girdileri :
O4 - HKCU\..\Run: [SystemCop] C:\Program Files\SystemCop Software\SystemCop\SystemCop.exe -min
O23 - Service: SystemCop Security Service (SystemCopSvc) - Unknown owner - C:\Program Files\SystemCop Software\SystemCop\SystemCopSvc.exe (file missing)

Temizlik

Aşama 1

Aşama 2

Malwarebytes' Anti-Malware ile temizleyebileceğiniz SystemCop girdileri

Kayıt Defteri Girdileri:

HKEY_CURRENT_USER\Software\SystemCop
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemCop
HKEY_LOCAL_MACHINE\SOFTWARE\SystemCop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SYSTEMCOPSVC
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SystemCopSvc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "ha8tozmj.exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "SystemCop"

Klasör ve Dosyalar :
c:\Program Files\SystemCop Software
c:\Program Files\SystemCop Software\SystemCop
c:\Program Files\SystemCop Software\SystemCop\license.txt
c:\Program Files\SystemCop Software\SystemCop\SystemCop.exe
c:\Program Files\SystemCop Software\SystemCop\uninstall.exe
c:\WINDOWS\102z6w59m3c4.cpl
c:\WINDOWS\1044zhackt9ol5b2.dll
c:\WINDOWS\10683v9rzs656.cpl
c:\WINDOWS\10915hief309z.cpl
c:\Documents and Settings\All Users\Desktop\SystemCop.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SystemCop
c:\Documents and Settings\All Users\Start Menu\Programs\SystemCop\1 SystemCop.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SystemCop\2 Homepage.lnk
c:\Documents and Settings\All Users\Start Menu\Programs\SystemCop\3 Uninstall.lnk

Opera 10 Final

2009-09-01T20:14:00.003+03:00

Nihayet Ünlü İnternet tarayıcısı olan Opera'nın 10 final sürümü çıktı.

Download ( 8 mb )

ftp://ftp.opera.com/pub/opera/win/1000/int/Opera_1000_int_Setup.exe