O4 - HKCU\..\RunOnce: [Application Restart #2] = C:\Windows\SysWOW64\muachost.exe /RestartByRestartManager:81EE5AC2-7C86-40e6-9D25-B618EA75F83D /RestartByRestartManager:B57D8004-58C4-45b9-A5E1-3BFE103F7D63 /RestartByRestartManager:495B1DAA-8B77-4097-BF88-8ADC54C88E87 /RestartByRestartManager:AE18C72F-EC17-412a-A888-78F1767ACA3F
R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8C3078A0-9AAB-4371-85D1-656CA8E46EE8}: [SuggestionsURL_JSON] = https://suggest.yandex.com.tr/suggest-ff.cgi?srv=ie11&uil=tr&part={searchTerms}&clid=2233630 - Yandex
R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8C3078A0-9AAB-4371-85D1-656CA8E46EE8}: [URL] = https://yandex.com.tr/search/?text={searchTerms}&clid=2233630 - Yandex
O4 - HKCU\..\Run: [Web Companion] = C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize (file missing)
Öyle bir şey bu konuda geçerli değil. Nedenini yazdık zaten.Bir şüphem var, virüs Teamviewer yoluyla bulaştırılma ihtimali olabilir mi?
Adware. Silinmemesinin sebebi Chrome hesabınızda senkronizasyonun açık olması.
chrome://settings/syncSetup urlsini kopyala yapıştır yaparak bağlantıya gidin.
Sayfada, ilk adım olarak Chrome Senkronizasyonu Verilerini tıklayın, ardından ikinci adım olarak "Kapat" ı tıklayın.
Kapat'ı tıklattığınızda, çıkan pencerede "Çıkış"a tıklayın. Ancak bunu işaretlemeden:
Eki Görüntüle 452905
Sync bu bağlantıya gidin.
Gittikten sonra sayfayı yenileyin!
Chrome'dan çıkış yaptığınızdan, yenilememeniz durumunda senkronizasyonu sıfırlamak işe yaramaz ve şu hatayı alırsınız: "Bu Chrome ayarları sayfası artık kullanılamıyor"
Google kimlik bilgilerinizle bu sayfada oturum açın.
Sayfanın en altına gidin ve "Senkronizasyonu Sıfırla" ya tıklayın.
Chrome tarayıcınızı kapatın.
Chrome'u düzeltmek için önce Malwarebytes ile başka bir tarama yapmanız gerektiğinden, henüz senkronizasyonu etkinleştirmeyin.
Malwarebytes ile yeni bir tarama yapın ve bulduklarını silmesine izin verin.
Sistemi yeniden başlatmanız istendiğinde yeniden başlatınız.
Bir sonraki taramanın ardından tespitin artık meydana gelmediğini doğrulayın. Sonuçlar tekrar temizlenirse, Google Sync'i tekrar etkinleştirebilirsiniz.
Giriş yapmak için önce kullanıcı adınızı soracaktır. Bir kez yapıldıktan sonra, otomatik olarak Senkronizasyonu tekrar etkinleştirmesi gerekir.
Sonucu bildirin.
Senkronizasyonu sıfırladıysanız, tekrar geri açabilirsiniz.Selamlar,
Dediğiniz gibi Chrome'dan senkronizasyonu kapattım. Artık virüs gözükmüyor ama senkronizasyonu açarsam tekrar gelecek sanırsam.
Bu arada halen görev yöneticisinden belirttiğim 2 program silinmedi halen bilgisayarda tüm işlemler kapalıyken bile yaklaşık % 50 Ram kullanılıyor oluyor.
Alay gibi mesaj. Herkes format atacak olsaydı bu sitede "Güvenlik" bölümü diye bir bölüm neden oluşturulurdu? Süs olması için mi var burası?Virüs varsa format şart.
Adamın 1 TB'ye yakın verisi var, onlar silinirse çalıştığı firmaya karşı çok büyük zarara girer. Bunlar şakaya gelmez.Virüs varsa format şart.
Dostum selam,Senkronizasyonu sıfırladıysanız, tekrar geri açabilirsiniz.
Kaspersky Total Security'nin deneme lisanslı olan versiyonunu Kaspersky'ın kendi sitesinden indirin.
"Tam tarama" gerçekleştirin ve tarama sonrasında "Hijackthis" logu oluşturun.
Rehber: HijackThis Log Paylaşımı ve Çözümleri
Sisteminizde yaşadığınız performans düşüşü, kilitlenme, zararlı etkisi, uygulama hatalarından kaynaklanan sorunsalları analiz etmek ve performans iyileştirmesi, zararlı etkisini inaktif etmek için bize HijackThis yazılımı ile yaptığınız tarama Logunu burada paylaşmanız gerekmektedir...www.technopat.net
Logfile of HiJackThis Fork by Alex Dragokas v.2.9.0.18
Platform: x64 Windows 10 (Pro), 10.0.18362.418 (ReleaseId: 1903), Service Pack: 0
Time: 01.11.2019 - 22:27 (UTC+03:00)
Language: OS: Turkish (0x41F). Display: Turkish (0x41F). Non-Unicode: Turkish (0x41F)
Elevated: Yes
Ran by: Niko (group: Administrator) on DESKTOP-GUUTOR7, FirstRun: yes
Chrome: 78.0.3904.70
Firefox: 70.0.0.7228
Edge: 11.0.18362.418
Internet Explorer: 11.0.18362.1
Default: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1" (Google Chrome)
Boot mode: Normal
Running processes:
Number | Path
1 C:\MSI\MSIRegister\MSIRegisterService.exe
1 C:\Program Files (x86)\Common Files\Steam\SteamService.exe
1 C:\Program Files (x86)\Google\Update\1.3.35.302\GoogleCrashHandler.exe
1 C:\Program Files (x86)\Google\Update\1.3.35.302\GoogleCrashHandler64.exe
1 C:\Program Files (x86)\Internet Download Manager\IDMan.exe
1 C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
1 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 4.0\ksde.exe
1 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 4.0\ksdeui.exe
1 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 20.0\avp.exe
1 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 20.0\avpui.exe
1 C:\Program Files (x86)\MSI\APP Manager\AppManager_Service.exe
1 C:\Program Files (x86)\MSI\Command Center\MSICCRS.exe
1 C:\Program Files (x86)\MSI\Command Center\MSIControlService.exe
1 C:\Program Files (x86)\MSI\Gaming APP\GamingApp_Service.exe
1 C:\Program Files (x86)\MSI\Gaming APP\GamingHotkey.exe
1 C:\Program Files (x86)\MSI\Gaming APP\GamingHotkey_Service.exe
1 C:\Program Files (x86)\MSI\Live Update\Live Update.exe
1 C:\Program Files (x86)\MSI\Live Update\MSI_LiveUpdate_Service.exe
1 C:\Program Files (x86)\MSI\MSI OC Kit\ActiveX_Service\EyeRest.exe
1 C:\Program Files (x86)\MSI\MSI OC Kit\ActiveX_Service\MSI_ActiveX_Service.exe
1 C:\Program Files (x86)\MSI\MSI OC Kit\ActiveX_Service\TriggerModeMonitor.exe
1 C:\Program Files (x86)\MSI\MSI OC Kit\ActiveX_Service\VideoCardMonitorII.exe
1 C:\Program Files (x86)\MSI\MSI Toast Server\MSIToastServer.exe
1 C:\Program Files (x86)\MSI\MysticLight\LEDKeeper.exe
1 C:\Program Files (x86)\MSI\MysticLight\MysticLight2_Service.exe
1 C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe
1 C:\Program Files (x86)\Steam\Steam.exe
7 C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
1 C:\Program Files (x86)\TeamViewer\TeamViewer.exe
1 C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
1 C:\Program Files (x86)\TeamViewer\tv_w32.exe
1 C:\Program Files (x86)\TeamViewer\tv_x64.exe
1 C:\Program Files\AMD\CNext\CNext\AMDRSServ.exe
1 C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
1 C:\Program Files\AMD\CNext\CNext\amdow.exe
1 C:\Program Files\AMD\Performance Profile Client\AUEPLauncher.exe
1 C:\Program Files\AMD\Performance Profile Client\AUEPMaster.exe
1 C:\Program Files\AMD\Performance Profile Client\AUEPUF.exe
1 C:\Program Files\AMD\Performance Profile Client\RyzenMaster\AUEPRyzenMasterAC.exe
1 C:\Program Files\Bonjour\mDNSResponder.exe
1 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1 C:\Program Files\ShareX\ShareX.exe
1 C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.85.0_x64__kzf8qxf38zg5c\SkypeApp.exe
1 C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.85.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
1 C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1001.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe
1 C:\Program Files\WindowsApps\Microsoft.YourPhone_1.19092.403.0_x64__8wekyb3d8bbwe\YourPhone.exe
1 C:\Users\Niko\Desktop\HiJackThis\HiJackThis.exe
1 C:\Windows\ImmersiveControlPanel\SystemSettings.exe
4 C:\Windows\SysWOW64\muachost.exe
1 C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
1 C:\Windows\System32\ApplicationFrameHost.exe
1 C:\Windows\System32\DriverStore\FileRepository\c0345289.inf_amd64_6ef2ac49787c27a7\B345285\atieclxx.exe
1 C:\Windows\System32\DriverStore\FileRepository\c0345289.inf_amd64_6ef2ac49787c27a7\B345285\atiesrxx.exe
2 C:\Windows\System32\RtkAudUService64.exe
6 C:\Windows\System32\RuntimeBroker.exe
1 C:\Windows\System32\SearchIndexer.exe
1 C:\Windows\System32\SecurityHealthService.exe
1 C:\Windows\System32\SecurityHealthSystray.exe
1 C:\Windows\System32\SettingSyncHost.exe
1 C:\Windows\System32\SgrmBroker.exe
1 C:\Windows\System32\audiodg.exe
2 C:\Windows\System32\conhost.exe
2 C:\Windows\System32\csrss.exe
1 C:\Windows\System32\ctfmon.exe
1 C:\Windows\System32\dllhost.exe
1 C:\Windows\System32\dwm.exe
2 C:\Windows\System32\fontdrvhost.exe
1 C:\Windows\System32\lsass.exe
1 C:\Windows\System32\schtasks.exe
1 C:\Windows\System32\services.exe
1 C:\Windows\System32\sihost.exe
1 C:\Windows\System32\smss.exe
1 C:\Windows\System32\spoolsv.exe
78 C:\Windows\System32\svchost.exe
1 C:\Windows\System32\taskhostw.exe
2 C:\Windows\System32\wbem\WmiPrvSE.exe
1 C:\Windows\System32\wininit.exe
1 C:\Windows\System32\winlogon.exe
1 C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
1 C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
1 C:\Windows\explorer.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxyOverride] = *.local
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxyServer] = 85.99.125.213:80 (disabled)
R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8C3078A0-9AAB-4371-85D1-656CA8E46EE8}: [SuggestionsURL_JSON] = https://suggest.yandex.com.tr/suggest-ff.cgi?srv=ie11&uil=tr&part={searchTerms}&clid=2233630 - Yandex
R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8C3078A0-9AAB-4371-85D1-656CA8E46EE8}: [URL] = https://yandex.com.tr/search/?text={searchTerms}&clid=2233630 - Yandex
O2 - HKLM\..\BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
O2-32 - HKLM\..\BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
O4 - HKCU\..\Run: [IDMan] = C:\Program Files (x86)\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Steam] = C:\Program Files (x86)\Steam\steam.exe -silent
O4 - HKCU\..\Run: [Web Companion] = C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize (file missing)
O4 - HKCU\..\RunOnce: [Application Restart #2] = C:\Windows\SysWOW64\muachost.exe /RestartByRestartManager:81EE5AC2-7C86-40e6-9D25-B618EA75F83D /RestartByRestartManager:B57D8004-58C4-45b9-A5E1-3BFE103F7D63 /RestartByRestartManager:495B1DAA-8B77-4097-BF88-8ADC54C88E87 /RestartByRestartManager:AE18C72F-EC17-412a-A888-78F1767ACA3F
O4 - HKCU\..\StartupApproved\Run: [Discord] = C:\Users\Niko\AppData\Local\Discord\app-0.0.305\Discord.exe (2019/08/04)
O4 - HKCU\..\StartupApproved\Run: [OneDrive] = C:\Users\Niko\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background (2019/08/03)
O4 - HKCU\..\StartupApproved\Run: [Spotify] = C:\Users\Niko\AppData\Roaming\Spotify\Spotify.exe --autostart --minimized (2019/10/03)
O4 - HKCU\..\StartupApproved\Run: [uTorrent] = C:\Users\Niko\AppData\Roaming\uTorrent\uTorrent.exe (2019/08/03)
O4 - HKLM\..\Run: [RtkAudUService] = C:\Windows\System32\RtkAudUService64.exe -background
O4 - HKLM\..\Run: [SecurityHealth] = C:\Windows\system32\SecurityHealthSystray.exe
O4 - HKLM\..\StartupApproved\Run32: [APP Manager] = C:\Program Files (x86)\MSI\APP Manager\AppManager.exe /mini (2019/08/25)
O4 - HKLM\..\StartupApproved\Run32: [Command Center] = C:\Program Files (x86)\MSI\Command Center\StartCommandCenter.exe (2019/08/25)
O4 - HKLM\..\StartupApproved\Run32: [MSIRegister] = C:\MSI\MSIRegister\MSIRegister.exe (2019/08/25)
O4 - HKLM\..\StartupApproved\Run32: [RemoteMedia] = C:\Program Files (x86)\MSI\Command Center\RemoteMedia.exe (2019/10/28)
O4 - HKLM\..\StartupApproved\Run32: [Super Charger] = C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe (2019/08/25)
O4 - HKLM\..\StartupApproved\Run: [Stream Deck] = C:\Program Files\Elgato\StreamDeck\StreamDeck.exe --runinbk (2019/11/01)
O4 - HKLM\..\StartupApproved\Run: [iTunesHelper] = C:\Program Files\iTunes\iTunesHelper.exe (2019/08/25)
O4 - User Startup: C:\Users\Niko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShareX.lnk -> C:\Program Files\ShareX\ShareX.exe -silent
O4-32 - HKLM\..\Run: [Live Update] = C:\Program Files (x86)\MSI\Live Update\Live Update.exe /REMINDER
O8 - Context menu item: HKCU\..\Internet Explorer\MenuExt\IDM ile indir: (default) = C:\Program Files (x86)\Internet Download Manager\IEExt.htm
O8 - Context menu item: HKCU\..\Internet Explorer\MenuExt\Tüm bağlantıları IDM ile indir: (default) = C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm
O10 - Unknown file in Winsock LSP: C:\Program Files (x86)\Bonjour\mdnsNSP.dll
O15 - Trusted Zone: *.localhost
O15 - Trusted Zone: http://webcompanion.com
O17 - DHCP DNS 1: 8.8.8.8 (Well-known DNS: Google)
O17 - DHCP DNS 2: 8.8.4.4 (Well-known DNS: Google)
O17 - HKLM\System\CCS\Services\Tcpip\..\{e99469ea-9fdb-4f04-a38b-4ef2c222f574}: [NameServer] = 8.8.4.4 (Well-known DNS: Google)
O17 - HKLM\System\CCS\Services\Tcpip\..\{e99469ea-9fdb-4f04-a38b-4ef2c222f574}: [NameServer] = 8.8.8.8 (Well-known DNS: Google)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ IDM Shell Extension: IDM Shell Extension - {CDC95B92-E27C-4745-A8C5-64A52A78855D} - C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
O22 - Task (.job): (disabled) (Not scheduled) CreateExplorerShellUnelevatedTask.job - C:\Windows\explorer.exe /NOUACCHECK
O23 - Service R2: AMD External Events Utility - C:\Windows\System32\DriverStore\FileRepository\c0345289.inf_amd64_6ef2ac49787c27a7\B345285\atiesrxx.exe
O23 - Service R2: AMD User Experience Program Launcher - (AUEPLauncher) - C:\Program Files\AMD\Performance Profile Client\AUEPLauncher.exe
O23 - Service R2: Apple Mobile Device Service - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service R2: Bonjour Service - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service R2: GamingApp_Service - C:\Program Files (x86)\MSI\Gaming APP\GamingApp_Service.exe
O23 - Service R2: Kaspersky Anti-Virus Hizmeti 20.0 - (AVP20.0) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 20.0\avp.exe -r
O23 - Service R2: Kaspersky Secure Connection Hizmeti 4.0 - (KSDE4.0) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 4.0\ksde.exe -r
O23 - Service R2: MSI AppManager Service - (MSI_AppManager_Service) - C:\Program Files (x86)\MSI\APP Manager\AppManager_Service.exe
O23 - Service R2: MSI Command Center Control Service - (MSICTL_CC) - C:\Program Files (x86)\MSI\Command Center\MSIControlService.exe
O23 - Service R2: MSI Gaming Hotkey Service - (GamingHotkey_Service) - C:\Program Files (x86)\MSI\Gaming APP\GamingHotkey_Service.exe
O23 - Service R2: MSI Live Update Service - (MSI_LiveUpdate_Service) - C:\Program Files (x86)\MSI\Live Update\MSI_LiveUpdate_Service.exe
O23 - Service R2: MSI Super Charger Service - (MSI_SuperCharger) - C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe
O23 - Service R2: MSIREGISTER_MR - C:\MSI\MSIRegister\MSIRegisterService.exe
O23 - Service R2: MSI_ActiveX_Service - C:\Program Files (x86)\MSI\MSI OC Kit\ActiveX_Service\MSI_ActiveX_Service.exe
O23 - Service R2: MysticLight2_Service - C:\Program Files (x86)\MSI\MysticLight\MysticLight2_Service.exe
O23 - Service R2: Realtek Audio Universal Service - (RtkAudioUniversalService) - C:\Windows\System32\RtkAudUService64.exe
O23 - Service R2: TeamViewer 14 - (TeamViewer) - C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
O23 - Service R3: Steam Client Service - C:\Program Files (x86)\Common Files\Steam\SteamService.exe /RunAsService
O23 - Service S2: Google Güncelleme Hizmeti (gupdate) - (gupdate) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /svc
O23 - Service S3: BattlEye Service - (BEService) - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe
O23 - Service S3: EasyAntiCheat - C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe
O23 - Service S3: Google Chrome Elevation Service - (GoogleChromeElevationService) - C:\Program Files (x86)\Google\Chrome\Application\78.0.3904.70\elevation_service.exe
O23 - Service S3: Google Güncelleme Hizmeti (gupdatem) - (gupdatem) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /medsvc
O23 - Service S3: Kaspersky Volume Shadow Copy Service Bridge. 20.0 - (klvssbridge64_20.0) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 20.0\x64\vssbridge64.exe
O23 - Service S3: MSI Command Center CPU Service - (MSICPU_CC) - C:\Program Files (x86)\MSI\Command Center\CPU\MSICPUService_x64.exe
O23 - Service S3: MSI Command Center Clock Service - (MSIClock_CC) - C:\Program Files (x86)\MSI\Command Center\ClockGen\MSIClockService_x64.exe
O23 - Service S3: MSI Command Center Comm Service - (MSICOMM_CC) - C:\Program Files (x86)\MSI\Command Center\MSICommService.exe
O23 - Service S3: MSI Command Center DDR Service - (MSIDDR_CC) - C:\Program Files (x86)\MSI\Command Center\DDR\MSIDDRService.exe
O23 - Service S3: MSI Command Center SMBus Service - (MSISMB_CC) - C:\Program Files (x86)\MSI\Command Center\SMBus\MSISMBService.exe
O23 - Service S3: MSI Command Center SuperIO Service - (MSISuperIO_CC) - C:\Program Files (x86)\MSI\Command Center\SuperIO\MSISuperIOService.exe
O23 - Service S3: Mozilla Maintenance Service - (MozillaMaintenance) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service S3: Office 64 Source Engine - (ose64) - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
O23 - Service S3: Rockstar Game Library Service - (Rockstar Service) - C:\Program Files\Rockstar Games\Launcher\RockstarService.exe
O23 - Service S3: Uncheater for BattleGroundsLite_SE - (uncheater_bgl) - C:\Program Files\Common Files\Uncheater\uncheater_bgl.exe
O23 - Service S3: iPod Servisi - (iPod Service) - C:\Program Files\iPod\bin\iPodService.exe
--
End of file - Time spent: 19,8 sec. - 29406 bytes, CRC32: FFFFFFFF. Sign: 뤗ᚯ
Olabilir, her ihtimali düşünmeye başladım programa ait tüm dosyaları kaldırabilecek önerdiğin bir program var mı?Bir şüphem var, virüs Teamviewer yoluyla bulaştırılma ihtimali olabilir mi?