Rehber HijackThis Log Paylaşımı ve Çözümleri

O4 - ActiveSetup: HKLM\..\{8A69D345-D564-463c-AFF1-A69D9E530F96}: [StubPath] = C:\Program Files\Google\Chrome\Application\128.0.6613.114\Installer\chrmstp.exe --configure-user-settings --verbose-logging --system-level --channel=stable (sign: 'Google LLC')
O4 - ActiveSetup: HKLM\..\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}: [StubPath] = C:\Program Files\BraveSoftware\Brave-Browser\Application\128.1.69.160\Installer\chrmstp.exe --configure-user-settings --verbose-logging --system-level (sign: 'Brave Software, Inc.')
O4 - HKCU\..\StartupApproved\Run: [MicrosoftEdgeAutoLaunch_E4B6158330865F68A7A950146713DC84] = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --no-startup-window --win-session-start (2024/08/31) (sign: 'Microsoft')
O4 - HKCU\..\StartupApproved\Run: [OneDrive] = C:\Users\emre\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background (2024/08/31) (sign: 'Microsoft')
O4 - HKCU\..\StartupApproved\Run: [Spotify] = C:\Users\emre\AppData\Roaming\Spotify\Spotify.exe --autostart --minimized (2024/08/31) (sign: 'Spotify AB')
O22 - BITS Job: (download) {9DAE7F4E-1FE2-4A76-92B7-34F8FA246881} - hxxp://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad4yxgp7ngdthbmnljttvjzk5vka_20240820.666556390.14/obedbbhbpmojnkanicioggnmelmoomoc_20240820.666556390.14_all_TR500000_ejbkov7a6ebf4kv2fqz6mgjxk4.crx3 -> C:\Users\emre\AppData\Local\Temp\chrome_BITS_3712_1927040929\obedbbhbpmojnkanicioggnmelmoomoc_20240820.666556390.14_all_TR500000_ejbkov7a6ebf4kv2fqz6mgjxk4.crx3
O22 - BITS Job: (download) {E6C5C255-61CB-4F83-813C-D63A0279AC4D} - hxxp://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acwcdm4bj7lx4xbm2ireywxlhvca_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win64_adsurwm4gclupf32xdrpgdnapira.crx3 -> C:\Users\emre\AppData\Local\Temp\chrome_BITS_6868_2057600893\oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win64_adsurwm4gclupf32xdrpgdnapira.crx3
O22 - BITS Job: Fix all (including legit)

LogFile of HijackThis+ (Plus) Build 2024-04-18 Alpha v.3.4.0.9

Platform: X64 Windows 10 (Home), 10.0.19045.4842 (releaseıd: 2009, 22H2), service pack: 0
Time: 09.09.2024 - 02:19 (utc+03:00)
Language: OS: Turkish (0x41F). Display: Turkish (0x41F). Non-unicode: Turkish (0x41F)
Memory: 14908 mib Free. Loading RAM (10 %), CPU (1 %)
Elevated: Yes.
Ran by: Ted (group: Administrators; type: Local) on desktop-dpd91nr, firstrun: Yes.

Internet Explorer: 11.0.19041.4355
Default: "C:\program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --Single-argument %1 (Brave)

Boot mode: Normal (Secure Boot: Off)

Running processes:
Number | path.
 1 C:\program Files\AMD\CNext\CNext\cncmd.exe
 1 C:\program Files\Realtek\Audio\HDA\RtkNGUI64.exe
 1 C:\Users\ted\Desktop\HiJackThis.exe
 1 C:\Windows\explorer.exe
 1 C:\Windows\servicing\TrustedInstaller.exe
 2 C:\Windows\System32\csrss.exe
 1 C:\Windows\System32\ctfmon.exe
 1 C:\Windows\System32\DriverStore\FileRepository\u0395510.inf_amd64_266bc083bb7590df\B395348\atieclxx.exe
 1 C:\Windows\System32\DriverStore\FileRepository\u0395510.inf_amd64_266bc083bb7590df\B395348\atiesrxx.exe
 1 C:\Windows\System32\dwm.exe
 2 C:\Windows\System32\fontdrvhost.exe
 1 C:\Windows\System32\lsass.exe
 1 C:\Windows\System32\MoUsoCoreWorker.exe
 1 C:\Windows\System32\rundll32.exe
 1 C:\Windows\System32\RuntimeBroker.exe
 1 C:\Windows\System32\services.exe
 1 C:\Windows\System32\SgrmBroker.exe
 1 C:\Windows\System32\sihost.exe
 1 C:\Windows\System32\smss.exe
 20 C:\Windows\System32\svchost.exe
 1 C:\Windows\System32\taskhostw.exe
 1 C:\Windows\System32\userinit.exe
 1 C:\Windows\System32\wbem\WMIADAP.exe
 1 C:\Windows\System32\wbem\WmiPrvSE.exe
 1 C:\Windows\System32\wininit.exe
 1 C:\Windows\System32\winlogon.exe
 1 C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
 1 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
 1 C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4840_none_7de2e3147cada334\TiWorker.exe

O2 - HKLM\..\BHO: ıetoedge bho - {1FD49718-1D00-4B19-AF5F-070 AF6D5D54C} - C:\program files (x86)\Microsoft\Edge\Application\128.0.2739.63\BHO\ie_to_edge_bho_64.dll (file missing)
O4 - activesetup: HKLM\..\{9459C573-B17A-45AE-9F64-1857B5D58CEE}: [StubPath] = "C:\program files (x86)\Microsoft\Edge\Application\128.0.2739.63\Installer\setup.exe" --configure-user-settings --verbose-logging --System-level --msedge --channel = stable (file missing)
O4 - activesetup: HKLM\..\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}: [StubPath] = C:\program Files\BraveSoftware\Brave-Browser\Application\128.1.69.162\Installer\chrmstp.exe --configure-user-settings --verbose-logging --System-level (sign: 'Brave software, ınc.')
O4 - HKCU\..\StartupApproved\Run: [Discord] = C:\Users\ted\AppData\Local\Discord\Update.exe --processstart Discord.exe (2024/09/06) (sign: 'Discord ınc.')
O4 - HKCU\..\StartupApproved\Run: [Snap Camera] = C:\program Files\Snap Inc\Snap Camera\Snap Camera.exe --minimized-mode (2024/09/07) (invalid sign: Trust_e_bad_dıgest - snap ınc - A7109E2Ab38BD69299E3F7e8C049C8085CD45618)
O4 - HKLM\..\Run: [RTHDVCPL] = C:\program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s (sign: 'Realtek semiconductor corp')
O5 - applet: C:\Windows\System32\RTSnMg64.cpl (sign: 'Realtek semiconductor corp')
O7 - policy: (UAC) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System: [ConsentPromptBehaviorAdmin] = 0
O7 - policy: (UAC) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System: [PromptOnSecureDesktop] = 0
O7 - policy: HKCU\..\Windows\Explorer: [DisableSearchBoxSuggestions] = 1
O7 - policy: HKLM\..\Windows\Explorer: [DisableSearchBoxSuggestions] = 1
O7 - policy: HKLM\Software\Microsoft\Windows Defender\Features: [TamperProtection] = 4
O7 - policy: HKLM\Software\Microsoft\Windows Defender\Real-Time protection: [DisableRealtimeMonitoring] = 1
O7 - policy: HKLM\Software\Policies\Microsoft\Windows Defender: [DisableAntiSpyware] = 1
O7 - policy: HKLM\Software\Policies\Microsoft\Windows Defender: [DisableAntiVirus] = 1
O17 - DHCP DNS 1: 8.8.8.8 (well-known DNS: Google)
O17 - DHCP DNS 2: 8.8.4.4 (well-known DNS: Google)
O17 - HKLM\System\CCS\Services\Tcpip\..\{b9c34cce-626b-4d0e-ac7d-5a6b16f70f71}: [NameServer] = 8.8.4.4 (well-known DNS: Google)
O17 - HKLM\System\CCS\Services\Tcpip\..\{b9c34cce-626b-4d0e-ac7d-5a6b16f70f71}: [NameServer] = 8.8.8.8 (well-known DNS: Google)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive1: (no name) - {bbacc218-34EA-4666-9D7A-C78F2274A524} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive2: (no name) - {5AB7172C-9C11-405C-8DD5-AF20F3606282} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive3: (no name) - {A78ED123-AB77-406B-9962-2A5D9D2F7F30} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive4: (no name) - {F241C880-6982-4CE5-8CF7-7085BA96da5a} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive5: (no name) - {A0396A93-DC06-4AEF-BEE9-95ffccaef20e} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive6: (no name) - {9AA2F32D-362a-42D9-9328-24A483E2CCC3} - (no file)
O21 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive7: (no name) - {C5FF006E-2AE9-408C-B85b-2dfDD5449D9C} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive1: (no name) - {bbacc218-34EA-4666-9D7A-C78F2274A524} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive2: (no name) - {5AB7172C-9C11-405C-8DD5-AF20F3606282} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive3: (no name) - {A78ED123-AB77-406B-9962-2A5D9D2F7F30} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive4: (no name) - {F241C880-6982-4CE5-8CF7-7085BA96da5a} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive5: (no name) - {A0396A93-DC06-4AEF-BEE9-95ffccaef20e} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive6: (no name) - {9AA2F32D-362a-42D9-9328-24A483E2CCC3} - (no file)
O21-32 - HKLM\..\ShellIconOverlayIdentifiers\ OneDrive7: (no name) - {C5FF006E-2AE9-408C-B85b-2dfDD5449D9C} - (no file)
O22 - task (.job): (not scheduled) Yandex browser güncellemesi. Job - C:\Users\ted\AppData\Local\Yandex\YandexBrowser\Application\browser.exe (file missing)
O22 - task (.job): (not scheduled) Yandex browser sistem güncellemesi. Job - C:\program files (x86)\Yandex\YandexBrowser\24.7.2.1100\service_update.exe (sign: 'Yandex llc')
O22 - task (.job): (not scheduled) Yandex browser güncelleme servisinin geri yüklenmesi. Job - C:\program files (x86)\Yandex\YandexBrowser\24.7.2.1100\service_update.exe (sign: 'Yandex llc')
O22 - tasks: (disabled) (telemetry) \Microsoft\Windows\Application Experience\PcaPatchDbTask - C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask (sign: 'Microsoft')
O22 - tasks: (disabled) \Microsoft\Windows\Management\Autopilot\DetectHardwareChange - {62b2DD2C-F129-42EE-BF59-55D3FD21C215},detecthardwarechange - C:\Windows\System32\Autopilot.dll (sign: 'Microsoft')
O22 - tasks: (disabled) \Microsoft\Windows\Management\Autopilot\RemediateHardwareChange - {62b2DD2C-F129-42EE-BF59-55D3FD21C215},remediatehardwarechange - C:\Windows\System32\Autopilot.dll (sign: 'Microsoft')
O22 - tasks: (disabled) \Microsoft\Windows\Management\Provisioning\Retry - C:\Windows\system32\ProvTool.exe /turn 5 /source provretrytask (sign: 'Microsoft')
O22 - tasks: (disabled) \Microsoft\Windows\Management\Provisioning\RunOnReboot - C:\Windows\system32\ProvTool.exe /turn 5 /source continuesessiontask (sign: 'Microsoft')
O22 - tasks: (disabled) \Microsoft\Windows\UpdateOrchestrator\Schedule maintenance work - C:\Windows\system32\usoclient.exe startmaintenancework (sign: 'Microsoft')
O22 - tasks: (telemetry) \Microsoft\Windows\Application Experience\MareBackup - C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -F: Updatesoftwareınventoryw invsvc (sign: 'Microsoft')
O22 - tasks: (telemetry) \Microsoft\Windows\Application Experience\MareBackup - C:\Windows\system32\compattelrunner.exe -m:aemarebackup.dll -F: Backupmaredata (sign: 'Microsoft')
O22 - tasks: (telemetry) \Microsoft\Windows\Application Experience\MareBackup - C:\Windows\system32\compattelrunner.exe -m:appraiser.dll -F: Doscheduledtelemetryrun (sign: 'Microsoft')
O22 - tasks: \Microsoft\Windows\SMB\UninstallSMB1ClientTask - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -executionpolicy unrestricted -nonınteractive -noprofile -windowstyle hidden "& C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\DisableUnusedSmb1.ps1 -scenario Client" (sign: ")
O22 - tasks: \Microsoft\Windows\SMB\UninstallSMB1ServerTask - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -executionpolicy unrestricted -nonınteractive -noprofile -windowstyle hidden "& C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\DisableUnusedSmb1.ps1 -scenario server" (sign: ")
O22 - tasks: Amdınstalllauncher - C:\program Files\AMD\CIM\Bin64\InstallManagerApp.exe /ınstallauep (sign: 'Advanced Micro devices ınc.')
O22 - tasks: Amdlinkupdate - C:\program Files\AMD\CIM\Bin64\InstallManagerApp.exe -amdlinkupdate (sign: 'Advanced Micro devices ınc.')
O22 - tasks: Amdryzenmastersdktask - C:\program Files\AMD\CNext\CNext\cpumetricsserver.exe (sign: 'Advanced Micro devices ınc.')
O22 - tasks: Bravesoftwareupdatetaskmachinecore{AA5AA6C3-B055-4ECB-A3D4-ffadEE2705AC} - C:\program files (x86)\BraveSoftware\Update\BraveUpdate.exe /c (sign: 'Brave software, ınc.')
O22 - tasks: Bravesoftwareupdatetaskmachineua{a2CB8EE1-99C7-4F05-A4C2-51236A50eed5} - C:\program files (x86)\BraveSoftware\Update\BraveUpdate.exe /ua /installsource scheduler (sign: 'Brave software, ınc.')
O22 - tasks: Eosv3 scheduler onlogon - C:\Users\ted\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner.exe logon (sign: 'ESET, spol. S r. O.')
O22 - tasks: Eosv3 scheduler ONT'ime - C:\Users\ted\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner.exe sched (sign: 'ESET, spol. S r. O.')
O22 - tasks: Microsoftedgeupdatetaskmachinecore - C:\program files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe /c (file missing)
O22 - tasks: Microsoftedgeupdatetaskmachineua - C:\program files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe /ua /installsource scheduler (file missing)
O22 - tasks: Modifylinkupdate - C:\program Files\AMD\CIM\Bin64\InstallManagerApp.exe -updatecurrentuser (sign: 'Advanced Micro devices ınc.')
O22 - tasks: Startcn - C:\program Files\AMD\CNext\CNext\cncmd.exe startwithdelay (sign: 'Advanced Micro devices ınc.')
O22 - tasks: Startdvr - C:\program Files\AMD\CNext\CNext\RSServCmd.exe (sign: 'Advanced Micro devices ınc.')
O22 - tasks: Yandex browser güncellemesi - C:\Users\ted\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --background-Update --noerrdialogs (file missing)
O22 - tasks: Yandex browser sistem güncellemesi - C:\program files (x86)\Yandex\YandexBrowser\24.7.2.1100\service_update.exe --run-as-Launcher (sign: 'Yandex llc')
O22 - tasks: Yandex browser güncelleme servisinin geri yüklenmesi - C:\program files (x86)\Yandex\YandexBrowser\24.7.2.1100\service_update.exe --repair (sign: 'Yandex llc')
O23 - service r2: AMD external events Utility - C:\Windows\System32\DriverStore\FileRepository\u0395510.inf_amd64_266bc083bb7590df\B395348\atiesrxx.exe (sign: 'Advanced Micro devices ınc.')
O23 - service S2: Asusupdatecheck - C:\Windows\System32\AsusUpdateCheck.exe (sign: 'ASUSTeK Computer ınc.')
O23 - service S2: Microsoft Edge Update service (edgeupdate) - (edgeupdate) - C:\program files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe /svc (file missing)
O23 - service S3: Microsoft Defender çekirdek hizmeti - (mdcoresvc) - C:\ProgramData\Microsoft\Windows Defender\platform\4.18.24070.5-0\MpDefenderCoreService.exe (sign: 'Microsoft')
O23 - service S3: Microsoft Edge elevation service (microsoftedgeelevationservice) - (microsoftedgeelevationservice) - C:\program files (x86)\Microsoft\Edge\Application\128.0.2739.63\elevation_service.exe (file missing)
O23 - service S3: Microsoft Edge Update service (edgeupdatem) - (edgeupdatem) - C:\program files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe /medsvc (file missing)
O23 - service S3: Steam Client service - C:\program files (X86)\common Files\Steam\steamservice.exe /runasservice (sign: 'Valve Corp.')
O23 - driver r0: AMD PCI root bus lower filter - (amdkmpfd) - C:\Windows\System32\drivers\amdkmpfd.sys (+safe mode) (sign: 'Advanced Micro devices ınc.')
O23 - driver r0: AMD PSP service - (amdpsp) - C:\Windows\System32\drivers\amdpsp.sys (sign: 'Advanced Micro devices, ınc.')
O23 - driver r1: Memuhyperv service - (memudrv) - C:\Windows\system32\DRIVERS\MEmuDrv.sys (sign: 'shanghai microvirt software Technology co. LTD.')
O23 - driver r2: Amdryzenmasterdriverv20 - C:\Windows\system32\AMDRyzenMasterDriver.sys (sign: 'Advanced Micro devices ınc.')
O23 - driver R3: AMD crash Defender driver - (amdfendr) - C:\Windows\System32\drivers\amdfendr.sys (sign: 'Microsoft' - Advanced Micro devices, ınc.)
O23 - driver R3: AMD crash Defender Manager driver - (amdfendrmgr) - C:\Windows\System32\drivers\amdfendrmgr.sys (sign: 'Microsoft' - Advanced Micro devices, ınc.)
O23 - driver R3: AMD function driver for HD Audio service - (atihdaudioservice) - C:\Windows\system32\drivers\AtihdWT6.sys (sign: 'Microsoft' - Advanced Micro devices)
O23 - driver R3: AMD gpıo Client driver - (amdgpio2) - C:\Windows\System32\drivers\amdgpio2.sys (sign: 'Advanced Micro devices ınc.')
O23 - driver R3: AMD gpıo Client driver - (amdgpio3) - C:\Windows\System32\drivers\amdgpio3.sys (invalid sign: Cert_e_chaınıng - Advanced Micro devices, ınc - 6C33D9E8ed5C745C079CC9cCE37EF9449E428A91)
O23 - driver R3: AMD Link Controller emulation - (amdxe) - C:\Windows\System32\drivers\amdxe.sys (sign: 'Advanced Micro devices ınc.')
O23 - driver R3: AMD PCI - (amdpcıdev) - C:\Windows\System32\drivers\AMDPCIDev.sys (sign: 'Advanced Micro devices ınc.')
O23 - driver R3: Amdsafd - C:\Windows\System32\DriverStore\FileRepository\amdsafd.inf_amd64_54807f69fe156f14\amdsafd.sys (sign: 'Advanced Micro devices ınc.')
O23 - driver R3: Amdwddmg - C:\Windows\System32\DriverStore\FileRepository\u0395510.inf_amd64_266bc083bb7590df\B395348\amdkmdag.sys (sign: 'Advanced Micro devices ınc.')
O23 - driver R3: Realtek RT640 NT driver - (RT640x64) - C:\Windows\System32\drivers\rt640x64.sys (+safe mode) (sign: 'Realtek semiconductor Corp.')
O23 - driver R3: Service for Realtek HD Audio (wdm) - (ıntcazaudaddservice) - C:\Windows\system32\drivers\RTKVHD64.sys (sign: 'Realtek semiconductor corp')
O23 - driver R3: Snap camera - (snapcameravirtualdevice) - C:\Windows\System32\drivers\SnapCameraVirtualDevice.sys (sign: 'snap ınc.')
O23 - driver S3: Intel(R) Serial IO gpıo Controller driver - (ialpssi_gpıo) - C:\Windows\System32\drivers\iaLPSSi_GPIO.sys (sign: 'Intel corporation - Client components group')
O23 - driver S3: Revoflt - C:\Windows\system32\DRIVERS\revoflt.sys (sign: 'Microsoft' - vs Revo group)
O23 - dependency: Microsoft service group 'NDIS' contains unknown service: 'RT640x64'.
O26 - debugger: HKLM\..\CompatTelRunner.exe: [Debugger] = C:\Windows\System32\taskkill.exe (sign: 'Microsoft')
O26 - debugger: HKLM\..\DeviceCensus.exe: [Debugger] = C:\Windows\System32\taskkill.exe (sign: 'Microsoft')

--
End of file - time spent: 11 sec. - 31276 bytes, CRC32: Ffffffff. Sign: 쁱ꓟ.

Running processes:
Number | Path
   2  C:\Program Files (x86)\Google\Chrome Remote Desktop\129.0.6668.14\remoting_host.exe
   1  C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe
   1  C:\Program Files (x86)\Intel\Driver and Support Assistant\DSATray.exe
   1  C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe
   1  C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe
   1  C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe
   1  C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe
   1  C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
   1  C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpDefenderCoreService.exe
   1  C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MsMpEng.exe
   1  C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\NisSrv.exe
   1  C:\Users\burha\Desktop\HiJackThis\HiJackThis.exe
   1  C:\Windows\explorer.exe
   1  C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
   1  C:\Windows\servicing\TrustedInstaller.exe
   1  C:\Windows\System32\AggregatorHost.exe
   1  C:\Windows\System32\audiodg.exe
   2  C:\Windows\System32\conhost.exe
   2  C:\Windows\System32\csrss.exe
   1  C:\Windows\System32\ctfmon.exe
   1  C:\Windows\System32\dllhost.exe
   1  C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_01c7e148055ac0fe\igfxCUIService.exe
   1  C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_01c7e148055ac0fe\igfxEM.exe
   1  C:\Windows\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_1b99d7afd85e5c44\OneApp.IGCC.WinService.exe
   1  C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_58ee72dee7989949\IntelCpHDCPSvc.exe
   1  C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_58ee72dee7989949\IntelCpHeciSvc.exe
   1  C:\Windows\System32\dwm.exe
   2  C:\Windows\System32\fontdrvhost.exe
   1  C:\Windows\System32\Intel\DPTF\dptf_helper.exe
   1  C:\Windows\System32\Intel\DPTF\esif_uf.exe
   1  C:\Windows\System32\lsass.exe
   3  C:\Windows\System32\RuntimeBroker.exe
   1  C:\Windows\System32\SearchIndexer.exe
   1  C:\Windows\System32\SecurityHealthService.exe
   1  C:\Windows\System32\services.exe
   1  C:\Windows\System32\SgrmBroker.exe
   1  C:\Windows\System32\sihost.exe
   1  C:\Windows\System32\smss.exe
   1  C:\Windows\System32\spoolsv.exe
  72  C:\Windows\System32\svchost.exe
   2  C:\Windows\System32\taskhostw.exe
   2  C:\Windows\System32\wbem\WmiPrvSE.exe
   1  C:\Windows\System32\wininit.exe
   1  C:\Windows\System32\winlogon.exe
   1  C:\Windows\System32\wlanext.exe
   1  C:\Windows\System32\WUDFHost.exe
   1  C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
   1  C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
   1  C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
   1  C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4892_none_7de7b6f67ca95529\TiWorker.exe

O4 - ActiveSetup: HKLM\..\{8A69D345-D564-463c-AFF1-A69D9E530F96}: [StubPath] = C:\Program Files\Google\Chrome\Application\128.0.6613.138\Installer\chrmstp.exe --configure-user-settings --verbose-logging --system-level --channel=stable (sign: 'Google LLC')
O4 - HKCU\..\StartupApproved\Run: [Crypto] = C:\Users\burha\AppData\Roaming\Microsoft\Crypto\Crypto.vbs (2024/05/05) (not signed - no company - 0B1B9F9EEC9B568D4A80BBACBB2C3EB1A65AF64B)
O4 - HKCU\..\StartupApproved\Run: [EpicGamesLauncher] = "E:\epic\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe" -silent -launchcontext=boot (file missing) (2024/09/12)
O4 - HKCU\..\StartupApproved\Run: [MicrosoftEdgeAutoLaunch_1EF25A4AB80F8B20554B8DA0B213B4EE] = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --no-startup-window --win-session-start (2024/05/05) (sign: 'Microsoft')
O4 - HKCU\..\StartupApproved\Run: [OneDrive] = C:\Users\burha\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background (2024/05/05) (sign: 'Microsoft')
O4 - HKCU\..\StartupApproved\Run: [Opera Browser Assistant] = C:\Users\burha\AppData\Local\Programs\Opera\assistant\browser_assistant.exe (2024/05/05) (sign: 'Opera Norway AS')
O4 - HKLM\..\Run: [ctfmon] = C:\Windows\System32\ctfmon.exe (sign: 'Microsoft')
O4 - HKLM\..\Run: [RTHDVCPL] = C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s (sign: 'Realtek Semiconductor Corp.')
O4 - HKLM\..\StartupApproved\Run: [SecurityHealth] = C:\Windows\system32\SecurityHealthSystray.exe (2024/05/05) (sign: 'Microsoft')
O5 - Applet: C:\Windows\System32\RTSnMg64.cpl (sign: 'Realtek Semiconductor Corp.')
O7 - Policy: HKLM\Software\Microsoft\Windows Defender\Features: [TamperProtection] = 4
O7 - TroubleShooting (EV): %PATH% has missing system folder: C:\Windows
O17 - DHCP DNS 1: 192.168.1.1
O22 - Tasks: (disabled) \Microsoft\Windows\Management\Autopilot\DetectHardwareChange - {62B2DD2C-F129-42EE-BF59-55D3FD21C215},DetectHardwareChange - C:\Windows\System32\Autopilot.dll (sign: 'Microsoft')
O22 - Tasks: (disabled) \Microsoft\Windows\Management\Autopilot\RemediateHardwareChange - {62B2DD2C-F129-42EE-BF59-55D3FD21C215},RemediateHardwareChange - C:\Windows\System32\Autopilot.dll (sign: 'Microsoft')
O22 - Tasks: (disabled) \Microsoft\Windows\Management\Provisioning\Retry - C:\Windows\system32\ProvTool.exe /turn 5 /source ProvRetryTask (sign: 'Microsoft')
O22 - Tasks: (disabled) \Microsoft\Windows\Management\Provisioning\RunOnReboot - C:\Windows\system32\ProvTool.exe /turn 5 /source ContinueSessionTask (sign: 'Microsoft')
O22 - Tasks: (disabled) \Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work - C:\Windows\system32\usoclient.exe StartMaintenanceWork (sign: 'Microsoft')
O22 - Tasks: (telemetry) \Microsoft\Windows\Application Experience\MareBackup - C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW invsvc (sign: 'Microsoft')
O22 - Tasks: (telemetry) \Microsoft\Windows\Application Experience\MareBackup - C:\Windows\system32\compattelrunner.exe -m:aemarebackup.dll -f:BackupMareData (sign: 'Microsoft')
O22 - Tasks: (telemetry) \Microsoft\Windows\Application Experience\MareBackup - C:\Windows\system32\compattelrunner.exe -m:appraiser.dll -foScheduledTelemetryRun (sign: 'Microsoft')
O22 - Tasks: (telemetry) \Microsoft\Windows\Application Experience\PcaPatchDbTask - C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask (sign: 'Microsoft')
O22 - Tasks: \GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem130.0.6679.0{A753CE0A-BA9F-48DA-BB0D-C1A46ED33AE6} - C:\Program Files (x86)\Google\GoogleUpdater\130.0.6679.0\updater.exe --wake --system (sign: 'Google LLC')
O22 - Tasks: IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132 - C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe --automatic (sign: 'Intel Corporation')
O22 - Tasks: IntelSURQC-Upgrade-86621605-2a0b-4128-8ffc-15514c247132-Logon - C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe --automatic (sign: 'Intel Corporation')
O22 - Tasks: IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 - C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe --automatic (file missing)
O22 - Tasks: MSIAfterburner - C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe /s (sign: 'MICRO-STAR INTERNATIONAL CO., LTD.')
O22 - Tasks: OneDrive Reporting Task-S-1-5-21-2546540862-2233662565-4250941841-1001 - C:\Users\burha\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe /reporting (sign: 'Microsoft')
O22 - Tasks: Opera scheduled assistant Autoupdate 1714921801 - C:\Users\burha\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --productiscomponent --bypasslauncher --installdir="C:\Users\burha\AppData\Local\Programs\Opera\assistant" --producttype=assistant $(Arg0) (sign: 'Opera Norway AS')
O22 - Tasks: Opera scheduled Autoupdate 1714921792 - C:\Users\burha\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --bypasslauncher $(Arg0) (sign: 'Opera Norway AS')
O22 - Tasks: USER_ESRV_SVC_QUEENCREEK - C:\Windows\System32\Wscript.exe //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs" (sign: 'Microsoft')
O23 - Service R2: Chrome Uzaktan Masaüstü Hizmeti - (chromoting) - C:\Program Files (x86)\Google\Chrome Remote Desktop\129.0.6668.14\remoting_host.exe --type=daemon --host-config="C:\ProgramData\Google\Chrome Remote Desktop\host.json" (sign: 'Google LLC')
O23 - Service R2: Energy Server Service queencreek - (ESRV_SVC_QUEENCREEK) - C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe "--AUTO_START" "--start" "--start_options_registry_key" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ESRV_SVC_QUEENCREEK\_start" (sign: 'Intel Corporation')
O23 - Service R2: Intel(R) Content Protection HDCP Service - (cplspcon) - C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_58ee72dee7989949\IntelCpHDCPSvc.exe (sign: 'Intel Corporation')
O23 - Service R2: Intel(R) Driver & Support Assistant - (DSAService) - C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAService.exe (sign: 'Intel Corporation')
O23 - Service R2: Intel(R) Driver & Support Assistant Updater - (DSAUpdateService) - C:\Program Files (x86)\Intel\Driver and Support Assistant\DSAUpdateService.exe (sign: 'Intel Corporation')
O23 - Service R2: Intel(R) Dynamic Platform and Thermal Framework service - (esifsvc) - C:\Windows\System32\Intel\DPTF\esif_uf.exe (sign: 'Intel Corporation')
O23 - Service R2: Intel(R) Graphics Command Center Service - (igccservice) - C:\Windows\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_1b99d7afd85e5c44\OneApp.IGCC.WinService.exe (sign: 'Intel Corporation')
O23 - Service R2: Intel(R) HD Graphics Control Panel Service - (igfxCUIService2.0.0.0) - C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_01c7e148055ac0fe\igfxCUIService.exe (sign: 'Intel Corporation')
O23 - Service R2: Intel(R) System Usage Report Service SystemUsageReportSvc_QUEENCREEK - (SystemUsageReportSvc_QUEENCREEK) - C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe (sign: 'Intel Corporation')
O23 - Service R2: Microsoft Defender Çekirdek Hizmeti - (MDCoreSvc) - C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.24070.5-0\MpDefenderCoreService.exe (sign: 'Microsoft')
O23 - Service R3: Intel(R) Content Protection HECI Service - (cphs) - C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_58ee72dee7989949\IntelCpHeciSvc.exe (sign: 'Intel Corporation')
O23 - Service S2: GoogleUpdater InternalService 130.0.6679.0 (GoogleUpdaterInternalService130.0.6679.0) - (GoogleUpdaterInternalService130.0.6679.0) - C:\Program Files (x86)\Google\GoogleUpdater\130.0.6679.0\updater.exe --system --windows-service --service=update-internal (sign: 'Google LLC')
O23 - Service S2: GoogleUpdater Service 130.0.6679.0 (GoogleUpdaterService130.0.6679.0) - (GoogleUpdaterService130.0.6679.0) - C:\Program Files (x86)\Google\GoogleUpdater\130.0.6679.0\updater.exe --system --windows-service --service=update (sign: 'Google LLC')
O23 - Service S2: Malwarebytes Service - (MBAMService) - E:\malwarebytes\MBAMService.exe (file missing) (+safe mode)
O23 - Service S3: BattlEye Service - (BEService) - C:\Program Files (x86)\Common Files\BattlEye\BEService.exe (sign: 'BattlEye Innovations e.K.')
O23 - Service S3: Epic Online Services - (EpicOnlineServices) - C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe (sign: 'Epic Games Inc.')
O23 - Service S3: Google Chrome Elevation Service (GoogleChromeElevationService) - (GoogleChromeElevationService) - C:\Program Files\Google\Chrome\Application\128.0.6613.138\elevation_service.exe (sign: 'Google LLC')
O23 - Service S3: Intel(R) SUR QC Software Asset Manager - (Intel(R) SUR QC SAM) - C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe (sign: 'Intel Corporation')
O23 - Service S3: LibreOffice Maintenance Service - (LibreOfficeMaintenance) - E:\Libre\program\update_service.exe (file missing)
O23 - Service S3: MBVpnTunnelService - E:\malwarebytes\MBVpnTunnelService.exe (file missing)
O23 - Service S3: Steam Client Service - C:\Program Files (x86)\Common Files\Steam\SteamService.exe /RunAsService (sign: 'Valve Corp.')
O23 - Service S3: User Energy Server Service queencreek - (USER_ESRV_SVC_QUEENCREEK) - C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe "--run_as_user_process"  (sign: 'Intel Corporation')
O23 - Driver R: (no name) - C:\Windows\System32\Drivers\dump_dumpsd.sys (file missing)
O23 - Driver R3: ___ Windows 10 64 Bit için Intel(R) Wireless Bağdaştırıcı Sürücüsü  - (Netwtw04) - C:\Windows\System32\drivers\Netwtw04.sys (+safe mode) (sign: 'Intel Corporation')
O23 - Driver R3: dptf_acpi - C:\Windows\System32\drivers\dptf_acpi.sys (+safe mode) (sign: 'Intel Corporation')
O23 - Driver R3: dptf_cpu - C:\Windows\System32\drivers\dptf_cpu.sys (+safe mode) (sign: 'Intel Corporation')
O23 - Driver R3: esif_lf - C:\Windows\System32\drivers\esif_lf.sys (+safe mode) (sign: 'Intel Corporation')
O23 - Driver R3: igfx - C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_58ee72dee7989949\igdkmd64.sys (sign: 'Intel Corporation')
O23 - Driver R3: Intel(R) Display Audio - (IntcDAud) - C:\Windows\System32\DriverStore\FileRepository\intcdaud.inf_amd64_e91fd5f4ce5fb012\IntcDAud.sys (sign: 'Intel Corporation')
O23 - Driver R3: Intel(R) HID Event Filter - (HidEventFilter) - C:\Windows\System32\drivers\HidEventFilter.sys (sign: 'Intel(R) Software')
O23 - Driver R3: Intel(R) Serial IO SPI Driver v2 - (iaLPSS2_SPI) - C:\Windows\System32\drivers\iaLPSS2_SPI.sys (+safe mode) (sign: 'Intel Corporation - Embedded Subsystems and IP Blocks Group')
O23 - Driver R3: Intel(R) Serial IO UART Driver v2 - (iaLPSS2_UART2) - C:\Windows\System32\drivers\iaLPSS2_UART2.sys (sign: 'Intel Corporation - Embedded Subsystems and IP Blocks Group')
O23 - Driver R3: Intel(R) Trusted Execution Engine Interface - (MEIx64) - C:\Windows\System32\drivers\TeeDriverW8x64.sys (sign: 'Intel(R) Embedded Subsystems and IP Blocks Group')
O23 - Driver R3: Intel(R) Wireless Bluetooth(R) - (ibtusb) - C:\Windows\System32\DriverStore\FileRepository\ibtusb.inf_amd64_930110eceb58f65b\ibtusb.sys (+safe mode) (sign: 'Intel Corporation')
O23 - Driver R3: Realtek USB Card Reader - UER - (RTSUER) - C:\Windows\system32\Drivers\RtsUer.sys (sign: 'Realtek Semiconductor Corp.')
O23 - Driver R3: semav6msr64 - C:\Windows\system32\drivers\semav6msr64.sys (sign: 'Intel Corporation')
O23 - Driver R3: Service for Realtek HD Audio (WDM) - (IntcAzAudAddService) - C:\Windows\system32\drivers\RTKVHD64.sys (sign: 'Realtek Semiconductor Corp.')
O23 - Driver S3: Intel(R) Serial IO GPIO Controller Driver - (iaLPSSi_GPIO) - C:\Windows\System32\drivers\iaLPSSi_GPIO.sys (sign: 'Intel Corporation - Client Components Group')
O23 - Driver S3: MBAMSwissArmy - C:\Windows\System32\Drivers\mbamswissarmy.sys (sign: 'Microsoft' - Malwarebytes)
O23 - Driver S3: SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.) - (ssudmdm) - C:\Windows\system32\DRIVERS\ssudmdm.sys (sign: 'Samsung Electronics CO., LTD.')
O23 - Driver S3: SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.) - (dg_ssudbus) - C:\Windows\system32\DRIVERS\ssudbus2.sys (+safe mode) (sign: 'Samsung Electronics CO., LTD.')
O23 - Dependency: Microsoft Service Group 'NDIS' contains unknown service:  'Netwtw04'


--
End of file - Time spent: 80,2 sec. - 32656 bytes, CRC32: FFFFFFFF. Sign: 

O4 - ActiveSetup: HKLM\..\{8A69D345-D564-463c-AFF1-A69D9E530F96}: [StubPath] = C:\Program Files\Google\Chrome\Application\128.0.6613.138\Installer\chrmstp.exe --configure-user-settings --verbose-logging --system-level --channel=stable (sign: 'Google LLC')
O4 - HKCU\..\StartupApproved\Run: [Crypto] = C:\Users\burha\AppData\Roaming\Microsoft\Crypto\Crypto.vbs (2024/05/05) (not signed - no company - 0B1B9F9EEC9B568D4A80BBACBB2C3EB1A65AF64B)
O4 - HKCU\..\StartupApproved\Run: [MicrosoftEdgeAutoLaunch_1EF25A4AB80F8B20554B8DA0B213B4EE] = C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe --no-startup-window --win-session-start (2024/05/05) (sign: 'Microsoft')
O4 - HKCU\..\StartupApproved\Run: [OneDrive] = C:\Users\burha\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background (2024/05/05) (sign: 'Microsoft')
O4 - HKCU\..\StartupApproved\Run: [Opera Browser Assistant] = C:\Users\burha\AppData\Local\Programs\Opera\assistant\browser_assistant.exe (2024/05/05) (sign: 'Opera Norway AS')
O22 - Tasks: \GoogleSystem\GoogleUpdater\GoogleUpdaterTaskSystem130.0.6679.0{A753CE0A-BA9F-48DA-BB0D-C1A46ED33AE6} - C:\Program Files (x86)\Google\GoogleUpdater\130.0.6679.0\updater.exe --wake --system (sign: 'Google LLC')
O22 - Tasks: MSIAfterburner - C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe /s (sign: 'MICRO-STAR INTERNATIONAL CO., LTD.')
O22 - Tasks: OneDrive Reporting Task-S-1-5-21-2546540862-2233662565-4250941841-1001 - C:\Users\burha\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe /reporting (sign: 'Microsoft')
O22 - Tasks: Opera scheduled assistant Autoupdate 1714921801 - C:\Users\burha\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --productiscomponent --bypasslauncher --installdir="C:\Users\burha\AppData\Local\Programs\Opera\assistant" --producttype=assistant $(Arg0) (sign: 'Opera Norway AS')
O22 - Tasks: USER_ESRV_SVC_QUEENCREEK - C:\Windows\System32\Wscript.exe //B //NoLogo "C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.vbs" (sign: 'Microsoft')
O23 - Service R2: Chrome Uzaktan Masaüstü Hizmeti - (chromoting) - C:\Program Files (x86)\Google\Chrome Remote Desktop\129.0.6668.14\remoting_host.exe --type=daemon --host-config="C:\ProgramData\Google\Chrome Remote Desktop\host.json" (sign: 'Google LLC')
O23 - Service R2: Energy Server Service queencreek - (ESRV_SVC_QUEENCREEK) - C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe "--AUTO_START" "--start" "--start_options_registry_key" "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\ESRV_SVC_QUEENCREEK\_start" (sign: 'Intel Corporation')
O23 - Service S3: MBVpnTunnelService - E:\malwarebytes\MBVpnTunnelService.exe (file missing)