Sahte Türkçe yama sitesinden indirilen virüs nasıl temizlenebilir?

Bu mu indirdiğiniz dosya?

sha256 - 7b6985aa651055dbe9867c2a4a300952b145c213da0bc697077b8247ac7082cc setup.exe

Özür dilerim ancak indirdiğim dosya sanırsam bu da değildi direkt RAR'dan çıkarttığım dosyayı kurmuştum.
 
Kayıt defterinden devre dışı bırakmış gözüküyor. Hijackthis ve FRST raporu göndermenizi isteyeceğim, inceledikten sonra konuya yazarım.

 

Yardımınız için çok teşekkür ederim hemen gönderiyorum.

Bu frst için.
[CODE title="hijaksthis"]Logfile of HiJackThis Fork by Alex Dragokas v.2.10.0.13

Platform: x64 Windows 10 (Pro), 10.0.19044.1415 (ReleaseId: 2009, 21H2), Service Pack: 0
Time: 24.12.2021 - 17:54 (UTC+03:00)
Language: OS: Turkish (0x41F). Display: Turkish (0x41F). Non-Unicode: Turkish (0x41F)
Elevated: Yes
Ran by: Mehmet Ali Vatan (group: Administrators) on MW, FirstRun: yes

Chrome: 96.0.4664.110
Internet Explorer: 11.789.19041.0
Default: "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument %1 (Google Chrome)

Boot mode: Normal

Running processes:
Number | Path
1 C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
1 C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
1 C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
1 C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler.exe
1 C:\Program Files (x86)\Google\Update\1.3.36.112\GoogleCrashHandler64.exe
1 C:\Program Files (x86)\IObit\Driver Booster\8.3.0\Scheduler.exe
1 C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe
14 C:\Program Files\Google\Chrome\Application\chrome.exe
1 C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
1 C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
1 C:\Program Files\WindowsApps\28017CharlesMilette.TranslucentTB_2021.5.0.0_x64__v826wp6bftszj\TranslucentTB.exe
1 C:\Program Files\WindowsApps\Microsoft.GamingServices_3.60.12001.0_x64__8wekyb3d8bbwe\gamingservices.exe
1 C:\Program Files\WindowsApps\Microsoft.GamingServices_3.60.12001.0_x64__8wekyb3d8bbwe\gamingservicesnet.exe
1 C:\Program Files\WindowsApps\Microsoft.YourPhone_1.21111.123.0_x64__8wekyb3d8bbwe\YourPhone.exe
4 C:\Users\Mehmet Ali Vatan\AppData\Local\Programs\Opera GX\81.0.4196.61\opera_autoupdate.exe
2 C:\Users\Mehmet Ali Vatan\AppData\Local\Programs\Opera GX\launcher.exe
1 C:\Users\Mehmet Ali Vatan\AppData\Roaming\Telegram Desktop\Telegram.exe
1 C:\Users\Mehmet Ali Vatan\Downloads\Programs\HiJackThis.exe
1 C:\Windows\explorer.exe
1 C:\Windows\System32\backgroundTaskHost.exe
2 C:\Windows\System32\csrss.exe
1 C:\Windows\System32\ctfmon.exe
1 C:\Windows\System32\dasHost.exe
1 C:\Windows\System32\dllhost.exe
1 C:\Windows\System32\dwm.exe
2 C:\Windows\System32\fontdrvhost.exe
1 C:\Windows\System32\lsass.exe
1 C:\Windows\System32\MoUsoCoreWorker.exe
5 C:\Windows\System32\RuntimeBroker.exe
1 C:\Windows\System32\SearchIndexer.exe
1 C:\Windows\System32\SecurityHealthService.exe
1 C:\Windows\System32\services.exe
1 C:\Windows\System32\SettingSyncHost.exe
1 C:\Windows\System32\SgrmBroker.exe
1 C:\Windows\System32\sihost.exe
1 C:\Windows\System32\smartscreen.exe
1 C:\Windows\System32\smss.exe
1 C:\Windows\System32\spoolsv.exe
1 C:\Windows\System32\sppsvc.exe
74 C:\Windows\System32\svchost.exe
1 C:\Windows\System32\taskhostw.exe
1 C:\Windows\System32\wbem\unsecapp.exe
2 C:\Windows\System32\wbem\WmiPrvSE.exe
1 C:\Windows\System32\wininit.exe
1 C:\Windows\System32\winlogon.exe
1 C:\Windows\System32\WUDFHost.exe
1 C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
1 C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
1 C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
1 C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe

R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8C3078A0-9AAB-4371-85D1-656CA8E46EE8}: [SuggestionsURL_JSON] = https://suggest.yandex.com.tr/suggest-ff.cgi?srv=ie11&uil=tr&part={searchTerms}&clid=2233630 - Yandex
R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8C3078A0-9AAB-4371-85D1-656CA8E46EE8}: = https://yandex.com.tr/search/?te...27098 bytes, CRC32: FFFFFFFF. Sign: 按뮞[/CODE]
 
Son düzenleme:
Aktif bir zararlı göremedim ama bunları fixleyin. Sonra, FRST ile aynı dizinde fixlist.txt adında bir metin belgesi oluşturup ikinci kodu içine yapıştırın. Yönetici olarak çalıştırıp fix tuşuna basın.

[CODE title="hijackthis"]R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8C3078A0-9AAB-4371-85D1-656CA8E46EE8}: [SuggestionsURL_JSON] = https://suggest.yandex.com.tr/suggest-ff.cgi?srv=ie11&uil=tr&part={searchTerms}&clid=2233630 - Yandex
R4 - SearchScopes: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{8C3078A0-9AAB-4371-85D1-656CA8E46EE8}: = https://yandex.com.tr/search/?te...<==== ATTENTION (Restriction - Zones) [/CODE]
 
Bu siteyi kullanmak için çerezler gereklidir. Siteyi kullanmaya devam etmek için çerezleri kabul etmelisiniz. Daha Fazlasını Öğren.…