Sistemimde virüs var mı?

Artorias74 · 17 Aralık 2020

Merhaba, son zamanlarda internetim bağlantım ara ara sorunlar yaşıyor, bilgisayar her açıldığında "Uygulama ve tarayıcı denetimi" adlı özellik Windows Defender'da kapatılmış oluyor, kendim elle tekrar açıyorum. Kaspersky Internet Security ile taradım bir şey çıkmadı, emin olmak için Windows Defender Offline Scan'de gerçekleştirdim ama tarama sonuçlarına ulaşamadım. Rica etsem, birisi analiz edebilir mi? HijackThisLog'um bu :

Kod:

Logfile of HiJackThis Fork by Alex Dragokas v.2.9.0.26

Platform:  x64 Windows 10 (Education), 10.0.19042.685 (ReleaseId: 2009), Service Pack: 0
Time:      17.12.2020 - 13:48 (UTC+03:00)
Language:  OS: Turkish (0x41F). Display: Turkish (0x41F). Non-Unicode: Turkish (0x41F)
Elevated:  Yes
Ran by:    ugurbyr    (group: Administrator) on DESKTOP-933F025, FirstRun: no

Edge:    11.0.19041.546
Internet Explorer: 11.0.19041.1
Default: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument %1 (Microsoft Edge)

Boot mode: Normal

Running processes:
Number | Path
   1  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.2\avp.exe
   1  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.2\avpui.exe
   1  C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
   1  C:\Program Files\7.1 Sound Effect Gaming Headset\CPL\FaceLift_x64.exe
   2  C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
   3  C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
   3  C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
   1  C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe
   1  C:\Program Files\WindowsApps\microsoft.yourphone_1.20111.125.0_x64__8wekyb3d8bbwe\YourPhone.exe
   1  C:\Users\ugurbyr\Desktop\HiJackThis.exe
   1  C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
   1  C:\Windows\System32\ApplicationFrameHost.exe
   1  C:\Windows\System32\CompPkgSrv.exe
   3  C:\Windows\System32\RuntimeBroker.exe
   1  C:\Windows\System32\SearchFilterHost.exe
   1  C:\Windows\System32\SearchIndexer.exe
   1  C:\Windows\System32\SearchProtocolHost.exe
   1  C:\Windows\System32\SecurityHealthService.exe
   1  C:\Windows\System32\SecurityHealthSystray.exe
   1  C:\Windows\System32\SgrmBroker.exe
   1  C:\Windows\System32\WUDFHost.exe
   1  C:\Windows\System32\audiodg.exe
   1  C:\Windows\System32\conhost.exe
   2  C:\Windows\System32\csrss.exe
   1  C:\Windows\System32\ctfmon.exe
   1  C:\Windows\System32\dllhost.exe
   1  C:\Windows\System32\dwm.exe
   2  C:\Windows\System32\fontdrvhost.exe
   1  C:\Windows\System32\lsass.exe
   1  C:\Windows\System32\rundll32.exe
   1  C:\Windows\System32\services.exe
   1  C:\Windows\System32\sihost.exe
   1  C:\Windows\System32\smartscreen.exe
   1  C:\Windows\System32\smss.exe
   1  C:\Windows\System32\spoolsv.exe
  70  C:\Windows\System32\svchost.exe
   1  C:\Windows\System32\taskhostw.exe
   1  C:\Windows\System32\wbem\WmiPrvSE.exe
   1  C:\Windows\System32\wininit.exe
   1  C:\Windows\System32\winlogon.exe
   1  C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
   1  C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
   1  C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
   1  C:\Windows\explorer.exe

O2 - HKLM\..\BHO: IEToEdge BHO - {1FD49718-1D00-4B19-AF5F-070AF6D5D54C} - C:\Program Files (x86)\Microsoft\Edge\Application\87.0.664.60\BHO\ie_to_edge_bho_64.dll
O2-32 - HKLM\..\BHO: IEToEdge BHO - {1FD49718-1D00-4B19-AF5F-070AF6D5D54C} - C:\Program Files (x86)\Microsoft\Edge\Application\87.0.664.60\BHO\ie_to_edge_bho.dll
O4 - HKCU\..\StartupApproved\Run: [OneDrive] = C:\Users\ugurbyr\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background (2020/12/16)
O4 - HKCU\..\StartupApproved\Run: [Steam] = C:\Program Files (x86)\Steam\steam.exe -silent (2020/12/16)
O4 - HKLM\..\Run: [Cm108BSound] = C:\Program Files\7.1 Sound Effect Gaming Headset\CPL\FaceLift_x64.exe /h /d
O17 - DHCP DNS 1: 1.1.1.1 (Well-known DNS: Cloudflare / APNIC)
O17 - DHCP DNS 2: 1.0.0.1 (Well-known DNS: Cloudflare / APNIC)
O17 - HKLM\System\CCS\Services\Tcpip\..\{82479e83-ca40-4557-accc-14124b4b35f3}: [NameServer] = 1.0.0.1 (Well-known DNS: Cloudflare / APNIC)
O17 - HKLM\System\CCS\Services\Tcpip\..\{82479e83-ca40-4557-accc-14124b4b35f3}: [NameServer] = 1.1.1.1 (Well-known DNS: Cloudflare / APNIC)
O22 - Task: (disabled) (update) \Microsoft\Windows\UpdateOrchestrator\Reboot_AC - C:\WINDOWS\system32\MusNotification.exe /RunOnAC RebootDialog (Microsoft)
O22 - Task: (disabled) (update) \Microsoft\Windows\UpdateOrchestrator\Reboot_Battery - C:\WINDOWS\system32\MusNotification.exe /RunOnBattery RebootDialog (Microsoft)
O22 - Task: (disabled) \Agent Activation Runtime\S-1-5-21-2884472411-4012815239-1292087636-1001 - C:\WINDOWS\System32\AgentActivationRuntimeStarter.exe
O22 - Task: (disabled) \Microsoft\Windows\Management\Provisioning\Retry - C:\WINDOWS\system32\ProvTool.exe /turn 5 /source ProvRetryTask (Microsoft)
O22 - Task: (disabled) \Microsoft\Windows\Management\Provisioning\RunOnReboot - C:\WINDOWS\system32\ProvTool.exe /turn 5 /source ContinueSessionTask (Microsoft)
O22 - Task: (disabled) \Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work - C:\WINDOWS\system32\usoclient.exe StartMaintenanceWork (Microsoft)
O22 - Task: (disabled) \Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work - C:\WINDOWS\system32\usoclient.exe StartWork (Microsoft)
O22 - Task: (telemetry) NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe
O22 - Task: (telemetry) NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe
O22 - Task: (telemetry) NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe
O22 - Task: (telemetry) NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe
O22 - Task: (telemetry) \Microsoft\Windows\Application Experience\PcaPatchDbTask - C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\PcaSvc.dll,PcaPatchSdbTask (Microsoft)
O22 - Task: (update) \Microsoft\Windows\UpdateOrchestrator\USO_UxBroker - C:\WINDOWS\system32\MusNotification.exe (Microsoft)
O22 - Task: Adobe Flash Player PPAPI Notifier - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_465_pepper.exe -check pepperplugin
O22 - Task: Adobe Flash Player Updater - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O22 - Task: Kaspersky_Upgrade_Launcher_{278ADC42-419D-4547-A6CA-5B74BE0AD901} - C:\Program Files\Common Files\AV\Kaspersky Lab\upgrade_launcher.exe /waitUpgrade
O22 - Task: NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe
O22 - Task: NvBatteryBoostCheckOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe -d "C:\Program Files\NVIDIA Corporation\NvBackend\NvBatteryBoostCheck" -l 3 -f C:\ProgramData\NVIDIA\NvContainerBatteryBoostCheck.log
O22 - Task: NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe -d "C:\Program Files\NVIDIA Corporation\NvDriverUpdateCheck" -l 3 -f C:\ProgramData\NVIDIA\NvContainerDriverUpdateCheck.log
O22 - Task: NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe --launcher=TaskScheduler
O22 - Task: NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe
O22 - Task: NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} - C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe
O22 - Task: \AVG\Overseer - C:\Windows\OEM\CustomizationFiles\Overseer.exe /from_scheduler:1
O22 - Task: \Microsoft\Windows\RetailDemo\CleanupOfflineContent - {61f77d5e-afe9-400b-a5e6-e9e80fc8e601} - C:\Windows\System32\RDXTaskFactory.dll (Microsoft)
O23 - Service R2: Kaspersky Anti-Virus Hizmeti 21.2 - (AVP21.2) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.2\avp.exe -r
O23 - Service R2: NVIDIA Display Container LS - (NVDisplay.ContainerLocalSystem) - C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000
O23 - Service R2: NVIDIA LocalSystem Container - (NvContainerLocalSystem) - C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe -s NvContainerLocalSystem -a -f "C:\ProgramData\NVIDIA\NvContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\NvContainer\plugins\LocalSystem" -r -p 30000 -st "C:\Program Files\NVIDIA Corporation\NvContainer\NvContainerTelemetryApi.dll"
O23 - Service S3: Adobe Flash Player Update Service - (AdobeFlashPlayerUpdateSvc) - C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service S3: Kaspersky VPN Secure Connection Hizmeti 5.2 - (KSDE5.2) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky VPN 5.2\ksde.exe -r
O23 - Service S3: Kaspersky Volume Shadow Copy Service Bridge 21.2 - (klvssbridge64_21.2) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 21.2\x64\vssbridge64.exe
O23 - Service S3: NVIDIA FrameView SDK service - (FvSvc) - C:\Program Files\NVIDIA Corporation\FrameViewSDK\nvfvsdksvc_x64.exe -service
O23 - Service S3: Steam Client Service - C:\Program Files (x86)\Common Files\Steam\SteamService.exe /RunAsService


--
End of file - Time spent: 10,9 sec. - 19206 bytes, CRC32: FFFFFFFF. Sign: 剬

364485 · 17 Aralık 2020

Kaspersky indirip tara geçenlerde bana trojan bulaşmıştı.

4Justicia · 17 Aralık 2020

Hijackthis.exe dosyasının ne olduğunu açıklar mısın, keylog atmış olabilir.

Artorias74 · 17 Aralık 2020

4Justicia dedi:
Hijackthis.exe dosyasının ne olduğunu açıklar mısın, keylog atmış olabilir.

Hocam, logu paylaşmak için kullandığım program.

ArdaFRKN · 17 Aralık 2020

4Justicia dedi:
Hijackthis.exe dosyasının ne olduğunu açıklar mısın, keylog atmış olabilir.

Keylogger değil. Virüs hiç değil.

CanbeyT · 17 Aralık 2020

Windows tam tarama. Çevrimdışı tarama. Kasksepery ıle taratın. Eğer depolama birden 20GB birden düştüyse olabilir yada sistem anormal çalışıyorsa. Aniden reklam geliyorsa.

4Justicia · 17 Aralık 2020

Artorias74 dedi:
Hocam, logu paylaşmak için kullandığım program.

hijack hava korsancılığı demek te karıştı aklım

ArdaFRKN · 17 Aralık 2020

Şahsen bu loglardan anlamıyorum ama Kaspersky ve Malwarebytes ücretsiz denemeleri ile tam tarama yapabilirsin.
Anlayan birini çağıralım.
@24099

Arda_Animations · 17 Aralık 2020

Windows Defender çevrimdışı tarama yapabilirsin.

Artorias74 · 17 Aralık 2020

ArdaFRKN dedi:
Şahsen bu loglardan anlamıyorum ama Kaspersky ve Malwarebytes ücretsiz denemeleri ile tam tarama yapabilirsin.
Anlayan birini çağıralım.
@24099

Kaspersky Internet Security kurulu hocam, tam tarama yapmıştım dün gece, şimdi tekrar yapayım. 3 gün önce sistem çok geç açılıyordu, bariz bir yavaşlama vardı, C diskini tamamen sıfırladım, bulut indirerek Windows'u tekrar kurdum. Şimdi'de her açıldığında Windows Defender uyarı veriyor ve baktığımda, "Uygulama ve tarayıcı denetimi" adlı özellik kapalı oluyor, kendim elle açıyorum. İnternet bağlantımda ara ara ani ping artışı gerçekleşiyor bir de.

Arda_Animations dedi:
Windows Defender çevrimdışı tarama yapabilirsin.

Onunla taradım ama sonuçlara ulaşamadım.

Sistemimde virüs var mı?

Ayrıntılı düzenleme

Artorias74

Kilopat

364485

Hectopat

4Justicia

Hectopat

Artorias74

Kilopat

ArdaFRKN

Hectopat

CanbeyT

Centipat

4Justicia

Hectopat

ArdaFRKN

Hectopat

Arda_Animations

Hectopat

Artorias74

Kilopat

Benzer konular

Yeni konular

Yeni mesajlar

Gizliliğinize önem veriyoruz