HijackThis. Performans + Güvenlik! (Virüslerden kurtulun). 500.000+ (441. sayfa)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =http://go.microsoft.com/fwlink/?LinkId=69157 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\pchealth\helpctr\System\panels\blank.htm 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =  
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =http://dt-updates.com/activate?query=suepdxstkEueTWdkMMgUApgTj8J5wc9dIdYJdp3YgP2olZ5yvPKGA4%2fglpvcmHU1%2bSVOMGhwm29Jt9GB4xCArY%2b8jbyNX8NjKD9XgzKH%2fzonNSIVCX5MLWeUHifD8XRvArsrFNw3TKTKvnXjHFlz5oCxz5bgVWZ0hopit4bqX8QcL0acpq%2b1hfK4bjs%2fyu9XvvQ8y5OvDLzHVeBL3rtHGoeOEJAVqL9x1UN2w0K16fruGzq6JWelTMteXHs9xmGdNG6GsKXArzFWlqZ8Z9q3ROV%2fHw3IF3jZ3CIDimI6Vew%3d 
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = PERFECT XP SP3 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" 
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
  O4 - HKCU\..\Run: [PopRock] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c.exe 
  

ComboFix 09-10-18.06 - Administrator 19.10.2009 22:21.2.1 - NTFSx86 
  Microsoft Windows XP Professional  5.1.2600.3.1254.90.1055.18.2047.1594 [GMT 3:00] 
  Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe 
   * Resident AV is active 
   
   
  WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! 
  . 
   
  (((((((((((((((((((((((((   Files Created from 2009-09-19 to 2009-10-19  ))))))))))))))))))))))))))))))) 
  . 
   
  2009-10-19 16:32 . 2009-10-19 16:33	--------	d-----w-	c:\documents and settings\Administrator\Local Settings\Application Data\Risen 
  2009-10-19 16:28 . 2009-10-19 16:28	--------	d-----w-	c:\windows\system32\wbem\snmp 
  2009-10-19 16:28 . 2009-10-19 16:28	--------	d-----w-	c:\windows\system32\xircom 
  2009-10-19 16:28 . 2009-10-19 16:28	--------	d-----w-	c:\program files\microsoft frontpage 
  2009-10-19 13:40 . 2009-10-19 13:40	--------	d-----w-	c:\program files\3B Software 
  2009-10-19 13:39 . 2009-10-19 13:43	--------	d---a-w-	c:\documents and settings\All Users\Application Data\TEMP 
  2009-10-19 13:39 . 2009-10-19 13:39	--------	d-----w-	c:\documents and settings\Administrator\Local Settings\Application Data\Thinstall 
  2009-10-19 13:39 . 2009-10-19 13:39	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Thinstall 
  2009-10-19 13:39 . 2009-10-19 13:43	--------	d-----w-	c:\program files\Free Registry Fix 
  2009-10-18 18:21 . 2009-10-18 18:21	--------	d-----w-	c:\documents and settings\LocalService\Local Settings\Application Data\ESET 
  2009-10-18 16:57 . 2009-10-18 16:57	--------	d-----w-	c:\documents and settings\Administrator\Local Settings\Application Data\ESET 
  2009-10-18 16:49 . 2009-10-18 16:49	--------	d-----w-	c:\program files\Trend Micro 
  2009-10-18 10:04 . 2009-10-18 10:05	--------	d-----w-	C:\MenajerMedia 
  2009-10-17 18:47 . 2009-10-17 18:47	--------	d-----w-	c:\windows\Sun 
  2009-10-17 15:20 . 2009-10-17 15:20	--------	d-----w-	c:\program files\Alcohol Soft 
  2009-10-17 14:09 . 2009-10-17 14:09	--------	d-----w-	c:\windows\1C4551A64743409391E41477CD655043.TMP 
  2009-10-17 14:08 . 2008-10-10 01:52	452440	----a-w-	c:\windows\system32\d3dx10_40.dll 
  2009-10-17 14:08 . 2008-10-10 01:52	4379984	----a-w-	c:\windows\system32\D3DX9_40.dll 
  2009-10-17 14:08 . 2008-10-10 01:52	2036576	----a-w-	c:\windows\system32\D3DCompiler_40.dll 
  2009-10-17 14:08 . 2008-10-27 07:04	514384	----a-w-	c:\windows\system32\XAudio2_3.dll 
  2009-10-17 14:08 . 2008-10-27 07:04	235856	----a-w-	c:\windows\system32\xactengine3_3.dll 
  2009-10-17 14:08 . 2008-10-27 07:04	23376	----a-w-	c:\windows\system32\X3DAudio1_5.dll 
  2009-10-17 14:08 . 2008-10-27 07:04	70992	----a-w-	c:\windows\system32\XAPOFX1_2.dll 
  2009-10-17 14:08 . 2008-07-30 03:20	68616	----a-w-	c:\windows\system32\XAPOFX1_1.dll 
  2009-10-17 14:06 . 2009-10-17 14:06	--------	d-----w-	c:\program files\Deep Silver 
  2009-10-17 13:57 . 2009-10-17 13:57	--------	d-----w-	c:\program files\PowerISO 
  2009-10-17 13:26 . 2008-07-30 03:20	509448	----a-w-	c:\windows\system32\XAudio2_2.dll 
  2009-10-17 13:26 . 2008-07-30 03:20	238088	----a-w-	c:\windows\system32\xactengine3_2.dll 
  2009-10-17 13:26 . 2008-07-10 08:01	467984	----a-w-	c:\windows\system32\d3dx10_39.dll 
  2009-10-17 13:26 . 2008-07-10 08:00	1493528	----a-w-	c:\windows\system32\D3DCompiler_39.dll 
  2009-10-17 13:26 . 2008-07-10 08:00	3851784	----a-w-	c:\windows\system32\D3DX9_39.dll 
  2009-10-17 13:26 . 2008-05-30 11:19	507400	----a-w-	c:\windows\system32\XAudio2_1.dll 
  2009-10-17 13:26 . 2008-05-30 11:17	65032	----a-w-	c:\windows\system32\XAPOFX1_0.dll 
  2009-10-17 13:26 . 2008-05-30 11:18	238088	----a-w-	c:\windows\system32\xactengine3_1.dll 
  2009-10-17 13:26 . 2008-05-30 11:17	25608	----a-w-	c:\windows\system32\X3DAudio1_4.dll 
  2009-10-17 13:26 . 2008-05-30 11:11	467984	----a-w-	c:\windows\system32\d3dx10_38.dll 
  2009-10-17 13:26 . 2008-05-30 11:11	1491992	----a-w-	c:\windows\system32\D3DCompiler_38.dll 
  2009-10-17 13:26 . 2008-05-30 11:11	3850760	----a-w-	c:\windows\system32\D3DX9_38.dll 
  2009-10-17 13:23 . 2009-10-17 13:32	--------	d-----w-	c:\program files\MagicDisc 
  2009-10-17 13:20 . 2009-10-17 13:20	--------	d-----w-	c:\windows\Logs 
  2009-10-16 20:30 . 2009-10-16 20:30	--------	d-----w-	c:\documents and settings\Administrator\Application Data\vlc 
  2009-10-16 19:11 . 2009-10-16 19:11	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Nero 
  2009-10-15 16:21 . 2009-10-18 17:05	138352	----a-w-	c:\windows\system32\drivers\PnkBstrK.sys 
  2009-10-15 16:21 . 2009-10-18 17:05	191304	----a-w-	c:\windows\system32\PnkBstrB.exe 
  2009-10-15 16:21 . 2009-10-15 16:21	--------	d-----w-	c:\windows\system32\LogFiles 
  2009-10-15 16:21 . 2009-10-15 16:21	75064	----a-w-	c:\windows\system32\PnkBstrA.exe 
  2009-10-15 16:21 . 2009-10-15 16:21	--------	d-----w-	c:\documents and settings\Administrator\Local Settings\Application Data\PunkBuster 
  2009-10-15 16:02 . 2009-10-15 16:02	--------	d-----w-	c:\documents and settings\All Users\Application Data\Messenger Plus! 
  2009-10-15 15:10 . 2009-10-15 15:10	60416	----a-w-	c:\windows\ALCFDRTM.EXE 
  2009-10-15 15:10 . 2009-10-15 15:10	--------	d-----w-	c:\windows\system32\Lang 
  2009-10-15 15:10 . 2009-10-15 15:10	--------	d-----w-	c:\documents and settings\Administrator\Application Data\GRETECH 
  2009-10-15 15:10 . 2009-10-15 15:10	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Media Player Classic 
  2009-10-15 14:08 . 2009-10-18 13:11	--------	d-----w-	c:\documents and settings\Administrator\Contacts 
  2009-10-15 14:03 . 2009-10-15 14:03	--------	d-----w-	c:\program files\DAEMON Tools Lite 
  2009-10-15 14:00 . 2009-10-15 14:02	--------	d-----w-	c:\program files\DAEMON Tools Pro 
  2009-10-15 14:00 . 2009-10-15 14:00	--------	d-----w-	c:\documents and settings\All Users\Application Data\DAEMON Tools Pro 
   
  . 
  ((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  2009-10-19 16:22 . 2009-10-15 13:02	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Xfire 
  2009-10-17 14:09 . 2009-10-15 12:07	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard 
  2009-10-17 13:17 . 2009-10-15 11:21	--------	d--h--w-	c:\program files\InstallShield Installation Information 
  2009-10-17 04:35 . 2009-10-15 10:59	--------	d-----w-	c:\program files\FlashGet 
  2009-10-15 13:59 . 2009-10-15 11:39	722416	----a-w-	c:\windows\system32\drivers\sptd.sys 
  2009-10-15 13:59 . 2009-10-15 13:59	--------	d-----w-	c:\documents and settings\Administrator\Application Data\DAEMON Tools Pro 
  2009-10-15 13:20 . 2009-10-15 13:20	281760	----a-w-	c:\windows\system32\drivers\atksgt.sys 
  2009-10-15 13:20 . 2009-10-15 13:20	25888	----a-w-	c:\windows\system32\drivers\lirsgt.sys 
  2009-10-15 13:02 . 2009-10-15 13:02	--------	d-----w-	c:\documents and settings\NetworkService\Application Data\Xfire 
  2009-10-15 12:07 . 2009-10-15 12:07	--------	d-----w-	c:\program files\AGEIA Technologies 
  2009-10-15 12:06 . 2009-10-15 11:09	--------	d-----w-	c:\program files\Java 
  2009-10-15 11:57 . 2009-10-15 11:57	0	----a-w-	c:\windows\nsreg.dat 
  2009-10-15 11:56 . 2009-10-15 11:56	--------	d-----w-	c:\documents and settings\Administrator\Application Data\IObit 
  2009-10-15 11:55 . 2009-10-15 11:53	--------	d-----w-	c:\program files\Winamp 
  2009-10-15 11:52 . 2009-10-15 11:52	--------	d-----w-	c:\program files\GRETECH 
  2009-10-15 11:51 . 2009-10-15 11:51	--------	d-----w-	c:\program files\VideoLAN 
  2009-10-15 11:50 . 2009-10-15 11:50	--------	d-----w-	c:\program files\MSECache 
  2009-10-15 11:47 . 2001-11-22 19:00	81506	----a-w-	c:\windows\system32\perfc01F.dat 
  2009-10-15 11:47 . 2001-11-22 19:00	428200	----a-w-	c:\windows\system32\perfh01F.dat 
  2009-10-15 11:40 . 2009-10-15 11:40	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Canneverbe_Limited 
  2009-10-15 11:39 . 2009-10-15 11:39	--------	d-----w-	c:\program files\RivaTuner v2.09 
  2009-10-15 11:39 . 2009-10-15 11:39	--------	d-----w-	c:\documents and settings\Administrator\Application Data\DAEMON Tools 
  2009-10-15 11:38 . 2009-10-15 11:38	--------	d-----w-	c:\program files\Realtek Sound Manager 
  2009-10-15 11:38 . 2009-10-15 11:38	--------	d-----w-	c:\program files\AvRack 
  2009-10-15 11:38 . 2009-10-15 11:38	--------	d-----w-	c:\program files\AMD 
  2009-10-15 11:29 . 2009-10-15 11:29	--------	d-----w-	c:\documents and settings\All Users\Application Data\ATI 
  2009-10-15 11:29 . 2009-10-15 11:29	--------	d-----w-	c:\documents and settings\Administrator\Application Data\ATI 
  2009-10-15 11:28 . 2009-10-15 11:28	0	----a-w-	c:\windows\ativpsrm.bin 
  2009-10-15 11:26 . 2009-10-15 11:21	--------	d-----w-	c:\program files\ATI Technologies 
  2009-10-15 11:25 . 2009-10-15 11:20	--------	d-----w-	c:\program files\Common Files\InstallShield 
  2009-10-15 11:24 . 2009-10-15 11:24	--------	d-----w-	c:\program files\Common Files\ATI Technologies 
  2009-10-15 11:10 . 2009-10-15 11:10	--------	d-----w-	c:\program files\ESET 
  2009-10-15 11:10 . 2009-10-15 11:10	--------	d-----w-	c:\documents and settings\All Users\Application Data\ESET 
  2009-10-15 11:10 . 2009-10-15 11:17	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Winamp 
  2009-10-15 11:10 . 2009-10-15 11:10	--------	d-----w-	c:\program files\Haberler 
  2009-10-15 11:10 . 2009-10-15 11:10	--------	d-----w-	c:\program files\Oyunlar 
  2009-10-15 11:10 . 2009-10-15 11:10	--------	d-----w-	c:\program files\AudioShell 
  2009-10-15 11:09 . 2009-10-15 11:09	--------	d-----w-	c:\program files\K-Lite Codec Pack 
  2009-10-15 11:09 . 2009-10-15 11:09	--------	d-----w-	c:\program files\Common Files\Java 
  2009-10-15 11:09 . 2009-10-15 11:09	--------	d-----w-	c:\program files\Messenger Plus! Live 
  2009-10-15 11:09 . 2009-10-15 11:17	35800	----a-w-	c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 
  2009-10-15 11:08 . 2009-10-15 11:08	--------	d-----w-	c:\program files\Windows Live 
  2009-10-15 11:08 . 2009-10-15 11:08	--------	d-----w-	c:\program files\Restoration 
  2009-10-15 11:08 . 2009-10-15 11:08	--------	d-----w-	c:\program files\CCleaner 
  2009-10-15 11:07 . 2009-10-15 11:07	2272	----a-w-	c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 
  2009-10-15 11:07 . 2009-10-15 11:07	--------	d-----w-	c:\program files\MSBuild 
  2009-10-15 11:07 . 2009-10-15 11:07	--------	d-----w-	c:\program files\Reference Assemblies 
  2009-10-15 11:04 . 2009-10-15 11:04	--------	d-----w-	c:\program files\Microsoft Works 
  2009-10-15 11:00 . 2009-10-15 11:00	21736	----a-w-	c:\windows\system32\emptyregdb.dat 
  2009-10-15 10:59 . 2009-10-15 10:59	--------	d-----w-	c:\program files\Microsoft Silverlight 
  2009-10-15 10:59 . 2009-10-15 10:59	--------	d-----w-	c:\program files\Common Files\Nero 
  2009-10-15 10:59 . 2009-10-15 10:59	--------	d-----w-	c:\program files\Nero 
  2009-10-15 10:59 . 2009-10-15 10:59	--------	d-----w-	c:\program files\Araçlar 
  2009-10-15 10:58 . 2009-10-15 10:58	--------	d-----w-	c:\program files\Paint.NET 
  2009-10-15 10:58 . 2009-10-15 10:57	--------	d-----w-	c:\program files\Reader 
  2009-10-15 10:57 . 2009-10-15 10:57	--------	d-----w-	c:\program files\Windows Media Connect 2 
  2009-07-25 02:23 . 2009-10-15 11:49	411368	----a-w-	c:\windows\system32\deploytk.dll 
  . 
   
  ------- Sigcheck ------- 
   
  [7] 2008-04-14 . 4A06B20542848FF905E6490159C9B07A . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll 
  [-] 2008-04-14 . 2B4A3B1490A8ED0778A5129BED6F8A57 . 691200 . . [5.82] . . c:\windows\system32\comctl32.dll 
  [7] 2001-11-22 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll 
   
  [-] 2008-05-21 . 030DC4D48CC2B894FEE2F390D8E66AD5 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys 
   
  [-] 2008-04-14 . D62561EA168804A1A3D1FBBC19F9360F . 583680 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll 
   
  [-] 2008-03-01 . F1476C665DEA8150DA77F50935C4D6EC . 871936 . . [7.00.6000.20772] . . c:\windows\system32\wininet.dll 
   
  [-] 2007-07-30 . 5BCAD5C7BB5C7604CD30FFA2CCBFEF9B . 76120 . . [7.0.6000.381] . . c:\windows\system32\wuauclt.exe 
   
  [-] 2008-04-14 . 9307842157D3F44A421F407FA9EA446F . 1508352 . . [6.00.2900.5512] . . c:\windows\explorer.exe 
   
   
  [-] 2008-04-14 . 3FC7CC8501E0DEE1563D31A72D77D967 . 17408 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe 
   
  c:\windows\system32\wscntfy.exe ... is missing !! 
  . 
  (((((((((((((((((((((((((((((   SnapShot@2009-10-19_15.54.50   ))))))))))))))))))))))))))))))))))))))))) 
  . 
  + 2009-10-15 13:50 . 2009-10-19 16:28	179448              c:\windows\system32\FNTCACHE.DAT 
  . 
  (((((((((((((((((((((((((((((((((((((   Reg Loading Points   )))))))))))))))))))))))))))))))))))))))))))))))))) 
  . 
  . 
  *Note* empty entries & legit default entries are not shown  
  REGEDIT4 
   
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
  "VistaDrive"="c:\windows\VistaDrive\VistaDrive.exe" [2006-10-05 280779] 
  "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-04-23 1438976] 
  "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] 
  "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-06-18 67584] 
   
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] 
  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 17408] 
   
  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] 
  "nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-03-01 124928] 
   
  c:\documents and settings\Administrator\Start Menu\Programlar\BaŸlang‡\ 
  Scheduler.lnk - c:\program files\3B Software\Common\Scheduler\wcomschd.exe [2009-10-19 464240] 
   
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] 
  "NoSMConfigurePrograms"= 1 (0x1) 
  "NoSMMyPictures"= 1 (0x1) 
   
  [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] 
  "NoSMConfigurePrograms"= 1 (0x1) 
  "NoSMMyPictures"= 1 (0x1) 
   
  [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programlar^Başlangıç^Registry Repair Pro.lnk] 
  path=c:\documents and settings\Administrator\Start Menu\Programlar\Başlangıç\Registry Repair Pro.lnk 
  backup=c:\windows\pss\Registry Repair Pro.lnkStartup 
   
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] 
  "EnableFirewall"= 0 (0x0) 
   
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] 
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"= 
  "%windir%\\system32\\sessmgr.exe"= 
  "c:\\Program Files\\FlashGet\\flashget.exe"= 
  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= 
  "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= 
  "c:\\NVIDIA\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"= 
  "c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"= 
  "c:\\Program Files\\Java\\jre6\\bin\\java.exe"= 
  "d:\\x-Fire\\Xfire\\xfire.exe"= 
  "e:\\Call of Duty 2\\CoD2MP_s.exe"= 
   
  R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [23.04.2008 15:00 33800] 
  R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [01.05.2008 01:09 472320] 
  . 
  . 
  ------- Supplementary Scan ------- 
  . 
  IE: &FlashGet ile indir - c:\program files\FlashGet\jc_link.htm 
  IE: &Tümünü FlashGet ile indir - c:\program files\FlashGet\jc_all.htm 
  IE: Microsoft Excel'e Gö&nder - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 
  TCP: {425E52E0-BBB5-428C-ACD2-46F0FE0E1648} = 4.2.2.2,4.2.2.4 
  FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\3kiq0p9u.default\ 
  FF - prefs.js: browser.startup.homepage - www.google.com 
  . 
   
  ************************************************************************** 
   
  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,http://www.gmer.net 
  Rootkit scan 2009-10-19 22:24 
  Windows 5.1.2600 Service Pack 3 NTFS 
   
  scanning hidden processes ...   
   
  scanning hidden autostart entries ...  
   
  scanning hidden files ...   
   
  scan completed successfully 
  hidden files: 0 
   
  ************************************************************************** 
  . 
  --------------------- DLLs Loaded Under Running Processes --------------------- 
   
  - - - - - - - > 'winlogon.exe'(704) 
  c:\windows\system32\Ati2evxx.dll 
  c:\windows\system32\cscui.dll 
  c:\windows\system32\COMRes.dll 
   
  - - - - - - - > 'explorer.exe'(2852) 
  c:\windows\system32\COMRes.dll 
  c:\windows\System32\cscui.dll 
  c:\windows\system32\msi.dll 
  c:\windows\system32\SETUPAPI.dll 
  c:\windows\system32\wpdshserviceobj.dll 
  c:\windows\system32\portabledevicetypes.dll 
  c:\windows\system32\portabledeviceapi.dll 
  c:\windows\system32\credui.dll 
  . 
  Completion time: 2009-10-19 22:25 
  ComboFix-quarantined-files.txt  2009-10-19 19:25 
  ComboFix2.txt  2009-10-19 15:55 
   
  Pre-Run: 17.825.251.328 bayt boş 
  Post-Run: 17.798.746.112 bayt boş 
   
  - - End Of File - - DAE51313D4BACA15CFD4A0A974D26E8F

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll 
  O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll 
  O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll 
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll 
  O2 - BHO: Windows Live Toolbar Beta - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll 
  O3 - Toolbar: &Windows Live Toolbar Beta - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll  
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 

Logfile of Trend Micro HijackThis v2.0.2 
  Scan saved at 17:36:12, on 21.10.2009 
  Platform: Windows XP SP3 (WinNT 5.01.2600) 
  MSIE: Internet Explorer v8.00 (8.00.6001.18702) 
  Boot mode: Normal 
   
  Running processes: 
  C:\WINDOWS\System32\smss.exe 
  C:\WINDOWS\system32\winlogon.exe 
  C:\WINDOWS\system32\services.exe 
  C:\WINDOWS\system32\lsass.exe 
  C:\WINDOWS\system32\svchost.exe 
  C:\Program Files\Microsoft Security Essentials\MsMpEng.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\WINDOWS\system32\ZoneLabs\vsmon.exe 
  C:\WINDOWS\Explorer.EXE 
  C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe 
  C:\WINDOWS\system32\spoolsv.exe 
  C:\Program Files\CheckPoint\ZAForceField\ForceField.exe 
  C:\Program Files\Java\jre6\bin\jqs.exe 
  C:\WINDOWS\system32\nvsvc32.exe 
  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 
  C:\WINDOWS\System32\svchost.exe 
  C:\WINDOWS\System32\wbem\wmiapsrv.exe 
  C:\WINDOWS\SOUNDMAN.EXE 
  C:\WINDOWS\system32\rundll32.exe 
  C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe 
  C:\Program Files\A4Tech\Mouse\Amoumain.exe 
  C:\WINDOWS\system32\RUNDLL32.EXE 
  C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe 
  C:\Program Files\Microsoft Security Essentials\msseces.exe 
  C:\Program Files\Microsoft ActiveSync\wcescomm.exe 
  C:\PROGRA~1\MICROS~4\rapimgr.exe 
  C:\Program Files\AirTies\ADSL Hizmet Programı\AirTies_util3.exe 
  C:\Program Files\Mozilla Firefox\firefox.exe 
  C:\Program Files\Trend Micro\HijackThis\HijackThis.exe 
   
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://tr.msn.com/ 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =http://go.microsoft.com/fwlink/?LinkId=69157 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://go.microsoft.com/fwlink/?LinkId=54896 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =http://go.microsoft.com/fwlink/?LinkId=54896 
  O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll 
  O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll 
  O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll 
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE 
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup 
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install 
  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent 
  O4 - HKLM\..\Run: [USIUDF_Eject_Monitor] C:\Program Files\Common Files\Ulead Systems\DVD\USISrv.exe 
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe 
  O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe 
  O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe 
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit 
  O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" 
  O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden" 
  O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript 
  O4 - HKLM\..\Run: [MSSE] "C:\Program Files\Microsoft Security Essentials\msseces.exe" -hide 
  O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" 
  O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') 
  O4 - Global Startup: AirTies ADSL Hizmet Programı.lnk = ? 
  O8 - Extra context menu item: &FlashGet ile indir - C:\Program Files\FlashGet\jc_link.htm 
  O8 - Extra context menu item: &Tümünü FlashGet ile indir - C:\Program Files\FlashGet\jc_all.htm 
  O8 - Extra context menu item: Microsoft Excel'e Gö&nder - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 
  O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm 
  O9 - Extra button: Bunu Bloga Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll 
  O9 - Extra 'Tools' menuitem: Windows Live Writer içinde &Bunu Web Günlüğüne Al - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll 
  O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll 
  O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll 
  O9 - Extra 'Tools' menuitem: Mobil Sık Kullanılanı Oluştur... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll 
  O9 - Extra button: Rip YouTube File - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\DrmRemoval\YouTubeRipper.dll 
  O9 - Extra 'Tools' menuitem: Rip YouTube file embedded in this page - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\DrmRemoval\YouTubeRipper.dll 
  O9 - Extra button: Araştır - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL 
  O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe 
  O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe 
  O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm 
  O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm 
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe 
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1237894515531 
  O17 - HKLM\System\CCS\Services\Tcpip\..\{CD496969-9A2F-40C6-AA46-D95F7BE2A71D}: NameServer = 208.67.222.222,208.67.220.220 
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL 
  O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\@\LOCALS~1\Temp\hpdj.exe (file missing) 
  O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe 
  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe 
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe 
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe 
  O23 - Service: SMServer - SMServer - C:\WINDOWS\system32\snmvtsvc.exe 
  O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe 
   
  -- 
  End of file - 7532 bytes 
  

 
  Malwarebytes' Anti-Malware 1.41 
  Veritabanı sürümü: 2775 
  Windows 5.1.2600 Service Pack 3 
   
  21.10.2009 19:13:31 
  mbam-log-2009-10-21 (19-13-31).txt 
   
  Tarama biçimi: Gelişmiş Tarama (C:\|D:\|E:\|) 
  Taranan öğeler: 200893 
  Geçen süre: 49 minute(s), 8 second(s) 
   
  Etkilenmiş Hafıza İşlemleri: 0 
  Etkilenmiş Hafıza Modülleri: 0 
  Etkilenmiş Kayıt Anahtarları: 0 
  Etkilenmiş Kayıt Değerleri: 0 
  Etkilenmiş Kayıt Verisi Öğeleri: 0 
  Etkilenmiş Klasörler: 0 
  Etkilenmiş Dosyalar: 2 
   
  Etkilenmiş Hafıza İşlemleri: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Hafıza Modülleri: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Kayıt Anahtarları: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Kayıt Değerleri: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Kayıt Verisi Öğeleri: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Klasörler: 
  (Herhangi bir tehlikeli öğe bulunmadı) 
   
  Etkilenmiş Dosyalar: 
  D:\System Volume Information\_restore{1D4C737A-AAF4-4838-A0BB-45C77184D8DC}\RP4\A0000697.exe (Trojan.Dropper) -> Quarantined and deleted successfully. 
  E:\System Volume Information\_restore{1D4C737A-AAF4-4838-A0BB-45C77184D8DC}\RP4\A0000700.dll (Malware.Packer) -> Quarantined and deleted successfully. 
  

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =http://search.live.com 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =http://www.daemon-search.com/startpage 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =http://toolbar.ask.com/toolbarv/askRedirect?o=101668&gct=&gc=1&q= 
  R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL =http://toolbar.ask.com/toolbarv/askRedirect?o=101668&gct=&gc=1&q= 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =http://search.live.com/sphome.aspx 
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =http://toolbar.ask.com/toolbarv/askRedirect?o=101668&gct=&gc=1&q=%s 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Bağlantılar 
  R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll 
  R3 - URLSearchHook: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll 
  R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL 
  F2 - REG:system.ini: Shell=explorer.exe "C:\Documents and Settings\Deniz\Application Data\svchost.exe"  
  O2 - BHO: (no name) - {00A6FAF1-072E-44cf-8957-5838F569A31D} - (no file) 
  O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL 
  O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll  
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)  
  O2 - BHO: Windows Live Oturum Açma Yardım Aracı - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll 
  O2 - BHO: DepositFiles.com BHO - {9DFE2FE9-CF99-4ADF-A28E-9B5ADB8DC74F} - C:\DEPOSI~1\DEPOSI~1\DEPOSI~1.DLL  
  O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\****\Mega Manager\MegaIEMn.dll 
  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll 
  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll 
  O2 - BHO: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll 
  O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll 
  O3 - Toolbar: BS Player Toolbar - {fed66dc5-1b74-4a04-8f5c-15c5ace2b9a5} - C:\Program Files\BS_Player\tbBS_P.dll 
  O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL 
  O3 - Toolbar: Deposit IE Toolbar - {6AA40521-14E7-4B1D-B1B4-98528C1388C9} - C:\DEPOSI~1\DEPOSI~1\DEPOSI~1.DLL 
  O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll  
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" 
  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k 
  O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\M3PLUGIN.DLL,UPF 
  O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\2.bin\MWSBAR.DLL,S 
  O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe  
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe 
  O4 - HKLM\..\Run: [VMSnap3] C:\WINDOWS\VMSnap3.EXE 
  O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.EXE 
  O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe  
  O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe 
  O4 - HKCU\..\Run: [svchost] "C:\Documents and Settings\Deniz\Application Data\svchost.exe"  
  O4 - HKCU\..\Run: [DF Manager] C:\DepositFiles\Depositfiles Filemanager with FTP\dfmanager.exe -minimize  
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') 
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') 
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') 
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')  
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe