Prosim o kontrolu diky

[AlastoR]

Doufam že to bude už OK :))

[Reklama]

[sakiri]

to je ten log který jsem chtěl.

Tyto soubory nech zkontrolovat na Virustotalu:
C:\WINDOWS\eSellerateEngine.dll
C:\WINDOWS\qtsrig.exe
C:\WINDOWS\ric.exe
C:\WINDOWS\system32\wdmioctl.dll
C:\WINDOWS\system32\DSndUp.exe
C:\WINDOWS\system32\CleanUp.exe
C:\WINDOWS\system32\AA25530C47.sys

Pro lepší nalezení si zapni - Zobrazovat skryté a systémové soubory.
Poté sem zkopíruj výsledky.

Vím že toho je hodně ale proscanuj to.

Pak uvidíme co s něma.

[AlastoR]

Complete scanning result of "eSellerateEngine.dll", received in VirusTotal at 04.26.2007, 18:53:44 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.4.26.0 04.26.2007 no virus found
AntiVir 7.4.0.15 04.26.2007 no virus found
Authentium 4.93.8 04.26.2007 no virus found
Avast 4.7.981.0 04.26.2007 no virus found
AVG 7.5.0.464 04.26.2007 no virus found
BitDefender 7.2 04.26.2007 no virus found
CAT-QuickHeal 9.00 04.26.2007 no virus found
ClamAV devel-20070416 04.26.2007 no virus found
DrWeb 4.33 04.26.2007 no virus found
eSafe 7.0.15.0 04.25.2007 no virus found
eTrust-Vet 30.7.3597 04.26.2007 no virus found
Ewido 4.0 04.26.2007 no virus found
FileAdvisor 1 04.26.2007 No threat detected
Fortinet 2.85.0.0 04.26.2007 no virus found
F-Prot 4.3.2.48 04.25.2007 no virus found
F-Secure 6.70.13030.0 04.26.2007 no virus found
Ikarus T3.1.1.5 04.26.2007 no virus found
Kaspersky 4.0.2.24 04.26.2007 no virus found
McAfee 5018 04.26.2007 no virus found
Microsoft 1.2405 04.26.2007 no virus found
NOD32v2 2221 04.26.2007 no virus found
Norman 5.80.02 04.26.2007 no virus found
Panda 9.0.0.4 04.26.2007 no virus found
Prevx1 V2 04.26.2007 no virus found
Sophos 4.16.0 04.23.2007 no virus found
Sunbelt 2.2.907.0 04.19.2007 no virus found
Symantec 10 04.26.2007 no virus found
TheHacker 6.1.6.088 04.09.2007 no virus found
VBA32 3.11.4 04.26.2007 no virus found
VirusBuster 4.3.7:9 04.26.2007 no virus found
Webwasher-Gateway 6.0.1 04.26.2007 no virus found

Aditional Information
File size: 356352 bytes
MD5: 02127fdd91fda05fa8b201a4171cc0e2
SHA1: fd40535aea9f86bf22cfeba2a55a6191b72de496
Bit9 info: http://fileadvisor.bit9.com/services/ex ... a4171cc0e2

[AlastoR]

Complete scanning result of "AA25530C47.sys", received in VirusTotal at 04.26.2007, 19:09:54 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.4.26.0 04.26.2007 no virus found
AntiVir 7.4.0.15 04.26.2007 no virus found
Authentium 4.93.8 04.26.2007 no virus found
Avast 4.7.981.0 04.26.2007 no virus found
AVG 7.5.0.464 04.26.2007 no virus found
BitDefender 7.2 04.26.2007 no virus found
CAT-QuickHeal 9.00 04.26.2007 no virus found
ClamAV devel-20070416 04.26.2007 no virus found
DrWeb 4.33 04.26.2007 no virus found
eSafe 7.0.15.0 04.25.2007 no virus found
eTrust-Vet 30.7.3597 04.26.2007 no virus found
Ewido 4.0 04.26.2007 no virus found
FileAdvisor 1 04.26.2007 no virus found
Fortinet 2.85.0.0 04.26.2007 no virus found
F-Prot 4.3.2.48 04.25.2007 no virus found
F-Secure 6.70.13030.0 04.26.2007 no virus found
Ikarus T3.1.1.5 04.26.2007 no virus found
Kaspersky 4.0.2.24 04.26.2007 no virus found
McAfee 5018 04.26.2007 no virus found
Microsoft 1.2405 04.26.2007 no virus found
NOD32v2 2221 04.26.2007 no virus found
Norman 5.80.02 04.26.2007 no virus found
Panda 9.0.0.4 04.26.2007 no virus found
Prevx1 V2 04.26.2007 no virus found
Sophos 4.16.0 04.23.2007 no virus found
Sunbelt 2.2.907.0 04.19.2007 no virus found
Symantec 10 04.26.2007 no virus found
TheHacker 6.1.6.095 04.15.2007 no virus found
VBA32 3.11.4 04.26.2007 no virus found
VirusBuster 4.3.7:9 04.26.2007 no virus found
Webwasher-Gateway 6.0.1 04.26.2007 no virus found

Aditional Information
File size: 56 bytes
MD5: aac069817aa37938d838484aa3b36225
SHA1: 2a98f0adaed21a8c7c8924a0661946adf2

[AlastoR]

Complete scanning result of "wdmioctl.dll", received in VirusTotal at 04.26.2007, 19:06:13 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.4.26.0 04.26.2007 no virus found
AntiVir 7.4.0.15 04.26.2007 no virus found
Authentium 4.93.8 04.26.2007 no virus found
Avast 4.7.981.0 04.26.2007 no virus found
AVG 7.5.0.464 04.26.2007 no virus found
BitDefender 7.2 04.26.2007 no virus found
CAT-QuickHeal 9.00 04.26.2007 no virus found
ClamAV devel-20070416 04.26.2007 no virus found
DrWeb 4.33 04.26.2007 no virus found
eSafe 7.0.15.0 04.25.2007 no virus found
eTrust-Vet 30.7.3597 04.26.2007 no virus found
Ewido 4.0 04.26.2007 no virus found
FileAdvisor 1 04.26.2007 No threat detected
Fortinet 2.85.0.0 04.26.2007 no virus found
F-Prot 4.3.2.48 04.25.2007 no virus found
F-Secure 6.70.13030.0 04.26.2007 no virus found
Ikarus T3.1.1.5 04.26.2007 no virus found
Kaspersky 4.0.2.24 04.26.2007 no virus found
McAfee 5018 04.26.2007 no virus found
Microsoft 1.2405 04.26.2007 no virus found
NOD32v2 2221 04.26.2007 no virus found
Norman 5.80.02 04.26.2007 no virus found
Panda 9.0.0.4 04.26.2007 no virus found
Prevx1 V2 04.26.2007 no virus found
Sophos 4.16.0 04.23.2007 no virus found
Sunbelt 2.2.907.0 04.19.2007 no virus found
Symantec 10 04.26.2007 no virus found
TheHacker 6.1.6.088 04.09.2007 no virus found
VBA32 3.11.4 04.26.2007 no virus found
VirusBuster 4.3.7:9 04.26.2007 no virus found
Webwasher-Gateway 6.0.1 04.26.2007 no virus found

Aditional Information
File size: 53248 bytes
MD5: ec9b293ada32cf769d759bfdddd57cbd
SHA1: cffa73cdbb3dd418a6edf1735a7387237f3acc47
Bit9 info: http://fileadvisor.bit9.com/services/ex ... fdddd57cbd

[AlastoR]

Complete scanning result of "DSndUp.exe", received in VirusTotal at 04.26.2007, 19:07:13 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.4.26.0 04.26.2007 no virus found
AntiVir 7.4.0.15 04.26.2007 no virus found
Authentium 4.93.8 04.26.2007 no virus found
Avast 4.7.981.0 04.26.2007 no virus found
AVG 7.5.0.464 04.26.2007 no virus found
BitDefender 7.2 04.26.2007 no virus found
CAT-QuickHeal 9.00 04.26.2007 no virus found
ClamAV devel-20070416 04.26.2007 no virus found
DrWeb 4.33 04.26.2007 no virus found
eSafe 7.0.15.0 04.25.2007 no virus found
eTrust-Vet 30.7.3597 04.26.2007 no virus found
Ewido 4.0 04.26.2007 no virus found
FileAdvisor 1 04.26.2007 No threat detected
Fortinet 2.85.0.0 04.26.2007 no virus found
F-Prot 4.3.2.48 04.25.2007 no virus found
F-Secure 6.70.13030.0 04.26.2007 no virus found
Ikarus T3.1.1.5 04.26.2007 no virus found
Kaspersky 4.0.2.24 04.26.2007 no virus found
McAfee 5018 04.26.2007 no virus found
Microsoft 1.2405 04.26.2007 no virus found
NOD32v2 2221 04.26.2007 no virus found
Norman 5.80.02 04.26.2007 no virus found
Panda 9.0.0.4 04.26.2007 no virus found
Prevx1 V2 04.26.2007 no virus found
Sophos 4.16.0 04.23.2007 no virus found
Sunbelt 2.2.907.0 04.19.2007 no virus found
Symantec 10 04.26.2007 no virus found
TheHacker 6.1.6.088 04.09.2007 no virus found
VBA32 3.11.4 04.26.2007 no virus found
VirusBuster 4.3.7:9 04.26.2007 no virus found
Webwasher-Gateway 6.0.1 04.26.2007 no virus found

Aditional Information
File size: 49152 bytes
MD5: 522b98cdd484ac6681fabaa848e83815
SHA1: c5c9350fd7f54781adeca7d22ee09567dc20fadd
Bit9 info: http://fileadvisor.bit9.com/services/ex ... a848e83815

[AlastoR]

Complete scanning result of "CleanUp.exe", received in VirusTotal at 04.26.2007, 19:08:54 (CET).
Antivirus Version Update Result
AhnLab-V3 2007.4.26.0 04.26.2007 no virus found
AntiVir 7.4.0.15 04.26.2007 no virus found
Authentium 4.93.8 04.26.2007 no virus found
Avast 4.7.981.0 04.26.2007 no virus found
AVG 7.5.0.464 04.26.2007 no virus found
BitDefender 7.2 04.26.2007 no virus found
CAT-QuickHeal 9.00 04.26.2007 no virus found
ClamAV devel-20070416 04.26.2007 no virus found
DrWeb 4.33 04.26.2007 no virus found
eSafe 7.0.15.0 04.25.2007 no virus found
eTrust-Vet 30.7.3597 04.26.2007 no virus found
Ewido 4.0 04.26.2007 no virus found
FileAdvisor 1 04.26.2007 No threat detected
Fortinet 2.85.0.0 04.26.2007 no virus found
F-Prot 4.3.2.48 04.25.2007 no virus found
F-Secure 6.70.13030.0 04.26.2007 no virus found
Ikarus T3.1.1.5 04.26.2007 no virus found
Kaspersky 4.0.2.24 04.26.2007 no virus found
McAfee 5018 04.26.2007 no virus found
Microsoft 1.2405 04.26.2007 no virus found
NOD32v2 2221 04.26.2007 no virus found
Norman 5.80.02 04.26.2007 no virus found
Panda 9.0.0.4 04.26.2007 no virus found
Prevx1 V2 04.26.2007 no virus found
Sophos 4.16.0 04.23.2007 no virus found
Sunbelt 2.2.907.0 04.19.2007 no virus found
Symantec 10 04.26.2007 no virus found
TheHacker 6.1.6.095 04.15.2007 no virus found
VBA32 3.11.4 04.26.2007 no virus found
VirusBuster 4.3.7:9 04.26.2007 no virus found
Webwasher-Gateway 6.0.1 04.26.2007 no virus found

Aditional Information
File size: 45056 bytes
MD5: c78a0d9e0fac64810cef67908eb0d695
SHA1: 069130e4542c787039102bbb6f894e5c1d790524
Bit9 info: http://fileadvisor.bit9.com/services/ex ... 908eb0d695

[AlastoR]

C:\WINDOWS\qtsrig.exe
C:\WINDOWS\ric.exe

nejdou scenovat

0 bytes size received / Se ha recibido un archivo vacio

to pise

[AlastoR]

Tak co dal??? uz me ten vir stve :)

[sakiri]

oki tyhle soubory jsou šmejdi na 100% i když to na virustotalu nic nenašlo:
C:\WINDOWS\qtsrig.exe
C:\WINDOWS\ric.exe

Takže si stáhni Avenger a spusť ho pod účtem administrátora.

Zaškrtni volbu - Input script manually a klikni na ikonku lupy vyskočí prázdné okno kam zkopíruj ten tučně označený text:
Files to delete:
C:\WINDOWS\qtsrig.exe
C:\WINDOWS\ric.exe

A klikni na Done.
Poté klikni na ikonku Semafory.

Vyskočí hláška kde odklikni Yes poté další hláška kde odklikni Yes.
PC se restartuje.Po restartu by ti měl "vyběhnout" log z Avengeru tak ho sem zkopíruj.

Větší problém vidím v těchto souborech:
C:\WINDOWS\system32\AA25530C47.sys - podle google ho máš jediný na světě ale ten název je hodně divný.

C:\WINDOWS\system32\DSndUp.exe - u tohodle si nejsem jistý někde ho mazali někde ne tady je to ok. Jinde šel do kytek tenhle soubor.

C:\WINDOWS\system32\CleanUp.exe - tenhle soubor vypadá na šmejda.

S těma třema souborama nic nedělej. Počkáme na vyjádření ostatních

[AlastoR]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\dtlyoklk

*******************

Script file located at: \??\C:\aghvugur.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\qtsrig.exe deleted successfully.
File C:\WINDOWS\ric.exe deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[sakiri]

ok takže nechal jsem se poradit s Fredikem a fredik s další osobou a podle nich je to v pořádku.
Takže ty soubory necháme na pokoji.

A jak ti šlape PC?