VIRY.CZ

Zdravím. HitmanPro mi našel při kontrole toto, ten soubor nejde v průzkumníkovi zobrazit:

Properties
Name DasPtct.SYS
Location C:\WINDOWS\system32\drivers
Size 38.7 KB
Time 118.7 days ago (2015-10-02 21:52:03)
Entropy 6.0
SHA-256 D5E4BCB80B8EBB68A3FB8D84E24B9D5F4BA5ADC3E43BAE0BC34778F955102A90

Scoring (48.0)
The file is hidden from Windows API. This is typical for malware.
The file is completely hidden from view and most antivirus products. It may belong to a rootkit.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
The file is a device driver. Device drivers run as trusted (highly privileged) code.

Properties
Name DC93.tmp
Location C:\Users\Admin\AppData\Local\Temp
Size 16.1 KB
Time 0.5 days ago (2016-01-29 01:48:23)
Authenticode Valid
Entropy 5.9
Product OSHI Unhooker
Publisher Aveas Limited
Description OSHI Unhooker
Version 1.3.401.1
Copyright Copyright (c) 2013 Aveas Limited. All rights reserved.
RSA Key Size 2048
Service OSHI_Unhooker
LanguageID 1033
SHA-256 3CC6A4670D64419A1F5AE835A7703CFB98E77E496E75638C372D60C132B34730

Scoring (37.0)
The file name extension of this program is not common.
The file is completely hidden from view and most antivirus products. It may belong to a rootkit.
Time indicates that the file appeared recently on this computer.
Starts automatically as a service during system bootup.
The file is a device driver. Device drivers run as trusted (highly privileged) code.
Program is code signed with a valid Authenticode certificate.

Startup
HKLM\SYSTEM\ControlSet001\Services\OSHI_Unhooker\

Ještě mi to našlo tohle, ale ten soubor měl úplně čistý sken na VirusTotal, takže by to nic nemělo být.

Zdravim,

muzete tam pustit jeste MBAR nebo TDSSKillera, ale nemyslim si, ze soubory detekovane Hitmanem jsou malware.

altrok píše:Zdravim,

muzete tam pustit jeste MBAR nebo TDSSKillera, ale nemyslim si, ze soubory detekovane Hitmanem jsou malware.

Děkuji, MBAR nic nenašel, ale proč tedy "Name DasPtct.SYS Location C:\WINDOWS\system32\drivers" nelze najít? Jak ho mám zpřístupnit?

Soubor muze mit nastavene atributy, diky kterym se Vam v defaultnim nastaveni pruzkumnika (exploreru) nezobrazi - hidden, system apod. nebo jej ma v karantene HitmanPro.


Spustte jako spravce FRST a do sirokeho bileho okenka vlozte

DasPtct.SYS

kliknete na Search Files. Sken potrva az nekolik minut.
Ve stejnem umisteni, jako mate FRST.exe/FRST64.exe, byl vytvoren soubor Search.txt jehoz obsah vlozte do pristi odpovedi.

altrok píše: Soubor muze mit nastavene atributy, diky kterym se Vam v defaultnim nastaveni pruzkumnika (exploreru) nezobrazi - hidden, system apod. nebo jej ma v karantene HitmanPro.


Spustte jako spravce FRST a do sirokeho bileho okenka vlozte

DasPtct.SYS

kliknete na Search Files. Sken potrva az nekolik minut.
Ve stejnem umisteni, jako mate FRST.exe/FRST64.exe, byl vytvoren soubor Search.txt jehoz obsah vlozte do pristi odpovedi.

Farbar Recovery Scan Tool (x64) Version:21-02-2016 01
Ran by Admin (2016-02-23 23:50:24)
Running from C:\Users\Admin\Desktop\Scan
Boot Mode: Normal

================== Search Files: "DasPtct.SYS" =============

C:\Windows\System32\drivers\DasPtct.SYS
[2015-10-02 21:52][2015-07-21 09:57] 0039672 ____A () 6F5D7826957A10FAE66061E724272C8E [File not signed]

C:\Users\Admin\Desktop\Scan\Panda Scanner\x86\DasPtct.sys
[2016-01-30 02:05][2015-09-14 13:03] 0038520 ____A () 2FB9B034CC55F84516A4CE5BBC8C5417 [File is digitally signed]

C:\Users\Admin\Desktop\Scan\Panda Scanner\x64\DasPtct.sys
[2016-01-30 02:05][2015-09-14 13:03] 0039672 ____A () C538D97D0CA4DAD7480551A8291CA42F [File is digitally signed]

====== End of Search ======

Mine. píše:================== Search Files: "DasPtct.SYS" =============

C:\Windows\System32\drivers\DasPtct.SYS
[2015-10-02 21:52][2015-07-21 09:57] 0039672 ____A () 6F5D7826957A10FAE66061E724272C8E [File not signed]

====== End of Search ======

Vysledek testu na virustotal: https://www.virustotal.com/en/file/07f0 ... /analysis/
Také mě mate, že neni podepsany jako dva ostatni stejne pojmenovane soubory, ale dle meho o malware nejde.

altrok píše:

Mine. píše:================== Search Files: "DasPtct.SYS" =============

C:\Windows\System32\drivers\DasPtct.SYS
[2015-10-02 21:52][2015-07-21 09:57] 0039672 ____A () 6F5D7826957A10FAE66061E724272C8E [File not signed]

====== End of Search ======

Vysledek testu na virustotal: https://www.virustotal.com/en/file/07f0 ... /analysis/
Také mě mate, že neni podepsany jako dva ostatni stejne pojmenovane soubory, ale dle meho o malware nejde.

Dobře. Takže není důvod k obavám? Ještě Vás poprosím o kontrolu avast! logu.

aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
Run date: 2016-02-22 23:16:24
-----------------------------
23:16:24.200 OS Version: Windows x64 6.2.9200
23:16:24.200 Number of processors: 6 586 0x200
23:16:24.202 ComputerName: ZALMANR1 UserName: Admin
23:16:31.095 Initialize success
23:16:31.104 VM: initialized successfully
23:16:31.109 VM: Amd CPU supported virtualized
23:16:35.928 AVAST engine defs: 16012201
23:16:54.928 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000002d
23:16:54.932 Disk 0 Vendor: WDC_WD10EZEX-00BN5A0 01.01A01 Size: 953869MB BusType: 11
23:16:54.938 Disk 1 \Device\Harddisk1\DR1 -> \Device\0000002e
23:16:54.942 Disk 1 Vendor: WDC_WD10EZRX-00A8LB0 01.01A01 Size: 953869MB BusType: 11
23:16:55.436 Disk 0 MBR read successfully
23:16:55.440 Disk 0 MBR scan
23:16:55.449 Disk 0 Windows 7 default MBR code
23:16:55.495 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 350 MB offset 2048
23:16:55.519 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 953067 MB offset 718848
23:16:55.564 Disk 0 Partition 3 00 27 Hidden NTFS WinRE NTFS 450 MB offset 1952600064
23:16:55.686 Disk 0 scanning C:\WINDOWS\system32\drivers
23:17:10.675 Service scanning
23:19:44.636 Modules scanning
23:19:44.649 Disk 0 trace - called modules:
23:19:44.714 ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll storahci.sys
23:19:44.724 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe0002ae54590]
23:19:44.736 3 CLASSPNP.SYS[fffff800721e46c5] -> nt!IofCallDriver -> \Device\0000002d[0xffffe0002ac8a060]
23:19:49.349 AVAST engine scan C:\WINDOWS
23:19:51.752 AVAST engine scan C:\WINDOWS\system32
23:24:05.569 AVAST engine scan C:\WINDOWS\system32\drivers
23:24:25.736 AVAST engine scan C:\Users\Admin
00:22:30.036 AVAST engine scan C:\ProgramData
00:28:28.470 Disk 0 statistics 5389533/0/0 @ 0,80 MB/s
00:28:28.497 Scan finished successfully
00:40:24.067 Disk 0 MBR has been saved successfully to "C:\Users\Admin\Desktop\MBR.dat"
00:40:24.074 The log file has been saved successfully to "C:\Users\Admin\Desktop\aswMBR.txt"

V logu z antirootkitoveho nastroje pochazejicicho z dilny Avastu take zadnou nesrovnalost nevidim. Citim z vas stale neduveru - spustte jeste TDSSKiller.

Přikládám log TDSSKiller.

Ani TDSSKiller zadny malware nenasel. Dle meho je PC na rootkity cisty.

altrok píše:Ani TDSSKiller zadny malware nenasel. Dle meho je PC na rootkity cisty.

Děkuji.

Nemate zac, rad jsem pomohl


Mejte se krasne a treba zase nekdy