Discord'dan alınan dosyadan virüs bulaşır mı?

Crypto Guard · 25 Aralık 2023

OfLeep dedi:
şifa gibi VirusTotal

Bilgisayarda bozulan herhangi bir dosya yok interneti çekip tarama başlattım.

Bu dosyaları bırakıp ardından uzak sunucuyla iletişim kuruyor. Elaman modemi söktü götürüyor.

%TEMP%\RtkBtManServ.exe
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B43.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B43.tmp.WERInternalMetadata.xml
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1BFF.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1BFF.tmp.csv
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C2F.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C2F.tmp.txt
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20B3.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20B3.tmp.WERInternalMetadata.xml
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20B4.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20B4.tmp.csv
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20C4.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WER20C4.tmp.txt
C:\Users\<USER>\AppData\Local\Temp\CustomEXE.exe
C:\Users\<USER>\AppData\Local\Temp\bfsvc.cfg
C:\Users\<USER>\AppData\Local\Temp\config
C:\Users\<USER>\AppData\Local\Temp\whysosad
C:\Users\<USER>\AppData\Local\Temp\xwizard.cfg
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RtkBtManServ.exe.log
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
C:\Users\user\AppData\Local\Temp\CustomEXE.exe
C:\Users\user\AppData\Local\Temp\RtkBtManServ.exe
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_ARC4.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_Salsa20.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_chacha20.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_pkcs1_decode.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_aes.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_aesni.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_arc2.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_blowfish.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_cast.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_cbc.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_cfb.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_ctr.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_des.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_des3.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_ecb.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_eksblowfish.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_ocb.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Cipher\_raw_ofb.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_BLAKE2b.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_BLAKE2s.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_MD2.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_MD4.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_MD5.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_RIPEMD160.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_SHA1.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_SHA224.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_SHA256.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_SHA384.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_SHA512.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_ghash_clmul.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_ghash_portable.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_keccak.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Hash\_poly1305.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Math\_modexp.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Protocol\_scrypt.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\PublicKey\_ec_ws.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\PublicKey\_ed25519.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\PublicKey\_ed448.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\PublicKey\_x25519.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Util\_cpuid_c.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\Crypto\Util\_strxor.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\MSVCP140.dll
C:\Users\user\AppData\Local\Temp\_MEI72282\VCRUNTIME140.dll
C:\Users\user\AppData\Local\Temp\_MEI72282\VCRUNTIME140_1.dll
C:\Users\user\AppData\Local\Temp\_MEI72282\_brotli.cp310-win_amd64.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_bz2.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_cffi_backend.cp310-win_amd64.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_ctypes.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_decimal.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_hashlib.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_lzma.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_multiprocessing.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_queue.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_socket.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_sqlite3.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_ssl.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_uuid.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\_win32sysloader.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\altgraph-0.17.3.dist-info\INSTALLER
C:\Users\user\AppData\Local\Temp\_MEI72282\altgraph-0.17.3.dist-info\LICENSE
C:\Users\user\AppData\Local\Temp\_MEI72282\altgraph-0.17.3.dist-info\METADATA
C:\Users\user\AppData\Local\Temp\_MEI72282\altgraph-0.17.3.dist-info\RECORD
C:\Users\user\AppData\Local\Temp\_MEI72282\altgraph-0.17.3.dist-info\WHEEL
C:\Users\user\AppData\Local\Temp\_MEI72282\altgraph-0.17.3.dist-info\top_level.txt
C:\Users\user\AppData\Local\Temp\_MEI72282\base_library.zip
C:\Users\user\AppData\Local\Temp\_MEI72282\certifi\cacert.pem
C:\Users\user\AppData\Local\Temp\_MEI72282\cryptography-39.0.1.dist-info\INSTALLER
C:\Users\user\AppData\Local\Temp\_MEI72282\cryptography-39.0.1.dist-info\LICENSE
C:\Users\user\AppData\Local\Temp\_MEI72282\cryptography-39.0.1.dist-info\LICENSE.APACHE
C:\Users\user\AppData\Local\Temp\_MEI72282\cryptography-39.0.1.dist-info\LICENSE.BSD
C:\Users\user\AppData\Local\Temp\_MEI72282\cryptography-39.0.1.dist-info\LICENSE.PSF
C:\Users\user\AppData\Local\Temp\_MEI72282\cryptography-39.0.1.dist-info\METADATA
C:\Users\user\AppData\Local\Temp\_MEI72282\cryptography-39.0.1.dist-info\RECORD
C:\Users\user\AppData\Local\Temp\_MEI72282\cryptography-39.0.1.dist-info\WHEEL
C:\Users\user\AppData\Local\Temp\_MEI72282\cryptography-39.0.1.dist-info\top_level.txt
C:\Users\user\AppData\Local\Temp\_MEI72282\cryptography\hazmat\bindings\_openssl.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\cryptography\hazmat\bindings\_rust.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\libcrypto-1_1.dll
C:\Users\user\AppData\Local\Temp\_MEI72282\libffi-7.dll
C:\Users\user\AppData\Local\Temp\_MEI72282\libssl-1_1.dll
C:\Users\user\AppData\Local\Temp\_MEI72282\mfc140u.dll
C:\Users\user\AppData\Local\Temp\_MEI72282\pyexpat.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\pyinstaller-5.1.dist-info\COPYING.txt
C:\Users\user\AppData\Local\Temp\_MEI72282\pyinstaller-5.1.dist-info\INSTALLER
C:\Users\user\AppData\Local\Temp\_MEI72282\pyinstaller-5.1.dist-info\METADATA
C:\Users\user\AppData\Local\Temp\_MEI72282\pyinstaller-5.1.dist-info\RECORD
C:\Users\user\AppData\Local\Temp\_MEI72282\pyinstaller-5.1.dist-info\WHEEL
C:\Users\user\AppData\Local\Temp\_MEI72282\pyinstaller-5.1.dist-info\direct_url.json
C:\Users\user\AppData\Local\Temp\_MEI72282\pyinstaller-5.1.dist-info\entry_points.txt
C:\Users\user\AppData\Local\Temp\_MEI72282\pyinstaller-5.1.dist-info\top_level.txt
C:\Users\user\AppData\Local\Temp\_MEI72282\python3.dll
C:\Users\user\AppData\Local\Temp\_MEI72282\python310.dll
C:\Users\user\AppData\Local\Temp\_MEI72282\pythoncom310.dll
C:\Users\user\AppData\Local\Temp\_MEI72282\pywintypes310.dll
C:\Users\user\AppData\Local\Temp\_MEI72282\select.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\setuptools-65.5.0.dist-info\INSTALLER
C:\Users\user\AppData\Local\Temp\_MEI72282\setuptools-65.5.0.dist-info\LICENSE
C:\Users\user\AppData\Local\Temp\_MEI72282\setuptools-65.5.0.dist-info\METADATA
C:\Users\user\AppData\Local\Temp\_MEI72282\setuptools-65.5.0.dist-info\RECORD
C:\Users\user\AppData\Local\Temp\_MEI72282\setuptools-65.5.0.dist-info\WHEEL
C:\Users\user\AppData\Local\Temp\_MEI72282\setuptools-65.5.0.dist-info\entry_points.txt
C:\Users\user\AppData\Local\Temp\_MEI72282\setuptools-65.5.0.dist-info\top_level.txt
C:\Users\user\AppData\Local\Temp\_MEI72282\sqlite3.dll
C:\Users\user\AppData\Local\Temp\_MEI72282\unicodedata.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\win32api.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\win32com\shell\shell.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\win32trace.pyd
C:\Users\user\AppData\Local\Temp\_MEI72282\win32ui.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\PIL\_imaging.cp310-win_amd64.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\PIL\_imagingcms.cp310-win_amd64.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\PIL\_imagingtk.cp310-win_amd64.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\PIL\_webp.cp310-win_amd64.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\VCRUNTIME140.dll
C:\Users\user\AppData\Local\Temp\_MEI80962\_bz2.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\_ctypes.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\_decimal.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\_hashlib.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\_lzma.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\_queue.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\_socket.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\_sqlite3.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\_ssl.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\base_library.zip
C:\Users\user\AppData\Local\Temp\_MEI80962\bound.exe
C:\Users\user\AppData\Local\Temp\_MEI80962\libcrypto-1_1.dll
C:\Users\user\AppData\Local\Temp\_MEI80962\libffi-7.dll
C:\Users\user\AppData\Local\Temp\_MEI80962\libssl-1_1.dll
C:\Users\user\AppData\Local\Temp\_MEI80962\python310.dll
C:\Users\user\AppData\Local\Temp\_MEI80962\rar.exe
C:\Users\user\AppData\Local\Temp\_MEI80962\rarreg.key
C:\Users\user\AppData\Local\Temp\_MEI80962\select.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\sqlite3.dll
C:\Users\user\AppData\Local\Temp\_MEI80962\tinyaes.cp310-win_amd64.pyd
C:\Users\user\AppData\Local\Temp\_MEI80962\unicodedata.pyd
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfa5b23s.4w4.ps1
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lw5haird.tnz.psm1
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mfly1jbi.0kv.ps1
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rik11vmj.qsn.psm1
C:\Users\user\AppData\Local\Temp\bfsvc.cfg
C:\Users\user\AppData\Local\Temp\bfsvc.exe
C:\Users\user\AppData\Local\Temp\bound.exe
C:\Users\user\AppData\Local\Temp\compile.bat
C:\Users\user\AppData\Local\Temp\compile.vbs
C:\Users\user\AppData\Local\Temp\config
C:\Users\user\AppData\Local\Temp\costura.metadata
C:\Users\user\AppData\Local\Temp\dav.bat (copy)
C:\Users\user\AppData\Local\Temp\hh.exe
C:\Users\user\AppData\Local\Temp\snuvcdsm.exe
C:\Users\user\AppData\Local\Temp\splwow64.exe
C:\Users\user\AppData\Local\Temp\whysosad
C:\Users\user\AppData\Local\Temp\winhlp32.exe
C:\Users\user\AppData\Local\Temp\xwizard.cfg
C:\Users\user\AppData\Local\Temp\xwizard.exe
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update Manager5581452.exe
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Update Manager5581452.exe:Zone.Identifier
C:\Windows\System32\spp\store\2.0\cache\cache.dat
C:\Windows\System32\spp\store\2.0\data.dat.tmp

475454 · 25 Aralık 2023

OfLeep dedi:
modemden baktığımda bahsetiğimiz siteye hiç bağlanmamış mcaffe engelemiş olabilirmi?

Riske atmaya gerek var mı?

Modem derken nereden baktın?

Douuuuuuuuu35 · 25 Aralık 2023

Crypto Guard dedi:
Eki Görüntüle 2064858

Bu dosyaları bırakıp ardından uzak sunucuyla iletişim kuruyor. Eleman modemi söktü götürüyor.

Hangi site dostum?

475454 · 25 Aralık 2023

Douuuuuuuuu35 dedi:
Hangi site dostum?

VirusTotal üzerinden bu bilgiyi öğrenebilirsin.

Crypto Guard · 26 Aralık 2023

Douuuuuuuuu35 dedi:
Hangi site dostum?

VirusTotal.

Discord'dan alınan dosyadan virüs bulaşır mı?

Crypto Guard

Kilopat

475454

Hectopat

Douuuuuuuuu35

Picopat

475454

Hectopat

Crypto Guard

Kilopat