Jump to content

DavidP

Members
 View Profile  See their activity

  • Posts

    3

  • Joined

  • Last visited

 Content Type 

Posts posted by DavidP

    Is this malware?

    in Malware Finding and Cleaning

    Posted · Edited by DavidP

    Hello. I have some strange dns queries going on.

    Open dns is saying some thing is requesting domains like this:

     

    h32cuaacaakjxrtpaeaaaagsaqaaakg6ek7tlo3gkfsk5ligafx5sca2aaaabua.ofliacaabaaaqboo54apdohqrwncgvevsqmu2cuwcydptw.a.j.e5.sk

    or

     

    aioxcbqaaaf2zficaaaaaaa.ulwm23ajmn4ypdq2.a.l.e5.sk

     

    a "dig" on e5.sk shows:

    dig +trace e5.sk                     

; <<>> DiG 9.9.2-P2 <<>> +trace e5.sk
;; global options: +cmd
.                       518282  IN      NS      g.root-servers.net.
.                       518282  IN      NS      d.root-servers.net.
.                       518282  IN      NS      j.root-servers.net.
.                       518282  IN      NS      a.root-servers.net.
.                       518282  IN      NS      k.root-servers.net.
.                       518282  IN      NS      m.root-servers.net.
.                       518282  IN      NS      c.root-servers.net.
.                       518282  IN      NS      e.root-servers.net.
.                       518282  IN      NS      b.root-servers.net.
.                       518282  IN      NS      h.root-servers.net.
.                       518282  IN      NS      i.root-servers.net.
.                       518282  IN      NS      l.root-servers.net.
.                       518282  IN      NS      f.root-servers.net.
;; Received 239 bytes from 192.168.1.1#53(192.168.1.1) in 40 ms

sk.                     172800  IN      NS      a.tld.sk.
sk.                     172800  IN      NS      c.tld.sk.
sk.                     172800  IN      NS      ns.eunet.sk.
sk.                     172800  IN      NS      ns.sk-nic.sk.
sk.                     172800  IN      NS      ns1.sk-nic.sk.
sk.                     172800  IN      NS      ns3.sk-nic.sk.
sk.                     172800  IN      NS      sns-pb.isc.org.
sk.                     86400   IN      NSEC    sl. NS RRSIG NSEC
sk.                     86400   IN      RRSIG   NSEC 8 1 86400 20140317000000 20140309230000 33655 . CrEdW8psKI1+7QCNxofwNftW7+v7Z0RcEn9ob0l65Nrex04B1XNpWkOT VijVjnKY4QX4HtfjhVe4FzeM4e78ycyXdUWvuEMRXHsDPFPJ/qGORr/w 5YselmVHpr4fAqD3T5Buf67IKUFaQCPsgbR+G2sx0qshrYD3aoQEzOaX 55g=
;; Received 560 bytes from 193.0.14.129#53(193.0.14.129) in 1038 ms

e5.sk.                  86400   IN      NS      h5-f5lb01-lsnr02-s.eset.com.
e5.sk.                  86400   IN      NS      h3-f5lb01-lsnr01-s.eset.com.
e5.sk.                  86400   IN      NS      89.202.157.228.rev.eset.com.
;; Received 141 bytes from 217.75.72.157#53(217.75.72.157) in 938 ms

e5.sk.                  900     IN      SOA     89.202.157.228.rev.eset.com.e5.sk. hostmaster.89.202.157.228.rev.eset.com.e5.sk. 2011111173 10800 3600 604800 900
;; Received 109 bytes from 89.202.157.228#53(89.202.157.228) in 444 ms

    I am asking about this here only because e5.sk seems to be eset....is this my anti virus doing something it should not be?

     

    Any thoughts on this?

×
×
  • Create New...