Infekcja przeglądarek - trotux.com, local64spl.dll

[Varak]

Dzień dobry,

 

przedwczoraj nieopatrznie zdarzyło mi się zainstalować jakieś świństwo objawiające się podmianą strony startowej i wyszukiwarki domyślnej w FF oraz Chrome na niejaki trotux.com. Doraźnie udało mi się przywrócić własne ustawienia (nie wiem na ile skutecznie, na razie nie podmieniły się ponownie), ale dzisiaj równo o 22:00 Avast zgłosił zablokowanie uruchomienia kilkunastu kopii pliku local64spl.dll. Na ile udało mi się stwierdzić, świństwo działa tak, że kopiuje ten plik do różnych folderów, dodatkowo tworząc ukryte kopie tych folderów z taką samą nazwą i końcówką "_" i do nich także się multiplikuje. I tutaj już z usunięciem nie potrafię sobie poradzić, proszę o pomoc.

Addition.txt

FRST.txt

GMER.txt

Shortcut.txt

[jessica]

Po tylu dniach pewnie temat jest już nieaktualny, więc mogę sobie pozwolić na "pomoc", bo i tak pewnie nie jest już potrzebna.

 

1) Odinstaluj niepotrzebny Akamai NetSession Interface

 

2) Odinstaluj te programy:

AnySend (HKLM-x32\...\ASPackage) (Version:  - CMI Limited) <==== ATTENTION

Reimage Repair (HKLM\...\Reimage Repair) (Version: 1.8.4.8 - Reimage) <==== ATTENTION

 

3) Otwórz Notatnik i wklej w nim:

 

2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Program Files (x86)\Mozilla Firefox\browser\features\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Program Files (x86)\Mozilla Firefox\browser\features_\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Program Files (x86)\Youtube AdBlock\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Program Files (x86)\Youtube AdBlock_\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Users\DefaultAppPool\AppData\LocalLow\Youtube AdBlock\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Users\DefaultAppPool\AppData\LocalLow\Youtube AdBlock_\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Users\DefaultAppPool\AppData\Local\Temp\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Users\DefaultAppPool\AppData\Local\Temp_\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Users\Varak\AppData\LocalLow\Youtube AdBlock\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Users\Varak\AppData\LocalLow\Youtube AdBlock_\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Users\Varak\AppData\Local\Google\Chrome\User Data\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Users\Varak\AppData\Local\Google\Chrome\User Data_\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Users\Varak\AppData\Local\Temp\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\Users\Varak\AppData\Local\Temp_\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\WINDOWS\Temp\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () C:\WINDOWS\Temp_\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () D:\Internet Download Manager\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () D:\K-Lite Codec Pack\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H () D:\Origin\local64spl.dll
RemoveDirectory: C:\Program Files\Reimage\Reimage Repair
RemoveDirectory: c:\program files (x86)\ckifasy
RemoveDirectory: C:\Users\Varak\AppData\Roaming\SimpleNotepad4
HKLM\...\Providers\06zqxz49: C:\Users\Varak\AppData\LocalLow\Youtube AdBlock\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\0ak7f0z0: D:\Program Files\UDPdp\UDPnp4_\local64spl.dll
HKLM\...\Providers\1od682xz: C:\Program Files (x86)\Mozilla Firefox\browser\features_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\2buzgj5q: D:\K-Lite Codec Pack_\local64spl.dll
HKLM\...\Providers\2co2ctdz: C:\Program Files (x86)\Mozilla Firefox\browser\features\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\2ffof5fu: C:\Users\Varak\AppData\Local\Temp\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\35kzpcko: C:\Users\DefaultAppPool\AppData\LocalLow\Youtube AdBlock\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\3kfz9rqx: D:\Origin_\local64spl.dll
HKLM\...\Providers\3sybvo0k: D:\MyFreeCodec\\local64spl.dll
HKLM\...\Providers\4ahqll75: D:\Internet Download Manager\\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\4gbsg7os: C:\WINDOWS\Temp\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\50v2bbew: C:\Users\DefaultAppPool\AppData\Local\Temp_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\52ic5l08: D:\Program Files\UDPdp\UDPnp4_\local64spl.dll
HKLM\...\Providers\6f0fym51: C:\Program Files (x86)\Youtube AdBlock_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\6iynuoql: D:\Program Files\UDPdp\UDPnp4\\local64spl.dll
HKLM\...\Providers\789cvtd2: C:\Program Files (x86)\Youtube AdBlock\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\8zdayf58: D:\MyFreeCodec_\local64spl.dll
HKLM\...\Providers\99fuhxjd: D:\MyFreeCodec\\local64spl.dll
HKLM\...\Providers\awr6aunc: C:\Users\Varak\AppData\Local\Google\Chrome\User Data_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\c3jqrco7: C:\Program Files (x86)\Youtube AdBlock_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\f6fvij7h: C:\Users\Varak\AppData\Local\Google\Chrome\User Data\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\g31rnpnx: C:\Users\Varak\AppData\LocalLow\Youtube AdBlock_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\ggn1q39w: D:\Origin\\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\hlwxy87e: C:\Users\DefaultAppPool\AppData\Local\Temp_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\hs72lykk: D:\Internet Download Manager_\local64spl.dll
HKLM\...\Providers\iblpcje3: C:\\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\is8k79rj: C:\Users\DefaultAppPool\AppData\Local\Temp\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\j9c2ama5: D:\Origin\\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\jxr219e4: C:\Program Files (x86)\Mozilla Firefox\browser\features\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\k44d47zy: C:\Users\Varak\AppData\Local\Google\Chrome\User Data_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\klncjwkm: D:\K-Lite Codec Pack\\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\krzlkd59: C:\Users\Varak\AppData\Local\Temp_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\me26x14v: C:\WINDOWS\Temp_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\me9s7zon: D:\K-Lite Codec Pack\\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\mkmgpr50: D:\Program Files\UDPdp\UDPnp4\\local64spl.dll
HKLM\...\Providers\n3qrckfw: C:\Users\DefaultAppPool\AppData\LocalLow\Youtube AdBlock_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\nwnsdn0a: C:\Users\Varak\AppData\Local\Temp\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\ofgopzaa: C:\WINDOWS\Temp\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\oo0i4bw6: C:\Program Files (x86)\Youtube AdBlock\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\pthnnqjs: C:\Users\DefaultAppPool\AppData\LocalLow\Youtube AdBlock\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\pu6l1ivl: C:\Users\DefaultAppPool\AppData\Local\Temp\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\q32jqf6t: D:\Internet Download Manager\\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\qhsk0mls: C:\Users\Varak\AppData\LocalLow\Youtube AdBlock_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\rawdpp92: C:\_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\rvg6s8el: D:\K-Lite Codec Pack_\local64spl.dll
HKLM\...\Providers\rz46f4vi: C:\Program Files (x86)\Mozilla Firefox\browser\features_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\sf841o4s: C:\\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\t4tl8w5v: C:\WINDOWS\Temp_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\tsgq6stz: C:\_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\unh4d8nw: D:\MyFreeCodec_\local64spl.dll
HKLM\...\Providers\uwj69ldk: C:\Users\Varak\AppData\Local\Temp_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\vnyc24py: C:\Users\DefaultAppPool\AppData\LocalLow\Youtube AdBlock_\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\xa0ymysw: C:\Users\Varak\AppData\Local\Google\Chrome\User Data\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\xkccmba4: D:\Origin_\local64spl.dll
HKLM\...\Providers\y10cusnu: C:\Users\Varak\AppData\LocalLow\Youtube AdBlock\local64spl.dll [142848 2016-10-31] ()
HKLM\...\Providers\zyhdrw8z: D:\Internet Download Manager_\local64spl.dll
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eushully\神採りアルケミーマイスター\Append01のアンインストール.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eushully\神採りアルケミーマイスター\Append02のアンインストール.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eushully\神採りアルケミーマイスター\Ver2.00 Update のアンインストール.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eushully\神採りアルケミーマイスター\アンインストール.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eushully\神採りアルケミーマイスター\神採りアルケミーマイスター.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eushully\神採りアルケミーマイスター\起動時設定.lnk
Task: {0B40296A-CABB-41FD-BE03-D80BB9B5E8AE} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> No File <==== ATTENTION
Task: {86B7D1E1-8BB3-43C5-A0C8-DA69E09FBC36} - System32\Tasks\{95C9A4C6-A89C-4B95-997C-B6BB00AD7232} => pcalua.exe -a D:\GRY\Kamidori\Kamidori\age.exe -d D:\GRY\Kamidori\Kamidori\
Task: {9927C950-A239-43EB-97B4-EBA9994074DF} - System32\Tasks\Reimage Reminder => C:\Program Files\Reimage\Reimage Repair\ReimageReminder.exe [2016-09-29] (Reimage ltd.) <==== ATTENTION
Task: {99A968C6-81B2-47E0-8030-D2B79384F0A5} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Task: {B25B83DA-C764-43F3-95CE-7576A95DE353} - \Microsoft\Windows\Setup\gwx\runappraiser -> No File <==== ATTENTION
Task: {CFE1A74B-EBB0-4F79-B1BA-D72D8BAC05F7} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {E2B556CA-DAE3-4E6F-A034-82CB5B2BA656} - System32\Tasks\0415avUpdateInfo => C:\ProgramData\Avg_Update_0415av\0415av_AVG-Secure-Search-Update.exe [2015-04-21] ()
Task: {E60B6775-CC96-40A2-8752-47676BCB5B69} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {E84A99B8-6DD5-4E00-9430-8E97C08D196E} - System32\Tasks\ReimageUpdater => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [2016-09-28] (Reimage®) <==== ATTENTION
Task: {EEA424B4-4D71-4818-8532-B74470D4728D} - System32\Tasks\48156235445b4b0653a5d4549627ebef => Rundll32.exe "C:\Program Files (x86)\Google\0t4b4g.dll",e62dc6c6547f46bda862da2d05af6862 <==== ATTENTION
Task: {F97740AF-FB53-4C00-9223-13B530A0ED09} - System32\Tasks\{017DA730-482E-4233-B473-01C9962F68DD} => pcalua.exe -a E:\Download\Mozilla\DuOSInstaller-Beta.exe -d E:\Download\Mozilla
ShortcutWithArgument: C:\Users\Varak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome\Program uruchamiający aplikacje Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> --show-app-list
ShortcutWithArgument: C:\Users\Varak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplikacje Chrome\グランブルーファンタジー[ChromeApps版].lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --profile-directory=Default --app-id=eablgejicbklomgaiclcolfilbkckngf
FirewallRules: [uDP Query User{481F3D07-B7C7-4F0B-99A9-A0134219A5F0}C:\users\varak\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\varak\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{1A28F934-F624-4E8E-827F-A9DAB41E175E}C:\users\varak\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\varak\appdata\local\akamai\netsession_win.exe
C:\Users\Varak\AppData\Local\Akamai\netsession_win.exe
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-1879993363-3360728001-3534206898-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Varak\AppData\Local\Akamai\netsession_win.exe [4691384 2015-07-23] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1879993363-3360728001-3534206898-1000\...\Run: [simpleNoteApp3] => "C:\Users\Varak\AppData\Roaming\SimpleNotepad4\SimpleNoteApp5.exe" <===== ATTENTION
GroupPolicy: Restriction - Chrome <======= ATTENTION
GroupPolicyScripts: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
FF NewTab: Mozilla\Firefox\Profiles\k1r9fk2p.default -> hxxp://www.trotux.com/?z=349fce8dee365a20969cafdg1zbmam7m5mcz1m6b2c&from=isr&uid=ST1000DM003-9YN162_S1D1162QXXXXS1D1162Q&type=hp
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\k1r9fk2p.default -> trotux
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\k1r9fk2p.default -> trotux
CHR DefaultProfile: ChromeDefaultData
CHR StartupUrls: ChromeDefaultData -> "hxxp://nutaku.net/"
CHR Profile: C:\Users\Varak\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2016-10-31] <==== ATTENTION
R2 Coalerly; C:\Program Files (x86)\Ckifasy\ZapingdreqisServer.dll [275968 2016-10-29] () [File not signed]
R2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [7953776 2016-09-28] (Reimage®)
2016-10-30 22:00 - 2016-10-31 22:00 - 00142848 ____H C:\local64spl.dll
2016-10-30 22:00 - 2016-10-31 22:00 - 00000020 ____H C:\local64spl.dll.ini
2016-10-30 22:00 - 2016-10-30 22:00 - 00000000 ___HD C:\WINDOWS\Temp_
2016-10-30 22:00 - 2016-10-30 22:00 - 00000000 ___HD C:\Users\Varak\AppData\LocalLow\Youtube AdBlock_
2016-10-30 22:00 - 2016-10-30 22:00 - 00000000 ___HD C:\Users\DefaultAppPool\AppData\LocalLow\Youtube AdBlock_
2016-10-30 22:00 - 2016-10-30 22:00 - 00000000 ___HD C:\Program Files (x86)\Youtube AdBlock_
2016-10-30 22:00 - 2016-10-30 22:00 - 00000000 ___HD C:\_
2016-10-29 22:28 - 2016-10-29 22:28 - 00001990 _____ C:\Users\Public\Desktop\PC Scan & Repair by Reimage.lnk
2016-10-29 22:28 - 2016-10-29 22:28 - 00000000 ____D C:\ProgramData\Reimage Protector
2016-10-29 22:28 - 2016-10-29 22:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair
2016-10-29 22:28 - 2016-10-29 22:28 - 00000000 ____D C:\Program Files\Reimage
2016-10-29 22:27 - 2016-10-29 22:29 - 00000150 _____ C:\WINDOWS\Reimage.ini
2016-10-29 22:08 - 2016-10-29 22:08 - 00004608 _____ C:\WINDOWS\SECOH-QAD.exe
2016-10-29 22:08 - 2016-10-29 22:08 - 00003584 _____ C:\WINDOWS\SECOH-QAD.dll
2016-10-29 22:02 - 2016-10-29 22:02 - 00000000 ____D C:\Users\Varak\AppData\Roaming\ASPackage
2016-10-29 22:02 - 2016-10-29 22:02 - 00000000 ____D C:\Program Files (x86)\03000200-1477774947-0500-0006-000700080009
2016-10-29 22:01 - 2016-10-29 22:01 - 00000000 ____D C:\ProgramData\Avira
2016-10-29 22:01 - 2016-10-29 22:01 - 00000000 ____D C:\ProgramData\Avg
2016-10-29 22:00 - 2016-10-29 22:00 - 00006072 _____ C:\WINDOWS\System32\Tasks\Clurers Server
2016-10-29 22:00 - 2016-10-29 22:00 - 00003634 _____ C:\WINDOWS\System32\Tasks\48156235445b4b0653a5d4549627ebef
2016-10-29 22:00 - 2016-10-29 22:00 - 00000000 ____D C:\Users\Varak\AppData\Roaming\BrowserModule
2016-10-29 21:59 - 2016-10-29 22:50 - 00000000 ____D C:\Users\Varak\AppData\Roaming\Clesyphimile
HOSTS:
EmptyTemp:

>>Menu Notatnika >> Plik >>
>>Zapisz jako >>
Nazwa pliku: fixlist
Zapisz jako typ: Dokumenty tekstowe
Kodowanie: UTF-8
>>Zapisz
Plik umieść w folderze E:\Download\Mozilla
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

4) Użyj >Adw-cleaner
najpierw kliknij na SKANUJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk OCZYŚĆ (CLEANING), to kliknij na niego.
Pokaż raport z niego "C"

 

5) Zrób nowe logi FRST.

 

6) Uruchom FRST.
W polu SEARCH (SZUKAJ) wklej:

 

local64spl.dll

kliknij na przycisk "Search Files (Szukaj Plików)".
Raport z tego będzie tam, gdzie jest FRST.

7) Uruchom FRST.
W polu SEARCH (SZUKAJ) wklej:

 

local64spl.dll

kliknij na przycisk "Search Registry" (Szukaj w Rejestrze).
Raport z tego będzie tam, gdzie jest FRST.

 

jessi