unable to run mbam.exe due to missing DNSAPI

[Ahptex]

I am unable to run mbam.exe due to a missing DNSAPI.dll file.  I tried some of the suggestions in the pinned help post, but am still not able to access. We have had the free Malwarebytes version for a while, and have scanned and removed several malware infections.  We recently upgraded to the premium version (on October 25, 2015).  I am not certain whether we have scanned successfully since upgrading to the premium version.

 

I downloaded the farbar recovery scan tool, and have attached the resulting addition.txt and frst.txt files.

 

What should I do next?

 

Thanks for your help!

Addition.txt

FRST.txt

[TwinHeadedEagle]

Hello,

Can you attach MalwareBytes report?

[Ahptex]

I don't think so (unless they are saved somewhere as a file each time a scan is run -- if that is the case, where would I look to find the report?).  I am not able to launch the application at all.  It just gives the error unable to run due to the missing DNSAPI.dll file.

[TwinHeadedEagle]

FRST search

Once again we shall use FRST for additional checks. Re-run FRST/FRST64 by double-clicking:

• Copy dnsapi.dll into the Search: field in FRST then click the Search Files button.
• FRST will search your computer for files and when finished it will produce a log Search.txt in the same directory the tool is run.
• Please attach it to your reply.

[Ahptex]

Ok, I am attaching the search.txt file.  Thanks for your help.

Search.txt

[TwinHeadedEagle]

I overlooked this topic. Do you still need my help?

[Ahptex]

Yes, please.  I am still not able to run malwarebytes or to reinstall it.  I think the computer also has some kind of infection, because we are having problems opening browsers.

 

Any ideas as to next steps?  Thanks!

[TwinHeadedEagle]

Okay, we need to replace some infected files.

• Create two folders on your C partition.
• One should be named 32 and the second one should be named 64.
• Now you need to download two files and to put them in those folders.
• This one you need to put into the folder named 32.
• This one you need to put into the folder named 64.

Let me know when you do this.

[Ahptex]

ok, I have created the folders and downloaded the files.

[TwinHeadedEagle]

Uninstall some programs
 
We need to uninstall some unwanted/unneeded programs.

• Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search there for each entry mentioned below, right-click the entry and click Uninstall one at a time

The list of programs to uninstall:

• Setup

After completing uninstalls, please manually reboot your machine!
 
Note: If you get the message like: An error occurred while trying to uninstall, just press Yes.
Note: If you are unable to uninstall all programs, please inform me, but continue with other steps.
 

---

Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please upload it to your reply.

fixlist.txt

[Ahptex]

Just letting you know that when I search for Setup to uninstall, it is not found.

 

I am continuing with the other steps.

[Ahptex]

I am attaching the fixlog.txt file

Fixlog.txt

[TwinHeadedEagle]

Very good. How is the situation now?

[Ahptex]

I am still not able to run mbam.exe (when I clicked on it previously, I would get an error message.  Now, it just does not start and there is no error message). 

 

I am getting some alerts through windows defender about malware (Trojan:Win32.Patched.AP and Adware:Win32/EoRezo).  I think that the problems with the computer started around the same time as the Trojan lists as quarantined (10/25/2015). Should I try having windows defender delete it?

[TwinHeadedEagle]

No, don't need to use Windows Defender, just ignore it.
 
 
Uninstall outdated Malwarebytes' Anti-Malware
 
Please download MBAM-clean and save it to your desktop.

• Right-click on mbam-clean.exe icon and select Run as Administrator to start the tool.
• It will ask you to reboot the machine - please do so.

After that follow my next instructions to download & install the newset MBAM version.
 
 
 
Scan with Malwarebytes' Anti-Malware
 
Please download Malwarebytes Anti-Malware and save it to your desktop.

• Install the progam and select update.
• Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.
• In the same tab, under PUP and PUM detections make sure it is set to Treat detections as malware.
• Click the Scan tab, choose Threat Scan is checked and click Start Scan.
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• At the bottom click Export and choose Text file.

Save the file to your desktop and include its content in your next reply.

[Ahptex]

Here is the scan log file.  Thanks again for your help.

scan log.txt

[TwinHeadedEagle]

Very good. How is your PC behaving now?

[Ahptex]

I think it is almost clean but still has at least one issue. 

 

There are three users on the computer ... One user has full use of chrome, firefox, and microsoft edge with no apparent issues.  I was able to reset the shortcuts for the browsers, everything works normally, and nothing unusual happens when the browsers are opened and used.

 

The second user has full use of firefox and Microsoft edge, but vosteran.com is popping up in a second window when chrome is launched. I re-ran Malwarebytes to see if it would locate this and it did find a few things (adware maybe?) and I removed the things Malwarebytes found.  However, I don't think the things that were removed are the vosteran malware.  I am attaching the scan log from this last scan.  

 

I have not yet tested the browsers for the third user on the computer, so not sure if there are issues there.

 

Is there a good way to rid the computer of the vosteran malware? I am hopeful that this is the last problem!

 

Thanks again for all of your help!

scan log 2.txt

[TwinHeadedEagle]

I think the easiest thing is to reinstall Google Chrome.

 

 

Uninstall Chrome

 

Export your bookmarks

https://support.google.com/chrome/answer/96816?hl=en

 

 

Close all Chrome windows and tabs.

Go to the Start menu > Control Panel.

Click Programs and Features.

Double-click Google Chrome.

Click Uninstall from the confirmation dialog. Delete your user profile information, like your browser preferences, bookmarks, and history, select the "Also delete your browsing data" checkbox.

 

 

Click Start, copy in search %LOCALAPPDATA%\ and remove folder Google

 

Download Chrome

https://www.google.com/intl/en/chrome/browser/desktop/

[Ahptex]

That worked, I did a final scan with malwarebytes, and everything seems to be working normally! Thank you so much for your help.

[TwinHeadedEagle]

Since there are no more problems, we can declare this PC clean

Now, we can proceed with post-cleanup procedures. Let's remove my tools and create a new, non infected restore point concurrently deleting old ones.

Step 1. - Creation of system restore point and tools removal.

Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run and wait until the tool completes his work.
• All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt). I don't need it for review.

Tool deletes old system restore points and creates a fresh system restore point after cleaning.

Step 2. - Tips and tricks to keep your computer clean, safe and in a good shape.

Security tips - highly recommended reading:

• Simple and easy ways to keep your computer safe and secure on the Internet

Maintenance tips:

• Optimize Windows for better performance

Additional software that I personally use and install on all my clients devices:

• Malwarebytes' Anti-Malware (paid version highly recommended) - to scan your system from time to time in search for malware.
• Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.
• McShield - to prevent infections spread by removable media.
• Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.
• Adblock - to surf the web without annoying ads!
• Qualys BrowserCheck - cloud service that scans your browsers and plugins to see if they’re all up-to-date.

My help is free for everybody.

If you're happy with the help provided and/or wish to buy me a beer for the assistance you received, then you can consider a donation:

Thank you!

Stay safe,

TwinHeadedEagle

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!