dnsapi.dll missing after malwarebytes removed a ton of malware

[windchime]

My father installed some bad software that let a truckload of malware into the system.  After running malwarebytes once (found and quarantined 28 items), rebooting, updating, running again (found and quarantined 478 items), and rebooting - I can no longer run malwarebytes.  I attempted to uninstall/reinstall, but I keep getting the error message "The program can't start because DNSAPI.dll is missing from your computer. Try reinstalling the program to fix this problem."

 

I noticed that TwinHeadedEagle commonly requests these two files from FRST, so I've attached them below.  (In an attempt to be proactive, I'm now running a search for dnsapi.dll using FRST)

 

Any help would be greatly appreciated!

 

Addition.txtFRST.txt

 

[windchime]

Also of note - google chrome seems to work properly (after removing all the start pages / search engines the malware installed), but Mozilla Firefox crashes immediately upon launch.  I'm using Windows 7.

[windchime]

All P2P software is fully disabled, and this is a fully registered copy of windows.

 

Attached is the search.txt for dnsapi.dll

Search.txt

[windchime]

Also, if it helps, I remembered that a rootkit was found on one of the malwarebytes scans called "cherimoya"

[windchime]

Hey - delete this thread if you'd like, but I found a solution to the problem that turned out to be quite easy.  I hope this gets left up so it can help others. 

 

Instead of all the logging and FRST nonsense - I just went to Windows System Restore, and restored the computer to the state it was in a little over 24 hours ago (before the malware had been downloaded and run).  

 

So far, this seems to have solved all problems.  Running malwarebytes now to confirm that all is well and that I'm in the clear.  Will report back if it comes back as infected.  If not, happy computing.

[windchime]

Just an update - system is running great, Malwarebytes came back with a clean scan.  I also ran Malwarebytes AntiRootkit just to make sure - which also came back as clean.  All hail System Restore! 

[AdvancedSetup]

Well glad you got it cleaned up but the system is pirating software from Adobe which is illegal.

 

127.0.0.1 localhost127.0.0.1 3dns.adobe.com 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com activate.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.wip.adobe.com
127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com
127.0.0.1 adobeereg.com practivate.adobe practivate.adobe.com practivate.adobe.newoa practivate.adobe.ntp practivate.adobe.ipp ereg.adobe.com ereg.wip.adobe.com ereg.wip1.adobe.com
127.0.0.1 ereg.wip2.adobe.com ereg.wip3.adobe.com ereg.wip4.adobe.com hl2rcv.adobe.com wip.adobe.com wip1.adobe.com wip2.adobe.com wip3.adobe.com wip4.adobe.com
127.0.0.1 www.adobeereg.com wwis-dubc1-vip60.adobe.com www.wip.adobe.com www.wip1.adobe.com
127.0.0.1 www.wip2.adobe.com www.wip3.adobe.com www.wip4.adobe.com wwis-dubc1-vip60.adobe.com crl.verisign.net CRL.VERISIGN.NET ood.opsource.net127.0.0.1 nlsk.neulion.com

[AdvancedSetup]

This topic will now be closed due to evidence of cracked or pirated software on this system.

Piracy Policy