FaGoogle Chrome Process Malware: Need Help

[Vinn1]

I got the Fake Chrome Process Malware around a week ago, but did a System Restore which seemed to have gotten rid of it until about an hour ago (11/20/2014) when it came back.. I got a popup randomly that said that something failed and then it tried to open my CMD prompt. I force closed the popup (rundll32), but it still put the Malware back onto my PC. I noticed numerous Baxigxtm.exe processes which constantly come back after I end the process, and have the obvious icon of Google Chrome.

I've read up on this Malware before, but have no idea how to truly get rid of it without having to do a full system wipe. I don't even know if that would fix the issue.

I look forward to getting a response ASAP! Thank you.

Attached is a PICTURE of the Error I get right before the Malware attaches itself.



^ I also noticed that the Process for this Error is Microsoft Register Server aka regsvr32, which apparently is used to register a DLL (most likely the corrupt DLL files associated with this Malware..) ^

PS: I also just finished using Malware Bytes AntiRoot Kit and it still found nothing.

Some code of the culprit folder from the Scan:

"\AppData\LocalLow\Portalarium\kskjxbe\Hmdfbtuugd\36.0.1985.143\libglesv2.dll
2014-11-20 15:35 - 2014-11-20 15:35 - 00126280 _____ () C:\Users\*\AppData\LocalLow\Portalarium\kskjxbe\Hmdfbtuugd\36.0.1985.143\libegl.dll
2014-11-20 15:35 - 2014-11-20 15:35 - 08537928 _____ () C:\Users\*\AppData\LocalLow\Portalarium\kskjxbe\Hmdfbtuugd\36.0.1985.143\pdf.dll
2014-11-20 15:35 - 2014-11-20 15:35 - 00353096 _____ () C:\Users\*\AppData\LocalLow\Portalarium\kskjxbe\Hmdfbtuugd\36.0.1985.143\ppGoogleNaClPluginChrome.dll
2014-11-20 15:35 - 2014-11-20 15:35 - 01732936 _____ () C:\Users\*\AppData\LocalLow\Portalarium\kskjxbe\Hmdfbtuugd\36.0.1985.143\ffmpegsumo.dll
2014-11-20 15:35 - 2014-11-20 15:35 - 14669128 _____ () C:\Users\*\AppData\LocalLow\Portalarium\kskjxbe\Hmdfbtuugd\36.0.1985.143\PepperFlash\pepflashplayer.dll"


EDIT: I deleted the Portalarium folder and got the Baxigxtn to stop briefly, but then the error popped up again and it ended up in a raidcall folder instead..

The process keeps multiplying and popping up again as soon as I delete it.. I'm getting really mad..

 

[argus]

Helllo,

Before we begin, please note the following:

• I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
• The logs can take some time to research, so please be patient with me.
• Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
• Instructions that I give are for your system only!
• Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
• Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
• Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
  

  createsrpoint;
  Quickscan;
  autoclean;
  emptyalltemp;
  ipconfig /flushdns;b

• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

 

[Vinn1]

Hey there. I just want to update you by saying that I download ESET Nod32 after finding a suspicious DLL (which I found out was the rat causing me to constantly get the malware back). I scanned the file with Nod32 and it found a threat with the file and removed it. After I restarted my PC, the Process Malware was no longer there and the suspicious dll was also there.

Everything seems to have been solved by doing my own check. Do you think I should do anything else to make sure it's truly gone and not going to come back?

My performance is MUCH better since I got rid of the suspicious DLL and stopped the Malware.

 

[argus]

Good job.



Download DelFix by Xplode and save it to your desktop.

• Run the tool by right click on the
  
  icon and Run as administrator option.
• Make sure that these ones are checked:
  • Remove disinfection tools
  • Purge system restore
  • Reset system settings
• Push Run and wait until the tool completes his work.
• All tools we used should be gone. Tool will create an report for you (C:\DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.