Laptop problems.

[REDACTED]

Well, the google chrome resource hog is back and this time it installed itself in the app data for the game Gone Home. 

C:\Users\Stacy\AppData\LocalLow\The Fullbright Company\yvdttjqb\vyztfmqu 

It has created a process called Dlouhtylolvx.exe.

[essexboy]

OK lets have a fresh FRST scan.  What may have happened is that Chrome has been changed to the developer version which has no security checks.  In my opinion I would cease using chrome until they plug this gaping hole

 Please download Farbar Recovery Scan Tool and save it to your Desktop.
 
Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
 

• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
  
• Select  additions at the bottom
• Press Scan button.
  
  
• It will produce a log called FRST.txt in the same directory the tool is run from. 
  
• Please attach both logs generated.

[REDACTED]

Here is the updated logs.

[essexboy]

Hmm the fullbright company is a new startup that makes games and I do not believe they are very ethical as they appear to hide the updater as a legitimate Google updater.

None of these were evident on the initial log so they must have installed recently, or the updater on their website was substituted 

(Google Inc.) C:\Users\Stacy\AppData\Local\Google\Update\GoogleUpdate.exe
() C:\Users\Stacy\AppData\Local\Google\Update\Install\{ED87079F-BCFF-4E01-B29F-02C41E7FC379}\40.0.2214.91_39.0.2171.99_chrome_updater.exe

I assume you have uninstalled (!) the game as there is no reference to it in your uninstall list.  What is even more unethical is to leave a run key linked to the installer for the bad bits

HKU\S-1-5-21-328026544-1961890695-2546268383-1001\...\Run: [rnrkamxi] => regsvr32.exe /s "C:\Users\Stacy\AppData\Local\{C0FB8F9F-FB6E-4090-A939-0F75148F38F7}\rnrkamxi.dll" <===== ATTENTION


CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
Toolbar: HKU\S-1-5-21-328026544-1961890695-2546268383-1001 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
2015-01-20 21:19 - 2014-08-24 19:35 - 00000000 ____D () C:\Users\Stacy\AppData\Local\{C0FB8F9F-FB6E-4090-A939-0F75148F38F7}
HKU\S-1-5-21-328026544-1961890695-2546268383-1001\...\Run: [rnrkamxi] => regsvr32.exe /s "C:\Users\Stacy\AppData\Local\{C0FB8F9F-FB6E-4090-A939-0F75148F38F7}\rnrkamxi.dll" <===== ATTENTION
FF Extension: No Name - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1504\6.6.1088\firefoxextension [Not Found]
FF Extension: No Name - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [Not Found]
CHR Plugin: (Shockwave Flash) - C:\Users\Stacy\AppData\Local\Google\Chrome\Application\39.0.2171.99\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Native Client) - C:\Users\Stacy\AppData\Local\Google\Chrome\Application\39.0.2171.99\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
2015-01-09 15:52 - 2015-01-09 15:53 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage
C:\Users\Stacy\AppData\Local\Google\Update\Install\{ED87079F-BCFF-4E01-B29F-02C41E7FC379}
C:\Users\Stacy\AppData\Local\Temp\CR_ECF41.tmp
C:\Users\Stacy\AppData\LocalLow\The Fullbright Company
C:\Users\Stacy\AppData\Local\{C0FB8F9F-FB6E-4090-A939-0F75148F38F7}
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

[REDACTED]

Here is the fix log. 

I uninstalled the game through Steam which is where I installed it from.  Gone Home is an excellent narrative driven game by the way.  Not one act of violence in the game which was a change.  I have had the game on system since 2013 and not one issue until now.

The google resource hog was the same as last time in the EmieUserList\yvdttjqb\vyztfmqu.  I think the virus recreated itself in the game folder. 

I found some sites which mention a similiar google virus like what I have been experiencing.  (http://malwaretips.com/threads/uyitudbeg-exe-32-fake-google-chrome-process-emieuserlist-emiesitelist.36345/)

I thought I read another thread on another board which mentioned they deleted it and it came back in another location too. 

[essexboy]

Recently I have been removing EmieUserList, of which there are three variants,  as a matter of course (if it is needed then windows will re-create it)

How is the computer behaving now ?

[REDACTED]

now I have a IE memory hog back and Avast is pinging threat has been detected repeatedly.

I wish Avast or Malwarebytes would find what ever is going on. 

The explorer resource is running outside the user profile and when I attempted to close the process it says access denied.

[essexboy]

There is something hidden somewhere

Download and Install Combofix
 
Download ComboFix from one of the following locations:
Link 1
Link 2
 
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
 
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
  
• Accept the disclaimer and allow to update if it asks

• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.[/b]
  

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3.  If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.


Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

[REDACTED]

here we go.

[essexboy]

OK one hidden driver

1. Close any open browsers.
 
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 
 
3. Open notepad and copy/paste the text in the quotebox below into it:
 

File::
c:\windows\System32\drivers\cxqilqi.sys
c:\windows\SYSNATIVE\drivers\cxqilqi.sys
 
Driver::
fttqkxmf

 
Save this as CFScript.txt, in the same location as ComboFix.exe
 
 
 
 
Refering to the picture above, drag CFScript into ComboFix.exe
 
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

[REDACTED]

Here is the new log.

[essexboy]

That killed the driver but, for some reason it missed the file.  How is the computer running now

1. Close any open browsers.
 
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 
 
3. Open notepad and copy/paste the text in the quotebox below into it:
 

File::
c:\windows\system32\drivers\cxqilqi.sys

 
Save this as CFScript.txt, in the same location as ComboFix.exe
 
 
 
 
Refering to the picture above, drag CFScript into ComboFix.exe
 
When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

[REDACTED]

Latest log.  Hope we go it this time.

[essexboy]

How is the computer behaving now ?

[REDACTED]

So far everything is running like it is supposed to.