EDIT: Avast is the bomb in dealing with this shit.
Copied from a message to my friend:
The actual shit is called Win32:Jifas and JS:Redirector-BN
Avast finally found it and killed it
You have to scan on boot
because if you don't, it starts up and disables your antivirus/anti-malware
Then hides behind all its spawn files, those fucked up DLLs
So, in the hours after I opened the Masaya PDF, I noticed some weird shit happening to my computer. It was slower, I had problems loading my e-mail for some reason..... and then last night I started getting a barrage of popups for no reason. I hit Task Manager to see what the fuck was going on.... and Adobe Reader was running even though I'd shut it down earlier. Not only running, but eating 700mb of memory. I shut it down, the IE popups stopped.... and I forgot it until today.
Randomly, when I'd do a google search, I had search pages that were unrelated pop up when I clicked on a link. On the advice of a friend..... I downloaded an anti-malware program (I chose Malwarebytes' Anti-Malware 1.44) and spent an hour and a half running it....
The results
Memory Modules Infected:
c:\Documents and Settings\All Users\Application Data\pabewisa\pabewisa.dll (Malware.Packer.Gen) ->
Files Infected:
c:\Documents and Settings\All Users\Application Data\pabewisa\pabewisa.dll (Malware.Packer.Gen) -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\garayudi\garayudi.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\mijepubi\mijepubi.dll.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\nevoputo\nevoputo.dll.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\rilalelu\rilalelu.dll.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\welumiva\welumiva.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\zorihali\zorihali.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP363\A0045532.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP363\A0045534.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP363\A0045533.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.
While I'm not *entirely* sure I got this nasty little fucker from the Masaya PDF, it's definitely suspect: I hadn't downloaded/opened anything else suspicious (some jrock files from valid, safe sources, ordinary internet browsing -and I avoid virusy pr0n sites like the plague they are, I'd rather have my prawnz in written form anyway-) so yeah... I think this PDF is suspicious.
Edit: THIS IS FUCKING NASTY SHIT. Somehow, it restored itself, my anti-malware scanner isn't finding it now, and it's giving me popups again. /RAAAAGGGGEEE
