Rootkit.Win32.PMax.gen

[Vict]

Dear Members,

I am using Win XP Pro and IE6.

I wonder if a solution has been found to do away with Rootkit.Win32.PMax.gen ?

I have been unable to run either anti-malware programme (SuperAntiSpywsare or Malwarebytes), IOBit Malware Fighter does run - but finds no fault.

TDSSKiller identifies 3 rogue items: On re-starting, it says they are supposed to be deleted, but they're not!

I am able to manually remove the 3 items:

1935382290 (I find this in C/Windows and can shred it)

12975b73 (I find this in the Registry HKLM/System/Control Set 001/Services/12975b73 and also in Control Set 002 and can delete them)

But none of this helps in the slightest.

I have uninstalled and re-installed Malwarebytes half a dozen times but even if I get it to start scanning, after about 10 seconds the programme just disappears off screen. The same happens with SuperAntiSpyware.

"Restore Points" going back in time using System Restore and another programme I have (by Innovative Solutions) do not help as the situation remains the same.

NB. I also note that www dot abnow dotcom seems to be involved in all this. I think it should be blocked or banned! On clicking a Google result, www dot abnow com takes over!

I am not sure how to "block" a website?

In "Safe Mode", none of the rogue items come up and so anti-malware detects nothing.

Any help would be much appreciated. So far, I have been trying to no avail for the last 18 hours.

Regards, Victor. 20th February 2012.

Edited February 20, 2012 by Maurice Naggar
URLs munged

[Maurice Naggar]

Victor,

We cannot help you in General forum to remove malware. And especially since you indicate having a rootkit infection !!

Let me suggest, if you're an MBAM customer, you contact the help desk at support@malwarebytes.org

Alternatively, Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select FOLLOW this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Please post there MBAM log (if possible) & the DDS logs

Don't post your logs here.

P.S. De-install IOBIt.

Edited February 20, 2012 by Maurice Naggar