My HijackThis log

[mbamuser1]

When I try launching mbam.exe, it does not start.

I tried renaming mbam.exe to winlogon.exe, it does not start.

My Hijackthis log is attached. Thanks for your help.

[SpySentinel]

Hi mbamuser1, Welcome to Malwarebytes

The infection you have is caused by CLB Rootkits

1. Download RootRepeal from the following location and save it to your desktop.
   
   • Zip Mirrors (Recommended)
     
     • Secondary Mirror
       
     • Secondary Mirror
       

[*]Rar Mirrors - Only if you know what a RAR is and can extract it.

• Primary Mirror
• Secondary Mirror
  
• Secondary Mirror
  

[*]Extract RootRepeal.exe from the archive.

[*]Open on your desktop.

[*]Click the tab.

[*]Click the button.

[*]Check all seven boxes:

[*]Push Ok

[*]Check the box for your main system drive (Usually C:), and press Ok.

[*]Allow RootRepeal to run a scan of your system. This may take some time.

[*]Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

[mbamuser1]

Thanks for the quick response. Will load the log once I'm done.

[SpySentinel]

You're welcome

[mbamuser1]

Sorry for the late response. Work kept me busy and so just found time to follow your instructions. Attached is the file.

Looking forward to your feedback. Thanks a lot!

roottest.txt

[mbamuser1]

Just want to add that this pc freezes quite a number of times while logging in. Alt + Tab or Ctrl+Alt + Tab does not work and I had to switch off the PC and reboot multiple times. I have both McAfee and Avast. Hope that helps in diagonizing the problem.

[SpySentinel]

I do not recommend that you have more than one anti virus product installed and running on your computer at a time. The reason for this is that if both products have their automatic (Real-Time) protection switched on, then those products which do not encrypt the virus strings within them can cause other anti virus products to cause "false alarms". It can also lead to a clash as both products fight for access to files which are opened again this is the resident/automatic protection. In general terms, the two programs may conflict and cause:

1) False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.

2) System Performance Problems: Your system may lock up due to both products attempting to access the same file at the same time.

Therefore please go to add/remove in the control panel and remove either McAfee or AVAST.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

1. If you are using Firefox, make sure that your download settings are as follows:
   
   • Tools->Options->Main tab
     
   • Set to "Always ask me where to Save the files".
     

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  -----------------------------------------------------------

  
  

• Close any open browsers.
  
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the "C:\Combo-Fix.txt" for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

[mbamuser1]

Thanks for the tip and I did uninstall McAfee and the PC doesnt seem to freeze now. Attached is the combofix log. Thanks again for your help!

ComboFix.txt

[SpySentinel]

McAfee has been known to cause issues so it was good you removed it.

Here are a few very good free Antivirus products which are available:

• 
  
• AntiVir Personal
  
• AVG Free
  
• AVAST!
  
• PC Tools AntiVirus
  

Select one of these, or another of your choice. Download, install, and update definitions. Do Not run a scan yet

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish, so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

[mbamuser1]

SpySentinel: Did a scan using mbam. And the PC came clean! I wouldnt have pulled this one off without your help! Thanks a lot!

[SpySentinel]

You're welcome, Glad I could help

I would like to see one more scan to make sure you are clean.

• Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  
• Double click on RSIT.exe to run RSIT.
  
• Click Continue at the disclaimer screen.
  
• Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)
  

[screen317]

mbamuser1,

SpySentinel will be away for a bit and I will be taking over for him. Please follow his most recent set of instructions and we'll continue from there.

-screen317

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!