Rootkit other malware suspected

[andrewoman]

FYI: I am fairly ignorant about computer problems and troubleshooting. I have a Presario V5000, Windows XP Home, with Avast Free Antivirus, ZoneAlarm Free Firewall, WinPatrol and Snoopfree.

The first suspiscion I had was when an Adobe PDF file appeared on my desktop (I had only put Word doc's on the desktop), then weird desktop word doc's being renamed slightly. Then while mouse was idling the screen went black - I assumed it was because the mouse went in sleep mode. I toggled the mouse and "enter" key several times, to no avail. The screen was black for an inordinate amount of time, then as it went back to "normal", down in the task bar area (where open Chrome & IE8 screens "sit" in XP), I noticed a program called "3dtext" in the bottom of the screen. Never heard of it, so I googled it and found a bunch of bad news related to it.

I also noticed that when I boot up XP, instead of immediately going to Windows XP on black screen, an icon I don't ever recall seeing down in the lower right side of screen (could have been there before and not noticed it, but don't think so). The screen is black with an icon in lower corner that reads "Phoenix", with a swoop logo, and under "Phoenix" is text too small to see. Then it goes to black screen and Windows XP logo like normal.

Upon boot-up, Avast is disabled temporarily - it has a yellow exclamation point/icon (I think) in front of the Avast icon, then after about 30 seconds, it disappears. It had never done that until recently.

I have been doing scans (also in safe mode) with: Malwarebytes, SuperAntiSpyware, Avast. They have never found anything. There is something very wrong, but I am not savvy enough to troubleshoot it, so here I am. There is something that precedes boot-up and I did a scan with Avast's boot-up scan. No luck there.

Today I found Hijack Hunter and ran a scan. It says: (!!!POSSIBLE ROOTKIT DETECTED!!!)

When I looked in Administrator Tools, Services (Local), I found in many of the files instead of Logon as: "Local System Account", it says "This Account", NT AUTHORITY\LocalService, with a 13 digit password, which I certainly didn't set. It is enabled under Hardware Profile: "Profile 1".

Also, there are more user accounts than I should have. I have never added any.

I will thank you in advance. Thanks!

[yardbird]

Welcome to Malwarebytes! Malwarebytes scan should be done in windows! not safe mode, unless you can't get into windows.... If you want to see if your computer is clean. Follow these instructions please:

Please read the following so that you can begin the cleaning process:

As we don't deal with malware removal in the General Malwarebytes' Anti-Malware Forum, you need to start a topic in the Malware Removal forum so a qualified helper can help you fix any malware related problems/infections you may have.

• Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.
  
• After posting your new post, make sure under options, you select Track this topic and choose Immediate Email Notification, so that you're alerted when someone has replied to your post.
  
• One of the expert helpers there will give you one-on-one assistance when one becomes available.
  
• Please refrain from making any further changes to your computer (Install/Uninstall programs, use special fix tools, delete files, edit the registry, etc...) unless advised by a malware removal helper. Doing so can result in system changes which may hinder the attempts by a helper to clean your machine.
  

NOTE: Please DO NOT post back to (bump) your topic within the first 48 hours.

Replying to your own posts changes the post count and helpers are looking for topics with zero replies. If you reply to your own post helpers may think that you're already being helped and thus overlook your post.

• • If there is no reply from any experts after 48 hours, you can reply to the topic, asking for help again.
    Or
    
  • You may send a Private Message to a Moderator asking for assistance.
    

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org or here.

Please be patient, someone will assist you as soon as it is possible.