Im at my ends trying to figure this out on my own. Here is a list of some of the behavior and things I've tried to do to solve it myself. I've had rootkit infection before so I am familiar with some of the tell-tale signs. So just some basic info first...I've completely removed Adobe Flash off my system -- forawhile I figured I was the victim of some XSS and flash exploits because its so vulnerable. Now that Flash is off my system I know it's not that...I've also ran TFC (quite frequently) which does give me some peace of mind...but not for long. Even if it is getting rid of some temp files that this malware creates It comes back (go figure)
I cannot access my command prompt from control panel > advanced settings (this is a red flag for me) system just gives me a black screen and hangs. I cant run GMER anymore i get this error:
"C:\WINDOWS\system32\config\system: The process cannot access the file because it is being used by another process."
I can click "OK" after and scan anyways, but this never used to happen and i think the rootkits have gotten even better since 2012. Back then (the last time i was infected) i was able to use RKILL and MBAM to clean up the problem on my own. Alas, Im here now because I don't know what else to do and this type of Kernel land infection is too advanced for me to handle alone. I've considered just replacing my hard drive but I have ~ 1 TB of data and trying to transfer it without risking re-infection...Meh.
I have a very fast system, purchased in 2014 and when I got it browsing on the net was lightning quick. Another red flag for me is that everything is super slow and sluggish. I also get random audio "blips"
another "sign" as I see it is, whenever I restart it takes SUPER long -- so usually I just use shutdown option and restart manually -- Furtthermore, when I boot up the login screen is sometimes replaced with the "default" windows 8 login screen and not my custom one. There were a few times when I was trying to get into safemode and right when I'd be about to get something going id get booted out to see this default screen and have to re-log in again. SUPER SUSPICIOUS. I'm like 99.9% sure my system is rooted. I've tried a variety of programs to no avail. All reports are "clean"