If you have successfully installed MBAM, go to the installation folder (default is C:\Program Files\Malwarebytes’ Anti-Malware) and rename the main .exe (MBAM.exe) to something else, say, bluk.exe, then try to run it. Run a quick scan. When finished, have it remove everything found, and post the scan report. If it prompts you to complete removal on reboot, reboot promptly.
If it is “mbam-setup.exe” that won’t run, that means it is not installed, the installer is blocked. Try renaming the installer. If still no luck, try it again in safe mode.
There are hundreds, maybe thousands of rogue variants released each day. What’s surprising is that an AV actually picks any of them up, not that it misses the odd one. If you have the main executable of the rogue, you could try moving it to the Avast chest and then upload it to Avast for analysis, or zip it and email it to virus@avast.com with the description, and the password to unzip it in the body of the text. That would be appreciated.
SpywareDoctor and reg Mechanic aren’t rogues, but in my opinion they come close to the line, because of the “threats detected, but you must purchase to remove” thing.
I’ve read a lot of adverse reports about their performance, and (as with a lot of registry cleaners) propensity of Reg Mechanic to break things. I’d definitely uninstall both.
Revo uninstaller is good for stuff that doesn’t uninstall clean.
If you can’t stop Reg Mechanic or otherwise have problems uninstalling it, let me know, I’ll walk you through some steps that should work.
One of the problems with a lot of download sites, Cnet included, is that there are a large number of sponsored links available to click on. “Computer running slow? Click here for a free scan”, that sort of thing. And although they are not links to rogues software, mainly, they do tend to install these applications, like reg mechanic, which is a form of aggressive marketing. I don’t touch any of those sorts of things.
And a lot of perfectly legit things you might want to download, like for example, Ccleaner, comes with a Yahoo toolbar, unless you opt out.
This is (probably) not how you were infected with the rogue, but it probably is how you ended up with more PCTools stuff than you probably thought you were getting.
Threatfire is OK, useful, and works fine with Avast. I wouldn’t install the (optional) AV component.
