TechSpot

Trojan:DOS/Alureon.A

Solved
By Bunnie1978
Nov 13, 2012
  1. Running Windows 7
    MS Security Essentials and Defender Offline no help.

    Please help.

    Will have to use USB drive to download any files on this computer as I can't get the internet to run on the infected computer. :(
     
  2. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Hello, and welcome to TechSpot.


    [​IMG] Please see here for the board rules and other FAQ.

    Please feel free to introduce yourself, after you follow the steps below to get started.

    Information
    • From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by a malware removal helper.
    • Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
    • If you have already asked for help somewhere, please post the link to the topic you were helped.
    • We try our best to reply quickly, but for any reason we do not reply in two days, please reply to this topic with the word BUMP!
    • Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.


    TDSSKiller Scan

    Please download and run TDSSKiller to your desktop as outlined below:

    Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

    For Windows XP, double-click to start.
    For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

    [​IMG]

    -------------------------

    Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

    [​IMG]

    ------------------------

    Click the Start Scan button.

    [​IMG]

    -----------------------

    If a suspicious object is detected, the default action will be Skip, click on Continue
    If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
    Skip and click on Continue


    [​IMG]

    ----------------------

    If malicious objects are found, they will show in the Scan results and offer three (3) options.

    Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.


    [​IMG]


    --------------------

    A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.
    Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

    -------------------

    Here's a summary of what to do if you would like to print it out:

    If a suspicious object is detected, the default action will be Skip, click on Continue
    If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
    Skip and click on Continue

    If malicious objects are found, they will show in the Scan results and offer three (3) options.

    Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.


    CapperKiller Scan

    The CapperKiller utility is designed for treating the aftermaths of a Trojan-Banker.Win32.Capper infection.

    How to use the utility:
    • Download the CapperKiller.exe utility.
    • Run CapperKiller.exe

      [​IMG]
    • A reboot may be required after the treatment. Please make sure it reboots, if it asks.
    • A report will be created in your root directory, (usually C:\ folder) in the form of "CapperKiller.[Version]_[Date]_[Time]_log.txt".
    • Please copy and paste its contents on your next reply.
    • Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.
     
  3. Bunnie1978

    Bunnie1978 TS Rookie Topic Starter

    My internet is kinda slow.. freezes up when I try to paste.. please let me know if uploading the txt is not ok. :)
     

    Attached Files:

  4. Bunnie1978

    Bunnie1978 TS Rookie Topic Starter

    This is the other tdsskiller file... there were 2.
    15:21:18.0210 2748 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35
    15:21:18.0709 2748 ============================================================
    15:21:18.0709 2748 Current date / time: 2012/11/13 15:21:18.0709
    15:21:18.0709 2748 SystemInfo:
    15:21:18.0709 2748
    15:21:18.0709 2748 OS Version: 6.1.7601 ServicePack: 1.0
    15:21:18.0709 2748 Product type: Workstation
    15:21:18.0709 2748 ComputerName: DESKTOP
    15:21:18.0709 2748 UserName: Hannah
    15:21:18.0709 2748 Windows directory: C:\Windows
    15:21:18.0709 2748 System windows directory: C:\Windows
    15:21:18.0709 2748 Running under WOW64
    15:21:18.0709 2748 Processor architecture: Intel x64
    15:21:18.0709 2748 Number of processors: 4
    15:21:18.0709 2748 Page size: 0x1000
    15:21:18.0709 2748 Boot type: Normal boot
    15:21:18.0709 2748 ============================================================
    15:21:21.0932 2748 BG loaded
    15:21:22.0775 2748 Drive \Device\Harddisk0\DR0 - Size: 0x2540BE4000 (149.01 Gb), SectorSize: 0x200, Cylinders: 0x4BFC, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
    15:21:22.0806 2748 Drive \Device\Harddisk1\DR1 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
    15:21:22.0806 2748 Drive \Device\Harddisk2\DR2 - Size: 0x1DD180000 (7.45 Gb), SectorSize: 0x200, Cylinders: 0x3CD, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
    15:21:22.0806 2748 ============================================================
    15:21:22.0806 2748 \Device\Harddisk0\DR0:
    15:21:22.0837 2748 MBR partitions:
    15:21:22.0837 2748 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x12A011FC
    15:21:22.0837 2748 \Device\Harddisk1\DR1:
    15:21:22.0837 2748 MBR partitions:
    15:21:22.0837 2748 \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x3A385000
    15:21:22.0837 2748 \Device\Harddisk2\DR2:
    15:21:22.0837 2748 MBR partitions:
    15:21:22.0837 2748 \Device\Harddisk2\DR2\Partition1: MBR, Type 0xB, StartLBA 0x20, BlocksNum 0xEE8BE0
    15:21:22.0837 2748 ============================================================
    15:21:23.0102 2748 C: <-> \Device\Harddisk0\DR0\Partition1
    15:21:23.0134 2748 F: <-> \Device\Harddisk1\DR1\Partition1
    15:21:23.0134 2748 ============================================================
    15:21:23.0134 2748 Initialize success
    15:21:23.0134 2748 ============================================================
    15:21:35.0614 2492 Deinitialize success
     
  5. Bunnie1978

    Bunnie1978 TS Rookie Topic Starter

    15:22:04.0535 3584 Trojan-Banker.Win32.Capper removal tool 1.0.6.0 Oct 26 2012 17:47:38
    15:22:04.0925 3584 ============================================================
    15:22:04.0925 3584 Current date / time: 2012/11/13 15:22:04.0925
    15:22:04.0925 3584 SystemInfo:
    15:22:04.0925 3584
    15:22:04.0925 3584 OS Version: 6.1.7601 ServicePack: 1.0
    15:22:04.0925 3584 Product type: Workstation
    15:22:04.0925 3584 ComputerName: DESKTOP
    15:22:04.0925 3584 UserName: Hannah
    15:22:04.0925 3584 Windows directory: C:\Windows
    15:22:04.0925 3584 System windows directory: C:\Windows
    15:22:04.0925 3584 Running under WOW64
    15:22:04.0925 3584 Processor architecture: Intel x64
    15:22:04.0925 3584 Number of processors: 4
    15:22:04.0925 3584 Page size: 0x1000
    15:22:04.0925 3584 Boot type: Normal boot
    15:22:04.0925 3584 ============================================================
    15:22:04.0925 3584 Initialize success
    15:22:04.0925 3584 ============================================================
    15:22:19.0979 3872 ================================================================================
    15:22:19.0979 3872 Scan started
    15:22:19.0979 3872 ================================================================================
    15:22:19.0979 3872 ProcessDriveEnumEx: Drive C:\ type 3:0
    15:28:30.0479 3872 ProcessDriveEnumEx: Drive D:\ type 5:0
    15:28:30.0479 3872 ProcessDriveEnumEx: Drive E:\ type 5:0
    15:28:30.0479 3872 ProcessDriveEnumEx: Drive F:\ type 3:0
    15:28:30.0479 3872 ProcessDriveEnumEx: Drive G:\ type 1:0
    15:28:30.0479 3872 ================================================================================
    15:28:30.0479 3872 Scan finished
    15:28:30.0479 3872 ================================================================================
    15:29:45.0331 3576 Deinitialize success
     
  6. Bunnie1978

    Bunnie1978 TS Rookie Topic Starter

    Hi. I'm Hannah. Single mother in Nashville. Only thing I do besides keep my personal records on my computer is watch my shows on Hulu... this trojan is ruining that... my only recreation... because my internet won't run. It starts out ok, at 1.25 mg download but after a minute or two drops to a third of that or LESS!! I just moved to this little ho-bunk one light town... should have found out if there was good internet out here before I moved, but oh well. :)
     
  7. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Hello again. Please open TDSSKiller, do another scan (as earlier), delete the TDSS file system once the prompt comes up. Post new log, please. :)

    avast! aswMBR

    Please download aswMBR from here
    • Save aswMBR.exe to your Desktop
    • Double click aswMBR.exe to run it
    • Uncheck "Trace disk IO calls".
    • Click the Scan button to start the scan as illustrated below
    [​IMG]
    Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives.
    • Once the scan finishes click Save log to save the log to your Desktop
      [​IMG]
    • Copy and paste the contents of aswMBR.txt back here for review
    • Please also find MBR.dat on your Desktop, and rename it to MBRscan.txt. Upload that as well. Do not copy and paste MBR.dat/txt, it needs to be uploaded.
     
  8. Bunnie1978

    Bunnie1978 TS Rookie Topic Starter

    New TDS log attached. Running the other now.
     

    Attached Files:

  9. Bunnie1978

    Bunnie1978 TS Rookie Topic Starter

    aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
    Run date: 2012-11-15 20:04:26
    -----------------------------
    20:04:26.962 OS Version: Windows x64 6.1.7601 Service Pack 1
    20:04:26.962 Number of processors: 4 586 0x403
    20:04:26.962 ComputerName: DESKTOP UserName: Hannah
    20:04:27.726 Initialize success
    20:05:04.131 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
    20:05:04.146 Disk 0 Vendor: ST3160812AS 3.ADH Size: 152587MB BusType: 3
    20:05:04.146 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-4
    20:05:04.146 Disk 1 Vendor: ST500DM002-1BD142 KC45 Size: 476940MB BusType: 3
    20:05:04.177 Disk 0 MBR read successfully
    20:05:04.177 Disk 0 MBR scan
    20:05:04.177 Disk 0 Windows 7 default MBR code
    20:05:04.177 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 152578 MB offset 63
    20:05:04.193 Disk 0 scanning C:\Windows\system32\drivers
    20:05:13.709 Service scanning
    20:05:31.930 Modules scanning
    20:05:31.946 Scan finished successfully
    20:06:40.681 Disk 0 MBR has been saved successfully to "C:\Users\Hannah\Desktop\MBR.dat"
    20:06:40.681 The log file has been saved successfully to "C:\Users\Hannah\Desktop\aswMBR.txt"
     
  10. Bunnie1978

    Bunnie1978 TS Rookie Topic Starter

    Here it is.
     

    Attached Files:

    • MBR.txt
      File size:
      512 bytes
      Views:
      0
  11. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Good job!

    ESET Online Scan

    Please run a free online scan with the ESET Online Scanner
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • When asked, allow the ActiveX control to install, or it will ask to download an installer. Please do so an install it.
    • Click Start or wait for the scanner to load.
    • Make sure that the options Remove found threats and the option Scan unwanted applications are checked.
    • Click Scan (This scan can take several hours, so please be patient)
    • Once the scan is completed, there are a couple of things to keep in mind:
    • 1. If NO threats were found, allow the scanner to Uninstall on close and then close the Window.
    • 2. If threats WERE detected, click on List of Threats Found, Export to Text File...save it as ESET-Scan-Log.txt. Click the back button/link, put a checkmark to Uninstall Application on Close and then close the window.
    • Open the logfile from wherever you saved it
    • Copy and paste the contents in your next reply.


    Any more issues?

    We need to know any other issues that are plaguing your computer. Kindly give a summary so we know how to continue from here.

    Many of the things to note for us would be:

    • Slow computer
    • Error messages
    • Fake antivirus alerts or the icon in the system tray
    • svchost.exe running at 100%
    • System crashes or blue screen of death
     
     
  12. Bunnie1978

    Bunnie1978 TS Rookie Topic Starter

    I am running this scan now. It has a bunch of threats detected, but I will have to leave before it is complete. A whole bunch of trojans that MSE didn't detect.... :(
    Otherwise, whatever was interupting my internet usage is cleared and I can get online on the infected computer again. No other performance issues or weirdness. Is there any other program I should have besides MSE on my computer to protect from these infections? Confession... I forgot to install it when I did the last clean (reformat, reinstall everything) so this computer was running with no antivirus for a few months...
    Bunnie <--- stupid!! LOL
     
  13. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    You can take a look at my prevention tips later, once we finish up here...

    Clean up System Restore

    Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."

    To manually create a new Restore Point
    • Go to Control Panel and select System and Maintenance
    • Select System
    • On the left select Advance System Settings and accept the warning if you get one
    • Select System Protection Tab
    • Select Create at the bottom
    • Type in a name I.e. Clean
    • Select Create
    Now we can purge the infected ones
    • Go back to the System and Maintenance page
    • Select Performance Information and Tools
    • On the left select Open Disk Cleanup
    • Select Files from all users and accept the warning if you get one
    • In the drop down box select your main drive I.e. C
    • For a few moments the system will make some calculations:
      [​IMG]
    • Select the More Options tab
      [​IMG]
    • In the System Restore and Shadow Backups select Clean up
      [​IMG]
    • Select Delete on the pop up
    • Select OK
    • Select Delete
    Run OTC to remove our tools

    To remove all of the tools we used and the files and folders they created, please do the following:
    Please download OTC.exe by OldTimer:
    • Save it to your Desktop.
    • Double click OTC.exe.
    • Click the CleanUp! button.
    • If you are prompted to Reboot during the cleanup, select Yes.
    • The tool will delete itself once it finishes.
    Note:If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

    Purge old temporary files

    NOTE: If you already have this installed, you don't have to reinstall it.

    Please download CCleaner Slim and save it to your Desktop - Alternate download link

    When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
    Follow the prompts to install the program.

    • Double-click the CCleaner shortcut on the desktop to start the program.
    • A prompt will ask you if you want CCleaner to do a check to see what cookies it needs to keep. Allow that operation.
    • On the Cleaner tab, click on Run Cleaner on the bottom-right to run the program.
    • Important: Make sure that ALL browser windows are closed before selecting Run Cleaner, or it will ask if you want the program to close them for you (when you do this, all unsaved data may be lost in the browser).

    Caution: Only use the Registry feature if you are very familiar with the registry.
    Always back up your registry before making any changes. Exit CCleaner after it has completed it's process.

    Security Check

    Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.
    • Save it to your Desktop.
    • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
     
  14. Jay Pfoutz

    Jay Pfoutz Malware Helper Posts: 4,286   +49

    Personal Tips on Preventing Malware

    See this page for more info about malware and prevention.



    Topic marked solved.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.