Alureon.A infection causing No Program to run

Hi Guys,

first time posting on major geek. Found this site trying to look for a solution to my problem.

Couple days ago became the lucky owner of Trojan.dos\Alureon.A virus/rootkit. I have MSE running which I supplement with spybot S&D and ad-aware. MSE picked up the trojan but when I tried to remove it, it required a reboot. After the reboot the virus was still there and MSE now says that it was not able to remove it completely. So I tried using spybot which refused to open. Then I tried ad-aware with same result. Practlcally any program that I try to run will not launch. Word, firefox, opera, .....etc etc. Nothing will launch. Same results in safe mode.

Only thing that I have been able to run in any mode is internet explorer (64 bit version), notepad, MSE. Did some digging and got TDSSKiller, followed the instructions on this forum (and another post just like this) but same result. It won't launch. identical result for malwarebytes. Tried to install and run MGTools, MBRCheck so I could have some logs to post but again can't launch the programs. Only log I could get was the tasklist log that I have posted here.

I even tried calling MS support. They ran some software that found nothing. Their support says they can fix it but will cost money.

I need help guys, Please. I have been trying for two days straight and am tired :tired at my wits end. I would rather not do a whole reinstall.
Help Please

 

Hi and welcome to Major Geeks, ma2012!

For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Choose your language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Choose your language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
• Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please attach this log to your next reply. (How to attach)

 

thisisu,

thanks for giving perfect directions for any windows system. I forgot to mention in my original post that I am running windows 7 home editon on an hp laptop.

Anyway, here is the log

 

You're welcome. Try to run .exes again after this fix.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attached is fixlist.txt

• Save fixlist.txt to your flash drive.
• You should now have both fixlist.txt and FRST64.exe on your flash drive.

Now re-enter System Recovery Options.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (How to attach)

Now attempt to boot normally.

 

hi thisisu,

Got a quick question about the fix. I started the fix just as you instructed but it has been going on for almost two hours now. There is definately activity going on with the flash drive. Is this typical normal behavior or did something go kaput and I need to start again.

Sorry if I seem a little bit jumpy and impatient.

ma

 

Hi,

I am uploading another fixlist.txt

Replace your old fixlist.txt with this new one.

It should not take longer than one minute to finish.

 

thisisu.

You are the man. It worked :celebrate. I can now run other programs. So far I have run firefox and TDSSKiller (which didn't find anything). MSE is running scanning for trouble. So far looks like Alureon is gone.

I am still seeing some performance slowdown, can you recommend any program that I can use to cleanup or optimize my system. I hate all these proccess that are running that I have no idea what they do. I am currently using ccleaner but I am not sure that is a good optimization app.

Here's the log file.

ma

 

Let me know if you need additional assistance.

 

Actually can you suggest what anti-virus to use for real time protection as MSE really didn't do anything. I have had infection before but this was the worst I have been ever hit. It would be nice to know that I don't have to always be wary of my own AV software.

 

Hi,

All I can really is that you are your best source of protection. There is no foolproof antivirus.

I would recommend reading the below links for more information:

• How to Protect yourself from malware!
• How to deal with startup processes