Alureon.FV and FakeSysDef infection

Just as the title says both of these were on the computer I'm trying to repair. I scanned the computer with Windows Security Essentials and removed the viruses. Later on I downloaded Malwarebytes and performed another scan which removed them again. It seems that the viruses are gone, but I'm unable to perform a windows update to get to SP1. Every time I go through the process it hangs around 50%. I've tried going through the windows update dialog and also downloading the update directly from microsoft and installing manually. The last steps I have performed were the ones from the Malware Removal Guide from these forums. I am still experiencing the same issue with not being able to install SP1.

Computer Background:
Dell 1545
Intel Pentium Dual Core 2GHz
3GB RAM
Windows 7 Home Premium 64-bit

Any help would be greatly appreciated.

 

Hello Hyperbomb64,

From Programs and Features (via Control Panel), please uninstall the below:

• Coupon Printer for Windows
• Dell-eBay
• Java(TM) 6 Update 29

__

Please download OTL by OldTimer.

• Save it to your desktop.
• Right mouse click on the OTL icon on your desktop and select Run as Administrator
• Check the "Scan All Users" checkbox.
• Check the "Standard Output".
• Change the setting of "Drivers" and "Services" to "All"
• Copy the text in the code box below and paste it into the text-field.
  
  Code:

  activex
  netsvcs
  drives
  

• Now click the button.
• One report will be created:
  • OTL.txt <-- Will be opened
• Attach OTL.txt to your next message. (How to attach)

__

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure all the options are checked
• Press Scan.
• It will create a log (FSS.txt) in the same directory the tool was run.
• Please attach FSS.txt to your next message. (How to attach)

 

Thanks for your reply. I've uninstalled the programs you mentioned and also run the scans. The logs are attached.

 

I don't see any problems with Windows Update malfunctioning which may have been preventing SP1 from installing.

I'm going to help you remove the remaining traces of malware but afterwards I would recommend asking for help with the SP1 issue in the Software forum.

From Programs and Features (via Control Panel), please uninstall the below:

• Viewpoint Media Player <= Not recommended. Keep it if you use it.

Fix items using OTL by OldTimer

Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Copy the text in the code box below and paste it into the text-field.

Code:

[COLOR="DarkRed"]:processes[/COLOR]
killallprocesses
[COLOR="DarkRed"]:otl[/COLOR]
IE - HKU\S-1-5-21-2009075729-236556007-2880401984-1000\..\SearchScopes\{A3587BC7-F3AF-4657-B2A2-97BA5D9A17A2}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=38C5D2F2-0061-4908-85A3-A6318B9EF097&apn_sauid=B1F5D7B5-A6B6-45E6-9885-35ABC2C037B7&
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
[2009/11/06 11:37:19 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npCouponPrinter.dll
[2009/11/06 11:37:20 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npMozCouponPrinter.dll
O16:[b]64bit:[/b] - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16:[b]64bit:[/b] - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13)
O16:[b]64bit:[/b] - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Reg Error: Key error.)
[COLOR="DarkRed"]:files[/COLOR]
C:\ProgramData\-lRunQB9idboDCM
C:\ProgramData\-lRunQB9idboDCMr
C:\ProgramData\lRunQB9idboDCM
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons
[COLOR="DarkRed"]:commands[/COLOR]
[clearallrestorepoints]
[emptyjava]
[emptyflash]

Now click the button.
If the fix needed a reboot please do it.
Click the OK button (upon reboot).
When OTL is finished, Notepad will open. Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach)

__

If you are not having any other malware related problems, it is time to do our final steps:

• Any programs we had you download and/or install can be removed at this time.
• If we had you download and run ComboFix, here is how to uninstall it:
  • Press and hold the Windows key and then press the letter R on your keyboard.
  • This opens the Run dialog box.
  • Copy and paste the below text inside the text-field:
    • "%userprofile%\desktop\ComboFix" /uninstall
  • Now press ENTER
  • ComboFix will extract its files one last time and you should receive a notification that ComboFix has been uninstalled shortly after.
• You can re-enable your Disk Emulation software at this time via DeFogger.
• If we had you create or download a registry patch or "fix" script, these can be deleted at this time.
• Go into the C:\MGtools folder and run the MGclean.bat file to remove additional traces of our tools.
• Now we will toggle System Restore to remove any infected system restore points.
  • Read this: How to Disable And Enable System Restore
• Lastly, here is a guide to protect you from future infections: How to Protect yourself from malware!
• Be safe

 

Thanks for your assistance with my issue. Everything seems to be running fine so if I have the go ahead I'll run the final steps listed in your reply.

 

You're welcome. Be safe.