Unable to boot, Tried to remove - Alurean.gem!A - with Windows defender

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by mirunning, Nov 10, 2013.

  1. mirunning

    mirunning Private E-2

    I originaly posted under Hardware issue and was asked by Sikvik to post a thread here in Maleware.

    Here are my specs
    Sony Vaio Laptop model: SVE15D11L, 64-bit, Windows 7
    Problem: Currently cannot get past the windows screen to get in on any mode. I have had the Blue screen of death flash in and out and then the lapop would restart. I could not run my antivirus (McAfee). I downloaded Windows Defender Offline (WDO) from another laptop to a USB and then ran it by changing the BIOS setting. A scan found the following - TrojanClicker.ASX // Trojan.HTML/Redvetar // WIN64/Alurean.gem!A - WDO then cleaned the files and then I ran a full scan.
    Tried the following:
    1. Backed up files.
    2. Downloaded Kapersky as an ISO to a CD and verified it was downloaded correctly by using it on another laptop. I changed the BIOS on the Sony to boot from the CD, but nothing happens.
    3.Through the Command Prompt and entered:
    bootrec /fixboot
    bootrec /fixmbr
    bootrec /rebuildbcd
    and a chkdsk

    In summary for each bootrec prompt I received (The operations completed successfully). For the last command prompt I received three replies for each stage and they indicated the following: stage 1 357632 file records processed. File verification complete // stage 2 418216 index entries processed. Index verification completed. // stage 3 357632 file SDs/SIDs processed. Security descriptor verification completed. 30293 data files processed. After that I tried a Restart, but I was redirected back to the window "Windows Error Recovery". I tried "Start Windows Normally" but it only loops be back. I also tried "Launch Startup Repair" no luck either. I am willing to try more ideas, or any suggestions on how to get the CD drive to boot.
     
    mirunning, Nov 10, 2013
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Try this:

    Please do the below so that we can boot to System Recovery Options to run a scan. There will be two options to choose from. One if you do not have your Windows 7 boot DVD and another when you have your DVD.

    For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
    For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    Option1: Enter System Recovery Options from the Advanced Boot Options:

    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.

    Option2: Enter System Recovery Options by using Windows installation disc:

    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.

    On the System Recovery Options menu you will get the following options:
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
      Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)
     
    TimW, Nov 10, 2013
    #2
  3. mirunning

    mirunning Private E-2

    Tim,

    I was able to execute the steps as you recommended. I have attached the FRST.txt log. This was the first time something went right. I am thankfull for your help.
     

    Attached Files:

    mirunning, Nov 10, 2013
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Save fixlist.txt to your flash drive.

    • You should now have both fixlist.txt and FRST.exe on your flash drive.

    Now reboot back into the System Recovery Options as you did previously.
    Run FRST and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt).
    Please attach this to your next message. (See how to attach)

    Now boot into normal Windows can continue with the below.

    Running MGTools.
     

    Attached Files:

    TimW, Nov 11, 2013
    #4
  5. mirunning

    mirunning Private E-2

    Tim,

    I have attached the Fixlog.txt. I was confused by your last statement. "Now boot into normal Windows can continue with the below." I assumed you wanted me to try an boot the laptop normally. If so I tried, but I was still unsucessful. If I was to download MGtools and place it on the root drive then I need some direction on doing so since I still cannot log in under any mode.
     

    Attached Files:

    mirunning, Nov 11, 2013
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Do my original instructions again and get me a new FRST log.
     
    TimW, Nov 11, 2013
    #6
  7. mirunning

    mirunning Private E-2

    Tim,

    Here is the new FRST.log. Thanks again for your assistance.
     

    Attached Files:

    mirunning, Nov 12, 2013
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not finding any malware in your log. Have you tried one of the restore points as indicated in the log?
     
    TimW, Nov 12, 2013
    #8
  9. mirunning

    mirunning Private E-2

    Tim,

    I was unsuccessful with the Restore Point. I tried four different dates for the Restore Points (1 Nov, 31 Oct, 28 Oct and 26 Oct), but none worked.
     
    mirunning, Nov 12, 2013
    #9
  10. mirunning

    mirunning Private E-2

    Tim,
    I think I may have found the issue. The restore point is attempting to pull from the C: drive, but in the Command Prompt that is a reserved drive, and not used. The primary drive is d: (local disk) and I also noticed my recover drive too. This may have been my fat finger when I moved my files over to the external HD and I thought I was creating a folder in the External HD. Is there a way to either delete the C: (System Reserved) drive? I have verified and there is nothing on it? If it can be done from the Command prompt terrific, if not then I will need to use my SATA to USB adapter again. Sorry for the confusion.
     
    mirunning, Nov 12, 2013
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Save fixlist.txt to your flash drive.

    • You should now have both fixlist.txt and FRST.exe on your flash drive.

    Now reboot back into the System Recovery Options as you did previously.
    Run FRST and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt).
    Please attach this to your next message. (See how to attach)

    Now boot into normal Windows


    Fixlist
     
    TimW, Nov 13, 2013
    #11
  12. mirunning

    mirunning Private E-2

    Tim,

    Here you go. Thanks for the help.
     

    Attached Files:

    mirunning, Nov 13, 2013
    #12
  13. mirunning

    mirunning Private E-2

    Tim,

    I had to do another post. I am back in business:). I am grateful for all of your assistance and patience. I will follow the steps Read me and Run me first. The laptop is working again and conducted a Windows update. You saved my laptop from becoming a paper weight- THANK YOU!
     
    mirunning, Nov 13, 2013
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Sorry I missed it on the first go round. Attach the requested log from the Read and Run First sticky and I will check if all is removed. ;)
     
    TimW, Nov 14, 2013
    #14
  15. mirunning

    mirunning Private E-2

    Tim,

    Here are logs for:
    Defogger, RKreport, TDSS, Hitman

    I could not find the log for Malewarebytes or MGlogs.

    Problems:
    (1) I tried to run my AV, McAffee, but it will not open. I then tried to remove it, but a white screen opened and nothing happened.
    (2) Internet Explorer was having problems opening and then I did another Windows update and now I have Internet Explorer 11v.

    The good news is I am using the laptop to send this reply.
     

    Attached Files:

    mirunning, Nov 14, 2013
    #15
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these detections:


    • ¤¤¤ Registry Entries : 8 ¤¤¤
      [RUN][SUSP PATH] HKLM\[...]\Wow6432Node\[...]\Run : ShopAtHomeWatcher (C:\Users\melaw96\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeWatcher.exe [x]) -> FOUND
      [RUN][SUSP PATH] HKLM\[...]\Wow6432Node\[...]\Run : ShopAtHomeUpdater (C:\Users\melaw96\AppData\Roaming\ShopAtHome\ShopAtHomeHelper\ShopAtHomeUpdater.exe [x]) -> FOUND


    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.

    Rerun Hitman and remove all the PUP's.

    Reboot and rescan with both RogueKiller and Hitman. Attach the new logs and tell me how things are running.
     
    TimW, Nov 15, 2013
    #16

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds