Trojan:DOS/Alureon.A just won't die

I followed the steps here
http://forums.majorgeeks.com/showthread.php?t=252831
http://forums.majorgeeks.com/showthread.php?t=35407
and
http://forums.majorgeeks.com/showthread.php?t=139681

And this nasty fella won't go away. The only thing that detected it, other than Microsoft Security Essentials, was TDSSKiller. But it only gives me the option to skip or delete. I am using a fresh installation of Windows 7 64-Bit on an Alienware M11x R2 (I didn't know what virus I was infected with until after I restored Windows and MSE detected it).

I have also attached my logs. Thanks for the help!

 

And here are the rest of the logs (only lets me attach 4 at a time, sorry for double post)

 

Hi and welcome to Major Geeks, Arcady!

There is an infected partition here:
I highlighted the infected one in red.

Code:

  Partition ###  Type              Size     Offset
  -------------  ----------------  -------  -------
  Partition 1    OEM                 39 MB    31 KB
  Partition 2    Primary             14 GB    40 MB
  Partition 3    Primary            451 GB    14 GB
  [B][COLOR="Red"]Partition 4[/COLOR][/B]    [B][COLOR="Red"]Primary[/COLOR][/B]           [B][COLOR="Red"]1016 KB[/COLOR][/B]   465 GB

We need to remove Partition 4 which is 1016KB.

Here are the steps to resolve this:

Preferably from a clean computer, I need you to download: gparted-live-0.11.0-10.iso (121.1 MB)
Create a bootable CD for GParted. You can use ImgBurn to accomplish this.
If you need help on how to use ImgBurn, please view this guide by dr.m -- Using ImageBurn to Burn an ISO image

Now boot off of the newly created GParted CD.
http://img534.imageshack.us/img534/5492/gpartedsplash011010.th.png
You should be here...
Press ENTER
http://img819.imageshack.us/img819/7286/gpartedkeymaps.th.png
By default, do not touch keymap is highlighted. Leave this setting alone and just press ENTER.
http://img404.imageshack.us/img404/9840/gpartedlanguage.th.png
Choose your language and press ENTER. English is default [33]
http://img140.imageshack.us/img140/7958/gpartedgui.th.png
Once again, at this prompt, press ENTER
You will now be taken to the main GUI screen below
http://img32.imageshack.us/img32/1122/gpartedo.th.png
According to your logs, the partition that you want to delete is 0.99 MiB (0.99 MB)
Click the trash can icon to delete and then click Apply.
You should now be here confirming your actions:
http://img233.imageshack.us/img233/1533/gpartedsteps.th.png
Now you should be here:
http://img696.imageshack.us/img696/8471/gpartedsuccessclose.th.png
Is boot next to your OS drive? According to your logs, your OS drive is the 451 GiB sized partition.
http://img194.imageshack.us/img194/7753/gpartedboot.th.png
If boot is not next to your OS drive under Flags, right-mouse click the OS drive while in Gparted and select Manage Flags


In the menu that pops up, place a checkmark in boot like the picture below:
http://img196.imageshack.us/img196/3483/gpartedmanageflagsboot.th.png
Now press the Close button to save these changes.
Now double-click the http://img715.imageshack.us/img715/641/gpartedexit.png button.
You should receive a small pop up like this:
http://img88.imageshack.us/img88/8986/gpartedexitreboot.png
Choose reboot and then press OK.

Once you have rebooted...

http://img600.imageshack.us/img600/2693/mgtools.gif Now download the latest MGtools.exe to the root of your c: drive.

• Replace your existing MGtools.exe with this one.
• Now run this new MGtools.exe by double-clicking it. (Vista/7 right-click and select Run as Administrator)
• When it is finished, attach c:\MGlogs.zip to your next message. (How to attach)

 

Thank you for the quick reply!
I don't currently own a clean CD to get this done, but I will definitely buy one tomorrow and inform you of the results. How much time do you think I have before the virus starts giving me trouble? This computer was reformatted 3 days ago and completely clean except for that one virus.
Thanks again for the help

 

Once the partition is removed, I think the vast majority of your computer problems will go away. There may be a file or two left behind on your actual OS partition that we need to remove but these have typically been very "light" traces of malware and not difficult to remove.

 

Seems like I've finally gotten rid of this pest thanks to your amazing help! Here are my logs. I've renamed MGlogs to MGlogs2 because when I try to attach a file it keeps telling me that I've already uploaded MGlogs before. Any further instructions?

 

You're welcome.

http://img196.imageshack.us/img196/3557/tdsskiller.gif Re-scan with TDSSKiller with the parameters you used before.
This time if TDSS File System appears, delete it!
Then attach the latest TDSSKiller log. (How to attach)

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!

Be safe

 

Woah, so the file did show up again on the TDSS Killer, I selected Delete and then right after I applied the action, MSE detected 4 variations of Alure :confused it then supposedly removed them. But I don't know if it really did remove them. :cry
I attached the logs and the pictures when MSE detected the files and after it allegedly removed them.
Thanks again for your great help!

 

MSE is just detecting what TDSSKiller already quarantined.
Run TDSSKiller until TDSS File System no longer shows and then start the cleanup procedure.

Once you get around to running MGclean .batit will also empty the TDSSKiller Quarantine folder

 

Allright! TDSSKiller no longer shows the infection. I will begin the cleanup procedure right away. Thank you so much! :major

 

You're welcome