Alureon and other infections windows 7

Laptop got a virus 5 days ago been trying on my own with MSE and Malwarebytes but with no luck. Laptop goes into startup repair/system restore after restart to remove virus. MSE reported Alureon.fp and Malwarebytes reports Backdoor.Multi.ZAccess.gen.
Everything I've done brings me back to this cycle of; scan,restart,startup repair,system restore.

 

Welcome to Major Geeks, Crash752

http://img827.imageshack.us/img827/1263/frst.gif For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Choose your language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:

• Insert the installation disc.
• Restart your computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Choose your language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst64 and press Enter
• Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please attach this log to your next reply. (How to attach)

 

Thanks for the welcome thisisu don't know why it took me so long to come to these forums, realy appreciate the help.

 

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attached is fixlist.txt

• Save fixlist.txt to your flash drive.
• You should now have both fixlist.txt and FRST64.exe on your flash drive.

Now re-enter System Recovery Options.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (How to attach)

Now attempt to boot normally.

Now continue with this procedure: How to Remove TrojanOS/Alureon.A

 

Here's the Fixlog.txt moving through the http://forums.majorgeeks.com/showthread.php?t=252831 thread now.

 

Ok

 

Ran superantispyware and malwarebytes and combofix, after combofix scanned it's been hanging at a black screen with cursor for about 2 hrs not sure what to do. wanted your opinion first thanks

 

Reboot.

 

Rebooted all scans complete. Seems ok but haven't poked around yet not sure if I'm missing some hidden infection though.

 

Spoke to soon. Microsoft reported an error and had to restart. Won't let me start in normal mode or safe mode enters startup repair asking for system restore.

 

http://img827.imageshack.us/img827/1263/frst.gif Run a new scan with FRST.
Attach the new FRST.txt when finished.

When was the Microsoft error reported? Was the system idle?

 

new scan

 

sorry system was idle, it reported an error not long after combofix finished after reboot.

 

http://img827.imageshack.us/img827/1263/frst.gif New fixlist.txt attached

You forgot the scans from the How to Remove TrojanOS/Alureon.A thread (TDSSKiller and MBRCheck)

Please do this one immediately after getting back into Windows:

http://img196.imageshack.us/img196/3557/tdsskiller.gif I want you to read and follow these instructions: TDSSKiller - How to run

 

Thought I had run those earlier but here they are. TDSSkiller came back negetive.

 

No problem.

http://img196.imageshack.us/img196/3557/tdsskiller.gif Rescan with TDSSKiller using the Detect TDLFS File System option.

http://img827.imageshack.us/img827/1263/frst.gif I'd also like to review the latest Fixlog.txt from FRST so attach this as well.

 

Oh must have unchecked those :-o

 

These look good.

Experiment with the PC for as long as needed and let me know when you are ready for final cleanup steps or if you run into another problem.

 

Thank you doesn't even cut it! But thank you so much, this was driving me nuts! Will play around with it and if anything pops up I'll report :major
Should I hold off on the final cleanup or do it now?

 

You're welcome.

Hold off until you are aren't noticing any other malware related problems.

Here are the cleanup steps for when you are ready.

__

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it is present
8. Delete the C:\FRST folder if it is present.
9. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
10. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
    • Refer to the cleaning procedures pointed to by step 7 of the READ ME
      for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
11. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!

Be safe