DOS\Alureon.a removal shows Windows 2008 MBR code

Discussion in 'Malware Help (A Specialist Will Reply)' started by onabeach, Dec 14, 2012.

  1. onabeach

    onabeach Private E-2

    Recently found out I had DOS/alureon.a trojan while running MSE scan. MGscan says: Windows 2008 MBR code detected. In early November, I got wireless internet for the 1st time ever and downloaded Freecorder. This time, lots of malware came with it – Babylon Toolbar, Claro Search, Sweet IM search and related things, Strongvault, and RealPlayer. I got rid of all that stuff the best I could, running MBAR and MBAM, chameleon, Advanced Uninstaller, and MSE. Maybe I messed up my computer more by using Advance Uninstaller?

    The reason I ask is because in between the early November Freecorder disaster and the recent Alureon Trojan, I began experiencing very slow cable download speeds of less than 1mgps in Normal mode, but cable technician tested it at 10mg in Safe mode. My computer was barely usable. I had very slow boot and application loads when in normal mode, webstream music youtubes etc. would barely play, if at all. But, I had quick everything while in safe mode and high download speed nearing 10 mb. So, I was told by the cable technician that this was a computer issue not a wireless issue. (By the end of the story this has changed). Also, I left my computer plugged in and charging, while using it for days on end, listening to music all day and all night, so there’s a small area of plastic on the deck of my laptop that melted, and black plastic melts repeatedly onto the silver insertable end of the charging cable sometimes. Needless to say I watch it pretty carefully. So, I don’t know if wireless and computer boot up speed issues are the result of hardware issues or malware issues. Currently, after getting rid of the Trojan several days ago (I think), the cable guy tested the laptop again and discovered that it gets the normal 10 mg download speed when he put it on wired internet, but less than 1 mg. on wireless connection, for BOTH Normal and Safe mode. So, number one, I don’t know if computer is clean, and secondly, if malware or hardware is causing the wireless connectivity problems? You people are AWESOME, if only I could KNOW more! (and if only I had any money I could just buy a new laptop!) Also, I guess I need to add something that works in real time to tell you if you’ve been infected, like the Computer Associates Security package I used to use. What would you recommend? I would have thought MSE would have done this, but I guess not. Also, I wonder how dangerous the overheating batter / charging cable / melting problem is?
    Lastly, because I was never sure if I did the scan right, or if I did it in administrator mode, I have lots of logs for each application except TDSS which only produced 1 very early one. SORRYYYY!! I had planned on posting them earliest to latest, but since I had to choose I chose the first log for every application. I figure this is the worst case scenario, and maybe its fixed now, but since I can't post all the logs, I had to choose. Thanks in advance for any help!
     
    Last edited: Dec 14, 2012
  2. onabeach

    onabeach Private E-2

    Thought there was an hour to edit, not 10 minutes! Had to change logs to earliest administrator log run. Instead of last log run for every application. Sorry, I have 5 or 7 for some of them. Also edited the text to explain certain things better, but that is lost.:)
     

    Attached Files:

  3. onabeach

    onabeach Private E-2

    geez, now it took OFF the ORIGINAL 5 attachments I was attempting to replace by my edit (that the system didn't take), so I responded to my 1st thread. Then, one of the original 5 attachments that was actually correct was now missing. So, now I'm attempting to attach all 5 again, but it won't let me, saying that Hitmanpro was already attached. I don't know what else to do. Sorry!
     

    Attached Files:

  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Do not worry about that, sometimes the tools don't report accurately about that. I can see you are running Win 7.

    Delete these folders:

    • C:\ProgramData\Babylon
    • C:\ProgramData\SweetIM
    • C:\Program Files (x86)\SweetIM
    • C:\Program Files (x86)\~BabylonToolbar

    Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
     
  5. onabeach

    onabeach Private E-2

    Thanks Kestral13!! So far so good. Got success message with registry fix. Bad at following directions tho. Ran MGlogs bat file and saw that it said Marsha and not Administrator, so ran it again, this time as administrator. It still said Marsha, so put UAC back to off and ran a 3rd time.

    Questions - I saw the diagnostics running. Appeared to be testing communications. So, any chance my horrible wireless problems were the malware?
    And, since my computer has sensitive personal information of clients, should I assume the worst and warn them all that I could have had malware that resulted in their identity theft? :( Is there any way to tell what information was off loaded during the time the computer was compromised?

    I'll repost later once out of safe mode as to how its running now.:)
     

    Attached Files:

  6. onabeach

    onabeach Private E-2

    Well, it runs WAY better than the time period of a few days (I think) during which I had the trojan. During that time, I sometimes couldn't go on line or open applications. Things ran in slo mo if at all. I can now open applications and go online. Because of my issues of not knowing what problems are hardware and what problems are malware, I would have to say its pretty much the same as pre-trojan, because all I use it for is streaming live web music. The computer is pretty much useless as a laptop now because of the wireless <1mb connection speed and melting charger cable plugin sleeve issues. I'm so very grateful! Now if I could only find a solution to the other 2 issues, I'll have my laptop back! Another great thing because of your help, I can safely get the data off of it without worrying about infecting my other computer! I downloaded a bunch of files onto a USB drive during the infection tho. Should I run all the malware programs on the drive?
     
  7. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Not necessary I don't think. :)
    No, I don't think you were infected that badly anyway to be fair.
    If you wish, but you must start a new thread.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 6 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds