Win32:Aluroot-B [Rkt] removed but checking system to be clean

Background:
First, my network connection went out. I replaced NIC thinking the one on the board went out. After replacing that I got connection back after applying a winshock fix and tcp/ip fix, and installing new tcp/ip for connection. Within a few hours AVG was picking up trojan horse crypt.ANVH but was only whitelisting it as it looked to be attached to ipsec.sys.

After running AVG and Malwarebytes (these are the two progams I had to be begin with besides Spybot) and taking off what I could, connection would still keep going out.

I started to perform actions in the read and run first sticky only to see I'd have to remove AVG. In so doing I also downloaded avast and Comodo firewall. avast picked up and began blocking the Win32:Aluroot-B rootkit. I let it run the boot scan and it deleted a number of files/processes associated with the Aluroot-B.

Before proceeding with the read and run first procedures, I took note of other rootkit removals and performed programs TDSSKiller and MBRCheck. I then proceeded with other scans.

My PC doesn't seem to be sending as many packets, I don't have pop-ups coming up, and avast and comodo haven't blocked anything that it was before.

I still want to be sure my PC is clean of rootkits or anything else.

 

Note: Only program I had a hard time with was RootRepeal. After 2 hours it didn't list any files and just didn't seem to do anything. Is this normal ? I just restarted the PC and moved on.

As I said, things seem to be clean and working better now but I wanted to check and to see if I do need the RootRepeal to be ran.

 

Hi and welcome to Major Geeks, riverrat721!

http://img853.imageshack.us/img853/6741/addremovexp.gif From Add/Remove Programs (via Control Panel), please uninstall the below:

• AML Free Registry Cleaner 4.14
• XFINITY Toolbar

http://img823.imageshack.us/img823/2039/msnmsg.gif Please download Disable/Remove Windows Messenger to your desktop.

• Double-click MessengerDisable.exe to run it.
• Place checkmarks in "Uninstall Windows Messenger" and "Hide Messenger from Outlook Express"
• Click Apply
• Click Exit

http://img194.imageshack.us/img194/4930/combofix.gif Fixing items using ComboFix
Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop -- but do not run it.
If it is not on your desktop, the below will not work.
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]Driver::[/COLOR]
Lbd
WRConsumerService
Lavasoft Kernexplorer
Dlallpio
AGCoreService
[COLOR="DarkRed"]FireFox::[/COLOR]
FF - ProfilePath - c:\documents and settings\Nevil Family\Application Data\Mozilla\Firefox\Profiles\y26k21j6.default\
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7Be37d16da-3fcf-4862-92b1-1fed2c0abc04%7D&mid=e2b4e98527d15162dbc03be31b94decc-1d53b6451a217fe04ba11286f289ac1ac0da6924&ds=AVG&v=10.0.0.7&lang=en&pr=fr&d=2011-09-24%2008%3A02%3A34&sap=ku&q=
[COLOR="DarkRed"]Folder::[/COLOR]
c:\windows\$NtUninstallKB64311$
c:\documents and settings\All Users\Application Data\PC Tools
C:\Documents and Settings\Nevil Family\Local Settings\Application Data\AVG Security Toolbar
C:\Documents and Settings\Nevil Family\Local Settings\Application Data\{0011BBC4-A45A-42B1-B6B9-4D7A8E31511A}
C:\Documents and Settings\Nevil Family\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}
C:\Program Files\AGI
C:\Program Files\xfin_portal
C:\Documents and Settings\All Users\Start Menu\Programs\AVG Free Edition
C:\$AVG
C:\WINDOWS\system32\config\systemprofile\Application Data\AVG7
[COLOR="DarkRed"]RegLock::[/COLOR]
[HKEY_USERS\S-1-5-21-3606626649-978186050-994759300-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[COLOR="DarkRed"]RegNull::[/COLOR]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{63BAD34D-E43D-34DE-CF7B4FB1218A8193}\{46DC1FCE-91E4-C154-F7B2B64F1EC4E2B2}\{DF20576E-07F0-1F62-8523FCCC30054B8C}*]
[COLOR="DarkRed"]Registry::[/COLOR]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0BC6E3FA-78EF-4886-842C-5A1258C4455A}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0BC6E3FA-78EF-4886-842C-5A1258C4455A}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{BE41240A-E363-451A-AC14-4CC141282B22}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E519AA1F-E8A8-47ED-92E3-BCFB65055819}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{CF739809-1C6C-47C0-85B9-569DBB141420}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0BC6E3FA-78EF-4886-842C-5A1258C4455A}]

Save this file as CFScript.txt to your desktop. So now you should have both CFScript.txt and ComboFix.exe on your desktop.
Now use your mouse to drag CFScript.txt on top of ComboFix.exe and then release.
http://softvisia.com/users/Night_Raven/Security/cfsdnd2.gif
This will launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Allow ComboFix to update itself if prompted.
When ComboFix finishes, a log will be produced at C:\ComboFix.txt
Attach this log to your next message. (How to attach)

http://img254.imageshack.us/img254/945/baticonxp.gif Now run C:\MGtools\GetLogs.bat by double-clicking it.
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

Let me know how the system is running after you have completed these steps.

 

everything seems to be fine...no pop-ups

 

http://img205.imageshack.us/img205/4783/regeditb.gif Open Notepad and copy everything in the code box below into it.

Code:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{1E73965B-8B48-48be-9C8D-68B920ABC1C4}"=-
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]

• File -> Save As -> Save as type: "All Files" -> File Name: fixme.reg > Save.

Now merge this into the registry by double-clicking it.
Let me know if the merge was successful or not.

If it was successful, proceed with these final cleanup steps:

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!

Be safe

 

merge successful, continuing with final steps

 

Ok