Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Win32/Alureon.H and Selace Trojan HELP!


  • Please log in to reply
7 replies to this topic

#1 SlippyB

SlippyB

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:29 PM

Posted 24 June 2010 - 06:06 PM

My computer has been giving me problems, randomly I will get "Host Process has stopped working" or my Windows Explorer will stop working. I started getting redirects when I was looking up help online. I ran Malwarebytes, Ad-Aware, and MSE but they didn't find anything. Microsoft OneLive found the following, but was unable to remove them.

Trojan:Java/CVE-2009-38 67
Trojan:Java/Selace:A
Trojan:Java/Selace:B
TrojanDownloader:Java/OpenStream.f
Virus:win32/Alureon.H

From what I have read these are very hard to get rid of, but I would like to try - I do not want to have to format and reinstall windows and would only want to do that as a last resort. Not sure how I got the viruses, I try to be pretty safe when online, I think it may have been a fake java update?

Hope someone can help me, I've read some of the forums here and have seen others with similar problems get solved, just let me know what more info you will need and what I will have to do and I will get that to you.

Thanks.

BA

BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,573 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:29 PM

Posted 25 June 2010 - 12:02 AM

Hello and welcome... You need to do all the steps as some pertain to your issue..
Please follow our Removal Guide here How to remove the TDSS, TDL3, or Alureon rootkit
You will move to the Automated Removal Instructions

After you completed that, post your scan log here,let me know how things are.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 SlippyB

SlippyB
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:29 PM

Posted 25 June 2010 - 02:22 PM

Thank you for your assistance! Before I got a reply here I went ahead and ran MSE in Safe Mode and it found and removed all of the Trojans I listed but did not find Alureon.H. I followed your directions and ran the TDSS Kill program and it found and removed "pci.sys". I then rebooted and ran Malwarebytes and it didn't find anything (though it didn't find anything before either.) Here is the log. Don't know if I am in the clear as I haven't had a chance to run my computer since then, though it did run all night long during the scan and there were no Windows Explorer or Host Process errors the next morning, where as before these errors would pop up within 10 min.


------------------------------------


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4235

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18928

6/25/2010 3:40:51 AM
mbam-log-2010-06-25 (03-40-51).txt

Scan type: Full scan (C:\|)
Objects scanned: 477131
Time elapsed: 1 hour(s), 55 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,573 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:29 PM

Posted 25 June 2010 - 09:49 PM

So how is it now ? I believe you removed a TDDS infection in your C:\Windows\System32\drivers\ pci.sys.
So we should be free of the original issue..

Let's do an online scan before we go.
ESET
Please perform a scan with Eset Online Antiivirus Scanner.
(Requires Internet Explorer to work. If given the option, choose "Quarantine" instead of delete.)
Vista users need to run Internet Explorer as Administrator. Right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.
  • Click the green ESET Online Scanner button.
  • Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
  • Click on the Start button next to it.
  • You may receive an alert on the address bar that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then click Insall ActiveX component.
  • A new window will appear asking "Do you want to install this software?"".
  • Answer Yes to download and install the ActiveX controls that allows the scan to run.
  • Click Start.
  • Check Remove found threats and Scan potentially unwanted applications.
  • Click Scan to start. (please be patient as the scan could take some time to complete)
  • If offered the option to get information or buy software. Just close the window.
  • When the scan has finished, a log.txt file will be created and automatically saved in the C:\Program Files\ESET\ESET Online Scanner\log.txt
    folder.
  • Click Posted Image > Run..., then copy and paste this command into the open box: C:\Program Files\ESET\EsetOnlineScanner\log.txt
  • The scan results will open in Notepad. Copy and paste the contents of log.txt in your next reply.
Note: Some online scanners will detect existing anti-virus software and refuse to cooperate. You may have to disable the real-time protection components of your existing anti-virus and try running the scan again. If you do this, remember to turn them back on after you are finished.

Edited by boopme, 26 June 2010 - 08:56 AM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 SlippyB

SlippyB
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:29 PM

Posted 26 June 2010 - 01:21 AM

So far I have had no further issues, I can even go to the Windows Update page now with no problems, and my windows auto-update just informed me of a new update. Have had no redirects all night. Looks good thanks!!

:thumbsup:

Here is my latest log, found no threats.

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=ba15c39804fd874ca553d06ccdc40a09
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-06-26 05:01:47
# local_time=2010-06-26 12:01:47 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=5892 16776574 100 100 0 114129837 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=391477
# found=0
# cleaned=0
# scan_time=6198

#6 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,573 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:29 PM

Posted 26 June 2010 - 08:57 AM

Excellent.... :thumbsup:
Now you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been backed up, renamed and saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Go to Start > Run and type: Cleanmgr
  • Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  • Click the "More Options" tab, then click the "Clean up" button under System Restore.
  • Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  • Click Yes, then click Ok.
  • Click Yes again when prompted with "Are you sure you want to perform these actions?"
  • Disk Cleanup will remove the files and close automatically.
Vista and Windows 7 users can refer to these links: Create a New Restore Point in Vista or Windows 7 and Disk Cleanup in Vista.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 SlippyB

SlippyB
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:29 PM

Posted 28 June 2010 - 01:05 AM

Everything is still running clean - THANK YOU!

#8 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,573 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:04:29 PM

Posted 28 June 2010 - 03:34 PM

You're welcome from all of us here at BC. We are glad to have helped.
Please take a few minutes to read our quietman7's excellent Tips to protect yourself against malware and reduce the potential for re-infection:,in post 17. :thumbsup:
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users