Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with DOS/Alureon and Win32/Alureon


  • This topic is locked This topic is locked
4 replies to this topic

#1 Clinenator

Clinenator

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:33 AM

Posted 21 January 2012 - 10:50 PM

I have a Dell Studio XPS with x64 Win7. Somehow I have managed to get DOS/Alureon and Win32/Alureon. The Malicious Removal Tool can find the problem, but has only been able to "partially remove it". I have also tried tdsskiller with no success. I've also run the following command prompt commands after using the repair option when booting to my Win7 install disk:

bcdedit /export c:\BCD_Backup
c:
cd boot
attrib bcd -s -h -r
ren c:\boot\bcd bcd.old
bootrec /RebuildBcd

bootrec /FixMbr

bootrec /Fixboot

bootrec /RebuildBcd

I have also run a Microsoft Security Essentials scan where I boot to a jump drive, but I get the following error when trying to remove the problem it found:

This program is blocked by group policy. For more information contact your system administrator.

All of this after I reformatted to remove it. My DDS Log can be found below. Any help is greatly appreciated. Thanks!

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Mark at 21:27:57 on 2012-01-21
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.4061.2585 [GMT -6:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
C:\Windows\system32\mfevtps.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Windows\system32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\LogonUI.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\AIM\aim.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
mWinlogon: Userinit=userinit.exe
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120120003131.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
uRun: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US
uRun: [Google Update] "C:\Users\Mark\AppData\Local\Google\Update\GoogleUpdate.exe" /c
mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
StartupFolder: C:\Users\Mark\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files (x86)\Dell\DellDock\DellDock.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{C9D8AC72-5A68-494C-AFBD-86C9D422CB09} : DhcpNameServer = 192.168.1.1
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\MSC\McSnIePl.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll
BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120120003131.dll
BHO-X64: scriptproxy - No File
BHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\uf7rr43h.default\
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
FF - plugin: c:\progra~2\mcafee\msc\npMcSnFFPl.dll
FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
FF - plugin: C:\Program Files (x86)\McAfee\SiteAdvisor\NPMcFFPlg32.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: C:\Users\Mark\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: C:\Users\Mark\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
FF - plugin: C:\Users\Mark\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]
R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]
R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2010-1-11 155648]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-1-20 249936]
R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-1-20 249936]
R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-1-20 249936]
R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-1-20 249936]
R2 McShield;McAfee McShield;C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe [2012-1-20 199272]
R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [2012-1-20 208536]
R2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]
R3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]
R3 itecir;ITECIR Infrared Receiver;C:\Windows\system32\DRIVERS\itecir.sys --> C:\Windows\system32\DRIVERS\itecir.sys [?]
R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\k57nd60a.sys --> C:\Windows\system32\DRIVERS\k57nd60a.sys [?]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]
R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]
R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2012-01-22 04:38:20 -------- d-----w- C:\Windows\Microsoft Antimalware
2012-01-22 04:38:17 -------- d-----w- C:\Windows\Windows Defender Offline
2012-01-22 02:34:29 -------- d-----w- C:\Windows\SysWow64\Wat
2012-01-22 02:34:29 -------- d-----w- C:\Windows\System32\Wat
2012-01-22 02:15:14 -------- d-----w- C:\Users\Mark\AppData\Roaming\Malwarebytes
2012-01-22 02:15:05 -------- d-----w- C:\ProgramData\Malwarebytes
2012-01-22 02:15:02 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-01-22 02:15:02 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-01-22 02:04:53 -------- d-----w- C:\Users\Mark\AppData\Local\Diagnostics
2012-01-22 01:07:28 367104 ----a-w- C:\Windows\System32\wcncsvc.dll
2012-01-22 01:07:28 276992 ----a-w- C:\Windows\SysWow64\wcncsvc.dll
2012-01-22 01:06:10 -------- d-----w- C:\TDSSKiller_Quarantine
2012-01-22 01:04:34 311808 ----a-w- C:\Windows\System32\msv1_0.dll
2012-01-22 01:04:34 257024 ----a-w- C:\Windows\SysWow64\msv1_0.dll
2012-01-22 01:01:28 99176 ----a-w- C:\Windows\SysWow64\PresentationHostProxy.dll
2012-01-22 01:01:28 49472 ----a-w- C:\Windows\SysWow64\netfxperf.dll
2012-01-22 01:01:28 48960 ----a-w- C:\Windows\System32\netfxperf.dll
2012-01-22 01:01:28 444752 ----a-w- C:\Windows\System32\mscoree.dll
2012-01-22 01:01:28 320352 ----a-w- C:\Windows\System32\PresentationHost.exe
2012-01-22 01:01:28 297808 ----a-w- C:\Windows\SysWow64\mscoree.dll
2012-01-22 01:01:28 295264 ----a-w- C:\Windows\SysWow64\PresentationHost.exe
2012-01-22 01:01:28 1942856 ----a-w- C:\Windows\System32\dfshim.dll
2012-01-22 01:01:28 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll
2012-01-22 01:01:28 109912 ----a-w- C:\Windows\System32\PresentationHostProxy.dll
2012-01-21 23:19:19 -------- d-----w- C:\Users\Mark\.thumbnails
2012-01-21 23:17:11 -------- d-----w- C:\Users\Mark\.gimp-2.6
2012-01-21 22:21:14 1975296 ----a-w- C:\Windows\System32\CertEnroll.dll
2012-01-21 22:21:14 1320960 ----a-w- C:\Windows\SysWow64\CertEnroll.dll
2012-01-21 22:21:09 1572864 ----a-w- C:\Windows\System32\quartz.dll
2012-01-21 22:21:09 1328640 ----a-w- C:\Windows\SysWow64\quartz.dll
2012-01-21 22:21:07 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll
2012-01-21 22:21:07 366592 ----a-w- C:\Windows\System32\qdvd.dll
2012-01-21 22:20:19 2080256 ----a-w- C:\Program Files\Windows Mail\msoe.dll
2012-01-21 22:20:19 1619968 ----a-w- C:\Program Files (x86)\Windows Mail\msoe.dll
2012-01-21 22:20:09 552960 ----a-w- C:\Windows\System32\msdri.dll
2012-01-21 22:20:05 1897328 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2012-01-21 22:20:00 2003968 ----a-w- C:\Windows\System32\msxml6.dll
2012-01-21 22:20:00 1880576 ----a-w- C:\Windows\System32\msxml3.dll
2012-01-21 22:18:57 499712 ----a-w- C:\Windows\System32\drivers\afd.sys
2012-01-21 22:16:59 613888 ----a-w- C:\Windows\System32\psisdecd.dll
2012-01-21 22:15:59 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
2012-01-21 22:11:46 976896 ----a-w- C:\Windows\System32\inetcomm.dll
2012-01-21 22:11:45 740864 ----a-w- C:\Windows\SysWow64\inetcomm.dll
2012-01-21 22:11:16 5507968 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-01-21 22:11:15 3957120 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-01-21 22:11:15 3902336 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-01-21 22:09:14 3141632 ----a-w- C:\Windows\System32\win32k.sys
2012-01-21 22:08:47 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe
2012-01-21 22:08:19 77312 ----a-w- C:\Windows\System32\packager.dll
2012-01-21 22:08:18 67072 ----a-w- C:\Windows\SysWow64\packager.dll
2012-01-21 22:08:16 9728 ----a-w- C:\Windows\SysWow64\sscore.dll
2012-01-21 22:08:16 236032 ----a-w- C:\Windows\System32\srvsvc.dll
2012-01-21 22:08:10 31232 ----a-w- C:\Windows\SysWow64\prevhost.exe
2012-01-21 22:08:10 31232 ----a-w- C:\Windows\System32\prevhost.exe
2012-01-21 17:58:24 243712 ----a-w- C:\Windows\System32\drivers\ks.sys
2012-01-21 17:58:24 184832 ----a-w- C:\Windows\System32\drivers\usbvideo.sys
2012-01-21 00:19:43 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-01-20 07:18:57 0 ----a-w- C:\Windows\ativpsrm.bin
2012-01-20 07:16:47 -------- d-----w- C:\Windows\Panther
2012-01-20 07:16:32 -------- d-sh--w- C:\Boot
2012-01-20 06:49:56 -------- d-----w- C:\Program Files (x86)\GIMP-2.0
2012-01-20 06:42:14 -------- d-----w- C:\Users\Mark\AppData\Local\Google
2012-01-20 06:37:07 -------- d-----w- C:\Users\Mark\AppData\Roaming\Dell
2012-01-20 06:36:14 -------- d-----w- C:\Users\Mark\AppData\Local\Stardock_Corporation
2012-01-20 06:36:07 -------- dc-h--w- C:\ProgramData\{CBCE2F73-24E4-481F-84B2-1A5EB720D187}
2012-01-20 06:35:52 -------- d-----w- C:\Program Files\Dell
2012-01-20 06:35:46 -------- d-sh--w- C:\Windows\Installer
2012-01-20 06:35:27 -------- d-----w- C:\Users\Mark\AppData\Local\PackageAware
2012-01-20 06:31:42 -------- d-----w- C:\Program Files (x86)\McAfee.com
2012-01-20 06:31:31 28760 ----a-w- C:\Program Files (x86)\Mozilla Firefox\ScriptFF.dll
2012-01-20 06:31:31 10248 ----a-w- C:\Windows\System32\drivers\mfeclnk.sys
2012-01-20 06:31:30 -------- d-----w- C:\Program Files (x86)\Common Files\McAfee
2012-01-20 06:31:02 75808 ----a-w- C:\Windows\System32\drivers\mfenlfk.sys
2012-01-20 06:31:02 65264 ----a-w- C:\Windows\System32\drivers\cfwids.sys
2012-01-20 06:31:02 481768 ----a-w- C:\Windows\System32\drivers\mfefirek.sys
2012-01-20 06:31:02 284648 ----a-w- C:\Windows\System32\drivers\mfewfpk.sys
2012-01-20 06:31:02 229528 ----a-w- C:\Windows\System32\drivers\mfeavfk.sys
2012-01-20 06:31:02 100912 ----a-w- C:\Windows\System32\drivers\mferkdet.sys
2012-01-20 06:30:59 -------- d-----w- C:\Program Files\Common Files\McAfee
2012-01-20 06:30:58 -------- d-----w- C:\Program Files\McAfee.com
2012-01-20 06:30:58 -------- d-----w- C:\Program Files\McAfee
2012-01-20 06:30:57 -------- d-----w- C:\Program Files (x86)\McAfee
2012-01-20 06:09:38 161168 ----a-w- C:\Windows\System32\mfevtps.exe
2012-01-20 05:48:17 -------- d-----w- C:\Users\Mark\AppData\Local\Thunderbird
2012-01-20 05:45:45 8602168 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{99AEBAE7-446B-4E1D-BD94-878ABBA8211F}\mpengine.dll
2012-01-20 05:45:43 270720 ------w- C:\Windows\System32\MpSigStub.exe
2012-01-20 05:31:29 -------- d-----w- C:\Users\Mark\AppData\Local\AOL
2012-01-20 05:31:29 -------- d-----w- C:\Users\Mark\AppData\Local\AIM
2012-01-20 05:31:17 -------- d-----w- C:\ProgramData\AIM
2012-01-20 05:31:15 -------- d-----w- C:\Program Files (x86)\Common Files\Software Update Utility
2012-01-20 05:31:15 -------- d-----w- C:\Program Files (x86)\AIM
2012-01-20 05:31:14 -------- d-----w- C:\Program Files (x86)\Common Files\AOL
2012-01-20 05:30:22 -------- d-----w- C:\Users\Mark\AppData\Local\Mozilla
2012-01-20 05:25:51 220672 ----a-w- C:\Windows\System32\wintrust.dll
2012-01-20 05:25:51 172032 ----a-w- C:\Windows\SysWow64\wintrust.dll
2012-01-20 05:25:51 139264 ----a-w- C:\Windows\System32\cabview.dll
2012-01-20 05:25:51 132608 ----a-w- C:\Windows\SysWow64\cabview.dll
.
==================== Find3M ====================
.
2011-12-21 00:02:26 4448256 ----a-w- C:\Windows\SysWow64\GPhotos.scr
2011-11-17 07:14:10 1739160 ----a-w- C:\Windows\System32\ntdll.dll
2011-11-17 05:41:38 1292592 ----a-w- C:\Windows\SysWow64\ntdll.dll
2011-11-05 05:17:42 2048 ----a-w- C:\Windows\System32\tzres.dll
2011-11-05 04:30:11 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2011-10-26 05:19:07 43520 ----a-w- C:\Windows\System32\csrsrv.dll
.
============= FINISH: 21:28:50.32 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,627 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:33 AM

Posted 27 January 2012 - 10:55 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

Posted Image In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/439364 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

Posted Image If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 Clinenator

Clinenator
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:33 AM

Posted 27 January 2012 - 11:16 PM

I have a Dell Studio XPS with x64 Win7. Somehow I have managed to get DOS/Alureon and Win32/Alureon. The Malicious Removal Tool can find the problem, but has only been able to "partially remove it". I have also tried tdsskiller with no success. I've also run the following command prompt commands after using the repair option when booting to my Win7 install disk:

bcdedit /export c:\BCD_Backup
c:
cd boot
attrib bcd -s -h -r
ren c:\boot\bcd bcd.old
bootrec /RebuildBcd

bootrec /FixMbr

bootrec /Fixboot

bootrec /RebuildBcd

I have also run a Microsoft Security Essentials scan where I boot to a jump drive, but I get the following error when trying to remove the problem it found:

This program is blocked by group policy. For more information contact your system administrator.

All of this after I reformatted to remove it. My DDS Log can be found below. Any help is greatly appreciated. Thanks!

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by Mark at 22:07:27 on 2012-01-27
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.4061.2164 [GMT -6:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
C:\Windows\system32\mfevtps.exe
C:\Windows\system32\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\AIM\aim.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
c:\PROGRA~1\mcafee\msc\mcupdmgr.exe
c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Mark\AppData\Roaming\Juniper Networks\Setup Client\JuniperSetupClient.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\taskhost.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
mWinlogon: Userinit=userinit.exe
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120122113054.dll
BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
uRun: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US
uRun: [Google Update] "C:\Users\Mark\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
StartupFolder: C:\Users\Mark\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files (x86)\Dell\DellDock\DellDock.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://rcconnect.rockwellcollins.com/dana-cached/sc/JuniperSetupClient.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{C9D8AC72-5A68-494C-AFBD-86C9D422CB09} : DhcpNameServer = 192.168.1.1
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\McAfee\MSC\McSnIePl.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\McAfee\SITEAD~1\McIEPlg.dll
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120122113054.dll
BHO-X64: scriptproxy - No File
BHO-X64: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO-X64: SkypeIEPluginBHO - No File
BHO-X64: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
TB-X64: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll
mRun-x64: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\uf7rr43h.default\
FF - prefs.js: browser.search.selectedEngine - Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=mcafee&p=
FF - plugin: c:\progra~2\mcafee\msc\npMcSnFFPl.dll
FF - plugin: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll
FF - plugin: C:\Program Files (x86)\McAfee\SiteAdvisor\NPMcFFPlg32.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dll
FF - plugin: C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: C:\Users\Mark\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: C:\Users\Mark\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
FF - plugin: C:\Users\Mark\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\system32\drivers\mfehidk.sys --> C:\Windows\system32\drivers\mfehidk.sys [?]
R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\system32\drivers\mfewfpk.sys --> C:\Windows\system32\drivers\mfewfpk.sys [?]
R1 mfenlfk;McAfee NDIS Light Filter;C:\Windows\system32\DRIVERS\mfenlfk.sys --> C:\Windows\system32\DRIVERS\mfenlfk.sys [?]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2010-1-11 155648]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-1-20 249936]
R2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-1-20 249936]
R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-1-20 249936]
R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [2012-1-20 249936]
R2 McShield;McAfee McShield;C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe [2012-1-20 199272]
R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe [2012-1-20 208536]
R2 mfevtp;McAfee Validation Trust Protection Service;"C:\Windows\system32\mfevtps.exe" --> C:\Windows\system32\mfevtps.exe [?]
R3 cfwids;McAfee Inc. cfwids;C:\Windows\system32\drivers\cfwids.sys --> C:\Windows\system32\drivers\cfwids.sys [?]
R3 itecir;ITECIR Infrared Receiver;C:\Windows\system32\DRIVERS\itecir.sys --> C:\Windows\system32\DRIVERS\itecir.sys [?]
R3 k57nd60a;Broadcom NetLink ™ Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\k57nd60a.sys --> C:\Windows\system32\DRIVERS\k57nd60a.sys [?]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\system32\drivers\mfeavfk.sys --> C:\Windows\system32\drivers\mfeavfk.sys [?]
R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\system32\drivers\mfefirek.sys --> C:\Windows\system32\drivers\mfefirek.sys [?]
R3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\system32\drivers\mferkdet.sys --> C:\Windows\system32\drivers\mferkdet.sys [?]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2012-01-27 19:57:38 -------- d-----w- C:\Users\Mark\AppData\Roaming\Juniper Networks
2012-01-23 04:34:10 -------- d-----r- C:\Program Files (x86)\Skype
2012-01-22 18:27:07 -------- d-----w- C:\Windows\SysWow64\Adobe
2012-01-22 04:38:20 -------- d-----w- C:\Windows\Microsoft Antimalware
2012-01-22 04:38:17 -------- d-----w- C:\Windows\Windows Defender Offline
2012-01-22 02:34:29 -------- d-----w- C:\Windows\SysWow64\Wat
2012-01-22 02:34:29 -------- d-----w- C:\Windows\System32\Wat
2012-01-22 02:15:14 -------- d-----w- C:\Users\Mark\AppData\Roaming\Malwarebytes
2012-01-22 02:15:05 -------- d-----w- C:\ProgramData\Malwarebytes
2012-01-22 02:15:02 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-01-22 02:15:02 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-01-22 02:04:53 -------- d-----w- C:\Users\Mark\AppData\Local\Diagnostics
2012-01-22 01:07:28 367104 ----a-w- C:\Windows\System32\wcncsvc.dll
2012-01-22 01:07:28 276992 ----a-w- C:\Windows\SysWow64\wcncsvc.dll
2012-01-22 01:06:10 -------- d-----w- C:\TDSSKiller_Quarantine
2012-01-22 01:04:34 311808 ----a-w- C:\Windows\System32\msv1_0.dll
2012-01-22 01:04:34 257024 ----a-w- C:\Windows\SysWow64\msv1_0.dll
2012-01-22 01:01:28 99176 ----a-w- C:\Windows\SysWow64\PresentationHostProxy.dll
2012-01-22 01:01:28 49472 ----a-w- C:\Windows\SysWow64\netfxperf.dll
2012-01-22 01:01:28 48960 ----a-w- C:\Windows\System32\netfxperf.dll
2012-01-22 01:01:28 444752 ----a-w- C:\Windows\System32\mscoree.dll
2012-01-22 01:01:28 320352 ----a-w- C:\Windows\System32\PresentationHost.exe
2012-01-22 01:01:28 297808 ----a-w- C:\Windows\SysWow64\mscoree.dll
2012-01-22 01:01:28 295264 ----a-w- C:\Windows\SysWow64\PresentationHost.exe
2012-01-22 01:01:28 1942856 ----a-w- C:\Windows\System32\dfshim.dll
2012-01-22 01:01:28 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll
2012-01-22 01:01:28 109912 ----a-w- C:\Windows\System32\PresentationHostProxy.dll
2012-01-21 23:19:19 -------- d-----w- C:\Users\Mark\.thumbnails
2012-01-21 23:17:11 -------- d-----w- C:\Users\Mark\.gimp-2.6
2012-01-21 22:21:14 1975296 ----a-w- C:\Windows\System32\CertEnroll.dll
2012-01-21 22:21:14 1320960 ----a-w- C:\Windows\SysWow64\CertEnroll.dll
2012-01-21 22:21:09 1572864 ----a-w- C:\Windows\System32\quartz.dll
2012-01-21 22:21:09 1328640 ----a-w- C:\Windows\SysWow64\quartz.dll
2012-01-21 22:21:07 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll
2012-01-21 22:21:07 366592 ----a-w- C:\Windows\System32\qdvd.dll
2012-01-21 22:20:19 2080256 ----a-w- C:\Program Files\Windows Mail\msoe.dll
2012-01-21 22:20:19 1619968 ----a-w- C:\Program Files (x86)\Windows Mail\msoe.dll
2012-01-21 22:20:09 552960 ----a-w- C:\Windows\System32\msdri.dll
2012-01-21 22:20:05 1897328 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2012-01-21 22:20:00 2003968 ----a-w- C:\Windows\System32\msxml6.dll
2012-01-21 22:20:00 1880576 ----a-w- C:\Windows\System32\msxml3.dll
2012-01-21 22:18:57 499712 ----a-w- C:\Windows\System32\drivers\afd.sys
2012-01-21 22:16:59 613888 ----a-w- C:\Windows\System32\psisdecd.dll
2012-01-21 22:15:59 3072 ---ha-w- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
2012-01-21 22:11:46 976896 ----a-w- C:\Windows\System32\inetcomm.dll
2012-01-21 22:11:45 740864 ----a-w- C:\Windows\SysWow64\inetcomm.dll
2012-01-21 22:11:16 5507968 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-01-21 22:11:15 3957120 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-01-21 22:11:15 3902336 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-01-21 22:09:14 3141632 ----a-w- C:\Windows\System32\win32k.sys
2012-01-21 22:08:47 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe
2012-01-21 22:08:19 77312 ----a-w- C:\Windows\System32\packager.dll
2012-01-21 22:08:18 67072 ----a-w- C:\Windows\SysWow64\packager.dll
2012-01-21 22:08:16 9728 ----a-w- C:\Windows\SysWow64\sscore.dll
2012-01-21 22:08:16 236032 ----a-w- C:\Windows\System32\srvsvc.dll
2012-01-21 22:08:10 31232 ----a-w- C:\Windows\SysWow64\prevhost.exe
2012-01-21 22:08:10 31232 ----a-w- C:\Windows\System32\prevhost.exe
2012-01-21 17:58:24 243712 ----a-w- C:\Windows\System32\drivers\ks.sys
2012-01-21 17:58:24 184832 ----a-w- C:\Windows\System32\drivers\usbvideo.sys
2012-01-21 00:19:43 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-01-20 07:18:57 0 ----a-w- C:\Windows\ativpsrm.bin
2012-01-20 07:16:47 -------- d-----w- C:\Windows\Panther
2012-01-20 07:16:32 -------- d-sh--w- C:\Boot
2012-01-20 06:49:56 -------- d-----w- C:\Program Files (x86)\GIMP-2.0
2012-01-20 06:42:14 -------- d-----w- C:\Users\Mark\AppData\Local\Google
2012-01-20 06:37:07 -------- d-----w- C:\Users\Mark\AppData\Roaming\Dell
2012-01-20 06:36:14 -------- d-----w- C:\Users\Mark\AppData\Local\Stardock_Corporation
2012-01-20 06:36:07 -------- dc-h--w- C:\ProgramData\{CBCE2F73-24E4-481F-84B2-1A5EB720D187}
2012-01-20 06:35:52 -------- d-----w- C:\Program Files\Dell
2012-01-20 06:35:46 -------- d-sh--w- C:\Windows\Installer
2012-01-20 06:35:27 -------- d-----w- C:\Users\Mark\AppData\Local\PackageAware
2012-01-20 06:31:42 -------- d-----w- C:\Program Files (x86)\McAfee.com
2012-01-20 06:31:31 28760 ----a-w- C:\Program Files (x86)\Mozilla Firefox\ScriptFF.dll
2012-01-20 06:31:31 10248 ----a-w- C:\Windows\System32\drivers\mfeclnk.sys
2012-01-20 06:31:30 -------- d-----w- C:\Program Files (x86)\Common Files\McAfee
2012-01-20 06:31:02 75808 ----a-w- C:\Windows\System32\drivers\mfenlfk.sys
2012-01-20 06:31:02 65264 ----a-w- C:\Windows\System32\drivers\cfwids.sys
2012-01-20 06:31:02 481768 ----a-w- C:\Windows\System32\drivers\mfefirek.sys
2012-01-20 06:31:02 284648 ----a-w- C:\Windows\System32\drivers\mfewfpk.sys
2012-01-20 06:31:02 229528 ----a-w- C:\Windows\System32\drivers\mfeavfk.sys
2012-01-20 06:31:02 100912 ----a-w- C:\Windows\System32\drivers\mferkdet.sys
2012-01-20 06:30:59 -------- d-----w- C:\Program Files\Common Files\McAfee
2012-01-20 06:30:58 -------- d-----w- C:\Program Files\McAfee.com
2012-01-20 06:30:58 -------- d-----w- C:\Program Files\McAfee
2012-01-20 06:30:57 -------- d-----w- C:\Program Files (x86)\McAfee
2012-01-20 06:09:38 161168 ----a-w- C:\Windows\System32\mfevtps.exe
2012-01-20 05:48:17 -------- d-----w- C:\Users\Mark\AppData\Local\Thunderbird
2012-01-20 05:45:45 8602168 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{99AEBAE7-446B-4E1D-BD94-878ABBA8211F}\mpengine.dll
2012-01-20 05:45:43 270720 ------w- C:\Windows\System32\MpSigStub.exe
2012-01-20 05:31:29 -------- d-----w- C:\Users\Mark\AppData\Local\AOL
2012-01-20 05:31:29 -------- d-----w- C:\Users\Mark\AppData\Local\AIM
2012-01-20 05:31:17 -------- d-----w- C:\ProgramData\AIM
2012-01-20 05:31:15 -------- d-----w- C:\Program Files (x86)\Common Files\Software Update Utility
2012-01-20 05:31:15 -------- d-----w- C:\Program Files (x86)\AIM
2012-01-20 05:31:14 -------- d-----w- C:\Program Files (x86)\Common Files\AOL
2012-01-20 05:30:22 -------- d-----w- C:\Users\Mark\AppData\Local\Mozilla
2012-01-20 05:25:51 220672 ----a-w- C:\Windows\System32\wintrust.dll
2012-01-20 05:25:51 172032 ----a-w- C:\Windows\SysWow64\wintrust.dll
2012-01-20 05:25:51 139264 ----a-w- C:\Windows\System32\cabview.dll
2012-01-20 05:25:51 132608 ----a-w- C:\Windows\SysWow64\cabview.dll
.
==================== Find3M ====================
.
2011-12-21 00:02:26 4448256 ----a-w- C:\Windows\SysWow64\GPhotos.scr
2011-11-17 07:17:03 152432 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2011-11-17 07:17:02 95088 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2011-11-17 07:15:08 460296 ----a-w- C:\Windows\System32\drivers\cng.sys
2011-11-17 07:14:10 1739160 ----a-w- C:\Windows\System32\ntdll.dll
2011-11-17 07:12:02 395776 ----a-w- C:\Windows\System32\webio.dll
2011-11-17 07:11:33 28672 ----a-w- C:\Windows\System32\sspisrv.dll
2011-11-17 07:11:33 136192 ----a-w- C:\Windows\System32\sspicli.dll
2011-11-17 07:11:02 28160 ----a-w- C:\Windows\System32\secur32.dll
2011-11-17 07:10:58 340992 ----a-w- C:\Windows\System32\schannel.dll
2011-11-17 07:08:18 1446912 ----a-w- C:\Windows\System32\lsasrv.dll
2011-11-17 07:05:16 31232 ----a-w- C:\Windows\System32\lsass.exe
2011-11-17 05:41:38 1292592 ----a-w- C:\Windows\SysWow64\ntdll.dll
2011-11-17 05:39:28 314368 ----a-w- C:\Windows\SysWow64\webio.dll
2011-11-17 05:39:21 224768 ----a-w- C:\Windows\SysWow64\schannel.dll
2011-11-17 05:39:21 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2011-11-17 05:35:13 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2011-11-05 05:17:42 2048 ----a-w- C:\Windows\System32\tzres.dll
2011-11-05 04:30:11 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
.
============= FINISH: 22:08:29.04 ===============

Attached Files



#4 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 60,984 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:06:33 PM

Posted 28 January 2012 - 03:47 AM

Hello, my name is Elise and I'll assist you with this issue.

To check for Alureon, please do the following.

Try this please. You will need a USB drive.

Download GETxPUD.exe to the desktop of your clean computer
  • Run GETxPUD.exe
  • A new folder will appear on the desktop.
  • Open the GETxPUD folder and click on the get&burn.bat
  • The program will download xpud_0.9.2.iso, and upon finished will open BurnCDCC ready to burn the image.
  • Click on Start and follow the prompts to burn the image to a CD.
  • Remove the USB & CD and insert it in the sick computer
  • Boot the Sick computer with the CD you just burned
  • The computer must be set to boot from the CD
  • Gently tap F12 and choose to boot from the CD
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your USB drive (sdb1 ?)
  • Press Tool at the top
  • Choose Open Terminal
  • Type the following and press enter:

    dd if=/dev/sda of=mbr.bin bs=512 count=1

  • Press Enter
  • After it has finished a file will be located on your USB drive named mbr.bin
  • Remove the USB drive and insert it back in your working computer and navigate to mbr.bin, zip it up and attach it to your next reply.

This will allow me to have a look at the MasterBootRecord of your drive and see if it is infected.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#5 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 60,984 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:06:33 PM

Posted 07 February 2012 - 09:47 AM

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users