Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan:DOS/Alureon.E


  • This topic is locked This topic is locked
12 replies to this topic

#1 REIDS

REIDS

  • Members
  • 102 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 11 March 2012 - 04:28 PM

So, I just purchased a new computer because my previous computer's motherboard had some hardware issues. I am running Win 7 with a new hard drive. I have turned my previous hard disk into an external hard drive connected through USB (so that I can get all of my previous file info installed onto my new computer). When I connect my external drive, my "Microsoft Security Essentials" program finds the "Trojan:DOS/Alureon.E" virus on it. It continues to try and remove the virus, however, it requires an OS restart and everytime it restarts the same virus comes up. How do I search and destroy this virus off of my old hard drive?

Edit: Moved topic from Windows 7 to the more appropriate forum. ~ Animal

BC AdBot (Login to Remove)

 


#2 REIDS

REIDS
  • Topic Starter

  • Members
  • 102 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 11 March 2012 - 06:04 PM

Case closed. I found the base culprit file on my old hard drive that was trying to infect everything. Sorry for taking your time.

#3 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:36 AM

Posted 11 March 2012 - 07:25 PM

Did you remove a TDSS infection?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#4 REIDS

REIDS
  • Topic Starter

  • Members
  • 102 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 11 March 2012 - 08:56 PM

Case open. I guess I didn't remove it. I stopped getting the error for a few bootups and a few hours. Then all of a sudden MSE (Microsoft Security Essentials) suspended the action of this virus again. Now when I try to remove the virus the following error pops up in MSE: Error Code 0x800704ec. This program is blocked by group policy. For more information, contact your system administrator.

I am the system admin (or at least the head of household on my home computer). It says that the infected item is "boot:\HarddiskVolume10". Please let me know the proper way to remove this thing. I'm not sure if it is located on my old hard drive (via USB connection) or on my current boot partition.

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:36 AM

Posted 11 March 2012 - 09:22 PM

Lets try to run this,if normal fails try safe mode.



Download the FixTDSS.exe

Save the file to your Windows desktop.
Close all running programs.
If you are running Windows XP, turn off System Restore. How to turn off or turn on Windows XP System Restore
Double-click the FixTDSS.exe file to start the removal tool.
Click Start to begin the process, and then allow the tool to run.
Restart the computer when prompted by the tool.
After the computer has started, the tool will inform you of the state of infection (make sure to let me know what it said)
If you are running Windows XP, re-enable System Restore.




Now I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Under scan settings, check Posted Image and check Remove found threats
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image


NOTE: In some instances if no malware is found there will be no log produced.

Edited by boopme, 11 March 2012 - 09:23 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 REIDS

REIDS
  • Topic Starter

  • Members
  • 102 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 12 March 2012 - 01:56 AM

FixTDSS:
"No infections were found"

ESET:
L:\Reids Work Computer\Forms and Templates\Junk\Misc. Games\PopCap Games\Keygens\dynomite.deluxe.2.7.keygen-tsrh.zip a variant of Win32/Keygen.BP application deleted - quarantined
L:\Reids Work Computer\Forms and Templates\Junk\Misc. Games\PopCap Games\Keygens\rocket.mania.deluxe.1.0.keygen-tsrh.zip a variant of Win32/Keygen.BP application deleted - quarantined
N:\I Drive - Temp\Reids Work Computer\Forms and Templates\Junk\Misc. Games\PopCap Games\Keygens\dynomite.deluxe.2.7.keygen-tsrh.zip a variant of Win32/Keygen.BP application deleted - quarantined
N:\I Drive - Temp\Reids Work Computer\Forms and Templates\Junk\Misc. Games\PopCap Games\Keygens\rocket.mania.deluxe.1.0.keygen-tsrh.zip a variant of Win32/Keygen.BP application deleted - quarantined

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:36 AM

Posted 12 March 2012 - 11:55 AM

Ok, we found the source so I have to tell you this....

IMPORTANT NOTE: The practice of using cracking tools, keygens, warez or any pirated software is not only considered illegal activity but it is a serious security risk.

Cracking applications are used for illegally breaking (cracking) various copy-protection and registration techniques used in commercial software. These programs may be distributed via Web sites, Usenet, and P2P networks.

trendmicro.com/vinfo

...warez and crack web pages are being used by cybercriminals as download sites for malware related to VIRUT and VIRUX. Searches for serial numbers, cracks, and even antivirus products like Trend Micro yield malcodes that come in the form of executables or self-extracting files...quick links in these sites also lead to malicious files. Ads and banners are also infection vectors...

Keygen and Crack Sites Distribute VIRUX and FakeAV

...warez/piracy sites ranked the highest in downloading spyware...just opening the web page usually sets off an exploit, never mind actually downloading anything. And by the time the malware is finished downloading, often the machine is trashed and rendered useless.

University of Washington spyware study

...One of the most aggressive and intrusive of all bad websites on the Internet are serial, warez, software cracking type sites...they sneak malware onto your system...Where do trojan viruses originate? One of the biggest malware distributors on the Internet are serial/warez/code cracking sites.

Bad Web Sites: Malware

When you use these kind of programs, be forewarned that some of the worst types of malware infections can be contracted and spread by visiting crack, keygen, warez and other pirated software sites. In many cases, those sites are infested with a smörgåsbord of malware and an increasing source of system infection. Those who attempt to get software for free can end up with a computer system so badly damaged that recovery is not possible and it cannot be repaired. When that happens there is nothing you can do besides reformatting and reinstalling the OS.

Before we can continue, I need you to remove all cracks and keygens immediately to reduce the risk of infection/reinfection. If not, then we are just wasting time trying to clean your system. Further, other tools used during the disinfection process may detect crack and keygens so we need to ensure they have been removed.

Using these types of programs or the websites you visited to get them is almost a guaranteed way to get yourself infected!!





Next run MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware Posted Image and save it to your desktop.
  • Important!! When you save the mbam-setup file, rename it to something random (such as 123abc.exe) before beginning the download.
Malwarebytes may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

  • Make sure you are connected to the Internet and double-click on the renamed file to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • Malwarebytes will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button and continue.
  • If you cannot update Malwarebytes or use the Internet to download any files to the infected computer, manually update the database by following the instructions in FAQ Section A: 4. Issues.
  • Under the Scanner tab, make sure the "Perform Quick Scan" option is selected.
  • Click on the Scan button.
  • When finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box, then click the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked and then click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows the database version and your operating system.
  • Exit Malwarebytes when done.
Note: If Malwarebytes encounters a file that is difficult to remove, you will be asked to reboot your computer so it can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally will prevent Malwarebytes from removing all the malware.

-- Some types of malware will target Malwarebytes and other security tools to keep them from running properly. If that's the case, go to Start > All Programs > Malwarebytes Anti-Malware folder > Tools > click on Malwarebytes Chameleon and follow the onscreen instructions. The Chameleon folder can be accessed by opening the program folder for Malwarebytes Anti-Malware (normally C:\Program Files\Malwarebytes' Anti-Malware or C:\Program Files (x86)\Malwarebytes' Anti-Malware).



Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
Click the "Scan" button to start scan:
Posted Image

On completion of the scan click "Save log", save it to your desktop and post in your next reply:
Posted Image

NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 REIDS

REIDS
  • Topic Starter

  • Members
  • 102 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 13 March 2012 - 02:01 AM

MBAM Log is the following:

Malwarebytes Anti-Malware (Trial) 1.60.1.1000
www.malwarebytes.org

Database version: v2012.03.12.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
rstadel :: TGOE_DESKTOP [administrator]

Protection: Enabled

3/12/2012 11:39:29 PM
mbam-log-2012-03-12 (23-39-29).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 187661
Time elapsed: 1 minute(s), 45 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


aswMBR Log is the following (i don't have an option to attach the dat file to this post:

aswMBR version 0.9.9.1649 Copyright© 2011 AVAST Software
Run date: 2012-03-12 23:45:05
-----------------------------
23:45:05.328 OS Version: Windows x64 6.1.7601 Service Pack 1
23:45:05.328 Number of processors: 8 586 0x2A07
23:45:05.329 ComputerName: TGOE_DESKTOP UserName: rstadel
23:45:06.076 Initialize success
23:45:34.836 AVAST engine defs: 12031200
23:45:45.492 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
23:45:45.494 Disk 0 Vendor: WDC_WD50 15.0 Size: 476940MB BusType: 3
23:45:45.497 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-2
23:45:45.500 Disk 1 Vendor: WDC_WD50 15.0 Size: 476940MB BusType: 3
23:45:45.503 Disk 0 MBR read successfully
23:45:45.506 Disk 0 MBR scan
23:45:45.511 Disk 0 Windows 7 default MBR code
23:45:45.514 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
23:45:45.544 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 459479 MB offset 206848
23:45:45.593 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 17357 MB offset 941220929
23:45:45.692 Disk 0 scanning C:\Windows\system32\drivers
23:45:51.392 Service scanning
23:46:07.446 Modules scanning
23:46:07.784 Disk 0 trace - called modules:
23:46:07.799 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
23:46:07.804 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8009fbf790]
23:46:07.807 3 CLASSPNP.SYS[fffff88001a0143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8007b8c050]
23:46:08.807 AVAST engine scan C:\Windows
23:46:10.325 AVAST engine scan C:\Windows\system32
23:48:18.572 AVAST engine scan C:\Windows\system32\drivers
23:48:24.105 AVAST engine scan C:\Users\rstadel
23:49:18.596 AVAST engine scan C:\ProgramData
23:49:42.279 Scan finished successfully
23:50:30.242 Disk 0 MBR has been saved successfully to "C:\Users\rstadel\Desktop\Bleeping Computer\MBR.dat"
23:50:30.275 The log file has been saved successfully to "C:\Users\rstadel\Desktop\Bleeping Computer\aswMBR.txt"

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:36 AM

Posted 13 March 2012 - 05:31 PM

Ok I need to see this log and are you still haing both issues?

Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:
  • Flush DNS
  • Report IE Proxy Settings
  • Reset IE Proxy Settings
  • Report FF Proxy Settings
  • Reset FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Users, Partitions and Memory size.
Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 REIDS

REIDS
  • Topic Starter

  • Members
  • 102 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 13 March 2012 - 05:49 PM

I am still having the issue. As soon as I start the computer and the OS boots up, my version of MSE will have a pop up saying that it has stopped a security threat (which is a virus listed as the name of this post). If I wait for about 10-15 minutes, my internet connection will be interupted/stopped (I am assuming that this is being done by MSE). Remember, that this is a brand new computer & OS. I bought the system at a retail store and then created a restore/recovery disk with a USB Flash Memory Card. Then I removed the existing hard drive and replaced with a faster one and reinstalled the windows OS onto this disk. I believe I started getting the error messages when I connected my old hard drive to the computer. I will upload the contents of the txt file later today.

#11 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:36 AM

Posted 13 March 2012 - 06:00 PM

Ok,appears to be a protected Rootkit,to get it we need a deeper look. Please go here....Preparation Guide ,do steps 6-9.

Create a DDS log and post it in the new topic explained in step 9 which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
If GMER won't run skip it and move on.

Let me know if that went well.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#12 REIDS

REIDS
  • Topic Starter

  • Members
  • 102 posts
  • OFFLINE
  •  
  • Local time:10:36 PM

Posted 14 March 2012 - 05:23 PM

I posted this topic to the forum that you referenced below (yesteday), however, nobody has replied yet. Am I supposed to let you know when I posted or I just wait until someone responds?

Link to this post is the following: http://www.bleepingcomputer.com/forums/topic446171.html/page__p__2630602#entry2630602

#13 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,489 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:36 AM

Posted 14 March 2012 - 07:15 PM

Thank you......
Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRL Team member is already assisting you and not open the thread to respond.

Due to work load the current wait time is 1 - 3 days and ALL logs are answered.

To avoid confusion, I am closing this topi
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users