Aureon.k Found Disk 0, Partion 3

Viruses and worms
1

aswmbr shows Aureon.k present. See attached

OTL log. See attached. Could not attach “Extras”

Had to paste

Malawarebytes shows nothing. See below.

What next to remove this problem?

Malwarebytes’ Anti-Malware 1.25
Database version: 1062
Windows 5.1.2600 Service Pack 3

11:49:19 AM 8/26/2008
mbam-log-08-26-2008 (11-49-19).txt

Scan type: Quick Scan
Objects scanned: 63079
Time elapsed: 7 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

2

Thank you for posting your logs. I am going to refer you to our Certified Malware expert, named Essexboy. He will also review your logs and give you further instructions. He will respond to you in this thread, so remember to check this thread daily.

Please do not make any further changes to your machine after you have provided the logs.

IMPORTANT: If you are on a home network, disconnect the affected machine from the network. Do not share a USB/flash drive with this affected machine. Do not use this machine unless Essexboy instructs you do to malware removal instructions; use a different machine to check email, sync your phone, etc. if possible.

Let us know if you have any questions. Thank you.

3

Hi could you copy aswMBR to your C drive root please i.e. C:\aswMBR

Then run the following command

Go Start > Run
Or press the windows and R key together
Copy and then paste the bold command below
Then press OK

aswMBR.exe -ap 1

Once it has run then reboot and re-run an aswMBR scan

NEXT

[*] Download RogueKiller and save it on your desktop.
[*]Quit all programs
[*] Start RogueKiller.exe.
[*] Wait until Prescan has finished …
[*] Click on Scan

http://i1224.photobucket.com/albums/ee362/Essexboy3/RogueKiller/RGKRScan.png

[*]Wait for the end of the scan.
[*] The report has been created on the desktop.
[*] Click on the Delete button.

http://i1224.photobucket.com/albums/ee362/Essexboy3/RogueKiller/RGKRDelete.png

[*]The report has been created on the desktop.

[*]Next click on the ShortcutsFix

http://i1224.photobucket.com/albums/ee362/Essexboy3/RogueKiller/RGKRShortcutsFix.png

[*]The report has been created on the desktop.

Please post: All RKreport.txt text files located on your desktop.

FINALLY

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL DRV - File not found [Kernel | Boot | Stopped] -- System32\drivers\filbdbng.sys -- (heyuvea) O28 - HKLM ShellExecuteHooks: {a5780613-492e-4a2a-a7fd-549610edf6cc} - No CLSID value found. [2011/01/27 17:44:07 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Lkoduwonezonuso.bin [2011/01/27 17:44:07 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Pnitilita.dat

:Files
ipconfig /flushdns /c
xcopy %Temp%\smtmp\1 “%AllUsersProfile%\Start Menu” /H /I /S /Y /C
xcopy %Temp%\smtmp\2 “%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch” /H /I /S /Y /C
xcopy %Temp%\smtmp\3 “%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar” /H /I /S /Y /C
xcopy %Temp%\smtmp\4 “%AllUsersProfile%\Desktop” /H /I /S /Y /C

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

4

Thanks for the reply

Copied aswmbr to c drive and ran command aswmbr.exe -ap 1.

Received reply that changing partions could make my machine “unbootable” and gave me a yes / no answer. see attached

Should I say yes?

5

Answer yes please

6

rebooted PC.

System is asking to run diagnostics. choices are test momory, test system exit

Which one to select ?

7

Run test system and then exit

8

Thanks

Running express test

received error code 0f00:137B
IDE Device faled blank media or no media is present in optical drive…

Asks if I wish to continue testing. Choices are yes / no/ retry. I am guessing “no”.

Which choice to pick?

9

Aye no will do

10

Exch time I exit the tests the system reboots back to the diagnostic

How do I get to a C prompt to run aswmbr?

11

Reboot the computer, press F8 to get to the safe mode menu
Select command prompt
Type in the following

aswMBR.exe -ap 2

12

If that fails then do the following

I need you to download: gparted-live-0.10.0-3.iso (115.1 MB)

Create a bootable CD, for Gparted from the ISO images. You can use ImgBurn do this.

Now boot off of the newly created Gparted CD.

http://img829.imageshack.us/img829/5772/gpartedsplash.th.png

You should be here…
Press ENTER

http://img5.imageshack.us/img5/7286/gpartedkeymaps.th.png

By default, “do not touch keymap” is highlighted. Leave this setting alone and just press ENTER.

http://img404.imageshack.us/img404/9840/gpartedlanguage.th.png

Choose your language and press ENTER. English is default [33]

http://img140.imageshack.us/img140/7958/gpartedgui.th.png

Once again, at this prompt, press ENTER

You will now be taken to the main GUI screen below

http://img32.imageshack.us/img32/1122/gpartedo.th.png

According to your logs, the partition that you want to delete is 8 MB
Click the trash can icon to delete and then click Apply.

You should now be here confirming your actions:

http://img233.imageshack.us/img233/1533/gpartedsteps.th.png

Now you should be here:

http://img696.imageshack.us/img696/8471/gpartedsuccessclose.th.png

http://img194.imageshack.us/img194/7753/gpartedboot.th.png

Is “boot” next to your OS drive?

If “boot” is not next to your OS drive under “Flags”, right-mouse click the OS drive while in Gparted and select Manage Flags

In the menu that pops up, place a checkmark in boot like the picture below:

http://img196.imageshack.us/img196/3483/gpartedmanageflagsboot.th.png

Now double-click the
http://img822.imageshack.us/img822/641/gpartedexit.png
button.

You should receive a small pop up like this:

http://img88.imageshack.us/img88/8986/gpartedexitreboot.png

Choose reboot and then press OK.

13

Need to download gparted-live and change boot menu to boot from the CD

Successfully deleted partion 3

Partion 1 labeled “dell utility” is flagged as “boot”

Once I exit do I need to:

  • change boot menu back to boot from c drive ?

  • reboot in safe mode then run aswmbr?

14

Correct make the C drive (windows ) the boot partition - It was an error on my part I set the wrong partition to boot

Reboot to normal windows and re-run aswMBR please

15

rebooted but got back to the test program

does this mean I should flag partion 2 as “boot” then reboot to normal windows?

16

Yes sorry I did not make that clear partition 2 is the one that contains windows and should be set to active (boot)

17

no problem

Attached is the log from the most erecent scan by aswmbr. No suspecious file shown.

Shall I continue with downloading / runiing rogue killer, OTL and send you the logs?

Looks like progress to me…

18

Yes please as you appear to have some of your files and folders hidden

Again my apologies for the mess up I made

19

finished running roguekiller and OTL. See attached logs.

Question - after rogue killer ran a shortcut appeared in my launch bar “C:\Documents and Settings\All Users\Application Data\cLs6hQYQTPuePT.exe”. It says “System check”

Is this exe file safe?

Next steps?

20

Just checking OTL now - but it looks like roguekiller did its trick ;D I will try to get the remainder back

¤¤¤ File attributes restored: ¤¤¤
Desktop: Success 0 / Fail 0
Quick launch: Success 0 / Fail 0
Programs: Success 3 / Fail 0
Start menu: Success 0 / Fail 0
User folder: Success 32 / Fail 0
My documents: Success 2 / Fail 0
My favorites: Success 0 / Fail 0
My pictures: Success 0 / Fail 0
My music: Success 0 / Fail 0
My videos: Success 0 / Fail 0
Local drives: Success 5023 / Fail 0
Backup: [FOUND] Success 19 / Fail 252