Hello there guys,
I need some help with this Alureon-k. I’ve tried to remove it by following some other forum’s tutorials but it’s always there.
The note is an Acer Aspire 5610, win XP.
Thank you very much in advance!
Marcio
This needs further analysis by a malware removal specialist:
Go to this topic http://forum.avast.com/index.php?topic=53253.0 for information on Logs to assist in cleaning malware. Use the information about getting and using the tools and attach the logs here, not in the LOGS topic.
Thanks for the quick response!
There go the files you need.
Essexboy should arrive here in a couple of hours 
Hi
Do the following:
Start → Run
type diskmgmt.msc
Click “OK”
Disk Management will open.
Click and hold the right side of the Disk Management Window and drag it to the right until you can see all the columns.
Locate the partition that is 2 MB
Right click the partition and select delete
Re-run aswMBR and post the log please
Here we go
OK lets now get rid of the other nasty
Download and Install Combofix
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
- IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks
http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png
http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png
[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.
Notes:
- Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
- Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
- If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
Do you need the entire file?
For when trying to reply with it attached I’m getting the message:
An Error Has Occurred!
The upload folder is full. Please try a smaller file and/or contact an administrator.
There appears to be a problem on the forum
Could you upload the log to mediafire and post the sharing link please
http://www.mediafire.com/
Looks good - are there any other problems ?
No! seems nice now! Thank you guys for all the support!
You do need to update to SP3
Subject to no further problems 
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean 
A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
:Commands [resethosts] [emptytemp] [CLEARALLRESTOREPOINTS] [Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
Remove ComboFix
[*]Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
[*]In the Run box, type in ComboFix /Uninstall
(Notice the space between the “x” and “/”)
then click OK
http://i1224.photobucket.com/albums/ee362/Essexboy3/Misc%20screen%20shots/CF_Uninstall-1.jpg
[]Follow the prompts on the screen
[]A message should appear confirming that ComboFix was uninstalled
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.
We will now confirm that your hidden files are set to that, as some of the tools I use will change that
[*]Click Start.
[*]Open My Computer.
[*]Select the Tools menu and click Folder Options.
[*]Select the View Tab.
[*]Under the Hidden files and folders heading select Do not show hidden files and folders.
[]Click Yes to confirm.
[]Click OK.
http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif
Your Java is out of date.
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.
Upgrading Java:
[] Go to this site and click Do I have Java
[] It will check your current version and then offer to update to the latest version
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
http://img233.imageshack.us/img233/7729/mbamicontw5.gif
Malwarebytes.
Update and run weekly to keep your system clean
Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link
It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
[*]Microsoft Windows Update
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe 
I’ve got this one too! Well, the work computer does. And not from me. :-\ Woah boy what a killer! I’m scanning upon startup right now, we’ll see how that goes and I will use the instructions Essex posted if that don’t work. I removed probably 12 different threats, 200+ infections. The MBR is the last one.
so, my question is , will all the icons come back after this bugger (correction: Monster) is deleted?
I should really consider doing this as a job, lol…
If you have “lost” your icons and folders then do not empty any temporary folders
Follow the destructions here http://forum.avast.com/index.php?topic=53253.0
RogueKiller should restore the vast majority of icons and kill the malware
aswMBR will determine which type of MBR infection you have, as there are several variants out there and each needs to be approached differently
Then either create a new topic or post here as this one appears to be finished