Infected with MBR:Alureon-K. Avast sees it but can't remove it

Viruses and worms
1

This has been a long battle. Initially the PC was showing no icons and I could run Malwarebytes only in safe mode as the administrator. Malwarebytes found some threats and removed them but there were still no icons. After a bit of research I cam across unhide. After running unhide.exe (from bleepingcomputer.com) the accessories folder returned and I could choose a restore point. Everything was back to normal except Avast highlighted two threats

MBR:Alureon-K and Win32:Dropper-Kpj. There was an option to move to the chest which I selected. Win32 was moved successfully but Alureon-K would not move. I tried to delete it…same result.

When I run Malwarebytes it finds no threats. Avast continues to find Alureon-K. The PC is operating perfectly for the moment.

I’ve attached the MBAM log, the OTL & Extras log and the aswMBR log and have my fingers crossed that you can help me.

2

Could you go to Start > Run then copy/paste the following command:

aswMBR.exe -ap 2

Press OK and reboot on completion

Then rescan with aswMBR

Meanwhile I will look at the OTL log

3

I’ve copied “aswMBR.exe -ap 2” into start/run but it reports that it can’t find aswMBR. I have the aswMBR.exe sitting on the desktop. Should it be somewhere else?

Thanks

4

Nope it is being blocked… But I have other ways of killing it

Download the latest version of TDSSKiller from here and save it to your Desktop.

[*]Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_1.jpg

[*]Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_2.jpg

[*]Click the Start Scan button.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_3.jpg

[*]If a suspicious object is detected, the default action will be Skip, click on Continue.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_4.jpg

[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.
[*]Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_5.jpg

[*]Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

A report will be created in your root directory, (usually C:\ folder) in the form of “TDSSKiller.[Version][Date][Time]_log.txt”. Please copy and paste its contents on your next reply.

5

Hi, “Cure” wasn’t available so I selected skip as suggested.

I’ve attached the TDSS report as it was over the maximum 1000 characters allowed in your message system.

Thanks for such prompt replies. It’s superb customer service.

6

Re-run TDSSKiller and if this item appears select delete :

\Device\Harddisk0\DR0 ( TDSS File System )

How is the computer running now ? Any further problems ?

7

Although the re-run of TDSSkiller found 12 threats they were described as medium risk. The file you said to look out for wasn’t on the list. So, I ran another Avast scan and this time it found no threats. I’m happy with that.

Thank you again. I shall be recommending Avast to anyone who needs to know.

8

OK not quite finished yet, once done can you let me know if you have all your icons and menus back

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from “Start with Windows”
Reboot and then run OTL

http://i1224.photobucket.com/albums/ee362/Essexboy3/mbamstop.jpg

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL DRV - File not found [Kernel | On_Demand | Stopped] -- C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20090311.001\symidsco.sys -- (SYMIDSCO) [2011/01/02 03:11:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pKkCfLj06502

:Files
ipconfig /flushdns /c
xcopy %Temp%\smtmp\1 “%AllUsersProfile%\Start Menu” /H /I /S /Y /C
xcopy %Temp%\smtmp\2 “%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch” /H /I /S /Y /C
xcopy %Temp%\smtmp\3 “%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar” /H /I /S /Y /C
xcopy %Temp%\smtmp\4 “%AllUsersProfile%\Desktop” /H /I /S /Y /C

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.