MBR:Alureon-K [Rtk]

Viruses and worms
21

Don’t worry about any delay… :slight_smile:

Malwarebytes

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.

Please run a free online scan with the ESET Online Scanner
[i]Note: You will need to use Internet Explorer for this scan[/i]
[*]Tick the box next to YES, I accept the Terms of Use
[*]Click Start
[*]When asked, allow the ActiveX control to install
[*]Click Start
[*]Make sure that the options Remove found threats is NOT selected and the option Scan unwanted applications is selected.
[*]Click Scan (This scan can take several hours, so please be patient)
[*]Once the scan is completed, you may close the window
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner[b]log.txt
[*]Copy and paste that log as a reply to this topic

In your next reply please attach the logs made by Malwarebytes and ESET online scanner. :slight_smile:

22

MBAM and ESET logs attached :slight_smile:

23

Hi,

I see you did not take action on the entries found by Malwarebytes? Those are PUPs (potentially unwanted programs) meaning that they may not be malware exactly but you may not want them on your system either. I would run Malwarebytes again and remove those entries if I were in your shoes. If you do remove them be sure to attach the new log made. If you choose not to remove them please let me know.

24

I decided to follow your suggestion and remove the PUPs. (I haven’t been sure wether to remove them or not earlier. I remember them being tools that download a certain programm. Never really understood why this is necessary…)

The new log is of course attached :slight_smile:

25

Hi,

[*]Please open Notepad (Start → Run → type notepad in the Open field → OK) and copy and paste the text present inside the code box below:


ClearJavaCache::

File::
C:\Programme\Veoh Networks\VeohWebPlayer\qlps-qlipso-sntb.exe

[*]Save this as CFScript.txt and change the “Save as type” to “All Files” and place it on your desktop.

http://img.photobucket.com/albums/v706/ried7/CFScriptB-4.gif

[*]Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause “unpredictable results”.
[*]Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
[*]ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
[*]When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix’s window while it is running. That may cause it to stall.

In your next reply please attach the log made by ComboFix and let me know how the system is running. :slight_smile:

26

Attached the ComboFix log.

After I used the script with ComboFix and it was done, i rescanned my system with avast. It had found 2 trojans and 1 malware file (sadly I didn’t remember noting the names of them down. I was kind of enthusiastic and decided to remove them which seems to have worked).

However avast suggested a start-up scan (I’m not sure if you call it that. A scan before the actual OS is booted or something). I did that and I must say I have been somewhat surprised.

“The file C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVAST Software\Avast\log\unp107783191.tmp.mdmp is infected by MBR:Alureon-K [Rtk]”

It found a couple more of these rootkits, all in this folder and only different by the number of the .tmp.mdmp file.

The rest seemed to be virus-free.

27

Hi,

Yes those are actually alright. What is being detected is that this is where avast unpacks archives to scan the contents from what we have been working on. They are not a problem and fine to remove.

Any other malware related problems that you see? :slight_smile:

28

I think that’s it for now :stuck_out_tongue:

I have one more question about removing these tmp.mdmp files tough. Do I have to use a tool to remove them or is it fine by putting them in the recycle bin and emptying it?

29

No just using the Recycle Bin will be fine. :slight_smile:

30

Okay :slight_smile:

Well then… thanks a lot for this awesome support the past few days ( I didn’t actually expect that :P) and keep up the good work ^^

31

;D ;D Glad that I could help!

Providing there are no other malware related problems…

IT APPEARS THAT YOUR LOGS ARE NOW CLEAN :smiley: SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!! :smiley:

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following text into the Run box as shown and click OK.
Combofix /Uninstall
(Note: There is a space between the …X and the /U that needs to be there.)

http://i1224.photobucket.com/albums/ee380/jeffce74/CF.jpg

Clean up with OTL:

[*]Right-click and Run as Administrator OTL.exe to start the program.
[*]Close all other programs apart from OTL as this step will require a reboot
[*]On the OTL main screen, press the CLEANUP button
[*]Say Yes to the prompt and then allow the program to reboot your computer.

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren’t cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:

[*]From within Internet Explorer click on the Tools menu and then click on Options.
[*]Click once on the Security tab
[*]Click once on the Internet icon so it becomes highlighted.
[*]Click once on the Custom Level button.
[*]Change the Download signed ActiveX controls to Prompt
[*]Change the Download unsigned ActiveX controls to Disable
[*]Change the Initialize and script ActiveX controls not marked as safe to Disable
[*]Change the Installation of desktop items to Prompt
[*]Change the Launching programs and files in an IFRAME to Prompt
[*]Change the Navigate sub-frames across different domains to Prompt
[*]When all these settings have been made, click on the OK button.
[*]If it prompts you as to whether or not you want to save the settings, press the Yes button.
[*]Next press the Apply button and then the OK to exit the Internet Properties page.

2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:
[*]Open Internet Explorer
[*]Click on Tools > Internet Options
[*]Press Security tab
[*]Select Internet zone then place check next to Enable Protected Mode if not already done
[*]Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
[*]Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.

3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here. **There are firewalls listed in this tutorial that could be downloaded and used but I would personally only recommend using one of the following two below:
Online Armor Free
Agnitum Outpost Firewall Free

5. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

6. WOT (Web of Trust) As “Googling” is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT’s color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

7.Finally, I strongly recommend that you read TonyKlein’s good advice So how did I get infected in the first place?

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

32

Okay so I’ve done about everything mentioned in your post (removed the uneccessary tools, secured IE, installed a firewall (OnlineArmor) and WOT. Then I’ve read TonyKlein’s text and installed SpywareBlaster, SuperAntiSpyware and Secunia Personal Software Inspector)

Now I’ve noticed that it takes a rather long time for me to log in my computer. It boots in normal pace, but when I enter my account password it takes up to two minutes to load everything.
Is this normal with all these new protection software, and is there a way to fasten up the process?

33

Hi,

Do you still have Spyhunter Security Suite on your system? If so it runs in real-time as well as Avast does. You might go ahead and remove that program and that may speed up your system. :slight_smile:

34

I never had Spyhunter Security Suite active. I installed it when I was googling for Alureon-K and found this programm. After installation I noticed it’s one of these programmes that display (possibly wrong?) infections and other errors, but in order to fix them you need to pay and buy the full version.

I deinstalled it already, so I don’t think this programme is the reason. :confused:

35

Hi,

Sorry for any delay…I am preparing to close on the sale of my old home and purchase of my new home.

Are you experiencing any malware related problems…popups, redirects? A computer can be slow for many reasons that are not malware related. I just want to be sure we aren’t looking in the wrong directions. :slight_smile:

36

Don’t worry, I’m fine with any delay (not really quick replying myself).

No, I don’t have any pop-ups nor redirects and my scanners (Malware Bites, avast and SuperAntiSpyware) don’t find a threat.
I usually disable SuperAntiSpyware and only use it for scans (which fastened my computer a bit) but it’s still very slow, especially when browsing the web or opening folders. (The Login however could be fixed by disabling SuperAntiSpyware).

37

We may need to just do some TLC.

Download TFC to your desktop

[*]Close any open windows.
[*]Right-click and Run as Administrator the TFC icon to run the program
[*]TFC will close all open programs itself in order to run,
[*]Click the Start button to begin the process.
[*]Allow TFC to run uninterrupted.
[*]The program should not take long to finish it’s job
[*]Once its finished it should automatically reboot your machine,
[*]if it doesn’t, manually reboot to ensure a complete clean

Go to Start >> Run >> type msconfig >> Startup tab and take a screen shot of the programs that are there to attach here.

You might do well by run a defrag program if you have one…even the Windows Defrag. That might help as well. :slight_smile: