removing alureon.a

Psi*

Tech Monkey
I have not seen much here about virus issues. I believe that most of us "regulars" are smart enough to have an adequate prophylactic in place and just avoid *those* kind of web sites.

However, since no man is an island, aka I do have female friends that have considerable inertia in their thoughts (aka stubborn). I have a very attractive friend that persisted in drilling into a web site that her virus checker said "no no no no no no no no.... " well, you get the idea.

As a result, she asked me why her sound no longer played on her 5 y/o computer. Stupid me thinks the thing is actually dying. NOT!

Upon reboot, it does not.:mad: We go buy a new machine which she really needed anyway & therefore was not a painful decision.

Today I pull the HDD out of the old machine praying that I will be able to get some her old data. By a quirk of fate I have the Thermaltake external sata dual drive box thingy. In a greater act of providence, the old HDD is sata. This little box is plugged into my Windows 7 system running Microsoft Security Essentials (I am cheap because I 5 systems that I live & die with ... free fits the budget really well).

Dropping the old drive into the external drive box & then steering in Windows Explorer over to drive F ... been 10 yrs since I last went that high in the alphabet ... I see all kinds of directories & files. YES! The data is good and availble. (It will be a greate night tonight!!:D:D)

However, a moment later MS SE pops up complaining about dos/alureon.a. Ugh. A few reboots later convinces me that MS SE cannot remove the ... I guess it is a spyware. I plug the Thermaltake into an XP machine. XP doesn't eve see the drive. The olde machine that the HDD came out of is XP, BTW.

Going back to Windows 7 & several net searches later, I find a link to Kaspersky Lab
TDSS rootkit removing tool. Also something called MBRCheck & not sure what it does, but report stuff I cannot understand. Never the less, after 1 reboot & running the TDSS rootkit removing tool alureon.a seems to be extracted!! :eek::eek:

Anyone else had this issue? What did you do?
 

OriginalJoeCool

Tech Monkey
This one infects your master boot record (according to this site https://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan:DOS/Alureon.A&ThreatID=-2147330347) and tries to decrpyt a file called "ldr16".

The file is stored on the encrypted virtual file system (VFS) created by Trojan:Win32/Alureon.DX.

I don't remember ever "contracting" this virus, but I've had my share of encounters, especially when dealing with my sister's computer. Some of them even totally shut down your anti-virus when you try to do a scan. They can be very smart.
 

Rob Williams

Editor-in-Chief
Staff member
Moderator
If it's a master boot record virus, the best course of action would be to get the data off that drive and onto another, and then wipe the infected drive with a secure erase (HDD Erase). That should get rid of it, as it also cleans out the MBR, which a format sometimes doesn't do.

Sounds like a major pain in the ass... one of the worst kinds of infections to get I'd imagine.

I'd of course also recommend scanning that drive's data for the carriers as well, and remove them as needed.
 
Top